@sip-protocol/sdk 0.6.22 → 0.6.23

package/dist/browser.js

@@ -5434,9 +5434,29 @@ async function createShieldedIntent(params, options) {
       const cleanHex = hex.startsWith("0x") ? hex.slice(2) : hex;
       return (0, import_utils6.hexToBytes)(cleanHex);
     };
-    const effectiveOwnershipSig = ownershipSignature ?? (0, import_utils6.randomBytes)(64);
     const effectiveSenderSecret = senderSecret ?? (0, import_utils6.randomBytes)(32);
-    const effectiveAuthSig = authorizationSignature ?? (0, import_utils6.randomBytes)(64);
+    const intentHashBytes = (0, import_sha2565.sha256)(new TextEncoder().encode(intentId));
+    const intentHashHex = hash(intentId);
+    let effectiveOwnershipSig;
+    let effectiveAuthSig;
+    if (ownershipSignature && authorizationSignature) {
+      effectiveOwnershipSig = ownershipSignature;
+      effectiveAuthSig = authorizationSignature;
+    } else if (allowPlaceholders && !senderSecret) {
+      effectiveOwnershipSig = (0, import_utils6.randomBytes)(64);
+      effectiveAuthSig = (0, import_utils6.randomBytes)(64);
+      console.warn(
+        "[createShieldedIntent] WARNING: Using placeholder signatures for proof generation. These proofs are NOT cryptographically valid. Do NOT use in production!"
+      );
+    } else {
+      const { secp256k1: secp256k110 } = await import("@noble/curves/secp256k1");
+      const publicKey = secp256k110.getPublicKey(effectiveSenderSecret, true);
+      const senderAddressBytes = (0, import_sha2565.sha256)(publicKey);
+      const ownershipSig = secp256k110.sign(senderAddressBytes, effectiveSenderSecret);
+      effectiveOwnershipSig = ownershipSig.toCompactRawBytes();
+      const authSig = secp256k110.sign(intentHashBytes, effectiveSenderSecret);
+      effectiveAuthSig = authSig.toCompactRawBytes();
+    }
     const fundingResult = await proofProvider.generateFundingProof({
       balance: input.amount,
       minimumRequired: input.amount,

package/dist/browser.mjs

@@ -263,7 +263,7 @@ import {
   walletRegistry,
   withSecureBuffer,
   withSecureBufferSync
-} from "./chunk-NM5PTCQ5.mjs";
+} from "./chunk-CHC3HKUM.mjs";
 import {
   fulfillment_proof_default,
   funding_proof_default,

package/dist/{chunk-NM5PTCQ5.mjs → chunk-CHC3HKUM.mjs}

@@ -1777,9 +1777,29 @@ async function createShieldedIntent(params, options) {
       const cleanHex = hex.startsWith("0x") ? hex.slice(2) : hex;
       return hexToBytes4(cleanHex);
     };
-    const effectiveOwnershipSig = ownershipSignature ?? randomBytes6(64);
     const effectiveSenderSecret = senderSecret ?? randomBytes6(32);
-    const effectiveAuthSig = authorizationSignature ?? randomBytes6(64);
+    const intentHashBytes = sha2565(new TextEncoder().encode(intentId));
+    const intentHashHex = hash(intentId);
+    let effectiveOwnershipSig;
+    let effectiveAuthSig;
+    if (ownershipSignature && authorizationSignature) {
+      effectiveOwnershipSig = ownershipSignature;
+      effectiveAuthSig = authorizationSignature;
+    } else if (allowPlaceholders && !senderSecret) {
+      effectiveOwnershipSig = randomBytes6(64);
+      effectiveAuthSig = randomBytes6(64);
+      console.warn(
+        "[createShieldedIntent] WARNING: Using placeholder signatures for proof generation. These proofs are NOT cryptographically valid. Do NOT use in production!"
+      );
+    } else {
+      const { secp256k1: secp256k19 } = await import("@noble/curves/secp256k1");
+      const publicKey = secp256k19.getPublicKey(effectiveSenderSecret, true);
+      const senderAddressBytes = sha2565(publicKey);
+      const ownershipSig = secp256k19.sign(senderAddressBytes, effectiveSenderSecret);
+      effectiveOwnershipSig = ownershipSig.toCompactRawBytes();
+      const authSig = secp256k19.sign(intentHashBytes, effectiveSenderSecret);
+      effectiveAuthSig = authSig.toCompactRawBytes();
+    }
     const fundingResult = await proofProvider.generateFundingProof({
       balance: input.amount,
       minimumRequired: input.amount,

package/dist/index.js

@@ -5421,9 +5421,29 @@ async function createShieldedIntent(params, options) {
       const cleanHex = hex.startsWith("0x") ? hex.slice(2) : hex;
       return (0, import_utils6.hexToBytes)(cleanHex);
     };
-    const effectiveOwnershipSig = ownershipSignature ?? (0, import_utils6.randomBytes)(64);
     const effectiveSenderSecret = senderSecret ?? (0, import_utils6.randomBytes)(32);
-    const effectiveAuthSig = authorizationSignature ?? (0, import_utils6.randomBytes)(64);
+    const intentHashBytes = (0, import_sha2565.sha256)(new TextEncoder().encode(intentId));
+    const intentHashHex = hash(intentId);
+    let effectiveOwnershipSig;
+    let effectiveAuthSig;
+    if (ownershipSignature && authorizationSignature) {
+      effectiveOwnershipSig = ownershipSignature;
+      effectiveAuthSig = authorizationSignature;
+    } else if (allowPlaceholders && !senderSecret) {
+      effectiveOwnershipSig = (0, import_utils6.randomBytes)(64);
+      effectiveAuthSig = (0, import_utils6.randomBytes)(64);
+      console.warn(
+        "[createShieldedIntent] WARNING: Using placeholder signatures for proof generation. These proofs are NOT cryptographically valid. Do NOT use in production!"
+      );
+    } else {
+      const { secp256k1: secp256k19 } = await import("@noble/curves/secp256k1");
+      const publicKey = secp256k19.getPublicKey(effectiveSenderSecret, true);
+      const senderAddressBytes = (0, import_sha2565.sha256)(publicKey);
+      const ownershipSig = secp256k19.sign(senderAddressBytes, effectiveSenderSecret);
+      effectiveOwnershipSig = ownershipSig.toCompactRawBytes();
+      const authSig = secp256k19.sign(intentHashBytes, effectiveSenderSecret);
+      effectiveAuthSig = authSig.toCompactRawBytes();
+    }
     const fundingResult = await proofProvider.generateFundingProof({
       balance: input.amount,
       minimumRequired: input.amount,

package/dist/index.mjs

@@ -253,7 +253,7 @@ import {
   walletRegistry,
   withSecureBuffer,
   withSecureBufferSync
-} from "./chunk-NM5PTCQ5.mjs";
+} from "./chunk-CHC3HKUM.mjs";
 import {
   CryptoError,
   EncryptionNotImplementedError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sip-protocol/sdk",
-  "version": "0.6.22",
+  "version": "0.6.23",
   "description": "Core SDK for Shielded Intents Protocol - Privacy layer for cross-chain transactions",
   "author": "SIP Protocol <hello@sip-protocol.org>",
   "homepage": "https://sip-protocol.org",

package/src/intent.ts

@@ -555,12 +555,48 @@ export async function createShieldedIntent(
       return hexToBytes(cleanHex)
     }
 
-    // Use provided signatures or placeholders (if allowed)
+    // Use provided signatures or generate them from senderSecret
     // IMPORTANT: senderSecret must be random even for placeholders, as secp256k1
     // rejects all-zero private keys. randomBytes generates cryptographically secure random values.
-    const effectiveOwnershipSig = ownershipSignature ?? randomBytes(64)
     const effectiveSenderSecret = senderSecret ?? randomBytes(32)
-    const effectiveAuthSig = authorizationSignature ?? randomBytes(64)
+
+    // Compute the intent hash that will be used in the circuit
+    const intentHashBytes = sha256(new TextEncoder().encode(intentId))
+    const intentHashHex = hash(intentId) as HexString
+
+    // Generate ECDSA signatures using senderSecret if not provided
+    // This ensures the signature matches the intentHash computed internally
+    let effectiveOwnershipSig: Uint8Array
+    let effectiveAuthSig: Uint8Array
+
+    if (ownershipSignature && authorizationSignature) {
+      // Use provided signatures
+      effectiveOwnershipSig = ownershipSignature
+      effectiveAuthSig = authorizationSignature
+    } else if (allowPlaceholders && !senderSecret) {
+      // Placeholder mode with no senderSecret - use random bytes (won't verify)
+      effectiveOwnershipSig = randomBytes(64)
+      effectiveAuthSig = randomBytes(64)
+      console.warn(
+        '[createShieldedIntent] WARNING: Using placeholder signatures for proof generation. ' +
+        'These proofs are NOT cryptographically valid. Do NOT use in production!'
+      )
+    } else {
+      // Generate real ECDSA signatures using senderSecret
+      const { secp256k1 } = await import('@noble/curves/secp256k1')
+
+      // Derive sender address from senderSecret (hash of public key)
+      const publicKey = secp256k1.getPublicKey(effectiveSenderSecret, true)
+      const senderAddressBytes = sha256(publicKey)
+
+      // Sign the sender address for ownership proof
+      const ownershipSig = secp256k1.sign(senderAddressBytes, effectiveSenderSecret)
+      effectiveOwnershipSig = ownershipSig.toCompactRawBytes()
+
+      // Sign the intent hash for authorization proof
+      const authSig = secp256k1.sign(intentHashBytes, effectiveSenderSecret)
+      effectiveAuthSig = authSig.toCompactRawBytes()
+    }
 
     // Generate funding proof
     // Note: The funding proof proves balance >= minimumRequired