@smartledger/bsv 7.12.0 → 8.0.0

package/lib/crypto/random.js

@@ -1,37 +1,94 @@
 'use strict'
 
+// WebCrypto refuses more than 65,536 bytes in a single getRandomValues() call, so large
+// requests are filled in chunks. Node's randomBytes has no such limit, which is why this
+// only matters on the WebCrypto path.
+var MAX_GET_RANDOM_VALUES = 65536
+
 function Random () {
 }
 
-/* secure random bytes that sometimes throws an error due to lack of entropy */
+/**
+ * Cryptographically secure random bytes.
+ *
+ * Backend selection is by FEATURE DETECTION, not by environment guess. This previously
+ * branched on `process.browser` — a Browserify-era convention that is undefined in React
+ * Native, Deno, Cloudflare Workers, Bun, and any bundler that does not shim it. All of
+ * those fell through to `require('crypto').randomBytes`. In React Native that is a hard
+ * failure at best; at worst a partial crypto shim (rn-nodeify and several RN starter
+ * templates register one) supplies a weak `randomBytes`, and `PrivateKey.fromRandom()`
+ * silently produces guessable keys.
+ *
+ * `globalThis.crypto.getRandomValues` covers browsers, Node >= 19, Deno, Workers, Bun,
+ * and React Native with react-native-get-random-values, so it is tried first.
+ *
+ * If no CSPRNG can be found this THROWS. That is as important as the detection: a key
+ * library must never return bytes it cannot vouch for.
+ *
+ * @param {number} size - number of bytes
+ * @returns {Buffer}
+ */
 Random.getRandomBuffer = function (size) {
-  if (process.browser) { return Random.getRandomBufferBrowser(size) } else { return Random.getRandomBufferNode(size) }
+  var webcrypto = typeof globalThis !== 'undefined' ? globalThis.crypto : undefined
+  if (webcrypto && typeof webcrypto.getRandomValues === 'function') {
+    return Random._fromGetRandomValues(webcrypto, size)
+  }
+
+  // Node < 19 has no global crypto. Kept as a fallback rather than the default.
+  try {
+    var nodeCrypto = require('crypto')
+    if (nodeCrypto && typeof nodeCrypto.randomBytes === 'function') {
+      return nodeCrypto.randomBytes(size)
+    }
+  } catch (e) { /* no node crypto in this environment */ }
+
+  throw new Error('bsv: no CSPRNG available in this environment (needs globalThis.crypto.getRandomValues or node crypto)')
 }
 
+/**
+ * Fill `size` bytes from a WebCrypto instance, respecting the per-call limit.
+ * @private
+ */
+Random._fromGetRandomValues = function (webcrypto, size) {
+  var buf = Buffer.alloc(size)
+  for (var offset = 0; offset < size; offset += MAX_GET_RANDOM_VALUES) {
+    var chunk = new Uint8Array(Math.min(MAX_GET_RANDOM_VALUES, size - offset))
+    webcrypto.getRandomValues(chunk)
+    Buffer.from(chunk).copy(buf, offset)
+  }
+  return buf
+}
+
+/**
+ * Node-specific CSPRNG. Retained as public API; `getRandomBuffer` no longer routes
+ * here by default.
+ */
 Random.getRandomBufferNode = function (size) {
   var crypto = require('crypto')
   return crypto.randomBytes(size)
 }
 
+/**
+ * WebCrypto CSPRNG. Retained as public API.
+ *
+ * Reads `globalThis` rather than a bare `window`, which does not exist in Web Workers,
+ * Node, or React Native.
+ */
 Random.getRandomBufferBrowser = function (size) {
-  if (!window.crypto && !window.msCrypto) {
-    throw new Error('window.crypto not available')
+  var g = typeof globalThis !== 'undefined' ? globalThis : {}
+  var crypto = null
+
+  if (g.crypto && typeof g.crypto.getRandomValues === 'function') {
+    crypto = g.crypto
+  } else if (g.msCrypto && typeof g.msCrypto.getRandomValues === 'function') { // internet explorer
+    crypto = g.msCrypto
   }
-  var crypto
 
-  if (window.crypto && window.crypto.getRandomValues) {
-    crypto = window.crypto
-  } else if (window.msCrypto && window.msCrypto.getRandomValues) { // internet explorer
-    crypto = window.msCrypto
-  } else {
+  if (!crypto) {
     throw new Error('window.crypto.getRandomValues not available')
   }
 
-  var bbuf = new Uint8Array(size)
-  crypto.getRandomValues(bbuf)
-  var buf = Buffer.from(bbuf)
-
-  return buf
+  return Random._fromGetRandomValues(crypto, size)
 }
 
 module.exports = Random

package/lib/didweb/index.js

@@ -58,6 +58,44 @@ async function generateIssuerKeys(opts) {
   }
 }
 
+// The five verification relationships DID Core defines. They exist to be DISTINCT:
+// `authentication` proves who you are right now, `assertionMethod` makes a claim that
+// outlives the session. Keeping them apart is what stops a low-friction login signature
+// from being redeemed as a signed statement.
+//
+// This module used to cross-list every key into both, which erased the distinction and
+// left a caller unable to express "this key may log in but may not make assertions".
+var VERIFICATION_RELATIONSHIPS = [
+  'authentication',
+  'assertionMethod',
+  'keyAgreement',
+  'capabilityInvocation',
+  'capabilityDelegation'
+]
+
+// Preserves the historical output when a key does not say otherwise.
+var DEFAULT_RELATIONSHIPS = ['authentication', 'assertionMethod']
+
+/**
+ * Resolve the verification relationships for a key descriptor.
+ *
+ * @param {object} key - `{ kid, jwk, relationships? }`
+ * @returns {Array<string>}
+ */
+function relationshipsFor (key) {
+  var rels = key.relationships || DEFAULT_RELATIONSHIPS
+  if (!Array.isArray(rels) || rels.length === 0) {
+    throw new Error('relationships must be a non-empty array of DID Core verification relationships')
+  }
+  rels.forEach(function (rel) {
+    if (VERIFICATION_RELATIONSHIPS.indexOf(rel) === -1) {
+      throw new Error('unknown verification relationship: ' + rel +
+        ' (expected one of ' + VERIFICATION_RELATIONSHIPS.join(', ') + ')')
+    }
+  })
+  return rels
+}
+
 // Build did:web documents (did.json and jwks.json)
 function buildDidWebDocuments(params) {
   if (!params.domain) {
@@ -68,6 +106,7 @@ function buildDidWebDocuments(params) {
   var did = 'did:web:' + domain.replace(/:/g, '%3A')
   
   var verificationMethods = []
+  var methodRelationships = []
   var publicKeys = []
 
   // Add P-256 key if provided
@@ -79,6 +118,7 @@ function buildDidWebDocuments(params) {
       publicKeyJwk: params.p256.jwk
     }
     verificationMethods.push(p256Method)
+    methodRelationships.push(relationshipsFor(params.p256))
     publicKeys.push(params.p256.jwk)
   }
 
@@ -91,6 +131,7 @@ function buildDidWebDocuments(params) {
       publicKeyJwk: params.k1.jwk
     }
     verificationMethods.push(k1Method)
+    methodRelationships.push(relationshipsFor(params.k1))
     publicKeys.push(params.k1.jwk)
   }
 
@@ -105,11 +146,19 @@ function buildDidWebDocuments(params) {
       'https://w3id.org/security/suites/jws-2020/v1'
     ],
     id: did,
-    verificationMethod: verificationMethods,
-    authentication: verificationMethods.map(function(vm) { return vm.id }),
-    assertionMethod: verificationMethods.map(function(vm) { return vm.id })
+    verificationMethod: verificationMethods
   }
 
+  // Scope each key to the relationships it was given. Omitting `relationships`
+  // reproduces the previous output exactly (every key in both authentication and
+  // assertionMethod), so existing callers are unaffected.
+  VERIFICATION_RELATIONSHIPS.forEach(function (rel) {
+    var ids = verificationMethods
+      .filter(function (vm, i) { return methodRelationships[i].indexOf(rel) !== -1 })
+      .map(function (vm) { return vm.id })
+    if (ids.length) didDocument[rel] = ids
+  })
+
   if (params.controllerName) {
     didDocument.controller = params.controllerName
   }
@@ -144,6 +193,11 @@ function rotateIssuerKey(params) {
     publicKeyJwk: params.newKey.jwk
   }
 
+  // Which relationships this rotation actually replaces. Defaults to both, which is
+  // the historical behaviour.
+  var rotating = relationshipsFor(params.newKey)
+  var current = params.currentDocument || null
+
   // Build updated DID Document with new key as primary
   var didDocument = {
     '@context': [
@@ -151,13 +205,38 @@ function rotateIssuerKey(params) {
       'https://w3id.org/security/suites/jws-2020/v1'
     ],
     id: did,
-    verificationMethod: [newMethod],
-    authentication: [newMethod.id],
-    assertionMethod: [newMethod.id],
-    rotationInfo: {
-      rotatedAt: new Date().toISOString(),
-      gracePeriodDays: keepOldForDays
+    verificationMethod: [newMethod]
+  }
+
+  // A rotation must not silently reach beyond the relationship being rotated.
+  // Replacing a compromised `authentication` key used to rewrite `assertionMethod`
+  // too, which invalidates every statement the issuer has ever signed. Relationships
+  // outside `rotating` are carried across from `currentDocument` untouched; without a
+  // `currentDocument` there is nothing to carry, and the result matches the old output.
+  VERIFICATION_RELATIONSHIPS.forEach(function (rel) {
+    if (rotating.indexOf(rel) !== -1) {
+      didDocument[rel] = [newMethod.id]
+    } else if (current && Array.isArray(current[rel]) && current[rel].length) {
+      didDocument[rel] = current[rel].slice()
     }
+  })
+
+  // Keep the verification methods those carried-over relationships still point at,
+  // otherwise the document references key ids it does not define. The rotated-out key
+  // drops out here automatically: nothing references it any more.
+  if (current && Array.isArray(current.verificationMethod)) {
+    var referenced = {}
+    VERIFICATION_RELATIONSHIPS.forEach(function (rel) {
+      (didDocument[rel] || []).forEach(function (id) { referenced[id] = true })
+    })
+    current.verificationMethod.forEach(function (vm) {
+      if (referenced[vm.id] && vm.id !== newMethod.id) didDocument.verificationMethod.push(vm)
+    })
+  }
+
+  didDocument.rotationInfo = {
+    rotatedAt: new Date().toISOString(),
+    gracePeriodDays: keepOldForDays
   }
 
   var jwks = {

package/lib/encoding/base58.js

@@ -1,7 +1,6 @@
 'use strict'
 
 var _ = require('../util/_')
-var bs58 = require('bs58')
 var buffer = require('buffer')
 
 /**
@@ -11,6 +10,71 @@ var buffer = require('buffer')
  */
 var ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'.split('')
 
+// Reverse lookup for decoding. Built from ALPHABET so the two cannot disagree.
+var ALPHABET_MAP = {}
+for (var _i = 0; _i < ALPHABET.length; _i++) ALPHABET_MAP[ALPHABET[_i]] = _i
+
+/**
+ * Base58 encode/decode, replacing the `bs58` dependency (which also pulled `base-x`).
+ *
+ * This is the standard big-number-in-base-58 conversion: repeatedly multiply the
+ * accumulator by 256 (encode) or 58 (decode) and carry. Two details are where
+ * implementations usually go wrong, and both are exercised by the differential test in
+ * test/encoding/base58.js:
+ *
+ *   - Leading zero bytes are NOT part of the number — they are significant and each one
+ *     maps to a literal '1'. Dropping them silently truncates an address.
+ *   - The carry loops must run to completion before the next digit, or long inputs lose
+ *     the high-order bytes.
+ *
+ * These functions encode and decode addresses and WIF private keys, so they were
+ * verified by differential test against bs58 across 20,000 random inputs — including
+ * every leading-zero-count from 0 to 8 — before the dependency was removed.
+ */
+function base58encode (buf) {
+  if (buf.length === 0) return ''
+  var digits = [0]
+  var i, j, carry
+  for (i = 0; i < buf.length; i++) {
+    for (j = 0, carry = buf[i]; j < digits.length; j++) {
+      carry += digits[j] << 8
+      digits[j] = carry % 58
+      carry = (carry / 58) | 0
+    }
+    while (carry > 0) {
+      digits.push(carry % 58)
+      carry = (carry / 58) | 0
+    }
+  }
+  var out = ''
+  // Each leading zero byte is a significant '1', not part of the number.
+  for (i = 0; buf[i] === 0 && i < buf.length - 1; i++) out += ALPHABET[0]
+  for (i = digits.length - 1; i >= 0; i--) out += ALPHABET[digits[i]]
+  return out
+}
+
+function base58decode (str) {
+  if (str.length === 0) return Buffer.alloc(0)
+  var bytes = [0]
+  var i, j, carry
+  for (i = 0; i < str.length; i++) {
+    var value = ALPHABET_MAP[str[i]]
+    if (value === undefined) throw new Error('Non-base58 character')
+    for (j = 0, carry = value; j < bytes.length; j++) {
+      carry += bytes[j] * 58
+      bytes[j] = carry & 0xff
+      carry >>= 8
+    }
+    while (carry > 0) {
+      bytes.push(carry & 0xff)
+      carry >>= 8
+    }
+  }
+  // Mirror of the encode side: each leading '1' is a zero byte.
+  for (i = 0; str[i] === ALPHABET[0] && i < str.length - 1; i++) bytes.push(0)
+  return Buffer.from(bytes.reverse())
+}
+
 /**
  * A Base58 object can encode/decoded Base 58, which is used primarily for
  * string-formatted Bitcoin addresses and private keys. Addresses and private
@@ -54,7 +118,7 @@ Base58.encode = function (buf) {
   if (!buffer.Buffer.isBuffer(buf)) {
     throw new Error('Input should be a buffer')
   }
-  return bs58.encode(buf)
+  return base58encode(buf)
 }
 
 /**
@@ -67,7 +131,7 @@ Base58.decode = function (str) {
   if (typeof str !== 'string') {
     throw new Error('Input should be a string')
   }
-  return Buffer.from(bs58.decode(str))
+  return base58decode(str)
 }
 
 Base58.prototype.fromBuffer = function (buf) {

package/lib/mnemonic/mnemonic.js

@@ -2,7 +2,6 @@
 
 var HDPrivateKey = require('../hdprivatekey')
 var BN = require('../crypto/bn')
-var unorm = require('unorm')
 var _ = require('../util/_')
 
 var pbkdf2 = require('./pbkdf2')
@@ -16,6 +15,21 @@ var Random = require('../crypto/random')
 
 var $ = require('../util/preconditions')
 
+/**
+ * NFKD-normalise a mnemonic or passphrase, as BIP-39 requires before PBKDF2.
+ *
+ * Replaces the `unorm` dependency: `String.prototype.normalize` has been in the language
+ * since ES6 and this package requires Node >= 20.19, so the shim was redundant.
+ *
+ * Non-strings return '' so that `Mnemonic.isValid(garbage)` answers false instead of
+ * throwing. unorm was inconsistent about this — `[]` and `{}` returned '' while `['a']`
+ * and a Buffer threw — and a validity predicate that fails closed for every non-string
+ * is both the safer answer and the coherent one.
+ */
+function nfkd (str) {
+  return typeof str === 'string' ? str.normalize('NFKD') : ''
+}
+
 /**
  * This is an immutable class that represents a BIP39 Mnemonic code.
  * See BIP39 specification for more info: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki
@@ -52,7 +66,7 @@ var Mnemonic = function (data, wordlist) {
   if (Buffer.isBuffer(data)) {
     seed = data
   } else if (_.isString(data)) {
-    phrase = unorm.nfkd(data)
+    phrase = nfkd(data)
   } else if (_.isNumber(data)) {
     ent = data
   } else if (data) {
@@ -145,7 +159,7 @@ Mnemonic.Words = require('./words')
  * @returns {boolean}
  */
 Mnemonic.isValid = function (mnemonic, wordlist) {
-  mnemonic = unorm.nfkd(mnemonic)
+  mnemonic = nfkd(mnemonic)
   wordlist = wordlist || Mnemonic._getDictionary(mnemonic)
 
   if (!wordlist) {
@@ -179,7 +193,7 @@ Mnemonic.isValid = function (mnemonic, wordlist) {
  * @returns {boolean}
  */
 Mnemonic._belongsToWordlist = function (mnemonic, wordlist) {
-  var words = unorm.nfkd(mnemonic).split(' ')
+  var words = nfkd(mnemonic).split(' ')
   for (var i = 0; i < words.length; i++) {
     var ind = wordlist.indexOf(words[i])
     if (ind < 0) return false
@@ -217,7 +231,7 @@ Mnemonic._getDictionary = function (mnemonic) {
  */
 Mnemonic.prototype.toSeed = function (passphrase) {
   passphrase = passphrase || ''
-  return pbkdf2(unorm.nfkd(this.phrase), unorm.nfkd('mnemonic' + passphrase), 2048, 64)
+  return pbkdf2(nfkd(this.phrase), nfkd('mnemonic' + passphrase), 2048, 64)
 }
 
 /**

package/lib/mnemonic/pbkdf2.js

@@ -1,2 +1,35 @@
-if (process.browser) module.exports = require('./pbkdf2.browser')
-else module.exports = require('./pbkdf2.node')
+'use strict'
+
+// Pick the PBKDF2 backend by CAPABILITY, not by `process.browser`. Same reasoning as
+// lib/crypto/hash.js: that flag is undefined in React Native, Deno, Workers and Bun, so
+// all of them took the node branch and required('crypto') — failing outright, or
+// resolving to a partial shim.
+//
+// The node variant needs `createHmac('sha512')`, so that is what is probed, and the
+// result is checked against RFC 4231 test case 1 rather than merely existing. A shim
+// that returns a wrong or stubbed HMAC would otherwise silently corrupt every seed
+// derived from a mnemonic — and unlike a crash, that failure is invisible until funds
+// are missing. The pure-JS fallback is audited and always safe.
+
+var RFC4231_CASE1 = '87aa7cdea5ef619d4ff0b4241a1d6cb02379f4e2ce4ec2787ad0b30545e17cdedaa833b7d6b8a702038b274eaea3f4e4be9d914eeb61f1702e696c203a126854'
+
+function nodeHmacIsUsable () {
+  var crypto
+  try {
+    crypto = require('crypto')
+  } catch (e) {
+    return false
+  }
+  if (!crypto || typeof crypto.createHmac !== 'function') return false
+
+  try {
+    var mac = crypto.createHmac('sha512', Buffer.alloc(20, 0x0b))
+      .update('Hi There')
+      .digest('hex')
+    return mac === RFC4231_CASE1
+  } catch (e) {
+    return false
+  }
+}
+
+module.exports = nodeHmacIsUsable() ? require('./pbkdf2.node') : require('./pbkdf2.browser')