@starknetfoundation/krusty-kms-wasm 0.8.1 → 0.9.1

package/krusty_kms_wasm.d.ts

@@ -23,7 +23,9 @@ export class WasmAccount {
      *
      * # Arguments
      * * `ciphertext` - The ciphertext to decrypt
-     * * `max_search` - Maximum value to search for (default: 1,000,000)
+     * * `max_search` - Maximum value to search for (default: 1,000,000;
+     *   capped at 2^20 — see [`Self::MAX_SEARCH_CEILING`] for why the cap has
+     *   to be this small)
      *
      * # Returns
      * The decrypted balance as a string (for large number support in JS)
@@ -1312,11 +1314,21 @@ export function encryptWithKey(plaintext: string, key_hex: string): WasmEncrypte
  * Generate a compact summary of candidate addresses grouped by derivation index.
  *
  * Returns a JSON object where keys are derivation indices and values are
- * objects mapping wallet type to address. Useful for quick discovery without
- * needing the full candidate details. Never includes private keys.
+ * objects mapping wallet type to **all** candidate addresses for that type.
+ * Useful for quick discovery without needing the full candidate details.
+ * Never includes private keys.
+ *
+ * # Why every address, not just the first
+ *
+ * A wallet type can have several address variants at one index: OpenZeppelin
+ * has two salt policies (`salt = public_key` and the legacy `salt = 0`),
+ * Argent legacy spans three Cairo 1 class hashes, and Argent Cairo 0 spans
+ * four proxy implementations. This is a funds-recovery path, so collapsing to
+ * one address per wallet type silently hides deployed accounts — every
+ * omitted variant is an account the caller cannot find.
  *
  * # Returns
- * JSON string: `{ "0": { "Braavos": "0x...", "Argent": "0x...", ... }, "1": { ... } }`
+ * JSON string: `{ "0": { "Braavos": ["0x..."], "OpenZeppelin": ["0x...", "0x..."], ... } }`
  */
 export function generateAccountAddresses(mnemonic: string, max_index?: number | null): string;
 
@@ -1499,13 +1511,16 @@ export function isValidFelt(hex_str: string): boolean;
 /**
  * Check whether a hex string is a valid Stark private key.
  *
- * A valid private key must parse as a felt and must not be zero.
+ * A valid private key must parse as a felt, must not be zero, and must be
+ * strictly below the Stark curve order `n`. Values in `[n, p)` parse as
+ * felts but silently reduce mod `n` when used for signing — i.e. they alias
+ * to a *different* key — so they are rejected here.
  *
  * # Arguments
  * * `hex_str` - Hex string to validate (with or without `0x` prefix)
  *
  * # Returns
- * `true` if the string is a non-zero valid felt, `false` otherwise
+ * `true` if the string is a valid in-range private key, `false` otherwise
  */
 export function isValidStarkPrivateKey(hex_str: string): boolean;
 
@@ -1580,7 +1595,9 @@ export function poseidonHashMany(inputs: string[]): string;
  * Uses a cryptographically secure random number generator.
  *
  * # Arguments
- * * `length` - Number of random bytes to generate
+ * * `length` - Number of random bytes to generate (maximum 1024 — this API
+ *   exists for keys/nonces/salts, and an unbounded caller-supplied length is
+ *   an allocation-DoS vector)
  *
  * # Returns
  * Hex-encoded bytes with `0x` prefix
@@ -2029,22 +2046,6 @@ export interface InitOutput {
     readonly __wbg_set_wasmstarkxonlykeypair_private_key: (a: number, b: number, c: number) => void;
     readonly __wbg_set_wasmstarkxonlykeypair_public_key_x: (a: number, b: number, c: number) => void;
     readonly __wbg_set_wasmstarkxonlypublickey_public_key_x: (a: number, b: number, c: number) => void;
-    readonly grindKey: (a: number, b: number) => [number, number, number, number];
-    readonly isValidFelt: (a: number, b: number) => number;
-    readonly isValidStarkPrivateKey: (a: number, b: number) => number;
-    readonly randomBytesHex: (a: number) => [number, number, number, number];
-    readonly deserializePublicKey: (a: number, b: number) => [number, number, number];
-    readonly getBuildInfo: () => any;
-    readonly getGenerator: () => number;
-    readonly getVersion: () => [number, number];
-    readonly init: () => void;
-    readonly pointAdd: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number) => [number, number, number];
-    readonly poseidonHash: (a: number, b: number, c: number, d: number) => [number, number, number, number];
-    readonly poseidonHashMany: (a: number, b: number) => [number, number, number, number];
-    readonly randomFelt: () => [number, number];
-    readonly scalarMul: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
-    readonly scalarMulGenerator: (a: number, b: number) => [number, number, number];
-    readonly serializePublicKey: (a: number, b: number, c: number, d: number) => [number, number, number, number];
     readonly __wbg_get_wasmencryptedkey_encryptedKey: (a: number) => [number, number];
     readonly __wbg_get_wasmencryptedkey_nonce: (a: number) => [number, number];
     readonly __wbg_get_wasmencryptedkey_salt: (a: number) => [number, number];
@@ -2057,28 +2058,48 @@ export interface InitOutput {
     readonly decryptKeystore: (a: number, b: number, c: number, d: number) => [number, number, number, number];
     readonly decryptPrivateKey: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number) => [number, number, number, number];
     readonly decryptWithKey: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number, number];
+    readonly deriveArgentLegacyKeypair: (a: number, b: number, c: number, d: number) => [number, number, number];
+    readonly deriveArgentLegacyPublicKey: (a: number, b: number, c: number, d: number) => [number, number, number];
+    readonly deriveKeypair: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
+    readonly derivePublicKey: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
+    readonly deriveStarknetKeypair: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
+    readonly deriveStarknetPublicKey: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
     readonly encryptKeystore: (a: number, b: number, c: number, d: number, e: number) => [number, number, number, number];
     readonly encryptPrivateKey: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
     readonly encryptWithKey: (a: number, b: number, c: number, d: number) => [number, number, number];
-    readonly nostrPublicKey: (a: number, b: number) => [number, number, number, number];
-    readonly signNostrEventId: (a: number, b: number, c: number, d: number) => [number, number, number];
-    readonly signNostrMessage: (a: number, b: number, c: number, d: number) => [number, number, number];
-    readonly signStarkHash: (a: number, b: number, c: number, d: number) => [number, number, number];
-    readonly starkPublicKey: (a: number, b: number) => [number, number, number, number];
+    readonly generateMnemonic: (a: number) => [number, number, number, number];
+    readonly getNostrCoinType: () => number;
+    readonly getStarknetCoinType: () => number;
+    readonly getTongoCoinType: () => number;
+    readonly validateMnemonic: (a: number, b: number) => number;
     readonly __wbg_get_wasmencryptedpayload_ciphertext: (a: number) => [number, number];
     readonly __wbg_get_wasmencryptedpayload_nonce: (a: number) => [number, number];
     readonly __wbg_set_wasmencryptedpayload_ciphertext: (a: number, b: number, c: number) => void;
     readonly __wbg_set_wasmencryptedpayload_nonce: (a: number, b: number, c: number) => void;
+    readonly deserializePublicKey: (a: number, b: number) => [number, number, number];
+    readonly getBuildInfo: () => any;
+    readonly getGenerator: () => number;
+    readonly getVersion: () => [number, number];
+    readonly init: () => void;
+    readonly pointAdd: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number) => [number, number, number];
+    readonly poseidonHash: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+    readonly poseidonHashMany: (a: number, b: number) => [number, number, number, number];
+    readonly randomFelt: () => [number, number];
+    readonly scalarMul: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
+    readonly scalarMulGenerator: (a: number, b: number) => [number, number, number];
+    readonly serializePublicKey: (a: number, b: number, c: number, d: number) => [number, number, number, number];
     readonly compileCalls: (a: number, b: number) => [number, number, number, number];
     readonly decodeShortString: (a: number, b: number) => [number, number, number, number];
-    readonly deriveNostrKeypair: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
-    readonly deriveNostrPublicKey: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
     readonly deriveStrk20ViewingKey: (a: number, b: number) => [number, number, number, number];
     readonly encodeFelt: (a: number, b: number) => [number, number, number, number];
     readonly encodeShortString: (a: number, b: number) => [number, number, number, number];
     readonly getSelectorFromName: (a: number, b: number) => [number, number, number, number];
+    readonly grindKey: (a: number, b: number) => [number, number, number, number];
+    readonly isValidFelt: (a: number, b: number) => number;
+    readonly isValidStarkPrivateKey: (a: number, b: number) => number;
     readonly pedersenHash: (a: number, b: number, c: number, d: number) => [number, number, number, number];
     readonly pedersenHashMany: (a: number, b: number) => [number, number, number, number];
+    readonly randomBytesHex: (a: number) => [number, number, number, number];
     readonly starknetKeccak: (a: number, b: number, c: number, d: number) => [number, number, number, number];
     readonly computeDeclareTransactionHashV2: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number, j: number, k: number, l: number) => [number, number, number, number];
     readonly computeDeclareTransactionHashV3: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number, j: number, k: number, l: number, m: any, n: number, o: number, p: number, q: number, r: number, s: number) => [number, number, number, number];
@@ -2087,28 +2108,12 @@ export interface InitOutput {
     readonly computeInvokeTransactionHashV1: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number, j: number) => [number, number, number, number];
     readonly computeInvokeTransactionHashV3: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number, j: number, k: any, l: number, m: number, n: number, o: number, p: number, q: number, r: number, s: number) => [number, number, number, number];
     readonly computeTypedDataMessageHash: (a: number, b: number, c: number, d: number) => [number, number, number, number];
-    readonly deriveArgentLegacyKeypair: (a: number, b: number, c: number, d: number) => [number, number, number];
-    readonly deriveArgentLegacyPublicKey: (a: number, b: number, c: number, d: number) => [number, number, number];
-    readonly deriveDiscoveryKeypairs: (a: number, b: number, c: number) => [number, number, number, number];
-    readonly deriveDiscoveryKeypairsWithSecrets: (a: number, b: number, c: number) => [number, number, number, number];
-    readonly deriveKeypair: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
-    readonly derivePublicKey: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
-    readonly deriveStarknetKeypair: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
-    readonly deriveStarknetPublicKey: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
-    readonly discoverAccountsFromMnemonic: (a: number, b: number, c: number) => [number, number, number, number];
-    readonly discoverAccountsFromMnemonicWithSecrets: (a: number, b: number, c: number) => [number, number, number, number];
-    readonly generateAccountAddresses: (a: number, b: number, c: number) => [number, number, number, number];
-    readonly generateAccountCandidates: (a: number, b: number, c: number) => [number, number, number, number];
-    readonly generateAccountCandidatesWithSecrets: (a: number, b: number, c: number) => [number, number, number, number];
-    readonly generateMnemonic: (a: number) => [number, number, number, number];
-    readonly getNostrCoinType: () => number;
-    readonly getStarknetCoinType: () => number;
-    readonly getTongoCoinType: () => number;
-    readonly validateMnemonic: (a: number, b: number) => number;
     readonly __wbg_wasmaccount_free: (a: number, b: number) => void;
     readonly calculateContractAddress: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number) => [number, number, number, number];
     readonly deriveArgentAccountAddress: (a: number, b: number, c: number, d: number) => [number, number, number, number];
     readonly deriveBraavosAccountAddress: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+    readonly deriveNostrKeypair: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
+    readonly deriveNostrPublicKey: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
     readonly deriveOzAccountAddress: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number, number];
     readonly getAccountClassHashes: () => [number, number];
     readonly wasmaccount_contractAddress: (a: number) => [number, number];
@@ -2121,6 +2126,18 @@ export interface InitOutput {
     readonly wasmaccount_ownerPublicKeyHex: (a: number) => [number, number, number, number];
     readonly wasmaccount_totalBalance: (a: number) => [number, number, number, number];
     readonly wasmaccount_updateState: (a: number, b: number) => [number, number];
+    readonly deriveDiscoveryKeypairs: (a: number, b: number, c: number) => [number, number, number, number];
+    readonly deriveDiscoveryKeypairsWithSecrets: (a: number, b: number, c: number) => [number, number, number, number];
+    readonly discoverAccountsFromMnemonic: (a: number, b: number, c: number) => [number, number, number, number];
+    readonly discoverAccountsFromMnemonicWithSecrets: (a: number, b: number, c: number) => [number, number, number, number];
+    readonly generateAccountAddresses: (a: number, b: number, c: number) => [number, number, number, number];
+    readonly generateAccountCandidates: (a: number, b: number, c: number) => [number, number, number, number];
+    readonly generateAccountCandidatesWithSecrets: (a: number, b: number, c: number) => [number, number, number, number];
+    readonly nostrPublicKey: (a: number, b: number) => [number, number, number, number];
+    readonly signNostrEventId: (a: number, b: number, c: number, d: number) => [number, number, number];
+    readonly signNostrMessage: (a: number, b: number, c: number, d: number) => [number, number, number];
+    readonly signStarkHash: (a: number, b: number, c: number, d: number) => [number, number, number];
+    readonly starkPublicKey: (a: number, b: number) => [number, number, number, number];
     readonly __wbindgen_malloc: (a: number, b: number) => number;
     readonly __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
     readonly __wbindgen_exn_store: (a: number) => void;

package/krusty_kms_wasm.js

@@ -48,7 +48,9 @@ export class WasmAccount {
      *
      * # Arguments
      * * `ciphertext` - The ciphertext to decrypt
-     * * `max_search` - Maximum value to search for (default: 1,000,000)
+     * * `max_search` - Maximum value to search for (default: 1,000,000;
+     *   capped at 2^20 — see [`Self::MAX_SEARCH_CEILING`] for why the cap has
+     *   to be this small)
      *
      * # Returns
      * The decrypted balance as a string (for large number support in JS)
@@ -6073,11 +6075,21 @@ export function encryptWithKey(plaintext, key_hex) {
  * Generate a compact summary of candidate addresses grouped by derivation index.
  *
  * Returns a JSON object where keys are derivation indices and values are
- * objects mapping wallet type to address. Useful for quick discovery without
- * needing the full candidate details. Never includes private keys.
+ * objects mapping wallet type to **all** candidate addresses for that type.
+ * Useful for quick discovery without needing the full candidate details.
+ * Never includes private keys.
+ *
+ * # Why every address, not just the first
+ *
+ * A wallet type can have several address variants at one index: OpenZeppelin
+ * has two salt policies (`salt = public_key` and the legacy `salt = 0`),
+ * Argent legacy spans three Cairo 1 class hashes, and Argent Cairo 0 spans
+ * four proxy implementations. This is a funds-recovery path, so collapsing to
+ * one address per wallet type silently hides deployed accounts — every
+ * omitted variant is an account the caller cannot find.
  *
  * # Returns
- * JSON string: `{ "0": { "Braavos": "0x...", "Argent": "0x...", ... }, "1": { ... } }`
+ * JSON string: `{ "0": { "Braavos": ["0x..."], "OpenZeppelin": ["0x...", "0x..."], ... } }`
  * @param {string} mnemonic
  * @param {number | null} [max_index]
  * @returns {string}
@@ -6495,13 +6507,16 @@ export function isValidFelt(hex_str) {
 /**
  * Check whether a hex string is a valid Stark private key.
  *
- * A valid private key must parse as a felt and must not be zero.
+ * A valid private key must parse as a felt, must not be zero, and must be
+ * strictly below the Stark curve order `n`. Values in `[n, p)` parse as
+ * felts but silently reduce mod `n` when used for signing — i.e. they alias
+ * to a *different* key — so they are rejected here.
  *
  * # Arguments
  * * `hex_str` - Hex string to validate (with or without `0x` prefix)
  *
  * # Returns
- * `true` if the string is a non-zero valid felt, `false` otherwise
+ * `true` if the string is a valid in-range private key, `false` otherwise
  * @param {string} hex_str
  * @returns {boolean}
  */
@@ -6713,7 +6728,9 @@ export function poseidonHashMany(inputs) {
  * Uses a cryptographically secure random number generator.
  *
  * # Arguments
- * * `length` - Number of random bytes to generate
+ * * `length` - Number of random bytes to generate (maximum 1024 — this API
+ *   exists for keys/nonces/salts, and an unbounded caller-supplied length is
+ *   an allocation-DoS vector)
  *
  * # Returns
  * Hex-encoded bytes with `0x` prefix

package/package.json

@@ -5,7 +5,7 @@
     "Krusty KMS Contributors"
   ],
   "description": "WASM bindings for krusty-kms account and protocol utilities",
-  "version": "0.8.1",
+  "version": "0.9.1",
   "license": "MIT OR Apache-2.0",
   "repository": {
     "type": "git",