@taquito/signer 25.0.0-rc.1 → 25.1.0-beta0

package/README.md

@@ -1,6 +1,7 @@
 # Taquito Signer package
-*Documentation can be found [here](https://taquito.io/docs/inmemory_signer)*
-*TypeDoc style documentation is available on-line [here](https://taquito.io/typedoc/modules/_taquito_signer.html)*
+
+_Documentation can be found [here](https://taquito.io/docs/inmemory_signer)_
+_TypeDoc style documentation is available on-line [here](https://taquito.io/typedoc/modules/_taquito_signer.html)_
 
 `@taquito/signer` is an npm package that provides developers with signing functionality for Taquito.
 
@@ -14,12 +15,14 @@ This signer implementation is for development workflows.
 production use-cases! Use the InMemorySigner appropriately given your risk profile.**
 
 ## Install
+
 ```
 npm i --save @taquito/taquito
 npm i --save @taquito/signer
 ```
 
 ## Usage
+
 ### Loading an unencrypted private key
 
 ```js
@@ -47,6 +50,20 @@ Tezos.setProvider({
 
 The following link can be used to fund an address on the different testnets: https://teztnets.com/.
 
+### ML-DSA-44 (tz5)
+
+`InMemorySigner.fromSecretKey` accepts Octez `mdsk` secret keys and `mdesk`
+encrypted secret keys. It exposes the corresponding `mdpk` public key and `tz5`
+address. Key generation from mnemonics and HD derivation do not support ML-DSA.
+
+For this scheme, both `SignResult.sig` and `SignResult.prefixSig` use `mdsig`.
+`SignResult.sbytes` includes Octez's `ff04` marker and the full 2420-byte signature.
+Watermarks follow the existing signer API; proof of possession remains BLS-only.
+
+Sending operations requires a protocol with `tz5_account_enable` enabled. This
+support is validated against an isolated Octez 25.2 Ushuaia sandbox, and does not
+imply activation on mainnet. See the [local conformance suite](../../integration-tests/tz5/README.md).
+
 ## Additional info
 
 See the top-level [https://github.com/ecadlabs/taquito](https://github.com/ecadlabs/taquito) file for details on reporting issues, contributing and versioning.

package/dist/lib/in-memory-signer.js

@@ -26,6 +26,7 @@ const errors_1 = require("./errors");
 const core_1 = require("@taquito/core");
 const key_interface_1 = require("./key-interface");
 const bls_key_1 = require("./bls-key");
+const mldsa_key_1 = require("./mldsa-key");
 const sha2_js_1 = require("@noble/hashes/sha2.js");
 /**
  * A local implementation of the signer. Will represent a Tezos account and be able to produce signature in its behalf
@@ -80,6 +81,8 @@ class InMemorySigner {
             utils_1.PrefixV2.P256SecretKey,
             utils_1.PrefixV2.BLS12_381EncryptedSecretKey,
             utils_1.PrefixV2.BLS12_381SecretKey,
+            utils_1.PrefixV2.MLDSA44EncryptedSecretKey,
+            utils_1.PrefixV2.MLDSA44SecretKey,
         ];
         const pre = (() => {
             try {
@@ -93,7 +96,8 @@ class InMemorySigner {
         const encrypted = pre === utils_1.PrefixV2.Ed25519EncryptedSeed ||
             pre === utils_1.PrefixV2.Secp256k1EncryptedSecretKey ||
             pre === utils_1.PrefixV2.P256EncryptedSecretKey ||
-            pre === utils_1.PrefixV2.BLS12_381EncryptedSecretKey;
+            pre === utils_1.PrefixV2.BLS12_381EncryptedSecretKey ||
+            pre === utils_1.PrefixV2.MLDSA44EncryptedSecretKey;
         let decrypt;
         if (encrypted) {
             if (!passphrase) {
@@ -132,6 +136,10 @@ class InMemorySigner {
             case utils_1.PrefixV2.BLS12_381SecretKey:
                 __classPrivateFieldSet(this, _InMemorySigner_key, new bls_key_1.BLSKey(key, decrypt), "f");
                 break;
+            case utils_1.PrefixV2.MLDSA44EncryptedSecretKey:
+            case utils_1.PrefixV2.MLDSA44SecretKey:
+                __classPrivateFieldSet(this, _InMemorySigner_key, new mldsa_key_1.MLDSAKey(key, decrypt), "f");
+                break;
         }
     }
     /**
@@ -143,13 +151,17 @@ class InMemorySigner {
         const msg = typeof message == 'string' ? (0, utils_1.hex2buf)(message) : message;
         const watermarkMsg = watermark !== undefined ? (0, utils_1.mergebuf)(watermark, msg) : msg;
         const { rawSignature, sig: signature, prefixSig: prefixedSignature, } = await __classPrivateFieldGet(this, _InMemorySigner_key, "f").sign(watermarkMsg);
+        // Variable-length operation signatures carry the signature-prefix marker
+        // and scheme tag before the complete signature payload (Octez signature_v3).
+        const signatureTag = __classPrivateFieldGet(this, _InMemorySigner_key, "f") instanceof mldsa_key_1.MLDSAKey ? 4 : __classPrivateFieldGet(this, _InMemorySigner_key, "f") instanceof bls_key_1.BLSKey ? 3 : undefined;
+        const signatureBytes = signatureTag === undefined
+            ? rawSignature
+            : (0, utils_1.mergebuf)(new Uint8Array([255, signatureTag]), rawSignature);
         return {
             bytes: (0, utils_1.buf2hex)(msg),
             sig: signature,
             prefixSig: prefixedSignature,
-            sbytes: (0, utils_1.buf2hex)((0, utils_1.mergebuf)(msg, 
-            // bls only Signature_prefix ff03 ref:https://octez.tezos.com/docs/shell/p2p_api.html#signature-prefix-tag-255 & https://octez.tezos.com/docs/shell/p2p_api.html#bls-prefix-tag-3
-            (0, key_interface_1.isPOP)(__classPrivateFieldGet(this, _InMemorySigner_key, "f")) ? (0, utils_1.mergebuf)(new Uint8Array([255, 3]), rawSignature) : rawSignature)),
+            sbytes: (0, utils_1.buf2hex)((0, utils_1.mergebuf)(msg, signatureBytes)),
         };
     }
     async provePossession() {
@@ -190,6 +202,7 @@ function publicKeyFromString(src) {
         utils_1.PrefixV2.Secp256k1PublicKey,
         utils_1.PrefixV2.P256PublicKey,
         utils_1.PrefixV2.BLS12_381PublicKey,
+        utils_1.PrefixV2.MLDSA44PublicKey,
     ]);
     switch (pre) {
         case utils_1.PrefixV2.Ed25519PublicKey:
@@ -200,5 +213,7 @@ function publicKeyFromString(src) {
             return new ec_key_1.ECPublicKey(keyData, 'p256');
         case utils_1.PrefixV2.BLS12_381PublicKey:
             return new bls_key_1.BLSPublicKey(keyData);
+        case utils_1.PrefixV2.MLDSA44PublicKey:
+            return new mldsa_key_1.MLDSAPublicKey(keyData);
     }
 }

package/dist/lib/mldsa-key.js

@@ -0,0 +1,85 @@
+"use strict";
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _MLDSAKey_key, _MLDSAPublicKey_key;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MLDSAPublicKey = exports.MLDSAKey = void 0;
+const ml_dsa_js_1 = require("@noble/post-quantum/ml-dsa.js");
+const blake2_js_1 = require("@noble/hashes/blake2.js");
+const core_1 = require("@taquito/core");
+const utils_1 = require("@taquito/utils");
+// Octez stores the 2560-byte ML-DSA-44 secret followed by its 1312-byte public key.
+const SECRET_KEY_SIZE = 2560;
+class MLDSAKey {
+    constructor(key, decrypt) {
+        _MLDSAKey_key.set(this, void 0);
+        const [encoded, prefix] = (0, utils_1.b58DecodeAndCheckPrefix)(key, [
+            utils_1.PrefixV2.MLDSA44SecretKey,
+            utils_1.PrefixV2.MLDSA44EncryptedSecretKey,
+        ]);
+        let data = encoded;
+        if (prefix === utils_1.PrefixV2.MLDSA44EncryptedSecretKey) {
+            if (!decrypt)
+                throw new Error('decryption function is not provided');
+            data = decrypt(data);
+        }
+        if (data.length !== utils_1.payloadLength[utils_1.PrefixV2.MLDSA44SecretKey]) {
+            throw new core_1.InvalidKeyError('Invalid ML-DSA-44 secret key length');
+        }
+        __classPrivateFieldSet(this, _MLDSAKey_key, Uint8Array.from(data), "f");
+    }
+    sign(message) {
+        // Octez uses pure ML-DSA with an empty context over Blake2b-256(message),
+        // not HashML-DSA. InMemorySigner has already prepended any watermark.
+        const rawSignature = ml_dsa_js_1.ml_dsa44.sign((0, blake2_js_1.blake2b)(message, { dkLen: 32 }), __classPrivateFieldGet(this, _MLDSAKey_key, "f").subarray(0, SECRET_KEY_SIZE));
+        const encoded = (0, utils_1.b58Encode)(rawSignature, utils_1.PrefixV2.MLDSA44Signature);
+        return { rawSignature, sig: encoded, prefixSig: encoded };
+    }
+    publicKey() {
+        return new MLDSAPublicKey(__classPrivateFieldGet(this, _MLDSAKey_key, "f").subarray(SECRET_KEY_SIZE));
+    }
+    secretKey() {
+        return (0, utils_1.b58Encode)(__classPrivateFieldGet(this, _MLDSAKey_key, "f"), utils_1.PrefixV2.MLDSA44SecretKey);
+    }
+}
+exports.MLDSAKey = MLDSAKey;
+_MLDSAKey_key = new WeakMap();
+class MLDSAPublicKey {
+    constructor(src) {
+        _MLDSAPublicKey_key.set(this, void 0);
+        const key = typeof src === 'string' ? (0, utils_1.b58DecodeAndCheckPrefix)(src, [utils_1.PrefixV2.MLDSA44PublicKey])[0] : src;
+        if (key.length !== utils_1.payloadLength[utils_1.PrefixV2.MLDSA44PublicKey]) {
+            throw new utils_1.InvalidPublicKeyError('Invalid ML-DSA-44 public key length');
+        }
+        __classPrivateFieldSet(this, _MLDSAPublicKey_key, Uint8Array.from(key), "f");
+    }
+    compare(other) {
+        if (!(other instanceof MLDSAPublicKey)) {
+            throw new utils_1.InvalidPublicKeyError('ML-DSA-44 key expected');
+        }
+        return (0, utils_1.compareArrays)(__classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"), __classPrivateFieldGet(other, _MLDSAPublicKey_key, "f"));
+    }
+    hash() {
+        return (0, utils_1.b58Encode)((0, blake2_js_1.blake2b)(__classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"), { dkLen: 20 }), utils_1.PrefixV2.MLDSA44PublicKeyHash);
+    }
+    bytes() {
+        return __classPrivateFieldGet(this, _MLDSAPublicKey_key, "f").slice();
+    }
+    toProtocol() {
+        return (0, utils_1.mergebuf)(new Uint8Array([4]), __classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"));
+    }
+    toString() {
+        return (0, utils_1.b58Encode)(__classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"), utils_1.PrefixV2.MLDSA44PublicKey);
+    }
+}
+exports.MLDSAPublicKey = MLDSAPublicKey;
+_MLDSAPublicKey_key = new WeakMap();

package/dist/lib/version.js

@@ -3,6 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
 // IMPORTANT: THIS FILE IS AUTO GENERATED! DO NOT MANUALLY EDIT!
 exports.VERSION = {
-    "commitHash": "13f62cd47ea018312f100b660d0225604c757afa",
-    "version": "25.0.0-rc.1"
+    "commitHash": "a1d45363559ba27998bbc263b69c961710e4710a",
+    "version": "25.1.0-beta0"
 };