hd-wallet-wasm 2.0.20 → 2.0.26

package/dist/runtime/epm-attestation.d.ts

@@ -0,0 +1,105 @@
+import type { HDWalletModule } from './index.js';
+
+export type EpmSignatureCurve = 'ed25519' | 'secp256k1';
+
+export interface EpmSignatureOptions {
+  curve?: EpmSignatureCurve;
+}
+
+export interface EpmSignatureResult {
+  signature: string;
+  timestamp: number;
+}
+
+export interface CanonicalPayloadParams {
+  xpub: string;
+  signingPubKeyHex: string;
+  encryptionPubKeyHex: string;
+  issuedAt: number;
+  identityPubKeyHex?: string;
+  version?: string;
+}
+
+export interface ChainKeyParams {
+  address: string;
+  publicKeyHex: string;
+  privateKey: Uint8Array;
+  keyPath: string;
+  canonicalPayload: string;
+}
+
+export interface AllChainProofsParams {
+  canonicalPayload: string;
+  bitcoin?: Omit<ChainKeyParams, 'canonicalPayload'>;
+  ethereum?: Omit<ChainKeyParams, 'canonicalPayload'>;
+  solana?: Omit<ChainKeyParams, 'canonicalPayload'>;
+}
+
+export interface ChainProofData {
+  CHAIN: string;
+  ADDRESS: string;
+  PUBLIC_KEY: string;
+  KEY_PATH: string;
+  SIGNATURE: string;
+  SIGNED_PAYLOAD: string;
+  ALGORITHM: string;
+  ENCODING: string;
+}
+
+export interface ChainProofResult {
+  chain: string;
+  valid: boolean;
+}
+
+export interface ChainProofVerifyResult {
+  valid: boolean;
+  results: ChainProofResult[];
+}
+
+export function buildCanonicalPayload(params: CanonicalPayloadParams): string;
+
+export function buildEPMSigningContent(epm: Record<string, unknown>): Uint8Array;
+
+export function signEPMContent(
+  wallet: HDWalletModule,
+  epm: Record<string, unknown>,
+  privateKey: Uint8Array,
+  options?: EpmSignatureOptions,
+): EpmSignatureResult;
+
+export function verifyEPMSignature(
+  wallet: HDWalletModule,
+  epm: Record<string, unknown>,
+  publicKey: Uint8Array,
+  options?: EpmSignatureOptions,
+): boolean;
+
+export function buildBitcoinChainProof(
+  wallet: HDWalletModule,
+  params: ChainKeyParams,
+): ChainProofData;
+
+export function buildEthereumChainProof(
+  wallet: HDWalletModule,
+  params: ChainKeyParams,
+): ChainProofData;
+
+export function buildSolanaChainProof(
+  wallet: HDWalletModule,
+  params: ChainKeyParams,
+): ChainProofData;
+
+export function buildAllChainProofs(
+  wallet: HDWalletModule,
+  params: AllChainProofsParams,
+): ChainProofData[];
+
+export function verifyChainProof(
+  wallet: HDWalletModule,
+  proof: ChainProofData,
+): boolean;
+
+export function verifyAllChainProofs(
+  wallet: HDWalletModule,
+  chainProofs: ChainProofData[],
+): ChainProofVerifyResult;

package/{src → dist/runtime}/epm-attestation.mjs

@@ -212,17 +212,25 @@ export function buildEPMSigningContent(epm) {
 }
 
 /**
- * Sign EPM content with an Ed25519 private key.
+ * Sign EPM content. Default curve is ed25519 (fast, the network default); pass
+ * `{ curve: 'secp256k1' }` to sign with secp256k1 (ECDSA-DER over sha256(content),
+ * byte-compatible with the Go/C++ EPM verifiers). The content canonicalization is
+ * identical for both curves; only the signature differs.
  *
  * @param {Object} wallet - Initialized HDWalletModule
  * @param {Object} epm - EPM fields as a plain object (without SIGNATURE/SIGNATURE_TIMESTAMP)
- * @param {Uint8Array} ed25519PrivateKey - 32-byte Ed25519 private key (seed)
+ * @param {Uint8Array} privateKey - 32-byte private key (ed25519 seed or secp256k1 key)
+ * @param {{ curve?: 'ed25519'|'secp256k1' }} [options]
  * @returns {{ signature: string, timestamp: number }} Hex signature and Unix timestamp
  */
-export function signEPMContent(wallet, epm, ed25519PrivateKey) {
+export function signEPMContent(wallet, epm, privateKey, options = {}) {
+  const curve = String(options.curve || 'ed25519').toLowerCase();
   const timestamp = Math.floor(Date.now() / 1000);
   const content = buildEPMSigningContent({ ...epm, SIGNATURE_TIMESTAMP: timestamp });
-  const sig = wallet.curves.ed25519.sign(content, ed25519PrivateKey);
+  const sig =
+    curve === 'secp256k1'
+      ? wallet.curves.secp256k1.sign(wallet.utils.sha256(content), privateKey)
+      : wallet.curves.ed25519.sign(content, privateKey);
   return {
     signature: wallet.utils.encodeHex(sig),
     timestamp,
@@ -230,20 +238,30 @@ export function signEPMContent(wallet, epm, ed25519PrivateKey) {
 }
 
 /**
- * Verify an EPM content signature.
+ * Verify an EPM content signature. Dispatches on the explicit `options.curve`,
+ * else infers from the public key length (32 = ed25519; 33/65 = secp256k1).
+ * secp256k1 is verified as ECDSA-DER over sha256(content), matching signEPMContent
+ * and the Go/C++ verifiers.
  *
  * @param {Object} wallet - Initialized HDWalletModule
  * @param {Object} epm - Full EPM object including SIGNATURE and SIGNATURE_TIMESTAMP
- * @param {Uint8Array} ed25519PublicKey - 32-byte Ed25519 public key
+ * @param {Uint8Array} publicKey - ed25519 (32B) or secp256k1 (33/65B) public key
+ * @param {{ curve?: 'ed25519'|'secp256k1' }} [options]
  * @returns {boolean} True if signature is valid
  */
-export function verifyEPMSignature(wallet, epm, ed25519PublicKey) {
+export function verifyEPMSignature(wallet, epm, publicKey, options = {}) {
   const sigHex = epm.SIGNATURE || epm.signature;
   if (!sigHex) return false;
 
   const content = buildEPMSigningContent(epm);
   const sig = wallet.utils.decodeHex(sigHex);
-  return wallet.curves.ed25519.verify(content, sig, ed25519PublicKey);
+  const curve = String(
+    options.curve || (publicKey && publicKey.length === 32 ? 'ed25519' : 'secp256k1'),
+  ).toLowerCase();
+  if (curve === 'secp256k1') {
+    return wallet.curves.secp256k1.verify(wallet.utils.sha256(content), sig, publicKey);
+  }
+  return wallet.curves.ed25519.verify(content, sig, publicKey);
 }
 
 // =============================================================================

package/dist/{index.d.ts → runtime/index.d.ts}

@@ -10,7 +10,7 @@
  */
 
 // Import aligned API types
-import { AlignedAPI } from './aligned';
+import { AlignedAPI } from './aligned.js';
 
 export type BinaryLike = Uint8Array | ArrayBuffer | ArrayBufferView;
 export type X509CertificateInput = string | BinaryLike;
@@ -142,6 +142,193 @@ export interface SdnPluginContract {
   verify_detached(request: { inputs: SdnPluginFrame[] }): SdnPluginInvocationResult;
 }
 
+declare const sdnIdentityHandleBrand: unique symbol;
+
+export interface SdnIdentityHandle {
+  readonly [sdnIdentityHandleBrand]: true;
+}
+
+export interface SdnWasmKeyDescriptor {
+  purpose: 'asset-review-approval' | 'contact-encryption' | 'sdn-authentication';
+  identityScheme: 'sdn-bip32-slip10-purpose-v1'
+    | 'sdn-fast-password-auth-v1-legacy' | 'sdn-bip39-auth-v1-legacy';
+  seedProfile: 'password-scrypt-v2' | 'password-fast-v1-legacy'
+    | 'bip39-mnemonic-v1-legacy';
+  signatureProfile: 'ed25519-over-sha256-jcs-v1'
+    | 'ed25519-raw-32-v1' | null;
+  curve: 'ed25519' | 'x25519';
+  derivation: 'slip10' | 'bip32-scalar-as-ed25519-seed';
+  path: string;
+  encoding: 'raw';
+  publicKeyHex: string;
+  bip32Fingerprint: null;
+  keyId: `sha256:${string}`;
+}
+
+export interface SdnWasmPublicIdentity {
+  schemaVersion: 1;
+  identityScheme: SdnWasmKeyDescriptor['identityScheme'];
+  seedProfile: SdnWasmKeyDescriptor['seedProfile'];
+  accountIndex: 0 | 1;
+  accountLabel: null;
+  accountXpub: string;
+  accountPeerId: string;
+  accountFingerprint: string;
+  keys: readonly SdnWasmKeyDescriptor[];
+}
+
+export type SdnRegistryRowId =
+  | 'sdn-node-console-v2'
+  | 'asset-review-authority-activation-v1'
+  | 'asset-review-decision-v1';
+
+export interface RawWalletSignature {
+  schemaVersion: 1;
+  keyId: `sha256:${string}`;
+  identityScheme: 'sdn-fast-password-auth-v1-legacy' | 'sdn-bip39-auth-v1-legacy';
+  algorithm: 'ed25519';
+  encoding: 'raw';
+  signatureProfile: 'ed25519-raw-32-v1';
+  signatureHex: string;
+}
+
+export interface CanonicalWalletSignature {
+  schemaVersion: 1;
+  keyId: `sha256:${string}`;
+  identityScheme: 'sdn-bip32-slip10-purpose-v1';
+  algorithm: 'ed25519';
+  encoding: 'raw';
+  signatureProfile: 'ed25519-over-sha256-jcs-v1';
+  canonicalEnvelope: string;
+  signedDigestSha256: string;
+  signatureHex: string;
+}
+
+export interface SdnLoginV2WireRequest {
+  audience: string;
+  challengeBase64url: string;
+  expiresAt: string;
+  issuedAt: string;
+  nonce: string;
+  protocolVersion: 2;
+}
+
+export interface ReviewedTransform {
+  translation: readonly [number, number, number];
+  rotation: readonly [number, number, number, number];
+  scale: readonly [number, number, number];
+  upAxis: 'X_UP' | 'Y_UP' | 'Z_UP';
+  sourceUnits: 'm' | 'cm' | 'mm' | 'km';
+  metersPerSourceUnit: number;
+}
+
+interface AssetReviewApprovalRequestBase {
+  protocolVersion: 1;
+  audience: 'asset-review:assets.ipfs.01';
+  requestOrigin: 'https://review.spacedatanetwork.org';
+  clientId: 'sdn-asset-review-v1';
+  challengeId: string;
+  nonce: string;
+  issuedAt: string;
+  expiresAt: string;
+  candidateKey: string;
+  modelCid: string;
+  modelSha256: string;
+  modelBytes: number;
+  metadataSha256: string;
+  previousDecisionHead: string | null;
+}
+
+export interface AssetReviewApproveRequest extends AssetReviewApprovalRequestBase {
+  decision: 'approve';
+  reviewedTransform: ReviewedTransform;
+  note: string | null;
+}
+
+export interface AssetReviewDisapproveRequest extends AssetReviewApprovalRequestBase {
+  decision: 'disapprove';
+  reason: string;
+}
+
+export type AssetReviewApprovalRequest =
+  | AssetReviewApproveRequest
+  | AssetReviewDisapproveRequest;
+
+export interface AssetReviewAuthorityActivationRequest {
+  protocolVersion: 1;
+  audience: 'asset-review-authority:assets.ipfs.01';
+  requestOrigin: 'https://review.spacedatanetwork.org';
+  clientId: 'sdn-asset-review-v1';
+  serviceInstance: 'assets.ipfs.01/asset-review-attestation';
+  purpose: 'asset-review-authority-activation';
+  nonce: string;
+  issuedAt: string;
+  expiresAt: string;
+  publicKeyHex: string;
+  keyId: `sha256:${string}`;
+  identityScheme: 'sdn-bip32-slip10-purpose-v1';
+  signatureProfile: 'ed25519-over-sha256-jcs-v1';
+}
+
+export interface RememberWalletSealInput {
+  passwordUtf8: Uint8Array;
+  prfOutput: Uint8Array;
+  hkdfSalt: Uint8Array;
+  nonce: Uint8Array;
+  canonicalAad: string;
+}
+
+export interface SdnIdentityCapabilities {
+  derivePasswordIdentity(input: {
+    usernameUtf8: Uint8Array;
+    passwordUtf8: Uint8Array;
+    accountIndex: 0 | 1;
+  }): Promise<{ handle: SdnIdentityHandle; identity: SdnWasmPublicIdentity }>;
+  deriveLegacyPasswordIdentity(input: {
+    usernameUtf8: Uint8Array;
+    passwordUtf8: Uint8Array;
+    accountIndex: 0 | 1;
+  }): Promise<{ handle: SdnIdentityHandle; identity: SdnWasmPublicIdentity }>;
+  importLegacyMnemonicIdentity(input: {
+    mnemonicUtf8: Uint8Array;
+    accountIndex: 0 | 1;
+  }): Promise<{ handle: SdnIdentityHandle; identity: SdnWasmPublicIdentity }>;
+  importRememberedIdentity(input: {
+    ciphertextAndTag: Uint8Array;
+    prfOutput: Uint8Array;
+    hkdfSalt: Uint8Array;
+    nonce: Uint8Array;
+    canonicalUsernameUtf8: Uint8Array;
+    canonicalAad: string;
+  }): { handle: SdnIdentityHandle; identity: SdnWasmPublicIdentity };
+  signSdnLoginV1(handle: SdnIdentityHandle, challenge: Uint8Array): RawWalletSignature;
+  signSdnLoginV2(
+    handle: SdnIdentityHandle,
+    request: SdnLoginV2WireRequest,
+    registryRow: 'sdn-node-console-v2',
+  ): CanonicalWalletSignature;
+  signAssetReviewAuthorityActivation(
+    handle: SdnIdentityHandle,
+    request: AssetReviewAuthorityActivationRequest,
+    registryRow: 'asset-review-authority-activation-v1',
+  ): CanonicalWalletSignature;
+  signAssetReviewDecision(
+    handle: SdnIdentityHandle,
+    request: AssetReviewApprovalRequest,
+    registryRow: 'asset-review-decision-v1',
+  ): CanonicalWalletSignature;
+  sealRememberedIdentity(
+    handle: SdnIdentityHandle,
+    input: RememberWalletSealInput,
+  ): Uint8Array;
+  destroySdnIdentity(handle: SdnIdentityHandle): void;
+}
+
+export interface WalletOriginCapabilities {
+  readonly sdn: SdnIdentityCapabilities;
+  readonly sha256: (bytes: Uint8Array) => Uint8Array;
+}
+
 // =============================================================================
 // Module Types
 // =============================================================================
@@ -219,6 +406,12 @@ export interface HDWalletModule {
   // Canonical SDN plugin-facing contract
   plugin: SdnPluginContract;
 
+  // Purpose-separated, instance-bound SDN wallet capabilities
+  readonly sdn: SdnIdentityCapabilities;
+
+  // Authenticated, immutable binding used only by the wallet-origin runtime
+  readonly walletOriginCapabilities: WalletOriginCapabilities;
+
   // Aligned binary API for efficient batch operations
   aligned: AlignedAPI;
 }
@@ -934,15 +1127,18 @@ export enum WellKnownCoinType {
 
 /**
  * Initialize the HD Wallet WASM module
- * @param wasmPath - Optional path to WASM file
  */
-export default function init(wasmPath?: string): Promise<HDWalletModule>;
+export default function init(): Promise<HDWalletModule>;
 
 /**
  * Create HD Wallet instance (alternative syntax)
- * @param wasmPath - Optional path to WASM file
  */
-export function createHDWallet(wasmPath?: string): Promise<HDWalletModule>;
+export function createHDWallet(): Promise<HDWalletModule>;
+
+/** Resolve the immutable wallet-origin binding for its exact initialized owner. */
+export function getWalletOriginCapabilities(
+  module: HDWalletModule,
+): WalletOriginCapabilities;
 
 export const HD_WALLET_SDN_PLUGIN_MANIFEST: SdnPluginManifest;
 export const SDN_PLUGIN_MANIFEST_EXPORTS: {
@@ -950,76 +1146,6 @@ export const SDN_PLUGIN_MANIFEST_EXPORTS: {
   sizeSymbol: string;
 };
 
-// =============================================================================
-// EPM Attestation
-// =============================================================================
-
-export interface ChainProofData {
-  CHAIN: string;
-  ADDRESS: string;
-  PUBLIC_KEY: string;
-  KEY_PATH: string;
-  SIGNATURE: string;
-  SIGNED_PAYLOAD: string;
-  ALGORITHM: string;
-  ENCODING: string;
-}
-
-export interface CanonicalPayloadParams {
-  xpub: string;
-  signingPubKeyHex: string;
-  encryptionPubKeyHex: string;
-  issuedAt: number;
-  identityPubKeyHex?: string;
-  version?: string;
-}
-
-export interface ChainKeyParams {
-  address: string;
-  publicKeyHex: string;
-  privateKey: Uint8Array;
-  keyPath: string;
-  canonicalPayload: string;
-}
-
-export interface AllChainProofsParams {
-  canonicalPayload: string;
-  bitcoin?: Omit<ChainKeyParams, 'canonicalPayload'>;
-  ethereum?: Omit<ChainKeyParams, 'canonicalPayload'>;
-  solana?: Omit<ChainKeyParams, 'canonicalPayload'>;
-}
-
-export interface ChainProofVerifyResult {
-  valid: boolean;
-  results: Array<{ chain: string; valid: boolean }>;
-}
-
-/** Build a canonical attestation payload for chain proof signing */
-export function buildCanonicalPayload(params: CanonicalPayloadParams): string;
-
-/** Build canonical EPM content bytes for signing (excludes SIGNATURE and SIGNATURE_TIMESTAMP) */
-export function buildEPMSigningContent(epm: Record<string, unknown>): Uint8Array;
-
-/** Sign EPM content with an Ed25519 private key */
-export function signEPMContent(wallet: HDWalletModule, epm: Record<string, unknown>, ed25519PrivateKey: Uint8Array): { signature: string; timestamp: number };
-
-/** Verify an EPM content signature */
-export function verifyEPMSignature(wallet: HDWalletModule, epm: Record<string, unknown>, ed25519PublicKey: Uint8Array): boolean;
-
-/** Build a Bitcoin chain proof */
-export function buildBitcoinChainProof(wallet: HDWalletModule, params: ChainKeyParams): ChainProofData;
-
-/** Build an Ethereum chain proof */
-export function buildEthereumChainProof(wallet: HDWalletModule, params: ChainKeyParams): ChainProofData;
-
-/** Build a Solana chain proof */
-export function buildSolanaChainProof(wallet: HDWalletModule, params: ChainKeyParams): ChainProofData;
-
-/** Build all chain proofs for a full identity attestation */
-export function buildAllChainProofs(wallet: HDWalletModule, params: AllChainProofsParams): ChainProofData[];
-
-/** Verify a single chain proof */
-export function verifyChainProof(wallet: HDWalletModule, proof: ChainProofData): boolean;
-
-/** Verify all chain proofs in an EPM */
-export function verifyAllChainProofs(wallet: HDWalletModule, chainProofs: ChainProofData[]): ChainProofVerifyResult;
+// Keep the root declaration surface identical to the dedicated attestation
+// subpath instead of maintaining a second, diverging copy of these types.
+export * from './epm-attestation.js';

package/{src → dist/runtime}/index.mjs

@@ -9,7 +9,7 @@
  * - Transaction building and signing
  *
  * @module hd-wallet-wasm
- * @version 2.0.9
+ * @version 2.0.26
  */
 
 // Import aligned API for batch operations
@@ -19,6 +19,56 @@ import {
   SDN_PLUGIN_MANIFEST_EXPORTS
 } from './sdn-plugin.mjs';
 import { HD_WALLET_SDN_PLUGIN_MANIFEST } from './sdn-plugin-manifest-source.mjs';
+import { createSdnTypedCapabilities } from './sdn-typed.mjs';
+
+const walletOriginCapabilitiesByModule = new WeakMap();
+
+function createWalletOriginCapabilitiesBinding(module) {
+  const sdn = module.sdn;
+  const utils = module.utils;
+  const wasmSha256 = utils.sha256;
+  return Object.freeze({
+    sdn,
+    sha256(bytes) {
+      return wasmSha256(bytes);
+    },
+  });
+}
+
+function installWalletOriginCapabilities(module) {
+  const binding = createWalletOriginCapabilitiesBinding(module);
+  Object.defineProperty(module, 'walletOriginCapabilities', {
+    value: binding,
+    enumerable: false,
+    writable: false,
+    configurable: false,
+  });
+  walletOriginCapabilitiesByModule.set(module, binding);
+}
+
+/**
+ * Resolve the wallet-origin binding only for the exact initialized owner.
+ * Forged pairs and copied bindings are never accepted as module authority.
+ *
+ * @param {Object} module - An initialized HDWalletModule returned by init().
+ * @returns {{sdn: Object, sha256: (bytes: Uint8Array) => Uint8Array}}
+ */
+export function getWalletOriginCapabilities(module) {
+  if (module === null || typeof module !== 'object') {
+    throw new TypeError('Invalid HD wallet module');
+  }
+  const binding = walletOriginCapabilitiesByModule.get(module);
+  if (!binding) throw new TypeError('Invalid HD wallet module');
+  const descriptor = Object.getOwnPropertyDescriptor(
+    module,
+    'walletOriginCapabilities',
+  );
+  if (!descriptor || descriptor.value !== binding || descriptor.enumerable ||
+      descriptor.writable || descriptor.configurable) {
+    throw new TypeError('Invalid HD wallet module');
+  }
+  return binding;
+}
 
 // =============================================================================
 // Enums (matching TypeScript definitions)
@@ -1183,7 +1233,7 @@ async function loadWasmModule() {
   let HDWalletWasm;
 
   try {
-    const module = await import('../dist/hd-wallet.js');
+    const module = await import('../hd-wallet.js');
     HDWalletWasm = module.default;
   } catch (e) {
     if (typeof globalThis !== 'undefined' && globalThis.HDWalletWasm) {
@@ -4586,6 +4636,13 @@ function createModule(wasm) {
     }
   };
 
+  Object.defineProperty(module, 'sdn', {
+    value: createSdnTypedCapabilities(wasm),
+    enumerable: true,
+    writable: false,
+    configurable: false,
+  });
+  installWalletOriginCapabilities(module);
   module.plugin = createSdnPluginContract({ wallet: module, wasm });
   return module;
 }