hd-wallet-wasm 2.0.21 → 2.0.26

package/dist/runtime/epm-attestation.d.ts

@@ -0,0 +1,105 @@
+import type { HDWalletModule } from './index.js';
+
+export type EpmSignatureCurve = 'ed25519' | 'secp256k1';
+
+export interface EpmSignatureOptions {
+  curve?: EpmSignatureCurve;
+}
+
+export interface EpmSignatureResult {
+  signature: string;
+  timestamp: number;
+}
+
+export interface CanonicalPayloadParams {
+  xpub: string;
+  signingPubKeyHex: string;
+  encryptionPubKeyHex: string;
+  issuedAt: number;
+  identityPubKeyHex?: string;
+  version?: string;
+}
+
+export interface ChainKeyParams {
+  address: string;
+  publicKeyHex: string;
+  privateKey: Uint8Array;
+  keyPath: string;
+  canonicalPayload: string;
+}
+
+export interface AllChainProofsParams {
+  canonicalPayload: string;
+  bitcoin?: Omit<ChainKeyParams, 'canonicalPayload'>;
+  ethereum?: Omit<ChainKeyParams, 'canonicalPayload'>;
+  solana?: Omit<ChainKeyParams, 'canonicalPayload'>;
+}
+
+export interface ChainProofData {
+  CHAIN: string;
+  ADDRESS: string;
+  PUBLIC_KEY: string;
+  KEY_PATH: string;
+  SIGNATURE: string;
+  SIGNED_PAYLOAD: string;
+  ALGORITHM: string;
+  ENCODING: string;
+}
+
+export interface ChainProofResult {
+  chain: string;
+  valid: boolean;
+}
+
+export interface ChainProofVerifyResult {
+  valid: boolean;
+  results: ChainProofResult[];
+}
+
+export function buildCanonicalPayload(params: CanonicalPayloadParams): string;
+
+export function buildEPMSigningContent(epm: Record<string, unknown>): Uint8Array;
+
+export function signEPMContent(
+  wallet: HDWalletModule,
+  epm: Record<string, unknown>,
+  privateKey: Uint8Array,
+  options?: EpmSignatureOptions,
+): EpmSignatureResult;
+
+export function verifyEPMSignature(
+  wallet: HDWalletModule,
+  epm: Record<string, unknown>,
+  publicKey: Uint8Array,
+  options?: EpmSignatureOptions,
+): boolean;
+
+export function buildBitcoinChainProof(
+  wallet: HDWalletModule,
+  params: ChainKeyParams,
+): ChainProofData;
+
+export function buildEthereumChainProof(
+  wallet: HDWalletModule,
+  params: ChainKeyParams,
+): ChainProofData;
+
+export function buildSolanaChainProof(
+  wallet: HDWalletModule,
+  params: ChainKeyParams,
+): ChainProofData;
+
+export function buildAllChainProofs(
+  wallet: HDWalletModule,
+  params: AllChainProofsParams,
+): ChainProofData[];
+
+export function verifyChainProof(
+  wallet: HDWalletModule,
+  proof: ChainProofData,
+): boolean;
+
+export function verifyAllChainProofs(
+  wallet: HDWalletModule,
+  chainProofs: ChainProofData[],
+): ChainProofVerifyResult;

package/dist/{index.d.ts → runtime/index.d.ts}

@@ -10,7 +10,7 @@
  */
 
 // Import aligned API types
-import { AlignedAPI } from './aligned';
+import { AlignedAPI } from './aligned.js';
 
 export type BinaryLike = Uint8Array | ArrayBuffer | ArrayBufferView;
 export type X509CertificateInput = string | BinaryLike;
@@ -142,6 +142,193 @@ export interface SdnPluginContract {
   verify_detached(request: { inputs: SdnPluginFrame[] }): SdnPluginInvocationResult;
 }
 
+declare const sdnIdentityHandleBrand: unique symbol;
+
+export interface SdnIdentityHandle {
+  readonly [sdnIdentityHandleBrand]: true;
+}
+
+export interface SdnWasmKeyDescriptor {
+  purpose: 'asset-review-approval' | 'contact-encryption' | 'sdn-authentication';
+  identityScheme: 'sdn-bip32-slip10-purpose-v1'
+    | 'sdn-fast-password-auth-v1-legacy' | 'sdn-bip39-auth-v1-legacy';
+  seedProfile: 'password-scrypt-v2' | 'password-fast-v1-legacy'
+    | 'bip39-mnemonic-v1-legacy';
+  signatureProfile: 'ed25519-over-sha256-jcs-v1'
+    | 'ed25519-raw-32-v1' | null;
+  curve: 'ed25519' | 'x25519';
+  derivation: 'slip10' | 'bip32-scalar-as-ed25519-seed';
+  path: string;
+  encoding: 'raw';
+  publicKeyHex: string;
+  bip32Fingerprint: null;
+  keyId: `sha256:${string}`;
+}
+
+export interface SdnWasmPublicIdentity {
+  schemaVersion: 1;
+  identityScheme: SdnWasmKeyDescriptor['identityScheme'];
+  seedProfile: SdnWasmKeyDescriptor['seedProfile'];
+  accountIndex: 0 | 1;
+  accountLabel: null;
+  accountXpub: string;
+  accountPeerId: string;
+  accountFingerprint: string;
+  keys: readonly SdnWasmKeyDescriptor[];
+}
+
+export type SdnRegistryRowId =
+  | 'sdn-node-console-v2'
+  | 'asset-review-authority-activation-v1'
+  | 'asset-review-decision-v1';
+
+export interface RawWalletSignature {
+  schemaVersion: 1;
+  keyId: `sha256:${string}`;
+  identityScheme: 'sdn-fast-password-auth-v1-legacy' | 'sdn-bip39-auth-v1-legacy';
+  algorithm: 'ed25519';
+  encoding: 'raw';
+  signatureProfile: 'ed25519-raw-32-v1';
+  signatureHex: string;
+}
+
+export interface CanonicalWalletSignature {
+  schemaVersion: 1;
+  keyId: `sha256:${string}`;
+  identityScheme: 'sdn-bip32-slip10-purpose-v1';
+  algorithm: 'ed25519';
+  encoding: 'raw';
+  signatureProfile: 'ed25519-over-sha256-jcs-v1';
+  canonicalEnvelope: string;
+  signedDigestSha256: string;
+  signatureHex: string;
+}
+
+export interface SdnLoginV2WireRequest {
+  audience: string;
+  challengeBase64url: string;
+  expiresAt: string;
+  issuedAt: string;
+  nonce: string;
+  protocolVersion: 2;
+}
+
+export interface ReviewedTransform {
+  translation: readonly [number, number, number];
+  rotation: readonly [number, number, number, number];
+  scale: readonly [number, number, number];
+  upAxis: 'X_UP' | 'Y_UP' | 'Z_UP';
+  sourceUnits: 'm' | 'cm' | 'mm' | 'km';
+  metersPerSourceUnit: number;
+}
+
+interface AssetReviewApprovalRequestBase {
+  protocolVersion: 1;
+  audience: 'asset-review:assets.ipfs.01';
+  requestOrigin: 'https://review.spacedatanetwork.org';
+  clientId: 'sdn-asset-review-v1';
+  challengeId: string;
+  nonce: string;
+  issuedAt: string;
+  expiresAt: string;
+  candidateKey: string;
+  modelCid: string;
+  modelSha256: string;
+  modelBytes: number;
+  metadataSha256: string;
+  previousDecisionHead: string | null;
+}
+
+export interface AssetReviewApproveRequest extends AssetReviewApprovalRequestBase {
+  decision: 'approve';
+  reviewedTransform: ReviewedTransform;
+  note: string | null;
+}
+
+export interface AssetReviewDisapproveRequest extends AssetReviewApprovalRequestBase {
+  decision: 'disapprove';
+  reason: string;
+}
+
+export type AssetReviewApprovalRequest =
+  | AssetReviewApproveRequest
+  | AssetReviewDisapproveRequest;
+
+export interface AssetReviewAuthorityActivationRequest {
+  protocolVersion: 1;
+  audience: 'asset-review-authority:assets.ipfs.01';
+  requestOrigin: 'https://review.spacedatanetwork.org';
+  clientId: 'sdn-asset-review-v1';
+  serviceInstance: 'assets.ipfs.01/asset-review-attestation';
+  purpose: 'asset-review-authority-activation';
+  nonce: string;
+  issuedAt: string;
+  expiresAt: string;
+  publicKeyHex: string;
+  keyId: `sha256:${string}`;
+  identityScheme: 'sdn-bip32-slip10-purpose-v1';
+  signatureProfile: 'ed25519-over-sha256-jcs-v1';
+}
+
+export interface RememberWalletSealInput {
+  passwordUtf8: Uint8Array;
+  prfOutput: Uint8Array;
+  hkdfSalt: Uint8Array;
+  nonce: Uint8Array;
+  canonicalAad: string;
+}
+
+export interface SdnIdentityCapabilities {
+  derivePasswordIdentity(input: {
+    usernameUtf8: Uint8Array;
+    passwordUtf8: Uint8Array;
+    accountIndex: 0 | 1;
+  }): Promise<{ handle: SdnIdentityHandle; identity: SdnWasmPublicIdentity }>;
+  deriveLegacyPasswordIdentity(input: {
+    usernameUtf8: Uint8Array;
+    passwordUtf8: Uint8Array;
+    accountIndex: 0 | 1;
+  }): Promise<{ handle: SdnIdentityHandle; identity: SdnWasmPublicIdentity }>;
+  importLegacyMnemonicIdentity(input: {
+    mnemonicUtf8: Uint8Array;
+    accountIndex: 0 | 1;
+  }): Promise<{ handle: SdnIdentityHandle; identity: SdnWasmPublicIdentity }>;
+  importRememberedIdentity(input: {
+    ciphertextAndTag: Uint8Array;
+    prfOutput: Uint8Array;
+    hkdfSalt: Uint8Array;
+    nonce: Uint8Array;
+    canonicalUsernameUtf8: Uint8Array;
+    canonicalAad: string;
+  }): { handle: SdnIdentityHandle; identity: SdnWasmPublicIdentity };
+  signSdnLoginV1(handle: SdnIdentityHandle, challenge: Uint8Array): RawWalletSignature;
+  signSdnLoginV2(
+    handle: SdnIdentityHandle,
+    request: SdnLoginV2WireRequest,
+    registryRow: 'sdn-node-console-v2',
+  ): CanonicalWalletSignature;
+  signAssetReviewAuthorityActivation(
+    handle: SdnIdentityHandle,
+    request: AssetReviewAuthorityActivationRequest,
+    registryRow: 'asset-review-authority-activation-v1',
+  ): CanonicalWalletSignature;
+  signAssetReviewDecision(
+    handle: SdnIdentityHandle,
+    request: AssetReviewApprovalRequest,
+    registryRow: 'asset-review-decision-v1',
+  ): CanonicalWalletSignature;
+  sealRememberedIdentity(
+    handle: SdnIdentityHandle,
+    input: RememberWalletSealInput,
+  ): Uint8Array;
+  destroySdnIdentity(handle: SdnIdentityHandle): void;
+}
+
+export interface WalletOriginCapabilities {
+  readonly sdn: SdnIdentityCapabilities;
+  readonly sha256: (bytes: Uint8Array) => Uint8Array;
+}
+
 // =============================================================================
 // Module Types
 // =============================================================================
@@ -219,6 +406,12 @@ export interface HDWalletModule {
   // Canonical SDN plugin-facing contract
   plugin: SdnPluginContract;
 
+  // Purpose-separated, instance-bound SDN wallet capabilities
+  readonly sdn: SdnIdentityCapabilities;
+
+  // Authenticated, immutable binding used only by the wallet-origin runtime
+  readonly walletOriginCapabilities: WalletOriginCapabilities;
+
   // Aligned binary API for efficient batch operations
   aligned: AlignedAPI;
 }
@@ -934,15 +1127,18 @@ export enum WellKnownCoinType {
 
 /**
  * Initialize the HD Wallet WASM module
- * @param wasmPath - Optional path to WASM file
  */
-export default function init(wasmPath?: string): Promise<HDWalletModule>;
+export default function init(): Promise<HDWalletModule>;
 
 /**
  * Create HD Wallet instance (alternative syntax)
- * @param wasmPath - Optional path to WASM file
  */
-export function createHDWallet(wasmPath?: string): Promise<HDWalletModule>;
+export function createHDWallet(): Promise<HDWalletModule>;
+
+/** Resolve the immutable wallet-origin binding for its exact initialized owner. */
+export function getWalletOriginCapabilities(
+  module: HDWalletModule,
+): WalletOriginCapabilities;
 
 export const HD_WALLET_SDN_PLUGIN_MANIFEST: SdnPluginManifest;
 export const SDN_PLUGIN_MANIFEST_EXPORTS: {
@@ -950,76 +1146,6 @@ export const SDN_PLUGIN_MANIFEST_EXPORTS: {
   sizeSymbol: string;
 };
 
-// =============================================================================
-// EPM Attestation
-// =============================================================================
-
-export interface ChainProofData {
-  CHAIN: string;
-  ADDRESS: string;
-  PUBLIC_KEY: string;
-  KEY_PATH: string;
-  SIGNATURE: string;
-  SIGNED_PAYLOAD: string;
-  ALGORITHM: string;
-  ENCODING: string;
-}
-
-export interface CanonicalPayloadParams {
-  xpub: string;
-  signingPubKeyHex: string;
-  encryptionPubKeyHex: string;
-  issuedAt: number;
-  identityPubKeyHex?: string;
-  version?: string;
-}
-
-export interface ChainKeyParams {
-  address: string;
-  publicKeyHex: string;
-  privateKey: Uint8Array;
-  keyPath: string;
-  canonicalPayload: string;
-}
-
-export interface AllChainProofsParams {
-  canonicalPayload: string;
-  bitcoin?: Omit<ChainKeyParams, 'canonicalPayload'>;
-  ethereum?: Omit<ChainKeyParams, 'canonicalPayload'>;
-  solana?: Omit<ChainKeyParams, 'canonicalPayload'>;
-}
-
-export interface ChainProofVerifyResult {
-  valid: boolean;
-  results: Array<{ chain: string; valid: boolean }>;
-}
-
-/** Build a canonical attestation payload for chain proof signing */
-export function buildCanonicalPayload(params: CanonicalPayloadParams): string;
-
-/** Build canonical EPM content bytes for signing (excludes SIGNATURE and SIGNATURE_TIMESTAMP) */
-export function buildEPMSigningContent(epm: Record<string, unknown>): Uint8Array;
-
-/** Sign EPM content with an Ed25519 private key */
-export function signEPMContent(wallet: HDWalletModule, epm: Record<string, unknown>, ed25519PrivateKey: Uint8Array): { signature: string; timestamp: number };
-
-/** Verify an EPM content signature */
-export function verifyEPMSignature(wallet: HDWalletModule, epm: Record<string, unknown>, ed25519PublicKey: Uint8Array): boolean;
-
-/** Build a Bitcoin chain proof */
-export function buildBitcoinChainProof(wallet: HDWalletModule, params: ChainKeyParams): ChainProofData;
-
-/** Build an Ethereum chain proof */
-export function buildEthereumChainProof(wallet: HDWalletModule, params: ChainKeyParams): ChainProofData;
-
-/** Build a Solana chain proof */
-export function buildSolanaChainProof(wallet: HDWalletModule, params: ChainKeyParams): ChainProofData;
-
-/** Build all chain proofs for a full identity attestation */
-export function buildAllChainProofs(wallet: HDWalletModule, params: AllChainProofsParams): ChainProofData[];
-
-/** Verify a single chain proof */
-export function verifyChainProof(wallet: HDWalletModule, proof: ChainProofData): boolean;
-
-/** Verify all chain proofs in an EPM */
-export function verifyAllChainProofs(wallet: HDWalletModule, chainProofs: ChainProofData[]): ChainProofVerifyResult;
+// Keep the root declaration surface identical to the dedicated attestation
+// subpath instead of maintaining a second, diverging copy of these types.
+export * from './epm-attestation.js';

package/{src → dist/runtime}/index.mjs

@@ -9,7 +9,7 @@
  * - Transaction building and signing
  *
  * @module hd-wallet-wasm
- * @version 2.0.9
+ * @version 2.0.26
  */
 
 // Import aligned API for batch operations
@@ -19,6 +19,56 @@ import {
   SDN_PLUGIN_MANIFEST_EXPORTS
 } from './sdn-plugin.mjs';
 import { HD_WALLET_SDN_PLUGIN_MANIFEST } from './sdn-plugin-manifest-source.mjs';
+import { createSdnTypedCapabilities } from './sdn-typed.mjs';
+
+const walletOriginCapabilitiesByModule = new WeakMap();
+
+function createWalletOriginCapabilitiesBinding(module) {
+  const sdn = module.sdn;
+  const utils = module.utils;
+  const wasmSha256 = utils.sha256;
+  return Object.freeze({
+    sdn,
+    sha256(bytes) {
+      return wasmSha256(bytes);
+    },
+  });
+}
+
+function installWalletOriginCapabilities(module) {
+  const binding = createWalletOriginCapabilitiesBinding(module);
+  Object.defineProperty(module, 'walletOriginCapabilities', {
+    value: binding,
+    enumerable: false,
+    writable: false,
+    configurable: false,
+  });
+  walletOriginCapabilitiesByModule.set(module, binding);
+}
+
+/**
+ * Resolve the wallet-origin binding only for the exact initialized owner.
+ * Forged pairs and copied bindings are never accepted as module authority.
+ *
+ * @param {Object} module - An initialized HDWalletModule returned by init().
+ * @returns {{sdn: Object, sha256: (bytes: Uint8Array) => Uint8Array}}
+ */
+export function getWalletOriginCapabilities(module) {
+  if (module === null || typeof module !== 'object') {
+    throw new TypeError('Invalid HD wallet module');
+  }
+  const binding = walletOriginCapabilitiesByModule.get(module);
+  if (!binding) throw new TypeError('Invalid HD wallet module');
+  const descriptor = Object.getOwnPropertyDescriptor(
+    module,
+    'walletOriginCapabilities',
+  );
+  if (!descriptor || descriptor.value !== binding || descriptor.enumerable ||
+      descriptor.writable || descriptor.configurable) {
+    throw new TypeError('Invalid HD wallet module');
+  }
+  return binding;
+}
 
 // =============================================================================
 // Enums (matching TypeScript definitions)
@@ -1183,7 +1233,7 @@ async function loadWasmModule() {
   let HDWalletWasm;
 
   try {
-    const module = await import('../dist/hd-wallet.js');
+    const module = await import('../hd-wallet.js');
     HDWalletWasm = module.default;
   } catch (e) {
     if (typeof globalThis !== 'undefined' && globalThis.HDWalletWasm) {
@@ -4586,6 +4636,13 @@ function createModule(wasm) {
     }
   };
 
+  Object.defineProperty(module, 'sdn', {
+    value: createSdnTypedCapabilities(wasm),
+    enumerable: true,
+    writable: false,
+    configurable: false,
+  });
+  installWalletOriginCapabilities(module);
   module.plugin = createSdnPluginContract({ wallet: module, wasm });
   return module;
 }