Sign and broadcast transactions

npm install --save-exact [email protected] [email protected] [email protected] \
  @solana/[email protected] [email protected] [email protected]

IO_SIGN_API_URL=https://sign.example.com
IO_SIGN_TOKEN=<bearer-token-for-this-environment>
VAULT_ID=<vault-id>
# Optional: omit to sign with the root vault key.
# DERIVATION_PATH=m/0/1

import { createPublicKey, verify } from 'node:crypto';
import { pathToFileURL } from 'node:url';

export function required(name) {
  const value = process.env[name];
  if (!value) throw new Error(`Set ${name}`);
  return value;
}

export function positiveInteger(value, name) {
  if (!/^[1-9][0-9]*$/.test(String(value))) throw new Error(`${name} must be a positive integer`);
  return BigInt(value);
}

export function hexBytes(value) {
  const hex = value.replace(/^0x/, '');
  if (!/^(?:[0-9a-fA-F]{2})+$/.test(hex)) throw new Error('Invalid hexadecimal bytes');
  return Buffer.from(hex, 'hex');
}

export function signatureBytes(value, algorithm) {
  const bytes = hexBytes(value);
  // The current Virtual Signer appends a zero recovery byte even for Ed25519.
  if (algorithm === 'eddsa' && bytes.length === 64) return bytes;
  if (bytes.length === 65 && (algorithm !== 'eddsa' || bytes[64] === 0)) return bytes.subarray(0, 64);
  throw new Error(`Unexpected ${algorithm} signature encoding`);
}

export function ecdsaParts(value, chainId) {
  const bytes = hexBytes(value);
  if (bytes.length < 65) throw new Error('Expected r, s, and recovery suffix');
  const v = BigInt('0x' + bytes.subarray(64).toString('hex'));
  const parity = v <= 1n ? v : v === 27n || v === 28n ? v - 27n : v - 35n - 2n * BigInt(chainId);
  if (parity !== 0n && parity !== 1n) throw new Error('Invalid recovery suffix or chain ID');
  return { r: '0x' + bytes.subarray(0, 32).toString('hex'),
    s: '0x' + bytes.subarray(32, 64).toString('hex'), yParity: Number(parity) };
}

export function verifyEd25519(message, publicKey, signature) {
  if (publicKey.length !== 32 || signature.length !== 64) throw new Error('Invalid Ed25519 key or signature');
  const key = createPublicKey({ format: 'der', type: 'spki',
    key: Buffer.concat([Buffer.from('302a300506032b6570032100', 'hex'), Buffer.from(publicKey)]) });
  if (!verify(null, message, key, signature)) throw new Error('Signature does not match the message and public key');
}

export async function requestSignature(config, item, checkFresh = async () => {}) {
  const { apiUrl, token, vaultId, fetchImpl = fetch, intervalMs = 2000, maxWaitMs = 600_000 } = config;
  const endpoint = `${apiUrl.replace(/\/$/, '')}/v2/vaults/${encodeURIComponent(vaultId)}/signatures`;
  const deadline = Date.now() + maxWaitMs;
  async function api(url, method, body) {
    const response = await fetchImpl(url, {
      method, headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
      ...(body ? { body: JSON.stringify(body) } : {}), signal: AbortSignal.timeout(15_000),
    });
    if (!response.ok) throw new Error(`io.sign HTTP ${response.status}; inspect the existing request before retrying`);
    return response.json();
  }
  await checkFresh();
  // No automatic POST retry: a lost response does not prove creation failed.
  const created = await api(endpoint, 'POST', {
    expiresAt: new Date(Date.now() + 11 * 60_000).toISOString(), signatures: [
    { contentType: 'application/octet-stream+hex', ...item },
  ] });
  if (!created.id) throw new Error('io.sign returned no request ID');
  console.log(`io.sign request: ${created.id}`);
  while (Date.now() < deadline) {
    await checkFresh();
    const result = await api(`${endpoint}/${encodeURIComponent(created.id)}`, 'GET');
    if (result.status === 'completed') {
      const signatures = result.signatures?.[0]?.signature;
      if (!Array.isArray(signatures) || signatures.length !== item.dataToSign.length ||
          !signatures.every((s) => typeof s === 'string')) throw new Error('Missing signature results');
      await checkFresh();
      return signatures;
    }
    if (['rejected', 'expired', 'failed', 'cancelled'].includes(result.status)) {
      throw new Error(`io.sign request ${created.id}: ${result.status}`);
    }
    await new Promise((resolve) => setTimeout(resolve, intervalMs));
  }
  throw new Error(`Stopped waiting for ${created.id}; this does not cancel it. Inspect its status before retrying.`);
}

export function signerFromEnvironment() {
  const config = { apiUrl: required('IO_SIGN_API_URL'), token: required('IO_SIGN_TOKEN'), vaultId: required('VAULT_ID') };
  return (item, checkFresh) => requestSignature(config, {
    ...item, ...(process.env.DERIVATION_PATH ? { derivationPath: process.env.DERIVATION_PATH } : {}),
  }, checkFresh);
}

export function jsonRpc(url, authorization) {
  let id = 0;
  return async (method, params = []) => {
    const response = await fetch(url, {
      method: 'POST', headers: { 'Content-Type': 'application/json', ...(authorization ? { Authorization: authorization } : {}) },
      body: JSON.stringify({ jsonrpc: '2.0', id: ++id, method, params }), signal: AbortSignal.timeout(20_000),
    });
    if (!response.ok) throw new Error(`RPC HTTP ${response.status}`);
    const body = await response.json();
    if (body.error) throw new Error(`RPC ${method}: ${body.error.message}`);
    return body.result;
  };
}

export function runMain(url, main) {
  if (process.argv[1] && pathToFileURL(process.argv[1]).href === url) {
    main().catch((error) => { console.error(error.message); process.exitCode = 1; });
  }
}