feat(wasm-utxo): replace outputScripts with publicKeys in parsing functions

Update parseTransactionWithWalletKeys and verifyReplayProtectionSignature
to use publicKeys instead of outputScripts for replay protection validation.
This provides a cleaner API and better aligns with the key-based security model.

Issue: BTC-2786

Co-authored-by: llm-git <[email protected]>

Author: OttoAllmendinger

packages/wasm-utxo/test/fixedScript/parseTransactionWithWalletKeys.ts

@@ -3,10 +3,12 @@ import * as utxolib from "@bitgo/utxo-lib";
 import { fixedScriptWallet } from "../../js/index.js";
 import { BitGoPsbt, InputScriptType } from "../../js/fixedScriptWallet/index.js";
 import type { RootWalletKeys } from "../../js/fixedScriptWallet/RootWalletKeys.js";
+import type { ECPair } from "../../js/index.js";
 import {
   loadPsbtFixture,
   loadWalletKeysFromFixture,
   getPsbtBuffer,
+  loadReplayProtectionKeyFromFixture,
   type Fixture,
 } from "./fixtureUtil.js";
 
@@ -36,12 +38,6 @@ function getOtherWalletKeys(): utxolib.bitgo.RootWalletKeys {
 }
 
 describe("parseTransactionWithWalletKeys", function () {
-  // Replay protection script that matches Rust tests
-  const replayProtectionScript = Buffer.from(
-    "a91420b37094d82a513451ff0ccd9db23aba05bc5ef387",
-    "hex",
-  );
-
   const supportedNetworks = utxolib.getNetworkList().filter((network) => {
     return (
       utxolib.isMainnet(network) &&
@@ -60,13 +56,15 @@ describe("parseTransactionWithWalletKeys", function () {
       let fullsignedPsbtBytes: Buffer;
       let bitgoPsbt: BitGoPsbt;
       let rootWalletKeys: RootWalletKeys;
+      let replayProtectionKey: ECPair;
       let fixture: Fixture;
 
       before(function () {
         fixture = loadPsbtFixture(networkName, "fullsigned");
         fullsignedPsbtBytes = getPsbtBuffer(fixture);
         bitgoPsbt = fixedScriptWallet.BitGoPsbt.fromBytes(fullsignedPsbtBytes, networkName);
         rootWalletKeys = loadWalletKeysFromFixture(fixture);
+        replayProtectionKey = loadReplayProtectionKeyFromFixture(fixture);
       });
 
       it("should have matching unsigned transaction ID", function () {
@@ -80,7 +78,7 @@ describe("parseTransactionWithWalletKeys", function () {
 
       it("should parse transaction and identify internal/external outputs", function () {
         const parsed = bitgoPsbt.parseTransactionWithWalletKeys(rootWalletKeys, {
-          outputScripts: [replayProtectionScript],
+          publicKeys: [replayProtectionKey],
         });
 
         // Verify all inputs have addresses and values
@@ -147,7 +145,7 @@ describe("parseTransactionWithWalletKeys", function () {
 
       it("should parse inputs with correct scriptType", function () {
         const parsed = bitgoPsbt.parseTransactionWithWalletKeys(rootWalletKeys, {
-          outputScripts: [replayProtectionScript],
+          publicKeys: [replayProtectionKey],
         });
 
         // Verify all inputs have scriptType matching fixture
@@ -166,7 +164,7 @@ describe("parseTransactionWithWalletKeys", function () {
         assert.throws(
           () => {
             bitgoPsbt.parseTransactionWithWalletKeys(getOtherWalletKeys(), {
-              outputScripts: [replayProtectionScript],
+              publicKeys: [replayProtectionKey],
             });
           },
           (error: Error) => {

packages/wasm-utxo/test/fixedScript/verifySignature.ts

@@ -70,12 +70,8 @@ function verifyInputSignatures(
 ): void {
   // Handle replay protection inputs (P2shP2pk)
   if ("hasReplayProtectionSignature" in expectedSignatures) {
-    const replayProtectionScript = Buffer.from(
-      "a91420b37094d82a513451ff0ccd9db23aba05bc5ef387",
-      "hex",
-    );
     const hasReplaySig = bitgoPsbt.verifyReplayProtectionSignature(inputIndex, {
-      outputScripts: [replayProtectionScript],
+      publicKeys: [replayProtectionKey],
     });
     assert.strictEqual(
       hasReplaySig,
@@ -127,19 +123,17 @@ function verifyInputSignatures(
  * @param fixture - The test fixture containing input metadata
  * @param rootWalletKeys - Wallet keys for verification
  * @param replayProtectionKey - Key for replay protection inputs
- * @param replayProtectionScript - Script for replay protection inputs
  * @param signatureStage - The signing stage (unsigned, halfsigned, fullsigned)
  */
 function verifyAllInputSignatures(
   bitgoPsbt: BitGoPsbt,
   fixture: Fixture,
   rootWalletKeys: RootWalletKeys,
   replayProtectionKey: ECPair,
-  replayProtectionScript: Uint8Array,
   signatureStage: SignatureStage,
 ): void {
   const parsed = bitgoPsbt.parseTransactionWithWalletKeys(rootWalletKeys, {
-    outputScripts: [replayProtectionScript],
+    publicKeys: [replayProtectionKey],
   });
 
   fixture.psbtInputs.forEach((input, index) => {
@@ -178,18 +172,13 @@ describe("verifySignature", function () {
       let unsignedBitgoPsbt: BitGoPsbt;
       let halfsignedBitgoPsbt: BitGoPsbt;
       let fullsignedBitgoPsbt: BitGoPsbt;
-      let replayProtectionScript: Uint8Array;
 
       before(function () {
         unsignedFixture = loadPsbtFixture(networkName, "unsigned");
         halfsignedFixture = loadPsbtFixture(networkName, "halfsigned");
         fullsignedFixture = loadPsbtFixture(networkName, "fullsigned");
         rootWalletKeys = loadWalletKeysFromFixture(fullsignedFixture);
         replayProtectionKey = loadReplayProtectionKeyFromFixture(fullsignedFixture);
-        replayProtectionScript = Buffer.from(
-          "a91420b37094d82a513451ff0ccd9db23aba05bc5ef387",
-          "hex",
-        );
         unsignedBitgoPsbt = fixedScriptWallet.BitGoPsbt.fromBytes(
           getPsbtBuffer(unsignedFixture),
           networkName,
@@ -211,7 +200,6 @@ describe("verifySignature", function () {
             unsignedFixture,
             rootWalletKeys,
             replayProtectionKey,
-            replayProtectionScript,
             "unsigned",
           );
         });
@@ -224,7 +212,6 @@ describe("verifySignature", function () {
             halfsignedFixture,
             rootWalletKeys,
             replayProtectionKey,
-            replayProtectionScript,
             "halfsigned",
           );
         });
@@ -237,7 +224,6 @@ describe("verifySignature", function () {
             fullsignedFixture,
             rootWalletKeys,
             replayProtectionKey,
-            replayProtectionScript,
             "fullsigned",
           );
         });