V4.0.0

.github/actions/setup-libtss/action.yml

@@ -0,0 +1,35 @@
+name: Setup libtss
+description: Clone 0xCarbon/libtss beside BoldWallet and build libtss-ffi for BBMTLib CGO.
+
+runs:
+  using: composite
+  steps:
+    - name: Checkout libtss (sibling of BoldWallet)
+      shell: bash
+      run: |
+        LIBTSS_DIR="${GITHUB_WORKSPACE}/../libtss"
+        LIBTSS_REF="ae1f891ee2dd67b6e841eaf673f7a1c0e8040815"
+        PATCH="${GITHUB_WORKSPACE}/BBMTLib/mobile-deps/libtss/derive-path-with-chain-code.patch"
+        rm -rf "${LIBTSS_DIR}"
+        git clone https://github.com/0xCarbon/libtss.git "${LIBTSS_DIR}"
+        git -C "${LIBTSS_DIR}" checkout "${LIBTSS_REF}"
+        ACTUAL_REF="$(git -C "${LIBTSS_DIR}" rev-parse HEAD)"
+        if [ "${ACTUAL_REF}" != "${LIBTSS_REF}" ]; then
+          echo "libtss revision mismatch: got ${ACTUAL_REF}, expected ${LIBTSS_REF}" >&2
+          exit 1
+        fi
+        git -C "${LIBTSS_DIR}" apply "${PATCH}"
+        echo "LIBTSS_DIR=${LIBTSS_DIR}" >> "${GITHUB_ENV}"
+        echo "LIBTSS_REF=${LIBTSS_REF}" >> "${GITHUB_ENV}"
+        test -f "${LIBTSS_DIR}/libtss-go/go.mod"
+        grep -q DerivePathWithChainCode "${LIBTSS_DIR}/libtss-go/tss/derive.go"
+
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@stable
+
+    - name: Build libtss-ffi
+      shell: bash
+      run: |
+        cd "${LIBTSS_DIR}"
+        cargo build --release -p libtss-ffi
+        test -f target/release/liblibtss_ffi.a

.github/scripts/check-sensitive-logs.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "${ROOT_DIR}"
+
+PATTERN='raw_json=|sessionID=%s, sessionKey=%s|fullNonce=%s|peerNonce=%s|Input [0-9]+ sighash:|PSBT_JSON:|runNostrPreAgreement.*nonce:'
+
+echo "Running sensitive log regression scan..."
+if git ls-files -z \
+  BBMTLib \
+  ios \
+  android \
+  ':!:**/*.md' \
+  ':!:.github/scripts/check-sensitive-logs.sh' \
+  ':!:BBMTLib/tss/logs.go' |
+  xargs -0 grep -n -E "${PATTERN}"; then
+  echo ""
+  echo "Sensitive log pattern found. Remove or redact before merging."
+  exit 1
+fi
+
+echo "Sensitive log scan passed."

.github/workflows/bbmtlib-test.yml

@@ -5,30 +5,41 @@ on:
     paths:
       - 'BBMTLib/**'
       - '.github/workflows/bbmtlib-test.yml'
+      - '.github/actions/setup-libtss/**'
+      - '.github/scripts/check-sensitive-logs.sh'
   workflow_dispatch:
 
 jobs:
   test:
     name: Test BBMTLib
     runs-on: ubuntu-latest
+    env:
+      CGO_ENABLED: '1'
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
     defaults:
       run:
         working-directory: ./BBMTLib
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+
+      - name: Setup libtss
+        uses: ./.github/actions/setup-libtss
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version: '1.26'
           cache-dependency-path: BBMTLib/go.sum
 
       - name: Verify Go version
         run: go version
 
+      - name: Check sensitive log regressions
+        run: bash ../.github/scripts/check-sensitive-logs.sh
+
       - name: Install dependencies
         run: go mod download
 

.github/workflows/dkls-scripts-test.yml

@@ -0,0 +1,54 @@
+name: DKLs23 Scripts Tests
+
+on:
+  pull_request:
+    paths:
+      - 'BBMTLib/dkls/**'
+      - 'BBMTLib/scripts-dkls/**'
+      - 'BBMTLib/dklsbind/**'
+      - 'BBMTLib/dklsstub/**'
+      - 'BBMTLib/go.mod'
+      - '.github/workflows/dkls-scripts-test.yml'
+      - '.github/actions/setup-libtss/**'
+      - '.github/scripts/check-sensitive-logs.sh'
+  workflow_dispatch:
+
+jobs:
+  test:
+    name: Test DKLs23 scripts
+    runs-on: ubuntu-latest
+    env:
+      CGO_ENABLED: '1'
+      # Node 20 EOL on Actions runners; v6 actions use Node 24 (see GitHub changelog Sep 2025).
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+    defaults:
+      run:
+        working-directory: ./BBMTLib
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup libtss
+        uses: ./.github/actions/setup-libtss
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.26'
+          cache-dependency-path: BBMTLib/go.sum
+
+      - name: Install jq
+        run: sudo apt-get update && sudo apt-get install -y jq
+
+      - name: Check sensitive log regressions
+        run: bash ../.github/scripts/check-sensitive-logs.sh
+
+      - name: Pull Nostr relay image
+        run: docker pull scsibug/nostr-rs-relay:latest
+
+      - name: Run DKLs script tests
+        run: |
+          chmod +x scripts-dkls/*.sh
+          ./scripts-dkls/dkls-test-all.sh
+
+      - name: go test dkls package
+        run: go test -count=1 -short ./dkls/...

.gitignore

@@ -75,21 +75,28 @@ bundle.js
 !.yarn/sdks
 !.yarn/versions
 
-# BBMTLib
+# BBMTLib — Go builds, mobile artifacts, test data
 #
 BBMTLib/.DS_Store
+BBMTLib/bin/
 BBMTLib/*.aar
 BBMTLib/*.jar
-BBMTLib/Tss.xcframework/
+BBMTLib/Tss.xcframework/**
+BBMTLib/Dkls.xcframework/**
+BBMTLib/libbbmtmobile.xcframework/**
+# c-shared host outputs (also under bin/; ignore if written to BBMTLib root)
+BBMTLib/libbbmtmobile
+BBMTLib/libbbmtmobile.h
+BBMTLib/libdklsmobile
+BBMTLib/libdklsmobile.h
 BBMTLib/scripts/bin/
 BBMTLib/scripts/*.json
-# Build binaries (bold-spend cross-platform binaries - ignore these)
-BBMTLib/bin/bold-spend-*
-# Build binaries (bbmt and related binaries - ignore these)
-BBMTLib/bin/bbmt*
+# Prebuilt libtss-ffi static libs (run mobile-deps/libtss/build-libtss.sh)
+BBMTLib/mobile-deps/libtss/**/*.a
+BBMTLib/mobile-deps/libtss/target/
 # Peer configuration files
 BBMTLib/peer*.json
-# Go build artifacts
+# Go build artifacts (host)
 BBMTLib/*.exe
 BBMTLib/*.dll
 BBMTLib/*.so
@@ -100,6 +107,9 @@ BBMTLib/*.dylib
 peer*.ks
 KeyShare*.share
 peer*.share
+# Local Nostr relay data (BBMTLib/scripts/start-local-relay.sh)
+BBMTLib/test-relay-data/
+
 # Testing data and temporary files
 BBMTLib/test-data/
 BBMTLib/test-keygen-output/
@@ -148,7 +158,9 @@ android/gradle.properties.local
 mcps/
 
 # IDE - VSCode
-.vscode/
+.vscode/*
+!.vscode/extensions.json
+!.vscode/c_cpp_properties.json
 *.code-workspace
 
 # IDE - JetBrains
@@ -267,8 +279,6 @@ tmp/
 temp/
 
 # Editor directories and files
-.vscode/*
-!.vscode/extensions.json
 .idea
 *.suo
 *.ntvs*
@@ -305,6 +315,21 @@ proguard/
 android/app/debug/
 android/app/release/
 android/app/profile/
+# Kotlin compiler session markers
+android/.kotlin/
+**/.kotlin/
+*.salive
+# ProGuard/R8 mapping (release builds; huge, regenerated)
+android/mapping.txt
+# Legacy gomobile GG18 AAR (app uses libbbmtmobile.so + dkls_jni; see BBMTLib/build-dkls.sh)
+android/app/libs/tss.aar
+android/app/libs/tss-sources.jar
+# DKLs23 / bbmtmobile Android (BBMTLib/build-dkls.sh): libbbmtmobile.so, libbbmtmobile.h, dkls_jni.so
+android/app/src/main/jniLibs/**
+android/app/src/main/cpp/libbbmtmobile.h
+# Legacy pre-bbmtmobile rename (stale headers from old builds)
+android/app/src/main/cpp/libdklsmobile.h
+**/libdklsmobile.so
 
 # iOS
 *.pbxuser
@@ -327,6 +352,22 @@ ios/build/
 !*.xcworkspace/contents.xcworkspacedata
 *.xcuserdata
 *.xcscmblueprint
+# Unified bbmtmobile (BBMTLib/build-dkls.sh ios) — built locally, not committed (same as android jniLibs)
+ios/Tss.xcframework/**
+ios/DklsMobile/**
+ios/DklsBridge.h
+ios/DklsBridge.mm
+ios/libbbmtmobile_go.h
+ios/BbmtMobile/libbbmtmobile.xcframework/**
+ios/BbmtMobile/libbbmtmobile_go.h
+ios/BbmtMobile/libbbmtmobile*.h
+ios/BbmtMobile/*.a
+ios/BbmtMobile/libbbmtmobile-merged-*.a
+ios/BbmtMobile/libbbmtmobile-device.*
+ios/BbmtMobile/libbbmtmobile-sim.*
+ios/BbmtMobile/headers/
+# Stale iOS outputs from pre-bbmtmobile builds (under ios/DklsMobile/ when present)
+ios/DklsMobile/libdklsmobile.xcframework/**
 
 # CocoaPods
 Pods/
@@ -371,6 +412,8 @@ vendor/bundle/
 
 # Database files
 *.db
+*.db-shm
+*.db-wal
 *.sqlite
 *.sqlite3
 

.vscode/c_cpp_properties.json

@@ -0,0 +1,19 @@
+{
+  "configurations": [
+    {
+      "name": "Android JNI (arm64-v8a)",
+      "includePath": [
+        "${workspaceFolder}/android/app/src/main/cpp",
+        "${workspaceFolder}/android/app/src/main/jniLibs/arm64-v8a",
+        "${env:ANDROID_HOME}/ndk/27.1.12297006/toolchains/llvm/prebuilt/darwin-x86_64/sysroot/usr/include",
+        "${env:ANDROID_HOME}/ndk/27.1.12297006/toolchains/llvm/prebuilt/darwin-x86_64/sysroot/usr/include/aarch64-linux-android"
+      ],
+      "defines": ["ANDROID"],
+      "compilerPath": "${env:ANDROID_HOME}/ndk/27.1.12297006/toolchains/llvm/prebuilt/darwin-x86_64/bin/aarch64-linux-android24-clang++",
+      "cStandard": "c17",
+      "cppStandard": "c++17",
+      "intelliSenseMode": "linux-clang-arm64"
+    }
+  ],
+  "version": 4
+}