@0xio/sdk 2.7.1 → 2.8.0

package/dist/index.umd.js

@@ -98,6 +98,16 @@
         ErrorCode["DUPLICATE_TRANSACTION"] = "DUPLICATE_TRANSACTION";
         ErrorCode["NONCE_TOO_FAR"] = "NONCE_TOO_FAR";
         ErrorCode["INTERNAL_ERROR"] = "INTERNAL_ERROR";
+        // Codes the 0xio wallet returns over the bridge
+        ErrorCode["NOT_CONNECTED"] = "NOT_CONNECTED";
+        ErrorCode["INVALID_PARAMS"] = "INVALID_PARAMS";
+        ErrorCode["METHOD_NOT_ALLOWED"] = "METHOD_NOT_ALLOWED";
+        ErrorCode["NOT_AVAILABLE"] = "NOT_AVAILABLE";
+        ErrorCode["PRIVATE_PROOF_FAILED"] = "PRIVATE_PROOF_FAILED";
+        ErrorCode["PRIVATE_TRANSFER_FAILED"] = "PRIVATE_TRANSFER_FAILED";
+        ErrorCode["CONTRACT_CALL_FAILED"] = "CONTRACT_CALL_FAILED";
+        ErrorCode["SIGN_FAILED"] = "SIGN_FAILED";
+        ErrorCode["RECIPIENT_NOT_REGISTERED"] = "RECIPIENT_NOT_REGISTERED";
     })(exports.ErrorCode || (exports.ErrorCode = {}));
     class ZeroXIOWalletError extends Error {
         constructor(code, message, details) {
@@ -120,7 +130,7 @@
      *   window.postMessage({ source: '0xio-sdk-bridge', response: { id, success, data, error }, sessionNonce })
      *   window.postMessage({ source: '0xio-sdk-bridge', event: { type, data } })
      *
-     * H-2: Session nonce validation — injected.ts broadcasts the nonce received from the
+     * Session nonce validation: injected.ts broadcasts the nonce received from the
      * isolated content script. Once set, any '0xio-sdk-bridge' response with a missing or
      * mismatched nonce is rejected, preventing response injection by malicious page scripts.
      */
@@ -153,7 +163,7 @@
                     window.parent.postMessage({ source: '0xio-sdk-request', request }, parentOrigin);
                 }
                 catch {
-                    // Do not fall back to '*' — silent failure is safer
+                    // Do not fall back to '*': silent failure is safer
                 }
             },
             listen(handler, options) {
@@ -168,7 +178,7 @@
                     ...(options?.trustedParentOrigins ?? []),
                 ]);
                 let _sessionNonce = null;
-                // H-2: receive session nonce from injected.ts (MAIN world content script)
+                // receive the session nonce from injected.ts (MAIN world content script)
                 const nonceListener = (e) => {
                     if (e.origin !== allowedOrigin)
                         return;
@@ -191,7 +201,7 @@
                         return;
                     if (!e.data || e.data.source !== '0xio-sdk-bridge')
                         return;
-                    // H-2: session nonce validation.
+                    // session nonce validation.
                     // Preferred path: nonce set via 0xio-sdk-nonce-init from injected.ts.
                     // Fallback path: if the init broadcast was missed (race between document_start
                     // content script and page script load), capture nonce from the first same-origin
@@ -261,7 +271,7 @@
             amount <= Number.MAX_SAFE_INTEGER;
     }
     function isValidMessage(message) {
-        // Type check first — falsy non-strings (0, false, null) are NOT valid messages
+        // Type check first: falsy non-strings (0, false, null) are not valid messages
         if (typeof message !== 'string') {
             return message === undefined || message === null ? true : false;
         }
@@ -269,7 +279,7 @@
         if (message.length === 0) {
             return true;
         }
-        // 100KB limit — contract call params can be large (serialized JSON)
+        // 100KB limit: contract call params can be large (serialized JSON)
         return message.length <= 100000;
     }
     function isValidFeeLevel(feeLevel) {
@@ -302,7 +312,7 @@
     }
     /**
      * Derive the canonical Octra address from a base64-encoded Ed25519 public key.
-     * Algorithm: SHA-256(pubkey_bytes) → base58 → prepend "oct"
+     * Algorithm: SHA-256 of the pubkey bytes, base58-encoded, with "oct" prepended
      * Source of truth: ocho-push-server/src/index.ts#deriveAddressFromPubkey
      */
     async function deriveOctraAddress(publicKeyBase64) {
@@ -361,6 +371,22 @@
         const microOCT = Math.round(amount * 1000000);
         return microOCT.toString();
     }
+    /**
+     * Exact OCT to raw micro-OCT conversion using string arithmetic (no float rounding).
+     * Accepts up to 6 decimals; anything else is rejected.
+     */
+    function octToMicro(amount) {
+        const text = typeof amount === 'number' ? amount.toFixed(6) : String(amount).trim();
+        if (!/^\d+(\.\d{1,6})?$/.test(text)) {
+            throw new ZeroXIOWalletError(exports.ErrorCode.INVALID_AMOUNT, 'Amount must be a positive decimal with at most 6 places');
+        }
+        const [whole, frac = ''] = text.split('.');
+        const micro = BigInt(whole) * BigInt(1000000) + BigInt(frac.padEnd(6, '0'));
+        if (micro <= BigInt(0)) {
+            throw new ZeroXIOWalletError(exports.ErrorCode.INVALID_AMOUNT, 'Amount must be greater than zero');
+        }
+        return micro.toString();
+    }
     function fromMicroOCT(microAmount) {
         const amount = typeof microAmount === 'string' ? parseInt(microAmount, 10) : microAmount;
         if (!Number.isFinite(amount) || amount < 0) {
@@ -389,7 +415,16 @@
             [exports.ErrorCode.INVALID_SIGNATURE]: 'Invalid transaction signature',
             [exports.ErrorCode.DUPLICATE_TRANSACTION]: 'Duplicate transaction detected',
             [exports.ErrorCode.NONCE_TOO_FAR]: 'Transaction nonce is too far ahead',
-            [exports.ErrorCode.INTERNAL_ERROR]: 'Internal server error'
+            [exports.ErrorCode.INTERNAL_ERROR]: 'Internal server error',
+            [exports.ErrorCode.NOT_CONNECTED]: 'Connect the wallet before this request',
+            [exports.ErrorCode.INVALID_PARAMS]: 'Invalid request parameters',
+            [exports.ErrorCode.METHOD_NOT_ALLOWED]: 'This method is not permitted through the wallet',
+            [exports.ErrorCode.NOT_AVAILABLE]: 'Not available through the wallet bridge',
+            [exports.ErrorCode.PRIVATE_PROOF_FAILED]: 'Private proof generation failed',
+            [exports.ErrorCode.PRIVATE_TRANSFER_FAILED]: 'Private transfer failed',
+            [exports.ErrorCode.CONTRACT_CALL_FAILED]: 'Contract call failed',
+            [exports.ErrorCode.SIGN_FAILED]: 'Signing failed',
+            [exports.ErrorCode.RECIPIENT_NOT_REGISTERED]: 'Recipient has no private view key registered'
         };
         const baseMessage = baseMessages[code] || 'Unknown error';
         return context ? `${baseMessage}: ${context}` : baseMessage;
@@ -410,7 +445,7 @@
             }
             catch (error) {
                 lastError = error;
-                // Never retry user rejections — these are intentional
+                // Never retry user rejections, they are intentional
                 const msg = lastError.message?.toLowerCase() || '';
                 if (msg.includes('rejected') || msg.includes('denied') || msg.includes('cancelled') || msg.includes('user refused')) {
                     throw lastError;
@@ -552,14 +587,14 @@
             this._adapterReadyTeardown = null;
             /**
              * Set when a trusted walletReady has been received from window.parent.
-             * The polling fallback must NOT clear this flag.
+             * The polling fallback must not clear this flag.
              */
             this._parentTrusted = false;
             /** walletReady postMessage listener stored for cleanup */
             this._walletReadyMessageListener = null;
             /**
              * In-flight interactive request lock.
-             * Methods that open approval popups are serialized — only one at a time.
+             * Methods that open approval popups are serialized: only one at a time.
              */
             this._interactiveInFlight = false;
             this.MAX_CONCURRENT_REQUESTS = 50;
@@ -600,9 +635,15 @@
             return this.isExtensionAvailableState && this.hasExtensionContext();
         }
         async sendRequest(method, params = {}, timeout = 30000) {
-            const isInteractive = ExtensionCommunicator.NO_RETRY_METHODS.has(method);
-            const maxRetries = isInteractive ? 0 : 1;
-            const effectiveTimeout = isInteractive ? Math.max(timeout, 180000) : timeout;
+            // No-retry + long timeout for both popup/broadcast methods and long compute primitives.
+            const longOrNoRetry = ExtensionCommunicator.NO_RETRY_METHODS.has(method) ||
+                ExtensionCommunicator.LONG_COMPUTE_METHODS.has(method);
+            const maxRetries = longOrNoRetry ? 0 : 1;
+            const effectiveTimeout = ExtensionCommunicator.PROOF_METHODS.has(method)
+                ? Math.max(timeout, 600000)
+                : longOrNoRetry
+                    ? Math.max(timeout, 180000)
+                    : timeout;
             return this.sendRequestWithRetry(method, params, maxRetries, effectiveTimeout);
         }
         async sendRequestWithRetry(method, params = {}, maxRetries = 3, timeout = 30000) {
@@ -671,7 +712,7 @@
                 return;
             this._adapterTeardown = this.adapter.listen((msg) => {
                 if (msg.requestId !== undefined) {
-                    // response — map AdapterIncomingMessage → ExtensionResponse shape
+                    // response: map AdapterIncomingMessage to the ExtensionResponse shape
                     if (this.pendingRequests.has(msg.requestId)) {
                         this.handleExtensionResponse({
                             id: msg.requestId,
@@ -705,7 +746,7 @@
             }
             clearTimeout(pending.timeout);
             this.pendingRequests.delete(response.id);
-            // Require strict boolean true — "false" string or other truthy values are failures
+            // Require strict boolean true: a "false" string or other truthy values are failures
             if (response.success === true) {
                 pending.resolve(response.data);
             }
@@ -730,7 +771,7 @@
         }
         postMessageToExtension(request) {
             this.adapter.postRequest(request);
-            // Parent bridge (iframe/desktop mode) — only when a trusted origin is established.
+            // Parent bridge (iframe/desktop mode), only when a trusted origin is established.
             // Sending with '*' would leak method + params to any intercepting frame.
             if (window.parent !== window && this._parentOrigin) {
                 if (this.adapter.postRequestToParent) {
@@ -747,7 +788,7 @@
             if (this.pendingRequests.size >= this.MAX_CONCURRENT_REQUESTS) {
                 throw new ZeroXIOWalletError(exports.ErrorCode.RATE_LIMIT_EXCEEDED, `Too many concurrent requests (max: ${this.MAX_CONCURRENT_REQUESTS})`);
             }
-            // Trim expired timestamps — cap array size to prevent unbounded growth in idle tabs
+            // Trim expired timestamps and cap the array size to prevent unbounded growth in idle tabs
             this.requestTimestamps = this.requestTimestamps.filter(t => now - t < this.RATE_LIMIT_WINDOW);
             if (this.requestTimestamps.length > this.MAX_REQUESTS_PER_WINDOW) {
                 this.requestTimestamps = this.requestTimestamps.slice(-this.MAX_REQUESTS_PER_WINDOW);
@@ -767,7 +808,7 @@
                 const hex = Array.from(array, b => b.toString(16).padStart(2, '0')).join('');
                 return `0xio-sdk-${hex}`;
             }
-            // Crypto API unavailable — throw rather than produce a guessable ID that
+            // Crypto API unavailable: throw rather than produce a guessable ID that
             // could allow response spoofing via a known requestId.
             throw new ZeroXIOWalletError(exports.ErrorCode.UNKNOWN_ERROR, 'Cryptographic random number generation is not available in this environment');
         }
@@ -781,7 +822,7 @@
                     this.isExtensionAvailableState = true;
                 });
             }
-            // walletReady via postMessage (desktop/mobile iframe bridge) — store ref for cleanup
+            // walletReady via postMessage (desktop/mobile iframe bridge), store the ref for cleanup
             this._walletReadyMessageListener = (event) => {
                 if (event.data?.source !== '0xio-sdk-bridge' || event.data?.event?.type !== 'walletReady') {
                     return;
@@ -816,7 +857,7 @@
             };
             window.addEventListener('message', this._walletReadyMessageListener);
             if (window.parent !== window) {
-                this.logger.log('Running inside a frame — waiting for trusted walletReady signal');
+                this.logger.log('Running inside a frame, waiting for the trusted walletReady signal');
             }
             this.checkExtensionAvailability();
             this.extensionDetectionInterval = setInterval(() => {
@@ -825,7 +866,7 @@
         }
         checkExtensionAvailability() {
             // If parent-bridge readiness was established via a trusted walletReady handshake,
-            // preserve that state — the polling fallback (detectExtensionSignals) does not
+            // preserve that state: the polling fallback (detectExtensionSignals) does not
             // consider the iframe parent signal and would incorrectly flip state back
             if (this._parentTrusted) {
                 return;
@@ -907,7 +948,7 @@
         }
         /**
          * Clean up SDK resources.
-         * After cleanup() the instance is terminal — do not call initialize() again.
+         * After cleanup() the instance is terminal: do not call initialize() again.
          * Construct a new instance instead.
          */
         cleanup() {
@@ -948,7 +989,7 @@
             };
         }
     }
-    // Methods that trigger user-facing popups — NEVER retry these.
+    // Methods that trigger user-facing popups: never retry these.
     // Retrying sends a second request while the first popup is still open,
     // causing double popups where the second tx fails (stale nonce/state).
     ExtensionCommunicator.NO_RETRY_METHODS = new Set([
@@ -956,12 +997,29 @@
         'sign_transaction', 'broadcast_only',
         'send_private_transfer', 'claim_private_transfer',
         'encrypt_balance', 'decrypt_balance',
+        // Broadcasts a sequence of contract txs, so it must never be retried (it would double-send).
+        'send_contract_transaction_sequence',
+        // Shows an approval popup + broadcasts a registration tx (offscreen cold-init can exceed
+        // 30s): interactive, long timeout, no retry.
+        'register_private_view_key',
+    ]);
+    // Long-running compute primitives (RFP): proof generation / decrypt take 10-120s, so
+    // they need the long (180s) timeout and must not be retried (a retry wastes ~a minute of
+    // compute). They do not show approval popups, so, unlike NO_RETRY_METHODS, they are not
+    // subject to the one-at-a-time interactive lock (a dapp may run several concurrently).
+    ExtensionCommunicator.LONG_COMPUTE_METHODS = new Set([
+        'make_zero_proof', 'make_range_proof', 'decrypt_value',
+        'get_private_balance', 'encrypt_value',
     ]);
+    // A private transfer runs proof generation after the approval (minutes on a slow machine),
+    // so its wait is longer than the popup window alone.
+    ExtensionCommunicator.PROOF_METHODS = new Set(['send_private_transfer']);
+    // The interactive lock applies only to methods that open a wallet popup / broadcast.
     ExtensionCommunicator.INTERACTIVE_METHODS = ExtensionCommunicator.NO_RETRY_METHODS;
     // only forward known event types
     ExtensionCommunicator.VALID_EVENT_TYPES = new Set([
         'connect', 'disconnect', 'accountChanged', 'balanceChanged',
-        'networkChanged', 'transactionConfirmed', 'permissionsChanged', 'message',
+        'networkChanged', 'transactionConfirmed', 'transactionFailed', 'permissionsChanged', 'message',
         'error', 'extensionLocked', 'extensionUnlocked'
     ]);
 
@@ -983,7 +1041,7 @@
         'devnet': {
             id: 'devnet',
             name: 'Octra Devnet',
-            rpcUrl: 'http://165.227.225.79:8080',
+            rpcUrl: 'https://devnet.octrascan.io',
             explorerUrl: 'https://devnet.octrascan.io/tx.html?hash=',
             explorerAddressUrl: 'https://devnet.octrascan.io/address.html?addr=',
             indexerUrl: 'https://devnet.octrascan.io',
@@ -1011,7 +1069,7 @@
     const DEFAULT_NETWORK_ID = 'mainnet';
     /**
      * Get network configuration by ID.
-     * Returns a frozen copy — callers cannot mutate SDK-internal state.
+     * Returns a frozen copy, so callers cannot mutate SDK-internal state.
      */
     function getNetworkConfig(networkId = DEFAULT_NETWORK_ID) {
         if (!Object.prototype.hasOwnProperty.call(_NETWORKS, networkId)) {
@@ -1021,7 +1079,7 @@
     }
     /**
      * Get all available networks.
-     * Returns frozen copies — callers cannot mutate SDK-internal state.
+     * Returns frozen copies, so callers cannot mutate SDK-internal state.
      */
     function getAllNetworks() {
         return Object.values(_NETWORKS).map(n => Object.freeze({ ...n }));
@@ -1070,7 +1128,7 @@
 
     /**
      * Default balance structure.
-     * Accepts a numeric total or undefined — never pass a Balance object here.
+     * Accepts a numeric total or undefined. Never pass a Balance object here.
      */
     function createDefaultBalance(total = 0) {
         const safeTotal = typeof total === 'number' && Number.isFinite(total) && total >= 0 ? total : 0;
@@ -1089,7 +1147,7 @@
         if (raw === null || raw === undefined)
             return null;
         // If it's already a Balance-shaped object, extract numeric fields
-        // Use Number() not parseFloat() — parseFloat('10abc') silently returns 10
+        // Use Number() not parseFloat(): parseFloat('10abc') silently returns 10
         const pub = typeof raw === 'object' ? Number(raw.public ?? raw.total ?? 0) : Number(raw);
         const priv = typeof raw === 'object' ? Number(raw.private ?? 0) : 0;
         if (!Number.isFinite(pub) || pub < 0)
@@ -1104,7 +1162,7 @@
         };
     }
     const SDK_CONFIG = {
-        version: '2.7.1',
+        version: '2.8.0',
         defaultNetworkId: DEFAULT_NETWORK_ID,
         communicationTimeout: 30000, // 30 seconds
         retryAttempts: 3,
@@ -1114,13 +1172,154 @@
         return getNetworkConfig(SDK_CONFIG.defaultNetworkId);
     }
 
+    /** Scope names the 0xio wallet enforces. Any other name is dropped at connect. */
+    const WALLET_PERMISSIONS = [
+        'accounts',
+        'public_transactions',
+        'contract_calls',
+        'contract_views',
+        'private_balance_read',
+        'private_proofs',
+        'private_transfers',
+        'private_claims',
+    ];
+    /** Older SDK permission names and the wallet scope each one means. */
+    const LEGACY_PERMISSION_MAP = {
+        read_address: 'accounts',
+        read_balance: 'accounts',
+        read_public_key: 'accounts',
+        send_transactions: 'public_transactions',
+        sign_messages: 'public_transactions',
+        contract_calls: 'contract_calls',
+        view_private_balance: 'private_balance_read',
+        view_encrypted_balance: 'private_balance_read',
+        stealth_scan: 'private_balance_read',
+        decrypt_balance: 'private_balance_read',
+        encrypt_balance: 'private_proofs',
+        private_transfers: 'private_transfers',
+        stealth_claim: 'private_claims',
+    };
+    /** Translate any mix of old and new names into the wallet's scope names, without duplicates. */
+    function toWalletPermissions(perms) {
+        const out = [];
+        for (const p of perms ?? []) {
+            const canonical = WALLET_PERMISSIONS.includes(p)
+                ? p
+                : LEGACY_PERMISSION_MAP[p];
+            if (canonical && !out.includes(canonical))
+                out.push(canonical);
+        }
+        return out;
+    }
+    /**
+     * The granted wallet scopes plus every requested old name they satisfy, so a dapp that checks
+     * for the name it asked for (for example 'read_balance') keeps seeing it.
+     */
+    function withLegacyAliases(granted, requested) {
+        const set = new Set(granted ?? []);
+        for (const p of requested ?? []) {
+            const canonical = LEGACY_PERMISSION_MAP[p];
+            if (canonical && set.has(canonical))
+                set.add(p);
+        }
+        return [...set];
+    }
+
+    /**
+     * 0xio Signed Message standard (v1).
+     *
+     * `wallet.signMessage(message)` never signs the raw message. The wallet frames it first so a signed
+     * "message" can never collide with a transaction pre-image (a transaction is canonical JSON that
+     * begins with '{'). The framing is:
+     *
+     *     "Octra Signed Message:\n" + utf8ByteLength(message) + "\n" + message
+     *
+     * signed as an Ed25519 detached signature over the UTF-8 bytes of that string. The leading 'O'
+     * guarantees the signed bytes never begin with '{', so a personal-message signature can never be a
+     * valid transaction. Any verifier MUST reconstruct the same bytes: use `getSignedMessageBytes()`
+     * with any Ed25519 library, or `verifyMessage()` for a batteries-included check.
+     */
+    /** Fixed prefix tag for the 0xio Signed Message scheme. */
+    const SIGNED_MESSAGE_PREFIX = 'Octra Signed Message:';
+    /** Scheme version, bumped if the framing ever changes so verifiers can detect it. */
+    const SIGNED_MESSAGE_VERSION = 1;
+    /** UTF-8 byte length of a string (JS `.length` counts UTF-16 units, not bytes). */
+    function utf8ByteLength(s) {
+        return new TextEncoder().encode(s).length;
+    }
+    function base64ToBytes(b64) {
+        // atob is available in browsers and Node 16+; utils.deriveOctraAddress uses the same path.
+        const bin = atob(b64);
+        const out = new Uint8Array(bin.length);
+        for (let i = 0; i < bin.length; i++)
+            out[i] = bin.charCodeAt(i);
+        return out;
+    }
+    /**
+     * The exact bytes that `wallet.signMessage(message)` produces a signature over. Verify a 0xio
+     * message signature by checking an Ed25519 signature against these bytes with the signer's public
+     * key. Zero-dependency - bring your own Ed25519 verifier, or use `verifyMessage`.
+     */
+    function getSignedMessageBytes(message) {
+        if (typeof message !== 'string') {
+            throw new TypeError('message must be a string');
+        }
+        const framed = `${SIGNED_MESSAGE_PREFIX}\n${utf8ByteLength(message)}\n${message}`;
+        return new TextEncoder().encode(framed);
+    }
+    /**
+     * Reconstruct the auth message that `wallet.signAuthMessage(service, nonce)` signs. A relying
+     * service verifies an auth signature with `verifyMessage(buildAuthMessage(service, nonce, origin),
+     * signature, publicKey)`, where `origin` is the caller's page origin.
+     */
+    function buildAuthMessage(service, nonce, origin) {
+        return `0xio auth\nService: ${service}\nNonce: ${nonce}\nOrigin: ${origin}`;
+    }
+    /**
+     * Verify a 0xio message signature produced by `wallet.signMessage`.
+     *
+     * @param message   The original message passed to `wallet.signMessage`.
+     * @param signature Base64 Ed25519 signature returned by `wallet.signMessage`.
+     * @param publicKey Base64 Ed25519 public key of the signer (from `wallet.getPublicKey()`).
+     * @returns         Whether the signature is valid for this message and key.
+     *
+     * Uses the Web Crypto Ed25519 primitive (Node 18+, Chrome 137+, Safari 17+, Firefox 129+). In an
+     * environment without it, verify `getSignedMessageBytes(message)` with your own Ed25519 library.
+     */
+    async function verifyMessage(message, signature, publicKey) {
+        if (typeof crypto === 'undefined' || !crypto.subtle) {
+            throw new Error('Web Crypto API unavailable; verify getSignedMessageBytes(message) with your own Ed25519 library');
+        }
+        let sigBytes;
+        let pubBytes;
+        try {
+            sigBytes = base64ToBytes(signature);
+            pubBytes = base64ToBytes(publicKey);
+        }
+        catch {
+            return false;
+        }
+        try {
+            const data = new Uint8Array(getSignedMessageBytes(message));
+            const key = await crypto.subtle.importKey('raw', pubBytes, { name: 'Ed25519' }, false, [
+                'verify',
+            ]);
+            return await crypto.subtle.verify({ name: 'Ed25519' }, key, sigBytes, data);
+        }
+        catch {
+            // importKey/verify can throw (rather than return false) on malformed input or an environment
+            // that recognizes Ed25519 only partially; treat any such failure as "not verified".
+            return false;
+        }
+    }
+
     class ZeroXIOWallet extends EventEmitter {
         constructor(config) {
             super(config.debug);
             this.connectionInfo = { isConnected: false };
             this.isInitialized = false;
             this._initPromise = null;
-            // session version — stale write detection
+            // session version, for stale write detection
             this._sessionVersion = 0;
             this.config = {
                 ...config,
@@ -1151,7 +1350,7 @@
                         appVersion: this.config.appVersion,
                         appUrl: typeof window !== 'undefined' ? window.location.origin : undefined,
                         appIcon: this.config.appIcon,
-                        requiredPermissions: this.config.requiredPermissions,
+                        requiredPermissions: toWalletPermissions(this.config.requiredPermissions),
                         networkId: this.config.networkId
                     });
                     this.setupExtensionEventListeners();
@@ -1179,22 +1378,22 @@
             this.ensureInitialized();
             try {
                 this.logger.log('Attempting to connect with options:', options);
-                // filter to declared perms only — accept both RFC 'permissions' and legacy 'requestPermissions'
+                // filter to declared perms only: accept both RFC 'permissions' and legacy 'requestPermissions'
                 const declaredPermissions = this.config.requiredPermissions || [];
                 const requestedPerms = options.permissions ?? options.requestPermissions;
                 const requestedPermissions = requestedPerms
                     ? requestedPerms.filter(p => declaredPermissions.includes(p))
                     : declaredPermissions;
                 const result = await this.communicator.sendRequest('connect', {
-                    permissions: requestedPermissions,
+                    permissions: toWalletPermissions(requestedPermissions),
                     networkId: options.networkId || this.config.networkId
                 });
-                // verify pubkey→addr binding
+                // verify the public key to address binding
                 if (result.publicKey && result.address) {
                     try {
                         const derived = await deriveOctraAddress(result.publicKey);
                         if (derived !== result.address) {
-                            throw new ZeroXIOWalletError(exports.ErrorCode.UNKNOWN_ERROR, 'Address-key binding verification failed — the reported public key does not derive to the reported address');
+                            throw new ZeroXIOWalletError(exports.ErrorCode.UNKNOWN_ERROR, 'Address-key binding verification failed: the reported public key does not derive to the reported address');
                         }
                     }
                     catch (e) {
@@ -1203,14 +1402,16 @@
                         this.logger.warn('Address derivation check skipped (crypto unavailable):', e);
                     }
                 }
-                // Use networkInfo from extension response — validate before caching.
+                // Use networkInfo from the extension response, validated before caching.
                 const networkInfo = validateNetworkInfo(result.networkInfo)
                     ?? (result.networkId ? getNetworkConfig(result.networkId) : null);
                 if (!networkInfo) {
                     throw new ZeroXIOWalletError(exports.ErrorCode.NETWORK_ERROR, 'Wallet did not return valid network metadata.');
                 }
-                const permissions = result.permissions || [];
-                // Update connection info — including permissions
+                // The wallet answers with its own scope names; the names the dapp asked for are kept as
+                // aliases so existing permission checks keep working.
+                const permissions = withLegacyAliases(result.permissions, requestedPermissions);
+                // Update connection info, including permissions
                 this.connectionInfo = {
                     isConnected: true,
                     address: result.address,
@@ -1284,12 +1485,12 @@
                 if (this._sessionVersion !== sv)
                     return { ...this.connectionInfo };
                 if (result.isConnected && result.address) {
-                    // verify pubkey→addr binding
+                    // verify the public key to address binding
                     if (result.publicKey) {
                         try {
                             const derived = await deriveOctraAddress(result.publicKey);
                             if (derived !== result.address) {
-                                this.logger.warn('Address-key binding mismatch on session restore — ignoring stale session');
+                                this.logger.warn('Address-key binding mismatch on session restore, ignoring stale session');
                                 this.connectionInfo = { isConnected: false };
                                 return { ...this.connectionInfo };
                             }
@@ -1303,11 +1504,11 @@
                     const networkInfo = validateNetworkInfo(result.networkInfo)
                         ?? (result.networkId ? getNetworkConfig(result.networkId) : null);
                     if (!networkInfo) {
-                        this.logger.warn('getConnectionStatus: wallet returned no network metadata — returning cached state');
+                        this.logger.warn('getConnectionStatus: wallet returned no network metadata, returning cached state');
                         return this.connectionInfo;
                     }
                     const wasConnected = this.connectionInfo.isConnected;
-                    const permissions = result.permissions || [];
+                    const permissions = withLegacyAliases(result.permissions, this.config.requiredPermissions);
                     // preserve existing connectedAt
                     const connectedAt = this.connectionInfo.connectedAt || result.connectedAt || Date.now();
                     this.connectionInfo = {
@@ -1320,7 +1521,7 @@
                         permissions
                     };
                     this.logger.log('Discovered existing connection:', { address: result.address, network: networkInfo.id });
-                    // only emit on disconnected→connected transition
+                    // only emit on the disconnected to connected transition
                     if (!wasConnected) {
                         const connectEvent = {
                             address: result.address,
@@ -1345,8 +1546,8 @@
             }
         }
         /**
-         * Switch the extension's active network (e.g. 'mainnet' → 'devnet').
-         * Works silently — no popup, no user confirmation needed.
+         * Switch the extension's active network (e.g. 'mainnet' to 'devnet').
+         * Works silently: no popup, no user confirmation needed.
          * The extension broadcasts 'networkChanged' event to all connected dApps.
          */
         async switchNetwork(networkId) {
@@ -1381,6 +1582,22 @@
         getAddress() {
             return this.connectionInfo.address || null;
         }
+        /**
+         * The connected account's Ed25519 public key (base64). Served from the session when the
+         * wallet reported it at connect, otherwise asked from the wallet.
+         */
+        async getPublicKey() {
+            this.ensureConnected();
+            if (this.connectionInfo.publicKey)
+                return this.connectionInfo.publicKey;
+            const result = await this.communicator.sendRequest('getPublicKey');
+            const publicKey = result?.publicKey;
+            if (typeof publicKey !== 'string' || !publicKey) {
+                throw new ZeroXIOWalletError(exports.ErrorCode.UNKNOWN_ERROR, 'Wallet did not return a public key');
+            }
+            this.connectionInfo.publicKey = publicKey;
+            return publicKey;
+        }
         async getBalance(forceRefresh = false) {
             this.ensureConnected();
             try {
@@ -1470,16 +1687,14 @@
             if (!isValidAddress(txData.to)) {
                 throw new ZeroXIOWalletError(exports.ErrorCode.INVALID_ADDRESS, 'Invalid recipient address');
             }
-            if (!isValidAmount(txData.amount)) {
-                throw new ZeroXIOWalletError(exports.ErrorCode.TRANSACTION_FAILED, 'Invalid transaction amount');
-            }
+            const amount = this.resolveRawAmount(txData.amount, txData.amountOct, 'Transaction amount');
             if (txData.message && txData.message.length > 1000) {
                 throw new ZeroXIOWalletError(exports.ErrorCode.TRANSACTION_FAILED, 'Transaction message too long (max 1,000 characters)');
             }
             try {
                 // log non-sensitive only
                 this.logger.log('Sending transaction:', { to: txData.to });
-                const result = await this.communicator.sendRequest('send_transaction', txData);
+                const result = await this.communicator.sendRequest('send_transaction', { ...txData, amount });
                 this.logger.log('Transaction result:', result);
                 // Refresh balance after successful transaction (accept RFC 'accepted' or legacy 'success')
                 if (result.accepted ?? result.success) {
@@ -1508,15 +1723,13 @@
             if (!isValidAddress(txData.to)) {
                 throw new ZeroXIOWalletError(exports.ErrorCode.INVALID_ADDRESS, 'Invalid recipient address');
             }
-            if (!isValidAmount(txData.amount)) {
-                throw new ZeroXIOWalletError(exports.ErrorCode.TRANSACTION_FAILED, 'Invalid transaction amount');
-            }
+            const amount = this.resolveRawAmount(txData.amount, txData.amountOct, 'Transaction amount');
             if (txData.message && txData.message.length > 1000) {
                 throw new ZeroXIOWalletError(exports.ErrorCode.TRANSACTION_FAILED, 'Transaction message too long (max 1,000 characters)');
             }
             try {
                 this.logger.log('Requesting transaction signature:', { to: txData.to });
-                const result = await this.communicator.sendRequest('sign_transaction', txData);
+                const result = await this.communicator.sendRequest('sign_transaction', { ...txData, amount });
                 return result;
             }
             catch (error) {
@@ -1560,9 +1773,15 @@
             if (callData.method.length > 200) {
                 throw new ZeroXIOWalletError(exports.ErrorCode.TRANSACTION_FAILED, 'Contract method name too long (max 200 characters)');
             }
+            if (callData.amount != null && callData.amountOct != null) {
+                throw new ZeroXIOWalletError(exports.ErrorCode.INVALID_AMOUNT, 'Contract call amount: pass amount or amountOct, not both');
+            }
             if (callData.amount != null) {
                 this.assertExactOCTAmount(callData.amount, 'Contract call amount');
             }
+            if (callData.amountOct != null) {
+                this.assertExactOCTAmount(callData.amountOct, 'Contract call amount');
+            }
             try {
                 if (JSON.stringify(callData.params).length > 65536) {
                     throw new ZeroXIOWalletError(exports.ErrorCode.TRANSACTION_FAILED, 'Contract params too large (max 64 KB)');
@@ -1580,7 +1799,11 @@
                     contract: callData.contract,
                     method: callData.method,
                     params: callData.params,
-                    amount: callData.amount != null ? String(callData.amount) : '0',
+                    amount: callData.amountOct != null
+                        ? octToMicro(callData.amountOct)
+                        : callData.amount != null
+                            ? String(callData.amount)
+                            : '0',
                     ou: callData.ou != null ? String(callData.ou) : '10000',
                 });
                 this.logger.log('Contract call result:', result);
@@ -1697,7 +1920,9 @@
             }
         }
         /**
-         * Encrypt public balance to private
+         * Encrypt public balance to private.
+         * @deprecated The 0xio extension does not serve this through the bridge (it answers
+         * NOT_AVAILABLE); users encrypt from the extension's Privacy screen.
          */
         async encryptBalance(amount) {
             this.ensureConnected();
@@ -1718,7 +1943,9 @@
             }
         }
         /**
-         * Decrypt private balance to public
+         * Decrypt private balance to public.
+         * @deprecated The 0xio extension does not serve this through the bridge (it answers
+         * NOT_AVAILABLE); users decrypt from the extension's Privacy screen.
          */
         async decryptBalance(amount) {
             this.ensureConnected();
@@ -1760,7 +1987,10 @@
                 throw new ZeroXIOWalletError(exports.ErrorCode.TRANSACTION_FAILED, 'Transfer message too long (max 1,000 characters)');
             }
             try {
-                const result = await this.communicator.sendRequest('send_private_transfer', transferData);
+                const result = await this.communicator.sendRequest('send_private_transfer', {
+                    ...transferData,
+                    ...(transferData.amountRaw ? { amount_raw: transferData.amountRaw } : {}),
+                });
                 // Refresh balance after transfer (accept RFC 'accepted' or legacy 'success')
                 if (result.accepted ?? result.success) {
                     setTimeout(() => {
@@ -1814,16 +2044,89 @@
                 throw new ZeroXIOWalletError(exports.ErrorCode.TRANSACTION_FAILED, 'Failed to claim private transfer', error);
             }
         }
+        // Generic provider passthrough and RFP private primitives (since 2.8.0)
+        // These route through the wallet bridge. The wallet keeps all private/FHE
+        // secret material internal and returns only ciphertexts/proofs/tx hashes.
+        /**
+         * Send any wallet method + params through the bridge. Escape hatch for
+         * primitives that don't have a typed helper yet (no SDK upgrade needed).
+         * @since 2.8.0
+         */
+        async request(method, params = {}) {
+            return this.communicator.sendRequest(method, params);
+        }
+        /**
+         * Read-only node RPC through the wallet. Only the wallet's allow-listed public methods work
+         * (octra_balance, octra_transaction, contract_call and similar); writes are refused.
+         * @since 2.8.0
+         */
+        async rpcCall(method, params = []) {
+            return this.communicator.sendRequest('rpc_call', { method, params });
+        }
+        /**
+         * Feature-detect which private capabilities the connected wallet supports.
+         * Lets a dapp render the correct UI (or fail closed) before any action.
+         * @since 2.8.0
+         */
+        async getPrivateCapabilities() {
+            return this.communicator.sendRequest('get_private_capabilities');
+        }
+        /** Read-only contract view (no approval popup). @since 2.8.0 */
+        async callContractView(params) {
+            this.ensureConnected();
+            return this.communicator.sendRequest('contract_call_view', params);
+        }
+        /** Encrypt a raw integer value to a contract-ready ciphertext (keys stay in wallet). @since 2.8.0 */
+        async encryptValue(params) {
+            this.ensureConnected();
+            return this.communicator.sendRequest('encrypt_value', params);
+        }
+        /** Decrypt a ciphertext to a raw integer value. @since 2.8.0 */
+        async decryptValue(params) {
+            this.ensureConnected();
+            return this.communicator.sendRequest('decrypt_value', params);
+        }
+        /** Zero proof for a ciphertext (proves it encrypts the given value, default 0). @since 2.8.0 */
+        async makeZeroProof(params) {
+            this.ensureConnected();
+            return this.communicator.sendRequest('make_zero_proof', params);
+        }
+        /** Range proof for a ciphertext. @since 2.8.0 */
+        async makeRangeProof(params) {
+            this.ensureConnected();
+            return this.communicator.sendRequest('make_range_proof', params);
+        }
+        /** Private OCT + private token balances (decrypted inside the wallet). @since 2.8.0 */
+        async getPrivateBalance(params = {}) {
+            this.ensureConnected();
+            return this.communicator.sendRequest('get_private_balance', params);
+        }
+        /** Register a receive/view public key so an address can receive private transfers. @since 2.8.0 */
+        async registerPrivateViewKey(params) {
+            this.ensureConnected();
+            return this.communicator.sendRequest('register_private_view_key', params);
+        }
+        /** Submit an ordered multi-step public contract flow under one approval. @since 2.8.0 */
+        async sendContractTransactionSequence(params) {
+            this.ensureConnected();
+            return this.communicator.sendRequest('send_contract_transaction_sequence', params);
+        }
         /**
-         * Sign an arbitrary message with the wallet's private key
-         * The user will be prompted to approve the signature request in the extension
+         * Sign an arbitrary message with the wallet's private key.
+         * The user will be prompted to approve the signature request in the extension.
+         *
+         * The wallet does not sign the raw message: it signs the 0xio Signed Message framing
+         * (`"Octra Signed Message:\n" + byteLength + "\n" + message`) so a signed message can never be a
+         * transaction pre-image. Verify with `verifyMessage(message, signature, publicKey)`, or check an
+         * Ed25519 signature against `getSignedMessageBytes(message)` with your own library.
+         *
          * @param message - The message to sign (non-empty string)
          * @returns Promise resolving to the base64-encoded Ed25519 signature
          * @throws ZeroXIOWalletError with code SIGNATURE_FAILED if signing fails
          * @example
          * ```typescript
          * const signature = await wallet.signMessage('Hello, 0xio!');
-         * console.log('Signature:', signature);
+         * const ok = await verifyMessage('Hello, 0xio!', signature, await wallet.getPublicKey());
          * ```
          */
         async signMessage(message) {
@@ -1857,7 +2160,7 @@
          * to the calling service and a one-time nonce, preventing cross-service replay attacks.
          *
          * @param service - Identifies the relying service (e.g. 'MyDApp' or 'api.mydapp.com')
-         * @param nonce   - Unique one-time value — use a server-generated UUID or challenge
+         * @param nonce   - Unique one-time value. Use a server-generated UUID or challenge
          * @returns Promise resolving to the base64-encoded Ed25519 signature
          */
         async signAuthMessage(service, nonce) {
@@ -1869,8 +2172,7 @@
                 throw new ZeroXIOWalletError(exports.ErrorCode.SIGNATURE_FAILED, 'Nonce is required');
             }
             const origin = typeof window !== 'undefined' ? window.location.origin : 'unknown';
-            const domainSeparated = `0xio auth\nService: ${service}\nNonce: ${nonce}\nOrigin: ${origin}`;
-            return this.signMessage(domainSeparated);
+            return this.signMessage(buildAuthMessage(service, nonce, origin));
         }
         ensureInitialized() {
             if (!this.isInitialized) {
@@ -1902,6 +2204,9 @@
             this.communicator.on('transactionConfirmed', (event) => {
                 this.handleTransactionConfirmed(event.data);
             });
+            this.communicator.on('transactionFailed', (event) => {
+                this.emit('transactionFailed', event.data ?? event);
+            });
             this.communicator.on('permissionsChanged', (event) => {
                 const permissions = event.data ?? event;
                 if (this.connectionInfo.isConnected) {
@@ -1940,7 +2245,7 @@
         }
         handleNetworkChanged(data) {
             const previousNetwork = this.connectionInfo.networkInfo;
-            // validate networkInfo — drop invalid
+            // validate networkInfo, drop invalid
             const networkInfo = validateNetworkInfo(data.networkInfo);
             if (!networkInfo) {
                 this.logger.warn('Received invalid networkInfo in networkChanged event, ignoring');
@@ -2001,9 +2306,26 @@
             }, 2000);
             this.logger.log('Transaction confirmed:', data.txHash);
         }
+        /**
+         * The wallet takes raw micro-OCT. `amount` passes through unchanged (what every existing
+         * dapp sends today); `amountOct` is converted exactly. Never both.
+         */
+        resolveRawAmount(amount, amountOct, label) {
+            if (amount != null && amountOct != null) {
+                throw new ZeroXIOWalletError(exports.ErrorCode.INVALID_AMOUNT, `${label}: pass amount or amountOct, not both`);
+            }
+            if (amountOct != null) {
+                this.assertExactOCTAmount(amountOct, label);
+                return octToMicro(amountOct);
+            }
+            if (amount == null || !isValidAmount(amount)) {
+                throw new ZeroXIOWalletError(exports.ErrorCode.TRANSACTION_FAILED, `Invalid ${label.toLowerCase()}`);
+            }
+            return amount;
+        }
         /**
          * Reject numeric amounts that cannot be represented exactly in micro-OCT.
-         * e.g. 0.1 + 0.2 = 0.30000000000000004 — the extension would sign the wrong value.
+         * e.g. 0.1 + 0.2 = 0.30000000000000004: the extension would sign the wrong value.
          * String amounts bypass this check (caller is responsible for correctness).
          */
         assertExactOCTAmount(amount, label) {
@@ -2037,7 +2359,7 @@
      *
      * Targets any wallet that exposes `window.octra` per the RFC-O-1 specification:
      *   window.octra.isOctra === true
-     *   window.octra.request({ method, params }) → Promise<unknown>
+     *   window.octra.request({ method, params }) returns Promise<unknown>
      *   window.octra.on(event, listener) / removeListener(event, listener)
      *
      * This adapter translates the SDK's internal method names into RFC-O-1 method
@@ -2046,7 +2368,7 @@
      * Non-standard SDK methods (ping, register_dapp, getTransactionHistory, etc.)
      * are passed through as-is; the wallet's request() handles or rejects them.
      */
-    /** SDK method → RFC-O-1 method name */
+    /** SDK method to RFC-O-1 method name */
     const SDK_TO_RFC = {
         get_network_info: 'octra_networkInfo',
         switch_network: 'octra_switchNetwork',
@@ -2061,8 +2383,16 @@
         decrypt_balance: 'octra_decryptBalance',
         send_private_transfer: 'octra_sendPrivateTransfer',
         claim_private_transfer: 'octra_claimStealth',
+        get_private_capabilities: 'octra_getPrivateCapabilities',
+        encrypt_value: 'octra_encryptValue',
+        decrypt_value: 'octra_decryptValue',
+        make_zero_proof: 'octra_makeZeroProof',
+        make_range_proof: 'octra_makeRangeProof',
+        get_private_balance: 'octra_getPrivateBalance',
+        register_private_view_key: 'octra_registerPrivateViewKey',
+        send_contract_transaction_sequence: 'octra_sendContractTransactionSequence',
     };
-    /** RFC-O-1 error code → SDK ErrorCode string */
+    /** RFC-O-1 error code to SDK ErrorCode string */
     const RFC_TO_SDK_ERROR = {
         4001: 'USER_REJECTED',
         4100: 'PERMISSION_DENIED',
@@ -2164,7 +2494,7 @@
                 const provider = getProvider();
                 if (!provider)
                     return () => { _handler = null; };
-                // RFC-O-1 event → SDK event name + data shape
+                // RFC-O-1 event to SDK event name and data shape
                 const onConnect = (data) => handler({ eventType: 'connect', eventData: data });
                 const onDisconnect = (data) => handler({ eventType: 'disconnect', eventData: { reason: 'network_error', ...data } });
                 const onAccountsChanged = (accounts) => handler({ eventType: 'accountChanged', eventData: { address: accounts?.[0] ?? null } });
@@ -2206,15 +2536,15 @@
     const OctraProviderAdapter = createOctraProviderAdapter();
 
     /**
-     * 0xio SDK — Wallet Adapter Registry
+     * 0xio SDK: Wallet Adapter Registry
      *
      * Add new wallet adapters here. Detection order determines which wallet takes
      * priority when multiple wallets are installed at the same time.
      */
     const REGISTERED_ADAPTERS = [
-        ZeroXIOAdapter, // 0xio extension (postMessage protocol) — highest priority
+        ZeroXIOAdapter, // 0xio extension (postMessage protocol), highest priority
         OctraProviderAdapter, // any RFC-O-1 compliant wallet (window.octra)
-        // Add new wallet adapters here — detection runs in order, first match wins
+        // Add new wallet adapters here: detection runs in order, first match wins
     ];
     /**
      * Auto-detects the first available wallet in the current page.
@@ -2261,7 +2591,7 @@
      */
     // Main exports
     // Version information
-    const SDK_VERSION = '2.7.1';
+    const SDK_VERSION = '2.8.0';
     const MIN_EXTENSION_VERSION = '2.0.1'; // Mainnet Alpha
     const MIN_EXTENSION_VERSION_DEVNET = '2.2.1'; // Devnet (contract calls, privacy)
     const SUPPORTED_EXTENSION_VERSIONS = '^2.0.1'; // Supports all versions >= 2.0.1
@@ -2289,7 +2619,7 @@
     function checkSDKCompatibility() {
         const issues = [];
         const recommendations = [];
-        // Hard blockers — SDK cannot function without these
+        // Hard blockers: the SDK cannot function without these
         if (typeof window === 'undefined') {
             issues.push('Window object not available');
             recommendations.push('SDK must be used in a browser environment');
@@ -2354,7 +2684,7 @@
                     debugMode: !!window.__ZEROXIO_SDK_DEBUG__,
                     environment: isDevelopment ? 'development' : 'production'
                 }),
-                // simulateExtensionEvent removed for security — could be exploited on staging builds
+                // simulateExtensionEvent removed for security: it could be exploited on staging builds
                 showWelcome: () => {
                     console.log(`[0xio SDK] Development mode - SDK v${SDK_VERSION}`);
                     console.log('[0xio SDK] Debug utilities available at window.__ZEROXIO_SDK_UTILS__');
@@ -2372,16 +2702,21 @@
     exports.DEFAULT_NETWORK_ID = DEFAULT_NETWORK_ID;
     exports.EventEmitter = EventEmitter;
     exports.ExtensionCommunicator = ExtensionCommunicator;
+    exports.LEGACY_PERMISSION_MAP = LEGACY_PERMISSION_MAP;
     exports.MIN_EXTENSION_VERSION = MIN_EXTENSION_VERSION;
     exports.MIN_EXTENSION_VERSION_DEVNET = MIN_EXTENSION_VERSION_DEVNET;
     exports.NETWORKS = NETWORKS;
     exports.OctraProviderAdapter = OctraProviderAdapter;
     exports.SDK_CONFIG = SDK_CONFIG;
     exports.SDK_VERSION = SDK_VERSION;
+    exports.SIGNED_MESSAGE_PREFIX = SIGNED_MESSAGE_PREFIX;
+    exports.SIGNED_MESSAGE_VERSION = SIGNED_MESSAGE_VERSION;
     exports.SUPPORTED_EXTENSION_VERSIONS = SUPPORTED_EXTENSION_VERSIONS;
+    exports.WALLET_PERMISSIONS = WALLET_PERMISSIONS;
     exports.ZeroXIOAdapter = ZeroXIOAdapter;
     exports.ZeroXIOWallet = ZeroXIOWallet;
     exports.ZeroXIOWalletError = ZeroXIOWalletError;
+    exports.buildAuthMessage = buildAuthMessage;
     exports.checkBrowserSupport = checkBrowserSupport;
     exports.checkSDKCompatibility = checkSDKCompatibility;
     exports.createDefaultBalance = createDefaultBalance;
@@ -2405,6 +2740,7 @@
     exports.getAllNetworks = getAllNetworks;
     exports.getDefaultNetwork = getDefaultNetwork;
     exports.getNetworkConfig = getNetworkConfig;
+    exports.getSignedMessageBytes = getSignedMessageBytes;
     exports.isBrowser = isBrowser;
     exports.isErrorType = isErrorType;
     exports.isValidAddress = isValidAddress;
@@ -2412,8 +2748,12 @@
     exports.isValidFeeLevel = isValidFeeLevel;
     exports.isValidMessage = isValidMessage;
     exports.isValidNetworkId = isValidNetworkId;
+    exports.octToMicro = octToMicro;
     exports.toMicroOCT = toMicroOCT;
     exports.toMicroZeroXIO = toMicroOCT;
+    exports.toWalletPermissions = toWalletPermissions;
+    exports.verifyMessage = verifyMessage;
+    exports.withLegacyAliases = withLegacyAliases;
 
 }));
 //# sourceMappingURL=index.umd.js.map