@chainvue/verus-sapling 0.0.0 → 0.1.0

package/LICENSE

@@ -187,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright [yyyy] [name of copyright owner]
+   Copyright 2026 Robert Lech
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/README.md

@@ -1,13 +1,9 @@
 # @chainvue/verus-sapling
 
-<p>
-  <a href="https://github.com/chainvue/verus-sapling/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/chainvue/verus-sapling/actions/workflows/ci.yml/badge.svg"></a>
-  <a href="https://www.npmjs.com/package/@chainvue/verus-sapling"><img alt="npm" src="https://img.shields.io/npm/v/@chainvue/verus-sapling?color=cb3837&logo=npm"></a>
-  <img alt="node" src="https://img.shields.io/node/v/@chainvue/verus-sapling">
-  <img alt="types" src="https://img.shields.io/badge/types-included-3178c6?logo=typescript&logoColor=white">
-  <a href="./LICENSE"><img alt="license" src="https://img.shields.io/badge/license-Apache--2.0-blue"></a>
-  <img alt="offline" src="https://img.shields.io/badge/network-none%20in%20signer-success">
-</p>
+[![npm](https://img.shields.io/npm/v/%40chainvue%2Fverus-sapling)](https://www.npmjs.com/package/@chainvue/verus-sapling)
+[![CI](https://github.com/chainvue/verus-sapling/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/chainvue/verus-sapling/actions/workflows/ci.yml)
+[![license](https://img.shields.io/npm/l/%40chainvue%2Fverus-sapling)](./LICENSE)
+[![node](https://img.shields.io/node/v/%40chainvue%2Fverus-sapling)](https://nodejs.org)
 
 > **Offline signing of Verus _shielded_ (Sapling) transactions** — `t→z`, `z→z`,
 > `z→t`, with encrypted memos. It builds and signs bytes; your consumer
@@ -101,6 +97,44 @@ ZIP-212 enforcement is `Off`. The only Verus-specific value in the entire path i
 that branch id, injected into the sighash. Even the lightwalletd wire protocol is
 stock — `VerusCoin/lightwalletd`'s protos are byte-identical to Zcash's.
 
+### Recovery phrases: one phrase, two unrelated key schedules
+
+A Verus Mobile wallet derives **both** of its keys from a single recovery
+phrase — by two derivations that share nothing:
+
+| | transparent (`R…`) | shielded (`zs…`) |
+|---|---|---|
+| derivation | `sha256(utf8(phrase))` + Agama/Iguana clamp | BIP-39 → ZIP-32 |
+| BIP-39 | ignored — the phrase is hashed as text | required, real PBKDF2 |
+| path | none — one key per phrase, no HD | `m/32'/coin'/account'` |
+| network | mainnet ≡ testnet | coin type 133 on **both** (see below) |
+| lives in | [`@chainvue/verus-sdk`](https://www.npmjs.com/package/@chainvue/verus-sdk) `keys.seedToWif` | `deriveSaplingAccount` (here) |
+
+```ts
+import { deriveSaplingAccount, initSapling } from '@chainvue/verus-sapling';
+
+await initSapling(wasmBytes);
+const account = await deriveSaplingAccount({ mnemonic: phrase }); // coinType 133, account 0
+account.address;   // zs… — compare against your wallet before relying on it
+account.extskHex;  // spending key, the form every builder here takes
+account.dfvkHex;   // viewing key — enough to scan, cannot spend
+```
+
+Consequences worth internalizing: the phrase must be a **valid BIP-39 mnemonic**
+for a z-address to exist at all (Verus Mobile gates its shielded account on
+`validateMnemonic()` + ≥12 words, while the transparent side accepts any string),
+so the same words produce unrelated keys on the two sides.
+
+**Coin type 133 on both networks — including VRSCTEST.** Verus Mobile's
+`parseDlightSeed` calls `Tools.deriveSaplingSpendingKey(seed)` with no network
+argument, so the Kotlin bridge's `networks.getOrDefault(network,
+ZcashNetwork.Mainnet)` falls back to mainnet and a testnet wallet holds a
+mainnet-path key. Verified 2026-07-28 against a live VRSCTEST wallet: of five
+candidate paths, only `m/32'/133'/0'` reproduced the address the app shows. The
+default here matches that; `COIN_TYPE_VRSCTEST` (1) exists for stock-zcash
+tooling and derives a key no Verus Mobile wallet holds. The address HRP is `zs`
+on both networks either way.
+
 ### Backend: the one unavoidable dependency
 
 - **`t→z` (shielding)** needs **no** commitment-tree witness — only the
@@ -177,8 +211,7 @@ test/           vitest suite (money, hex, protobuf, gRPC-web, wallet, zaddr, …
 ```
 
 Docs: [SECURITY](SECURITY.md) · [CONTRIBUTING](CONTRIBUTING.md) ·
-[RELEASING](RELEASING.md) · [NOTICE](NOTICE) ·
-[Code of Conduct](CODE_OF_CONDUCT.md)
+[RELEASING](RELEASING.md) · [NOTICE](NOTICE)
 
 ## Contributing
 

package/crate/pkg/verus_sapling_prover.d.ts

@@ -1,6 +1,14 @@
 /* tslint:disable */
 /* eslint-disable */
 
+/**
+ * Derive a Sapling account (spending key, viewing key, default address) from a
+ * BIP-39 seed via ZIP-32 `m/32'/coin_type'/account'`. `spec_json` is the
+ * derivation request (see `json_api::derive_account_from_json`). No params, no
+ * proving — cheap, safe on the main thread.
+ */
+export function derive_account(spec_json: string): string;
+
 /**
  * Detect the wallet's own notes by trial-decrypting compact outputs (read path
  * — no params, no proving). `spec_json` is the note-detection request (see
@@ -34,6 +42,7 @@ export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembl
 
 export interface InitOutput {
     readonly memory: WebAssembly.Memory;
+    readonly derive_account: (a: number, b: number) => [number, number, number, number];
     readonly detect_notes: (a: number, b: number) => [number, number, number, number];
     readonly read_note: (a: number, b: number) => [number, number, number, number];
     readonly shield_t2z: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number, number];

package/crate/pkg/verus_sapling_prover.js

@@ -1,5 +1,34 @@
 /* @ts-self-types="./verus_sapling_prover.d.ts" */
 
+/**
+ * Derive a Sapling account (spending key, viewing key, default address) from a
+ * BIP-39 seed via ZIP-32 `m/32'/coin_type'/account'`. `spec_json` is the
+ * derivation request (see `json_api::derive_account_from_json`). No params, no
+ * proving — cheap, safe on the main thread.
+ * @param {string} spec_json
+ * @returns {string}
+ */
+export function derive_account(spec_json) {
+    let deferred3_0;
+    let deferred3_1;
+    try {
+        const ptr0 = passStringToWasm0(spec_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.derive_account(ptr0, len0);
+        var ptr2 = ret[0];
+        var len2 = ret[1];
+        if (ret[3]) {
+            ptr2 = 0; len2 = 0;
+            throw takeFromExternrefTable0(ret[2]);
+        }
+        deferred3_0 = ptr2;
+        deferred3_1 = len2;
+        return getStringFromWasm0(ptr2, len2);
+    } finally {
+        wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
+    }
+}
+
 /**
  * Detect the wallet's own notes by trial-decrypting compact outputs (read path
  * — no params, no proving). `spec_json` is the note-detection request (see

package/crate/pkg/verus_sapling_prover_bg.wasm.d.ts

@@ -1,6 +1,7 @@
 /* tslint:disable */
 /* eslint-disable */
 export const memory: WebAssembly.Memory;
+export const derive_account: (a: number, b: number) => [number, number, number, number];
 export const detect_notes: (a: number, b: number) => [number, number, number, number];
 export const read_note: (a: number, b: number) => [number, number, number, number];
 export const shield_t2z: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number, number];

package/dist/derive.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Shielded key derivation from a recovery phrase — BIP-39 → ZIP-32 Sapling.
+ *
+ * A Verus Mobile wallet derives BOTH of its keys from one phrase, by two
+ * completely unrelated schedules:
+ *
+ *   transparent (R-address)  sha256(utf8(phrase)) + Agama/Iguana clamp.
+ *                            No BIP-39, no BIP-32, one key per phrase.
+ *                            Lives in `@chainvue/verus-sdk` (`keys.seedToWif`).
+ *   shielded    (z-address)  BIP-39 → 64-byte seed → ZIP-32 `m/32'/coin'/account'`.
+ *                            This module.
+ *
+ * Consequences worth knowing before you wire this into a wallet:
+ *
+ *  - The phrase must be a REAL BIP-39 mnemonic for a z-address to exist. Verus
+ *    Mobile gates its shielded account on `validateMnemonic()` + ≥12 words; an
+ *    arbitrary passphrase yields a transparent-only wallet. The transparent
+ *    side, by contrast, accepts any string at all.
+ *  - `coinType` is 133 for a Verus Mobile wallet on BOTH networks — including
+ *    VRSCTEST. That is not a typo: the app's `parseDlightSeed` calls
+ *    `Tools.deriveSaplingSpendingKey(seed)` with NO network argument, so the
+ *    Kotlin bridge falls back to `networks.getOrDefault(network,
+ *    ZcashNetwork.Mainnet)` and a testnet wallet ends up holding a mainnet-path
+ *    key. Confirmed 2026-07-28 against a live VRSCTEST wallet: only
+ *    `m/32'/133'/0'` reproduced the address the app displays. The stock-zcash
+ *    testnet coin type (1) is exported for other tooling, but derives a key no
+ *    Verus Mobile wallet holds.
+ *  - The address has no network split either — Verus emits `zs` on both.
+ *  - This derives keys; it does not validate the BIP-39 checksum (that needs the
+ *    2048-word list, which this package deliberately does not carry). A typo'd
+ *    phrase derives a valid but empty wallet — compare the address against your
+ *    wallet before relying on it.
+ */
+/**
+ * ZIP-32 coin type for Verus (stock Zcash mainnet value; the Verus librustzcash
+ * fork leaves it unmodified). This is what Verus Mobile uses on **both**
+ * networks — see the note above — so it is the right default for VRSCTEST too.
+ */
+export declare const COIN_TYPE_VRSC = 133;
+/**
+ * Stock-zcash testnet coin type. Exported for interoperating with tooling that
+ * follows the network split; a Verus Mobile wallet does NOT hold a key at this
+ * path, not even on VRSCTEST.
+ */
+export declare const COIN_TYPE_VRSCTEST = 1;
+/**
+ * BIP-39 mnemonic → 64-byte seed: PBKDF2-HMAC-SHA512, 2048 iterations, salt
+ * `"mnemonic" + passphrase`, both NFKD-normalized. Exactly what Verus Mobile's
+ * `SeedPhrase.toByteArray()` (kotlin-bip39 `MnemonicCode.toSeed()`) computes.
+ *
+ * WebCrypto, so it works unchanged in Node and the browser.
+ */
+export declare function mnemonicToSeed(mnemonic: string, passphrase?: string): Promise<Uint8Array>;
+/** A derived Sapling account. */
+export interface SaplingAccount {
+    /** `zs…` payment address — compare this against your wallet. */
+    address: string;
+    /** Raw 43-byte payment address, hex (what the JSON specs take). */
+    addressHex: string;
+    /** ZIP-32 extended spending key, hex — `extskHex` everywhere else here. CAN SPEND. */
+    extskHex: string;
+    /** Diversifiable full viewing key, hex — enough to scan, cannot spend. */
+    dfvkHex: string;
+    /** Diversifier index the default address was found at. */
+    diversifierIndexHex: string;
+}
+export interface DeriveSaplingAccountParams {
+    /** BIP-39 recovery phrase. Mutually exclusive with `seedHex`. */
+    mnemonic?: string;
+    /** Optional BIP-39 passphrase ("25th word"). Verus Mobile does not use one. */
+    passphrase?: string;
+    /** A 64-byte BIP-39 seed, hex, if you did the mnemonic step yourself. */
+    seedHex?: string;
+    /**
+     * Defaults to 133 — what Verus Mobile derives with on BOTH VRSC and VRSCTEST.
+     * Pass 1 only for stock-zcash tooling that honours the testnet split.
+     */
+    coinType?: number;
+    /** Defaults to 0 — the account Verus Mobile uses (`Account.DEFAULT`). */
+    account?: number;
+}
+/**
+ * Derive `m/32'/coinType'/account'` and its default payment address.
+ *
+ * Requires the wasm module: call `initSapling()` first. Cheap — no proving
+ * parameters, no Groth16, safe on the main thread.
+ */
+export declare function deriveSaplingAccount(params: DeriveSaplingAccountParams): Promise<SaplingAccount>;

package/dist/derive.js

@@ -0,0 +1,99 @@
+/**
+ * Shielded key derivation from a recovery phrase — BIP-39 → ZIP-32 Sapling.
+ *
+ * A Verus Mobile wallet derives BOTH of its keys from one phrase, by two
+ * completely unrelated schedules:
+ *
+ *   transparent (R-address)  sha256(utf8(phrase)) + Agama/Iguana clamp.
+ *                            No BIP-39, no BIP-32, one key per phrase.
+ *                            Lives in `@chainvue/verus-sdk` (`keys.seedToWif`).
+ *   shielded    (z-address)  BIP-39 → 64-byte seed → ZIP-32 `m/32'/coin'/account'`.
+ *                            This module.
+ *
+ * Consequences worth knowing before you wire this into a wallet:
+ *
+ *  - The phrase must be a REAL BIP-39 mnemonic for a z-address to exist. Verus
+ *    Mobile gates its shielded account on `validateMnemonic()` + ≥12 words; an
+ *    arbitrary passphrase yields a transparent-only wallet. The transparent
+ *    side, by contrast, accepts any string at all.
+ *  - `coinType` is 133 for a Verus Mobile wallet on BOTH networks — including
+ *    VRSCTEST. That is not a typo: the app's `parseDlightSeed` calls
+ *    `Tools.deriveSaplingSpendingKey(seed)` with NO network argument, so the
+ *    Kotlin bridge falls back to `networks.getOrDefault(network,
+ *    ZcashNetwork.Mainnet)` and a testnet wallet ends up holding a mainnet-path
+ *    key. Confirmed 2026-07-28 against a live VRSCTEST wallet: only
+ *    `m/32'/133'/0'` reproduced the address the app displays. The stock-zcash
+ *    testnet coin type (1) is exported for other tooling, but derives a key no
+ *    Verus Mobile wallet holds.
+ *  - The address has no network split either — Verus emits `zs` on both.
+ *  - This derives keys; it does not validate the BIP-39 checksum (that needs the
+ *    2048-word list, which this package deliberately does not carry). A typo'd
+ *    phrase derives a valid but empty wallet — compare the address against your
+ *    wallet before relying on it.
+ */
+import { ShieldedInputError } from './errors.js';
+import { bytesToHex, hexToBytes } from './hex.js';
+import { deriveAccountWasm } from './wasm.js';
+import { encodeSaplingAddress } from './zaddr.js';
+/**
+ * ZIP-32 coin type for Verus (stock Zcash mainnet value; the Verus librustzcash
+ * fork leaves it unmodified). This is what Verus Mobile uses on **both**
+ * networks — see the note above — so it is the right default for VRSCTEST too.
+ */
+export const COIN_TYPE_VRSC = 133;
+/**
+ * Stock-zcash testnet coin type. Exported for interoperating with tooling that
+ * follows the network split; a Verus Mobile wallet does NOT hold a key at this
+ * path, not even on VRSCTEST.
+ */
+export const COIN_TYPE_VRSCTEST = 1;
+/**
+ * BIP-39 mnemonic → 64-byte seed: PBKDF2-HMAC-SHA512, 2048 iterations, salt
+ * `"mnemonic" + passphrase`, both NFKD-normalized. Exactly what Verus Mobile's
+ * `SeedPhrase.toByteArray()` (kotlin-bip39 `MnemonicCode.toSeed()`) computes.
+ *
+ * WebCrypto, so it works unchanged in Node and the browser.
+ */
+export async function mnemonicToSeed(mnemonic, passphrase = '') {
+    if (typeof mnemonic !== 'string' || mnemonic.trim().length === 0) {
+        throw new ShieldedInputError('mnemonic is empty');
+    }
+    const enc = new TextEncoder();
+    const key = await globalThis.crypto.subtle.importKey('raw', enc.encode(mnemonic.normalize('NFKD')), 'PBKDF2', false, ['deriveBits']);
+    const bits = await globalThis.crypto.subtle.deriveBits({
+        name: 'PBKDF2',
+        salt: enc.encode(`mnemonic${passphrase.normalize('NFKD')}`),
+        iterations: 2048,
+        hash: 'SHA-512',
+    }, key, 512);
+    return new Uint8Array(bits);
+}
+/**
+ * Derive `m/32'/coinType'/account'` and its default payment address.
+ *
+ * Requires the wasm module: call `initSapling()` first. Cheap — no proving
+ * parameters, no Groth16, safe on the main thread.
+ */
+export async function deriveSaplingAccount(params) {
+    const { mnemonic, seedHex, passphrase = '', coinType = COIN_TYPE_VRSC, account = 0 } = params;
+    // Narrowed by the branches themselves rather than by a non-null assertion:
+    // exactly one input is allowed, and each branch reads the one it checked.
+    let seed;
+    if (mnemonic != null && seedHex == null) {
+        seed = await mnemonicToSeed(mnemonic, passphrase);
+    }
+    else if (seedHex != null && mnemonic == null) {
+        seed = hexToBytes(seedHex);
+    }
+    else {
+        throw new ShieldedInputError('pass exactly one of mnemonic or seedHex');
+    }
+    const derived = deriveAccountWasm(JSON.stringify({ seed_hex: bytesToHex(seed), coin_type: coinType, account }));
+    return {
+        address: encodeSaplingAddress(hexToBytes(derived.address_hex)),
+        addressHex: derived.address_hex,
+        extskHex: derived.extsk_hex,
+        dfvkHex: derived.dfvk_hex,
+        diversifierIndexHex: derived.diversifier_index_hex,
+    };
+}

package/dist/index.d.ts

@@ -27,7 +27,8 @@ export * from './errors.js';
 export * from './parse.js';
 export { CONSENSUS_BRANCH_ID, parseSats, toSafeNumber } from './money.js';
 export { bytesToHex, hexToBytes, reverseBytes } from './hex.js';
-export { decodeSaplingAddress, saplingAddressToHex } from './zaddr.js';
-export { initSapling, shieldT2z, spendShielded, detectNotes as detectNotesWasm, readNote, verifyCanonicalParams, PARAM_SHA256, type SaplingParams, type DetectedNoteRaw, type ReadNoteResult, } from './wasm.js';
+export { decodeSaplingAddress, saplingAddressToHex, encodeSaplingAddress } from './zaddr.js';
+export { mnemonicToSeed, deriveSaplingAccount, COIN_TYPE_VRSC, COIN_TYPE_VRSCTEST, type SaplingAccount, type DeriveSaplingAccountParams, } from './derive.js';
+export { initSapling, shieldT2z, spendShielded, detectNotes as detectNotesWasm, readNote, deriveAccountWasm, verifyCanonicalParams, PARAM_SHA256, type SaplingParams, type DetectedNoteRaw, type ReadNoteResult, type DerivedAccountRaw, } from './wasm.js';
 export { detectNotes, buildShieldedSpend, type DetectKey, type DetectProver, type SpendProver, type DetectNotesParams, type SpendableNote, type BuildShieldedSpendParams, type ShieldedRecipient, type TransparentRecipient, } from './wallet.js';
 export type { LightwalletdTransport, TreeState, CompactOutput, CompactTx, CompactBlock, LightdInfo, } from './lightwalletd.js';

package/dist/index.js

@@ -28,8 +28,11 @@ export * from './errors.js';
 export * from './parse.js';
 export { CONSENSUS_BRANCH_ID, parseSats, toSafeNumber } from './money.js';
 export { bytesToHex, hexToBytes, reverseBytes } from './hex.js';
-export { decodeSaplingAddress, saplingAddressToHex } from './zaddr.js';
+export { decodeSaplingAddress, saplingAddressToHex, encodeSaplingAddress } from './zaddr.js';
+// Shielded key derivation from a BIP-39 recovery phrase (ZIP-32 m/32'/coin'/account').
+// `mnemonicToSeed` is pure; `deriveSaplingAccount` needs the wasm module.
+export { mnemonicToSeed, deriveSaplingAccount, COIN_TYPE_VRSC, COIN_TYPE_VRSCTEST, } from './derive.js';
 // wasm prover loaders + low-level builders (init once, then call).
-export { initSapling, shieldT2z, spendShielded, detectNotes as detectNotesWasm, readNote, verifyCanonicalParams, PARAM_SHA256, } from './wasm.js';
+export { initSapling, shieldT2z, spendShielded, detectNotes as detectNotesWasm, readNote, deriveAccountWasm, verifyCanonicalParams, PARAM_SHA256, } from './wasm.js';
 // Shielded wallet orchestration (transport- and prover-agnostic).
 export { detectNotes, buildShieldedSpend, } from './wallet.js';

package/dist/wasm.d.ts

@@ -15,8 +15,8 @@
 /** SHA-256 of the canonical Zcash Sapling proving parameters (byte-identical for
  *  Verus). See NOTICE / README. */
 export declare const PARAM_SHA256: {
-    readonly spend: "8e48ffd23abb3a5fd9c5589204f32d9c31285a04b78096ba40a79b75677efc13";
-    readonly output: "2f0ebbcbb9bb0bcffe95a397e7eba89c29eb4dde6191c339db88570e3f3fb0e4";
+    readonly spend: '8e48ffd23abb3a5fd9c5589204f32d9c31285a04b78096ba40a79b75677efc13';
+    readonly output: '2f0ebbcbb9bb0bcffe95a397e7eba89c29eb4dde6191c339db88570e3f3fb0e4';
 };
 /**
  * Verify caller-supplied proving parameters are the canonical Sapling params
@@ -89,3 +89,22 @@ export interface ReadNoteResult {
  * Returns `null` if the output is not for this key. Cheap (no params, no proving).
  */
 export declare function readNote(specJson: string): ReadNoteResult | null;
+/** A ZIP-32-derived Sapling account, raw from the wasm boundary (all hex). */
+export interface DerivedAccountRaw {
+    /** Extended spending key, 169 bytes. CAN SPEND. */
+    extsk_hex: string;
+    /** Diversifiable full viewing key, 128 bytes — scanning only. */
+    dfvk_hex: string;
+    /** Raw 43-byte payment address. */
+    address_hex: string;
+    /** 11-byte diversifier index the default address was found at. */
+    diversifier_index_hex: string;
+}
+/**
+ * Derive a Sapling account from a BIP-39 seed via ZIP-32
+ * `m/32'/coin_type'/account'` (see the Rust `json_api::derive_account_from_json`).
+ * No params, no proving — but the wasm module must be initialized. Prefer
+ * `deriveSaplingAccount` in `derive.ts`, which also does the BIP-39 step and
+ * bech32-encodes the address.
+ */
+export declare function deriveAccountWasm(specJson: string): DerivedAccountRaw;

package/dist/wasm.js

@@ -14,7 +14,7 @@
  */
 // The generated glue is ESM (wasm-pack, crate/pkg). In a bundler/browser, import
 // the pkg directly.
-import initWasm, { shield_t2z, spend_shielded, detect_notes, read_note, } from '../crate/pkg/verus_sapling_prover.js';
+import initWasm, { shield_t2z, spend_shielded, detect_notes, read_note, derive_account, } from '../crate/pkg/verus_sapling_prover.js';
 import { ShieldedError } from './errors.js';
 let ready;
 /** SHA-256 of the canonical Zcash Sapling proving parameters (byte-identical for
@@ -88,3 +88,13 @@ export function detectNotes(specJson) {
 export function readNote(specJson) {
     return JSON.parse(read_note(specJson));
 }
+/**
+ * Derive a Sapling account from a BIP-39 seed via ZIP-32
+ * `m/32'/coin_type'/account'` (see the Rust `json_api::derive_account_from_json`).
+ * No params, no proving — but the wasm module must be initialized. Prefer
+ * `deriveSaplingAccount` in `derive.ts`, which also does the BIP-39 step and
+ * bech32-encodes the address.
+ */
+export function deriveAccountWasm(specJson) {
+    return JSON.parse(derive_account(specJson));
+}

package/dist/zaddr.d.ts

@@ -17,3 +17,14 @@
 export declare function decodeSaplingAddress(addr: string): Uint8Array;
 /** Hex of the 43-byte payload (convenience for JSON specs). */
 export declare function saplingAddressToHex(addr: string): string;
+/**
+ * Encode a raw 43-byte Sapling payment address as a `zs…` bech32 address — the
+ * inverse of `decodeSaplingAddress`, for addresses that are DERIVED rather than
+ * pasted in (see `derive.ts`).
+ *
+ * The HRP defaults to `zs` for BOTH Verus networks, matching what a live Verus
+ * daemon emits (see the note at the top of this file): unlike stock zcash there
+ * is no `ztestsapling` on vrsctest. The parameter exists only to interoperate
+ * with stock-zcash tooling that still expects that split.
+ */
+export declare function encodeSaplingAddress(payload: Uint8Array, hrp?: 'zs' | 'ztestsapling'): string;

package/dist/zaddr.js

@@ -105,3 +105,27 @@ export function decodeSaplingAddress(addr) {
 export function saplingAddressToHex(addr) {
     return bytesToHex(decodeSaplingAddress(addr));
 }
+function bech32Encode(hrp, data) {
+    // Checksum over hrp || data || six zero symbols, xor 1 (bech32, not bech32m).
+    const checksum = bech32Polymod([...hrpExpand(hrp), ...data, 0, 0, 0, 0, 0, 0]) ^ 1;
+    const out = [...data];
+    for (let i = 0; i < 6; i++)
+        out.push((checksum >> (5 * (5 - i))) & 31);
+    return `${hrp}1${out.map((v) => CHARSET[v]).join('')}`;
+}
+/**
+ * Encode a raw 43-byte Sapling payment address as a `zs…` bech32 address — the
+ * inverse of `decodeSaplingAddress`, for addresses that are DERIVED rather than
+ * pasted in (see `derive.ts`).
+ *
+ * The HRP defaults to `zs` for BOTH Verus networks, matching what a live Verus
+ * daemon emits (see the note at the top of this file): unlike stock zcash there
+ * is no `ztestsapling` on vrsctest. The parameter exists only to interoperate
+ * with stock-zcash tooling that still expects that split.
+ */
+export function encodeSaplingAddress(payload, hrp = 'zs') {
+    if (payload.length !== 43) {
+        throw new Error(`expected 43-byte payload, got ${payload.length}`);
+    }
+    return bech32Encode(hrp, convertBits([...payload], 8, 5, true));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chainvue/verus-sapling",
-  "version": "0.0.0",
+  "version": "0.1.0",
   "description": "Offline signing of Verus shielded (Sapling) transactions — t→z, z→z, z→t, with memo. Companion to @chainvue/verus-sdk. Builds and signs bytes; consumers broadcast. WASM prover, no full node on the signing host.",
   "license": "Apache-2.0",
   "author": "Robert Lech",
@@ -59,7 +59,6 @@
     "build:ext": "tsc && node examples/extension/build.mjs",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
-    "lint": "eslint .",
     "prepack": "npm run build"
   },
   "peerDependencies": {
@@ -67,20 +66,20 @@
   },
   "optionalDependencies": {
     "@grpc/grpc-js": "^1.10.0",
-    "@grpc/proto-loader": "^0.7.0"
+    "@grpc/proto-loader": "^0.8.1"
   },
   "devDependencies": {
     "@chainvue/verus-sdk": ">=0.14.0",
     "@grpc/grpc-js": "^1.10.0",
-    "@grpc/proto-loader": "^0.7.0",
-    "@semantic-release/changelog": "^6.0.3",
+    "@grpc/proto-loader": "^0.8.1",
+    "@semantic-release/changelog": "^7.0.0",
     "@semantic-release/exec": "^7.1.0",
-    "@semantic-release/git": "^10.0.1",
-    "@types/node": "^22",
-    "esbuild": "^0.24.2",
+    "@semantic-release/git": "^11.0.0",
+    "@types/node": "^26.1.1",
+    "esbuild": "^0.28.1",
     "semantic-release": "^25.0.7",
-    "typescript": "^5",
-    "vitest": "^2"
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.10"
   },
   "//": "The concrete lightwalletd gRPC client (@chainvue/verus-sapling/lightwalletd) needs @grpc/grpc-js — an OPTIONAL dependency: the browser path implements LightwalletdTransport over gRPC-web instead, and the package root pulls in no gRPC at runtime.",
   "publishConfig": {