@execra/core 1.0.0

package/dist/vault/keystore.d.ts

@@ -0,0 +1,44 @@
+/**
+ *
+ * AES-256-GCM encrypted keystore.
+ * The mnemonic (seed phrase) is encrypted at rest in ~/.wallet/vault.enc
+ * Private keys NEVER touch disk — they are derived in memory at runtime.
+ *
+ * Encryption scheme:
+ *   - Key derivation: PBKDF2 (SHA-512, 210,000 iterations) — OWASP recommended
+ *   - Cipher: AES-256-GCM (authenticated encryption — detects tampering)
+ *   - Salt: 32 random bytes (unique per vault)
+ *   - IV: 16 random bytes (unique per encryption)
+ *
+ * Dependencies: Node.js built-in `crypto`, `fs`, `os`, `path`
+ */
+interface VaultData {
+    mnemonic: string;
+    createdAt: string;
+    version: number;
+}
+declare function getWalletDir(): string;
+declare function getVaultPath(): string;
+declare function getConfigPath(): string;
+declare function getSessionsPath(): string;
+declare const SESSIONS_FILE: string;
+declare function ensureWalletDir(): void;
+declare function vaultExists(): boolean;
+/**
+ * Encrypt and save the vault to disk.
+ * @param data   - vault contents (mnemonic + metadata)
+ * @param password - user's wallet password
+ */
+declare function saveVault(data: VaultData, password: string): Promise<void>;
+/**
+ * Load and decrypt the vault from disk.
+ * Throws if the password is wrong or the file has been tampered with.
+ */
+declare function loadVault(password: string): Promise<VaultData>;
+/**
+ * Change the vault password.
+ * Decrypts with old password, re-encrypts with new password.
+ */
+declare function changePassword(oldPassword: string, newPassword: string): Promise<void>;
+
+export { SESSIONS_FILE, type VaultData, changePassword, ensureWalletDir, getConfigPath, getSessionsPath, getVaultPath, getWalletDir, loadVault, saveVault, vaultExists };

package/dist/vault/keystore.js

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+
+// src/vault/keystore.ts
+import crypto from "crypto";
+import fs from "fs";
+import os from "os";
+import path from "path";
+var VAULT_VERSION = 1;
+var PBKDF2_ITERATIONS = 21e4;
+var PBKDF2_DIGEST = "sha512";
+var KEY_LENGTH = 32;
+var SALT_LENGTH = 32;
+var IV_LENGTH = 16;
+var CIPHER = "aes-256-gcm";
+function getWalletDir() {
+  return path.join(os.homedir(), ".wallet");
+}
+function getVaultPath() {
+  return path.join(getWalletDir(), "vault.enc");
+}
+function getConfigPath() {
+  return path.join(getWalletDir(), "config.json");
+}
+function getSessionsPath() {
+  return path.join(getWalletDir(), "sessions.json");
+}
+var SESSIONS_FILE = getSessionsPath();
+function ensureWalletDir() {
+  const dir = getWalletDir();
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  }
+}
+function vaultExists() {
+  return fs.existsSync(getVaultPath());
+}
+async function saveVault(data, password) {
+  ensureWalletDir();
+  const salt = crypto.randomBytes(SALT_LENGTH);
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const key = await deriveKey(password, salt);
+  const plaintext = JSON.stringify(data);
+  const cipher = crypto.createCipheriv(CIPHER, key, iv);
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext, "utf8"),
+    cipher.final()
+  ]);
+  const authTag = cipher.getAuthTag();
+  const vault = {
+    version: VAULT_VERSION,
+    salt: salt.toString("hex"),
+    iv: iv.toString("hex"),
+    authTag: authTag.toString("hex"),
+    ciphertext: encrypted.toString("hex")
+  };
+  fs.writeFileSync(getVaultPath(), JSON.stringify(vault, null, 2), {
+    mode: 384
+    // owner read/write only
+  });
+}
+async function loadVault(password) {
+  if (!vaultExists()) {
+    throw new Error("No vault found. Run `wallet init` to create one.");
+  }
+  const raw = fs.readFileSync(getVaultPath(), "utf8");
+  const vault = JSON.parse(raw);
+  if (vault.version !== VAULT_VERSION) {
+    throw new Error(`Unsupported vault version: ${vault.version}`);
+  }
+  const salt = Buffer.from(vault.salt, "hex");
+  const iv = Buffer.from(vault.iv, "hex");
+  const authTag = Buffer.from(vault.authTag, "hex");
+  const ciphertext = Buffer.from(vault.ciphertext, "hex");
+  const key = await deriveKey(password, salt);
+  try {
+    const decipher = crypto.createDecipheriv(CIPHER, key, iv);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final()
+    ]);
+    return JSON.parse(decrypted.toString("utf8"));
+  } catch {
+    throw new Error("Decryption failed: wrong password or vault is corrupted.");
+  }
+}
+async function changePassword(oldPassword, newPassword) {
+  const data = await loadVault(oldPassword);
+  await saveVault(data, newPassword);
+}
+function deriveKey(password, salt) {
+  return new Promise((resolve, reject) => {
+    crypto.pbkdf2(
+      password,
+      salt,
+      PBKDF2_ITERATIONS,
+      KEY_LENGTH,
+      PBKDF2_DIGEST,
+      (err, key) => {
+        if (err) reject(err);
+        else resolve(key);
+      }
+    );
+  });
+}
+export {
+  SESSIONS_FILE,
+  changePassword,
+  ensureWalletDir,
+  getConfigPath,
+  getSessionsPath,
+  getVaultPath,
+  getWalletDir,
+  loadVault,
+  saveVault,
+  vaultExists
+};
+//# sourceMappingURL=keystore.js.map

package/dist/vault/keystore.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/vault/keystore.ts"],"sourcesContent":["/**\n *\n * AES-256-GCM encrypted keystore.\n * The mnemonic (seed phrase) is encrypted at rest in ~/.wallet/vault.enc\n * Private keys NEVER touch disk — they are derived in memory at runtime.\n *\n * Encryption scheme:\n *   - Key derivation: PBKDF2 (SHA-512, 210,000 iterations) — OWASP recommended\n *   - Cipher: AES-256-GCM (authenticated encryption — detects tampering)\n *   - Salt: 32 random bytes (unique per vault)\n *   - IV: 16 random bytes (unique per encryption)\n *\n * Dependencies: Node.js built-in `crypto`, `fs`, `os`, `path`\n */\n\nimport crypto from \"crypto\";\nimport fs from \"fs\";\nimport os from \"os\";\nimport path from \"path\";\n\n// ── Types ─────────────────────────────────────────────────────────────────────\n\nexport interface VaultData {\n  mnemonic: string;\n  createdAt: string;\n  version: number;\n}\n\ninterface EncryptedVault {\n  version: number; // format version for future migrations\n  salt: string; // hex — used for PBKDF2 key derivation\n  iv: string; // hex — AES-GCM initialisation vector\n  authTag: string; // hex — GCM authentication tag (detects tampering)\n  ciphertext: string; // hex — encrypted vault data\n}\n\n// ── Constants ─────────────────────────────────────────────────────────────────\n\nconst VAULT_VERSION = 1;\nconst PBKDF2_ITERATIONS = 210_000; // OWASP 2024 recommendation for PBKDF2-SHA512\nconst PBKDF2_DIGEST = \"sha512\";\nconst KEY_LENGTH = 32; // 256 bits for AES-256\nconst SALT_LENGTH = 32; // 256 bits\nconst IV_LENGTH = 16; // 128 bits for AES-GCM\nconst CIPHER = \"aes-256-gcm\";\n\n// ── Vault Path ────────────────────────────────────────────────────────────────\n\nexport function getWalletDir(): string {\n  // return path.join(__dirname, \".wallet\");\n  return path.join(os.homedir(), \".wallet\");\n}\n\nexport function getVaultPath(): string {\n  return path.join(getWalletDir(), \"vault.enc\");\n}\n\nexport function getConfigPath(): string {\n  return path.join(getWalletDir(), \"config.json\");\n}\n\nexport function getSessionsPath(): string {\n  return path.join(getWalletDir(), \"sessions.json\");\n}\n\nexport const SESSIONS_FILE = getSessionsPath();\n\nexport function ensureWalletDir(): void {\n  const dir = getWalletDir();\n  if (!fs.existsSync(dir)) {\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 }); // owner-only access\n  }\n}\n\nexport function vaultExists(): boolean {\n  return fs.existsSync(getVaultPath());\n}\n\n// ── Encryption ────────────────────────────────────────────────────────────────\n\n/**\n * Encrypt and save the vault to disk.\n * @param data   - vault contents (mnemonic + metadata)\n * @param password - user's wallet password\n */\nexport async function saveVault(\n  data: VaultData,\n  password: string,\n): Promise<void> {\n  ensureWalletDir();\n\n  const salt = crypto.randomBytes(SALT_LENGTH);\n  const iv = crypto.randomBytes(IV_LENGTH);\n  const key = await deriveKey(password, salt);\n\n  const plaintext = JSON.stringify(data);\n  const cipher = crypto.createCipheriv(CIPHER, key, iv);\n\n  const encrypted = Buffer.concat([\n    cipher.update(plaintext, \"utf8\"),\n    cipher.final(),\n  ]);\n\n  const authTag = cipher.getAuthTag();\n\n  const vault: EncryptedVault = {\n    version: VAULT_VERSION,\n    salt: salt.toString(\"hex\"),\n    iv: iv.toString(\"hex\"),\n    authTag: authTag.toString(\"hex\"),\n    ciphertext: encrypted.toString(\"hex\"),\n  };\n\n  fs.writeFileSync(getVaultPath(), JSON.stringify(vault, null, 2), {\n    mode: 0o600, // owner read/write only\n  });\n}\n\n/**\n * Load and decrypt the vault from disk.\n * Throws if the password is wrong or the file has been tampered with.\n */\nexport async function loadVault(password: string): Promise<VaultData> {\n  if (!vaultExists()) {\n    throw new Error(\"No vault found. Run `wallet init` to create one.\");\n  }\n\n  const raw = fs.readFileSync(getVaultPath(), \"utf8\");\n  const vault: EncryptedVault = JSON.parse(raw);\n\n  if (vault.version !== VAULT_VERSION) {\n    throw new Error(`Unsupported vault version: ${vault.version}`);\n  }\n\n  const salt = Buffer.from(vault.salt, \"hex\");\n  const iv = Buffer.from(vault.iv, \"hex\");\n  const authTag = Buffer.from(vault.authTag, \"hex\");\n  const ciphertext = Buffer.from(vault.ciphertext, \"hex\");\n\n  const key = await deriveKey(password, salt);\n\n  try {\n    const decipher = crypto.createDecipheriv(CIPHER, key, iv);\n    decipher.setAuthTag(authTag);\n\n    const decrypted = Buffer.concat([\n      decipher.update(ciphertext),\n      decipher.final(),\n    ]);\n\n    return JSON.parse(decrypted.toString(\"utf8\")) as VaultData;\n  } catch {\n    // GCM auth tag failure means wrong password OR tampered file\n    throw new Error(\"Decryption failed: wrong password or vault is corrupted.\");\n  }\n}\n\n/**\n * Change the vault password.\n * Decrypts with old password, re-encrypts with new password.\n */\nexport async function changePassword(\n  oldPassword: string,\n  newPassword: string,\n): Promise<void> {\n  const data = await loadVault(oldPassword);\n  await saveVault(data, newPassword);\n}\n\n// ── Internal ──────────────────────────────────────────────────────────────────\n\n/**\n * Derive a 256-bit AES key from a password using PBKDF2-SHA512.\n */\nfunction deriveKey(password: string, salt: Buffer): Promise<Buffer> {\n  return new Promise((resolve, reject) => {\n    crypto.pbkdf2(\n      password,\n      salt,\n      PBKDF2_ITERATIONS,\n      KEY_LENGTH,\n      PBKDF2_DIGEST,\n      (err, key) => {\n        if (err) reject(err);\n        else resolve(key);\n      },\n    );\n  });\n}\n"],"mappings":";;;AAeA,OAAO,YAAY;AACnB,OAAO,QAAQ;AACf,OAAO,QAAQ;AACf,OAAO,UAAU;AAoBjB,IAAM,gBAAgB;AACtB,IAAM,oBAAoB;AAC1B,IAAM,gBAAgB;AACtB,IAAM,aAAa;AACnB,IAAM,cAAc;AACpB,IAAM,YAAY;AAClB,IAAM,SAAS;AAIR,SAAS,eAAuB;AAErC,SAAO,KAAK,KAAK,GAAG,QAAQ,GAAG,SAAS;AAC1C;AAEO,SAAS,eAAuB;AACrC,SAAO,KAAK,KAAK,aAAa,GAAG,WAAW;AAC9C;AAEO,SAAS,gBAAwB;AACtC,SAAO,KAAK,KAAK,aAAa,GAAG,aAAa;AAChD;AAEO,SAAS,kBAA0B;AACxC,SAAO,KAAK,KAAK,aAAa,GAAG,eAAe;AAClD;AAEO,IAAM,gBAAgB,gBAAgB;AAEtC,SAAS,kBAAwB;AACtC,QAAM,MAAM,aAAa;AACzB,MAAI,CAAC,GAAG,WAAW,GAAG,GAAG;AACvB,OAAG,UAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,EACpD;AACF;AAEO,SAAS,cAAuB;AACrC,SAAO,GAAG,WAAW,aAAa,CAAC;AACrC;AASA,eAAsB,UACpB,MACA,UACe;AACf,kBAAgB;AAEhB,QAAM,OAAO,OAAO,YAAY,WAAW;AAC3C,QAAM,KAAK,OAAO,YAAY,SAAS;AACvC,QAAM,MAAM,MAAM,UAAU,UAAU,IAAI;AAE1C,QAAM,YAAY,KAAK,UAAU,IAAI;AACrC,QAAM,SAAS,OAAO,eAAe,QAAQ,KAAK,EAAE;AAEpD,QAAM,YAAY,OAAO,OAAO;AAAA,IAC9B,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACf,CAAC;AAED,QAAM,UAAU,OAAO,WAAW;AAElC,QAAM,QAAwB;AAAA,IAC5B,SAAS;AAAA,IACT,MAAM,KAAK,SAAS,KAAK;AAAA,IACzB,IAAI,GAAG,SAAS,KAAK;AAAA,IACrB,SAAS,QAAQ,SAAS,KAAK;AAAA,IAC/B,YAAY,UAAU,SAAS,KAAK;AAAA,EACtC;AAEA,KAAG,cAAc,aAAa,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG;AAAA,IAC/D,MAAM;AAAA;AAAA,EACR,CAAC;AACH;AAMA,eAAsB,UAAU,UAAsC;AACpE,MAAI,CAAC,YAAY,GAAG;AAClB,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AAEA,QAAM,MAAM,GAAG,aAAa,aAAa,GAAG,MAAM;AAClD,QAAM,QAAwB,KAAK,MAAM,GAAG;AAE5C,MAAI,MAAM,YAAY,eAAe;AACnC,UAAM,IAAI,MAAM,8BAA8B,MAAM,OAAO,EAAE;AAAA,EAC/D;AAEA,QAAM,OAAO,OAAO,KAAK,MAAM,MAAM,KAAK;AAC1C,QAAM,KAAK,OAAO,KAAK,MAAM,IAAI,KAAK;AACtC,QAAM,UAAU,OAAO,KAAK,MAAM,SAAS,KAAK;AAChD,QAAM,aAAa,OAAO,KAAK,MAAM,YAAY,KAAK;AAEtD,QAAM,MAAM,MAAM,UAAU,UAAU,IAAI;AAE1C,MAAI;AACF,UAAM,WAAW,OAAO,iBAAiB,QAAQ,KAAK,EAAE;AACxD,aAAS,WAAW,OAAO;AAE3B,UAAM,YAAY,OAAO,OAAO;AAAA,MAC9B,SAAS,OAAO,UAAU;AAAA,MAC1B,SAAS,MAAM;AAAA,IACjB,CAAC;AAED,WAAO,KAAK,MAAM,UAAU,SAAS,MAAM,CAAC;AAAA,EAC9C,QAAQ;AAEN,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACF;AAMA,eAAsB,eACpB,aACA,aACe;AACf,QAAM,OAAO,MAAM,UAAU,WAAW;AACxC,QAAM,UAAU,MAAM,WAAW;AACnC;AAOA,SAAS,UAAU,UAAkB,MAA+B;AAClE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAC,KAAK,QAAQ;AACZ,YAAI,IAAK,QAAO,GAAG;AAAA,YACd,SAAQ,GAAG;AAAA,MAClB;AAAA,IACF;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/vault/mnemonic.d.ts

@@ -0,0 +1,43 @@
+/**
+ *
+ * BIP-39 mnemonic generation, validation, and seed derivation.
+ * Supports 12-word (128-bit) and 24-word (256-bit) mnemonics.
+ *
+ * Dependencies: bip39
+ */
+type MnemonicStrength = 12 | 24;
+interface MnemonicResult {
+    mnemonic: string;
+    wordCount: 12 | 24;
+}
+/**
+ * Generate a new cryptographically random BIP-39 mnemonic.
+ * @param strength 128 for 12-word, 256 for 24-word (default: 128)
+ */
+declare function generateMnemonic(strength?: MnemonicStrength): MnemonicResult;
+/**
+ * Validate a BIP-39 mnemonic phrase.
+ * Checks both wordlist membership and BIP-39 checksum.
+ */
+declare function validateMnemonic(mnemonic: string): boolean;
+/**
+ * Derive a 64-byte seed buffer from a mnemonic.
+ * Optional passphrase adds extra security per BIP-39 spec.
+ * This seed is the root of ALL derived accounts.
+ */
+declare function mnemonicToSeed(mnemonic: string, passphrase?: string): Promise<Buffer>;
+/**
+ * Split mnemonic into a numbered word array.
+ * Used for backup verification display in the terminal UI.
+ *
+ * Example output:
+ * [ "1. witch", "2. collapse", "3. practice", ... ]
+ */
+declare function mnemonicToNumberedWords(mnemonic: string): string[];
+/**
+ * Reconstruct mnemonic from a word array.
+ * Used when user inputs words one by one during restore flow.
+ */
+declare function wordsToMnemonic(words: string[]): string;
+
+export { type MnemonicResult, type MnemonicStrength, generateMnemonic, mnemonicToNumberedWords, mnemonicToSeed, validateMnemonic, wordsToMnemonic };

package/dist/vault/mnemonic.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+
+// src/vault/mnemonic.ts
+import * as bip39 from "bip39";
+function generateMnemonic2(strength = 12) {
+  const mnemonic = bip39.generateMnemonic(strength == 12 ? 128 : 256);
+  const wordCount = strength;
+  return { mnemonic, wordCount };
+}
+function validateMnemonic2(mnemonic) {
+  const cleaned = cleanMnemonic(mnemonic);
+  return bip39.validateMnemonic(cleaned);
+}
+async function mnemonicToSeed2(mnemonic, passphrase = "") {
+  const cleaned = cleanMnemonic(mnemonic);
+  if (!validateMnemonic2(cleaned)) {
+    throw new Error("Invalid mnemonic: failed wordlist or checksum validation");
+  }
+  return bip39.mnemonicToSeed(cleaned, passphrase);
+}
+function mnemonicToNumberedWords(mnemonic) {
+  return cleanMnemonic(mnemonic).split(" ").map((word, i) => `${i + 1}. ${word}`);
+}
+function wordsToMnemonic(words) {
+  return words.map((w) => w.trim().toLowerCase()).join(" ");
+}
+function cleanMnemonic(mnemonic) {
+  return mnemonic.trim().toLowerCase().replace(/\s+/g, " ");
+}
+export {
+  generateMnemonic2 as generateMnemonic,
+  mnemonicToNumberedWords,
+  mnemonicToSeed2 as mnemonicToSeed,
+  validateMnemonic2 as validateMnemonic,
+  wordsToMnemonic
+};
+//# sourceMappingURL=mnemonic.js.map

package/dist/vault/mnemonic.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/vault/mnemonic.ts"],"sourcesContent":["/**\n *\n * BIP-39 mnemonic generation, validation, and seed derivation.\n * Supports 12-word (128-bit) and 24-word (256-bit) mnemonics.\n *\n * Dependencies: bip39\n */\n\nimport * as bip39 from \"bip39\";\n\nexport type MnemonicStrength = 12 | 24; // 128 = 12 words, 256 = 24 words\n\nexport interface MnemonicResult {\n  mnemonic: string;\n  wordCount: 12 | 24;\n}\n\n/**\n * Generate a new cryptographically random BIP-39 mnemonic.\n * @param strength 128 for 12-word, 256 for 24-word (default: 128)\n */\nexport function generateMnemonic(\n  strength: MnemonicStrength = 12,\n): MnemonicResult {\n  const mnemonic = bip39.generateMnemonic(strength == 12 ? 128 : 256);\n  const wordCount = strength;\n  return { mnemonic, wordCount };\n}\n\n/**\n * Validate a BIP-39 mnemonic phrase.\n * Checks both wordlist membership and BIP-39 checksum.\n */\nexport function validateMnemonic(mnemonic: string): boolean {\n  const cleaned = cleanMnemonic(mnemonic);\n  return bip39.validateMnemonic(cleaned);\n}\n\n/**\n * Derive a 64-byte seed buffer from a mnemonic.\n * Optional passphrase adds extra security per BIP-39 spec.\n * This seed is the root of ALL derived accounts.\n */\nexport async function mnemonicToSeed(\n  mnemonic: string,\n  passphrase: string = \"\",\n): Promise<Buffer> {\n  const cleaned = cleanMnemonic(mnemonic);\n\n  if (!validateMnemonic(cleaned)) {\n    throw new Error(\"Invalid mnemonic: failed wordlist or checksum validation\");\n  }\n\n  return bip39.mnemonicToSeed(cleaned, passphrase);\n}\n\n/**\n * Split mnemonic into a numbered word array.\n * Used for backup verification display in the terminal UI.\n *\n * Example output:\n * [ \"1. witch\", \"2. collapse\", \"3. practice\", ... ]\n */\nexport function mnemonicToNumberedWords(mnemonic: string): string[] {\n  return cleanMnemonic(mnemonic)\n    .split(\" \")\n    .map((word, i) => `${i + 1}. ${word}`);\n}\n\n/**\n * Reconstruct mnemonic from a word array.\n * Used when user inputs words one by one during restore flow.\n */\nexport function wordsToMnemonic(words: string[]): string {\n  return words.map((w) => w.trim().toLowerCase()).join(\" \");\n}\n\n// ── Internal ──────────────────────────────────────────────────────────────────\n\nfunction cleanMnemonic(mnemonic: string): string {\n  return mnemonic.trim().toLowerCase().replace(/\\s+/g, \" \");\n}\n"],"mappings":";;;AAQA,YAAY,WAAW;AAahB,SAASA,kBACd,WAA6B,IACb;AAChB,QAAM,WAAiB,uBAAiB,YAAY,KAAK,MAAM,GAAG;AAClE,QAAM,YAAY;AAClB,SAAO,EAAE,UAAU,UAAU;AAC/B;AAMO,SAASC,kBAAiB,UAA2B;AAC1D,QAAM,UAAU,cAAc,QAAQ;AACtC,SAAa,uBAAiB,OAAO;AACvC;AAOA,eAAsBC,gBACpB,UACA,aAAqB,IACJ;AACjB,QAAM,UAAU,cAAc,QAAQ;AAEtC,MAAI,CAACD,kBAAiB,OAAO,GAAG;AAC9B,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAEA,SAAa,qBAAe,SAAS,UAAU;AACjD;AASO,SAAS,wBAAwB,UAA4B;AAClE,SAAO,cAAc,QAAQ,EAC1B,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE;AACzC;AAMO,SAAS,gBAAgB,OAAyB;AACvD,SAAO,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,KAAK,GAAG;AAC1D;AAIA,SAAS,cAAc,UAA0B;AAC/C,SAAO,SAAS,KAAK,EAAE,YAAY,EAAE,QAAQ,QAAQ,GAAG;AAC1D;","names":["generateMnemonic","validateMnemonic","mnemonicToSeed"]}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@execra/core",
+  "version": "1.0.0",
+  "description": "Execra core — vault, HD key derivation, Solana RPC, and transaction pipeline",
+  "main": "dist/index.js",
+  "type": "module",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "build": "tsup",
+    "prepublishOnly": "pnpm build"
+  },
+  "files": [
+    "dist"
+  ],
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./handler/walletConnect": {
+      "types": "./dist/handler/walletConnect.d.ts",
+      "default": "./dist/handler/walletConnect.js"
+    }
+  },
+  "keywords": ["solana", "wallet", "crypto", "agent", "execra", "hd-wallet", "bip44"],
+  "author": "Execra",
+  "license": "MIT",
+  "dependencies": {
+    "@solana/web3.js": "^1.98.4",
+    "@walletconnect/sign-client": "^2.23.8",
+    "@walletconnect/utils": "^2.23.8",
+    "bip39": "^3.1.0",
+    "bs58": "^6.0.0",
+    "chalk": "^5.6.2",
+    "ed25519-hd-key": "^1.3.0",
+    "ink": "^6.8.0",
+    "react": "^19.2.4",
+    "tweetnacl": "^1.0.3",
+    "ws": "^8.19.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.4.0",
+    "@types/react": "^19.2.14",
+    "@types/ws": "^8.18.1",
+    "tsup": "^8.5.1"
+  }
+}