@majikah/majik-key 0.2.12 → 0.2.14

package/dist/core/types.d.ts

@@ -1,44 +1,135 @@
 import { MnemonicLanguage } from "./crypto/wordlist";
+/** ISO 8601 timestamp string, e.g. `"2026-07-11T00:00:00.000Z"`. */
 export type ISODateString = string;
 export type MajikMessageAccountID = string;
 export type MajikMessagePublicKey = string;
 export type MajikMessageChatID = string;
+/** Base64-encoded public key material. Safe to store, log, or transmit. */
+export type MajikKeyAddress = string;
+/** Base64-encoded SHA-256 digest of a MajikKey's X25519 public key. Doubles as the account `id`. */
+export type MajikKeyFingerprint = string;
+/**
+ * Safe, serializable snapshot of a MajikKey — what `toJSON()` / `toString()` produce.
+ *
+ * Every `encrypted*` field is an AES-256-GCM ciphertext (IV + ciphertext,
+ * base64-encoded) protected by a passphrase-derived Argon2id key (or legacy
+ * PBKDF2, see `kdfVersion`). None of these fields ever contain raw private
+ * key material — this shape is safe to persist in a database, localStorage,
+ * or anywhere else at rest.
+ *
+ * Load one of these back into a live instance with `MajikKey.fromJSON()`.
+ */
 export interface MajikKeyJSON {
+    /** Account identifier. Equal to `fingerprint` for accounts created by this library. */
     id: string;
+    /** Human-readable, user-editable account name. */
     label: string;
-    publicKey: string;
-    fingerprint: string;
+    /** X25519 public key, base64. */
+    publicKey: MajikKeyAddress;
+    /** SHA-256 fingerprint of `publicKey`. Stable identity anchor for the account. */
+    fingerprint: MajikKeyFingerprint;
+    /** AES-256-GCM-encrypted X25519 private key (IV + ciphertext), base64. Requires the passphrase to decrypt. */
     encryptedPrivateKey: string;
+    /** Random salt used to derive the passphrase-based encryption key. Shared across all key types on this account. */
     salt: string;
+    /**
+     * Encrypted, mnemonic-verification blob (base64 JSON). Decryptable only with
+     * the original mnemonic — used internally to verify a supplied mnemonic
+     * before `importFromMnemonicBackup()` re-derives the full identity. Not a
+     * general-purpose backup of the private key.
+     */
     backup: string;
+    /** Account creation time, ISO 8601. */
     timestamp: string;
+    /** KDF used for every `encrypted*` field on this account: `1` = legacy PBKDF2 (read-only), `2` = Argon2id (current). Defaults to `1` if omitted. */
     kdfVersion?: number;
+    /** ML-KEM-768 (FIPS-203) public key, base64. Post-quantum key encapsulation. */
     mlKemPublicKey?: string;
+    /** AES-256-GCM-encrypted ML-KEM-768 secret key, base64. */
     encryptedMlKemSecretKey?: string;
+    /** Ed25519 public key, base64. Classical signing — same keypair the X25519 identity key is converted from. */
     edPublicKey?: string;
+    /** AES-256-GCM-encrypted Ed25519 secret key, base64. */
     encryptedEdSecretKey?: string;
+    /** ML-DSA-87 (FIPS-204) public key, base64. Post-quantum signing. */
     mlDsaPublicKey?: string;
+    /** AES-256-GCM-encrypted ML-DSA-87 secret key, base64. */
     encryptedMlDsaSecretKey?: string;
+    /** @experimental secp256k1 Bitcoin public key, base64. Domain-separated BIP-32/84 derivation by default — see `MajikKeyBitcoinNamespace`. */
+    btcPublicKey?: string;
+    /** @experimental AES-256-GCM-encrypted Bitcoin private key, base64. */
+    encryptedBtcSecretKey?: string;
+    /** BIP-39 wordlist language the original mnemonic was generated/validated against. Defaults to `"en"`. */
     mnemonicLanguage?: MnemonicLanguage;
 }
+/**
+ * ⚠️ DANGEROUS. Every field below is a *raw, unencrypted* private key,
+ * base64-encoded — no passphrase, no KDF, no AES-GCM. Anyone with this
+ * object has full control of the account.
+ *
+ * Intended for one narrow use case: injecting a pre-unlocked signing key
+ * into a server process at boot (e.g. loaded from a secrets manager). Never
+ * log, store in a database, send over the network, or write to disk outside
+ * of a secrets manager.
+ *
+ * Produced by `toDangerousJSON()`, consumed by `MajikKey.fromDangerousJSON()`.
+ */
 export interface MajikKeyDangerousJSON extends MajikKeyJSON {
+    /** ⚠️ Raw X25519 private key, base64. Unencrypted. */
     privateKeyBase64: string;
+    /** ⚠️ Raw ML-KEM-768 secret key, base64. Unencrypted. */
     mlKemSecretKeyBase64: string;
+    /** ⚠️ Raw Ed25519 secret key, base64. Unencrypted. */
     edSecretKeyBase64: string;
+    /** ⚠️ Raw ML-DSA-87 secret key, base64. Unencrypted. */
     mlDsaSecretKeyBase64: string;
+    /** @experimental ⚠️ Raw Bitcoin private key, base64. Unencrypted. */
+    btcSecretKeyBase64?: string;
 }
+/**
+ * Lightweight, non-secret summary of a MajikKey — useful for account
+ * pickers, dashboards, or anywhere you want to display account state
+ * without touching encrypted key material. Contains no key bytes at all
+ * (not even encrypted ones), so it's cheaper to pass around than `MajikKeyJSON`.
+ *
+ * Get one via the `metadata` getter on a live `MajikKey` instance.
+ */
 export interface MajikKeyMetadata {
     id: string;
-    fingerprint: string;
+    fingerprint: MajikKeyFingerprint;
     label: string;
     timestamp: Date;
+    /** `true` if private key material is currently purged from memory (i.e. `lock()` was called, or it hasn't been `unlock()`ed yet). */
     isLocked: boolean;
+    /** `1` = legacy PBKDF2, `2` = Argon2id. See `MajikKeyJSON.kdfVersion`. */
     kdfVersion: number;
+    /** `true` if this account has ML-KEM-768 keys (i.e. is post-quantum-encryption capable). `false` means it's a legacy account pending migration. */
     hasMlKem: boolean;
+    /** @experimental Presence flags for optional Web3 key material. */
+    web3: {
+        /** @experimental `true` if this account has a stored Bitcoin keypair. */
+        hasBitcoin?: boolean;
+        /** @experimental `true` if this account can derive a Solana keypair (i.e. has an Ed25519 signing key and is unlocked). */
+        hasSolana?: boolean;
+    };
     mnemonicLanguage?: MnemonicLanguage;
 }
+/**
+ * Portable seed export — the format behind `toMnemonicJSON()` /
+ * `MajikKey.fromMnemonicJSON()`.
+ *
+ * ⚠️ Unlike `MajikKeyJSON`, this is **not an encrypted-at-rest format**.
+ * `seed` is the raw mnemonic, split into words, in plaintext. If a
+ * passphrase is included, it's plaintext too. Treat any `MnemonicJSON`
+ * exactly like the mnemonic itself — fine for a one-time, protected
+ * transport (e.g. into an encrypted file you control), not for long-term
+ * storage. Use `MajikKeyJSON` / `toJSON()` for anything persisted at rest.
+ */
 export interface MnemonicJSON {
+    /** Raw mnemonic, split into individual words. ⚠️ Plaintext — this *is* the recovery phrase. */
     seed: string[];
+    /** The account's encrypted backup blob (`MajikKeyJSON.backup`), carried along so this object alone is enough to call `importFromMnemonicBackup()`. */
     id: string;
+    /** Optional passphrase, carried in plaintext for convenience during export/import. ⚠️ Not encrypted. */
     phrase?: string;
 }

package/dist/core/web3/bitcoin/bitcoin.d.ts

@@ -0,0 +1,71 @@
+/**
+ * bitcoin.ts
+ *
+ * ⚠️ EXPERIMENTAL — Bitcoin keypair utilities for MajikKey.
+ * This module's API may change or be removed without notice in a minor version.
+ *
+ * Design:
+ *   - Real BIP-32/BIP-84 HD derivation directly off the raw 64-byte BIP-39
+ *     seed — NOT a hash-based domain separation like Solana. This matters:
+ *     BIP-32's tree structure lets us get privacy AND portability from the
+ *     exact same standard, auditable derivation, just by choosing the path:
+ *
+ *       MAJIK_BITCOIN_DOMAIN_PATH   (default) — effectively private to Majik;
+ *         not the path any generic wallet would derive by default.
+ *       MAJIK_BITCOIN_STANDARD_PATH (opt-in)  — the REAL BIP-84 mainnet path;
+ *         recoverable in any standard wallet using nothing but the mnemonic.
+ *
+ *   - `privateKey` is the raw 32-byte secp256k1 scalar. `toWIF()` encodes it
+ *     into Wallet Import Format — the universal paste-in-import string every
+ *     Bitcoin wallet accepts (base58check, versioned, deterministic).
+ *   - `@scure/btc-signer` is NOT a hard dependency. It is lazily `import()`-ed
+ *     only for bech32 address encoding / PSBT construction. If it isn't
+ *     installed, we throw a clear, actionable MajikKeyError instead of
+ *     failing module load.
+ */
+export interface BitcoinKeypairMaterial {
+    /** 32-byte secp256k1 private key. */
+    privateKey: Uint8Array;
+    /** 33-byte compressed secp256k1 public key. */
+    publicKey: Uint8Array;
+}
+export interface BitcoinDerivationOptions {
+    /**
+     * If true, derive the REAL BIP-84 mainnet path (SLIP-44 coin type 0) —
+     * the address any standard wallet would show for this mnemonic.
+     * Defaults to false (Majik's domain-separated path).
+     */
+    standard?: boolean;
+    /** Explicit derivation path — overrides `standard` if provided. */
+    path?: string;
+}
+/**
+ * Derive a Bitcoin keypair via standard BIP-32/BIP-84 from the raw 64-byte
+ * BIP-39 seed. Call this once at account creation/import time (mirrors
+ * ML-KEM/Ed25519/ML-DSA derivation) — the seed itself is never stored, only
+ * the resulting key, encrypted at rest like the others.
+ */
+export declare function deriveBitcoinKeypairFromSeed(seed: Uint8Array, options?: BitcoinDerivationOptions): BitcoinKeypairMaterial;
+/**
+ * Re-derive the public key from a raw private key. Used when unlocking —
+ * we only encrypt/store the private key, so the public key is recomputed
+ * on unlock rather than stored redundantly encrypted.
+ */
+export declare function bitcoinPublicKeyFromPrivateKey(privateKey: Uint8Array): Uint8Array;
+/** Sign a 32-byte message hash (already hashed — e.g. a Bitcoin sighash). */
+export declare function signWithBitcoinMaterial(material: BitcoinKeypairMaterial, messageHash: Uint8Array, scheme?: "ecdsa" | "schnorr"): Uint8Array;
+/**
+ * Encode a private key as WIF — the universal paste-in-import string every
+ * Bitcoin wallet accepts. Deterministic: same private key → same WIF, always.
+ */
+export declare function toWIF(material: BitcoinKeypairMaterial, options?: {
+    compressed?: boolean;
+}): string;
+type BtcSignerModule = typeof import("@scure/btc-signer");
+export declare function loadBtcSigner(): Promise<BtcSignerModule>;
+/**
+ * Native SegWit (bech32, "bc1...") mainnet address for this material's
+ * public key. Requires @scure/btc-signer — see loadBtcSigner().
+ */
+export declare function toBitcoinAddress(material: BitcoinKeypairMaterial): Promise<string>;
+export {};

package/dist/core/web3/bitcoin/bitcoin.js

@@ -0,0 +1,126 @@
+/**
+ * bitcoin.ts
+ *
+ * ⚠️ EXPERIMENTAL — Bitcoin keypair utilities for MajikKey.
+ * This module's API may change or be removed without notice in a minor version.
+ *
+ * Design:
+ *   - Real BIP-32/BIP-84 HD derivation directly off the raw 64-byte BIP-39
+ *     seed — NOT a hash-based domain separation like Solana. This matters:
+ *     BIP-32's tree structure lets us get privacy AND portability from the
+ *     exact same standard, auditable derivation, just by choosing the path:
+ *
+ *       MAJIK_BITCOIN_DOMAIN_PATH   (default) — effectively private to Majik;
+ *         not the path any generic wallet would derive by default.
+ *       MAJIK_BITCOIN_STANDARD_PATH (opt-in)  — the REAL BIP-84 mainnet path;
+ *         recoverable in any standard wallet using nothing but the mnemonic.
+ *
+ *   - `privateKey` is the raw 32-byte secp256k1 scalar. `toWIF()` encodes it
+ *     into Wallet Import Format — the universal paste-in-import string every
+ *     Bitcoin wallet accepts (base58check, versioned, deterministic).
+ *   - `@scure/btc-signer` is NOT a hard dependency. It is lazily `import()`-ed
+ *     only for bech32 address encoding / PSBT construction. If it isn't
+ *     installed, we throw a clear, actionable MajikKeyError instead of
+ *     failing module load.
+ */
+import { HDKey } from "@scure/bip32";
+import { schnorr, secp256k1 } from "@noble/curves/secp256k1.js";
+import { MAJIK_BITCOIN_STANDARD_PATH, MAJIK_BITCOIN_DOMAIN_PATH, } from "./constants";
+import { hash } from "@stablelib/sha256";
+import { base58Encode } from "../utils";
+import { MajikKeyError } from "../../error";
+import { randomBytes } from "@noble/hashes/utils.js";
+// ─── Derivation ─────────────────────────────────────────────────────────────
+/**
+ * Derive a Bitcoin keypair via standard BIP-32/BIP-84 from the raw 64-byte
+ * BIP-39 seed. Call this once at account creation/import time (mirrors
+ * ML-KEM/Ed25519/ML-DSA derivation) — the seed itself is never stored, only
+ * the resulting key, encrypted at rest like the others.
+ */
+export function deriveBitcoinKeypairFromSeed(seed, options) {
+    const path = options?.path ??
+        (options?.standard
+            ? MAJIK_BITCOIN_STANDARD_PATH
+            : MAJIK_BITCOIN_DOMAIN_PATH);
+    const child = HDKey.fromMasterSeed(seed).derive(path);
+    if (!child.privateKey || !child.publicKey) {
+        throw new MajikKeyError("Failed to derive Bitcoin keypair from seed");
+    }
+    return {
+        privateKey: child.privateKey,
+        publicKey: child.publicKey,
+    };
+}
+/**
+ * Re-derive the public key from a raw private key. Used when unlocking —
+ * we only encrypt/store the private key, so the public key is recomputed
+ * on unlock rather than stored redundantly encrypted.
+ */
+export function bitcoinPublicKeyFromPrivateKey(privateKey) {
+    return secp256k1.getPublicKey(privateKey, true); // compressed
+}
+/** Sign a 32-byte message hash (already hashed — e.g. a Bitcoin sighash). */
+export function signWithBitcoinMaterial(material, messageHash, scheme = "ecdsa") {
+    if (scheme === "schnorr") {
+        return schnorr.sign(messageHash, material.privateKey, randomBytes(32));
+    }
+    const signature = secp256k1.sign(messageHash, material.privateKey, {
+        prehash: false,
+        lowS: true, // Note: lowS is technically default in v2 for secp256k1, but it's good practice to be explicit!
+    });
+    return signature;
+}
+// ─── WIF export (Wallet Import Format) — no external lib needed ────────────
+const WIF_VERSION_MAINNET = 0x80;
+function doubleSha256(data) {
+    return hash(hash(data));
+}
+function base58checkEncode(payload) {
+    const checksum = doubleSha256(payload).slice(0, 4);
+    const full = new Uint8Array(payload.length + 4);
+    full.set(payload, 0);
+    full.set(checksum, payload.length);
+    return base58Encode(full);
+}
+/**
+ * Encode a private key as WIF — the universal paste-in-import string every
+ * Bitcoin wallet accepts. Deterministic: same private key → same WIF, always.
+ */
+export function toWIF(material, options) {
+    const compressed = options?.compressed ?? true;
+    const payload = new Uint8Array(compressed ? 34 : 33);
+    payload[0] = WIF_VERSION_MAINNET;
+    payload.set(material.privateKey, 1);
+    if (compressed)
+        payload[33] = 0x01;
+    return base58checkEncode(payload);
+}
+let _btcModule = null;
+export async function loadBtcSigner() {
+    if (_btcModule)
+        return _btcModule;
+    try {
+        _btcModule = (await import(
+        /* webpackIgnore: true */
+        /* @vite-ignore */
+        "@scure/btc-signer"));
+        return _btcModule;
+    }
+    catch (err) {
+        throw new MajikKeyError("@scure/btc-signer is required for this operation but is not installed. " +
+            "Install it in your project with `npm install @scure/btc-signer` " +
+            "(or the yarn/pnpm equivalent) and try again.", err);
+    }
+}
+/**
+ * Native SegWit (bech32, "bc1...") mainnet address for this material's
+ * public key. Requires @scure/btc-signer — see loadBtcSigner().
+ */
+export async function toBitcoinAddress(material) {
+    const btc = await loadBtcSigner();
+    const p2wpkh = btc.p2wpkh(material.publicKey);
+    if (!p2wpkh.address) {
+        throw new MajikKeyError("Failed to derive Bitcoin address");
+    }
+    return p2wpkh.address;
+}

package/dist/core/web3/bitcoin/constants.d.ts

@@ -0,0 +1,2 @@
+export declare const MAJIK_BITCOIN_STANDARD_PATH = "m/84'/0'/0'/0/0";
+export declare const MAJIK_BITCOIN_DOMAIN_PATH = "m/84'/1989'/0'/0/0";

package/dist/core/web3/bitcoin/constants.js

@@ -0,0 +1,7 @@
+// SLIP-44 coin type 0 = Bitcoin mainnet — the path any standard wallet
+// (Electrum, Sparrow, hardware wallets) derives by default from this mnemonic.
+export const MAJIK_BITCOIN_STANDARD_PATH = "m/84'/0'/0'/0/0";
+// Unregistered/private coin-type index — domain-separates Majik's default
+// Bitcoin key from a user's "real" BTC wallet, while remaining 100% standard
+// BIP-32 math (just a different branch of the same tree).
+export const MAJIK_BITCOIN_DOMAIN_PATH = "m/84'/1989'/0'/0/0";

package/dist/core/web3/bitcoin/types.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @experimental By default this is Majik's DOMAIN-SEPARATED Bitcoin key
+ * (derived via `MAJIK_BITCOIN_DOMAIN_PATH`) — deterministic and fully
+ * standard BIP-32, but not the path a generic wallet would derive by
+ * default, so it stays effectively private to Majik. Use
+ * `MajikKey.getBitcoinKeypairMaterial({ standard: true })` /
+ * `getBitcoinWIF({ standard: true })` for the REAL BIP-84 mainnet key —
+ * recoverable in any standard wallet from the same mnemonic alone.
+ */
+export interface MajikKeyBitcoinNamespace {
+    /** 33-byte compressed secp256k1 public key. */
+    readonly publicKey: Uint8Array;
+    /** 32-byte secp256k1 private key. Handle with the same care as any private key. */
+    readonly privateKey: Uint8Array;
+    /** Native SegWit (bech32) address. Lazily loads @scure/btc-signer — throws if not installed. */
+    getBitcoinAddress(): Promise<string>;
+    /** WIF string — pastes directly into any standard Bitcoin wallet. */
+    getWIF(options?: {
+        compressed?: boolean;
+    }): string;
+    /** Sign a 32-byte message hash. ECDSA (default) or Schnorr. */
+    sign(messageHash: Uint8Array, scheme?: "ecdsa" | "schnorr"): Uint8Array;
+}

package/dist/core/web3/bitcoin/types.js

@@ -0,0 +1 @@
+export {};

package/dist/core/web3/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./bitcoin/bitcoin";
+export * from "./solana/solana";
+export type * from "./types";
+export type * from "./bitcoin/types";
+export type * from "./solana/types";

package/dist/core/web3/index.js

@@ -0,0 +1,2 @@
+export * from "./bitcoin/bitcoin";
+export * from "./solana/solana";

package/dist/core/web3/{solana.d.ts → solana/solana.d.ts}

@@ -49,7 +49,6 @@ export declare function deriveSolanaKeypairFromEdSecretKey(edSecretKey: Uint8Arr
  * identical key on both.
  */
 export declare function solanaMaterialFromEd25519SecretKey(edSecretKey: Uint8Array): SolanaKeypairMaterial;
-export declare function base58Encode(bytes: Uint8Array): string;
 /**
  * Solana address for a given Solana/Ed25519 public key — just its base58
  * encoding. Does NOT require @solana/web3.js.

package/dist/core/web3/{solana.js → solana/solana.js}

@@ -28,7 +28,8 @@
 import * as ed25519 from "@stablelib/ed25519";
 import { hash } from "@stablelib/sha256";
 import { MAJIK_SOLANA_SEED } from "./constants";
-import { MajikKeyError } from "../error";
+import { MajikKeyError } from "../../error";
+import { base58Encode } from "../utils";
 const ED25519_SECRET_KEY_LENGTH = 64;
 const ED25519_SEED_LENGTH = 32;
 // ─── Derivation ─────────────────────────────────────────────────────────────
@@ -70,33 +71,6 @@ export function solanaMaterialFromEd25519SecretKey(edSecretKey) {
         secretKey: edSecretKey.slice(),
     };
 }
-// ─── Base58 (Solana address encoding) — no external dependency ─────────────
-const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
-export function base58Encode(bytes) {
-    if (bytes.length === 0)
-        return "";
-    const digits = [0];
-    for (let i = 0; i < bytes.length; i++) {
-        let carry = bytes[i];
-        for (let j = 0; j < digits.length; j++) {
-            carry += digits[j] << 8;
-            digits[j] = carry % 58;
-            carry = (carry / 58) | 0;
-        }
-        while (carry > 0) {
-            digits.push(carry % 58);
-            carry = (carry / 58) | 0;
-        }
-    }
-    let leadingZeros = 0;
-    for (let i = 0; i < bytes.length && bytes[i] === 0; i++)
-        leadingZeros++;
-    let result = "1".repeat(leadingZeros);
-    for (let i = digits.length - 1; i >= 0; i--) {
-        result += BASE58_ALPHABET[digits[i]];
-    }
-    return result;
-}
 /**
  * Solana address for a given Solana/Ed25519 public key — just its base58
  * encoding. Does NOT require @solana/web3.js.

package/dist/core/web3/solana/types.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @experimental Web3 / blockchain integrations are experimental. This
+ * namespace's shape may change without a major version bump.
+ */
+export interface MajikKeySolanaNamespace {
+    /** 32-byte Solana/Ed25519 public key. */
+    readonly publicKey: Uint8Array;
+    /** 64-byte nacl-format secret key. Handle with the same care as any private key. */
+    readonly secretKey: Uint8Array;
+    /** Base58 Solana address — does not require @solana/kit. */
+    readonly address: string;
+    /** Real @solana/kit Keypair. Lazily loads @solana/kit — throws if not installed. */
+    getSolanaKeypair(): Promise<any>;
+    /** Real @solana/kit PublicKey. Lazily loads @solana/kit — throws if not installed. */
+    getSolanaAddress(): Promise<any>;
+    /** Sign a message with this Solana keypair's Ed25519 key. No web3.js needed. */
+    sign(message: Uint8Array): Uint8Array;
+}

package/dist/core/web3/solana/types.js

@@ -0,0 +1 @@
+export {};

package/dist/core/web3/types.d.ts

@@ -1,26 +1,7 @@
-/**
- * @experimental Web3 / blockchain integrations are experimental. This
- * namespace's shape may change without a major version bump.
- */
-export interface MajikKeySolanaNamespace {
-    /** 32-byte Solana/Ed25519 public key. */
-    readonly publicKey: Uint8Array;
-    /** 64-byte nacl-format secret key. Handle with the same care as any private key. */
-    readonly secretKey: Uint8Array;
-    /** Base58 Solana address — does not require @solana/kit. */
-    readonly address: string;
-    /** Real @solana/kit Keypair. Lazily loads @solana/kit — throws if not installed. */
-    getSolanaKeypair(): Promise<any>;
-    /** Real @solana/kit PublicKey. Lazily loads @solana/kit — throws if not installed. */
-    getSolanaAddress(): Promise<any>;
-    /** Sign a message with this Solana keypair's Ed25519 key. No web3.js needed. */
-    sign(message: Uint8Array): Uint8Array;
-}
-/** @experimental */
-export interface MajikKeyWeb3Namespace {
-    readonly solana: MajikKeySolanaNamespace;
-}
+import { MajikKeyBitcoinNamespace } from "./bitcoin/types";
+import { MajikKeySolanaNamespace } from "./solana/types";
 /** @experimental */
 export interface MajikKeyWeb3Namespace {
     readonly solana: MajikKeySolanaNamespace;
+    readonly bitcoin?: MajikKeyBitcoinNamespace;
 }

package/dist/core/web3/utils.d.ts

@@ -0,0 +1 @@
+export declare function base58Encode(bytes: Uint8Array): string;

package/dist/core/web3/utils.js

@@ -0,0 +1,27 @@
+// ─── Base58 (Solana address encoding) — no external dependency ─────────────
+const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+export function base58Encode(bytes) {
+    if (bytes.length === 0)
+        return "";
+    const digits = [0];
+    for (let i = 0; i < bytes.length; i++) {
+        let carry = bytes[i];
+        for (let j = 0; j < digits.length; j++) {
+            carry += digits[j] << 8;
+            digits[j] = carry % 58;
+            carry = (carry / 58) | 0;
+        }
+        while (carry > 0) {
+            digits.push(carry % 58);
+            carry = (carry / 58) | 0;
+        }
+    }
+    let leadingZeros = 0;
+    for (let i = 0; i < bytes.length && bytes[i] === 0; i++)
+        leadingZeros++;
+    let result = "1".repeat(leadingZeros);
+    for (let i = digits.length - 1; i >= 0; i--) {
+        result += BASE58_ALPHABET[digits[i]];
+    }
+    return result;
+}

package/dist/index.d.ts

@@ -2,3 +2,4 @@ export * from "./majik-key";
 export type * from "./core/types";
 export * from "./core/error";
 export * from "./core/validator";
+export * from "./core/web3";

package/dist/index.js

@@ -1,3 +1,4 @@
 export * from "./majik-key";
 export * from "./core/error";
 export * from "./core/validator";
+export * from "./core/web3";