@prosopo/keyring 2.9.0 → 2.9.34

package/src/keyring/testingPairs.ts

@@ -0,0 +1,61 @@
+// Copyright 2017-2025 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import type { KeyringOptions, KeyringPair } from "@prosopo/types";
+import type { KeypairType } from "@prosopo/util-crypto";
+
+import { nobody } from "../pair/nobody.js";
+import { createTestKeyring } from "./testing.js";
+
+export interface TestKeyringMap {
+	nobody: KeyringPair;
+
+	[index: string]: KeyringPair;
+}
+
+export interface TestKeyringMapSubstrate extends TestKeyringMap {
+	alice: KeyringPair;
+	bob: KeyringPair;
+	charlie: KeyringPair;
+	dave: KeyringPair;
+	eve: KeyringPair;
+	ferdie: KeyringPair;
+}
+
+export interface TestKeyringMapEthereum extends TestKeyringMap {
+	Alith: KeyringPair;
+	Baltathar: KeyringPair;
+	Charleth: KeyringPair;
+	Dorothy: KeyringPair;
+	Ethan: KeyringPair;
+	Faith: KeyringPair;
+}
+
+export type DetectMap<O extends KeyringOptions | undefined> =
+	DetectPairType<O> extends "ethereum"
+		? TestKeyringMapEthereum
+		: TestKeyringMapSubstrate;
+
+export type DetectPairType<O extends KeyringOptions | undefined> =
+	O extends KeyringOptions
+		? O["type"] extends KeypairType
+			? O["type"]
+			: "sr25519"
+		: "sr25519";
+
+export function createTestPairs<O extends KeyringOptions, M = DetectMap<O>>(
+	options?: O,
+	isDerived = true,
+): M {
+	const keyring = createTestKeyring(options, isDerived);
+	const pairs = keyring.getPairs();
+	const map: TestKeyringMap = { nobody: nobody() };
+
+	for (const p of pairs) {
+		if (p.meta.name) {
+			map[p.meta.name] = p;
+		}
+	}
+
+	return map as M;
+}

package/src/pair/decode.spec.ts

@@ -0,0 +1,23 @@
+// Copyright 2017-2025 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, expect, it } from "vitest";
+import { createTestPairs } from "../keyring/testingPairs.js";
+
+const keyring = createTestPairs({ type: "sr25519" }, false);
+
+describe("decode", (): void => {
+	it("fails when no data provided", (): void => {
+		expect((): void => keyring.alice.decodePkcs8()).toThrow(
+			/(No encrypted data available|Password required)/,
+		);
+	});
+
+	it("returns correct publicKey from encoded", (): void => {
+		const PASS = "testing";
+
+		expect((): void =>
+			keyring.alice.decodePkcs8(PASS, keyring.alice.encodePkcs8(PASS)),
+		).not.toThrow();
+	});
+});

package/src/pair/decode.ts

@@ -0,0 +1,65 @@
+// Copyright 2017-2025 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import type { EncryptedJsonEncoding } from "@polkadot/util-crypto/types";
+
+import { u8aEq } from "@polkadot/util";
+import { jsonDecryptData } from "@prosopo/util-crypto";
+
+import {
+	PAIR_DIV,
+	PAIR_HDR,
+	PUB_LENGTH,
+	SEC_LENGTH,
+	SEED_LENGTH,
+} from "./defaults.js";
+
+const SEED_OFFSET = PAIR_HDR.length;
+
+/**
+ * Decode a pair, taking into account the generation-specific formats and headers
+ *
+ * For divisor/headers, don't rely on the magic being static. These will
+ * change between generations, aka with the long-awaited 4th generation
+ * of the format. The external decode interface is the only way to use and decode these.
+ **/
+export function decodePair(
+	passphrase?: string,
+	encrypted?: Uint8Array | null,
+	_encType?: EncryptedJsonEncoding | EncryptedJsonEncoding[],
+): { publicKey: Uint8Array; secretKey: Uint8Array } {
+	const encType =
+		Array.isArray(_encType) || _encType === undefined ? _encType : [_encType];
+	const decrypted = jsonDecryptData(encrypted, passphrase, encType);
+	const header = decrypted.subarray(0, PAIR_HDR.length);
+
+	// check the start header (generations 1-3)
+	if (!u8aEq(header, PAIR_HDR)) {
+		throw new Error("Invalid encoding header found in body");
+	}
+
+	// setup for generation 3 format
+	let secretKey = decrypted.subarray(SEED_OFFSET, SEED_OFFSET + SEC_LENGTH);
+	let divOffset = SEED_OFFSET + SEC_LENGTH;
+	let divider = decrypted.subarray(divOffset, divOffset + PAIR_DIV.length);
+
+	// old-style (generation 1 & 2), we have the seed here
+	if (!u8aEq(divider, PAIR_DIV)) {
+		divOffset = SEED_OFFSET + SEED_LENGTH;
+		secretKey = decrypted.subarray(SEED_OFFSET, divOffset);
+		divider = decrypted.subarray(divOffset, divOffset + PAIR_DIV.length);
+
+		// check the divisior at this point (already checked for generation 3)
+		if (!u8aEq(divider, PAIR_DIV)) {
+			throw new Error("Invalid encoding divider found in body");
+		}
+	}
+
+	const pubOffset = divOffset + PAIR_DIV.length;
+	const publicKey = decrypted.subarray(pubOffset, pubOffset + PUB_LENGTH);
+
+	return {
+		publicKey,
+		secretKey,
+	};
+}

package/src/pair/defaults.ts

@@ -0,0 +1,22 @@
+// Copyright 2017-2025 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/** public/secret section divider (generation 1-3, will change in 4, don't rely on value) */
+export const PAIR_DIV = new Uint8Array([161, 35, 3, 33, 0]);
+
+/** public/secret start block (generation 1-3, will change in 4, don't rely on value) */
+export const PAIR_HDR = new Uint8Array([
+	48, 83, 2, 1, 1, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32,
+]);
+
+/** length of a public key */
+export const PUB_LENGTH = 32;
+
+/** length of a salt */
+export const SALT_LENGTH = 32;
+
+/** length of a secret key */
+export const SEC_LENGTH = 64;
+
+/** length of a user-input seed */
+export const SEED_LENGTH = 32;

package/src/pair/encode.spec.ts

@@ -0,0 +1,24 @@
+// Copyright 2017-2025 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import { NONCE_LENGTH, SCRYPT_LENGTH } from "@prosopo/util-crypto";
+import { describe, expect, it } from "vitest";
+
+import { createTestPairs } from "../keyring/testingPairs.js";
+import { PAIR_DIV, PAIR_HDR, PUB_LENGTH, SEC_LENGTH } from "./defaults.js";
+
+const DECODED_LENGTH =
+	PAIR_DIV.length + PAIR_HDR.length + PUB_LENGTH + SEC_LENGTH;
+const ENCODED_LENGTH = 16 + DECODED_LENGTH + NONCE_LENGTH + SCRYPT_LENGTH;
+
+const keyring = createTestPairs({ type: "sr25519" }, false);
+
+describe("encode", (): void => {
+	it("returns PKCS8 when no passphrase supplied", (): void => {
+		expect(keyring.alice.encodePkcs8()).toHaveLength(DECODED_LENGTH);
+	});
+
+	it("returns encoded PKCS8 when passphrase supplied", (): void => {
+		expect(keyring.alice.encodePkcs8("testing")).toHaveLength(ENCODED_LENGTH);
+	});
+});

package/src/pair/encode.ts

@@ -0,0 +1,32 @@
+// Copyright 2017-2025 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import { u8aConcat } from "@polkadot/util";
+import type { PairInfo } from "@prosopo/types";
+import { naclEncrypt, scryptEncode, scryptToU8a } from "@prosopo/util-crypto";
+
+import { PAIR_DIV, PAIR_HDR } from "./defaults.js";
+
+/**
+ * Encode a pair with the latest generation format (generation 3)
+ **/
+export function encodePair(
+	{ publicKey, secretKey }: PairInfo,
+	passphrase?: string,
+): Uint8Array {
+	if (!secretKey) {
+		throw new Error("Expected a valid secretKey to be passed to encode");
+	}
+
+	const encoded = u8aConcat(PAIR_HDR, secretKey, PAIR_DIV, publicKey);
+
+	if (!passphrase) {
+		return encoded;
+	}
+
+	// this is only for generation 3 (previous generations are only handled in decoding)
+	const { params, password, salt } = scryptEncode(passphrase);
+	const { encrypted, nonce } = naclEncrypt(encoded, password.subarray(0, 32));
+
+	return u8aConcat(scryptToU8a(salt, params), nonce, encrypted);
+}

package/src/pair/index.ts

@@ -0,0 +1,304 @@
+// Copyright 2017-2025 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import type {
+	KeyringPair,
+	KeyringPair$Json,
+	KeyringPair$Meta,
+	SignOptions,
+} from "@prosopo/types";
+import type { PairInfo } from "@prosopo/types";
+
+import {
+	objectSpread,
+	u8aConcat,
+	u8aEmpty,
+	u8aToHex,
+	u8aToU8a,
+} from "@polkadot/util";
+
+import {
+	type JWT,
+	blake2AsU8a,
+	jwtVerify,
+	sr25519jwtIssue,
+} from "@prosopo/util-crypto";
+import type { EncryptedJsonEncoding } from "@prosopo/util-crypto";
+import { keyExtractPath, keyFromPath } from "@prosopo/util-crypto";
+import { secp256k1Compress } from "@prosopo/util-crypto";
+import { signatureVerify } from "@prosopo/util-crypto";
+import { sr25519FromSeed, sr25519Sign } from "@prosopo/util-crypto";
+import { sr25519VrfSign, sr25519VrfVerify } from "@prosopo/util-crypto";
+import type { JWTVerifyResult } from "@prosopo/util-crypto";
+import { decodePair } from "./decode.js";
+import { encodePair } from "./encode.js";
+import { pairToJson } from "./toJson.js";
+
+type KeypairType = "sr25519" | "ed25519" | "ecdsa" | "ethereum";
+
+interface Setup {
+	toSS58: (publicKey: Uint8Array) => string;
+	type: KeypairType;
+}
+
+const SIG_TYPE_NONE = new Uint8Array([]);
+
+const TYPE_FROM_SEED = {
+	sr25519: sr25519FromSeed,
+	ed25519: () => {
+		throw new Error("Not Implemented");
+	},
+	ecdsa: () => {
+		throw new Error("Not Implemented");
+	},
+	ethereum: () => {
+		throw new Error("Not Implemented");
+	},
+};
+
+const TYPE_PREFIX = {
+	ecdsa: new Uint8Array([2]),
+	ed25519: new Uint8Array([0]),
+	ethereum: new Uint8Array([2]),
+	sr25519: new Uint8Array([1]),
+};
+
+const TYPE_SIGNATURE = {
+	sr25519: sr25519Sign,
+	ed25519: () => {
+		throw new Error("Not Implemented");
+	},
+	ecdsa: () => {
+		throw new Error("Not Implemented");
+	},
+	ethereum: () => {
+		throw new Error("Not Implemented");
+	},
+};
+
+const TYPE_JWT_ISSUE = {
+	sr25519: sr25519jwtIssue,
+	ed25519: () => {
+		throw new Error("Not Implemented");
+	},
+	ecdsa: () => {
+		throw new Error("Not Implemented");
+	},
+	ethereum: () => {
+		throw new Error("Not Implemented");
+	},
+};
+
+const TYPE_ADDRESS = {
+	sr25519: (p: Uint8Array) => p,
+	ed25519: () => {
+		throw new Error("Not Implemented");
+	},
+	ecdsa: () => {
+		throw new Error("Not Implemented");
+	},
+	ethereum: () => {
+		throw new Error("Not Implemented");
+	},
+};
+
+function isLocked(secretKey?: Uint8Array): secretKey is undefined {
+	return !secretKey || u8aEmpty(secretKey);
+}
+
+function vrfHash(
+	proof: Uint8Array,
+	context?: string | Uint8Array,
+	extra?: string | Uint8Array,
+): Uint8Array {
+	return blake2AsU8a(u8aConcat(context || "", extra || "", proof));
+}
+
+/**
+ * @name createPair
+ * @summary Creates a keyring pair object
+ * @description Creates a keyring pair object with provided account public key, metadata, and encoded arguments.
+ * The keyring pair stores the account state including the encoded address and associated metadata.
+ *
+ * It has properties whose values are functions that may be called to perform account actions:
+ *
+ * - `address` function retrieves the address associated with the account.
+ * - `decodedPkcs8` function is called with the account passphrase and account encoded public key.
+ * It decodes the encoded public key using the passphrase provided to obtain the decoded account public key
+ * and associated secret key that are then available in memory, and changes the account address stored in the
+ * state of the pair to correspond to the address of the decoded public key.
+ * - `encodePkcs8` function when provided with the correct passphrase associated with the account pair
+ * and when the secret key is in memory (when the account pair is not locked) it returns an encoded
+ * public key of the account.
+ * - `meta` is the metadata that is stored in the state of the pair, either when it was originally
+ * created or set via `setMeta`.
+ * - `publicKey` returns the public key stored in memory for the pair.
+ * - `sign` may be used to return a signature by signing a provided message with the secret
+ * key (if it is in memory) using Nacl.
+ * - `toJson` calls another `toJson` function and provides the state of the pair,
+ * it generates arguments to be passed to the other `toJson` function including an encoded public key of the account
+ * that it generates using the secret key from memory (if it has been made available in memory)
+ * and the optionally provided passphrase argument. It passes a third boolean argument to `toJson`
+ * indicating whether the public key has been encoded or not (if a passphrase argument was provided then it is encoded).
+ * The `toJson` function that it calls returns a JSON object with properties including the `address`
+ * and `meta` that are assigned with the values stored in the corresponding state variables of the account pair,
+ * an `encoded` property that is assigned with the encoded public key in hex format, and an `encoding`
+ * property that indicates whether the public key value of the `encoded` property is encoded or not.
+ */
+export function createPair(
+	{ toSS58, type }: Setup,
+	{ publicKey, secretKey }: PairInfo,
+	meta: KeyringPair$Meta = {},
+	encoded: Uint8Array | null = null,
+	encTypes?: EncryptedJsonEncoding[],
+): KeyringPair {
+	const decodePkcs8 = (
+		passphrase?: string,
+		userEncoded?: Uint8Array | null,
+	): void => {
+		const decoded = decodePair(passphrase, userEncoded || encoded, encTypes);
+
+		if (decoded.secretKey.length === 64) {
+			publicKey = decoded.publicKey;
+			secretKey = decoded.secretKey;
+		} else {
+			const pair = TYPE_FROM_SEED[type](decoded.secretKey);
+
+			publicKey = pair.publicKey;
+			secretKey = pair.secretKey;
+		}
+	};
+
+	const recode = (passphrase?: string): Uint8Array => {
+		isLocked(secretKey) && encoded && decodePkcs8(passphrase, encoded);
+
+		encoded = encodePair({ publicKey, secretKey }, passphrase); // re-encode, latest version
+		encTypes = undefined; // swap to defaults, latest version follows
+
+		return encoded;
+	};
+
+	const encodeAddress = (): string => {
+		const raw = TYPE_ADDRESS[type](publicKey);
+
+		return toSS58(raw);
+	};
+
+	return {
+		get address(): string {
+			return encodeAddress();
+		},
+		get addressRaw(): Uint8Array {
+			return TYPE_ADDRESS[type](publicKey);
+		},
+		get isLocked(): boolean {
+			return isLocked(secretKey);
+		},
+		get meta(): KeyringPair$Meta {
+			return meta;
+		},
+		get publicKey(): Uint8Array {
+			return publicKey;
+		},
+		get type(): KeypairType {
+			return type;
+		},
+		// eslint-disable-next-line sort-keys
+		decodePkcs8,
+		derive: (suri: string, meta?: KeyringPair$Meta): KeyringPair => {
+			if (isLocked(secretKey)) {
+				throw new Error("Cannot derive on a locked keypair");
+			}
+
+			const { path } = keyExtractPath(suri);
+			const derived = keyFromPath({ publicKey, secretKey }, path, type);
+
+			return createPair({ toSS58, type }, derived, meta, null);
+		},
+		encodePkcs8: (passphrase?: string): Uint8Array => {
+			return recode(passphrase);
+		},
+		jwtIssue: (
+			options?: { expiresIn?: number; notBefore?: number },
+			message?: { [key: string]: string },
+		): JWT => {
+			if (isLocked(secretKey)) {
+				throw new Error("Cannot sign with a locked key pair");
+			}
+			return TYPE_JWT_ISSUE[type]({ publicKey, secretKey }, options, message);
+		},
+		jwtVerify: (jwt: JWT): JWTVerifyResult => {
+			return jwtVerify(jwt, publicKey);
+		},
+		lock: (): void => {
+			secretKey = new Uint8Array([]);
+		},
+		setMeta: (additional: KeyringPair$Meta): void => {
+			meta = objectSpread({}, meta, additional);
+		},
+		sign: (
+			message: string | Uint8Array,
+			options: SignOptions = {},
+		): Uint8Array => {
+			if (isLocked(secretKey)) {
+				throw new Error("Cannot sign with a locked key pair");
+			}
+
+			return u8aConcat(
+				options.withType ? TYPE_PREFIX[type] : SIG_TYPE_NONE,
+				TYPE_SIGNATURE[type](u8aToU8a(message), { publicKey, secretKey }),
+			);
+		},
+		toJson: (passphrase?: string): KeyringPair$Json => {
+			// NOTE: For ecdsa and ethereum, the publicKey cannot be extracted from the address. For these
+			// pass the hex-encoded publicKey through to the address portion of the JSON (before decoding)
+			// unless the publicKey is already an address
+			const address = ["ecdsa", "ethereum"].includes(type)
+				? publicKey.length === 20
+					? u8aToHex(publicKey)
+					: u8aToHex(secp256k1Compress(publicKey))
+				: encodeAddress();
+
+			return pairToJson(
+				type,
+				{ address, meta },
+				recode(passphrase),
+				!!passphrase,
+			);
+		},
+		unlock: (passphrase?: string): void => {
+			decodePkcs8(passphrase);
+		},
+		verify: (
+			message: string | Uint8Array,
+			signature: string | Uint8Array,
+			signerPublic: string | Uint8Array,
+		): boolean => {
+			return signatureVerify(
+				message,
+				signature,
+				TYPE_ADDRESS[type](u8aToU8a(signerPublic)),
+			).isValid;
+		},
+		vrfSign: (
+			message: string | Uint8Array,
+			context?: string | Uint8Array,
+			extra?: string | Uint8Array,
+		): Uint8Array => {
+			if (isLocked(secretKey)) {
+				throw new Error("Cannot sign with a locked key pair");
+			}
+
+			return sr25519VrfSign(message, { secretKey }, context, extra);
+		},
+		vrfVerify: (
+			message: string | Uint8Array,
+			vrfResult: Uint8Array,
+			signerPublic: Uint8Array | string,
+			context?: string | Uint8Array,
+			extra?: string | Uint8Array,
+		): boolean => {
+			return sr25519VrfVerify(message, vrfResult, publicKey, context, extra);
+		},
+	};
+}

package/src/pair/nobody.ts

@@ -0,0 +1,78 @@
+// Copyright 2017-2025 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import type {
+	KeyringPair,
+	KeyringPair$Json,
+	KeyringPair$Meta,
+} from "@prosopo/types";
+import type { JWT, JWTVerifyResult } from "@prosopo/util-crypto";
+
+// empty publicKey
+const publicKey = new Uint8Array(32);
+
+// pre-computed via encodeAddress(publicKey)
+const address = "5C4hrfjw9DjXZTzV3MwzrrAr9P1MJhSrvWGWqi1eSuyUpnhM";
+
+const meta = {
+	isTesting: true,
+	name: "nobody",
+};
+
+const json: KeyringPair$Json = {
+	address,
+	encoded: "",
+	encoding: {
+		content: ["pkcs8", "ed25519"],
+		type: "none",
+		version: "0",
+	},
+	meta,
+};
+
+const pair: KeyringPair = {
+	address,
+	addressRaw: publicKey,
+	decodePkcs8: (_passphrase?: string, _encoded?: Uint8Array): void => undefined,
+	derive: (_suri: string, _meta?: KeyringPair$Meta): KeyringPair => pair,
+	encodePkcs8: (_passphrase?: string): Uint8Array => new Uint8Array(0),
+	isLocked: true,
+	jwtIssue: (_options?: { expiresIn?: number; notBefore?: number }): JWT =>
+		"jwt.dummy.token",
+	jwtVerify: (
+		_jwt: JWT,
+		_options?: { ignoreExpiration?: boolean; ignoreNotBefore?: boolean },
+	): JWTVerifyResult => ({
+		isValid: false,
+		error: "JWT verification failed",
+		crypto: "sr25519",
+		publicKey,
+		isWrapped: false,
+	}),
+	lock: (): void => {
+		// no locking, it is always locked
+	},
+	meta,
+	publicKey,
+	setMeta: (_meta: KeyringPair$Meta): void => undefined,
+	sign: (_message: Uint8Array): Uint8Array => new Uint8Array(64),
+	toJson: (_passphrase?: string): KeyringPair$Json => json,
+	type: "sr25519",
+	unlock: (_passphrase?: string): void => undefined,
+	verify: (_message: Uint8Array, _signature: Uint8Array): boolean => false,
+	vrfSign: (
+		_message: Uint8Array,
+		_context?: string | Uint8Array,
+		_extra?: string | Uint8Array,
+	): Uint8Array => new Uint8Array(96),
+	vrfVerify: (
+		_message: Uint8Array,
+		_vrfResult: Uint8Array,
+		_context?: string | Uint8Array,
+		_extra?: string | Uint8Array,
+	): boolean => false,
+};
+
+export function nobody(): KeyringPair {
+	return pair;
+}

package/src/pair/toJson.spec.ts

@@ -0,0 +1,40 @@
+// Copyright 2017-2025 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, expect, it } from "vitest";
+import { createTestPairs } from "../keyring/testingPairs.js";
+
+const keyring = createTestPairs({ type: "sr25519" }, false);
+
+describe("toJson", (): void => {
+	it("creates an unencoded output with no passphrase", (): void => {
+		expect(keyring.alice.toJson()).toMatchObject({
+			address: "5Engs9f8Gk6JqvVWz3kFyJ8Kqkgx7pLi8C1UTcr7EZ855qBQ",
+			encoded:
+				"MFMCAQEwBQYDK2VwBCIEIHipoQ68w1cHP0Tju+ym3lzqc2fma5FCMXgDqwBDqTtU2pOQGFg2vA+4oVIIZMphcnOugCZhNuyAfxQ4r1OyWsahIwMhAHh9b36VcuIWVvYdPYl8NDyAyBt3Sx125cjHJVK3zLwl",
+			encoding: {
+				content: ["pkcs8", "sr25519"],
+				type: ["none"],
+				version: "3",
+			},
+			meta: {
+				isTesting: true,
+				name: "alice",
+			},
+		});
+	});
+
+	it("creates an encoded output with passphrase", (): void => {
+		const json = keyring.alice.toJson("testing");
+
+		expect(json.encoded).toHaveLength(268);
+		expect(json).toMatchObject({
+			address: "5Engs9f8Gk6JqvVWz3kFyJ8Kqkgx7pLi8C1UTcr7EZ855qBQ",
+			encoding: {
+				content: ["pkcs8", "sr25519"],
+				type: ["scrypt", "xsalsa20-poly1305"],
+				version: "3",
+			},
+		});
+	});
+});

package/src/pair/toJson.ts

@@ -0,0 +1,28 @@
+// Copyright 2017-2025 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import type { KeyringPair$Json, KeyringPair$Meta } from "@prosopo/types";
+import type { KeypairType } from "@prosopo/util-crypto";
+
+import { objectSpread } from "@polkadot/util";
+import { jsonEncryptFormat } from "@prosopo/util-crypto";
+
+interface PairStateJson {
+	address: string;
+	meta: KeyringPair$Meta;
+}
+
+export function pairToJson(
+	type: KeypairType,
+	{ address, meta }: PairStateJson,
+	encoded: Uint8Array,
+	isEncrypted: boolean,
+): KeyringPair$Json {
+	return objectSpread(
+		jsonEncryptFormat(encoded, ["pkcs8", type], isEncrypted),
+		{
+			address,
+			meta,
+		},
+	);
+}