@qorechain/wallet-adapter 0.1.3 → 0.1.5

package/README.md

@@ -72,15 +72,24 @@ await fetch(`${rpc}`, { method:'POST', body: JSON.stringify({
 | **Keplr** | `experimentalSuggestChain` + `signDirect` | ✅ supported |
 | **Leap / Cosmostation** | same `signDirect` interface | ✅ supported (any wallet exposing `signDirect`) |
 | **MetaMask** | uses QoreChain's **EVM** path (chainId 9800) — structurally PQC-exempt | ✅ works natively, no adapter needed |
-| **Phantom** | QoreChain's Solana-compatible RPC (`:8899`) | ⚠️ read/native-send; PQC SVM execute needs the same hybrid pattern |
+| **Phantom** | derive a unified account from a Phantom signature (`walletFromSeed`) | ✅ connect → qor1/0x/svm, receive on any, spend on any (incl. hybrid PQC) |
 
 ## API
 
-- `frame(b0, auth)` — QoreChain hybrid sign-bytes framing.
-- `encodePqcHybridSignature(algId, sig)` — proto encoder for the extension.
-- `derivePqcKeyFromWallet(wallet, chainId, address)` — deterministic ML-DSA-87 key from a wallet signature.
+Wallet generation & unified addresses:
+- `generateQoreWallet(strength?)` / `walletFromMnemonic(mnemonic)` / `walletFromSeed(seed32)` — a unified wallet `{ mnemonic, privateKey, pubkey, cosmos, evm, svm, pqc }`.
+- `addressesFrom20(bytes20)` / `qoreAddresses({cosmos|evm|hex})` — the three encodings of a known account.
+
+eth-native Cosmos signing (chain ≥ v3.1.83):
+- `signClassicalEth({ key, chainId, accountNumber, sequence, messages, fee, memo?, timeoutHeight? })` → `TxRaw` bytes (classical, e.g. PQC key registration).
+- `signHybridEth({ ... })` → `TxRaw` bytes (eth_secp256k1 + ML-DSA-87 hybrid).
+- `ETHSECP256K1_PUBKEY_TYPE` — the eth pubkey type URL.
+
+Keplr / any-signDirect adapter + PQC framing:
 - `QoreChainSigner#signHybrid({ messages, fee, sequence, memo?, timeoutHeight? })` → `TxRaw` bytes.
-- `qoreChainInfo({ chainId?, rpc, rest })` — Keplr chain descriptor.
+- `derivePqcKeyFromWallet(wallet, chainId, address)` — deterministic ML-DSA-87 key from a wallet signature.
+- `frame(b0, auth)` — QoreChain hybrid sign-bytes framing; `encodePqcHybridSignature(algId, sig)` — proto encoder for the extension.
+- `qoreChainInfo({ chainId?, rpc, rest })` — Keplr chain descriptor; `qoreEvmChainParams(...)` / `addQoreEvmToWallet(provider, opts)` — MetaMask (EIP-3085) EVM descriptor.
 
 ## License
 
@@ -112,3 +121,52 @@ under which the chain reads one `x/bank` balance. The account can sign EVM txs
 
 `addressesFrom20(bytes20)` / `qoreAddresses({cosmos|evm|hex})` derive the three
 encodings from a known account (for explorers / backends).
+
+### Derive from a seed (Phantom & other non-mnemonic flows)
+
+`walletFromSeed(seed32)` builds the same unified wallet from any 32 bytes (the
+seed becomes the secp256k1 key). Because a wallet's signature over a fixed message
+is deterministic, you can derive **one canonical QoreChain account from a Phantom
+(ed25519) signature** — a Phantom user connects once and gets three usable
+QoreChain addresses they fully control:
+
+```js
+import { walletFromSeed } from "@qorechain/wallet-adapter";
+import { shake256 } from "@qorechain/pqc";
+
+const msg = new TextEncoder().encode("QoreChain unified account derivation v1");
+const { signature } = await window.solana.signMessage(msg); // Phantom, deterministic
+const w = await walletFromSeed(shake256(signature, 32));     // → qor1 / 0x / svm + pqc
+```
+
+## eth-native Cosmos signing (requires chain ≥ v3.1.83)
+
+The unified account **signs on the Cosmos lane too**, with the `eth_secp256k1`
+scheme (secp256k1 over `keccak256(signBytes)`, pubkey
+`/cosmos.evm.crypto.v1.ethsecp256k1.PubKey`). `signClassicalEth` builds a
+classical-only tx (for the one-time, bootstrap-exempt PQC key registration);
+`signHybridEth` adds the ML-DSA-87 hybrid signature the ante requires for
+everything else. Both return broadcast-ready `TxRaw` bytes.
+
+```js
+import { walletFromMnemonic, signClassicalEth, signHybridEth } from "@qorechain/wallet-adapter";
+
+const key = await walletFromMnemonic(mnemonic); // has { privateKey, pubkey, pqc }
+const fee = { amount: [{ denom: "uqor", amount: "30000" }], gasLimit: 300000n };
+
+// 1) one-time: register the account's ML-DSA-87 key (classical, PQC-exempt)
+const regTx = await signClassicalEth({ key, chainId, accountNumber, sequence,
+  messages: [{ typeUrl: "/qorechain.pqc.v1.MsgRegisterPQCKeyV2", value: registerMsgBytes }],
+  fee: { amount: [{ denom: "uqor", amount: "600000" }], gasLimit: 6000000n } });
+
+// 2) thereafter: hybrid eth_secp256k1 + ML-DSA-87 (e.g. a bank MsgSend)
+const sendTx = await signHybridEth({ key, chainId, accountNumber, sequence,
+  messages: [{ typeUrl: "/cosmos.bank.v1beta1.MsgSend", value: msgSendBytes }], fee });
+```
+
+> **Requires QoreChain ≥ v3.1.83** — that release registers the `eth_secp256k1`
+> pubkey on the node's interface registry so eth-native Cosmos txs decode. Both
+> `qorechain-diana` (testnet) and `qorechain-vladi` (mainnet) run it.
+> `@qorechain/chain-bridge` wraps this server-side (`keyType: 'eth_secp256k1'`,
+> auto-registers the PQC key on first send). **Proven live** on QoreChain: register
+> (code 0) + hybrid send (code 0) + an EVM transfer from the same key, one balance.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qorechain/wallet-adapter",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Drop-in adapter to add QoreChain to any Cosmos wallet (Keplr, Leap, Cosmostation, …) and sign its PQC-required transactions. The wallet signs an ordinary SIGN_MODE_DIRECT SignDoc; the adapter layers a standard FIPS-204 ML-DSA-87 hybrid signature into the tx body, so no wallet code changes are needed.",
   "type": "module",
   "main": "src/index.js",

package/src/index.d.ts

@@ -1,6 +1,48 @@
 export const HYBRID_SIG_TYPE_URL: string;
 export const ALGORITHM_ML_DSA_87: number;
 
+// --- Unified wallet generation (one eth-native key → qor1 / 0x / svm) ---
+export interface PqcKeypair { publicKey: Uint8Array; secretKey: Uint8Array; }
+export interface QoreAddresses {
+  addressBytes: Uint8Array;
+  cosmos: string; // qor1… (bech32)
+  evm: string;    // 0x… (EIP-55)
+  svm: string;    // base58
+}
+export interface QoreWallet extends QoreAddresses {
+  mnemonic: string | null;
+  privateKey: string; // 0x-hex, 32 bytes
+  pubkey: string;     // 0x-hex, 33-byte compressed secp256k1
+  pqc: PqcKeypair;    // ML-DSA-87 (Dilithium-5)
+}
+export function generateQoreWallet(strength?: number): Promise<QoreWallet>;
+export function walletFromMnemonic(mnemonic: string): Promise<QoreWallet>;
+export function walletFromSeed(seed: Uint8Array | string): Promise<QoreWallet>;
+export function addressesFrom20(addr20: Uint8Array): QoreAddresses;
+export function qoreAddresses(opts: { cosmos?: string; evm?: string; hex?: string }): QoreAddresses;
+
+// --- eth-native (eth_secp256k1) Cosmos signing (requires chain >= v3.1.83) ---
+export const ETHSECP256K1_PUBKEY_TYPE: string;
+export interface EthSignKey { privateKey: Uint8Array | string; pubkey: Uint8Array | string; pqc?: PqcKeypair; }
+export interface EthSignArgs {
+  key: EthSignKey;
+  chainId: string;
+  accountNumber: number | bigint;
+  messages: Array<{ typeUrl: string; value: Uint8Array }>;
+  fee: any;
+  sequence: number | bigint;
+  memo?: string;
+  timeoutHeight?: bigint;
+}
+/** Classical-only eth_secp256k1 Cosmos tx (e.g. the bootstrap MsgRegisterPQCKeyV2). */
+export function signClassicalEth(args: EthSignArgs): Promise<Uint8Array>;
+/** Hybrid eth_secp256k1 + ML-DSA-87 Cosmos tx (key.pqc required). */
+export function signHybridEth(args: EthSignArgs): Promise<Uint8Array>;
+
+// --- EVM network descriptors (EIP-3085 / MetaMask) ---
+export function qoreEvmChainParams(opts?: { evmChainId?: number; rpcUrl?: string; wsUrl?: string; explorerUrl?: string; testnet?: boolean }): any;
+export function addQoreEvmToWallet(provider: any, opts?: any): Promise<any>;
+
 // --- Phantom / any-ed25519-wallet support ---
 export const SYSTEM_PROGRAM_ID: string;
 export function base58Encode(bytes: Uint8Array): string;

package/src/index.js

@@ -31,8 +31,12 @@ export {
 } from './phantom.js';
 // Unified wallet generation: one eth-native key → cosmos/evm/svm addresses + PQC key.
 export {
-  generateQoreWallet, walletFromMnemonic, addressesFrom20, qoreAddresses,
+  generateQoreWallet, walletFromMnemonic, walletFromSeed, addressesFrom20, qoreAddresses,
 } from './wallet.js';
+// eth-native (eth_secp256k1) Cosmos signing — classical (register) + hybrid (PQC).
+export {
+  signClassicalEth, signHybridEth, ETHSECP256K1_PUBKEY_TYPE,
+} from './sign-eth.js';
 import { TxBody, AuthInfo, TxRaw, SignerInfo, ModeInfo, Fee } from 'cosmjs-types/cosmos/tx/v1beta1/tx.js';
 import { SignMode } from 'cosmjs-types/cosmos/tx/signing/v1beta1/signing.js';
 import { SignDoc } from 'cosmjs-types/cosmos/tx/v1beta1/tx.js';

package/src/sign-eth.js

@@ -0,0 +1,91 @@
+// @qorechain/wallet-adapter — eth-native (eth_secp256k1) Cosmos signing.
+//
+// A QoreChain account created eth-native (address = keccak(pubkey)[12:]) signs
+// Cosmos SDK txs with the `eth_secp256k1` scheme: the classical signature is
+// secp256k1 over the KECCAK-256 of the SignDoc (not sha256), and the account's
+// pubkey is `/cosmos.evm.crypto.v1.ethsecp256k1.PubKey`. This is the same account
+// that spends on the EVM lane, so its qor1/0x/svm forms are one identity.
+//
+// Mainnet requires the ML-DSA-87 hybrid extension in the tx body; signHybridEth
+// adds it. signClassicalEth omits it (used for the one-time PQC key registration,
+// which is bootstrap-exempt from the hybrid requirement).
+
+import { Secp256k1, Keccak256 } from '@cosmjs/crypto';
+import { fromHex } from '@cosmjs/encoding';
+import { TxBody, AuthInfo, TxRaw, SignerInfo, ModeInfo, Fee, SignDoc } from 'cosmjs-types/cosmos/tx/v1beta1/tx.js';
+import { SignMode } from 'cosmjs-types/cosmos/tx/signing/v1beta1/signing.js';
+import { PubKey } from 'cosmjs-types/cosmos/crypto/secp256k1/keys.js';
+import { mldsa } from '@qorechain/pqc';
+import { frame, encodePqcHybridSignature, HYBRID_SIG_TYPE_URL, ALGORITHM_ML_DSA_87 } from './framing.js';
+
+// cosmos/evm eth_secp256k1 pubkey type. Wire shape is identical to the cosmos
+// secp256k1 PubKey ({1: bytes key}), only the typeUrl differs.
+export const ETHSECP256K1_PUBKEY_TYPE = '/cosmos.evm.crypto.v1.ethsecp256k1.PubKey';
+
+function toBytes(x) {
+  if (x instanceof Uint8Array) return x;
+  return fromHex(String(x).replace(/^0x/, ''));
+}
+
+function buildAuthInfo(compressedPubkey, sequence, fee) {
+  const pubAny = {
+    typeUrl: ETHSECP256K1_PUBKEY_TYPE,
+    value: PubKey.encode(PubKey.fromPartial({ key: toBytes(compressedPubkey) })).finish(),
+  };
+  const authInfo = AuthInfo.fromPartial({
+    signerInfos: [SignerInfo.fromPartial({
+      publicKey: pubAny,
+      modeInfo: ModeInfo.fromPartial({ single: { mode: SignMode.SIGN_MODE_DIRECT } }),
+      sequence: BigInt(sequence),
+    })],
+    fee: Fee.fromPartial(fee),
+  });
+  return AuthInfo.encode(authInfo).finish();
+}
+
+// eth_secp256k1 classical signature over a SignDoc: secp256k1 sign of keccak(signBytes),
+// serialized as the 64-byte r‖s (low-s normalized by @cosmjs/crypto).
+async function ethSign(signBytes, privateKey) {
+  const hash = new Keccak256(signBytes).digest();
+  const sig = await Secp256k1.createSignature(hash, toBytes(privateKey));
+  const out = new Uint8Array(64);
+  out.set(sig.r(32), 0);
+  out.set(sig.s(32), 32);
+  return out;
+}
+
+/**
+ * Classical-only eth_secp256k1 Cosmos tx (no PQC extension). Use for the one-time
+ * MsgRegisterPQCKeyV2 (bootstrap-exempt). `key` = { privateKey, pubkey } from
+ * generateQoreWallet/walletFromMnemonic.
+ */
+export async function signClassicalEth({ key, chainId, accountNumber, messages, fee, sequence, memo = '', timeoutHeight = 0n }) {
+  const authInfoBytes = buildAuthInfo(key.pubkey, sequence, fee);
+  const bodyBytes = TxBody.encode(TxBody.fromPartial({ messages, memo, timeoutHeight })).finish();
+  const signBytes = SignDoc.encode(SignDoc.fromPartial({
+    bodyBytes, authInfoBytes, chainId, accountNumber: BigInt(accountNumber),
+  })).finish();
+  const classical = await ethSign(signBytes, key.privateKey);
+  return TxRaw.encode(TxRaw.fromPartial({ bodyBytes, authInfoBytes, signatures: [classical] })).finish();
+}
+
+/**
+ * Hybrid eth_secp256k1 + ML-DSA-87 Cosmos tx. `key` must include `pqc`
+ * ({publicKey, secretKey}) as produced by generateQoreWallet/walletFromMnemonic.
+ */
+export async function signHybridEth({ key, chainId, accountNumber, messages, fee, sequence, memo = '', timeoutHeight = 0n }) {
+  const authInfoBytes = buildAuthInfo(key.pubkey, sequence, fee);
+  // B0 = body without the PQC extension.
+  const b0 = TxBody.encode(TxBody.fromPartial({ messages, memo, timeoutHeight })).finish();
+  // ML-DSA-87 over frame(B0, authInfo).
+  const pqcSig = mldsa.sign(key.pqc.secretKey, frame(b0, authInfoBytes));
+  const bodyWithExt = TxBody.encode(TxBody.fromPartial({
+    messages, memo, timeoutHeight,
+    extensionOptions: [{ typeUrl: HYBRID_SIG_TYPE_URL, value: encodePqcHybridSignature(ALGORITHM_ML_DSA_87, pqcSig) }],
+  })).finish();
+  const signBytes = SignDoc.encode(SignDoc.fromPartial({
+    bodyBytes: bodyWithExt, authInfoBytes, chainId, accountNumber: BigInt(accountNumber),
+  })).finish();
+  const classical = await ethSign(signBytes, key.privateKey);
+  return TxRaw.encode(TxRaw.fromPartial({ bodyBytes: bodyWithExt, authInfoBytes, signatures: [classical] })).finish();
+}

package/src/wallet.js

@@ -86,6 +86,40 @@ export async function walletFromMnemonic(mnemonic) {
   return fromMnemonicObj(mnemonic);
 }
 
+/**
+ * Derive a unified QoreChain wallet directly from a 32-byte seed (no mnemonic).
+ *
+ * The seed is used as the secp256k1 private key, so a caller can derive one
+ * canonical eth-native account deterministically from any 32 bytes — e.g.
+ * `shake256(phantomSignature)` for the Phantom "connect → 3 addresses" flow, or
+ * an HKDF/KDF output from another wallet. Same 20-byte identity model as
+ * `walletFromMnemonic`: qor1 / 0x / svm all resolve to the same account and the
+ * same balance, and the key signs on every interface (incl. hybrid PQC).
+ *
+ * The ML-DSA-87 key is bound to `qorechain:pqc:v1|<qor1>|seed:<hex>` so it is
+ * recoverable from the same seed and never collides with a mnemonic wallet.
+ * `seed` accepts a 32-byte Uint8Array or a (0x-)hex string.
+ */
+export async function walletFromSeed(seed) {
+  const privkey = typeof seed === 'string' ? fromHex(seed.replace(/^0x/, '')) : seed;
+  if (!(privkey instanceof Uint8Array) || privkey.length !== 32) {
+    throw new Error('seed must be 32 bytes (Uint8Array or hex)');
+  }
+  const kp = await Secp256k1.makeKeypair(privkey); // validates the scalar is in [1, n-1]
+  const uncompressed = kp.pubkey;
+  const compressed = Secp256k1.compressPubkey(uncompressed);
+  const addr20 = new Keccak256(uncompressed.slice(1)).digest().slice(12);
+  const enc = addressesFrom20(addr20);
+  const pqcSeed = shake256(new TextEncoder().encode(`qorechain:pqc:v1|${enc.cosmos}|seed:${toHex(privkey)}`), 32);
+  return {
+    mnemonic: null,
+    privateKey: '0x' + toHex(privkey),
+    pubkey: '0x' + toHex(compressed),
+    ...enc,
+    pqc: mldsa.keygen(pqcSeed),
+  };
+}
+
 /** Convenience: the three address encodings of an existing account. */
 export function qoreAddresses({ cosmos, evm, hex }) {
   let addr20;