@totemsdk/core 1.2.11 → 1.4.0

package/README.md

@@ -10,6 +10,64 @@ Zero production dependencies (only `@noble/hashes` as a peer). Provides WOTS (Wi
 npm install @totemsdk/core @noble/hashes
 ```
 
+## Bundling for edge / Workers
+
+The root entry (`@totemsdk/core`) re-exports the synchronous WASM crypto bridge
+(`@totemsdk/core/wasm`), which imports `@totemsdk/core-wasm` at module load. That
+glue uses a bundler-target `import * as wasm from "./….wasm"` (and, on the Node
+path, `fs`/`__dirname`), so a stock `esbuild` build targeting Cloudflare Workers
+(or any async-WASM edge runtime) fails to resolve or instantiate it.
+
+Import a wasm-free subpath instead of the root when you don't need the WASM
+crypto:
+
+| Need | Import | Notes |
+|---|---|---|
+| Adapter contracts / types (`StorageAdapter`, `WebSocketFactory`, `WebSocketReadyState`, …) | `@totemsdk/core/adapters` | Same names as the root — safe drop-in. |
+| Pure-JS crypto | `@totemsdk/core/legacy` | JS implementations are **`legacy`-prefixed** (`legacyWotsSign`, `legacyWotsVerify`, `legacyWotsKeypairFromSeed`, …); `verifySignature*` are unprefixed. **Not** a drop-in for the root's `wotsSign`. |
+| WASM crypto (async, portable to edge/Workers/Bare) | `@totemsdk/core/wasm` | ESM-only; `await init()` once (optionally with explicit wasm bytes), then synchronous calls. Alias: `./wasm-async`. |
+| WASM crypto (sync, Node/bundler with a `.wasm` loader) | `@totemsdk/core/wasm-sync` | Same names as the root; initializes at import. |
+
+Immediate unblock without an SDK change (adapter-only consumers):
+
+```bash
+esbuild --alias:@totemsdk/core=@totemsdk/core/adapters
+```
+
+`@totemsdk/core` does not set `"sideEffects": false` (the WASM bridge
+initializes at import), so bundlers will not tree-shake the WASM re-export away;
+prefer explicit subpath imports over relying on tree-shaking.
+
+### Deprecation & migration (RFC-031)
+
+`@totemsdk/core/legacy` is **deprecated and frozen** — the pure-JS kernels will be
+removed in a major release; no new kernels are added there. Prefer the WASM
+surface (`@totemsdk/core/wasm` for synchronous use, `@totemsdk/core/wasm-async`
+for edge/Workers). Typical migration:
+
+```ts
+// before — pure-JS, legacy-prefixed
+import { legacyWotsSign, legacyWotsVerify } from '@totemsdk/core/legacy';
+// after — async-init WASM, same names as the root
+import { init, wotsSign, wotsVerify } from '@totemsdk/core/wasm-async';
+await init();
+```
+
+Use `/legacy` only where WASM genuinely cannot run; `verifySignature*` and the
+adapter contracts are unaffected.
+
+### Bare / Pear
+
+Bare (Holepunch, V8-based) can run the portable `./wasm-async` entry, but does not
+provide the `TextEncoder`/`TextDecoder` globals the wasm-bindgen glue uses — import
+`bare-encoding/global` first:
+
+```ts
+import 'bare-encoding/global';           // Bare only
+import { init, sha3_256 } from '@totemsdk/core/wasm-async';
+await init();                            // optionally with explicit wasm bytes
+```
+
 ## What's inside
 
 | Module | What it does |

package/dist/address-derivation.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Deterministic address derivation (CAN-005).
+ *
+ * Minima's `newaddress` is non-deterministic, and not every node build honours a
+ * `modifier:` argument, so an address taken from the node can differ across
+ * containers/restarts and break cross-container resolution. These helpers derive
+ * the address **from the seed** instead, using the same schemes the node uses, so
+ * the result is reproducible and (for the matching scheme) node-spendable.
+ *
+ * - `deriveDeterministicAddress` — Minima `Wallet.createNewKey()` parity:
+ *   `privseed = hash(baseSeed, index)` → `TreeKey(privseed, 64, 3)` → pubkey → Mx.
+ * - `deriveUnifiedAddress` — RFC-037 hierarchical child key.
+ *
+ * `verifyDeterministicAddress` asserts an address a node handed back matches the
+ * seed-derived one — the fail-loud check that replaces a silent fallback.
+ */
+export type AddressScheme = 'per-address' | 'unified';
+export interface DerivedAddress {
+    addressIndex: number;
+    /** 0x-hex 32-byte WOTS public key. */
+    publicKey: string;
+    /** Mx… address derived from the public key. */
+    address: string;
+    scheme: AddressScheme;
+}
+/** Minima Wallet.java parity: `baseSeed + index → privseed → TreeKey(64,3) → address`. */
+export declare function deriveDeterministicAddress(baseSeed: Uint8Array, addressIndex: number): DerivedAddress;
+/** RFC-037 unified hierarchical scheme: `baseSeed + index → child TreeKey → address`. */
+export declare function deriveUnifiedAddress(baseSeed: Uint8Array, addressIndex: number): DerivedAddress;
+/** Derive the address for a scheme (default: the node-parity per-address scheme). */
+export declare function deriveAddress(baseSeed: Uint8Array, addressIndex: number, scheme?: AddressScheme): DerivedAddress;
+/**
+ * Fail-loud check: does the node-returned `expectedAddress` equal the address
+ * derived from the seed? Use this instead of trusting `newaddress` blindly.
+ */
+export declare function verifyDeterministicAddress(baseSeed: Uint8Array, addressIndex: number, expectedAddress: string, scheme?: AddressScheme): boolean;

package/dist/address-derivation.js

@@ -0,0 +1,54 @@
+/**
+ * Deterministic address derivation (CAN-005).
+ *
+ * Minima's `newaddress` is non-deterministic, and not every node build honours a
+ * `modifier:` argument, so an address taken from the node can differ across
+ * containers/restarts and break cross-container resolution. These helpers derive
+ * the address **from the seed** instead, using the same schemes the node uses, so
+ * the result is reproducible and (for the matching scheme) node-spendable.
+ *
+ * - `deriveDeterministicAddress` — Minima `Wallet.createNewKey()` parity:
+ *   `privseed = hash(baseSeed, index)` → `TreeKey(privseed, 64, 3)` → pubkey → Mx.
+ * - `deriveUnifiedAddress` — RFC-037 hierarchical child key.
+ *
+ * `verifyDeterministicAddress` asserts an address a node handed back matches the
+ * seed-derived one — the fail-loud check that replaces a silent fallback.
+ */
+import { derivePerAddressSeed } from './javaStreamables.js';
+import { TreeKey, createUnifiedChildTreeKey } from './treekey.js';
+import { deriveAddressFromPublicKey, bytesToHex } from './verify.js';
+function assertIndex(addressIndex) {
+    if (!Number.isInteger(addressIndex) || addressIndex < 0) {
+        throw new Error(`addressIndex must be a non-negative integer, got ${JSON.stringify(addressIndex)}`);
+    }
+}
+function toDerived(addressIndex, scheme, publicKeyBytes) {
+    const publicKey = '0x' + bytesToHex(publicKeyBytes).toUpperCase();
+    return { addressIndex, publicKey, address: deriveAddressFromPublicKey(publicKey), scheme };
+}
+/** Minima Wallet.java parity: `baseSeed + index → privseed → TreeKey(64,3) → address`. */
+export function deriveDeterministicAddress(baseSeed, addressIndex) {
+    assertIndex(addressIndex);
+    const privSeed = derivePerAddressSeed(baseSeed, addressIndex);
+    const publicKey = new TreeKey(privSeed, 64, 3).getPublicKey();
+    return toDerived(addressIndex, 'per-address', publicKey);
+}
+/** RFC-037 unified hierarchical scheme: `baseSeed + index → child TreeKey → address`. */
+export function deriveUnifiedAddress(baseSeed, addressIndex) {
+    assertIndex(addressIndex);
+    const publicKey = createUnifiedChildTreeKey(baseSeed, addressIndex).getPublicKey();
+    return toDerived(addressIndex, 'unified', publicKey);
+}
+/** Derive the address for a scheme (default: the node-parity per-address scheme). */
+export function deriveAddress(baseSeed, addressIndex, scheme = 'per-address') {
+    return scheme === 'unified'
+        ? deriveUnifiedAddress(baseSeed, addressIndex)
+        : deriveDeterministicAddress(baseSeed, addressIndex);
+}
+/**
+ * Fail-loud check: does the node-returned `expectedAddress` equal the address
+ * derived from the seed? Use this instead of trusting `newaddress` blindly.
+ */
+export function verifyDeterministicAddress(baseSeed, addressIndex, expectedAddress, scheme = 'per-address') {
+    return deriveAddress(baseSeed, addressIndex, scheme).address === expectedAddress;
+}

package/dist/bip39.js

@@ -11,7 +11,7 @@
  * - cleanSeedPhrase(): Normalizes input with prefix matching
  * - convertStringToSeed(): Hashes phrase bytes with SHA3-256
  */
-import { sha3_256 } from './wasm-sync.js';
+import { sha3_256 } from './wasm-async.js';
 /**
  * Official BIP39 English word list (2048 words)
  * From https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt

package/dist/bytes.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Wasm-free byte utilities (RFC-031 Fix A).
+ *
+ * Byte-exact equivalents of the WASM kernels `bytes_to_hex` (uppercase, via
+ * `hex::encode_upper`), `hex_to_bytes` (strips a leading lowercase `0x`),
+ * and `concat_bytes`. Living outside `wasm-sync` lets pure consumers and the
+ * core root avoid loading the WASM artifact for hex/concat work.
+ */
+export declare function bytesToHex(bytes: Uint8Array): string;
+export declare function hexToBytes(hex: string): Uint8Array;
+export declare function concatBytes(...arrays: Uint8Array[]): Uint8Array;

package/dist/bytes.js

@@ -0,0 +1,39 @@
+/**
+ * Wasm-free byte utilities (RFC-031 Fix A).
+ *
+ * Byte-exact equivalents of the WASM kernels `bytes_to_hex` (uppercase, via
+ * `hex::encode_upper`), `hex_to_bytes` (strips a leading lowercase `0x`),
+ * and `concat_bytes`. Living outside `wasm-sync` lets pure consumers and the
+ * core root avoid loading the WASM artifact for hex/concat work.
+ */
+export function bytesToHex(bytes) {
+    let s = '';
+    for (let i = 0; i < bytes.length; i++)
+        s += bytes[i].toString(16).padStart(2, '0');
+    return s.toUpperCase();
+}
+export function hexToBytes(hex) {
+    const s = hex.startsWith('0x') ? hex.slice(2) : hex;
+    if (s.length % 2 !== 0)
+        throw new Error('Invalid hex: odd-length string');
+    const out = new Uint8Array(s.length >> 1);
+    for (let i = 0; i < out.length; i++) {
+        const pair = s.slice(i * 2, i * 2 + 2);
+        if (!/^[0-9a-fA-F]{2}$/.test(pair))
+            throw new Error(`Invalid hex: ${pair}`);
+        out[i] = parseInt(pair, 16);
+    }
+    return out;
+}
+export function concatBytes(...arrays) {
+    let len = 0;
+    for (const a of arrays)
+        len += a.length;
+    const out = new Uint8Array(len);
+    let offset = 0;
+    for (const a of arrays) {
+        out.set(a, offset);
+        offset += a.length;
+    }
+    return out;
+}

package/dist/canonical-hash.d.ts

@@ -0,0 +1 @@
+export declare function hashCanonical(domain: string, value: unknown): string;

package/dist/canonical-hash.js

@@ -0,0 +1,12 @@
+/**
+ * Canonical JSON hashing (RFC-031 Fix A).
+ *
+ * Split out of `canonical.ts` so that `canonicalJson`/`toHex` are wasm-free:
+ * only `hashCanonical` needs the WASM `sha3_256` kernel.
+ */
+import { sha3_256 } from './wasm-async.js';
+import { canonicalJson, toHex } from './canonical.js';
+export function hashCanonical(domain, value) {
+    const input = domain + canonicalJson(value);
+    return toHex(sha3_256(new TextEncoder().encode(input)));
+}

package/dist/canonical.d.ts

@@ -1,3 +1,8 @@
+/**
+ * Canonical JSON + lowercase hex helpers (wasm-free).
+ *
+ * `hashCanonical` (which needs the WASM `sha3_256` kernel) lives in
+ * `canonical-hash.ts`.
+ */
 export declare function toHex(bytes: Uint8Array): string;
 export declare function canonicalJson(value: unknown): string;
-export declare function hashCanonical(domain: string, value: unknown): string;

package/dist/canonical.js

@@ -1,4 +1,9 @@
-import { sha3_256 } from './wasm-sync.js';
+/**
+ * Canonical JSON + lowercase hex helpers (wasm-free).
+ *
+ * `hashCanonical` (which needs the WASM `sha3_256` kernel) lives in
+ * `canonical-hash.ts`.
+ */
 export function toHex(bytes) {
     return Array.from(bytes)
         .map((b) => b.toString(16).padStart(2, '0'))
@@ -16,7 +21,3 @@ export function canonicalJson(value) {
     const pairs = keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`);
     return '{' + pairs.join(',') + '}';
 }
-export function hashCanonical(domain, value) {
-    const input = domain + canonicalJson(value);
-    return toHex(sha3_256(new TextEncoder().encode(input)));
-}

package/dist/cjs/address-derivation.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Deterministic address derivation (CAN-005).
+ *
+ * Minima's `newaddress` is non-deterministic, and not every node build honours a
+ * `modifier:` argument, so an address taken from the node can differ across
+ * containers/restarts and break cross-container resolution. These helpers derive
+ * the address **from the seed** instead, using the same schemes the node uses, so
+ * the result is reproducible and (for the matching scheme) node-spendable.
+ *
+ * - `deriveDeterministicAddress` — Minima `Wallet.createNewKey()` parity:
+ *   `privseed = hash(baseSeed, index)` → `TreeKey(privseed, 64, 3)` → pubkey → Mx.
+ * - `deriveUnifiedAddress` — RFC-037 hierarchical child key.
+ *
+ * `verifyDeterministicAddress` asserts an address a node handed back matches the
+ * seed-derived one — the fail-loud check that replaces a silent fallback.
+ */
+export type AddressScheme = 'per-address' | 'unified';
+export interface DerivedAddress {
+    addressIndex: number;
+    /** 0x-hex 32-byte WOTS public key. */
+    publicKey: string;
+    /** Mx… address derived from the public key. */
+    address: string;
+    scheme: AddressScheme;
+}
+/** Minima Wallet.java parity: `baseSeed + index → privseed → TreeKey(64,3) → address`. */
+export declare function deriveDeterministicAddress(baseSeed: Uint8Array, addressIndex: number): DerivedAddress;
+/** RFC-037 unified hierarchical scheme: `baseSeed + index → child TreeKey → address`. */
+export declare function deriveUnifiedAddress(baseSeed: Uint8Array, addressIndex: number): DerivedAddress;
+/** Derive the address for a scheme (default: the node-parity per-address scheme). */
+export declare function deriveAddress(baseSeed: Uint8Array, addressIndex: number, scheme?: AddressScheme): DerivedAddress;
+/**
+ * Fail-loud check: does the node-returned `expectedAddress` equal the address
+ * derived from the seed? Use this instead of trusting `newaddress` blindly.
+ */
+export declare function verifyDeterministicAddress(baseSeed: Uint8Array, addressIndex: number, expectedAddress: string, scheme?: AddressScheme): boolean;

package/dist/cjs/address-derivation.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * Deterministic address derivation (CAN-005).
+ *
+ * Minima's `newaddress` is non-deterministic, and not every node build honours a
+ * `modifier:` argument, so an address taken from the node can differ across
+ * containers/restarts and break cross-container resolution. These helpers derive
+ * the address **from the seed** instead, using the same schemes the node uses, so
+ * the result is reproducible and (for the matching scheme) node-spendable.
+ *
+ * - `deriveDeterministicAddress` — Minima `Wallet.createNewKey()` parity:
+ *   `privseed = hash(baseSeed, index)` → `TreeKey(privseed, 64, 3)` → pubkey → Mx.
+ * - `deriveUnifiedAddress` — RFC-037 hierarchical child key.
+ *
+ * `verifyDeterministicAddress` asserts an address a node handed back matches the
+ * seed-derived one — the fail-loud check that replaces a silent fallback.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveDeterministicAddress = deriveDeterministicAddress;
+exports.deriveUnifiedAddress = deriveUnifiedAddress;
+exports.deriveAddress = deriveAddress;
+exports.verifyDeterministicAddress = verifyDeterministicAddress;
+const javaStreamables_js_1 = require("./javaStreamables.js");
+const treekey_js_1 = require("./treekey.js");
+const verify_js_1 = require("./verify.js");
+function assertIndex(addressIndex) {
+    if (!Number.isInteger(addressIndex) || addressIndex < 0) {
+        throw new Error(`addressIndex must be a non-negative integer, got ${JSON.stringify(addressIndex)}`);
+    }
+}
+function toDerived(addressIndex, scheme, publicKeyBytes) {
+    const publicKey = '0x' + (0, verify_js_1.bytesToHex)(publicKeyBytes).toUpperCase();
+    return { addressIndex, publicKey, address: (0, verify_js_1.deriveAddressFromPublicKey)(publicKey), scheme };
+}
+/** Minima Wallet.java parity: `baseSeed + index → privseed → TreeKey(64,3) → address`. */
+function deriveDeterministicAddress(baseSeed, addressIndex) {
+    assertIndex(addressIndex);
+    const privSeed = (0, javaStreamables_js_1.derivePerAddressSeed)(baseSeed, addressIndex);
+    const publicKey = new treekey_js_1.TreeKey(privSeed, 64, 3).getPublicKey();
+    return toDerived(addressIndex, 'per-address', publicKey);
+}
+/** RFC-037 unified hierarchical scheme: `baseSeed + index → child TreeKey → address`. */
+function deriveUnifiedAddress(baseSeed, addressIndex) {
+    assertIndex(addressIndex);
+    const publicKey = (0, treekey_js_1.createUnifiedChildTreeKey)(baseSeed, addressIndex).getPublicKey();
+    return toDerived(addressIndex, 'unified', publicKey);
+}
+/** Derive the address for a scheme (default: the node-parity per-address scheme). */
+function deriveAddress(baseSeed, addressIndex, scheme = 'per-address') {
+    return scheme === 'unified'
+        ? deriveUnifiedAddress(baseSeed, addressIndex)
+        : deriveDeterministicAddress(baseSeed, addressIndex);
+}
+/**
+ * Fail-loud check: does the node-returned `expectedAddress` equal the address
+ * derived from the seed? Use this instead of trusting `newaddress` blindly.
+ */
+function verifyDeterministicAddress(baseSeed, addressIndex, expectedAddress, scheme = 'per-address') {
+    return deriveAddress(baseSeed, addressIndex, scheme).address === expectedAddress;
+}

package/dist/cjs/bytes.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Wasm-free byte utilities (RFC-031 Fix A).
+ *
+ * Byte-exact equivalents of the WASM kernels `bytes_to_hex` (uppercase, via
+ * `hex::encode_upper`), `hex_to_bytes` (strips a leading lowercase `0x`),
+ * and `concat_bytes`. Living outside `wasm-sync` lets pure consumers and the
+ * core root avoid loading the WASM artifact for hex/concat work.
+ */
+export declare function bytesToHex(bytes: Uint8Array): string;
+export declare function hexToBytes(hex: string): Uint8Array;
+export declare function concatBytes(...arrays: Uint8Array[]): Uint8Array;

package/dist/cjs/bytes.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * Wasm-free byte utilities (RFC-031 Fix A).
+ *
+ * Byte-exact equivalents of the WASM kernels `bytes_to_hex` (uppercase, via
+ * `hex::encode_upper`), `hex_to_bytes` (strips a leading lowercase `0x`),
+ * and `concat_bytes`. Living outside `wasm-sync` lets pure consumers and the
+ * core root avoid loading the WASM artifact for hex/concat work.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bytesToHex = bytesToHex;
+exports.hexToBytes = hexToBytes;
+exports.concatBytes = concatBytes;
+function bytesToHex(bytes) {
+    let s = '';
+    for (let i = 0; i < bytes.length; i++)
+        s += bytes[i].toString(16).padStart(2, '0');
+    return s.toUpperCase();
+}
+function hexToBytes(hex) {
+    const s = hex.startsWith('0x') ? hex.slice(2) : hex;
+    if (s.length % 2 !== 0)
+        throw new Error('Invalid hex: odd-length string');
+    const out = new Uint8Array(s.length >> 1);
+    for (let i = 0; i < out.length; i++) {
+        const pair = s.slice(i * 2, i * 2 + 2);
+        if (!/^[0-9a-fA-F]{2}$/.test(pair))
+            throw new Error(`Invalid hex: ${pair}`);
+        out[i] = parseInt(pair, 16);
+    }
+    return out;
+}
+function concatBytes(...arrays) {
+    let len = 0;
+    for (const a of arrays)
+        len += a.length;
+    const out = new Uint8Array(len);
+    let offset = 0;
+    for (const a of arrays) {
+        out.set(a, offset);
+        offset += a.length;
+    }
+    return out;
+}

package/dist/cjs/canonical-hash.d.ts

@@ -0,0 +1 @@
+export declare function hashCanonical(domain: string, value: unknown): string;

package/dist/cjs/canonical-hash.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashCanonical = hashCanonical;
+/**
+ * Canonical JSON hashing (RFC-031 Fix A).
+ *
+ * Split out of `canonical.ts` so that `canonicalJson`/`toHex` are wasm-free:
+ * only `hashCanonical` needs the WASM `sha3_256` kernel.
+ */
+const wasm_sync_js_1 = require("./wasm-sync.js");
+const canonical_js_1 = require("./canonical.js");
+function hashCanonical(domain, value) {
+    const input = domain + (0, canonical_js_1.canonicalJson)(value);
+    return (0, canonical_js_1.toHex)((0, wasm_sync_js_1.sha3_256)(new TextEncoder().encode(input)));
+}

package/dist/cjs/canonical.d.ts

@@ -1,3 +1,8 @@
+/**
+ * Canonical JSON + lowercase hex helpers (wasm-free).
+ *
+ * `hashCanonical` (which needs the WASM `sha3_256` kernel) lives in
+ * `canonical-hash.ts`.
+ */
 export declare function toHex(bytes: Uint8Array): string;
 export declare function canonicalJson(value: unknown): string;
-export declare function hashCanonical(domain: string, value: unknown): string;

package/dist/cjs/canonical.js

@@ -1,9 +1,13 @@
 "use strict";
+/**
+ * Canonical JSON + lowercase hex helpers (wasm-free).
+ *
+ * `hashCanonical` (which needs the WASM `sha3_256` kernel) lives in
+ * `canonical-hash.ts`.
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.toHex = toHex;
 exports.canonicalJson = canonicalJson;
-exports.hashCanonical = hashCanonical;
-const wasm_sync_js_1 = require("./wasm-sync.js");
 function toHex(bytes) {
     return Array.from(bytes)
         .map((b) => b.toString(16).padStart(2, '0'))
@@ -21,7 +25,3 @@ function canonicalJson(value) {
     const pairs = keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`);
     return '{' + pairs.join(',') + '}';
 }
-function hashCanonical(domain, value) {
-    const input = domain + canonicalJson(value);
-    return toHex((0, wasm_sync_js_1.sha3_256)(new TextEncoder().encode(input)));
-}

package/dist/cjs/index.d.ts

@@ -10,7 +10,7 @@ export * from './adapters/index.js';
 export { LeaseStore, WatermarkStore, LeaseMonitor, prepareLease, finalizeLease, flatIndexFromLanes, type StoredLease, type LeaseStatus, type LeaseStoreConfig, type LeaseWotsIndices, type WatermarkState, type SyncResult, type WatermarkStoreConfig, type LeaseExpiryEvent, type LeaseExpiryCallback, type LeaseMonitorConfig, type PrepareArgs, type PrepareResp, } from './lease/index.js';
 export { TransactionService, TransactionLifecycle, TransactionLifecycleError, WatermarkExhaustedError, TransactionReceiptStore, type TransactionServiceConfig, type WotsSigningDependencies, type TransactionLifecycleConfig, type WatermarkSyncFunction, type PrepareResult, type TransactionReceiptStoreConfig, type PrepareRequest, type PrepareResponse, type SignRequest, type SignResult, type HierarchicalWitnessBundle, type WitnessBundle, type FinalizeRequest, type FinalizeResponse, type TransactionMetadata, type TransactionReceipt, type TransactionError, } from './tx/index.js';
 export type { WotsIndices } from './tx/index.js';
-export { bytesToHex, hexToBytes, concatBytes } from './wasm-sync.js';
+export { bytesToHex, hexToBytes, concatBytes } from './bytes.js';
 export { sha3_256 } from './wasm-sync.js';
 export { expandPrivateKey, hashChain, derivePKdigest, deriveFullPublicKey, wotsSign, wotsVerify, wotsVerifyDigest, wotsPkFromSig, wotsPublicKeyFromSeed, wotsKeypairFromSeed, } from './wasm-sync.js';
 export * from './params.js';
@@ -28,17 +28,20 @@ export { makeMxAddress as encodeMx, parseMxAddress as decodeMx } from './wasm-sy
 export declare function mxToHex(address: string): string;
 export * from './mmr.js';
 export * from './scripts/index.js';
+export { toNodeScript } from './scripts/canonical.js';
 export { scriptToAddress, addressToRoot } from './derive.js';
 export { WORD_LIST, convertStringToSeed, convertWordListToSeed, generateSeedPhrase, } from './bip39.js';
 export { MiniNumber } from './MiniNumber.js';
 export { type MinimaTransaction, type MinimaCoin, type ParsedMiniNumber, type MinimaToken, type StateVariable, type RawStateVariable, type CoinProofData, type SpendableCoinInput, type TransactionBuildResult, parseDecimalToMiniNumber, serializeCoin, serializeTransaction as serializeTransactionObject, computeTokenId, serializeTokenDescriptor, createDefaultTransaction, buildMinimaCoin, } from './transaction.js';
 export { verifySignature, verifySignatureDetailed, verifyTreeSignatureDetailed, deriveAddressFromPublicKey, normalizeHex, type VerificationResult, } from './verify.js';
+export { deriveDeterministicAddress, deriveUnifiedAddress, deriveAddress, verifyDeterministicAddress, type AddressScheme, type DerivedAddress, } from './address-derivation.js';
 export { writeMiniByte, writeMMREntryNumber, writeSignature, writeSignatureProof, concat, bigIntToByteArray, type Bytes, } from './Streamable.js';
 export { serializeMiniNumber, serializeMiniData, hashAllObjects, deriveChildTreeSeedJava, hashObject, serializeMiniNumberZERO, serializeMiniNumberONE, writeHashToStream, javaHashAllObjects, indexToMiniDataBytes, deriveUnifiedChildSeed, createMMREntryNumber, serializeMMREntryNumber, serializeMMRData, serializeMMREntry, type MMREntryNumber as JavaMMREntryNumber, type MMRData as JavaMMRData, type MMREntry as JavaMMREntry, } from './javaStreamables.js';
 export { TreeKey, TreeKeyNode, serializeTreeSignature, deserializeTreeSignature, getRootPublicKey, DEFAULT_KEYS_PER_LEVEL, DEFAULT_LEVELS, createUnifiedChildTreeKeyAsync, createPerAddressTreeKey, createPerAddressTreeKeyAsync, setTreeKeyLogger, disableTreeKeyLogger, type KeyGenProgress, type ProgressCallback, type SignatureProof, type TreeSignature, } from './treekey.js';
 export type { WotsKeypair, WotsSignature } from './wots.js';
 export { F, hex, fromHex, setWotsLogger, disableWotsLogger, u16be, u32be, assert32, h, prfChainSeed, toWinternitzDigits, baseWWithChecksum, wotsSignLegacy, } from './wots.js';
-export { toHex, canonicalJson, hashCanonical } from './canonical.js';
+export { toHex, canonicalJson } from './canonical.js';
+export { hashCanonical } from './canonical-hash.js';
 export { utf8ToBytes, bytesToUtf8 } from './utils.js';
 export declare const MINIMA_CONSTANTS: {
     readonly WOTS_W: 8;