@txnod/sdk 1.0.1

package/dist/internals/parse-problem-details.js

@@ -0,0 +1,76 @@
+import { TxnodError } from '../errors.js';
+import { CODE_TO_CTOR, RETRY_AFTER_CODES, } from './error-ctor-map.js';
+function degraded(status) {
+    const raw = {
+        type: 'about:blank',
+        title: 'Non-compliant error response',
+        status,
+        error_code: 'internal_error',
+        request_id: '',
+    };
+    return new TxnodError(raw);
+}
+function isRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+// Duplicated from fetch-with-retry.ts#parseRetryAfterSeconds — do not cross-import; keep in sync.
+// RFC 7231 §7.1.3 allows either delta-seconds or HTTP-date. The cap defends
+// against a hostile/glitching upstream returning a far-future date that would
+// otherwise stall caller-side retry logic for hours.
+const RETRY_AFTER_CAP_SECONDS = 600;
+function parseRetryAfter(response) {
+    const header = response.headers.get('Retry-After');
+    if (header === null)
+        return 0;
+    const trimmed = header.trim();
+    let raw;
+    if (/^\d+$/.test(trimmed)) {
+        const n = parseInt(trimmed, 10);
+        raw = Number.isFinite(n) && n > 0 ? n : 0;
+    }
+    else {
+        const ms = Date.parse(header);
+        if (!Number.isFinite(ms))
+            return 0;
+        const deltaSec = Math.ceil((ms - Date.now()) / 1000);
+        raw = deltaSec > 0 ? deltaSec : 0;
+    }
+    return Math.min(raw, RETRY_AFTER_CAP_SECONDS);
+}
+export async function parseProblemDetails(response) {
+    const text = await response.text();
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return degraded(response.status);
+    }
+    if (!isRecord(parsed))
+        return degraded(response.status);
+    const { type, title, status, error_code, request_id, errors, wallet_id } = parsed;
+    if (type !== 'about:blank' ||
+        typeof title !== 'string' ||
+        typeof status !== 'number' ||
+        typeof error_code !== 'string' ||
+        typeof request_id !== 'string') {
+        return degraded(response.status);
+    }
+    const details = {
+        type: 'about:blank',
+        title,
+        status,
+        error_code: error_code,
+        request_id,
+        ...(Array.isArray(errors) ? { errors: errors } : {}),
+        ...(typeof wallet_id === 'string' ? { wallet_id } : {}),
+    };
+    const Ctor = CODE_TO_CTOR[details.error_code];
+    if (Ctor === undefined)
+        return degraded(response.status);
+    if (RETRY_AFTER_CODES.has(details.error_code)) {
+        return new Ctor(details, parseRetryAfter(response));
+    }
+    return new Ctor(details);
+}
+//# sourceMappingURL=parse-problem-details.js.map

package/dist/internals/parse-problem-details.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-problem-details.js","sourceRoot":"","sources":["../../src/internals/parse-problem-details.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,YAAY,EACZ,iBAAiB,GAGlB,MAAM,qBAAqB,CAAC;AAE7B,SAAS,QAAQ,CAAC,MAAc;IAC9B,MAAM,GAAG,GAAmB;QAC1B,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,8BAA8B;QACrC,MAAM;QACN,UAAU,EAAE,gBAAgB;QAC5B,UAAU,EAAE,EAAE;KACf,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,kGAAkG;AAClG,4EAA4E;AAC5E,8EAA8E;AAC9E,qDAAqD;AACrD,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,SAAS,eAAe,CAAC,QAAkB;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,GAAW,CAAC;IAChB,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACrD,GAAG,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAExD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,GACtE,MAAM,CAAC;IACT,IACE,IAAI,KAAK,aAAa;QACtB,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,UAAU,KAAK,QAAQ,EAC9B,CAAC;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,OAAO,GAAmB;QAC9B,IAAI,EAAE,aAAa;QACnB,KAAK;QACL,MAAM;QACN,UAAU,EAAE,UAA0C;QACtD,UAAU;QACV,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;IAEF,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAK,IAAuB,CAAC,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAK,IAAkB,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC"}

package/dist/internals/synthetic-details.d.ts

@@ -0,0 +1,12 @@
+import type { ErrorCode, ProblemDetails } from '../_shared/index.js';
+/**
+ * Builds a stand-in `ProblemDetails` envelope for SDK-thrown errors that
+ * never received a server response (webhook signature failures, address
+ * verification failures, etc.). Used internally by `TxnodSignatureFormatError`,
+ * `TxnodHmacError`, `TxnodTimestampError`, and `AddressVerificationError`
+ * so they can extend `TxnodError` while still satisfying the RFC-7807
+ * envelope shape. Internal helper — not re-exported from the package barrel;
+ * partners should not subclass `TxnodError`.
+ */
+export declare function syntheticDetails(error_code: ErrorCode, status: number, title: string): ProblemDetails;
+//# sourceMappingURL=synthetic-details.d.ts.map

package/dist/internals/synthetic-details.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"synthetic-details.d.ts","sourceRoot":"","sources":["../../src/internals/synthetic-details.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/D;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,SAAS,EACrB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,cAAc,CAQhB"}

package/dist/internals/synthetic-details.js

@@ -0,0 +1,19 @@
+/**
+ * Builds a stand-in `ProblemDetails` envelope for SDK-thrown errors that
+ * never received a server response (webhook signature failures, address
+ * verification failures, etc.). Used internally by `TxnodSignatureFormatError`,
+ * `TxnodHmacError`, `TxnodTimestampError`, and `AddressVerificationError`
+ * so they can extend `TxnodError` while still satisfying the RFC-7807
+ * envelope shape. Internal helper — not re-exported from the package barrel;
+ * partners should not subclass `TxnodError`.
+ */
+export function syntheticDetails(error_code, status, title) {
+    return {
+        type: 'about:blank',
+        title,
+        status,
+        error_code,
+        request_id: '',
+    };
+}
+//# sourceMappingURL=synthetic-details.js.map

package/dist/internals/synthetic-details.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"synthetic-details.js","sourceRoot":"","sources":["../../src/internals/synthetic-details.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAqB,EACrB,MAAc,EACd,KAAa;IAEb,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,KAAK;QACL,MAAM;QACN,UAAU;QACV,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC"}

package/dist/verify/chains/bsc.d.ts

@@ -0,0 +1,17 @@
+/**
+ * BNB Smart Chain verification — shares BIP-44 coin_type=60' with Ethereum
+ * (architecture addendum §4.4). Cross-checked byte-for-byte against server-side
+ * derivation in apps/web/lib/derivation/evm.ts.
+ *
+ * Sources:
+ *   - PRD FR96.
+ *   - Architecture addendum §4.1, §4.3, §4.4, AD-7.
+ */
+export interface VerifyBscInput {
+    xpub: string;
+    derivation_path: string;
+    expected_address: string;
+}
+/** Throws AddressVerificationError on mismatch; returns void on success. */
+export declare function verifyBsc(input: VerifyBscInput): void;
+//# sourceMappingURL=bsc.d.ts.map

package/dist/verify/chains/bsc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bsc.d.ts","sourceRoot":"","sources":["../../../src/verify/chains/bsc.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,4EAA4E;AAC5E,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAErD"}

package/dist/verify/chains/bsc.js

@@ -0,0 +1,15 @@
+/**
+ * BNB Smart Chain verification — shares BIP-44 coin_type=60' with Ethereum
+ * (architecture addendum §4.4). Cross-checked byte-for-byte against server-side
+ * derivation in apps/web/lib/derivation/evm.ts.
+ *
+ * Sources:
+ *   - PRD FR96.
+ *   - Architecture addendum §4.1, §4.3, §4.4, AD-7.
+ */
+import { verifyEvm } from './evm.js';
+/** Throws AddressVerificationError on mismatch; returns void on success. */
+export function verifyBsc(input) {
+    verifyEvm({ ...input, chain: 'bsc' });
+}
+//# sourceMappingURL=bsc.js.map

package/dist/verify/chains/bsc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bsc.js","sourceRoot":"","sources":["../../../src/verify/chains/bsc.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAQrC,4EAA4E;AAC5E,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACxC,CAAC"}

package/dist/verify/chains/btc.d.ts

@@ -0,0 +1,22 @@
+/**
+ * BTC native-SegWit (BIP-84) verification.
+ * Cross-checked byte-for-byte against server-side derivation in
+ * apps/web/lib/derivation/btc.ts (Story 25.3 AC 9 fixture vectors).
+ *
+ * Sources:
+ *   - PRD FR96: SDK locally verifies createInvoice address derives from xpub.
+ *   - Architecture addendum §4.1, §4.3, AD-7.
+ *   - Discovery §C.6 (Paul Miller / @noble / @scure family rationale),
+ *     §E.1 (path 3 — audited deps + CI guard),
+ *     sub-idea #2.1 (BTC SegWit-only default — Taproot deferred).
+ *   - BIP-84 (https://github.com/bitcoin/bips/blob/master/bip-0084.mediawiki).
+ *   - BIP-173 (https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki).
+ */
+export interface VerifyBtcInput {
+    xpub: string;
+    derivation_path: string;
+    expected_address: string;
+}
+/** Throws AddressVerificationError on mismatch; returns void on success. */
+export declare function verifyBtc(input: VerifyBtcInput): void;
+//# sourceMappingURL=btc.d.ts.map

package/dist/verify/chains/btc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"btc.d.ts","sourceRoot":"","sources":["../../../src/verify/chains/btc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,4EAA4E;AAC5E,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAkCrD"}

package/dist/verify/chains/btc.js

@@ -0,0 +1,55 @@
+/**
+ * BTC native-SegWit (BIP-84) verification.
+ * Cross-checked byte-for-byte against server-side derivation in
+ * apps/web/lib/derivation/btc.ts (Story 25.3 AC 9 fixture vectors).
+ *
+ * Sources:
+ *   - PRD FR96: SDK locally verifies createInvoice address derives from xpub.
+ *   - Architecture addendum §4.1, §4.3, AD-7.
+ *   - Discovery §C.6 (Paul Miller / @noble / @scure family rationale),
+ *     §E.1 (path 3 — audited deps + CI guard),
+ *     sub-idea #2.1 (BTC SegWit-only default — Taproot deferred).
+ *   - BIP-84 (https://github.com/bitcoin/bips/blob/master/bip-0084.mediawiki).
+ *   - BIP-173 (https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki).
+ */
+import { sha256 } from '@noble/hashes/sha2.js';
+import { ripemd160 } from '@noble/hashes/legacy.js';
+import { bech32 } from '@scure/base';
+import { deriveSecp256k1ChildPubkey } from './secp256k1-bip32.js';
+import { AddressVerificationError } from '../errors.js';
+/** Throws AddressVerificationError on mismatch; returns void on success. */
+export function verifyBtc(input) {
+    const sentinel = '<unsupported BTC address format — only bc1/tb1 native segwit (BIP-84) supported>';
+    let hrp;
+    if (input.expected_address.startsWith('bc1q'))
+        hrp = 'bc';
+    else if (input.expected_address.startsWith('tb1q'))
+        hrp = 'tb';
+    else {
+        throw new AddressVerificationError({
+            chain: 'btc',
+            derivation_path: input.derivation_path,
+            expected_address: input.expected_address,
+            derived_address: sentinel,
+        });
+    }
+    // `deriveSecp256k1ChildPubkey` strips/re-prepends the BIP-32 version
+    // bytes internally (single source of truth — see secp256k1-bip32.ts).
+    // Any of xpub / tpub / zpub / vpub is accepted as input here.
+    const pubkey = deriveSecp256k1ChildPubkey({
+        xpub: input.xpub,
+        derivation_path: input.derivation_path,
+    });
+    const program = ripemd160(sha256(pubkey));
+    const words = [0, ...bech32.toWords(program)];
+    const derived = bech32.encode(hrp, words);
+    if (derived !== input.expected_address) {
+        throw new AddressVerificationError({
+            chain: 'btc',
+            derivation_path: input.derivation_path,
+            expected_address: input.expected_address,
+            derived_address: derived,
+        });
+    }
+}
+//# sourceMappingURL=btc.js.map

package/dist/verify/chains/btc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"btc.js","sourceRoot":"","sources":["../../../src/verify/chains/btc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAQxD,4EAA4E;AAC5E,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,MAAM,QAAQ,GACZ,kFAAkF,CAAC;IACrF,IAAI,GAAgB,CAAC;IACrB,IAAI,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,GAAG,GAAG,IAAI,CAAC;SACrD,IAAI,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,GAAG,GAAG,IAAI,CAAC;SAC1D,CAAC;QACJ,MAAM,IAAI,wBAAwB,CAAC;YACjC,KAAK,EAAE,KAAK;YACZ,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,QAAQ;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,sEAAsE;IACtE,8DAA8D;IAC9D,MAAM,MAAM,GAAG,0BAA0B,CAAC;QACxC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE1C,IAAI,OAAO,KAAK,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,IAAI,wBAAwB,CAAC;YACjC,KAAK,EAAE,KAAK;YACZ,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,OAAO;SACzB,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/verify/chains/cardano.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Cardano CIP-1852 verification — full base_address reconstruction defending
+ * against the NFR-S11 stake-substitution attack class.
+ * Cross-checked byte-for-byte against server-side derivation in
+ * apps/web/lib/derivation/cardano.ts.
+ *
+ * Sources:
+ *   - PRD FR96: SDK locally verifies createInvoice address derives from xpub.
+ *   - PRD NFR-S11: full base-address reconstruction (no stake-only compares).
+ *   - Architecture addendum §4.1, §4.3.
+ *   - Discovery §E.2 (stake-substitution attack analysis),
+ *     §C.3 (~200 LOC hand-rolled CIP-1852 budget).
+ *   - CIP-1852 (https://cips.cardano.org/cip/CIP-1852).
+ *   - CIP-19 (https://cips.cardano.org/cip/CIP-19).
+ *   - BIP32-Ed25519 paper, Khovratovich & Law:
+ *     https://input-output-hk.github.io/adrestia/static/Ed25519_BIP.pdf
+ *   - Reference impl: LedgerHQ/orakolo/HDEd25519.py.
+ */
+/**
+ * Input shape for `verifyCardano`. Network is inferred from the bech32 HRP of
+ * `expected_address` (`addr1…` mainnet, `addr_test1…` testnet).
+ *
+ * @example
+ * ```ts
+ * import { verifyCardano, type VerifyCardanoInput } from '@txnod/sdk';
+ *
+ * const input: VerifyCardanoInput = {
+ *   xpub: 'acct_xvk1amspej3axrnc6p7cf0xaer365l2770744w5mhzu3l8seackc96pszurk0e6mlmd9dg9zkzsvw9sx7h5llkmu604r8eqhz7nw92fmn7qtfjwwy',
+ *   derivation_path: "m/1852'/1815'/0'/0/0",
+ *   expected_address: 'addr1q8sv3r5ve3dftjlv34jma0xx9kd84dzrxudsjkte5vsdd5fht2sfxl6wpe6c9m6jzpey8tzavkkyjgvjc6dluvar65js8mfsuy',
+ * };
+ * verifyCardano(input);
+ * ```
+ */
+export interface VerifyCardanoInput {
+    xpub: string;
+    derivation_path: string;
+    expected_address: string;
+}
+/**
+ * Locally verify that a Cardano `addr1…` / `addr_test1…` base address derives
+ * from the operator's CIP-5 `acct_xvk1…` account-extended verification key at
+ * the given CIP-1852 payment path. Reconstructs the FULL base address — both
+ * `payment_key_hash` (path `0/index`) AND `stake_key_hash` (path `2/0`) — and
+ * compares the full bech32 string. This closes NFR-S11: an attacker who
+ * controls a payment keypair cannot have an `evil_payment_hash || legit_stake_hash`
+ * address pass verification, because the SDK rederives both halves from the
+ * operator's account xvk and rejects on mismatch.
+ *
+ * Throws `AddressVerificationError` on mismatch (or unsupported HRP).
+ * Throws `TxnodInvalidXpubFormatError` on malformed xpub or path.
+ *
+ * @example
+ * ```ts
+ * import { verifyCardano, AddressVerificationError } from '@txnod/sdk';
+ *
+ * try {
+ *   verifyCardano({
+ *     xpub: 'acct_xvk1amspej3axrnc6p7cf0xaer365l2770744w5mhzu3l8seackc96pszurk0e6mlmd9dg9zkzsvw9sx7h5llkmu604r8eqhz7nw92fmn7qtfjwwy',
+ *     derivation_path: "m/1852'/1815'/0'/0/0",
+ *     expected_address: 'addr1q8sv3r5ve3dftjlv34jma0xx9kd84dzrxudsjkte5vsdd5fht2sfxl6wpe6c9m6jzpey8tzavkkyjgvjc6dluvar65js8mfsuy',
+ *   });
+ * } catch (err) {
+ *   if (err instanceof AddressVerificationError) {
+ *     console.error('ada verify failed', err.expected_address, err.derived_address);
+ *   } else {
+ *     throw err;
+ *   }
+ * }
+ * ```
+ */
+export declare function verifyCardano(input: VerifyCardanoInput): void;
+//# sourceMappingURL=cardano.d.ts.map

package/dist/verify/chains/cardano.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cardano.d.ts","sourceRoot":"","sources":["../../../src/verify/chains/cardano.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAWH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AA+GD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CA8C7D"}

package/dist/verify/chains/cardano.js

@@ -0,0 +1,175 @@
+/**
+ * Cardano CIP-1852 verification — full base_address reconstruction defending
+ * against the NFR-S11 stake-substitution attack class.
+ * Cross-checked byte-for-byte against server-side derivation in
+ * apps/web/lib/derivation/cardano.ts.
+ *
+ * Sources:
+ *   - PRD FR96: SDK locally verifies createInvoice address derives from xpub.
+ *   - PRD NFR-S11: full base-address reconstruction (no stake-only compares).
+ *   - Architecture addendum §4.1, §4.3.
+ *   - Discovery §E.2 (stake-substitution attack analysis),
+ *     §C.3 (~200 LOC hand-rolled CIP-1852 budget).
+ *   - CIP-1852 (https://cips.cardano.org/cip/CIP-1852).
+ *   - CIP-19 (https://cips.cardano.org/cip/CIP-19).
+ *   - BIP32-Ed25519 paper, Khovratovich & Law:
+ *     https://input-output-hk.github.io/adrestia/static/Ed25519_BIP.pdf
+ *   - Reference impl: LedgerHQ/orakolo/HDEd25519.py.
+ */
+import * as ed from '@noble/ed25519';
+import { blake2b } from '@noble/hashes/blake2.js';
+import { hmac } from '@noble/hashes/hmac.js';
+import { sha512 } from '@noble/hashes/sha2.js';
+import { bech32 } from '@scure/base';
+import { TxnodInvalidXpubFormatError } from '../../errors.js';
+import { syntheticDetails } from '../../internals/synthetic-details.js';
+import { AddressVerificationError } from '../errors.js';
+function pathError(message) {
+    return new TxnodInvalidXpubFormatError(syntheticDetails('invalid_xpub_format', 400, message));
+}
+function parseAccountXvk(xpub) {
+    const decoded = bech32.decode(xpub, false);
+    if (decoded.prefix !== 'acct_xvk') {
+        throw pathError(`xpub must be a CIP-5 'acct_xvk' bech32 string; got prefix '${decoded.prefix}'.`);
+    }
+    const bytes = bech32.fromWords(decoded.words);
+    if (bytes.length !== 64) {
+        throw pathError(`acct_xvk must decode to 64 bytes (32-byte pubkey + 32-byte chain-code); got ${bytes.length}.`);
+    }
+    return { A: bytes.slice(0, 32), c: bytes.slice(32, 64) };
+}
+function parsePaymentPath(path) {
+    const segments = path.split('/');
+    if (segments.length < 3 || segments[0] !== 'm') {
+        throw pathError(`derivation_path '${path}' must begin with 'm' and have at least 2 segments after 'm'.`);
+    }
+    const role = segments[segments.length - 2] ?? '';
+    const index = segments[segments.length - 1] ?? '';
+    if (role.endsWith("'") || index.endsWith("'")) {
+        throw pathError(`derivation_path '${path}' last two segments must be non-hardened (no apostrophe suffix).`);
+    }
+    if (!/^\d+$/.test(role) || !/^\d+$/.test(index)) {
+        throw pathError(`derivation_path '${path}' last two segments must be unsigned integers.`);
+    }
+    if (role !== '0') {
+        throw pathError(`derivation_path '${path}' role segment must be 0 (CIP-1852 external chain) for payment leaves; got '${role}'.`);
+    }
+    return { index: Number(index) };
+}
+function le32(i) {
+    const b = new Uint8Array(4);
+    b[0] = i & 0xff;
+    b[1] = (i >>> 8) & 0xff;
+    b[2] = (i >>> 16) & 0xff;
+    b[3] = (i >>> 24) & 0xff;
+    return b;
+}
+function bytesToNumberLE(b) {
+    let n = 0n;
+    for (let i = b.length - 1; i >= 0; i--) {
+        n = (n << 8n) | BigInt(b[i]);
+    }
+    return n;
+}
+function concat(...parts) {
+    let total = 0;
+    for (const p of parts)
+        total += p.length;
+    const out = new Uint8Array(total);
+    let off = 0;
+    for (const p of parts) {
+        out.set(p, off);
+        off += p.length;
+    }
+    return out;
+}
+function softCKDpub(parent, i) {
+    if (!Number.isInteger(i) || i < 0 || i >= 0x80000000) {
+        throw pathError(`child index ${i} out of range for non-hardened BIP32-Ed25519 derivation.`);
+    }
+    const idx = le32(i);
+    const Z = hmac(sha512, parent.c, concat(new Uint8Array([0x02]), parent.A, idx));
+    const childChain = hmac(sha512, parent.c, concat(new Uint8Array([0x03]), parent.A, idx)).slice(32, 64);
+    const ZL = Z.slice(0, 28);
+    const k = 8n * bytesToNumberLE(ZL);
+    const A_i = k === 0n
+        ? parent.A
+        : ed.Point.fromBytes(parent.A).add(ed.Point.BASE.multiply(k)).toBytes();
+    return { A: A_i, c: childChain };
+}
+/**
+ * Locally verify that a Cardano `addr1…` / `addr_test1…` base address derives
+ * from the operator's CIP-5 `acct_xvk1…` account-extended verification key at
+ * the given CIP-1852 payment path. Reconstructs the FULL base address — both
+ * `payment_key_hash` (path `0/index`) AND `stake_key_hash` (path `2/0`) — and
+ * compares the full bech32 string. This closes NFR-S11: an attacker who
+ * controls a payment keypair cannot have an `evil_payment_hash || legit_stake_hash`
+ * address pass verification, because the SDK rederives both halves from the
+ * operator's account xvk and rejects on mismatch.
+ *
+ * Throws `AddressVerificationError` on mismatch (or unsupported HRP).
+ * Throws `TxnodInvalidXpubFormatError` on malformed xpub or path.
+ *
+ * @example
+ * ```ts
+ * import { verifyCardano, AddressVerificationError } from '@txnod/sdk';
+ *
+ * try {
+ *   verifyCardano({
+ *     xpub: 'acct_xvk1amspej3axrnc6p7cf0xaer365l2770744w5mhzu3l8seackc96pszurk0e6mlmd9dg9zkzsvw9sx7h5llkmu604r8eqhz7nw92fmn7qtfjwwy',
+ *     derivation_path: "m/1852'/1815'/0'/0/0",
+ *     expected_address: 'addr1q8sv3r5ve3dftjlv34jma0xx9kd84dzrxudsjkte5vsdd5fht2sfxl6wpe6c9m6jzpey8tzavkkyjgvjc6dluvar65js8mfsuy',
+ *   });
+ * } catch (err) {
+ *   if (err instanceof AddressVerificationError) {
+ *     console.error('ada verify failed', err.expected_address, err.derived_address);
+ *   } else {
+ *     throw err;
+ *   }
+ * }
+ * ```
+ */
+export function verifyCardano(input) {
+    const sentinel = '<unsupported Cardano address format — only addr1/addr_test1 base addresses (CIP-19 Type 0) supported>';
+    let hrp;
+    let networkId;
+    if (input.expected_address.startsWith('addr_test1')) {
+        hrp = 'addr_test';
+        networkId = 0;
+    }
+    else if (input.expected_address.startsWith('addr1')) {
+        hrp = 'addr';
+        networkId = 1;
+    }
+    else {
+        throw new AddressVerificationError({
+            chain: 'ada',
+            derivation_path: input.derivation_path,
+            expected_address: input.expected_address,
+            derived_address: sentinel,
+        });
+    }
+    const acct = parseAccountXvk(input.xpub);
+    const { index } = parsePaymentPath(input.derivation_path);
+    const paymentRole = softCKDpub(acct, 0);
+    const paymentLeaf = softCKDpub(paymentRole, index);
+    const stakeRole = softCKDpub(acct, 2);
+    const stakeLeaf = softCKDpub(stakeRole, 0);
+    const paymentKeyHash = blake2b(paymentLeaf.A, { dkLen: 28 });
+    const stakeKeyHash = blake2b(stakeLeaf.A, { dkLen: 28 });
+    const headerByte = (0x0 << 4) | networkId;
+    const raw = new Uint8Array(57);
+    raw[0] = headerByte;
+    raw.set(paymentKeyHash, 1);
+    raw.set(stakeKeyHash, 29);
+    const derived = bech32.encode(hrp, bech32.toWords(raw), false);
+    if (derived !== input.expected_address) {
+        throw new AddressVerificationError({
+            chain: 'ada',
+            derivation_path: input.derivation_path,
+            expected_address: input.expected_address,
+            derived_address: derived,
+        });
+    }
+}
+//# sourceMappingURL=cardano.js.map

package/dist/verify/chains/cardano.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cardano.js","sourceRoot":"","sources":["../../../src/verify/chains/cardano.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AA6BxD,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,IAAI,2BAA2B,CACpC,gBAAgB,CAAC,qBAAqB,EAAE,GAAG,EAAE,OAAO,CAAC,CACtD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAA6B,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,SAAS,CACb,8DAA8D,OAAO,CAAC,MAAM,IAAI,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,SAAS,CACb,+EAA+E,KAAK,CAAC,MAAM,GAAG,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAC/C,MAAM,SAAS,CACb,oBAAoB,IAAI,+DAA+D,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,SAAS,CACb,oBAAoB,IAAI,kEAAkE,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,CACb,oBAAoB,IAAI,gDAAgD,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,SAAS,CACb,oBAAoB,IAAI,+EAA+E,IAAI,IAAI,CAChH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,eAAe,CAAC,CAAa;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,KAAmB;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,MAAmB,EAAE,CAAS;IAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;QACrD,MAAM,SAAS,CACb,eAAe,CAAC,0DAA0D,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,CAAC,GAAG,IAAI,CACZ,MAAM,EACN,MAAM,CAAC,CAAC,EACR,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAC9C,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,MAAM,CAAC,CAAC,EACR,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAC9C,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAChB,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,GAAG,GACP,CAAC,KAAK,EAAE;QACN,CAAC,CAAC,MAAM,CAAC,CAAC;QACV,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5E,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,MAAM,QAAQ,GACZ,uGAAuG,CAAC;IAC1G,IAAI,GAAyB,CAAC;IAC9B,IAAI,SAAgB,CAAC;IACrB,IAAI,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpD,GAAG,GAAG,WAAW,CAAC;QAClB,SAAS,GAAG,CAAC,CAAC;IAChB,CAAC;SAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,GAAG,GAAG,MAAM,CAAC;QACb,SAAS,GAAG,CAAC,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,wBAAwB,CAAC;YACjC,KAAK,EAAE,KAAK;YACZ,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,QAAQ;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAE1D,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAE3C,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAEzD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;IACpB,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAC3B,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAE1B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/D,IAAI,OAAO,KAAK,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,IAAI,wBAAwB,CAAC;YACjC,KAAK,EAAE,KAAK;YACZ,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,OAAO;SACzB,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/verify/chains/evm.d.ts

@@ -0,0 +1,21 @@
+/**
+ * EVM (ETH / Polygon PoS / BSC) verification — BIP-44 coin_type=60'.
+ * Cross-checked byte-for-byte against server-side derivation in
+ * apps/web/lib/derivation/evm.ts (Story 25.3 AC 9 fixture vectors).
+ *
+ * Sources:
+ *   - PRD FR96: SDK locally verifies createInvoice address derives from xpub.
+ *   - Architecture addendum §4.1, §4.3, §4.4 (EVM triplet shares coin_type=60'), AD-7.
+ *   - Discovery §C.6, §E.1.
+ *   - EIP-55 (https://eips.ethereum.org/EIPS/eip-55).
+ *   - SLIP-0044 coin_type=60 (https://github.com/satoshilabs/slips/blob/master/slip-0044.md).
+ */
+export interface VerifyEvmInput {
+    xpub: string;
+    derivation_path: string;
+    expected_address: string;
+    chain: 'eth' | 'polygon' | 'bsc';
+}
+/** Throws AddressVerificationError on mismatch; returns void on success. */
+export declare function verifyEvm(input: VerifyEvmInput): void;
+//# sourceMappingURL=evm.d.ts.map

package/dist/verify/chains/evm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evm.d.ts","sourceRoot":"","sources":["../../../src/verify/chains/evm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAmBH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,CAAC;CAClC;AAED,4EAA4E;AAC5E,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAiBrD"}

package/dist/verify/chains/evm.js

@@ -0,0 +1,46 @@
+/**
+ * EVM (ETH / Polygon PoS / BSC) verification — BIP-44 coin_type=60'.
+ * Cross-checked byte-for-byte against server-side derivation in
+ * apps/web/lib/derivation/evm.ts (Story 25.3 AC 9 fixture vectors).
+ *
+ * Sources:
+ *   - PRD FR96: SDK locally verifies createInvoice address derives from xpub.
+ *   - Architecture addendum §4.1, §4.3, §4.4 (EVM triplet shares coin_type=60'), AD-7.
+ *   - Discovery §C.6, §E.1.
+ *   - EIP-55 (https://eips.ethereum.org/EIPS/eip-55).
+ *   - SLIP-0044 coin_type=60 (https://github.com/satoshilabs/slips/blob/master/slip-0044.md).
+ */
+import { secp256k1 } from '@noble/curves/secp256k1.js';
+import { keccak_256 } from '@noble/hashes/sha3.js';
+import { deriveSecp256k1ChildPubkey } from './secp256k1-bip32.js';
+import { AddressVerificationError } from '../errors.js';
+function eip55Encode(bytes20) {
+    const lowerHex = Array.from(bytes20, (b) => b.toString(16).padStart(2, '0')).join('');
+    const hashed = keccak_256(new TextEncoder().encode(lowerHex));
+    const hashedHex = Array.from(hashed, (b) => b.toString(16).padStart(2, '0')).join('');
+    let out = '0x';
+    for (let i = 0; i < 40; i++) {
+        const ch = lowerHex.charAt(i);
+        out += parseInt(hashedHex.charAt(i), 16) >= 8 ? ch.toUpperCase() : ch;
+    }
+    return out;
+}
+/** Throws AddressVerificationError on mismatch; returns void on success. */
+export function verifyEvm(input) {
+    const pubkey = deriveSecp256k1ChildPubkey({
+        xpub: input.xpub,
+        derivation_path: input.derivation_path,
+    });
+    const uncompressed = secp256k1.Point.fromBytes(pubkey).toBytes(false);
+    const addressBytes = keccak_256(uncompressed.slice(1)).slice(-20);
+    const derived = eip55Encode(addressBytes);
+    if (derived !== input.expected_address) {
+        throw new AddressVerificationError({
+            chain: input.chain,
+            derivation_path: input.derivation_path,
+            expected_address: input.expected_address,
+            derived_address: derived,
+        });
+    }
+}
+//# sourceMappingURL=evm.js.map

package/dist/verify/chains/evm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evm.js","sourceRoot":"","sources":["../../../src/verify/chains/evm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAExD,SAAS,WAAW,CAAC,OAAmB;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtF,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9B,GAAG,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD,4EAA4E;AAC5E,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,MAAM,MAAM,GAAG,0BAA0B,CAAC;QACxC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IAE1C,IAAI,OAAO,KAAK,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,IAAI,wBAAwB,CAAC;YACjC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,OAAO;SACzB,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/verify/chains/polygon.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Polygon PoS verification — shares BIP-44 coin_type=60' with Ethereum
+ * (architecture addendum §4.4). Cross-checked byte-for-byte against server-side
+ * derivation in apps/web/lib/derivation/evm.ts.
+ *
+ * Sources:
+ *   - PRD FR96.
+ *   - Architecture addendum §4.1, §4.3, §4.4, AD-7.
+ */
+export interface VerifyPolygonInput {
+    xpub: string;
+    derivation_path: string;
+    expected_address: string;
+}
+/** Throws AddressVerificationError on mismatch; returns void on success. */
+export declare function verifyPolygon(input: VerifyPolygonInput): void;
+//# sourceMappingURL=polygon.d.ts.map

package/dist/verify/chains/polygon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"polygon.d.ts","sourceRoot":"","sources":["../../../src/verify/chains/polygon.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAE7D"}

package/dist/verify/chains/polygon.js

@@ -0,0 +1,15 @@
+/**
+ * Polygon PoS verification — shares BIP-44 coin_type=60' with Ethereum
+ * (architecture addendum §4.4). Cross-checked byte-for-byte against server-side
+ * derivation in apps/web/lib/derivation/evm.ts.
+ *
+ * Sources:
+ *   - PRD FR96.
+ *   - Architecture addendum §4.1, §4.3, §4.4, AD-7.
+ */
+import { verifyEvm } from './evm.js';
+/** Throws AddressVerificationError on mismatch; returns void on success. */
+export function verifyPolygon(input) {
+    verifyEvm({ ...input, chain: 'polygon' });
+}
+//# sourceMappingURL=polygon.js.map

package/dist/verify/chains/polygon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"polygon.js","sourceRoot":"","sources":["../../../src/verify/chains/polygon.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAQrC,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;AAC5C,CAAC"}