@unchainedshop/plugins 3.1.13 → 4.0.0-rc.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unchainedshop/plugins",
-  "version": "3.1.13",
+  "version": "4.0.0-rc.3",
   "main": "lib/plugins-index.js",
   "types": "lib/plugins-index.d.ts",
   "exports": {
@@ -34,46 +34,45 @@
   },
   "homepage": "https://github.com/unchainedshop/unchained#readme",
   "dependencies": {
-    "@breejs/later": "^4.2.0",
-    "@unchainedshop/api": "^3.1.12",
-    "@unchainedshop/core-delivery": "^3.1.13",
-    "@unchainedshop/core-enrollments": "^3.1.13",
-    "@unchainedshop/core-orders": "^3.1.13",
-    "@unchainedshop/core-payment": "^3.1.13",
-    "@unchainedshop/core-products": "^3.1.13",
-    "@unchainedshop/core-warehousing": "^3.1.13",
-    "@unchainedshop/core-worker": "^3.1.13",
-    "@unchainedshop/events": "^3.1.13",
-    "@unchainedshop/file-upload": "^3.1.13",
-    "@unchainedshop/logger": "^3.1.13",
-    "@unchainedshop/utils": "^3.1.13",
+    "@unchainedshop/api": "^4.0.0-rc.3",
+    "@unchainedshop/core-delivery": "^4.0.0-rc.3",
+    "@unchainedshop/core-enrollments": "^4.0.0-rc.3",
+    "@unchainedshop/core-orders": "^4.0.0-rc.3",
+    "@unchainedshop/core-payment": "^4.0.0-rc.3",
+    "@unchainedshop/core-products": "^4.0.0-rc.3",
+    "@unchainedshop/core-warehousing": "^4.0.0-rc.3",
+    "@unchainedshop/core-worker": "^4.0.0-rc.3",
+    "@unchainedshop/events": "^4.0.0-rc.3",
+    "@unchainedshop/file-upload": "^4.0.0-rc.3",
+    "@unchainedshop/logger": "^4.0.0-rc.3",
+    "@unchainedshop/utils": "^4.0.0-rc.3",
     "event-iterator": "^2.0.0",
     "JSONStream": "^1.3.5"
   },
   "peerDependencies": {
     "@aws-sdk/client-eventbridge": ">= 3.714 < 4",
+    "@breejs/later": "^4.2.0",
     "@paypal/checkout-server-sdk": "1.x",
-    "@redis/client": ">= 1.0 < 6",
-    "bip32": "^5.0.0-rc.0",
-    "bitcoinjs-lib": ">= 6.1 <7",
-    "bs58check": "^4.0.0",
-    "ethers": ">= 6.13 < 7",
+    "@redis/client": ">= 1 < 6",
+    "@scure/bip32": ">= 1.7 < 2",
+    "@scure/btc-signer": ">= 1.8 < 2",
     "expiry-map": "2.x",
     "express": ">= 5 < 6",
     "fastify": ">= 5.2 < 6",
-    "mime-types": ">= 3 < 4",
+    "mime-types": ">= 2 < 4",
     "minio": "8.x",
     "nodemailer": ">= 6.9 < 8",
     "open": "10.x",
     "p-memoize": "7.x",
     "postfinancecheckout": ">= 4.5.0",
-    "stripe": ">= 18 < 19",
-    "tiny-secp256k1": "2.x",
-    "twilio": "5.x",
+    "stripe": ">= 17 < 19",
     "web-push": ">= 3.6 <4",
     "xml-js": ">= 1.6 < 2"
   },
   "peerDependenciesMeta": {
+    "@breejs/later": {
+      "optional": true
+    },
     "@aws-sdk/client-eventbridge": {
       "optional": true
     },
@@ -83,16 +82,10 @@
     "@redis/client": {
       "optional": true
     },
-    "bip32": {
-      "optional": true
-    },
-    "bitcoinjs-lib": {
+    "@scure/bip32": {
       "optional": true
     },
-    "bs58check": {
-      "optional": true
-    },
-    "ethers": {
+    "@scure/btc-signer": {
       "optional": true
     },
     "expiry-map": {
@@ -125,12 +118,6 @@
     "stripe": {
       "optional": true
     },
-    "tiny-secp256k1": {
-      "optional": true
-    },
-    "twilio": {
-      "optional": true
-    },
     "web-push": {
       "optional": true
     },
@@ -142,25 +129,22 @@
     "@breejs/later": "^4.2.0",
     "@paypal/checkout-server-sdk": "^1.0.3",
     "@redis/client": "^5.5.6",
+    "@scure/bip32": "^1.7.0",
+    "@scure/btc-signer": "^1.8.1",
+    "@types/breejs__later": "^4.1.5",
     "@types/express": "^5.0.3",
     "@types/node": "^24.0.4",
-    "bip32": "^5.0.0-rc.0",
-    "bitcoinjs-lib": "^6.1.7",
-    "bs58check": "^4.0.0",
-    "ethers": "^6.14.4",
     "expiry-map": "^2.0.0",
     "express": "^5.1.0",
     "fastify": "^5.4.0",
-    "mime-types": "^3.0.0",
+    "mime-types": "^3.0.1",
     "minio": "^8.0.5",
     "nodemailer": "^7.0.3",
     "open": "^10.1.2",
     "p-memoize": "^7.1.1",
     "postfinancecheckout": "^4.7.0",
     "stripe": "^18.2.1",
-    "tiny-secp256k1": "^2.2.4",
     "tsx": "^4.20.3",
-    "twilio": "^5.7.1",
     "typescript": "^5.8.3",
     "web-push": "^3.6.7",
     "xml-js": "^1.6.11"

package/src/delivery/pick-mup.ts

@@ -22,7 +22,6 @@ const fetchPickMupLocations = async (key: string, idsFilter?: string) => {
   const { stores = [] } = result || {};
   return stores.flatMap(({ markets = [], location = {}, id }) => {
     return markets.map(({ full_name: fullName }) => {
-      // eslint-disable-line
       const {
         geo: { lat, lon },
         zip,
@@ -90,7 +89,6 @@ const PickMup: IDeliveryAdapter = {
       },
 
       configurationError: () => {
-        // eslint-disable-line
         if (!getKey()) {
           return DeliveryError.INCOMPLETE_CONFIGURATION;
         }

package/src/files/gridfs/handler-express.ts

@@ -98,6 +98,10 @@ const gridfsHandler = async (
           res.end('Access restricted: Invalid signature.');
           return;
         }
+      } else if (!fileDocument) {
+        res.statusCode = 404;
+        res.end();
+        return;
       }
       if (file?.metadata?.['content-type']) {
         res.setHeader('Content-Type', file.metadata['content-type']);

package/src/files/gridfs/handler-fastify.ts

@@ -89,6 +89,9 @@ const gridfsHandler: RouteHandlerMethod = async (
           reply.status(403);
           return reply.send('Access restricted: Invalid signature.');
         }
+      } else if (!fileDocument) {
+        reply.status(404);
+        return reply.send();
       }
 
       if (file?.metadata?.['content-type']) {

package/src/files/gridfs/module.ts

@@ -34,6 +34,6 @@ export default {
   },
 };
 
-export type GridFSFileUploadsModule = {
+export interface GridFSFileUploadsModule {
   gridfsFileUploads: ReturnType<typeof configureGridFSFileUploadModule>;
-};
+}

package/src/filters/local-search.ts

@@ -2,6 +2,10 @@ import { mongodb } from '@unchainedshop/mongodb';
 import { ProductText } from '@unchainedshop/core-products';
 import { AssortmentText } from '@unchainedshop/core-assortments';
 import { FilterDirector, FilterAdapter, IFilterAdapter } from '@unchainedshop/core';
+import { createLogger } from '@unchainedshop/logger';
+import { isDocumentDBCompatModeEnabled } from '@unchainedshop/mongodb';
+
+const logger = createLogger('unchained:core-filters:local-search');
 
 const LocalSearch: IFilterAdapter = {
   ...FilterAdapter,
@@ -38,7 +42,6 @@ const LocalSearch: IFilterAdapter = {
         return products.map(({ productId }) => productId);
       },
 
-      // eslint-disable-next-line
       searchAssortments: async ({ assortmentIds }) => {
         const { queryString } = params.searchQuery;
 
@@ -89,4 +92,10 @@ const LocalSearch: IFilterAdapter = {
 
 export default LocalSearch;
 
-FilterDirector.registerAdapter(LocalSearch);
+if (!isDocumentDBCompatModeEnabled()) {
+  FilterDirector.registerAdapter(LocalSearch);
+} else {
+  logger.warn(
+    'Free text search queries have been disabled due to DocumentDB compatibility mode (env UNCHAINED_DOCUMENTDB_COMPAT_MODE is trueish)',
+  );
+}

package/src/filters/strict-equal.ts

@@ -12,6 +12,27 @@ const StrictQualFilter: IFilterAdapter = {
     return {
       ...FilterAdapter.actions(params),
 
+      searchProducts: async ({ productIds }) => {
+        // Search Products
+        const { queryString } = params.searchQuery;
+
+        if (!queryString && !productIds) {
+          // If no query string is provided, return all product IDs
+          return params.modules.products.findProductIds({});
+        }
+        return productIds;
+      },
+
+      searchAssortments: async ({ assortmentIds }) => {
+        // Search Assortments
+        const { queryString } = params.searchQuery;
+        if (!queryString && !assortmentIds) {
+          // If no query string is provided, return all assortment IDs
+          return params.modules.assortments.findAssortmentIds({});
+        }
+        return assortmentIds;
+      },
+
       transformProductSelector: async (lastSelector, options) => {
         const { key, value } = options || {};
 

package/src/payment/apple-iap/adapter.ts

@@ -26,7 +26,6 @@ const AppleIAP: IPaymentAdapter = {
       ...PaymentAdapter.actions(params, context),
 
       configurationError() {
-        // eslint-disable-line
         if (!APPLE_IAP_SHARED_SECRET) {
           return PaymentError.INCOMPLETE_CONFIGURATION;
         }
@@ -38,23 +37,19 @@ const AppleIAP: IPaymentAdapter = {
         return false;
       },
 
-      // eslint-disable-next-line
       isPayLaterAllowed() {
         return false;
       },
 
-      // eslint-disable-next-line
       async sign() {
         throw new Error('Apple IAP does not support payment signing');
       },
 
-      // eslint-disable-next-line
       async validate() {
         // once registered receipt transactions are valid by default!
         return true;
       },
 
-      // eslint-disable-next-line
       async register(transactionContext) {
         const { receiptData } = transactionContext;
 
@@ -62,13 +57,13 @@ const AppleIAP: IPaymentAdapter = {
           receiptData,
           password: APPLE_IAP_SHARED_SECRET,
         });
-        const { status, latest_receipt_info: latestReceiptInfo } = response; // eslint-disable-line
+        const { status, latest_receipt_info: latestReceiptInfo } = response;
 
         if (status === 0) {
           logger.debug('Apple IAP Plugin: Receipt validated and updated for the user');
-          const latestTransaction = latestReceiptInfo[latestReceiptInfo.length - 1]; // eslint-disable-line
+          const latestTransaction = latestReceiptInfo[latestReceiptInfo.length - 1];
           return {
-            token: latestTransaction.web_order_line_item_id, // eslint-disable-line
+            token: latestTransaction.web_order_line_item_id,
             latestReceiptInfo,
           };
         }
@@ -79,7 +74,6 @@ const AppleIAP: IPaymentAdapter = {
         return null;
       },
 
-      // eslint-disable-next-line
       async charge(transactionContext) {
         const { meta, paymentCredentials, receiptData } = transactionContext || {};
         const { transactionIdentifier } = meta || {};
@@ -100,10 +94,9 @@ const AppleIAP: IPaymentAdapter = {
         }
 
         const transactions =
-          receiptResponse?.latest_receipt_info || // eslint-disable-line
-          paymentCredentials?.meta?.latestReceiptInfo;
+          receiptResponse?.latest_receipt_info || paymentCredentials?.meta?.latestReceiptInfo;
         const matchedTransaction = transactions?.find(
-          (transaction) => transaction?.transaction_id === transactionIdentifier, // eslint-disable-line
+          (transaction) => transaction?.transaction_id === transactionIdentifier,
         );
         if (!matchedTransaction) {
           throw new Error(
@@ -131,7 +124,7 @@ const AppleIAP: IPaymentAdapter = {
 
         const isMatchesTransaction =
           parseInt(matchedTransaction.quantity, 10) === quantity &&
-          matchedTransaction.product_id === productId; // eslint-disable-line
+          matchedTransaction.product_id === productId;
 
         if (!isMatchesTransaction)
           throw new Error('Apple IAP Plugin: Product in order does not match transaction');

package/src/payment/apple-iap/fix-periods.ts

@@ -4,17 +4,14 @@ export const fixPeriods = async (
   { transactionId, enrollmentId, orderId, transactions },
   unchainedAPI: UnchainedCore,
 ) => {
-  const relevantTransactions = transactions.filter(
-    // eslint-disable-next-line
-    ({ original_transaction_id }) => {
-      return original_transaction_id === transactionId; // eslint-disable-line
-    },
-  );
+  const relevantTransactions = transactions.filter(({ original_transaction_id }) => {
+    return original_transaction_id === transactionId;
+  });
 
   const adjustedEnrollmentPeriods = relevantTransactions
     .map((transaction) => {
       return {
-        isTrial: transaction.is_trial_period === 'true', // eslint-disable-line
+        isTrial: transaction.is_trial_period === 'true',
         start: new Date(parseInt(transaction.purchase_date_ms, 10)),
         end: new Date(parseInt(transaction.expires_date_ms, 10)),
         orderId: transaction.transaction_id === transactionId ? orderId : null,

package/src/payment/apple-iap/handler-express.ts

@@ -25,7 +25,7 @@ export const appleIAPHandler = async (req, res) => {
         throw new Error('shared secret not valid');
       }
 
-      const transactions = responseBody?.unified_receipt?.latest_receipt_info; // eslint-disable-line
+      const transactions = responseBody?.unified_receipt?.latest_receipt_info;
       const latestTransaction = transactions[0];
 
       if (responseBody.notification_type === AppleNotificationTypes.INITIAL_BUY) {
@@ -40,7 +40,7 @@ export const appleIAPHandler = async (req, res) => {
 
         const order = await services.orders.checkoutOrder(orderPayment.orderId, {
           paymentContext: {
-                receiptData: responseBody?.unified_receipt?.latest_receipt, // eslint-disable-line
+            receiptData: responseBody?.unified_receipt?.latest_receipt,
           },
         });
         const orderId = order._id;
@@ -78,7 +78,7 @@ export const appleIAPHandler = async (req, res) => {
 
         await services.orders.registerPaymentCredentials(enrollment.payment.paymentProviderId, {
           transactionContext: {
-              receiptData: responseBody?.unified_receipt?.latest_receipt, // eslint-disable-line
+            receiptData: responseBody?.unified_receipt?.latest_receipt,
           },
           userId: enrollment.userId,
         });

package/src/payment/apple-iap/handler-fastify.ts

@@ -33,7 +33,7 @@ export const appleIAPHandler: RouteHandlerMethod = async (
       throw new Error('shared secret not valid');
     }
 
-      const transactions = responseBody?.unified_receipt?.latest_receipt_info; // eslint-disable-line
+    const transactions = responseBody?.unified_receipt?.latest_receipt_info;
     const latestTransaction = transactions[0];
 
     if (responseBody.notification_type === AppleNotificationTypes.INITIAL_BUY) {
@@ -48,7 +48,7 @@ export const appleIAPHandler: RouteHandlerMethod = async (
 
       const order = await services.orders.checkoutOrder(orderPayment.orderId, {
         paymentContext: {
-                receiptData: responseBody?.unified_receipt?.latest_receipt, // eslint-disable-line
+          receiptData: responseBody?.unified_receipt?.latest_receipt,
         },
       });
       const orderId = order._id;
@@ -86,7 +86,7 @@ export const appleIAPHandler: RouteHandlerMethod = async (
 
       await services.orders.registerPaymentCredentials(enrollment.payment.paymentProviderId, {
         transactionContext: {
-              receiptData: responseBody?.unified_receipt?.latest_receipt, // eslint-disable-line
+          receiptData: responseBody?.unified_receipt?.latest_receipt,
         },
         userId: enrollment.userId,
       });

package/src/payment/apple-iap/module.ts

@@ -24,6 +24,6 @@ export default {
   },
 };
 
-export type AppleTransactionsModule = {
+export interface AppleTransactionsModule {
   appleTransactions: Awaited<ReturnType<typeof configureAppleTransactionsModule>>;
-};
+}

package/src/payment/braintree.ts

@@ -52,7 +52,6 @@ const BraintreeDirect: IPaymentAdapter = {
       return BRAINTREE_SANDBOX_TOKEN;
     };
 
-    // eslint-disable-next-line
     const getPrivateKey = () => {
       return BRAINTREE_PRIVATE_KEY;
     };
@@ -114,17 +113,17 @@ const BraintreeDirect: IPaymentAdapter = {
 
         // eslint-disable-next-line
         // @ts-ignore
-        const braintree = (await import('braintree')).default; // eslint-disable-line
+        const braintree = (await import('braintree')).default;
         const gateway = getGateway(braintree);
         const address = order.billingAddress;
         const pricing = OrderPricingSheet({
           calculation: order.calculation,
-          currency: order.currency,
+          currencyCode: order.currencyCode,
         });
         const rounded = Math.round(pricing.total({ useNetPrice: false }).amount / 10 || 0) * 10;
         const saleRequest = {
           amount: rounded / 100,
-          merchantAccountId: order.currency,
+          merchantAccountId: order.currencyCode,
           paymentMethodNonce: paypalPaymentMethodNonce,
           orderId: order.orderNumber || order._id,
           shipping: address

package/src/payment/cryptopay/db/CryptopayTransactions.ts

@@ -6,9 +6,8 @@ export type CryptopayTransaction = {
   blockHeight: number;
   mostRecentBlockHeight: number;
   amount: mongodb.Decimal128;
-  currency: string;
+  currencyCode: string;
   decimals: number;
-  contract: string;
   orderPaymentId?: string;
 } & TimestampFields;
 

package/src/payment/cryptopay/denote-amount.test.ts

@@ -0,0 +1,28 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+import denoteAmount from './denote-amount.js';
+
+describe('Denote Amount', () => {
+  it('Handle amount with 18 decimals', () => {
+    // For example, Ethereum uses 18 decimals, this converts WEI to GWei
+    assert.equal(denoteAmount('1000000000000000000', 18), 1000000000n);
+    assert.equal(denoteAmount('100000000000000', 18), 100000n);
+    assert.equal(denoteAmount('100', 18), 0n);
+  });
+  it('Handle amount with 10 decimals', () => {
+    assert.equal(denoteAmount('100000000', 10), 10000000n);
+    assert.equal(denoteAmount('100000000000000', 10), 10000000000000n);
+    assert.equal(denoteAmount('100', 10), 10n);
+  });
+  it('Handle amount with 8 decimals', () => {
+    // For example, Bitcoin uses 8 decimals, this keeps Satoshi as is
+    assert.equal(denoteAmount('100000000', 8), 100000000n);
+    assert.equal(denoteAmount('100000000000000', 8), 100000000000000n);
+    assert.equal(denoteAmount('1', 8), 1n);
+  });
+  it('Handle amount with 2 decimals', () => {
+    assert.equal(denoteAmount('100000000', 2), 100000000n);
+    assert.equal(denoteAmount('100000000000000', 2), 100000000000000n);
+    assert.equal(denoteAmount('1', 2), 1n);
+  });
+});

package/src/payment/cryptopay/denote-amount.ts

@@ -0,0 +1,29 @@
+/**
+ * Converts a cryptocurrency amount from its smallest unit (e.g., wei, satoshi) to a normalized value
+ * with 9 decimal places of precision.
+ *
+ * This function handles the denomination of cryptocurrency amounts by converting from the
+ * blockchain's native smallest units (like wei for Ethereum which is 10^-18 ETH, or satoshi for Bitcoin
+ * which is 10^-8 BTC) to a standardized format with 9 decimal places for consistent handling across
+ * different cryptocurrencies.
+ *
+ * @param {string} amountAsString - The amount in the cryptocurrency's smallest unit (e.g., wei, satoshi)
+ *                                  represented as a string to handle large numbers
+ * @param {number} decimals - The number of decimal places used by the cryptocurrency
+ *                           (e.g., 18 for Ethereum, 8 for Bitcoin)
+ * @returns {number} The converted amount with 9 decimal places of precision
+ *
+ * @example
+ * // Convert 1 ETH in wei (1000000000000000000) to normalized format
+ * denoteAmount("1000000000000000000", 18)
+ *
+ * @example
+ * // Convert 1 BTC in satoshi (100000000) to normalized format
+ * denoteAmount("100000000", 8)
+ */
+export default function denoteAmount(amountAsString: string, decimals: number) {
+  if (decimals <= 9) return BigInt(amountAsString); // No conversion needed if decimals are 9 or less
+  const exponent = BigInt(decimals) - 9n;
+  const amount = BigInt(amountAsString);
+  return amount / 10n ** exponent; // Denote to 9 decimals
+}

package/src/payment/cryptopay/derive-btc-address.test.ts

@@ -0,0 +1,22 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+import deriveBtcAddress from './derive-btc-address.js';
+
+describe('BTC Address Derivation', () => {
+  it('returns a deterministic BIP44 child address', () => {
+    assert.equal(
+      deriveBtcAddress(
+        'zpub6qpRm6gMdkrXvVKw7qgayHnqJGJkpE4rnYQdyJfZW87ed4Fk6HjVaThN12hv2rrL3EzfvvBW6ZpbMEe5UxZYEjhgeMigyvAbS5LiXPkKrys',
+        1,
+      ),
+      'bc1qspcam3ntdpvhgz4vnxfdhas6qr8hf8tjfaz5p4',
+    );
+    assert.equal(
+      deriveBtcAddress(
+        'zpub6qpRm6gMdkrXvVKw7qgayHnqJGJkpE4rnYQdyJfZW87ed4Fk6HjVaThN12hv2rrL3EzfvvBW6ZpbMEe5UxZYEjhgeMigyvAbS5LiXPkKrys',
+        2,
+      ),
+      'bc1qd0a7znq3pz3sc4armthddkyam57ey7qjc4v6vn',
+    );
+  });
+});

package/src/payment/cryptopay/derive-btc-address.ts

@@ -0,0 +1,48 @@
+import { HDKey } from '@scure/bip32';
+import { NETWORK, p2wpkh, TEST_NETWORK } from '@scure/btc-signer';
+
+// const resolvePath = (prefix) => {
+//   if (prefix === 'x') return `m/44'/0'`;
+//   if (prefix === 'y') return `m/49'/0'`;
+//   if (prefix === 'z') return `m/84'/0'`;
+//   if (prefix === 't') return `m/44'/1'`;
+//   if (prefix === 'u') return `m/49'/1'`;
+//   if (prefix === 'v') return `m/84'/1'`;
+//   return `m`;
+// };
+
+const resolveNetwork = (prefix) => {
+  if (['x', 'y', 'z'].includes(prefix)) return NETWORK;
+  return TEST_NETWORK;
+};
+
+export default (xpub, index) => {
+  const prefix = xpub.slice(0, 1);
+  if (prefix !== 'z' && prefix !== 'v')
+    throw new Error('Cryptopay only supports native segwit (zpub/vpub) extended key format for BTC');
+
+  const hardenedMaster = HDKey.fromExtendedKey(
+    xpub,
+    prefix === 'z'
+      ? {
+          public: 0x04b24746, // zpub public
+          private: 0x04b2430c, // zpriv private
+        }
+      : {
+          public: 0x045f1cf6,
+          private: 0x045f18bc,
+        },
+  );
+  hardenedMaster.wipePrivateData(); // Neuter
+
+  const child = hardenedMaster.deriveChild(0).deriveChild(index);
+
+  // We don't need this AFAIK:
+  // const derivationPath = resolvePath(prefix);
+  // const child = hardenedMaster.derive(`${derivationPath}/0/${btcDerivationNumber}`);
+
+  const network = resolveNetwork(prefix);
+  const pubKey = p2wpkh(child.publicKey /* hex.decode( as string)*/, network);
+
+  return pubKey.address;
+};

package/src/payment/cryptopay/derive-eth-address.test.ts

@@ -0,0 +1,22 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+import deriveEthAddress from './derive-eth-address.js';
+
+describe('ETH Address Derivation', () => {
+  it('returns a deterministic BIP44 child address', () => {
+    assert.equal(
+      deriveEthAddress(
+        'xpub6DTksA6DsGUgbEp1U29v3qGTt5P99iKThaqGEzerTfD73ZAg1F8j15TxWTPEjjA1uw1Zmwwc5dgVCXwTL2ZNhvdoLWNdqVuL1MDJMsQCLLs',
+        1,
+      ),
+      '0x11CF7d607A1Dc45a002592891fF25DAAE6eC7dE9',
+    );
+    assert.equal(
+      deriveEthAddress(
+        'xpub6DTksA6DsGUgbEp1U29v3qGTt5P99iKThaqGEzerTfD73ZAg1F8j15TxWTPEjjA1uw1Zmwwc5dgVCXwTL2ZNhvdoLWNdqVuL1MDJMsQCLLs',
+        2,
+      ),
+      '0x61663D505e3aB5b61a5344eA2c64b644c08013ea',
+    );
+  });
+});

package/src/payment/cryptopay/derive-eth-address.ts

@@ -0,0 +1,38 @@
+import { HDKey } from '@scure/bip32';
+import { keccak_256 } from '@noble/hashes/sha3';
+import { secp256k1 } from '@noble/curves/secp256k1';
+
+function getChecksumAddress(address) {
+  const chars = address.split('');
+  const expanded = new Uint8Array(40);
+  for (let i = 0; i < 40; i++) {
+    expanded[i] = chars[i].charCodeAt(0);
+  }
+  const hashed = keccak_256(expanded);
+
+  for (let i = 0; i < 40; i += 2) {
+    if (hashed[i >> 1] >> 4 >= 8) {
+      chars[i] = chars[i].toUpperCase();
+    }
+    if ((hashed[i >> 1] & 0x0f) >= 8) {
+      chars[i + 1] = chars[i + 1].toUpperCase();
+    }
+  }
+
+  return '0x' + chars.join('');
+}
+
+export default (xpub, index) => {
+  const hardenedMaster = HDKey.fromExtendedKey(xpub);
+  hardenedMaster.wipePrivateData(); // Neuter
+
+  const child = hardenedMaster.deriveChild(0).deriveChild(index);
+
+  // ETH Address (secp256k1 + keccak_256 + checksum)
+  const childSigningKey = secp256k1.ProjectivePoint.fromHex(child.publicKey).toRawBytes(false);
+  const address = Buffer.from(keccak_256(childSigningKey.slice(1)))
+    .toString('hex')
+    .substring(24);
+
+  return getChecksumAddress(address);
+};