wative-core 1.2.2 → 2.2.1

package/examples/08-persistence.test.cjs

@@ -0,0 +1,105 @@
+// 08 — Persistence. Verify that accounts, networks, custom assets, and the
+// logger configuration all round-trip correctly across `lock()` + reopen.
+
+const test = require("node:test");
+const assert = require("node:assert");
+const { mkdtempSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+
+const { Workspace, Network, Asset } = require("wative-core");
+
+const MNEMONIC =
+  "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
+
+test("persistence — multiple HD + PK accounts round-trip", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-persist-acc-"));
+  let ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const hd = await ws.accounts.create("Desk One", "wsp-pwd", MNEMONIC);
+  await hd.deriveWallets(3);
+
+  const pk = await ws.accounts.create(
+    "Hot Wallet",
+    "wsp-pwd",
+    "0x4f3edf983ac636a65a842ce7c78d9aa706d3b113bce9c46f30d7d21715b23b1d",
+    undefined,
+    { kind: "PK" },
+  );
+
+  await ws.lock();
+  ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+  assert.strictEqual(ws.accounts.length, 2);
+  const reopenHd = ws.accounts.bySlug(hd.slug);
+  const reopenPk = ws.accounts.bySlug(pk.slug);
+  assert.ok(reopenHd && reopenPk);
+  assert.strictEqual(reopenHd.organizationType, "HD");
+  assert.strictEqual(reopenPk.organizationType, "PK");
+  assert.strictEqual(reopenHd.wallets.length, 4);
+  assert.strictEqual(reopenPk.wallets.length, 1);
+
+  await ws.lock();
+});
+
+test("persistence — added user network round-trips with all fields", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-persist-net-"));
+  let ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  await ws.networks.add(new Network({
+    slug: "monad-testnet",
+    name: "Monad Testnet",
+    chainId: 10143,
+    rpcUrl: "https://testnet-rpc.monad.xyz",
+    nativeCurrency: { name: "Monad", symbol: "MON", decimals: 18 },
+    color: "#7e22ce",
+    vm: "evm",
+  }));
+
+  await ws.lock();
+  ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+  const monad = ws.networks.bySlug("monad-testnet");
+  assert.ok(monad);
+  assert.strictEqual(monad.chainId, 10143);
+  assert.strictEqual(monad.rpcUrl, "https://testnet-rpc.monad.xyz");
+  assert.strictEqual(monad.nativeCurrency.symbol, "MON");
+  assert.strictEqual(monad.color, "#7e22ce");
+
+  await ws.lock();
+});
+
+test("persistence — custom user asset round-trips", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-persist-asset-"));
+  let ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  await ws.addAsset(new Asset({
+    id: 250,
+    symbol: "PEPE",
+    name: "Pepe",
+    decimals: 18,
+    contractAddress: "0x6982508145454Ce325dDbE47a25d4ec3d2311933",
+    network: Network.Ethereum,
+  }));
+
+  await ws.lock();
+  ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+  const ethAssets = await ws.assets(Network.Ethereum);
+  const pepe = ethAssets.find((a) => a.id === 250);
+  assert.ok(pepe);
+  assert.strictEqual(pepe.symbol, "PEPE");
+  assert.strictEqual(pepe.decimals, 18);
+
+  await ws.lock();
+});
+
+test("persistence — custom logger config round-trips", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-persist-log-"));
+  let ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  await ws.logger.setLevel("debug");
+
+  await ws.lock();
+  ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+  assert.strictEqual(ws.logger.config.minLevel, "debug");
+
+  await ws.lock();
+});

package/examples/09-workspace-filter.test.cjs

@@ -0,0 +1,84 @@
+// 09 — Workspace search. `filter(query, objective)` returns the live object
+// matching `query` for the given objective: Wallet, Address, Account, or Asset.
+
+const test = require("node:test");
+const assert = require("node:assert");
+const { mkdtempSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+
+const { Workspace } = require("wative-core");
+
+const MNEMONIC =
+  "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
+
+test("filter — find an Account by displayName or slug", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-filter-acc-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const acc = await ws.accounts.create("Trading Desk", "wsp-pwd", MNEMONIC);
+
+  const byName = await ws.filter("Trading Desk", "Account");
+  const bySlug = await ws.filter(acc.slug, "Account");
+  assert.ok(byName && byName.slug === acc.slug);
+  assert.ok(bySlug && bySlug.slug === acc.slug);
+
+  const missing = await ws.filter("nonexistent", "Account");
+  assert.strictEqual(missing, null);
+
+  await ws.lock();
+});
+
+test("filter — find a Wallet by id or by tag", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-filter-wallet-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const acc = await ws.accounts.create("Desk", "wsp-pwd", MNEMONIC);
+  await acc.deriveWallets(2);
+
+  await acc.wallets[1].addTag("alpha-strategy");
+
+  const byId = await ws.filter("1", "Wallet");
+  assert.ok(byId);
+  assert.strictEqual(byId.id, 1);
+
+  const byTag = await ws.filter("alpha-strategy", "Wallet");
+  assert.ok(byTag);
+  assert.strictEqual(byTag.id, 1);
+
+  await ws.lock();
+});
+
+test("filter — find an Address by its public key (case-insensitive for EVM)", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-filter-addr-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const acc = await ws.accounts.create("Desk", "wsp-pwd", MNEMONIC);
+  const evm = acc.wallets[0].addresses.find((a) => a.vm === "evm");
+
+  const found = await ws.filter(evm.publicKey, "Address");
+  assert.ok(found);
+  assert.strictEqual(found.publicKey, evm.publicKey);
+
+  const foundLower = await ws.filter(evm.publicKey.toLowerCase(), "Address");
+  assert.ok(foundLower);
+  assert.strictEqual(foundLower.publicKey, evm.publicKey);
+
+  await ws.lock();
+});
+
+test("filter — find an Asset; returns null for unknown query", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-filter-asset-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const usdc = await ws.filter("USDC", "Asset");
+  assert.ok(usdc && usdc.symbol === "USDC");
+
+  const usdt = await ws.filter("0xdAC17F958D2ee523a2206206994597C13D831ec7", "Asset");
+  assert.ok(usdt && usdt.symbol === "USDT");
+
+  const missing = await ws.filter("DOES-NOT-EXIST", "Asset");
+  assert.strictEqual(missing, null);
+
+  await ws.lock();
+});

package/examples/10-default-network.test.cjs

@@ -0,0 +1,70 @@
+// 10 — Account default network. `account.setDefaultNetwork(value)` accepts
+// a slug, a chain id, a hex chain id, or a Network instance — and the choice
+// persists across reopen.
+
+const test = require("node:test");
+const assert = require("node:assert");
+const { mkdtempSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+
+const { Workspace, Network } = require("wative-core");
+
+const MNEMONIC =
+  "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
+
+test("setDefaultNetwork — accepts slug, chainId, hex chainId, and Network instance", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-default-net-forms-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const acc = await ws.accounts.create("Desk", "wsp-pwd", MNEMONIC);
+
+  await acc.setDefaultNetwork("base");
+  assert.strictEqual(acc.defaultNetwork, "base");
+
+  await acc.setDefaultNetwork(8453);
+  assert.strictEqual(acc.defaultNetwork, "base");
+
+  await acc.setDefaultNetwork("0xa");
+  assert.strictEqual(acc.defaultNetwork, "optimism");
+
+  await acc.setDefaultNetwork(Network.Arbitrum);
+  assert.strictEqual(acc.defaultNetwork, "arbitrum");
+
+  await ws.lock();
+});
+
+test("setDefaultNetwork — rejects an unknown network", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-default-net-bad-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const acc = await ws.accounts.create("Desk", "wsp-pwd", MNEMONIC);
+
+  await assert.rejects(
+    acc.setDefaultNetwork("does-not-exist"),
+    (err) => err.code === "UNSUPPORTED_NETWORK",
+  );
+  await assert.rejects(
+    acc.setDefaultNetwork(99999999),
+    (err) => err.code === "UNSUPPORTED_NETWORK",
+  );
+
+  await ws.lock();
+});
+
+test("setDefaultNetwork — choice persists across lock + reopen", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-default-net-persist-"));
+  let ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  const acc = await ws.accounts.create("Desk", "wsp-pwd", MNEMONIC);
+  await acc.setDefaultNetwork(Network.Solana);
+  assert.strictEqual(acc.defaultNetwork, "solana");
+
+  await ws.lock();
+  ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+  const reopened = ws.accounts.bySlug(acc.slug);
+  assert.ok(reopened);
+  assert.strictEqual(reopened.defaultNetwork, "solana");
+
+  await ws.lock();
+});

package/examples/11-subpath-imports.test.cjs

@@ -0,0 +1,24 @@
+// 11 — Subpath imports. Heavier chain helpers ship under `wative-core/artifacts/evm`
+// and `wative-core/artifacts/svm` so they're only pulled in when used. In your
+// own project: require("wative-core/artifacts/evm") / require("wative-core/artifacts/svm").
+
+const test = require("node:test");
+const assert = require("node:assert");
+
+// Imported by SUBPATH, which is the whole point of this example — and what a
+// consumer writes. A relative path into dist/ would resolve here but nowhere
+// else, so it would pass in-repo while failing for every real installation.
+const evmArtifacts = require("wative-core/artifacts/evm");
+const svmArtifacts = require("wative-core/artifacts/svm");
+
+test("subpath import — evm artifacts expose a usable ERC20 contract", () => {
+  assert.ok(evmArtifacts.ERC20);
+  assert.strictEqual(typeof evmArtifacts.ERC20.encode, "function");
+});
+
+test("subpath import — svm artifacts expose TokenProgram and Token2022Program", () => {
+  assert.ok(svmArtifacts.TokenProgram);
+  assert.ok(svmArtifacts.Token2022Program);
+  assert.strictEqual(typeof svmArtifacts.TokenProgram.encodeInstruction, "function");
+  assert.strictEqual(typeof svmArtifacts.Token2022Program.encodeInstruction, "function");
+});

package/examples/12-logger.test.cjs

@@ -0,0 +1,44 @@
+// 12 — Logger. Workspace exposes `ws.logger` after unlock. Write structured
+// logs at any level, change the level via `ws.logger.setLevel(...)`, and the
+// configuration persists across reopen.
+
+const test = require("node:test");
+const assert = require("node:assert");
+const { mkdtempSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+
+const { Workspace } = require("wative-core");
+
+test("logger — write at every level + change minLevel at runtime", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-logger-write-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  ws.logger.trace("trace event", { phase: "init" });
+  ws.logger.debug("debug event", { phase: "init" });
+  ws.logger.info("info event", { phase: "init" });
+  ws.logger.warn("warn event", { phase: "init" });
+  ws.logger.error("error event", { phase: "init" });
+
+  await ws.logger.setLevel("warn");
+  assert.strictEqual(ws.logger.config.minLevel, "warn");
+
+  ws.logger.warn("still works");
+  ws.logger.info("filtered out below minLevel");
+
+  await ws.lock();
+});
+
+test("logger — config persists across reopen", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-logger-persist-"));
+  let ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  await ws.logger.setLevel("error");
+  assert.strictEqual(ws.logger.config.minLevel, "error");
+
+  await ws.lock();
+  ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+  assert.strictEqual(ws.logger.config.minLevel, "error");
+
+  await ws.lock();
+});

package/examples/13-workspace-config.test.cjs

@@ -0,0 +1,43 @@
+// 13 — Workspace config public API. Consumers should never need Provider
+// record access to update business-wide settings.
+
+const test = require("node:test");
+const assert = require("node:assert");
+const { mkdtempSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+
+const { Workspace } = require("wative-core");
+
+test("workspace config — setBusinessTimezone/getConfig work from release dist", async () => {
+  const root = mkdtempSync(join(tmpdir(), "wative-config-"));
+  const ws = await Workspace.open({ path: root, password: "wsp-pwd" });
+
+  await ws.setBusinessTimezone("UTC");
+  assert.deepStrictEqual(await ws.getConfig(), { businessTimezone: "UTC" });
+
+  await ws.setBusinessTimezone("Etc/UTC");
+  assert.deepStrictEqual(await ws.getConfig(), { businessTimezone: "Etc/UTC" });
+
+  await assert.rejects(ws.setBusinessTimezone("Not/AZone"), (err) => (
+    err.code === "PARAMETER_ERROR"
+    && /INVALID_BUSINESS_TIMEZONE/.test(err.message)
+    && !err.message.includes("Not/AZone")
+  ));
+
+  // `config` hands back a frozen snapshot, not the live object. Assigning to it
+  // does not change the workspace — read config through `config` / `getConfig()`
+  // and change it through the setters.
+  const snapshot = ws.config;
+  assert.strictEqual(Object.isFrozen(snapshot), true);
+  snapshot.settlementWindow = "ny-close";
+  assert.strictEqual(snapshot.settlementWindow, undefined);
+
+  await ws.setBusinessTimezone("America/New_York");
+  assert.deepStrictEqual(await ws.getConfig(), { businessTimezone: "America/New_York" });
+
+  assert.strictEqual(Object.prototype.hasOwnProperty.call(ws, "_provider"), false);
+  assert.strictEqual("_provider" in ws, false);
+
+  await ws.lock();
+});

package/examples/14-esm-runtime.test.mjs

@@ -0,0 +1,81 @@
+import assert from "node:assert/strict";
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+
+async function importDist() {
+  // Import by PACKAGE SPECIFIER, not by file path. The root entry is
+  // condition-split: a raw path to dist/index.js bypasses the exports map and
+  // lands on the browser build, which deliberately has no filesystem backend.
+  // "wative-core" resolves through the node condition, which is what an ESM
+  // consumer actually gets — and still loads real ESM, so this keeps testing
+  // that the dist needs no CJS require shims.
+  return import("wative-core");
+}
+
+const PASSWORD = "wsp-pwd";
+const MNEMONIC = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
+const EVM_PK = "0x4f3edf983ac636a65a842ce7c78d9aa706d3b113bce9c46f30d7d21715b23b1d";
+
+test("ESM dist consumer creates HD and PK accounts without global require shims", async () => {
+  const { Workspace } = await importDist();
+  assert.equal(globalThis.require, undefined);
+  const root = await mkdtemp(path.join(tmpdir(), "wative-core-esm-runtime-"));
+  const ws = await Workspace.open({ path: root, password: PASSWORD });
+
+  const hd = await ws.accounts.create("ESM HD", PASSWORD, MNEMONIC, undefined, { kind: "HD" });
+  const pk = await ws.accounts.create("ESM PK", PASSWORD, EVM_PK, undefined, { kind: "PK" });
+
+  assert.equal(hd.organizationType, "HD");
+  assert.equal(pk.organizationType, "PK");
+});
+
+test("ESM dist consumer signs EVM transactions without global require shims", async () => {
+  const { Workspace } = await importDist();
+  assert.equal(globalThis.require, undefined);
+  const root = await mkdtemp(path.join(tmpdir(), "wative-core-esm-tx-sign-"));
+  const ws = await Workspace.open({ path: root, password: PASSWORD });
+  const account = await ws.accounts.create("ESM TX PK", PASSWORD, EVM_PK, undefined, { kind: "PK" });
+  await account.tryUnlock(PASSWORD);
+  const address = account.wallets[0].addresses.find((candidate) => candidate.vm === "evm");
+
+  const tx = address.buildTransaction({
+    to: "0x000000000000000000000000000000000000dEaD",
+    value: "0",
+    nonce: 0,
+    chainId: 1,
+    gasLimit: "21000",
+    maxFeePerGas: "2000000000",
+    maxPriorityFeePerGas: "1000000000",
+  });
+  await tx.sign();
+
+  assert.match(tx.rawTransaction, /^0x[0-9a-fA-F]+$/);
+});
+
+test("ESM dist consumer signs SVM transactions without global require shims", async () => {
+  // Regression: the SVM signing path used require() for @solana/web3.js, bs58
+  // and tweetnacl, which throws "Dynamic require ... is not supported" under
+  // native ESM. These are now static imports like web3 on the EVM side.
+  const { Workspace } = await importDist();
+  assert.equal(globalThis.require, undefined);
+  const root = await mkdtemp(path.join(tmpdir(), "wative-core-esm-svm-sign-"));
+  const ws = await Workspace.open({ path: root, password: PASSWORD });
+  const account = await ws.accounts.create("ESM SVM HD", PASSWORD, MNEMONIC, undefined, { kind: "HD" });
+  await account.tryUnlock(PASSWORD);
+  const svm = account.wallets[0].addresses.find((candidate) => candidate.vm === "svm");
+  assert.ok(svm, "wallet exposes an SVM address");
+
+  const tx = svm.buildTransaction({
+    recipient: "11111111111111111111111111111111",
+    amount: "1000000",
+    recentBlockhash: "11111111111111111111111111111111",
+  });
+  await tx.sign();
+  assert.equal(tx.status, "signed");
+  assert.ok(typeof tx.hash === "string" && tx.hash.length > 0);
+});

package/examples/15-package-resolution.test.cjs

@@ -0,0 +1,76 @@
+// 15 — Package resolution. Every other example imports `../dist/index.cjs`
+// directly, which bypasses the `exports` map in package.json entirely. This
+// file is the only one that resolves the package the way a real consumer does:
+// by its bare name. It therefore covers the export conditions (`import` vs
+// `require`), the declared subpaths, and the parity between the two builds.
+//
+// It works without installing anything because Node resolves a package's own
+// name from inside that package ("self-reference"), which requires `name` and
+// `exports` to be present — so a broken exports map fails this file outright.
+
+const test = require("node:test");
+const assert = require("node:assert");
+
+const SUBPATHS = ["wative-core", "wative-core/artifacts/evm", "wative-core/artifacts/svm"];
+
+test("every declared subpath resolves by bare name under require(), to the CJS build", () => {
+  for (const specifier of SUBPATHS) {
+    const resolved = require.resolve(specifier);
+    assert.ok(
+      resolved.endsWith(".cjs"),
+      `${specifier} should resolve to the CJS build via the "require" condition, got ${resolved}`,
+    );
+    const mod = require(specifier);
+    assert.ok(mod && typeof mod === "object", `${specifier} exported nothing`);
+  }
+});
+
+test("bare-name require() exposes the documented entry points", () => {
+  const core = require("wative-core");
+  for (const name of ["Workspace", "Network", "Asset", "Provider", "WativeError"]) {
+    assert.ok(core[name], `wative-core should export ${name}`);
+  }
+  const evm = require("wative-core/artifacts/evm");
+  assert.strictEqual(typeof evm.ERC20.encode, "function");
+  const svm = require("wative-core/artifacts/svm");
+  assert.strictEqual(typeof svm.TokenProgram.encodeInstruction, "function");
+});
+
+test("every declared subpath resolves by bare name under import(), to the ESM build", async () => {
+  for (const specifier of SUBPATHS) {
+    const mod = await import(specifier);
+    assert.ok(mod && typeof mod === "object", `${specifier} exported nothing via import()`);
+  }
+});
+
+test("the CJS and ESM builds expose an identical export surface", async () => {
+  const cjs = require("wative-core");
+  const esm = await import("wative-core");
+
+  const cjsKeys = Object.keys(cjs).sort();
+  // The ESM namespace carries a `default` interop key that the CJS object does not.
+  const esmKeys = Object.keys(esm).filter((k) => k !== "default").sort();
+
+  assert.deepStrictEqual(
+    esmKeys,
+    cjsKeys,
+    "the two builds must expose the same named exports, or consumers get different APIs depending on how they import",
+  );
+  assert.ok(cjsKeys.length > 0, "expected a non-empty export surface");
+});
+
+test("the package advertises a Node version that the current runtime satisfies", () => {
+  const { engines } = require("wative-core/package.json");
+  assert.ok(engines && engines.node, "package.json should declare engines.node");
+
+  const required = engines.node.replace(/^[^\d]*/, "").split(".").map(Number);
+  const actual = process.versions.node.split(".").map(Number);
+  const satisfies =
+    actual[0] > required[0] ||
+    (actual[0] === required[0] && (actual[1] ?? 0) >= (required[1] ?? 0));
+
+  assert.ok(
+    satisfies,
+    `these examples are running on Node ${process.versions.node} but the package requires ${engines.node}`,
+  );
+});

package/examples/16-known-answer-vectors.test.cjs

@@ -0,0 +1,141 @@
+// 16 — Known-answer vectors. The other examples check that operations succeed
+// and that results look plausible ("is a string", "starts with 0x"). That kind
+// of assertion still passes if a key is derived from the wrong path, or if a
+// signature is produced by the wrong key — the two failures most likely to lose
+// someone's funds.
+//
+// This file pins exact expected values instead. Every EVM value below was taken
+// from the published BIP-39 / BIP-44 test vectors for the canonical "abandon …
+// about" mnemonic, not from this library's own output, so the assertions are
+// independent ground truth rather than a recording of current behaviour.
+
+const test = require("node:test");
+const assert = require("node:assert");
+const { mkdtempSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+
+const { Workspace } = require("wative-core");
+
+// The canonical all-zero BIP-39 entropy phrase. Publicly known — never fund it.
+const MNEMONIC =
+  "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";
+
+// m/44'/60'/0'/0/{0,1,2} for the mnemonic above. These are the standard vectors
+// reproduced by every BIP-44 implementation; a mismatch means the derivation
+// path or the seed derivation changed.
+const EVM_ADDRESSES = [
+  "0x9858EfFD232B4033E47d90003D41EC34EcaEda94",
+  "0x6Fac4D18c912343BF86fa7049364Dd4E424Ab9C0",
+  "0xb6716976A3ebe8D39aCEB04372f22Ff8e6802D7A",
+];
+
+// Solana derivation for the same mnemonic. Pinned as a regression vector: these
+// are this library's values, so they guard against silent drift in the SVM
+// derivation path rather than asserting an external standard.
+const SVM_ADDRESSES = [
+  "HAgk14JpMQLgt6rVgv7cBQFJWFto5Dqxi472uT3DKpqk",
+  "Hh8QwFUA6MtVu1qAoq12ucvFHNwCcVTV7hpWjeY1Hztb",
+  "7WktogJEd2wQ9eH2oWusmcoFTgeYi6rS632UviTBJ2jm",
+];
+
+// EIP-191 personal_sign of "hello" by the first EVM address. ECDSA here is
+// deterministic (RFC 6979), so the signature is a fixed value, and it verifies
+// externally as recovering to EVM_ADDRESSES[0].
+const EVM_SIGNATURE_HELLO =
+  "0x22f6b9cd7ff4f321e11181c4fe64adeea9469908fb514fbb6001fe022002dfda" +
+  "1f4ec9ea436bad14a7823806487d3aeb39b22e2556590922d6a8308971a17e991c";
+
+// Well-known test private key and the address it must produce.
+const EVM_PRIVATE_KEY = "0x4f3edf983ac636a65a842ce7c78d9aa706d3b113bce9c46f30d7d21715b23b1d";
+const EVM_PRIVATE_KEY_ADDRESS = "0x90F8bf6A479f320ead074411a4B0e7944Ea8c9C1";
+
+function newWorkspaceRoot(tag) {
+  return mkdtempSync(join(tmpdir(), `wative-kat-${tag}-`));
+}
+
+function addressFor(wallet, vm) {
+  const found = wallet.addresses.find((a) => a.vm === vm);
+  assert.ok(found, `wallet has no ${vm} address`);
+  return found;
+}
+
+test("HD derivation reproduces the published BIP-44 vectors for EVM", async () => {
+  const ws = await Workspace.open({ path: newWorkspaceRoot("hd"), password: "wsp-pwd" });
+  const acc = await ws.accounts.create("Desk", "wsp-pwd", MNEMONIC);
+  await acc.deriveWallets(EVM_ADDRESSES.length);
+
+  EVM_ADDRESSES.forEach((expected, i) => {
+    assert.strictEqual(
+      addressFor(acc.wallets[i], "evm").publicKey,
+      expected,
+      `m/44'/60'/0'/0/${i} derived the wrong address`,
+    );
+  });
+
+  await ws.lock();
+});
+
+test("HD derivation stays stable for Solana", async () => {
+  const ws = await Workspace.open({ path: newWorkspaceRoot("svm"), password: "wsp-pwd" });
+  const acc = await ws.accounts.create("Desk", "wsp-pwd", MNEMONIC);
+  await acc.deriveWallets(SVM_ADDRESSES.length);
+
+  SVM_ADDRESSES.forEach((expected, i) => {
+    assert.strictEqual(
+      addressFor(acc.wallets[i], "svm").publicKey,
+      expected,
+      `Solana derivation slot ${i} changed`,
+    );
+  });
+
+  await ws.lock();
+});
+
+test("an imported private key produces its known address", async () => {
+  const ws = await Workspace.open({ path: newWorkspaceRoot("pk"), password: "wsp-pwd" });
+  const acc = await ws.accounts.create("HotWallet", "wsp-pwd", EVM_PRIVATE_KEY, undefined, {
+    kind: "PK",
+  });
+
+  assert.strictEqual(
+    addressFor(acc.wallets[0], "evm").publicKey,
+    EVM_PRIVATE_KEY_ADDRESS,
+    "the private key produced an address it does not own",
+  );
+
+  await ws.lock();
+});
+
+test("personal-message signing produces the exact expected signature", async () => {
+  const ws = await Workspace.open({ path: newWorkspaceRoot("sign"), password: "wsp-pwd" });
+  const acc = await ws.accounts.create("Desk", "wsp-pwd", MNEMONIC);
+
+  const signature = addressFor(acc.wallets[0], "evm").signMessage("hello");
+
+  assert.strictEqual(
+    signature,
+    EVM_SIGNATURE_HELLO,
+    "signing 'hello' no longer yields the signature that recovers to " + EVM_ADDRESSES[0],
+  );
+
+  await ws.lock();
+});
+
+test("signatures are bound to the message and to the signing key", async () => {
+  const ws = await Workspace.open({ path: newWorkspaceRoot("bind"), password: "wsp-pwd" });
+  const acc = await ws.accounts.create("Desk", "wsp-pwd", MNEMONIC);
+  await acc.deriveWallets(2);
+
+  const first = addressFor(acc.wallets[0], "evm");
+  const second = addressFor(acc.wallets[1], "evm");
+
+  // A different message under the same key must not reuse the signature.
+  assert.notStrictEqual(first.signMessage("hello!"), EVM_SIGNATURE_HELLO);
+  // The same message under a different key must not either.
+  assert.notStrictEqual(second.signMessage("hello"), EVM_SIGNATURE_HELLO);
+  // And signing is repeatable for a given key and message.
+  assert.strictEqual(first.signMessage("hello"), EVM_SIGNATURE_HELLO);
+
+  await ws.lock();
+});