fix: gate quantum-safe chains in the wallet, not in the network list

Filtering `filterAvailable` by `isQuantumSafe` removed Polkadot and Kusama from
`selectableNetworks`, and `@polkadot/types-known` throws for a chain it holds
upgrade history for but cannot find:

    Error: Unable to find info for chain kusama
      at mapRaw (@polkadot/types-known/upgrades/index.js:13:15)

which made `@polkadot/api` fail at *import* — nothing to do with Quantus, and
not diagnosable from the message.

The mistake was gating a library primitive. These lists say what Substrate
knows about; what a wallet offers is the wallet's decision, and `isQuantumSafe`
stays exported so the extension can make it in its own chain list. Keeping them
complete also means a pasted Polkadot address still decodes and renders as what
it is — recognisable, and therefore refusable. A wallet that cannot decode an
address it will not accept can only say "invalid", which reads as a typo rather
than a warning.

`index.spec.ts` is restored from upstream with only the testnet-exposure and
shared-prefix deltas re-applied, since its network-ordering assertions had
started passing vacuously once Polkadot and Kusama left the list.

Also corrects Heisenberg's token symbol to HEI; `system_properties` on
wss://a1-heisenberg.quantus.cat says HEI, not QTC.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f

.123trigger

@@ -1,30 +0,0 @@
-8
-2.6.2
-2.12.2
-5.2.2
-5.2.3
-5.4.2
-5.4.3
-5.4.4
-5.5.2
-5.6.2
-5.6.3
-5.9.2
-6.0.2
-6.0.3
-6.0.4
-6.0.5
-
-7.0.2
-7.0.3
-7.1.2
-7.8.2
-7.9.2
-8.0.2
-8.0.3
-8.0.4
-8.0.5
-8.1.2
-8.2.2
-8.3.2
-8.3.3

.codeclimate.yml

@@ -1,21 +0,0 @@
-checks:
-  argument-count:
-    config:
-      threshold: 5
-  method-complexity:
-    config:
-      threshold: 7
-  method-count:
-    config:
-      threshold: 25
-  method-lines:
-    config:
-      threshold: 30
-
-exclude_patterns:
-- "**/*.spec.js"
-- "**/*.spec.ts"
-- "packages/networks/src/substrate.ts"
-- "packages/util/src/is/utf8.ts"
-- "packages/x-noble-hashes/src/**.ts"
-- "packages/x-noble-secp256k1/src/**.ts"

.eslintignore

@@ -1,2 +0,0 @@
-packages/x-noble-hashes/**/*.ts
-packages/x-noble-secp256k1/**/*.ts

.eslintrc.js

@@ -1,22 +0,0 @@
-// Copyright 2017-2022 @polkadot/util authors & contributors
-// SPDX-License-Identifier: Apache-2.0
-
-const base = require('@polkadot/dev/config/eslint.cjs');
-
-module.exports = {
-  ...base,
-  ignorePatterns: [
-    ...base.ignorePatterns
-  ],
-  parserOptions: {
-    ...base.parserOptions,
-    project: [
-      './tsconfig.eslint.json'
-    ]
-  },
-  rules: {
-    ...base.rules,
-    // this seems very broken atm, false positives
-    '@typescript-eslint/unbound-method': 'off'
-  }
-};

.github/issue_template.md

@@ -0,0 +1,86 @@
+<!--
+
+For general support, howto, coding and bundling questions, please
+use the Substrate & Polkadot StackExchange at
+
+  https://substrate.stackexchange.com/
+
+and get other ecosystem developers involved. This issues in this
+repository are meant for the tracking of feature requests and bug
+reports.
+
+While all issues are looked at non-bug and non-features would take
+quite a bit longer to get to and may yield less than satisfactory
+responses in this format.
+
+Additionally, please ensure you have done a search on the existing
+and closed issues before logging a new request. This saves time on
+all sides.
+
+-->
+
+
+* **I'm submitting a ...**
+
+<!---
+
+REQUIRED:
+
+Classify the type of report your are submitting
+
+-->
+
+  - [ ] Bug report
+  - [ ] Feature request
+  - [ ] Support request
+  - [ ] Other
+
+
+* **What is the current behavior and expected behavior?**
+
+<!---
+
+REQUIRED:
+
+If you're describing a bug, tell us what should happen. If you're
+suggesting a change/improvement, tell us how it should work.
+
+-->
+
+
+* **What is the motivation for changing the behavior?**
+
+<!---
+
+OPTIONAL:
+
+Suggest a motivation for the request or ideas how to implement the
+addition or change
+
+-->
+
+
+* **Please tell us about your environment:**
+
+<!---
+
+REQUIRED:
+
+Include as many relevant details about the environment in which you
+experienced the issue. Also ensure that you have tested against the
+latest stable releases if you believe this to be a bug
+
+-->
+
+  - Version:
+  - Environment:
+
+    - [ ] Node.js
+    - [ ] Browser
+    - [ ] Other (limited support for other environments)
+
+  - Language:
+
+    - [ ] JavaScript
+    - [ ] TypeScript (include tsc --version)
+    - [ ] Other

.github/workflows/auto-approve.yml

@@ -9,8 +9,8 @@ jobs:
     if: "! startsWith(github.event.head_commit.message, '[CI Skip]') && (!github.event.pull_request || github.event.pull_request.head.repo.full_name == github.repository)"
     runs-on: ubuntu-latest
     steps:
-      - uses: jacogr/action-approve@master
+      - uses: jacogr/action-approve@795afd1dd096a2071d7ec98740661af4e853b7da
         with:
-          authors: jacogr
+          authors: jacogr, TarikGul
           labels: -auto
           token: ${{ secrets.GH_PAT_BOT }}

.github/workflows/auto-merge.yml

@@ -8,9 +8,9 @@ jobs:
   merge:
     runs-on: ubuntu-latest
     steps:
-      - uses: jacogr/action-merge@master
+      - uses: jacogr/action-merge@d2d64b4545acd93b0a9575177d3d215ae3f92029
         with:
-          checks: build,lint,test
+          checks: pr (build),pr (lint),pr (test)
           labels: -auto
           strategy: squash
           token: ${{ secrets.GH_PAT_BOT }}

.github/workflows/lock.yml

@@ -10,16 +10,16 @@ jobs:
     env:
       YARN_ENABLE_SCRIPTS: false
     steps:
-      - uses: dessant/lock-threads@v2
+      - uses: dessant/lock-threads@c1b35aecc5cdb1a34539d14196df55838bb2f836
         with:
           github-token: ${{ secrets.GH_PAT_BOT }}
-          issue-lock-inactive-days: '7'
-          issue-lock-comment: >
+          issue-inactive-days: '7'
+          issue-comment: >
             This thread has been automatically locked since there has not been
             any recent activity after it was closed. Please open a new issue
             if you think you have a related problem or query.
-          pr-lock-inactive-days: '2'
-          pr-lock-comment: >
+          pr-inactive-days: '2'
+          pr-comment: >
             This pull request has been automatically locked since there
             has not been any recent activity after it was closed.
             Please open a new issue for related bugs.

.github/workflows/pr-any.yml

@@ -3,17 +3,26 @@ on: [pull_request]
 
 jobs:
   pr:
+    continue-on-error: true
     strategy:
       matrix:
-        step: ['lint', 'test', 'build']
-    name: ${{ matrix.step }}
+        step: ['lint', 'test', 'build', 'deno']
     runs-on: ubuntu-latest
     env:
       YARN_ENABLE_SCRIPTS: false
       CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 'lts/*'
+    - uses: denoland/setup-deno@v1
+      with:
+        # Deno v2 throws errors with specific types therefore we set it to the last version before v2
+        deno-version: v1.46.3
     - name: ${{ matrix.step }}
+      if: always()
       run: |
-        yarn install --immutable | grep -v 'YN0013'
+        deno --version
+        yarn install --immutable
         yarn ${{ matrix.step }}

.github/workflows/push-master.yml

@@ -10,20 +10,22 @@ jobs:
     strategy:
       matrix:
         step: ['build:release']
-    name: ${{ matrix.step }}
     runs-on: ubuntu-latest
     env:
       YARN_ENABLE_SCRIPTS: false
       CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
-      GH_PAT: ${{ secrets.GH_PAT }}
-      GH_RELEASE_GITHUB_API_TOKEN: ${{ secrets.GH_PAT }}
+      GH_PAT: ${{ secrets.GH_PAT_BOT }}
+      GH_RELEASE_GITHUB_API_TOKEN: ${{ secrets.GH_PAT_BOT }}
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         fetch-depth: 0
-        token: ${{ secrets.GH_PAT }}
+        token: ${{ secrets.GH_PAT_BOT }}
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 'lts/*'
     - name: ${{ matrix.step }}
       run: |
-        yarn install --immutable | grep -v 'YN0013'
+        yarn install --immutable
         yarn ${{ matrix.step }}

.github/workflows/semgrep.yml

@@ -1,20 +0,0 @@
-name: Semgrep
-on:
-  pull_request: {}
-  push:
-    branches:
-      - master
-
-jobs:
-  check:
-    if: "! startsWith(github.event.head_commit.message, '[CI Skip]') && (!github.event.pull_request || github.event.pull_request.head.repo.full_name == github.repository)"
-    runs-on: ubuntu-latest
-    env:
-      YARN_ENABLE_SCRIPTS: false
-    steps:
-      - uses: actions/checkout@v2
-      - uses: returntocorp/semgrep-action@v1
-        with:
-          auditOn: push
-          publishToken: ${{ secrets.SEMGREP_APP_TOKEN }}
-          publishDeployment: 1395

.github/workflows/stale.yml

@@ -1,19 +0,0 @@
-name: 'Close stale issues and PRs'
-on:
-  schedule:
-    - cron: '50 1/3 * * *'
-
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    env:
-      YARN_ENABLE_SCRIPTS: false
-    steps:
-      - uses: actions/stale@v3
-        with:
-          repo-token: ${{ secrets.GH_PAT_BOT }}
-          stale-issue-message: 'This issue has been open for 21 days with no activity and is not labelled as an enhancement. It will be closed in 7 days.'
-          stale-issue-label: 'stale'
-          exempt-issue-labels: '-size-l,-size-m,-size-s,-size-xl,-size-xs,[bug],ci'
-          days-before-stale: 21
-          days-before-close: 7

.gitignore

@@ -1,13 +1,12 @@
 --test-*
 _book/
 build/
-build-cjs/
-build-esm/
-build-docs/
+build-*/
 coverage/
-docs/.vuepress/dist/
 node_modules/
 tmp/
+/import_map.json
+/mod.ts
 .DS_Store
 .env.local
 .env.development.local
@@ -26,6 +25,4 @@ npm-debug.log*
 package-lock.json
 yarn-debug.log*
 yarn-error.log*
-store.db
-store.db.compacted
 tsconfig.*buildinfo

.prettierrc.cjs

@@ -1,4 +1,4 @@
-// Copyright 2017-2022 @polkadot/dev authors & contributors
+// Copyright 2017-2026 @polkadot/util authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 module.exports = require('@polkadot/dev/config/prettier.cjs');

.yarnrc.yml

@@ -1,13 +1,24 @@
+compressionLevel: mixed
+
+enableGlobalCache: false
+
 enableImmutableInstalls: false
 
 enableProgressBars: false
 
+logFilters:
+  - code: YN0013
+    level: discard
+
 nodeLinker: node-modules
 
-plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
-    spec: "@yarnpkg/plugin-interactive-tools"
-  - path: .yarn/plugins/@yarnpkg/plugin-version.cjs
-    spec: "@yarnpkg/plugin-version"
+yarnPath: .yarn/releases/yarn-4.9.1.cjs
 
-yarnPath: .yarn/releases/yarn-3.2.0.cjs
+# @quantus packages come from the Gitea registry. Safe as a whole-scope route
+# because we own every name in it — unlike @polkadot, where routing the scope
+# would send yarn looking for dozens of unforked packages that are not there.
+#
+# Reads are anonymous; publishing needs `pass gitea/package-publisher-token`.
+npmScopes:
+  quantus:
+    npmRegistryServer: "https://git.lair.cafe/api/packages/quantus/npm/"

CHANGELOG.md

@@ -1,5 +1,768 @@
 # CHANGELOG
 
+## 14.0.3 Mar 23, 2026
+
+Changes:
+
+- Fix(hw-ledger): reset transport on operation errors and add explicit disconnect API ([#2024](https://github.com/polkadot-js/common/pull/2024))
+
+
+## 14.0.2 Mar 16, 2026
+
+Changes:
+
+- Set headers to 2026 ([#2021](https://github.com/polkadot-js/common/pull/2021))
+
+Contributed:
+
+- fix(util-crypto): use correct x/y getters in secp256k1Expand ([#2018](https://github.com/polkadot-js/common/pull/2018)) (Thanks to https://github.com/AndreasGassmann)
+
+
+## 14.0.1 Dec 9, 2025
+
+Changes:
+
+- fix(x-randomvalues): prioritize native RN modules over polyfilled crypto ([#2013](https://github.com/polkadot-js/common/pull/2013))
+- sr25519: switch from wasm to micro-sr25519 ([#1971](https://github.com/polkadot-js/common/pull/1971))
+
+
+## 13.5.9 Nov 25, 2025
+
+Changes:
+
+- Bump polkadot dependencies ([#2011](https://github.com/polkadot-js/common/pull/2011))
+
+
+## 13.5.8 Nov 11, 2025
+
+Changes:
+
+- Bump @polkadot dependencies ([#2009](https://github.com/polkadot-js/common/pull/2009))
+
+
+## 13.5.7 Oct 13, 2025
+
+Changes:
+
+- Revert "Set pbkdf2Encode rounds to default to 210,000" ([#2007](https://github.com/polkadot-js/common/pull/2007))
+
+
+## 13.5.6 Aug 26, 2025
+
+Changes:
+
+- Set pbkdf2Encode rounds to default to 210,000 ([#1983](https://github.com/polkadot-js/common/pull/1983))
+- Bump @polkadot/wasm deps ([#2002](https://github.com/polkadot-js/common/pull/2002))
+
+Contributed:
+
+- Add DENTNet to generic Polkadot app supported chains ([#1942](https://github.com/polkadot-js/common/pull/1942))
+
+## 13.5.5 Aug 11, 2025
+
+Changes:
+
+- Add ledger support for Mythos ([#1969](https://github.com/polkadot-js/common/pull/1969))
+
+## 13.5.4 July 28, 2025
+
+Changes:
+
+- Add Creditcoin3 support to Generic Ledger App  ([#1985](https://github.com/polkadot-js/common/pull/1985))
+
+## 13.5.3 July 1, 2025
+
+Changes:
+
+- Update polkadot dependencies ([#1995](https://github.com/polkadot-js/common/pull/1995))
+- Add Optional Strict Input Checking to u8aToU8a ([#1994](https://github.com/polkadot-js/common/pull/1994))
+- Update scrypt parameter validation ([#1993](https://github.com/polkadot-js/common/pull/1993))
+
+## 13.5.2 Jun 17, 2025
+
+Changes:
+
+- fix: enhance error handling for secure random number generation in React Native ([#1991](https://github.com/polkadot-js/common/pull/1991))
+- Add input length validation in scryptFromU8a function ([#1990](https://github.com/polkadot-js/common/pull/1990))
+
+Contributed:
+
+- Add Liberland support to Generic Ledger App ([#1989](https://github.com/polkadot-js/common/pull/1989))
+
+## 13.5.1 May 19, 2025
+
+Changes:
+
+- Ledger ECDSA signing support ([#1986](https://github.com/polkadot-js/common/pull/1986))
+- Bump yarn to 4.9.1 ([#1987](https://github.com/polkadot-js/common/pull/1987))
+
+
+## 13.4.4 Apr 14, 2025
+
+Changes:
+
+- Improve objectSpread function property handling ([#1982](https://github.com/polkadot-js/common/pull/1982))
+
+
+## 13.4.3 Feb 17, 2025
+
+Changes:
+
+- Rollback ws change in x-ws ([#1980](https://github.com/polkadot-js/common/pull/1980))
+  NOTE: this rollbacks changes made in ([#1976](https://github.com/polkadot-js/common/pull/1976)) to ensure websocket usage doesnt break in any downstream libs.
+
+
+## 13.4.2 Feb 17, 2025
+
+Changes:
+
+- Cast ws as global.WebSocket ([#1978](https://github.com/polkadot-js/common/pull/1978))
+
+
+## 13.4.1 Feb 16, 2025
+
+Changes:
+
+- Enable KeyringPair Creation with Custom Mnemonic Wordlists ([#1974](https://github.com/polkadot-js/common/pull/1974))
+- Use ws library in Node.js 22+ for Better WebSocket Error Handling ([#1976](https://github.com/polkadot-js/common/pull/1976))
+- Fix Misclassification of ECDSA Signatures in `verifyMultisig` ([#1973](https://github.com/polkadot-js/common/pull/1973))
+- Bump dev to 0.83.2 ([#1972](https://github.com/polkadot-js/common/pull/1972))
+- Bump yarn to 4.6.0 ([#1967](https://github.com/polkadot-js/common/pull/1967))
+
+
+## 13.3.1 Jan 6, 2025
+
+Changes:
+
+- Give compatibility for nodejs v22
+  - Fix `getSeparator` which fixes toLocaleString ([#1965](https://github.com/polkadot-js/common/pull/1965))
+- 2025 Headers ([#1963](https://github.com/polkadot-js/common/pull/1963))
+
+
+## 13.2.3 Nov 11, 2024
+
+Contributed:
+
+- Add Vara support to the Generic Ledger App ([#1958](https://github.com/polkadot-js/common/pull/1958)) (Thanks to https://github.com/breathx)
+
+Changes:
+
+- Bump Dev to 0.82.1 ([#1959](https://github.com/polkadot-js/common/pull/1959))
+
+
+## 13.2.2 Oct 28, 2024
+
+Contributed:
+
+- Add Polimec support to the Generic Ledger App ([#1945](https://github.com/polkadot-js/common/pull/1945)) (Thanks to https://github.com/lrazovic)
+- Add Frequency to the Generic Ledger App ([#1955](https://github.com/polkadot-js/common/pull/1955)) (Thanks to https://github.com/wilwade)
+
+Changes:
+
+- Bump yarn to 4.5.1 ([#1953](https://github.com/polkadot-js/common/pull/1953))
+
+
+## 13.2.1 Oct 21, 2024
+
+Contributed:
+
+- Add bittensor to genericLedgerApps (Thanks to https://github.com/camfairchild) ([#1941](https://github.com/polkadot-js/common/pull/1941))
+
+Changes:
+
+- Fix Deno CI Build ([#1947](https://github.com/polkadot-js/common/pull/1947))
+- Bump yarn to 4.5.0 ([#1946](https://github.com/polkadot-js/common/pull/1946))
+- Update Ledger Deps ([#1948](https://github.com/polkadot-js/common/pull/1948))
+- Update WS and deps ([#1949](https://github.com/polkadot-js/common/pull/1949))
+- Bump polkadot/wasm to 7.4.1 ([#1950](https://github.com/polkadot-js/common/pull/1950))
+- Bump dev to 0.81.2 ([#1951](https://github.com/polkadot-js/common/pull/1951))
+  - Allows for CJS target in build
+
+
+## 13.1.1 Sep 16, 2024
+
+Contributed:
+
+HydraDx - Hydration Rebrand Thanks to (https://github.com/jak-pan) ([#1923](https://github.com/polkadot-js/common/pull/1923))
+
+Changes:
+
+- Update all deps that have patch releases ([#1934](https://github.com/polkadot-js/common/pull/1934))
+- Bump yarn to 4.4.1 ([#1940](https://github.com/polkadot-js/common/pull/1940))
+- Update ss58-registry to 1.50.0 ([#1937](https://github.com/polkadot-js/common/pull/1937))
+- Update dev and typescript ([#1936](https://github.com/polkadot-js/common/pull/1936))
+- Add Encointer and Integritee to Ledger, and adjust tests ([#1939](https://github.com/polkadot-js/common/pull/1939))
+  - This PR added the addition of `genericLedgerApps` and `prevLedgerRecord` objects. They both combine into `ledgerApps` in `hw-ledger/defaults`.
+
+
+## 13.0.2 July 12, 2024
+
+Contributed:
+
+- Add peaq support for ledger (Thanks to https://github.com/lavish0000)
+
+
+## 13.0.1 July 12, 2024
+
+Breaking Changes:
+
+- Add Support for latest Ledger App
+  - This deprecates `class Ledger` in favor of `class LedgerGeneric`
+  - More info in the following PR ([#1925](https://github.com/polkadot-js/common/pull/1925))
+
+Changes:
+
+- Bump dev to 0.79.1
+- Comments around pair encode/decode 1-3
+- Bump ws, react-native, ss58Registry
+- Bump yarn to 4.3.1
+- Update CI to checkout and setup_node v4
+
+
+## 12.6.2 Dec 18, 2023
+
+Changes:
+
+- Update to latest `@polkadot/wasm-crypto`
+- Upgrade dependencies to latest versions
+
+
+## 12.6.1 Nov 18, 2023
+
+Contributed:
+
+- Ledger support for Quartz (Thanks to https://github.com/CertainLach)
+- Add flag to disable same-version esm/cjs warnings (Thanks to https://github.com/forgetso)
+
+Changes:
+
+- Adjust logger check for `process.env`
+- Adjust `isRiscV` helper to check for `PVM\0` bytes
+- Drop support for Node 16 (EOL 11 Sep 2023)
+- Upgrade dependencies to latest stable versions
+
+
+## 12.5.1 Sep 15, 2023
+
+Contributed:
+
+- Add `isRiskV` helper (Thanks to https://github.com/peetzweg)
+- Ledger support for Enjin & Matrixchain (Thanks to https://github.com/leonardocustodio)
+
+Changes:
+
+- Expand interface type comments (assists in-editor helpers)
+- Upgrade dependencies to latest stable versions
+
+
+## 12.4.2 Aug 23, 2023
+
+Changes:
+
+- Fix `u8aTo{BigInt, Bn, Number}` for non-negative `i{8, 16, 32...}` inputs
+- Extend `u8aToBuffer` with `hasBuffer` check
+- Adjust util tests (extract input/output arrays)
+
+
+## 12.4.1 Aug 17, 2023
+
+Changes:
+
+- Add support for Ledger `signRaw`, as exposed by lower-level
+- Update code to use `?.` shortcuts where appropriate
+- Adjust `u8aToBuffer` & `isBuffer` typings to not require `Buffer`
+- Use `stringify/import.meta.url` helpers in specs
+- Upgrade dependencies to latest stable versions
+
+
+## 12.3.2 Jun 12, 2023
+
+Changes:
+
+- Adjust `SubstrateNetwork` typing with `HexString` genesisHash
+- Re-export `Constructor<T>` type (deprecated, replaced with `Class<T>`)
+
+
+## 12.3.1 Jun 11, 2023
+
+Changes:
+
+- Only allow padding characters in base64 strings
+- Expand typings for keyring meta with known keys
+- Adjust object index access for stricter tsconfig settings
+
+
+## 12.2.2 Jun 4, 2023
+
+Changes:
+
+- Apply missing count assignment for `for (...)` loops
+- Remove unused `@types/*` dev dependencies
+- Upgrade dependencies to latest stable versions
+
+
+## 12.2.1 May 13, 2023
+
+Changes:
+
+- Align `u8aToBigInt` tests with `u8aToBn`
+- Unroll loops on most-frequently used paths for `u8aToBigInt`
+- Add `module` to `package.json` export map (ESM-only)
+- Upgrade dependencies to latest stable versions
+
+
+## 12.1.2 May 1, 2023
+
+Changes:
+
+- Adjust typing for `isChildClass` & `Constructor` usage
+
+
+## 12.1.1 Apr 29, 2023
+
+Changes:
+
+- Add shareable `identity` & `noop` functions
+- Flatten `Buffer | Uint8Array` types (as used) to base-only `Uint8Array`
+- Apply `readonly` specifiers to private class fields where applicable
+- Adjust compilation output for `__internal__` class fields
+- Remove unused types from `util`
+- Upgrade dependencies to latest stable versions
+
+
+## 12.0.1 Apr 22, 2023
+
+Contributed:
+
+- Add Cere genesisHash (Thanks to https://github.com/shamilkhan)
+
+Changes:
+
+- Swap secp256k1 functionality to `@noble/curves`
+- Swap ed25519 functionality to `@noble/curves`
+- Replace `tweetnacl` secretbox usage with slimmer local version
+- Adjust `isCodec` helper with closer API alignment
+- Initial steps to multi-language bip39 support
+- Use Node webcrypto for Node `getRandomValues` support
+- Upgrade dependencies to latest stable versions
+- Drop support for Node 14 (EOL 30 Apr 2023)
+
+
+## 11.1.3 Apr 1, 2023
+
+Contributed:
+
+- Add Bittensor genesisHash (Thanks to https://github.com/camfairchild)
+
+Changes:
+
+- Allow empty string as valid base32/base58/base64 decoder input
+- Add additional/missing `/*#__PURE__*/` annotations
+- Upgrade dependencies to latest stable versions
+
+
+## 11.1.2 Mar 25, 2023
+
+Changes:
+
+- Expand error details for invalid publicKeys in secp256k1 compress/expand operations
+- Expand `@polkadot/hw-ledger` with specific per-method JSDoc
+- Upgrade dependencies to latest stable versions
+
+
+## 11.1.1 Mar 18, 2023
+
+Contributed:
+
+- Add 3DPass genesisHash (Thanks to https://github.com/fedosov)
+
+Changes:
+
+- Remove support for encrypt/decrypt functionality on keypair
+- Upgrade dependencies to latest stable versions
+
+
+## 11.0.2 Mar 11, 2023
+
+Changes:
+
+- Use consistent `.js` imports in source files (TS moduleResolution)
+- Remove TS resolveJsonModule option
+- Upgrade to `@polkadot/wasm-crypto` 7.0.3
+
+
+## 11.0.1 Mar 4, 2023
+
+Changes:
+
+- Change `@polkadot/x-ws` to use [ws](https://www.npmjs.com/package/ws) package (previous: `websocket`)
+- Add `/*#__PURE__*/` annotations for `@polkadot/x-*` packages
+- Swap TS -> JS compiler to use tsc (from babel)
+- Adjust all tests to use `node:test` runner (ESM variants)
+- Move `cryptoWaitReady()` top-level in test files
+- Upgrade to `@polkadot/wasm-crypto` 7.0.1
+
+
+## 10.4.2 Feb 19, 2023
+
+Contributed:
+
+- Ledger support for Pendulum (Thanks to https://github.com/carlosala)
+
+Changes:
+
+- Ensure `u8aToU8a` correctly unwraps Buffer value (check ordering)
+- Upgrade dependencies to latest stable versions
+
+
+## 10.4.1 Feb 12, 2023
+
+Contributed:
+
+- Locale support for number formatting (Thanks to https://github.com/alko89)
+- Ledger support for Picasso (Thanks to https://github.com/carlosala)
+
+Changes:
+
+- Add `isClass` helper (checks if input is actual Class Constructor)
+- Adjust `isChildClass` to rely on new `isClass`
+- Upgrade dependencies to latest stable versions
+
+
+## 10.3.1 Jan 28, 2023
+
+Contributed:
+
+- Ledger support for Ternoa (Thanks to https://github.com/mohsinriaz17)
+
+Changes:
+
+- Expand `arrayChunk` tests
+- Adjust output for Ledger sanity checks
+- Expand exported `bigint` constants to match with those in `BN`
+- Adjust internal character maps to operate on `Uint8Array` instad of `Array<number>`
+- Upgrade dependencies to latest stable versions
+
+
+## 10.2.6 Jan 13, 2023
+
+Changes:
+
+- Drop stray `console.error` log (it really _is_ Friday 13th)
+
+
+## 10.2.5 Jan 13, 2023
+
+Changes:
+
+- Bugfix for `formatBalance` (forceUnit) with `BN` inputs where output is less than 0
+
+
+## 10.2.4 Jan 13, 2023
+
+Changes:
+
+- Add the `withAll` (default false) flag to `formatBalance` to format to max decimals
+- Add the `withZero` (default true) flags to `formatBalance` to retain trailing zeros
+
+
+## 10.2.3 Jan 7, 2023
+
+Changes:
+
+- Adjust `isBuffer` check on `xglobal` (no auto-polyfill detection on eg. parcel)
+- Upgrade dependencies to latest stable versions
+
+
+## 10.2.2 Jan 6, 2023
+
+Contributed:
+
+- Adjust Nodle Ledger mapping (Thanks to https://github.com/aliXsed)
+
+Changes:
+
+- Upgrade dependencies to latest stable versions
+
+
+## 10.2.1 Dec 4, 2022
+
+Contributed:
+
+- Ledger support for Ajuna (Thanks to https://github.com/carlosala)
+
+Changes:
+
+- `has{Buffer, Process}` now checks on `globalThis` (helps bundlers with auto-injection)
+- Add `/*#__PURE__*/` annotations for specific `export const something = someFunction(...)`
+- Upgrade dependencies to latest stable versions
+- Upgrade to `@polkadot/wasm-crypto` 6.4.1
+
+
+## 10.1.14 Nov 27, 2022
+
+Changes:
+
+- Upgrade dependencies to latest stable versions
+
+
+## 10.1.13 Nov 20, 2022
+
+Contributed:
+
+- Ledger support for Origintrail (Thanks to https://github.com/carlosala)
+
+Changes:
+
+- Expand type descriptions around Ledger-based structures
+- Upgrade dependencies to latest stable versions
+
+
+## 10.1.12 Nov 13, 2022
+
+Changes:
+
+- Upgrade dependencies to latest stable versions
+
+
+## 10.1.11 Oct 15, 2022
+
+Changes:
+
+- Upgrade dependencies to latest stable versions
+
+
+## 10.1.10 Oct 7, 2022
+
+Changes:
+
+- Ensure `{bn, n, number}ToHex(0)` always respects `bitLength`
+- Upgrade dependencies to latest stable versions
+
+
+## 10.1.9 Sep 24, 2022
+
+Contributed:
+
+- Ledger support for VTB (Thanks to https://github.com/GuilaneDen)
+
+Changes:
+
+- Upgrade dependencies to latest stable versions
+
+
+## 10.1.8 Sep 17, 2022
+
+Contributed:
+
+- Ledger support for Darwinia, Phala & Khala (Thanks to https://github.com/carlosala)
+- Ledger support for HydraX (Thanks to https://github.com/chcmedeiros)
+
+Changes:
+
+- Expand test cases
+- Upgrade dependencies to latest stable versions
+
+
+## 10.1.7 Sep 2, 2022
+
+Changes:
+
+- Hoist Ledger interface wrapError (internal adjustment)
+- Upgrade dependencies to latest stable versions
+
+
+## 10.1.6 Aug 23, 2022
+
+Changes:
+
+- Adjust `nextTick` with greater care for browser loops
+- Upgrade dependencies to latest stable versions
+
+
+## 10.1.5 Aug 21, 2022
+
+Changes:
+
+- Adjust `ledgerApps` to use new `@zondax/ledger-substrate` interfaces
+- Upgrade dependencies to latest stable versions
+
+
+## 10.1.4 Aug 12, 2022
+
+Contributed:
+
+- Ledger support for Kusama Bifrost (Thanks to https://github.com/awesomepan)
+
+Changes:
+
+- Upgrade dependencies to latest stable versions
+
+
+## 10.1.3 Aug 5, 2022
+
+Changes:
+
+- Optimization for empty `arrayFlatten` case
+- Coding cleanups for logger (no `as` casting)
+- Optiomizations in assertion checks
+
+
+## 10.1.2 Jul 29, 2022
+
+Changes:
+
+- Upgrade dependencies to latest stable versions
+
+
+## 10.1.1 Jul 21, 2022
+
+Changes:
+
+- Add `arrayUnzip` as reverse of `arrayZip`
+- Adjust `objectSpread` to natively handle `Map` entries spreads
+- Adjust `isAscii` check to disallow `\t`, `\n`, & `\r` characters
+- Adjust `nobody` zero-key pair with pre-computed address
+- Align `objectProperty` & `lazyMethod` call signatures (backwards compatible)
+- Various internal speed optimizations
+- Upgrade dependencies to latest stable versions
+
+
+## 10.0.2 Jul 10, 2022
+
+Changes:
+
+- Adjust async import in `x-fetch` to be Jest-friendly
+
+
+## 10.0.1 Jul 8, 2022
+
+- **Breaking change** In this major version version previously deprecated function signatures have been removed. If still using the old forms for either `bnToHex`, `bnToU8a`, `formatBalance`, `hexToBn` or `u8aToBn`, please update and only pass through an options object as the second parameter.
+
+Contributed:
+
+- Ledger support for Stafi (Thanks to https://github.com/kaelnew)
+- Ledger support for Aleph Zero (Thanks to https://github.com/carlosala)
+- Add genesis for HydraDX parachain (Thanks to https://github.com/jak-pan)
+
+Changes:
+
+- Remove deprecated signatures for `bnToHex`, `bnToU8a`, `formatBalance`, `hexToBn`, `u8aToBn`
+- Align option handling of `n*` (BigInt) functions with `bn*` (BN)
+- Allow for usage without `@types/node` installed
+- Adjust for available ESM-only dependencies
+- Upgrade dependencies to latest stable versions
+- Upgrade to `@polkadot/wasm-crypto` 6.2.3
+
+
+## 9.7.2 Jul 4, 2022
+
+Changes:
+
+- Upgrade to `@polkadot/wasm-crypto` 6.2.2
+
+
+## 9.7.1 Jul 1, 2022
+
+Changes:
+
+- Update signatures where `readonly` arrays are used
+- Upgrade dependencies to latest stable versions
+- Upgrade to `@polkadot/wasm-crypto` 6.2.1
+
+
+## 9.6.2 Jun 25, 2022
+
+Changes:
+
+- Fix `hexToU8a` where `0x` is not correctly converted
+
+
+## 9.6.1 Jun 23, 2022
+
+Changes:
+
+- Add `floatToU8a` and `u8aToFloat` (both 32 & 64-bit, le & be)
+- Adjust `isUndefined` check (local variable available)
+- Adjust use of `assert`, `isUndefined` & `isNull`
+
+
+## 9.5.1 Jun 18, 2022
+
+Contributed:
+
+- Update Bifrost genesisHash (Thanks to https://github.com/awesomepan)
+- Add Ledger support for Composable (Thanks to https://github.com/carlosala)
+
+Changes:
+
+- Add `u8aToNumber` (limited, <= 48 bits) function
+- Use `~~` as bitwise/faster `Math.floor` replacement
+- Remove unneeded `objectSpread` option expansions
+- Optimize `hexToU8a` operations
+- Optimize `stringCamelCase` operations
+- Optimize `u8aToBn` operations
+- Additional internal/external comments (as missing)
+- Upgrade dependencies to latest stable versions
+
+
+## 9.4.1 Jun 4, 2022
+
+Changes:
+
+- Add `nextTick` to `@polkadot/util` to defer execution to the queue
+- Upgrade dependencies to latest stable versions
+
+
+## 9.3.1 May 29, 2022
+
+Contributed:
+
+- Add Ledger support for Parallel (Thanks to https://github.com/carlosala)
+- Add Ledger support for Astar & Polkadex (Thanks to https://github.com/carlosala)
+
+Changes:
+
+- Adjust `u8aToU8a` checks with better `isU8a` shortcut
+- Adjust compact conversion with unrolled loops
+- Adjust `string{Camel, Pascal}Case` with loop (no map)
+- Add `compactFromU8aLim` variant with Uint8Array-only inputs
+- Add `u8aConcatStrict` variant with Uint8Array-only inputs
+- Internal code maintainability enhancements
+- Upgrade dependencies to latest stable versions
+
+
+## 9.2.1 May 13, 2022
+
+Contributed:
+
+- Add Ledger support for Acala (Thanks to https://github.com/ntduan)
+
+Changes:
+
+- Optimize `u8aToHex` with direct (non-hex) conversion
+- Change all occurences of `.substr(...)` to `.substring(...)`
+- Sync with upstream Substrate ss58 registry
+- Mark deprecated function signatures (no removals)
+- Re-enable auto init of `cryptoWaitReady()`
+- Upgrade to `@polkadot/wasm-crypto` 6.1.1
+
+
+## 9.1.1 Apr 30, 2022
+
+Contributed:
+
+- Add Ledger support for Statemint (Thanks to https://github.com/carlosala)
+- Add Ledger support for xxnetwork (Thanks to https://github.com/xx-labs)
+
+Changes:
+
+- Adjust/dedupe output from `detectPackage`
+- Adjust `isHex` performance test
+- Add field-level comments to some `*Options` structures
+- Add new Rococo genesisHash (reset)
+
+
 ## 9.0.1 Apr 9, 2022
 
 - **Breaking change** In this major version the commonjs outputs are moved to a sub-folder. Since the export map and main field in package.json does reflect this change, there should be no usage changes. However the packages here will all need to be on the same version for internal linkage.

CONTRIBUTORS

@@ -1,47 +1,77 @@
-    1293	Jaco                          	9.0.1 (#1457)
+    1674	Jaco                          	Bump deps (#1912)
+      47	Tarik Gul                     	14.0.3 (#2025)
+      13	Carlo Sala                    	feat(networks): add zeitgeist Ledger support (#1840)
+      11	Valentin Fernandez            	13.5.7 (#2008)
        9	Antoine Estienne              	Add eth uri keyring test (#1291)
+       9	rajk93                        	14.0.1 (#2014)
        6	Amaury Martiny                	Add tests from Rust (#283)
+       6	Jakub Pánik                   	HydraDX -> Hydration rebrand (#1923)
+       5	Arjun Porwal                  	13.5.6 (#2004)
        5	kwingram25                    	Add BN consts and timeToString (#610)
        4	Adam Dossa                    	Update Polymesh Genesis Hash (#1193)
-       4	Jakub Pánik                   	Add basilisk 🐍 (#1396)
+       4	pan                           	add bifrost kusama (#1626)
+       3	AndreasGassmann               	fix(util-crypto): use correct x/y getters in secp256k1Expand (#2018)
        3	Luke Schoen                   	docs: Fix example in readme since we use default imports (#243)
-       2	AndreasGassmann               	feat(dependencies): remove moment.js (#530)
+       2	Cameron Fairchild             	Add bittensor details (#1783)
        2	Gav Wood                      	Fix stake:unstake (#182)
        2	Hyungsuk Kang                 	Add cross client Encryption/Decryption (#496)
        2	Jared Norris                  	Add Sora network (#1306)
        2	Kami                          	Adding Westend genesis. (#1429)
        2	Lovesh Harchandani            	Update genesis hash of Dock mainnet (#1436)
        2	Nantian                       	fix bigint type (#1079)
-       2	pan                           	add bifrost (#1296)
        2	Stefanie Doll                 	Add missing dependencies to util-crypto (#424)
        1	Agustinus Theodorus           	docs: fix typo in naclSeal docs. (#1005)
+       1	Aleš Ferlan                   	feat: allow setting of thousand/decimal separators (#1722)
+       1	Alex Sedighi                  	fix Nodle's known network name (#1699)
        1	Alexander Krupenkin           	Added ECDSA keypair support (#589)
        1	alexdniep                     	added equilibrium slip44; added equilibrium genesis hash (#984)
        1	amphineko                     	chore: fix typo in versionDetect messages (#941)
        1	Axel Chalon                   	Simplify @polkadot/keyring KeyringPair (#419)
        1	Brad Larson                   	[FIX] Adjust error message (#646)
+       1	Carlos Medeiros               	add hydradx to knownLedger (#1647)
+       1	Chris                         	Get rid of warnings for dual esm and cjs packages of the same version (#1890)
+       1	Dmitrii Novikov               	Add `Vara` support to Generic Ledger App (#1958)
        1	Eliott Teissonniere           	add nodle ledger specs (#1089)
+       1	Francis O'Brien               	Fix(hw-ledger): reset transport on operation errors and add explicit disconnect API (#2024)
+       1	Guilane DENGUIR               	feat(VTB): Added support for VTB blockchain (#1651)
        1	h4x3rotab                     	Throws an error when signing with a locked keypair (#578)
        1	Harry Liu                     	Update README.md (#446)
+       1	henrikdent                    	Add DENTNet ledger support (via generic Polkadot app) (#1942)
        1	Hoon Kim                      	replace plasm genesis with astar (#1397)
        1	Hussein Ait-Lahcen            	Add Picasso Genesis Hash (#1261)
        1	Igor                          	Support genshiro network (#1148)
        1	Jake Naviasky                 	Add evmToAddress and addressToEvm crypto utils. (#705)
        1	JesseAbram                    	added check if valid address to docs (#440)
        1	joe petrowski                 	Add example for multisig address creation (#590)
+       1	José Molina Colmenero         	Add ledger support for Mythos (#1969)
+       1	kaelnew                       	add ledger support for stafi (#1569)
+       1	Leonardo Custodio             	Ledger support (#1879)
+       1	Leonardo Razovic              	feat: add Polimec (#1945)
        1	Lezek123                      	logger - wildcard include/exclude with DEBUG env (#932)
+       1	Lovish Arora                  	Add peaq support for ledger (#1928)
        1	Mario Neises                  	remove redudant export (#257)
        1	Miguel Hervas                 	Add CFG Ledger Support (#1057)
+       1	Mikhail Fedosov               	feat: add 3dpass network (#1769)
+       1	Mohsan Riaz                   	Add Ternoa for ledger hardware support (#1711)
        1	nahuseyoum                    	Reserving 65 for Aventus based on the new extended range (#871)
+       1	Nantian                       	add acala ledger config (#1485)
+       1	Paul Miller                   	sr25519: switch from wasm to micro-sr25519 (#1971)
+       1	peetzweg/                     	adds `isRiscV` guard function similar to isWasm (#1878)
        1	qwer951123                    	Add acala genesis (#1161)
+       1	Radek Bochenek                	feat: add Liberland support to Generic Ledger App (#1989)
        1	Raoul Millais                 	Fix yarn add instructions in x-global README (#873)
        1	Raymond Zhong                 	Add Edgeware ledger app (#1006)
        1	Reto Trinkler                 	Adding 4 as address type of ss58 for Katal Chain (#639)
        1	Rocco Musolino                	remove doc broken link (#697)
+       1	Salina                        	Add Creditcoin3 support to Generic Ledger App (#1985)
+       1	Shamilkhan                    	Add genesis hash for Cere Network (#1806)
        1	Song Zhou                     	Add in ability to encrypt/decrypt msg with keyring (#1070)
        1	Thibaut Sardan                	add hasLedgerSupport prop to networks (#835)
        1	Tomokazu Kozuma               	fix comment (#1119)
        1	Tore19                        	Add stafi genesis hash (#1096)
        1	Wei Tang                      	ss58: add Kulupu prefix to the list (#595)
+       1	Wil Wade                      	Add Frequency to the Generic Ledger App (#1955)
        1	WoeOm                         	Handing high precision scenes (#450)
+       1	xx network                    	Add xxnetwork genesis hash and ledger app (#1463)
+       1	Yaroslav Bolyukin             	Add quartz support for ledger, update unique slip-0044 identifier (#1882)
        1	Yuri                          	Extra check for process for browser bundles (#923)

README.md

@@ -1,10 +1,3 @@
-[![polkadotjs](https://img.shields.io/badge/polkadot-js-orange?logo=&style=flat-square)](https://polkadot.js.org)
-![license](https://img.shields.io/badge/License-Apache%202.0-blue?logo=apache&style=flat-square)
-[![npm](https://img.shields.io/npm/v/@polkadot/util?logo=npm&style=flat-square)](https://www.npmjs.com/package/@polkadot/util)
-[![beta](https://img.shields.io/npm/v/@polkadot/util/beta?label=beta&logo=npm&style=flat-square)](https://www.npmjs.com/package/@polkadot/util)
-[![maintainability](https://img.shields.io/codeclimate/maintainability-percentage/polkadot-js/common?logo=code-climate&style=flat-square)](https://codeclimate.com/github/polkadot-js/common)
-[![coverage](https://img.shields.io/codeclimate/coverage/polkadot-js/common?logo=code-climate&style=flat-square)](https://codeclimate.com/github/polkadot-js/common)
-
 # @polkadot/common
 
 Various useful utility functions that are used across all projects in the [@polkadot](https://polkadot.js.org) namespace. It provides utility functions with additional safety checks, allowing not only for consistent coding, but also reducing the general boilerplate.

babel.config.cjs

@@ -1,4 +0,0 @@
-// Copyright 2017-2022 @polkadot/util authors & contributors
-// SPDX-License-Identifier: Apache-2.0
-
-module.exports = require('@polkadot/dev/config/babel-config-cjs.cjs');

eslint.config.js

@@ -0,0 +1,8 @@
+// Copyright 2017-2026 @polkadot/util authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import baseConfig from '@polkadot/dev/config/eslint';
+
+export default [
+  ...baseConfig
+];

import_map.in.json

@@ -0,0 +1,5 @@
+{
+  "imports": {
+    "https://esm.sh/v90/@types/bn.js@~5.2/index.d.ts": "https://esm.sh/v90/@types/bn.js@5.1.0/index.d.ts"
+  }
+}

jest.config.cjs

@@ -1,19 +0,0 @@
-// Copyright 2017-2022 @polkadot/util authors & contributors
-// SPDX-License-Identifier: Apache-2.0
-
-const config = require('@polkadot/dev/config/jest.cjs');
-
-module.exports = Object.assign({}, config, {
-  moduleNameMapper: {
-    '@polkadot/hw-ledger-transports(.*)$': '<rootDir>/packages/hw-ledger-transports/src/node',
-    // eslint-disable-next-line sort-keys
-    '@polkadot/hw-ledger(.*)$': '<rootDir>/packages/hw-ledger/src/$1',
-    '@polkadot/keyring(.*)$': '<rootDir>/packages/keyring/src/$1',
-    '@polkadot/networks(.*)$': '<rootDir>/packages/networks/src/$1',
-    '@polkadot/util-(crypto)(.*)$': '<rootDir>/packages/util-$1/src/$2',
-    // eslint-disable-next-line sort-keys
-    '@polkadot/util(.*)$': '<rootDir>/packages/util/src/$1',
-    '@polkadot/x-(bigint|global)(.*)$': '<rootDir>/packages/x-$1/src/$2',
-    '@polkadot/x-(fetch|randomvalues|textdecoder|textencoder|ws)(.*)$': '<rootDir>/packages/x-$1/src/node'
-  }
-});

package.json

@@ -1,37 +1,46 @@
 {
   "author": "Jaco Greeff <jacogr@gmail.com>",
   "bugs": "https://github.com/polkadot-js/common/issues",
+  "engines": {
+    "node": ">=18.14"
+  },
   "homepage": "https://github.com/polkadot-js/common#readme",
   "license": "Apache-2.0",
-  "packageManager": "yarn@3.2.0",
+  "packageManager": "yarn@4.9.1",
   "private": true,
   "repository": {
     "type": "git",
     "url": "https://github.com/polkadot-js/common.git"
   },
   "sideEffects": false,
-  "version": "9.0.1",
+  "type": "module",
+  "version": "14.0.3",
+  "versions": {
+    "git": "14.0.3",
+    "npm": "14.0.3"
+  },
   "workspaces": [
     "packages/*"
   ],
   "scripts": {
     "build": "polkadot-dev-build-ts",
+    "build:networks": "polkadot-dev-run-test packages/networks/src",
     "build:release": "polkadot-ci-ghact-build",
     "build:rollup": "polkadot-exec-rollup --config",
     "clean": "polkadot-dev-clean-build",
+    "deno": "yarn polkadot-dev-deno-map && yarn build && deno check --import-map=import_map.json mod.ts",
     "lint": "polkadot-dev-run-lint",
-    "networks:crosscheck": "polkadot-dev-run-test packages/networks/src/crosscheck",
     "postinstall": "polkadot-dev-yarn-only",
-    "test": "polkadot-dev-run-test --coverage --runInBand --testPathIgnorePatterns crosscheck --testPathIgnorePatterns toMiniSecretCmp",
-    "test:mnemonicCmp": "polkadot-dev-run-test packages/util-crypto/src/mnemonic/toMiniSecretCmp.spec.ts",
-    "test:one": "polkadot-dev-run-test --runInBand"
+    "test": "polkadot-dev-run-test --env browser ^mnemonic/toMiniSecretCmp",
+    "test:mnemonicCmp": "polkadot-dev-run-test --env browser mnemonic/toMiniSecretCmp",
+    "test:node": "polkadot-dev-run-test --env browser ^mnemonic/toMiniSecretCmp",
+    "test:one": "polkadot-dev-run-test --env browser"
   },
   "devDependencies": {
-    "@babel/core": "^7.17.9",
-    "@polkadot/dev": "^0.66.1",
-    "@types/jest": "^27.4.1"
+    "@polkadot/dev": "^0.83.3",
+    "@types/node": "^22.7.5"
   },
   "resolutions": {
-    "typescript": "^4.6.3"
+    "typescript": "^5.5.4"
   }
 }

packages/hw-ledger-transports/LICENSE

@@ -1,201 +0,0 @@
-                              Apache License
-                        Version 2.0, January 2004
-                    http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-  "License" shall mean the terms and conditions for use, reproduction,
-  and distribution as defined by Sections 1 through 9 of this document.
-
-  "Licensor" shall mean the copyright owner or entity authorized by
-  the copyright owner that is granting the License.
-
-  "Legal Entity" shall mean the union of the acting entity and all
-  other entities that control, are controlled by, or are under common
-  control with that entity. For the purposes of this definition,
-  "control" means (i) the power, direct or indirect, to cause the
-  direction or management of such entity, whether by contract or
-  otherwise, or (ii) ownership of fifty percent (50%) or more of the
-  outstanding shares, or (iii) beneficial ownership of such entity.
-
-  "You" (or "Your") shall mean an individual or Legal Entity
-  exercising permissions granted by this License.
-
-  "Source" form shall mean the preferred form for making modifications,
-  including but not limited to software source code, documentation
-  source, and configuration files.
-
-  "Object" form shall mean any form resulting from mechanical
-  transformation or translation of a Source form, including but
-  not limited to compiled object code, generated documentation,
-  and conversions to other media types.
-
-  "Work" shall mean the work of authorship, whether in Source or
-  Object form, made available under the License, as indicated by a
-  copyright notice that is included in or attached to the work
-  (an example is provided in the Appendix below).
-
-  "Derivative Works" shall mean any work, whether in Source or Object
-  form, that is based on (or derived from) the Work and for which the
-  editorial revisions, annotations, elaborations, or other modifications
-  represent, as a whole, an original work of authorship. For the purposes
-  of this License, Derivative Works shall not include works that remain
-  separable from, or merely link (or bind by name) to the interfaces of,
-  the Work and Derivative Works thereof.
-
-  "Contribution" shall mean any work of authorship, including
-  the original version of the Work and any modifications or additions
-  to that Work or Derivative Works thereof, that is intentionally
-  submitted to Licensor for inclusion in the Work by the copyright owner
-  or by an individual or Legal Entity authorized to submit on behalf of
-  the copyright owner. For the purposes of this definition, "submitted"
-  means any form of electronic, verbal, or written communication sent
-  to the Licensor or its representatives, including but not limited to
-  communication on electronic mailing lists, source code control systems,
-  and issue tracking systems that are managed by, or on behalf of, the
-  Licensor for the purpose of discussing and improving the Work, but
-  excluding communication that is conspicuously marked or otherwise
-  designated in writing by the copyright owner as "Not a Contribution."
-
-  "Contributor" shall mean Licensor and any individual or Legal Entity
-  on behalf of whom a Contribution has been received by Licensor and
-  subsequently incorporated within the Work.
-
-2. Grant of Copyright License. Subject to the terms and conditions of
-  this License, each Contributor hereby grants to You a perpetual,
-  worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-  copyright license to reproduce, prepare Derivative Works of,
-  publicly display, publicly perform, sublicense, and distribute the
-  Work and such Derivative Works in Source or Object form.
-
-3. Grant of Patent License. Subject to the terms and conditions of
-  this License, each Contributor hereby grants to You a perpetual,
-  worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-  (except as stated in this section) patent license to make, have made,
-  use, offer to sell, sell, import, and otherwise transfer the Work,
-  where such license applies only to those patent claims licensable
-  by such Contributor that are necessarily infringed by their
-  Contribution(s) alone or by combination of their Contribution(s)
-  with the Work to which such Contribution(s) was submitted. If You
-  institute patent litigation against any entity (including a
-  cross-claim or counterclaim in a lawsuit) alleging that the Work
-  or a Contribution incorporated within the Work constitutes direct
-  or contributory patent infringement, then any patent licenses
-  granted to You under this License for that Work shall terminate
-  as of the date such litigation is filed.
-
-4. Redistribution. You may reproduce and distribute copies of the
-  Work or Derivative Works thereof in any medium, with or without
-  modifications, and in Source or Object form, provided that You
-  meet the following conditions:
-
-  (a) You must give any other recipients of the Work or
-      Derivative Works a copy of this License; and
-
-  (b) You must cause any modified files to carry prominent notices
-      stating that You changed the files; and
-
-  (c) You must retain, in the Source form of any Derivative Works
-      that You distribute, all copyright, patent, trademark, and
-      attribution notices from the Source form of the Work,
-      excluding those notices that do not pertain to any part of
-      the Derivative Works; and
-
-  (d) If the Work includes a "NOTICE" text file as part of its
-      distribution, then any Derivative Works that You distribute must
-      include a readable copy of the attribution notices contained
-      within such NOTICE file, excluding those notices that do not
-      pertain to any part of the Derivative Works, in at least one
-      of the following places: within a NOTICE text file distributed
-      as part of the Derivative Works; within the Source form or
-      documentation, if provided along with the Derivative Works; or,
-      within a display generated by the Derivative Works, if and
-      wherever such third-party notices normally appear. The contents
-      of the NOTICE file are for informational purposes only and
-      do not modify the License. You may add Your own attribution
-      notices within Derivative Works that You distribute, alongside
-      or as an addendum to the NOTICE text from the Work, provided
-      that such additional attribution notices cannot be construed
-      as modifying the License.
-
-  You may add Your own copyright statement to Your modifications and
-  may provide additional or different license terms and conditions
-  for use, reproduction, or distribution of Your modifications, or
-  for any such Derivative Works as a whole, provided Your use,
-  reproduction, and distribution of the Work otherwise complies with
-  the conditions stated in this License.
-
-5. Submission of Contributions. Unless You explicitly state otherwise,
-  any Contribution intentionally submitted for inclusion in the Work
-  by You to the Licensor shall be under the terms and conditions of
-  this License, without any additional terms or conditions.
-  Notwithstanding the above, nothing herein shall supersede or modify
-  the terms of any separate license agreement you may have executed
-  with Licensor regarding such Contributions.
-
-6. Trademarks. This License does not grant permission to use the trade
-  names, trademarks, service marks, or product names of the Licensor,
-  except as required for reasonable and customary use in describing the
-  origin of the Work and reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty. Unless required by applicable law or
-  agreed to in writing, Licensor provides the Work (and each
-  Contributor provides its Contributions) on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-  implied, including, without limitation, any warranties or conditions
-  of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-  PARTICULAR PURPOSE. You are solely responsible for determining the
-  appropriateness of using or redistributing the Work and assume any
-  risks associated with Your exercise of permissions under this License.
-
-8. Limitation of Liability. In no event and under no legal theory,
-  whether in tort (including negligence), contract, or otherwise,
-  unless required by applicable law (such as deliberate and grossly
-  negligent acts) or agreed to in writing, shall any Contributor be
-  liable to You for damages, including any direct, indirect, special,
-  incidental, or consequential damages of any character arising as a
-  result of this License or out of the use or inability to use the
-  Work (including but not limited to damages for loss of goodwill,
-  work stoppage, computer failure or malfunction, or any and all
-  other commercial damages or losses), even if such Contributor
-  has been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability. While redistributing
-  the Work or Derivative Works thereof, You may choose to offer,
-  and charge a fee for, acceptance of support, warranty, indemnity,
-  or other liability obligations and/or rights consistent with this
-  License. However, in accepting such obligations, You may act only
-  on Your own behalf and on Your sole responsibility, not on behalf
-  of any other Contributor, and only if You agree to indemnify,
-  defend, and hold each Contributor harmless for any liability
-  incurred by, or claims asserted against, such Contributor by reason
-  of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work.
-
-  To apply the Apache License to your work, attach the following
-  boilerplate notice, with the fields enclosed by brackets "[]"
-  replaced with your own identifying information. (Don't include
-  the brackets!)  The text should be enclosed in the appropriate
-  comment syntax for the file format. We also recommend that a
-  file or class name and description of purpose be included on the
-  same "printed page" as the copyright notice for easier
-  identification within third-party archives.
-
-Copyright [yyyy] [name of copyright owner]
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.

packages/hw-ledger-transports/package.json

@@ -1,13 +1,11 @@
 {
   "author": "Jaco Greeff <jacogr@gmail.com>",
   "bugs": "https://github.com/polkadot-js/common/issues",
-  "contributors": [],
   "engines": {
-    "node": ">=14.0.0"
+    "node": ">=18"
   },
   "homepage": "https://github.com/polkadot-js/common/tree/master/packages/hw-ledger-transports#readme",
   "license": "Apache-2.0",
-  "maintainers": [],
   "name": "@polkadot/hw-ledger-transports",
   "repository": {
     "directory": "packages/hw-ledger-transports",
@@ -16,18 +14,18 @@
   },
   "sideEffects": false,
   "type": "module",
-  "version": "9.0.1",
+  "version": "14.0.3",
   "browser": "browser.js",
   "main": "node.js",
   "react-native": "react-native.js",
   "dependencies": {
-    "@babel/runtime": "^7.17.9",
-    "@ledgerhq/hw-transport": "^6.24.1",
-    "@ledgerhq/hw-transport-webhid": "^6.24.1",
-    "@ledgerhq/hw-transport-webusb": "^6.24.1",
-    "@polkadot/util": "9.0.1"
+    "@ledgerhq/hw-transport": "^6.31.4",
+    "@ledgerhq/hw-transport-webhid": "^6.29.4",
+    "@ledgerhq/hw-transport-webusb": "^6.29.4",
+    "@polkadot/util": "14.0.3",
+    "tslib": "^2.8.0"
   },
   "optionalDependencies": {
-    "@ledgerhq/hw-transport-node-hid-singleton": "^6.26.0"
+    "@ledgerhq/hw-transport-node-hid-singleton": "^6.31.5"
   }
 }

packages/hw-ledger-transports/src/browser.ts

@@ -1,23 +1,11 @@
-// Copyright 2017-2022 @polkadot/hw-ledger authors & contributors
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type Transport from '@ledgerhq/hw-transport';
-import type { TransportDef } from './types';
+import LedgerHid from '@ledgerhq/hw-transport-webhid';
+import LedgerUsb from '@ledgerhq/hw-transport-webusb';
 
-import LedgerWebHid from '@ledgerhq/hw-transport-webhid';
-import LedgerWebUsb from '@ledgerhq/hw-transport-webusb';
+import { createDefs } from './util.js';
 
-export { packageInfo } from './packageInfo';
+export { packageInfo } from './packageInfo.js';
 
-export const transports: TransportDef[] = [
-  {
-    create: (): Promise<Transport> =>
-      LedgerWebUsb.create(),
-    type: 'webusb'
-  },
-  {
-    create: (): Promise<Transport> =>
-      LedgerWebHid.create(),
-    type: 'hid'
-  }
-];
+export const transports = /*#__PURE__*/ createDefs(['webusb', LedgerUsb], ['hid', LedgerHid]);

packages/hw-ledger-transports/src/detectOther.ts

@@ -1,4 +0,0 @@
-// Copyright 2017-2022 @polkadot/hw-ledger authors & contributors
-// SPDX-License-Identifier: Apache-2.0
-
-export default [];

packages/hw-ledger-transports/src/detectPackage.ts

@@ -1,11 +0,0 @@
-// Copyright 2017-2022 @polkadot/hw-ledger-transports authors & contributors
-// SPDX-License-Identifier: Apache-2.0
-
-// Do not edit, auto-generated by @polkadot/dev
-
-import { detectPackage } from '@polkadot/util';
-
-import others from './detectOther';
-import { packageInfo } from './packageInfo';
-
-detectPackage(packageInfo, null, others);

packages/hw-ledger-transports/src/empty.ts

@@ -0,0 +1,8 @@
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import { createDefs } from './util.js';
+
+export { packageInfo } from './packageInfo.js';
+
+export const transports = /*#__PURE__*/ createDefs();

packages/hw-ledger-transports/src/mod.ts

@@ -0,0 +1,4 @@
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+export * from './empty.js';

packages/hw-ledger-transports/src/node.ts

@@ -1,17 +1,10 @@
-// Copyright 2017-2022 @polkadot/hw-ledger authors & contributors
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type Transport from '@ledgerhq/hw-transport';
-import type { TransportDef } from './types';
-
 import LedgerHid from '@ledgerhq/hw-transport-node-hid-singleton';
 
-export { packageInfo } from './packageInfo';
+import { createDefs } from './util.js';
 
-export const transports: TransportDef[] = [
-  {
-    create: (): Promise<Transport> =>
-      LedgerHid.create(),
-    type: 'hid'
-  }
-];
+export { packageInfo } from './packageInfo.js';
+
+export const transports = /*#__PURE__*/ createDefs(['hid', LedgerHid]);

packages/hw-ledger-transports/src/packageDetect.ts

@@ -0,0 +1,11 @@
+// Copyright 2017-2026 @polkadot/hw-ledger-transports authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+// Do not edit, auto-generated by @polkadot/dev
+// (packageInfo imports will be kept as-is, user-editable)
+
+import { detectPackage } from '@polkadot/util';
+
+import { packageInfo } from './packageInfo.js';
+
+detectPackage(packageInfo, null, []);

packages/hw-ledger-transports/src/packageInfo.ts

@@ -1,6 +1,6 @@
-// Copyright 2017-2022 @polkadot/hw-ledger-transports authors & contributors
+// Copyright 2017-2026 @polkadot/hw-ledger-transports authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Do not edit, auto-generated by @polkadot/dev
 
-export const packageInfo = { name: '@polkadot/hw-ledger-transports', path: 'auto', type: 'auto', version: '9.0.1' };
+export const packageInfo = { name: '@polkadot/hw-ledger-transports', path: 'auto', type: 'auto', version: '14.0.3' };

packages/hw-ledger-transports/src/react-native.ts

@@ -1,8 +1,4 @@
-// Copyright 2017-2022 @polkadot/hw-ledger authors & contributors
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type { TransportDef } from './types';
-
-export { packageInfo } from './packageInfo';
-
-export const transports: TransportDef[] = [];
+export * from './empty.js';

packages/hw-ledger-transports/src/types.ts

@@ -1,11 +1,17 @@
-// Copyright 2017-2022 @polkadot/hw-ledger authors & contributors
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import Transport from '@ledgerhq/hw-transport';
+// CJS, so we use import * syntax
+import type * as HwTransport from '@ledgerhq/hw-transport';
 
-export type LedgerTypes = 'hid' | 'u2f' | 'webusb';
+// u2f is deprecated an therefore not added
+export type TransportType = 'hid' | 'webusb';
+
+export type Transport = HwTransport.default;
 
 export interface TransportDef {
+  /** Create a transport to be used in Ledger operations */
   create (): Promise<Transport>;
-  type: LedgerTypes;
+  /** The type of the underlying transport definition */
+  type: TransportType;
 }

packages/hw-ledger-transports/src/util.ts

@@ -0,0 +1,12 @@
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import type { Transport, TransportDef, TransportType } from './types.js';
+
+export function createDefs (...items: readonly [type: TransportType, Clazz: unknown][]): TransportDef[] {
+  return items.map(([type, Clazz]): TransportDef => ({
+    create: (): Promise<Transport> =>
+      (Clazz as Pick<TransportDef, 'create'>).create(),
+    type
+  }));
+}

packages/hw-ledger-transports/tsconfig.build.json

@@ -5,6 +5,9 @@
     "outDir": "./build",
     "rootDir": "./src"
   },
+  "exclude": [
+    "**/mod.ts"
+  ],
   "references": [
     { "path": "../util/tsconfig.build.json" }
   ]

packages/hw-ledger/LICENSE

@@ -1,201 +0,0 @@
-                              Apache License
-                        Version 2.0, January 2004
-                    http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-  "License" shall mean the terms and conditions for use, reproduction,
-  and distribution as defined by Sections 1 through 9 of this document.
-
-  "Licensor" shall mean the copyright owner or entity authorized by
-  the copyright owner that is granting the License.
-
-  "Legal Entity" shall mean the union of the acting entity and all
-  other entities that control, are controlled by, or are under common
-  control with that entity. For the purposes of this definition,
-  "control" means (i) the power, direct or indirect, to cause the
-  direction or management of such entity, whether by contract or
-  otherwise, or (ii) ownership of fifty percent (50%) or more of the
-  outstanding shares, or (iii) beneficial ownership of such entity.
-
-  "You" (or "Your") shall mean an individual or Legal Entity
-  exercising permissions granted by this License.
-
-  "Source" form shall mean the preferred form for making modifications,
-  including but not limited to software source code, documentation
-  source, and configuration files.
-
-  "Object" form shall mean any form resulting from mechanical
-  transformation or translation of a Source form, including but
-  not limited to compiled object code, generated documentation,
-  and conversions to other media types.
-
-  "Work" shall mean the work of authorship, whether in Source or
-  Object form, made available under the License, as indicated by a
-  copyright notice that is included in or attached to the work
-  (an example is provided in the Appendix below).
-
-  "Derivative Works" shall mean any work, whether in Source or Object
-  form, that is based on (or derived from) the Work and for which the
-  editorial revisions, annotations, elaborations, or other modifications
-  represent, as a whole, an original work of authorship. For the purposes
-  of this License, Derivative Works shall not include works that remain
-  separable from, or merely link (or bind by name) to the interfaces of,
-  the Work and Derivative Works thereof.
-
-  "Contribution" shall mean any work of authorship, including
-  the original version of the Work and any modifications or additions
-  to that Work or Derivative Works thereof, that is intentionally
-  submitted to Licensor for inclusion in the Work by the copyright owner
-  or by an individual or Legal Entity authorized to submit on behalf of
-  the copyright owner. For the purposes of this definition, "submitted"
-  means any form of electronic, verbal, or written communication sent
-  to the Licensor or its representatives, including but not limited to
-  communication on electronic mailing lists, source code control systems,
-  and issue tracking systems that are managed by, or on behalf of, the
-  Licensor for the purpose of discussing and improving the Work, but
-  excluding communication that is conspicuously marked or otherwise
-  designated in writing by the copyright owner as "Not a Contribution."
-
-  "Contributor" shall mean Licensor and any individual or Legal Entity
-  on behalf of whom a Contribution has been received by Licensor and
-  subsequently incorporated within the Work.
-
-2. Grant of Copyright License. Subject to the terms and conditions of
-  this License, each Contributor hereby grants to You a perpetual,
-  worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-  copyright license to reproduce, prepare Derivative Works of,
-  publicly display, publicly perform, sublicense, and distribute the
-  Work and such Derivative Works in Source or Object form.
-
-3. Grant of Patent License. Subject to the terms and conditions of
-  this License, each Contributor hereby grants to You a perpetual,
-  worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-  (except as stated in this section) patent license to make, have made,
-  use, offer to sell, sell, import, and otherwise transfer the Work,
-  where such license applies only to those patent claims licensable
-  by such Contributor that are necessarily infringed by their
-  Contribution(s) alone or by combination of their Contribution(s)
-  with the Work to which such Contribution(s) was submitted. If You
-  institute patent litigation against any entity (including a
-  cross-claim or counterclaim in a lawsuit) alleging that the Work
-  or a Contribution incorporated within the Work constitutes direct
-  or contributory patent infringement, then any patent licenses
-  granted to You under this License for that Work shall terminate
-  as of the date such litigation is filed.
-
-4. Redistribution. You may reproduce and distribute copies of the
-  Work or Derivative Works thereof in any medium, with or without
-  modifications, and in Source or Object form, provided that You
-  meet the following conditions:
-
-  (a) You must give any other recipients of the Work or
-      Derivative Works a copy of this License; and
-
-  (b) You must cause any modified files to carry prominent notices
-      stating that You changed the files; and
-
-  (c) You must retain, in the Source form of any Derivative Works
-      that You distribute, all copyright, patent, trademark, and
-      attribution notices from the Source form of the Work,
-      excluding those notices that do not pertain to any part of
-      the Derivative Works; and
-
-  (d) If the Work includes a "NOTICE" text file as part of its
-      distribution, then any Derivative Works that You distribute must
-      include a readable copy of the attribution notices contained
-      within such NOTICE file, excluding those notices that do not
-      pertain to any part of the Derivative Works, in at least one
-      of the following places: within a NOTICE text file distributed
-      as part of the Derivative Works; within the Source form or
-      documentation, if provided along with the Derivative Works; or,
-      within a display generated by the Derivative Works, if and
-      wherever such third-party notices normally appear. The contents
-      of the NOTICE file are for informational purposes only and
-      do not modify the License. You may add Your own attribution
-      notices within Derivative Works that You distribute, alongside
-      or as an addendum to the NOTICE text from the Work, provided
-      that such additional attribution notices cannot be construed
-      as modifying the License.
-
-  You may add Your own copyright statement to Your modifications and
-  may provide additional or different license terms and conditions
-  for use, reproduction, or distribution of Your modifications, or
-  for any such Derivative Works as a whole, provided Your use,
-  reproduction, and distribution of the Work otherwise complies with
-  the conditions stated in this License.
-
-5. Submission of Contributions. Unless You explicitly state otherwise,
-  any Contribution intentionally submitted for inclusion in the Work
-  by You to the Licensor shall be under the terms and conditions of
-  this License, without any additional terms or conditions.
-  Notwithstanding the above, nothing herein shall supersede or modify
-  the terms of any separate license agreement you may have executed
-  with Licensor regarding such Contributions.
-
-6. Trademarks. This License does not grant permission to use the trade
-  names, trademarks, service marks, or product names of the Licensor,
-  except as required for reasonable and customary use in describing the
-  origin of the Work and reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty. Unless required by applicable law or
-  agreed to in writing, Licensor provides the Work (and each
-  Contributor provides its Contributions) on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-  implied, including, without limitation, any warranties or conditions
-  of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-  PARTICULAR PURPOSE. You are solely responsible for determining the
-  appropriateness of using or redistributing the Work and assume any
-  risks associated with Your exercise of permissions under this License.
-
-8. Limitation of Liability. In no event and under no legal theory,
-  whether in tort (including negligence), contract, or otherwise,
-  unless required by applicable law (such as deliberate and grossly
-  negligent acts) or agreed to in writing, shall any Contributor be
-  liable to You for damages, including any direct, indirect, special,
-  incidental, or consequential damages of any character arising as a
-  result of this License or out of the use or inability to use the
-  Work (including but not limited to damages for loss of goodwill,
-  work stoppage, computer failure or malfunction, or any and all
-  other commercial damages or losses), even if such Contributor
-  has been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability. While redistributing
-  the Work or Derivative Works thereof, You may choose to offer,
-  and charge a fee for, acceptance of support, warranty, indemnity,
-  or other liability obligations and/or rights consistent with this
-  License. However, in accepting such obligations, You may act only
-  on Your own behalf and on Your sole responsibility, not on behalf
-  of any other Contributor, and only if You agree to indemnify,
-  defend, and hold each Contributor harmless for any liability
-  incurred by, or claims asserted against, such Contributor by reason
-  of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work.
-
-  To apply the Apache License to your work, attach the following
-  boilerplate notice, with the fields enclosed by brackets "[]"
-  replaced with your own identifying information. (Don't include
-  the brackets!)  The text should be enclosed in the appropriate
-  comment syntax for the file format. We also recommend that a
-  file or class name and description of purpose be included on the
-  same "printed page" as the copyright notice for easier
-  identification within third-party archives.
-
-Copyright [yyyy] [name of copyright owner]
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.

packages/hw-ledger/package.json

@@ -1,13 +1,11 @@
 {
   "author": "Jaco Greeff <jacogr@gmail.com>",
   "bugs": "https://github.com/polkadot-js/common/issues",
-  "contributors": [],
   "engines": {
-    "node": ">=14.0.0"
+    "node": ">=18"
   },
   "homepage": "https://github.com/polkadot-js/common/tree/master/packages/hw-ledger#readme",
   "license": "Apache-2.0",
-  "maintainers": [],
   "name": "@polkadot/hw-ledger",
   "repository": {
     "directory": "packages/hw-ledger",
@@ -15,17 +13,16 @@
     "url": "https://github.com/polkadot-js/common.git"
   },
   "sideEffects": [
-    "./detectPackage.js",
-    "./detectPackage.cjs"
+    "./packageDetect.js",
+    "./packageDetect.cjs"
   ],
   "type": "module",
-  "version": "9.0.1",
+  "version": "14.0.3",
   "main": "index.js",
   "dependencies": {
-    "@babel/runtime": "^7.17.9",
-    "@ledgerhq/hw-transport": "^6.24.1",
-    "@polkadot/hw-ledger-transports": "9.0.1",
-    "@polkadot/util": "9.0.1",
-    "@zondax/ledger-substrate": "^0.24.0"
+    "@polkadot/hw-ledger-transports": "14.0.3",
+    "@polkadot/util": "14.0.3",
+    "@zondax/ledger-substrate": "1.1.1",
+    "tslib": "^2.8.0"
   }
 }

packages/hw-ledger/src/Ledger.ts

@@ -0,0 +1,169 @@
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import type { SubstrateApp } from '@zondax/ledger-substrate';
+import type { Transport, TransportDef, TransportType } from '@polkadot/hw-ledger-transports/types';
+import type { AccountOptions, LedgerAddress, LedgerSignature, LedgerVersion } from './types.js';
+
+import { newSubstrateApp } from '@zondax/ledger-substrate';
+
+import { transports } from '@polkadot/hw-ledger-transports';
+import { hexAddPrefix, u8aToBuffer, u8aWrapBytes } from '@polkadot/util';
+
+import { LEDGER_DEFAULT_ACCOUNT, LEDGER_DEFAULT_CHANGE, LEDGER_DEFAULT_INDEX, LEDGER_SUCCESS_CODE } from './constants.js';
+import { ledgerApps } from './defaults.js';
+
+export { packageInfo } from './packageInfo.js';
+
+type Chain = keyof typeof ledgerApps;
+
+type WrappedResult = Awaited<ReturnType<SubstrateApp['getAddress' | 'getVersion' | 'sign']>>;
+
+/** @internal Wraps a SubstrateApp call, checking the result for any errors which result in a rejection */
+async function wrapError <T extends WrappedResult> (promise: Promise<T>): Promise<T> {
+  const result = await promise;
+
+  if (result.return_code !== LEDGER_SUCCESS_CODE) {
+    throw new Error(result.error_message);
+  }
+
+  return result;
+}
+
+/** @internal Best-effort transport cleanup after failed operations */
+async function closeTransport (transport: Transport | null): Promise<void> {
+  if (transport) {
+    try {
+      await transport.close();
+    } catch {
+      // Ignore cleanup errors so the original failure is preserved.
+    }
+  }
+}
+
+/** @internal Wraps a sign/signRaw call and returns the associated signature */
+function sign (method: 'sign' | 'signRaw', message: Uint8Array, accountOffset = 0, addressOffset = 0, { account = LEDGER_DEFAULT_ACCOUNT, addressIndex = LEDGER_DEFAULT_INDEX, change = LEDGER_DEFAULT_CHANGE }: Partial<AccountOptions> = {}): (app: SubstrateApp) => Promise<LedgerSignature> {
+  return async (app: SubstrateApp): Promise<LedgerSignature> => {
+    const { signature } = await wrapError(app[method](account + accountOffset, change, addressIndex + addressOffset, u8aToBuffer(message)));
+
+    return {
+      signature: hexAddPrefix(signature.toString('hex'))
+    };
+  };
+}
+
+/**
+ * @name Ledger
+ *
+ * @description
+ * Legacy wrapper for a ledger app -
+ *   - it connects automatically on use, creating an underlying interface as required
+ *   - Promises reject with errors (unwrapped errors from @zondax/ledger-substrate)
+ * @deprecated Use LedgerGeneric for up to date integration with ledger
+ */
+export class Ledger {
+  readonly #ledgerName: string;
+  readonly #transportDef: TransportDef;
+
+  #app: SubstrateApp | null = null;
+
+  constructor (transport: TransportType, chain: Chain) {
+    const ledgerName = ledgerApps[chain];
+    const transportDef = transports.find(({ type }) => type === transport);
+
+    if (!ledgerName) {
+      throw new Error(`Unsupported Ledger chain ${chain}`);
+    } else if (!transportDef) {
+      throw new Error(`Unsupported Ledger transport ${transport}`);
+    }
+
+    this.#ledgerName = ledgerName;
+    this.#transportDef = transportDef;
+  }
+
+  /**
+   * Returns the address associated with a specific account & address offset. Optionally
+   * asks for on-device confirmation
+   */
+  public async getAddress (confirm = false, accountOffset = 0, addressOffset = 0, { account = LEDGER_DEFAULT_ACCOUNT, addressIndex = LEDGER_DEFAULT_INDEX, change = LEDGER_DEFAULT_CHANGE }: Partial<AccountOptions> = {}): Promise<LedgerAddress> {
+    return this.withApp(async (app: SubstrateApp): Promise<LedgerAddress> => {
+      const { address, pubKey } = await wrapError(app.getAddress(account + accountOffset, change, addressIndex + addressOffset, confirm));
+
+      return {
+        address,
+        publicKey: hexAddPrefix(pubKey)
+      };
+    });
+  }
+
+  /**
+   * Returns the version of the Ledger application on the device
+   */
+  public async getVersion (): Promise<LedgerVersion> {
+    return this.withApp(async (app: SubstrateApp): Promise<LedgerVersion> => {
+      const { device_locked: isLocked, major, minor, patch, test_mode: isTestMode } = await wrapError(app.getVersion());
+
+      return {
+        isLocked,
+        isTestMode,
+        version: [major, minor, patch]
+      };
+    });
+  }
+
+  /**
+   * Signs a transaction on the Ledger device
+   */
+  public async sign (message: Uint8Array, accountOffset?: number, addressOffset?: number, options?: Partial<AccountOptions>): Promise<LedgerSignature> {
+    return this.withApp(sign('sign', message, accountOffset, addressOffset, options));
+  }
+
+  /**
+   * Signs a message (non-transactional) on the Ledger device
+   */
+  public async signRaw (message: Uint8Array, accountOffset?: number, addressOffset?: number, options?: Partial<AccountOptions>): Promise<LedgerSignature> {
+    return this.withApp(sign('signRaw', u8aWrapBytes(message), accountOffset, addressOffset, options));
+  }
+
+  /**
+   * Closes any active transport connection
+   */
+  public async disconnect (): Promise<void> {
+    const app = this.#app;
+
+    this.#app = null;
+
+    await closeTransport(app?.transport || null);
+  }
+
+  /**
+   * @internal
+   *
+   * Returns a created SubstrateApp to perform operations against. Generally
+   * this is only used internally, to ensure consistent behavior.
+   */
+  async withApp <T> (fn: (app: SubstrateApp) => Promise<T>): Promise<T> {
+    let transport: Transport | null = null;
+
+    try {
+      if (!this.#app) {
+        transport = await this.#transportDef.create();
+
+        // We need this override for the actual type passing - the Deno environment
+        // is quite a bit stricter and it yields invalids between the two (specifically
+        // since we mangle the imports from .default in the types for CJS/ESM and between
+        // esm.sh versions this yields problematic outputs)
+        //
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-argument, @typescript-eslint/no-explicit-any
+        this.#app = newSubstrateApp(transport as any, this.#ledgerName);
+      }
+
+      return await fn(this.#app);
+    } catch (error) {
+      await closeTransport(this.#app?.transport || transport);
+      this.#app = null;
+
+      throw error;
+    }
+  }
+}

packages/hw-ledger/src/LedgerGeneric.ts

@@ -0,0 +1,300 @@
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import type { Transport, TransportDef, TransportType } from '@polkadot/hw-ledger-transports/types';
+import type { AccountOptionsGeneric, LedgerAddress, LedgerSignature, LedgerVersion } from './types.js';
+
+import { PolkadotGenericApp } from '@zondax/ledger-substrate';
+
+import { transports } from '@polkadot/hw-ledger-transports';
+import { hexAddPrefix, u8aToBuffer, u8aWrapBytes } from '@polkadot/util';
+
+import { ledgerApps } from './defaults.js';
+
+export { packageInfo } from './packageInfo.js';
+
+type Chain = keyof typeof ledgerApps;
+
+type WrappedResult = Awaited<ReturnType<PolkadotGenericApp['getAddress' | 'getVersion' | 'sign' | 'signWithMetadata']>>;
+
+// FIXME This type is a copy of the `class ResponseError`
+// imported from `@zondax/ledger-js`. Happens because ledger-js includes
+// circular dependencies. This is a hack to avoid versioning issues
+// with Deno.
+interface ResponseError {
+  errorMessage: string
+  returnCode: number
+}
+
+/** @internal Wraps a PolkadotGenericApp call, checking the result for any errors which result in a rejection */
+async function wrapError <T extends WrappedResult> (promise: Promise<T>): Promise<T> {
+  let result: T;
+
+  try {
+    result = await promise;
+  } catch (e: unknown) {
+    // We check to see if the propagated error is the newer ResponseError type.
+    // The response code use to be part of the result, but with the latest breaking changes from 0.42.x
+    // the interface and it's types have completely changed.
+    if ((e as ResponseError).returnCode) {
+      throw new Error(`${(e as ResponseError).returnCode}: ${(e as ResponseError).errorMessage}`);
+    }
+
+    throw new Error((e as Error).message);
+  }
+
+  return result;
+}
+
+/** @internal Best-effort transport cleanup after failed operations */
+async function closeTransport (transport: Transport | null): Promise<void> {
+  if (transport) {
+    try {
+      await transport.close();
+    } catch {
+      // Ignore cleanup errors so the original failure is preserved.
+    }
+  }
+}
+
+/** @internal Wraps a signEd25519/signRawEd25519 call and returns the associated signature */
+function sign (method: 'signEd25519' | 'signRawEd25519', message: Uint8Array, slip44: number, accountIndex = 0, addressOffset = 0): (app: PolkadotGenericApp) => Promise<LedgerSignature> {
+  const bip42Path = `m/44'/${slip44}'/${accountIndex}'/${0}'/${addressOffset}'`;
+
+  return async (app: PolkadotGenericApp): Promise<LedgerSignature> => {
+    const { signature } = await wrapError(app[method](bip42Path, u8aToBuffer(message)));
+
+    return {
+      signature: hexAddPrefix(signature.toString('hex'))
+    };
+  };
+}
+
+/** @internal Wraps a signEcdsa/signRawEcdsa call and returns the associated signature */
+function signEcdsa (method: 'signEcdsa' | 'signRawEcdsa', message: Uint8Array, slip44: number, accountIndex = 0, addressOffset = 0): (app: PolkadotGenericApp) => Promise<LedgerSignature> {
+  const bip42Path = `m/44'/${slip44}'/${accountIndex}'/${0}'/${addressOffset}'`;
+
+  return async (app: PolkadotGenericApp): Promise<LedgerSignature> => {
+    const { r, s, v } = await wrapError(app[method](bip42Path, u8aToBuffer(message)));
+
+    const signature = Buffer.concat([r, s, v]);
+
+    return {
+      signature: hexAddPrefix(signature.toString('hex'))
+    };
+  };
+}
+
+/** @internal Wraps a signWithMetadataEd25519 call and returns the associated signature */
+function signWithMetadata (message: Uint8Array, slip44: number, accountIndex = 0, addressOffset = 0, { metadata }: Partial<AccountOptionsGeneric> = {}): (app: PolkadotGenericApp) => Promise<LedgerSignature> {
+  const bip42Path = `m/44'/${slip44}'/${accountIndex}'/${0}'/${addressOffset}'`;
+
+  return async (app: PolkadotGenericApp): Promise<LedgerSignature> => {
+    if (!metadata) {
+      throw new Error('The metadata option must be present when using signWithMetadata');
+    }
+
+    const bufferMsg = Buffer.from(message);
+
+    const { signature } = await wrapError(app.signWithMetadataEd25519(bip42Path, bufferMsg, metadata));
+
+    return {
+      signature: hexAddPrefix(signature.toString('hex'))
+    };
+  };
+}
+
+/** @internal Wraps a signWithMetadataEcdsa call and returns the associated signature */
+function signWithMetadataEcdsa (message: Uint8Array, slip44: number, accountIndex = 0, addressOffset = 0, { metadata }: Partial<AccountOptionsGeneric> = {}): (app: PolkadotGenericApp) => Promise<LedgerSignature> {
+  const bip42Path = `m/44'/${slip44}'/${accountIndex}'/${0}'/${addressOffset}'`;
+
+  return async (app: PolkadotGenericApp): Promise<LedgerSignature> => {
+    if (!metadata) {
+      throw new Error('The metadata option must be present when using signWithMetadata');
+    }
+
+    const bufferMsg = Buffer.from(message);
+
+    const { r, s, v } = await wrapError(app.signWithMetadataEcdsa(bip42Path, bufferMsg, metadata));
+
+    const signature = Buffer.concat([r, s, v]);
+
+    return {
+      signature: hexAddPrefix(signature.toString('hex'))
+    };
+  };
+}
+
+/**
+ * @name Ledger
+ *
+ * @description
+ * A very basic wrapper for a ledger app -
+ *   - it connects automatically on use, creating an underlying interface as required
+ *   - Promises reject with errors (unwrapped errors from @zondax/ledger-substrate-js)
+ */
+export class LedgerGeneric {
+  readonly #transportDef: TransportDef;
+  readonly #slip44: number;
+  /**
+   * The chainId is represented by the chains token in all lowercase. Example: Polkadot -> dot
+   */
+  readonly #chainId?: string;
+  /**
+   * The metaUrl is seen as a server url that the underlying `PolkadotGenericApp` will use to
+   * retrieve the signature given a tx blob, and a chainId. It is important to note that if you would like to avoid
+   * having any network calls made, use `signWithMetadata`, and avoid `sign`.
+   */
+  readonly #metaUrl?: string;
+
+  #app: PolkadotGenericApp | null = null;
+
+  constructor (transport: TransportType, chain: Chain, slip44: number, chainId?: string, metaUrl?: string) {
+    const ledgerName = ledgerApps[chain];
+    const transportDef = transports.find(({ type }) => type === transport);
+
+    if (!ledgerName) {
+      throw new Error(`Unsupported Ledger chain ${chain}`);
+    } else if (!transportDef) {
+      throw new Error(`Unsupported Ledger transport ${transport}`);
+    }
+
+    this.#metaUrl = metaUrl;
+    this.#chainId = chainId;
+    this.#slip44 = slip44;
+    this.#transportDef = transportDef;
+  }
+
+  /**
+   * @description Returns the address associated with a specific Ed25519 account & address offset. Optionally
+   * asks for on-device confirmation
+   */
+  public async getAddress (ss58Prefix: number, confirm = false, accountIndex = 0, addressOffset = 0): Promise<LedgerAddress> {
+    const bip42Path = `m/44'/${this.#slip44}'/${accountIndex}'/${0}'/${addressOffset}'`;
+
+    return this.withApp(async (app: PolkadotGenericApp): Promise<LedgerAddress> => {
+      const { address, pubKey } = await wrapError(app.getAddressEd25519(bip42Path, ss58Prefix, confirm));
+
+      return {
+        address,
+        publicKey: hexAddPrefix(pubKey)
+      };
+    });
+  }
+
+  /**
+   * @description Returns the address associated with a specific ecdsa account & address offset. Optionally
+   * asks for on-device confirmation
+   */
+  public async getAddressEcdsa (confirm = false, accountIndex = 0, addressOffset = 0) {
+    const bip42Path = `m/44'/${this.#slip44}'/${accountIndex}'/${0}'/${addressOffset}'`;
+
+    return this.withApp(async (app: PolkadotGenericApp): Promise<LedgerAddress> => {
+      const { address, pubKey } = await wrapError(app.getAddressEcdsa(bip42Path, confirm));
+
+      return {
+        address,
+        publicKey: hexAddPrefix(pubKey)
+      };
+    });
+  }
+
+  /**
+   * @description Returns the version of the Ledger application on the device
+   */
+  public async getVersion (): Promise<LedgerVersion> {
+    return this.withApp(async (app: PolkadotGenericApp): Promise<LedgerVersion> => {
+      const { deviceLocked: isLocked, major, minor, patch, testMode: isTestMode } = await wrapError(app.getVersion());
+
+      return {
+        isLocked: !!isLocked,
+        isTestMode: !!isTestMode,
+        version: [major || 0, minor || 0, patch || 0]
+      };
+    });
+  }
+
+  /**
+   * @description Signs a transaction on the Ledger device. This requires the LedgerGeneric class to be instantiated with `chainId`, and `metaUrl`
+   */
+  public async sign (message: Uint8Array, accountIndex?: number, addressOffset?: number): Promise<LedgerSignature> {
+    return this.withApp(sign('signEd25519', message, this.#slip44, accountIndex, addressOffset));
+  }
+
+  /**
+   * @description Signs a message (non-transactional) on the Ledger device
+   */
+  public async signRaw (message: Uint8Array, accountIndex?: number, addressOffset?: number): Promise<LedgerSignature> {
+    return this.withApp(sign('signRawEd25519', u8aWrapBytes(message), this.#slip44, accountIndex, addressOffset));
+  }
+
+  /**
+   * @description Signs a transaction on the Ledger device with Ecdsa. This requires the LedgerGeneric class to be instantiated with `chainId`, and `metaUrl`
+   */
+  public async signEcdsa (message: Uint8Array, accountIndex?: number, addressOffset?: number): Promise<LedgerSignature> {
+    return this.withApp(signEcdsa('signEcdsa', u8aWrapBytes(message), this.#slip44, accountIndex, addressOffset));
+  }
+
+  /**
+   * @description Signs a message with Ecdsa (non-transactional) on the Ledger device
+   */
+  public async signRawEcdsa (message: Uint8Array, accountIndex?: number, addressOffset?: number): Promise<LedgerSignature> {
+    return this.withApp(signEcdsa('signRawEcdsa', u8aWrapBytes(message), this.#slip44, accountIndex, addressOffset));
+  }
+
+  /**
+   * @description Signs a transaction on the ledger device provided some metadata.
+   */
+  public async signWithMetadata (message: Uint8Array, accountIndex?: number, addressOffset?: number, options?: Partial<AccountOptionsGeneric>): Promise<LedgerSignature> {
+    return this.withApp(signWithMetadata(message, this.#slip44, accountIndex, addressOffset, options));
+  }
+
+  /**
+   * @description Signs a transaction on the ledger device for an ecdsa signature provided some metadata.
+   */
+  public async signWithMetadataEcdsa (message: Uint8Array, accountIndex?: number, addressOffset?: number, options?: Partial<AccountOptionsGeneric>) {
+    return this.withApp(signWithMetadataEcdsa(message, this.#slip44, accountIndex, addressOffset, options));
+  }
+
+  /**
+   * Closes any active transport connection
+   */
+  public async disconnect (): Promise<void> {
+    const app = this.#app;
+
+    this.#app = null;
+
+    await closeTransport(app?.transport || null);
+  }
+
+  /**
+   * @internal
+   *
+   * Returns a created PolkadotGenericApp to perform operations against. Generally
+   * this is only used internally, to ensure consistent bahavior.
+   */
+  async withApp <T> (fn: (app: PolkadotGenericApp) => Promise<T>): Promise<T> {
+    let transport: Transport | null = null;
+
+    try {
+      if (!this.#app) {
+        transport = await this.#transportDef.create();
+
+        // We need this override for the actual type passing - the Deno environment
+        // is quite a bit stricter and it yields invalids between the two (specifically
+        // since we mangle the imports from .default in the types for CJS/ESM and between
+        // esm.sh versions this yields problematic outputs)
+        //
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-argument, @typescript-eslint/no-explicit-any
+        this.#app = new PolkadotGenericApp(transport as any, this.#chainId, this.#metaUrl);
+      }
+
+      return await fn(this.#app);
+    } catch (error) {
+      await closeTransport(this.#app?.transport || transport);
+      this.#app = null;
+
+      throw error;
+    }
+  }
+}

packages/hw-ledger/src/bundle.ts

@@ -1,103 +1,8 @@
-// Copyright 2017-2022 @polkadot/hw-ledger authors & contributors
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type { ResponseBase, SubstrateApp } from '@zondax/ledger-substrate';
-import type { AccountOptions, LedgerAddress, LedgerSignature, LedgerTypes, LedgerVersion } from './types';
-
-import { transports } from '@polkadot/hw-ledger-transports';
-import { assert, u8aToBuffer } from '@polkadot/util';
-
-import { LEDGER_DEFAULT_ACCOUNT, LEDGER_DEFAULT_CHANGE, LEDGER_DEFAULT_INDEX, LEDGER_SUCCESS_CODE } from './constants';
-import { ledgerApps } from './defaults';
-
-export { packageInfo } from './packageInfo';
-
-type Chain = keyof typeof ledgerApps;
-
-// A very basic wrapper for a ledger app -
-//  - it connects automatically, creating an app as required
-//  - Promises return errors (instead of wrapper errors)
-export class Ledger {
-  #app: SubstrateApp | null = null;
-
-  #chain: Chain;
-
-  #transport: LedgerTypes;
-
-  constructor (transport: LedgerTypes, chain: Chain) {
-    // u2f is deprecated
-    assert(['hid', 'webusb'].includes(transport), () => `Unsupported transport ${transport}`);
-    assert(Object.keys(ledgerApps).includes(chain), () => `Unsupported chain ${chain}`);
-
-    this.#chain = chain;
-    this.#transport = transport;
-  }
-
-  public async getAddress (confirm = false, accountOffset = 0, addressOffset = 0, { account = LEDGER_DEFAULT_ACCOUNT, addressIndex = LEDGER_DEFAULT_INDEX, change = LEDGER_DEFAULT_CHANGE }: Partial<AccountOptions> = {}): Promise<LedgerAddress> {
-    return this.#withApp(async (app: SubstrateApp): Promise<LedgerAddress> => {
-      const { address, pubKey } = await this.#wrapError(app.getAddress(account + accountOffset, change, addressIndex + addressOffset, confirm));
-
-      return {
-        address,
-        publicKey: `0x${pubKey}`
-      };
-    });
-  }
-
-  public async getVersion (): Promise<LedgerVersion> {
-    return this.#withApp(async (app: SubstrateApp): Promise<LedgerVersion> => {
-      const { device_locked: isLocked, major, minor, patch, test_mode: isTestMode } = await this.#wrapError(app.getVersion());
-
-      return {
-        isLocked,
-        isTestMode,
-        version: [major, minor, patch]
-      };
-    });
-  }
-
-  public async sign (message: Uint8Array, accountOffset = 0, addressOffset = 0, { account = LEDGER_DEFAULT_ACCOUNT, addressIndex = LEDGER_DEFAULT_INDEX, change = LEDGER_DEFAULT_CHANGE }: Partial<AccountOptions> = {}): Promise<LedgerSignature> {
-    return this.#withApp(async (app: SubstrateApp): Promise<LedgerSignature> => {
-      const buffer = u8aToBuffer(message);
-      const { signature } = await this.#wrapError(app.sign(account + accountOffset, change, addressIndex + addressOffset, buffer));
-
-      return {
-        signature: `0x${signature.toString('hex')}`
-      };
-    });
-  }
-
-  #getApp = async (): Promise<SubstrateApp> => {
-    if (!this.#app) {
-      const def = transports.find(({ type }) => type === this.#transport);
-
-      assert(def, () => `Unable to find a transport for ${this.#transport}`);
-
-      const transport = await def.create();
-
-      this.#app = ledgerApps[this.#chain](transport);
-    }
-
-    return this.#app;
-  };
-
-  #withApp = async <T> (fn: (app: SubstrateApp) => Promise<T>): Promise<T> => {
-    try {
-      const app = await this.#getApp();
-
-      return await fn(app);
-    } catch (error) {
-      this.#app = null;
-
-      throw error;
-    }
-  };
-
-  #wrapError = async <T extends ResponseBase> (promise: Promise<T>): Promise<T> => {
-    const result = await promise;
-
-    assert(result.return_code === LEDGER_SUCCESS_CODE, () => result.error_message);
-
-    return result;
-  };
-}
+// This is necessary to ensure users still have access to class Ledger even though its deprecated.
+//
+// eslint-disable-next-line deprecation/deprecation
+export { Ledger } from './Ledger.js';
+export { LedgerGeneric } from './LedgerGeneric.js';

packages/hw-ledger/src/constants.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2022 @polkadot/hw-ledger authors & contributors
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 export const LEDGER_DEFAULT_ACCOUNT = 0x80000000;

packages/hw-ledger/src/defaults.spec.ts

@@ -0,0 +1,20 @@
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
+
+import { supportedApps } from '@zondax/ledger-substrate';
+
+import { prevLedgerRecord } from './defaults.js';
+
+describe('ledgerApps', (): void => {
+  for (const k of Object.keys(prevLedgerRecord)) {
+    it(`${k} is available in @zondax/ledger-substrate`, (): void => {
+      expect(
+        supportedApps.find(({ name }) =>
+          name === prevLedgerRecord[k]
+        )
+      ).toBeDefined();
+    });
+  }
+});

packages/hw-ledger/src/defaults.ts

@@ -1,23 +1,69 @@
-// Copyright 2017-2022 @polkadot/hw-ledger authors & contributors
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type Transport from '@ledgerhq/hw-transport';
-import type { SubstrateApp } from '@zondax/ledger-substrate';
+// These map to the known name in the @zondax/ledger-substrate/supported_apps package
+// but they do not reflect all ledger apps that are supported. Since ledger now has support for all
+// substrate chains via the PolkadotGenericApp, any new chains that need ledger support can be added to
+// `genericLedgerApps` below.
+export const prevLedgerRecord: Record<string, string> = {
+  acala: 'Acala',
+  ajuna: 'Ajuna',
+  'aleph-node': 'AlephZero',
+  astar: 'Astar',
+  bifrost: 'Bifrost',
+  'bifrost-kusama': 'BifrostKusama',
+  centrifuge: 'Centrifuge',
+  composable: 'Composable',
+  darwinia: 'Darwinia',
+  'dock-mainnet': 'Dock',
+  edgeware: 'Edgeware',
+  enjin: 'Enjin',
+  equilibrium: 'Equilibrium',
+  genshiro: 'Genshiro',
+  hydradx: 'HydraDX',
+  'interlay-parachain': 'Interlay',
+  karura: 'Karura',
+  khala: 'Khala',
+  kusama: 'Kusama',
+  matrixchain: 'Matrixchain',
+  nodle: 'Nodle',
+  origintrail: 'OriginTrail',
+  parallel: 'Parallel',
+  peaq: 'Peaq',
+  pendulum: 'Pendulum',
+  phala: 'Phala',
+  picasso: 'Picasso',
+  polkadex: 'Polkadex',
+  polkadot: 'Polkadot',
+  polymesh: 'Polymesh',
+  quartz: 'Quartz',
+  sora: 'Sora',
+  stafi: 'Stafi',
+  statemine: 'Statemine',
+  statemint: 'Statemint',
+  ternoa: 'Ternoa',
+  unique: 'Unique',
+  vtb: 'VTB',
+  xxnetwork: 'XXNetwork',
+  zeitgeist: 'Zeitgeist'
+};
 
-import { newBifrostApp, newCentrifugeApp, newDockApp, newEdgewareApp, newEquilibriumApp, newGenshiroApp, newKusamaApp, newNodleApp, newPolkadotApp, newPolymeshApp, newSoraApp, newStatemineApp } from '@zondax/ledger-substrate';
+// Any chains moving forward that are supported by the PolkadotGenericApp from ledger will input their names below.
+export const genericLedgerApps = {
+  bittensor: 'Bittensor',
+  creditcoin3: 'Creditcoin3',
+  dentnet: 'DENTNet',
+  encointer: 'Encointer',
+  frequency: 'Frequency',
+  integritee: 'Integritee',
+  liberland: 'Liberland',
+  mythos: 'Mythos',
+  polimec: 'Polimec',
+  vara: 'Vara'
+};
 
 // These match up with the keys of the knownLedger object in the @polkadot/networks/defaults/ledger.ts
-export const ledgerApps: Record<string, (transport: Transport) => SubstrateApp> = {
-  bifrost: newBifrostApp,
-  centrifuge: newCentrifugeApp,
-  'dock-mainnet': newDockApp,
-  edgeware: newEdgewareApp,
-  equilibrium: newEquilibriumApp,
-  genshiro: newGenshiroApp,
-  kusama: newKusamaApp,
-  'nodle-chain': newNodleApp,
-  polkadot: newPolkadotApp,
-  polymesh: newPolymeshApp,
-  sora: newSoraApp,
-  statemine: newStatemineApp
+export const ledgerApps: Record<string, string> = {
+  ...prevLedgerRecord,
+  ...genericLedgerApps
 };

packages/hw-ledger/src/detectOther.ts

@@ -1,7 +0,0 @@
-// Copyright 2017-2022 @polkadot/hw-ledger authors & contributors
-// SPDX-License-Identifier: Apache-2.0
-
-import { packageInfo as transportInfo } from '@polkadot/hw-ledger-transports/packageInfo';
-import { packageInfo as utilInfo } from '@polkadot/util/packageInfo';
-
-export default [transportInfo, utilInfo];

packages/hw-ledger/src/detectPackage.ts

@@ -1,11 +0,0 @@
-// Copyright 2017-2022 @polkadot/hw-ledger authors & contributors
-// SPDX-License-Identifier: Apache-2.0
-
-// Do not edit, auto-generated by @polkadot/dev
-
-import { detectPackage } from '@polkadot/util';
-
-import others from './detectOther';
-import { packageInfo } from './packageInfo';
-
-detectPackage(packageInfo, null, others);

packages/hw-ledger/src/index.ts

@@ -1,6 +1,6 @@
-// Copyright 2017-2022 @polkadot/hw-ledger authors & contributors
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import './detectPackage';
+import './packageDetect.js';
 
-export * from './bundle';
+export * from './bundle.js';

packages/hw-ledger/src/mod.ts

@@ -0,0 +1,4 @@
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+export * from './index.js';

packages/hw-ledger/src/packageDetect.ts

@@ -0,0 +1,13 @@
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+// Do not edit, auto-generated by @polkadot/dev
+// (packageInfo imports will be kept as-is, user-editable)
+
+import { packageInfo as transportInfo } from '@polkadot/hw-ledger-transports/packageInfo';
+import { detectPackage } from '@polkadot/util';
+import { packageInfo as utilInfo } from '@polkadot/util/packageInfo';
+
+import { packageInfo } from './packageInfo.js';
+
+detectPackage(packageInfo, null, [transportInfo, utilInfo]);

packages/hw-ledger/src/packageInfo.ts

@@ -1,6 +1,6 @@
-// Copyright 2017-2022 @polkadot/hw-ledger authors & contributors
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Do not edit, auto-generated by @polkadot/dev
 
-export const packageInfo = { name: '@polkadot/hw-ledger', path: 'auto', type: 'auto', version: '9.0.1' };
+export const packageInfo = { name: '@polkadot/hw-ledger', path: 'auto', type: 'auto', version: '14.0.3' };

packages/hw-ledger/src/types.ts

@@ -1,27 +1,42 @@
-// Copyright 2017-2022 @polkadot/hw-ledger authors & contributors
+// Copyright 2017-2026 @polkadot/hw-ledger authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { HexString } from '@polkadot/util/types';
 
-export type LedgerTypes = 'hid' | 'u2f' | 'webusb';
-
+/**
+ * Legacy Type that works with the `Ledger` class.
+ */
 export interface AccountOptions {
+  /** The index of the account */
   account: number;
+  /** The index of the address */
   addressIndex: number;
+  /** The change to apply */
   change: number;
 }
 
+export interface AccountOptionsGeneric extends AccountOptions {
+  /** Option for PolkadotGenericApp.signWithMetadata */
+  metadata: Buffer;
+}
+
 export interface LedgerAddress {
+  /** The ss58 encoded address */
   address: string;
-  publicKey: string;
+  /** The hex-encoded publicKey */
+  publicKey: HexString;
 }
 
 export interface LedgerSignature {
+  /** A hex-encoded signature, as generated by the device */
   signature: HexString;
 }
 
 export interface LedgerVersion {
+  /** Indicator flag for locked status */
   isLocked: boolean;
+  /** Indicator flag for testmode status */
   isTestMode: boolean;
-  version: [number, number, number];
+  /** The software version for this device */
+  version: [major: number, minor: number, patch: number];
 }

packages/hw-ledger/tsconfig.build.json

@@ -5,6 +5,10 @@
     "outDir": "./build",
     "rootDir": "./src"
   },
+  "exclude": [
+    "**/*.spec.ts",
+    "**/mod.ts"
+  ],
   "references": [
     { "path": "../hw-ledger-transports/tsconfig.build.json" },
     { "path": "../util/tsconfig.build.json" }

packages/hw-ledger/tsconfig.spec.json

@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "baseUrl": "..",
+    "outDir": "./build",
+    "rootDir": "./src",
+    "emitDeclarationOnly": false,
+    "noEmit": true
+  },
+  "include": [
+    "**/*.spec.ts"
+  ],
+  "references": [
+    { "path": "../hw-ledger/tsconfig.build.json" }
+  ]
+}

packages/keyring/LICENSE

@@ -1,201 +0,0 @@
-                              Apache License
-                        Version 2.0, January 2004
-                    http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-  "License" shall mean the terms and conditions for use, reproduction,
-  and distribution as defined by Sections 1 through 9 of this document.
-
-  "Licensor" shall mean the copyright owner or entity authorized by
-  the copyright owner that is granting the License.
-
-  "Legal Entity" shall mean the union of the acting entity and all
-  other entities that control, are controlled by, or are under common
-  control with that entity. For the purposes of this definition,
-  "control" means (i) the power, direct or indirect, to cause the
-  direction or management of such entity, whether by contract or
-  otherwise, or (ii) ownership of fifty percent (50%) or more of the
-  outstanding shares, or (iii) beneficial ownership of such entity.
-
-  "You" (or "Your") shall mean an individual or Legal Entity
-  exercising permissions granted by this License.
-
-  "Source" form shall mean the preferred form for making modifications,
-  including but not limited to software source code, documentation
-  source, and configuration files.
-
-  "Object" form shall mean any form resulting from mechanical
-  transformation or translation of a Source form, including but
-  not limited to compiled object code, generated documentation,
-  and conversions to other media types.
-
-  "Work" shall mean the work of authorship, whether in Source or
-  Object form, made available under the License, as indicated by a
-  copyright notice that is included in or attached to the work
-  (an example is provided in the Appendix below).
-
-  "Derivative Works" shall mean any work, whether in Source or Object
-  form, that is based on (or derived from) the Work and for which the
-  editorial revisions, annotations, elaborations, or other modifications
-  represent, as a whole, an original work of authorship. For the purposes
-  of this License, Derivative Works shall not include works that remain
-  separable from, or merely link (or bind by name) to the interfaces of,
-  the Work and Derivative Works thereof.
-
-  "Contribution" shall mean any work of authorship, including
-  the original version of the Work and any modifications or additions
-  to that Work or Derivative Works thereof, that is intentionally
-  submitted to Licensor for inclusion in the Work by the copyright owner
-  or by an individual or Legal Entity authorized to submit on behalf of
-  the copyright owner. For the purposes of this definition, "submitted"
-  means any form of electronic, verbal, or written communication sent
-  to the Licensor or its representatives, including but not limited to
-  communication on electronic mailing lists, source code control systems,
-  and issue tracking systems that are managed by, or on behalf of, the
-  Licensor for the purpose of discussing and improving the Work, but
-  excluding communication that is conspicuously marked or otherwise
-  designated in writing by the copyright owner as "Not a Contribution."
-
-  "Contributor" shall mean Licensor and any individual or Legal Entity
-  on behalf of whom a Contribution has been received by Licensor and
-  subsequently incorporated within the Work.
-
-2. Grant of Copyright License. Subject to the terms and conditions of
-  this License, each Contributor hereby grants to You a perpetual,
-  worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-  copyright license to reproduce, prepare Derivative Works of,
-  publicly display, publicly perform, sublicense, and distribute the
-  Work and such Derivative Works in Source or Object form.
-
-3. Grant of Patent License. Subject to the terms and conditions of
-  this License, each Contributor hereby grants to You a perpetual,
-  worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-  (except as stated in this section) patent license to make, have made,
-  use, offer to sell, sell, import, and otherwise transfer the Work,
-  where such license applies only to those patent claims licensable
-  by such Contributor that are necessarily infringed by their
-  Contribution(s) alone or by combination of their Contribution(s)
-  with the Work to which such Contribution(s) was submitted. If You
-  institute patent litigation against any entity (including a
-  cross-claim or counterclaim in a lawsuit) alleging that the Work
-  or a Contribution incorporated within the Work constitutes direct
-  or contributory patent infringement, then any patent licenses
-  granted to You under this License for that Work shall terminate
-  as of the date such litigation is filed.
-
-4. Redistribution. You may reproduce and distribute copies of the
-  Work or Derivative Works thereof in any medium, with or without
-  modifications, and in Source or Object form, provided that You
-  meet the following conditions:
-
-  (a) You must give any other recipients of the Work or
-      Derivative Works a copy of this License; and
-
-  (b) You must cause any modified files to carry prominent notices
-      stating that You changed the files; and
-
-  (c) You must retain, in the Source form of any Derivative Works
-      that You distribute, all copyright, patent, trademark, and
-      attribution notices from the Source form of the Work,
-      excluding those notices that do not pertain to any part of
-      the Derivative Works; and
-
-  (d) If the Work includes a "NOTICE" text file as part of its
-      distribution, then any Derivative Works that You distribute must
-      include a readable copy of the attribution notices contained
-      within such NOTICE file, excluding those notices that do not
-      pertain to any part of the Derivative Works, in at least one
-      of the following places: within a NOTICE text file distributed
-      as part of the Derivative Works; within the Source form or
-      documentation, if provided along with the Derivative Works; or,
-      within a display generated by the Derivative Works, if and
-      wherever such third-party notices normally appear. The contents
-      of the NOTICE file are for informational purposes only and
-      do not modify the License. You may add Your own attribution
-      notices within Derivative Works that You distribute, alongside
-      or as an addendum to the NOTICE text from the Work, provided
-      that such additional attribution notices cannot be construed
-      as modifying the License.
-
-  You may add Your own copyright statement to Your modifications and
-  may provide additional or different license terms and conditions
-  for use, reproduction, or distribution of Your modifications, or
-  for any such Derivative Works as a whole, provided Your use,
-  reproduction, and distribution of the Work otherwise complies with
-  the conditions stated in this License.
-
-5. Submission of Contributions. Unless You explicitly state otherwise,
-  any Contribution intentionally submitted for inclusion in the Work
-  by You to the Licensor shall be under the terms and conditions of
-  this License, without any additional terms or conditions.
-  Notwithstanding the above, nothing herein shall supersede or modify
-  the terms of any separate license agreement you may have executed
-  with Licensor regarding such Contributions.
-
-6. Trademarks. This License does not grant permission to use the trade
-  names, trademarks, service marks, or product names of the Licensor,
-  except as required for reasonable and customary use in describing the
-  origin of the Work and reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty. Unless required by applicable law or
-  agreed to in writing, Licensor provides the Work (and each
-  Contributor provides its Contributions) on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-  implied, including, without limitation, any warranties or conditions
-  of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-  PARTICULAR PURPOSE. You are solely responsible for determining the
-  appropriateness of using or redistributing the Work and assume any
-  risks associated with Your exercise of permissions under this License.
-
-8. Limitation of Liability. In no event and under no legal theory,
-  whether in tort (including negligence), contract, or otherwise,
-  unless required by applicable law (such as deliberate and grossly
-  negligent acts) or agreed to in writing, shall any Contributor be
-  liable to You for damages, including any direct, indirect, special,
-  incidental, or consequential damages of any character arising as a
-  result of this License or out of the use or inability to use the
-  Work (including but not limited to damages for loss of goodwill,
-  work stoppage, computer failure or malfunction, or any and all
-  other commercial damages or losses), even if such Contributor
-  has been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability. While redistributing
-  the Work or Derivative Works thereof, You may choose to offer,
-  and charge a fee for, acceptance of support, warranty, indemnity,
-  or other liability obligations and/or rights consistent with this
-  License. However, in accepting such obligations, You may act only
-  on Your own behalf and on Your sole responsibility, not on behalf
-  of any other Contributor, and only if You agree to indemnify,
-  defend, and hold each Contributor harmless for any liability
-  incurred by, or claims asserted against, such Contributor by reason
-  of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work.
-
-  To apply the Apache License to your work, attach the following
-  boilerplate notice, with the fields enclosed by brackets "[]"
-  replaced with your own identifying information. (Don't include
-  the brackets!)  The text should be enclosed in the appropriate
-  comment syntax for the file format. We also recommend that a
-  file or class name and description of purpose be included on the
-  same "printed page" as the copyright notice for easier
-  identification within third-party archives.
-
-Copyright [yyyy] [name of copyright owner]
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.

packages/keyring/package.json

@@ -1,14 +1,12 @@
 {
   "author": "Jaco Greeff <jacogr@gmail.com>",
   "bugs": "https://github.com/polkadot-js/common/issues",
-  "contributors": [],
   "description": "Keyring management",
   "engines": {
-    "node": ">=14.0.0"
+    "node": ">=18"
   },
   "homepage": "https://github.com/polkadot-js/common/tree/master/packages/keyring#readme",
   "license": "Apache-2.0",
-  "maintainers": [],
   "name": "@polkadot/keyring",
   "repository": {
     "directory": "packages/keyring",
@@ -16,19 +14,20 @@
     "url": "https://github.com/polkadot-js/common.git"
   },
   "sideEffects": [
-    "./detectPackage.js",
-    "./detectPackage.cjs"
+    "./packageDetect.js",
+    "./packageDetect.cjs"
   ],
   "type": "module",
-  "version": "9.0.1",
+  "version": "14.0.3-quantus.2",
   "main": "index.js",
   "dependencies": {
-    "@babel/runtime": "^7.17.9",
-    "@polkadot/util": "9.0.1",
-    "@polkadot/util-crypto": "9.0.1"
+    "@polkadot/util": "14.0.3",
+    "@polkadot/util-crypto": "14.0.3-quantus.2",
+    "@quantus/crypto": "^0.1.0",
+    "tslib": "^2.8.0"
   },
   "peerDependencies": {
-    "@polkadot/util": "9.0.1",
-    "@polkadot/util-crypto": "9.0.1"
+    "@polkadot/util": "14.0.3",
+    "@polkadot/util-crypto": "14.0.3"
   }
 }

packages/keyring/src/bundle.ts

@@ -1,14 +1,16 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import { Keyring } from './keyring';
-
+// all external
+// eslint-disable-next-line deprecation/deprecation
 export { decodeAddress, encodeAddress, setSS58Format } from '@polkadot/util-crypto';
 
-export * from './defaults';
-export { createPair } from './pair';
-export { packageInfo } from './packageInfo';
-export { createTestKeyring } from './testing';
-export { createTestPairs } from './testingPairs';
+// all named
+export { Keyring } from './keyring.js';
+export { packageInfo } from './packageInfo.js';
+export { createPair } from './pair/index.js';
+export { createTestKeyring } from './testing.js';
+export { createTestPairs } from './testingPairs.js';
 
-export { Keyring };
+// all starred
+export * from './defaults.js';

packages/keyring/src/defaults.ts

@@ -1,4 +1,4 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // default substrate dev phrase

packages/keyring/src/detectOther.ts

@@ -1,7 +0,0 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
-// SPDX-License-Identifier: Apache-2.0
-
-import { packageInfo as utilInfo } from '@polkadot/util/packageInfo';
-import { packageInfo as cryptoInfo } from '@polkadot/util-crypto/packageInfo';
-
-export default [utilInfo, cryptoInfo];

packages/keyring/src/detectPackage.ts

@@ -1,11 +0,0 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
-// SPDX-License-Identifier: Apache-2.0
-
-// Do not edit, auto-generated by @polkadot/dev
-
-import { detectPackage } from '@polkadot/util';
-
-import others from './detectOther';
-import { packageInfo } from './packageInfo';
-
-detectPackage(packageInfo, null, others);

packages/keyring/src/index.spec.ts

@@ -1,19 +1,20 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type { KeyringPair$Json } from './types';
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
+
+import type { KeyringPair$Json } from './types.js';
 
 import { hexToU8a, stringToU8a } from '@polkadot/util';
-import { base64Decode, cryptoWaitReady, encodeAddress, randomAsU8a, setSS58Format } from '@polkadot/util-crypto';
+import { base64Decode, cryptoWaitReady, encodeAddress, mnemonicGenerate, randomAsU8a, setSS58Format } from '@polkadot/util-crypto';
+import * as languages from '@polkadot/util-crypto/mnemonic/wordlists/index';
 
-import { decodePair } from './pair/decode';
-import Keyring from '.';
+import { decodePair } from './pair/decode.js';
+import Keyring from './index.js';
+
+await cryptoWaitReady();
 
 describe('keypair', (): void => {
-  beforeEach(async (): Promise<void> => {
-    await cryptoWaitReady();
-  });
-
   describe('ed25519', (): void => {
     const publicKeyOne = new Uint8Array([47, 140, 97, 41, 216, 22, 207, 81, 195, 116, 188, 127, 8, 195, 230, 62, 209, 86, 207, 120, 174, 251, 74, 101, 80, 217, 123, 135, 153, 121, 119, 238]);
     const publicKeyTwo = new Uint8Array([215, 90, 152, 1, 130, 177, 10, 183, 213, 75, 254, 211, 201, 100, 7, 58, 14, 225, 114, 243, 218, 166, 35, 37, 175, 2, 26, 104, 247, 7, 81, 26]);
@@ -48,6 +49,7 @@ describe('keypair', (): void => {
     });
 
     it('adds from a mnemonic, with correct ss58', (): void => {
+      // eslint-disable-next-line deprecation/deprecation
       setSS58Format(20); // this would not be used
       keyring.setSS58Format(2); // this would be used
 
@@ -573,4 +575,35 @@ describe('keypair', (): void => {
       expect(pair.address).toBe('FLiSDPCcJ6auZUGXALLj6jpahcP6adVFDBUQznPXUQ7yoqH');
     });
   });
+
+  describe('wordlist', (): void => {
+    it('creates keypair from different wordlists mnemonics', (): void => {
+      Object.keys(languages).forEach((language) => {
+        const mnemonic = mnemonicGenerate(12, languages[language as keyof typeof languages]);
+        const keyring = new Keyring({
+          type: 'ed25519'
+        });
+
+        expect(keyring.addFromMnemonic(
+          mnemonic,
+          {},
+          'ed25519',
+          languages[language as keyof typeof languages]
+        )).toBeDefined();
+      });
+    });
+    it('cannot create from invalid wordlist', (): void => {
+      const mnemonic = mnemonicGenerate(12, languages.japanese);
+      const keyring = new Keyring({
+        type: 'ed25519'
+      });
+
+      expect(() => keyring.addFromMnemonic(
+        mnemonic,
+        {},
+        'ed25519',
+        languages.english
+      )).toThrow('Invalid bip39 mnemonic specified');
+    });
+  });
 });

packages/keyring/src/index.ts

@@ -1,10 +1,10 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import './detectPackage';
+import './packageDetect.js';
 
-import { Keyring } from './bundle';
+import { Keyring } from './bundle.js';
 
-export * from './bundle';
+export * from './bundle.js';
 
 export default Keyring;

packages/keyring/src/keyring.ts

@@ -1,17 +1,29 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { EncryptedJsonEncoding, Keypair, KeypairType } from '@polkadot/util-crypto/types';
-import type { KeyringInstance, KeyringOptions, KeyringPair, KeyringPair$Json, KeyringPair$Meta } from './types';
+import type { KeyringInstance, KeyringOptions, KeyringPair, KeyringPair$Json, KeyringPair$Meta } from './types.js';
 
-import { assert, hexToU8a, isHex, isUndefined, stringToU8a } from '@polkadot/util';
-import { base64Decode, decodeAddress, ed25519PairFromSeed as ed25519FromSeed, encodeAddress, ethereumEncode, hdEthereum, keyExtractSuri, keyFromPath, mnemonicToLegacySeed, mnemonicToMiniSecret, secp256k1PairFromSeed as secp256k1FromSeed, sr25519PairFromSeed as sr25519FromSeed } from '@polkadot/util-crypto';
+import { hexToU8a, isHex, stringToU8a } from '@polkadot/util';
+import { base64Decode, decodeAddress, dilithiumPairFromMnemonic, dilithiumPairFromSeed, dilithiumPathFromSuri, ed25519PairFromSeed as ed25519FromSeed, encodeAddress, ethereumEncode, hdEthereum, isDilithium, keyExtractSuri, keyFromPath, mnemonicToLegacySeed, mnemonicToMiniSecret, secp256k1PairFromSeed as secp256k1FromSeed, sr25519PairFromSeed as sr25519FromSeed } from '@polkadot/util-crypto';
 
-import { DEV_PHRASE } from './defaults';
-import { createPair } from './pair';
-import { Pairs } from './pairs';
+import { createPair } from './pair/index.js';
+import { DEV_PHRASE } from './defaults.js';
+import { Pairs } from './pairs.js';
+
+/**
+ * Every keypair type this keyring will construct.
+ *
+ * Was two separate inline arrays, both of which a widened `KeypairType` silently
+ * walked past — the union is compile-time and these checks are not. Named once so
+ * the next change to the union has one place to look, and so the error message
+ * cannot drift from the check.
+ */
+const KEYPAIR_TYPES: KeypairType[] = ['dilithium65', 'dilithium87', 'ecdsa', 'ed25519', 'ethereum', 'sr25519'];
 
 const PairFromSeed = {
+  dilithium65: (seed: Uint8Array): Keypair => dilithiumPairFromSeed(seed, 'dilithium65'),
+  dilithium87: (seed: Uint8Array): Keypair => dilithiumPairFromSeed(seed, 'dilithium87'),
   ecdsa: (seed: Uint8Array): Keypair => secp256k1FromSeed(seed),
   ed25519: (seed: Uint8Array): Keypair => ed25519FromSeed(seed),
   ethereum: (seed: Uint8Array): Keypair => secp256k1FromSeed(seed),
@@ -43,14 +55,19 @@ export class Keyring implements KeyringInstance {
 
   readonly #type: KeypairType;
 
-  #ss58?: number;
+  #ss58?: number | undefined;
 
   public decodeAddress = decodeAddress;
 
   constructor (options: KeyringOptions = {}) {
     options.type = options.type || 'ed25519';
 
-    assert(['ecdsa', 'ethereum', 'ed25519', 'sr25519'].includes(options.type || 'undefined'), () => `Expected a keyring type of either 'ed25519', 'sr25519', 'ethereum' or 'ecdsa', found '${options.type || 'unknown'}`);
+    // A runtime whitelist behind the KeypairType union, so widening the type
+    // alone was not enough — the compiler cannot see this one, and it fails at
+    // construction rather than at use.
+    if (!KEYPAIR_TYPES.includes(options.type || ('undefined' as KeypairType))) {
+      throw new Error(`Expected a keyring type of one of ${KEYPAIR_TYPES.map((t) => `'${t}'`).join(', ')}, found '${options.type || 'unknown'}'`);
+    }
 
     this.#pairs = new Pairs();
     this.#ss58 = options.ss58Format;
@@ -119,8 +136,8 @@ export class Keyring implements KeyringInstance {
    * of an account backup), and then generates a keyring pair from it that it passes to
    * `addPair` to stores in a keyring pair dictionary the public key of the generated pair as a key and the pair as the associated value.
    */
-  public addFromMnemonic (mnemonic: string, meta: KeyringPair$Meta = {}, type: KeypairType = this.type): KeyringPair {
-    return this.addFromUri(mnemonic, meta, type);
+  public addFromMnemonic (mnemonic: string, meta: KeyringPair$Meta = {}, type: KeypairType = this.type, wordlist?: string[]): KeyringPair {
+    return this.addFromUri(mnemonic, meta, type, wordlist);
   }
 
   /**
@@ -151,9 +168,9 @@ export class Keyring implements KeyringInstance {
    * @summary Creates an account via an suri
    * @description Extracts the phrase, path and password from a SURI format for specifying secret keys `<secret>/<soft-key>//<hard-key>///<password>` (the `///password` may be omitted, and `/<soft-key>` and `//<hard-key>` maybe repeated and mixed). The secret can be a hex string, mnemonic phrase or a string (to be padded)
    */
-  public addFromUri (suri: string, meta: KeyringPair$Meta = {}, type: KeypairType = this.type): KeyringPair {
+  public addFromUri (suri: string, meta: KeyringPair$Meta = {}, type: KeypairType = this.type, wordlist?: string[]): KeyringPair {
     return this.addPair(
-      this.createFromUri(suri, meta, type)
+      this.createFromUri(suri, meta, type, wordlist)
     );
   }
 
@@ -162,7 +179,9 @@ export class Keyring implements KeyringInstance {
    * @description Creates a pair from a JSON keyfile
    */
   public createFromJson ({ address, encoded, encoding: { content, type, version }, meta }: KeyringPair$Json, ignoreChecksum?: boolean): KeyringPair {
-    assert(version !== '3' || content[0] === 'pkcs8', () => `Unable to decode non-pkcs8 type, [${content.join(',')}] found}`);
+    if (version === '3' && content[0] !== 'pkcs8') {
+      throw new Error(`Unable to decode non-pkcs8 type, [${content.join(',')}] found}`);
+    }
 
     const cryptoType = version === '0' || !Array.isArray(content)
       ? this.type
@@ -171,17 +190,35 @@ export class Keyring implements KeyringInstance {
       ? [type]
       : type;
 
-    assert(['ed25519', 'sr25519', 'ecdsa', 'ethereum'].includes(cryptoType), () => `Unknown crypto type ${cryptoType}`);
+    // Same list, second copy — this one guards JSON coming in from a file the
+    // user chose, so it is the guard that will matter most once quantus/common#6
+    // narrows the union and imports of quantum-unsafe keys have to be refused
+    // with a message explaining why rather than "unknown crypto type".
+    if (!KEYPAIR_TYPES.includes(cryptoType as KeypairType)) {
+      throw new Error(`Unknown crypto type ${cryptoType}`);
+    }
 
-    // Here the address and publicKey are 32 bytes and isomorphic. This is why the address field needs to be the public key for ethereum type pairs
-    const publicKey = isHex(address)
+    // For the curve schemes the address and publicKey are 32 bytes and
+    // isomorphic, which is why the address field holds the public key for
+    // ethereum pairs and why this works at all.
+    const raw = isHex(address)
       ? hexToU8a(address)
       : this.decodeAddress(address, ignoreChecksum);
     const decoded = isHex(encoded)
       ? hexToU8a(encoded)
       : base64Decode(encoded);
 
-    return createPair({ toSS58: this.encodeAddress, type: cryptoType as KeypairType }, { publicKey, secretKey: new Uint8Array() }, meta, decoded, encType);
+    // ML-DSA breaks the isomorphism: the account id is a one-way Poseidon2 hash
+    // and the 1952/2592-byte public key is inside `decoded`, which is encrypted
+    // and stays that way until someone supplies a password. So pass the account
+    // id as an account id rather than pretending it is a key — createPair uses
+    // it for the address while locked, and checks it against the real public key
+    // the moment `decodePkcs8` produces one.
+    const info = isDilithium(cryptoType as KeypairType)
+      ? { accountId: raw, publicKey: new Uint8Array(), secretKey: new Uint8Array() }
+      : { publicKey: raw, secretKey: new Uint8Array() };
+
+    return createPair({ toSS58: this.encodeAddress, type: cryptoType as KeypairType }, info, meta, decoded, encType);
   }
 
   /**
@@ -197,7 +234,7 @@ export class Keyring implements KeyringInstance {
    * @summary Creates a Keypair from an suri
    * @description This creates a pair from the suri, but does not add it to the keyring
    */
-  public createFromUri (_suri: string, meta: KeyringPair$Meta = {}, type: KeypairType = this.type): KeyringPair {
+  public createFromUri (_suri: string, meta: KeyringPair$Meta = {}, type: KeypairType = this.type, wordlist?: string[]): KeyringPair {
     // here we only aut-add the dev phrase if we have a hard-derived path
     const suri = _suri.startsWith('//')
       ? `${DEV_PHRASE}${_suri}`
@@ -206,6 +243,33 @@ export class Keyring implements KeyringInstance {
     let seed: Uint8Array;
     const isPhraseHex = isHex(phrase, 256);
 
+    // ML-DSA derives from the mnemonic itself along a hardened BIP44 path, not
+    // from a seed along a junction chain — lattice keys have no public
+    // derivability, so there is no soft junction to emulate and the chain's own
+    // Pair::derive refuses for the same reason. Handled before the seeding below
+    // because that seeding (mnemonicToMiniSecret) is the wrong one for us and
+    // would produce a valid key for an account nobody owns.
+    if (isDilithium(type)) {
+      if (isPhraseHex) {
+        // A raw 32-byte seed goes straight into keygen, which is how the
+        // dev-genesis accounts are defined. Combining one with a derivation path
+        // is ambiguous — is the seed the master, or already derived? — so refuse
+        // rather than pick.
+        if (derivePath) {
+          throw new Error('A derivation path cannot be combined with a raw seed for post-quantum pairs');
+        }
+
+        return createPair({ toSS58: this.encodeAddress, type }, PairFromSeed[type](hexToU8a(phrase)), meta, null);
+      }
+
+      return createPair(
+        { toSS58: this.encodeAddress, type },
+        dilithiumPairFromMnemonic(phrase, password || '', dilithiumPathFromSuri(type, derivePath), type),
+        meta,
+        null
+      );
+    }
+
     if (isPhraseHex) {
       seed = hexToU8a(phrase);
     } else {
@@ -214,9 +278,11 @@ export class Keyring implements KeyringInstance {
       if ([12, 15, 18, 21, 24].includes(parts.length)) {
         seed = type === 'ethereum'
           ? mnemonicToLegacySeed(phrase, '', false, 64)
-          : mnemonicToMiniSecret(phrase, password);
+          : mnemonicToMiniSecret(phrase, password, wordlist);
       } else {
-        assert(phrase.length <= 32, 'specified phrase is not a valid mnemonic and is invalid as a raw seed at > 32 bytes');
+        if (phrase.length > 32) {
+          throw new Error('specified phrase is not a valid mnemonic and is invalid as a raw seed at > 32 bytes');
+        }
 
         seed = stringToU8a(phrase.padEnd(32));
       }
@@ -238,7 +304,7 @@ export class Keyring implements KeyringInstance {
   public encodeAddress = (address: Uint8Array | string, ss58Format?: number): string => {
     return this.type === 'ethereum'
       ? ethereumEncode(address)
-      : encodeAddress(address, isUndefined(ss58Format) ? this.#ss58 : ss58Format);
+      : encodeAddress(address, ss58Format ?? this.#ss58);
   };
 
   /**

packages/keyring/src/mod.ts

@@ -0,0 +1,4 @@
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+export * from './index.js';

packages/keyring/src/packageDetect.ts

@@ -0,0 +1,13 @@
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+// Do not edit, auto-generated by @polkadot/dev
+// (packageInfo imports will be kept as-is, user-editable)
+
+import { detectPackage } from '@polkadot/util';
+import { packageInfo as utilInfo } from '@polkadot/util/packageInfo';
+import { packageInfo as cryptoInfo } from '@polkadot/util-crypto/packageInfo';
+
+import { packageInfo } from './packageInfo.js';
+
+detectPackage(packageInfo, null, [cryptoInfo, utilInfo]);

packages/keyring/src/packageInfo.ts

@@ -1,6 +1,6 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 // Do not edit, auto-generated by @polkadot/dev
 
-export const packageInfo = { name: '@polkadot/keyring', path: 'auto', type: 'auto', version: '9.0.1' };
+export const packageInfo = { name: '@polkadot/keyring', path: 'auto', type: 'auto', version: '14.0.3-quantus.2' };

packages/keyring/src/pair/decode.spec.ts

@@ -1,7 +1,9 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import { createTestPairs } from '../testingPairs';
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
+
+import { createTestPairs } from '../testingPairs.js';
 
 const keyring = createTestPairs({ type: 'ed25519' }, false);
 

packages/keyring/src/pair/decode.ts

@@ -1,43 +1,81 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { EncryptedJsonEncoding } from '@polkadot/util-crypto/types';
-import type { PairInfo } from './types';
 
-import { assert, isUndefined, u8aEq } from '@polkadot/util';
+import { u8aEq } from '@polkadot/util';
 import { jsonDecryptData } from '@polkadot/util-crypto';
 
-import { PKCS8_DIVIDER, PKCS8_HEADER, PUB_LENGTH, SEC_LENGTH, SEED_LENGTH } from './defaults';
+import { PAIR_DIV, PAIR_HDR, PUB_LENGTH, SEC_LENGTH, SEED_LENGTH } from './defaults.js';
 
-const SEED_OFFSET = PKCS8_HEADER.length;
+const SEED_OFFSET = PAIR_HDR.length;
 
-type DecodeResult = PairInfo & {
-  secretKey: Uint8Array;
-};
-
-export function decodePair (passphrase?: string, encrypted?: Uint8Array | null, _encType?: EncryptedJsonEncoding | EncryptedJsonEncoding[]): DecodeResult {
-  const encType = Array.isArray(_encType) || isUndefined(_encType)
+/**
+ * Decode a pair, taking into account the generation-specific formats and headers
+ *
+ * For divisor/headers, don't rely on the magic being static. These will
+ * change between generations, aka with the long-awaited 4th generation
+ * of the format. The external decode interface is the only way to use and decode these.
+ *
+ * `secretLength` exists for keys that are not 32 or 64 bytes. The body is
+ * `HDR ‖ secretKey ‖ DIV ‖ publicKey`, and upstream located the divider by
+ * trying the two lengths every curve scheme uses. An ML-DSA secret is 4032 or
+ * 4896 bytes, so neither offset matches and the decode throws "Invalid encoding
+ * divider found in body" — a stored account that cannot be read back.
+ *
+ * The caller passes the length rather than this function searching for the
+ * divider. Searching would work almost always and fail catastrophically when it
+ * did not: PAIR_DIV is five bytes, so a 4032-byte secret contains a false match
+ * about once in 270 million keys, and the result would be a silently wrong key
+ * rather than an error. The caller knows the type, so it knows the length.
+ **/
+export function decodePair (passphrase?: string, encrypted?: Uint8Array | null, _encType?: EncryptedJsonEncoding | EncryptedJsonEncoding[], secretLength?: number): { publicKey: Uint8Array; secretKey: Uint8Array } {
+  const encType = Array.isArray(_encType) || _encType === undefined
     ? _encType
     : [_encType];
   const decrypted = jsonDecryptData(encrypted, passphrase, encType);
-  const header = decrypted.subarray(0, PKCS8_HEADER.length);
+  const header = decrypted.subarray(0, PAIR_HDR.length);
 
-  assert(u8aEq(header, PKCS8_HEADER), 'Invalid Pkcs8 header found in body');
-
-  let secretKey = decrypted.subarray(SEED_OFFSET, SEED_OFFSET + SEC_LENGTH);
-  let divOffset = SEED_OFFSET + SEC_LENGTH;
-  let divider = decrypted.subarray(divOffset, divOffset + PKCS8_DIVIDER.length);
-
-  // old-style, we have the seed here
-  if (!u8aEq(divider, PKCS8_DIVIDER)) {
-    divOffset = SEED_OFFSET + SEED_LENGTH;
-    secretKey = decrypted.subarray(SEED_OFFSET, divOffset);
-    divider = decrypted.subarray(divOffset, divOffset + PKCS8_DIVIDER.length);
-
-    assert(u8aEq(divider, PKCS8_DIVIDER), 'Invalid Pkcs8 divider found in body');
+  // check the start header (generations 1-3)
+  if (!u8aEq(header, PAIR_HDR)) {
+    throw new Error('Invalid encoding header found in body');
   }
 
-  const pubOffset = divOffset + PKCS8_DIVIDER.length;
+  // an explicitly-sized secret (ML-DSA); there is one offset and it either
+  // matches or the blob is not what the caller said it was
+  if (secretLength) {
+    const divOffset = SEED_OFFSET + secretLength;
+
+    if (!u8aEq(decrypted.subarray(divOffset, divOffset + PAIR_DIV.length), PAIR_DIV)) {
+      throw new Error('Invalid encoding divider found in body');
+    }
+
+    return {
+      // the public key is the remainder: its length varies by scheme and the
+      // body ends here, so there is nothing to read past it
+      publicKey: decrypted.subarray(divOffset + PAIR_DIV.length),
+      secretKey: decrypted.subarray(SEED_OFFSET, divOffset)
+    };
+  }
+
+  // setup for generation 3 format
+  let secretKey = decrypted.subarray(SEED_OFFSET, SEED_OFFSET + SEC_LENGTH);
+  let divOffset = SEED_OFFSET + SEC_LENGTH;
+  let divider = decrypted.subarray(divOffset, divOffset + PAIR_DIV.length);
+
+  // old-style (generation 1 & 2), we have the seed here
+  if (!u8aEq(divider, PAIR_DIV)) {
+    divOffset = SEED_OFFSET + SEED_LENGTH;
+    secretKey = decrypted.subarray(SEED_OFFSET, divOffset);
+    divider = decrypted.subarray(divOffset, divOffset + PAIR_DIV.length);
+
+    // check the divisior at this point (already checked for generation 3)
+    if (!u8aEq(divider, PAIR_DIV)) {
+      throw new Error('Invalid encoding divider found in body');
+    }
+  }
+
+  const pubOffset = divOffset + PAIR_DIV.length;
   const publicKey = decrypted.subarray(pubOffset, pubOffset + PUB_LENGTH);
 
   return {

packages/keyring/src/pair/defaults.ts

@@ -1,9 +1,20 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-export const PKCS8_DIVIDER = new Uint8Array([161, 35, 3, 33, 0]);
-export const PKCS8_HEADER = new Uint8Array([48, 83, 2, 1, 1, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32]);
+/** public/secret section divider (generation 1-3, will change in 4, don't rely on value) */
+export const PAIR_DIV = new Uint8Array([161, 35, 3, 33, 0]);
+
+/** public/secret start block (generation 1-3, will change in 4, don't rely on value) */
+export const PAIR_HDR = new Uint8Array([48, 83, 2, 1, 1, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32]);
+
+/** length of a public key */
 export const PUB_LENGTH = 32;
+
+/** length of a salt */
 export const SALT_LENGTH = 32;
+
+/** length of a secret key */
 export const SEC_LENGTH = 64;
+
+/** length of a user-input seed */
 export const SEED_LENGTH = 32;

packages/keyring/src/pair/dilithium.spec.ts

@@ -0,0 +1,100 @@
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
+
+import { contextForSpec, Scheme, sizes } from '@quantus/crypto';
+
+import { dilithiumVerify } from '@polkadot/util-crypto';
+
+import { Keyring } from '../keyring.js';
+
+// crystal_alice, from the chain's dev genesis: a raw 32-byte seed straight into
+// ML-DSA-87 keygen, no HD derivation. The expected address is what
+// `quantus developer create-test-wallets` prints — an independent implementation,
+// not this one.
+const ALICE_ADDRESS = 'qzk1Nxai3dZD9Cn5kwGcgL6mKxsfxwqdis7kDQJ52aJS2vSn7';
+
+const MESSAGE = new Uint8Array([0x74, 0x68, 0x65, 0x20, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64]);
+
+describe('dilithium pairs', (): void => {
+  const keyring = new Keyring({ ss58Format: 189, type: 'dilithium87' });
+  const alice = keyring.addFromSeed(new Uint8Array(32), { name: 'crystal_alice' }, 'dilithium87');
+  const context = contextForSpec(148);
+  const s87 = sizes(Scheme.MlDsa87);
+  const s65 = sizes(Scheme.MlDsa65);
+
+  it('derives the address quantus-cli derives', (): void => {
+    expect(alice.address).toEqual(ALICE_ADDRESS);
+  });
+
+  // The assumption this whole fork exists to break. Everywhere else in this
+  // package `addressRaw` and `publicKey` are the same 32 bytes.
+  it('has an addressRaw that is not the publicKey', (): void => {
+    expect(alice.addressRaw.length).toEqual(32);
+    expect(alice.publicKey.length).toEqual(s87.publicKey);
+  });
+
+  it('signs to the wire form the runtime reads', (): void => {
+    const signature = alice.sign(MESSAGE, { context });
+
+    expect(signature.length).toEqual(s87.signatureWithPublicKey);
+  });
+
+  // `withType` prepends the signature enum's variant index. For the curve types
+  // that enum is Substrate's MultiSignature; here it is the runtime's
+  // DilithiumSignatureScheme, reached by the same mechanism.
+  it('prepends the chain variant byte with withType', (): void => {
+    const signed87 = alice.sign(MESSAGE, { context, withType: true });
+    const k65 = keyring.addFromSeed(new Uint8Array(32).fill(9), {}, 'dilithium65');
+    const signed65 = k65.sign(MESSAGE, { context, withType: true });
+
+    expect(signed87[0]).toEqual(0);
+    expect(signed87.length).toEqual(s87.signatureWithPublicKey + 1);
+    expect(signed65[0]).toEqual(1);
+    expect(signed65.length).toEqual(s65.signatureWithPublicKey + 1);
+  });
+
+  it('verifies against the account id', (): void => {
+    const signature = alice.sign(MESSAGE, { context });
+
+    expect(dilithiumVerify(MESSAGE, signature, alice.addressRaw, 'dilithium87', context)).toEqual(true);
+  });
+
+  // The spec-148 boundary. A signature made under the wrong context is
+  // cryptographically valid and rejected by the chain, so this is the only place
+  // it can be caught locally.
+  it('does not verify under the wrong context', (): void => {
+    const signature = alice.sign(MESSAGE, { context });
+
+    expect(dilithiumVerify(MESSAGE, signature, alice.addressRaw, 'dilithium87', contextForSpec(147))).toEqual(false);
+  });
+
+  // Verification checks the embedded public key hashes to the account being
+  // verified against, not merely that the signature is valid for *some* key.
+  it('does not verify another account signature', (): void => {
+    const bob = keyring.addFromSeed(new Uint8Array(32).fill(1), {}, 'dilithium87');
+    const signature = bob.sign(MESSAGE, { context });
+
+    expect(dilithiumVerify(MESSAGE, signature, alice.addressRaw, 'dilithium87', context)).toEqual(false);
+  });
+
+  it('refuses to sign without a context', (): void => {
+    expect(() => alice.sign(MESSAGE)).toThrow(/signing context is required/);
+  });
+
+  // There is no ML-DSA VRF, and faking one from an ordinary signature would
+  // produce output that looks like a VRF proof and cannot be verified as one.
+  it('refuses to VRF sign', (): void => {
+    expect(() => alice.vrfSign(MESSAGE)).toThrow(/not available for dilithium87/);
+  });
+
+  // The classical paths must be untouched — this is what a careless rebase
+  // breaks, and it would break silently.
+  it('leaves sr25519 unchanged', (): void => {
+    const sr = new Keyring({ type: 'sr25519' }).addFromUri('//Alice');
+
+    expect(sr.address).toEqual('5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY');
+    expect(sr.sign(MESSAGE).length).toEqual(64);
+  });
+});

packages/keyring/src/pair/dilithiumDerive.spec.ts

@@ -0,0 +1,104 @@
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
+
+import { dilithiumPath } from '@polkadot/util-crypto';
+
+import { Keyring } from '../keyring.js';
+
+// The well-known Substrate development phrase — public by design, so pinning it
+// commits no secret. Any account it derives is assumed compromised.
+const DEV_PHRASE = 'bottom drive obey lake curtain smoke basket hold race lonely fit walk';
+
+// What `quantus wallet import --mnemonic-file <DEV_PHRASE> --scheme <s>` prints.
+// An independent implementation, not this one.
+const EXPECT_65 = 'qzq29m9WvneDAeXbtgueKCREtNe1rVVs6bXSMLmjr6shqvwq6';
+const EXPECT_87 = 'qzjrYTUnnE5NduTZKxe9dESCMTZg7nTueKM3bwhnkRdD1iYV4';
+
+// crystal_alice — a raw 32-byte seed straight into keygen, no derivation.
+const ALICE = 'qzk1Nxai3dZD9Cn5kwGcgL6mKxsfxwqdis7kDQJ52aJS2vSn7';
+
+describe('dilithium derivation', (): void => {
+  const keyring = new Keyring({ ss58Format: 189, type: 'dilithium65' });
+
+  it('builds the paths quantus-cli uses', (): void => {
+    expect(dilithiumPath('dilithium65')).toEqual("m/44'/189189'/0'/0'/1'");
+    expect(dilithiumPath('dilithium87')).toEqual("m/44'/189189'/0'/0'/0'");
+    expect(dilithiumPath('dilithium65', 3)).toEqual("m/44'/189189'/3'/0'/1'");
+  });
+
+  // The whole derivation chain at once: BIP39 to a 64-byte seed (not Substrate's
+  // mnemonicToMiniSecret), the HMAC-SHA512 walk keyed with "Dilithium seed", the
+  // trailing hardened index carrying the scheme, and the Poseidon2 account hash.
+  it('derives what quantus-cli derives, both schemes', (): void => {
+    expect(keyring.createFromUri(DEV_PHRASE, {}, 'dilithium65').address).toEqual(EXPECT_65);
+    expect(keyring.createFromUri(DEV_PHRASE, {}, 'dilithium87').address).toEqual(EXPECT_87);
+  });
+
+  it('defaults to account index 0', (): void => {
+    expect(keyring.createFromUri(`${DEV_PHRASE}//0`, {}, 'dilithium65').address).toEqual(EXPECT_65);
+  });
+
+  it('derives distinct accounts per index', (): void => {
+    const zero = keyring.createFromUri(`${DEV_PHRASE}//0`, {}, 'dilithium65').address;
+    const one = keyring.createFromUri(`${DEV_PHRASE}//1`, {}, 'dilithium65').address;
+
+    expect(zero).not.toEqual(one);
+  });
+
+  it('accepts an explicit hardened path', (): void => {
+    const byIndex = keyring.createFromUri(`${DEV_PHRASE}//2`, {}, 'dilithium65').address;
+    const byPath = keyring.createFromUri(`${DEV_PHRASE}//m/44'/189189'/2'/0'/1'`, {}, 'dilithium65').address;
+
+    expect(byPath).toEqual(byIndex);
+  });
+
+  // The suri syntax was built for curve junctions, where `/foo` is a soft
+  // derivation over arbitrary bytes. Neither form exists for ML-DSA, and quietly
+  // reinterpreting one would hand back an address no other tool derives.
+  it('refuses soft derivation', (): void => {
+    expect(() => keyring.createFromUri(`${DEV_PHRASE}/0`, {}, 'dilithium65')).toThrow(/Soft derivation is not possible/);
+  });
+
+  it('refuses a named junction', (): void => {
+    expect(() => keyring.createFromUri(`${DEV_PHRASE}//Alice`, {}, 'dilithium65')).toThrow(/Unsupported derivation path/);
+  });
+
+  it('refuses an unhardened level in an explicit path', (): void => {
+    expect(() => keyring.createFromUri(`${DEV_PHRASE}//m/44'/189189'/0'/0'/1`, {}, 'dilithium65')).toThrow(/Unhardened derivation/);
+  });
+
+  // A raw seed is already key material. Whether it is the master or something
+  // already derived is unanswerable, so combining it with a path is refused
+  // rather than guessed.
+  it('takes a raw hex seed underived, and refuses to derive from one', (): void => {
+    const seed = `0x${'00'.repeat(32)}`;
+
+    expect(keyring.createFromUri(seed, {}, 'dilithium87').address).toEqual(ALICE);
+    expect(() => keyring.createFromUri(`${seed}//1`, {}, 'dilithium87')).toThrow(/cannot be combined with a raw seed/);
+  });
+
+  it('honours a BIP39 passphrase', (): void => {
+    const plain = keyring.createFromUri(DEV_PHRASE, {}, 'dilithium65').address;
+    const withPass = keyring.createFromUri(`${DEV_PHRASE}///hunter2`, {}, 'dilithium65').address;
+
+    expect(plain).not.toEqual(withPass);
+  });
+
+  // Deriving a child *from a pair* is not merely unimplemented here, it is
+  // impossible: ML-DSA keys are not derivable from one another, and the Quantus
+  // tree derives each account from the mnemonic independently.
+  it('refuses to derive from an existing pair', (): void => {
+    const pair = keyring.createFromUri(DEV_PHRASE, {}, 'dilithium65');
+
+    expect(() => pair.derive('//1')).toThrow(/derive from the mnemonic with createFromUri/);
+  });
+
+  it('leaves sr25519 junction derivation unchanged', (): void => {
+    const sr = new Keyring({ type: 'sr25519' });
+
+    expect(sr.createFromUri('//Alice').address).toEqual('5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY');
+    expect(sr.createFromUri('//Bob').address).toEqual('5FHneW46xGXgs5mUiveU4sbTyGBzmstUspZC92UhjJM694ty');
+  });
+});

packages/keyring/src/pair/dilithiumJson.spec.ts

@@ -0,0 +1,114 @@
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
+
+import { contextForSpec } from '@quantus/crypto';
+
+import { dilithiumVerify } from '@polkadot/util-crypto';
+
+import { Keyring } from '../keyring.js';
+
+// The address `quantus developer create-test-wallets` prints for crystal_alice.
+const ALICE_ADDRESS = 'qzk1Nxai3dZD9Cn5kwGcgL6mKxsfxwqdis7kDQJ52aJS2vSn7';
+const PASSWORD = 'not a good password';
+const MESSAGE = new Uint8Array([0x6a, 0x73, 0x6f, 0x6e]);
+
+describe('dilithium account JSON', (): void => {
+  const keyring = new Keyring({ ss58Format: 189, type: 'dilithium87' });
+  const context = contextForSpec(148);
+
+  const backup = (type: 'dilithium65' | 'dilithium87', fill = 0) => {
+    const pair = keyring.addFromSeed(new Uint8Array(32).fill(fill), { name: 'backed up' }, type);
+
+    return { json: pair.toJson(PASSWORD), original: pair };
+  };
+
+  // The whole point. Before this worked, an exported Quantus account could not be
+  // imported by anything — decodePair looked for its divider at one of two fixed
+  // offsets and an ML-DSA secret is at neither, so restore threw "Invalid
+  // encoding divider found in body". That is a data-durability bug, not a
+  // convenience one: it had to land before any build let a user create an account.
+  it('round-trips an ML-DSA-87 account', (): void => {
+    const { json, original } = backup('dilithium87');
+    const restored = keyring.createFromJson(json);
+
+    restored.decodePkcs8(PASSWORD);
+
+    expect(restored.address).toEqual(original.address);
+    expect(restored.publicKey).toEqual(original.publicKey);
+    expect(restored.isLocked).toEqual(false);
+  });
+
+  it('round-trips an ML-DSA-65 account', (): void => {
+    const { json, original } = backup('dilithium65', 5);
+    const restored = keyring.createFromJson(json);
+
+    restored.decodePkcs8(PASSWORD);
+
+    expect(restored.address).toEqual(original.address);
+    expect(restored.publicKey).toEqual(original.publicKey);
+  });
+
+  // A restored pair is locked, and callers read `pair.address` off it long before
+  // any password appears. For every other scheme that works because the address
+  // *is* the public key; here the key is still encrypted, so the account id has
+  // to be carried as data until decodePkcs8 supplies the real one.
+  it('reports the same address before and after unlock', (): void => {
+    const { json } = backup('dilithium87');
+    const restored = keyring.createFromJson(json);
+
+    expect(restored.isLocked).toEqual(true);
+    expect(restored.address).toEqual(ALICE_ADDRESS);
+
+    restored.decodePkcs8(PASSWORD);
+
+    expect(restored.address).toEqual(ALICE_ADDRESS);
+  });
+
+  it('restores a pair that can still sign', (): void => {
+    const { json, original } = backup('dilithium87');
+    const restored = keyring.createFromJson(json);
+
+    restored.decodePkcs8(PASSWORD);
+
+    const signature = restored.sign(MESSAGE, { context });
+
+    expect(dilithiumVerify(MESSAGE, signature, original.addressRaw, 'dilithium87', context)).toEqual(true);
+  });
+
+  it('fails cleanly on a wrong password', (): void => {
+    const { json } = backup('dilithium87');
+    const restored = keyring.createFromJson(json);
+
+    expect(() => restored.decodePkcs8('wrong')).toThrow();
+    // and must not have half-applied anything
+    expect(restored.isLocked).toEqual(true);
+    expect(restored.address).toEqual(ALICE_ADDRESS);
+  });
+
+  // For every other scheme a tampered `address` field cannot decode at all,
+  // because the address is the public key. Here it decodes perfectly and yields a
+  // pair reporting an address its key does not control — a user would see someone
+  // else's address in their own wallet and believe they held it.
+  it('rejects JSON whose address does not match its key', (): void => {
+    const { json } = backup('dilithium87');
+    const other = keyring.addFromSeed(new Uint8Array(32).fill(2), {}, 'dilithium87');
+    const tampered = { ...json, address: other.address };
+    const restored = keyring.createFromJson(tampered);
+
+    expect(restored.address).toEqual(other.address);
+    expect(() => restored.decodePkcs8(PASSWORD)).toThrow(/does not match the address/);
+  });
+
+  it('leaves sr25519 JSON round-tripping unchanged', (): void => {
+    const sr = new Keyring({ type: 'sr25519' });
+    const pair = sr.addFromUri('//Alice');
+    const restored = sr.createFromJson(pair.toJson(PASSWORD));
+
+    restored.decodePkcs8(PASSWORD);
+
+    expect(restored.address).toEqual(pair.address);
+    expect(restored.publicKey).toEqual(pair.publicKey);
+  });
+});

packages/keyring/src/pair/encode.spec.ts

@@ -1,13 +1,15 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
+
 import { NONCE_LENGTH, SCRYPT_LENGTH } from '@polkadot/util-crypto/json/constants';
 
-import { createTestPairs } from '../testingPairs';
-import { PKCS8_DIVIDER, PKCS8_HEADER, PUB_LENGTH, SEC_LENGTH } from './defaults';
+import { createTestPairs } from '../testingPairs.js';
+import { PAIR_DIV, PAIR_HDR, PUB_LENGTH, SEC_LENGTH } from './defaults.js';
 
-const PKCS8_LENGTH = PKCS8_DIVIDER.length + PKCS8_HEADER.length + PUB_LENGTH + SEC_LENGTH;
-const ENCODED_LENGTH = 16 + PKCS8_LENGTH + NONCE_LENGTH + SCRYPT_LENGTH;
+const DECODED_LENGTH = PAIR_DIV.length + PAIR_HDR.length + PUB_LENGTH + SEC_LENGTH;
+const ENCODED_LENGTH = 16 + DECODED_LENGTH + NONCE_LENGTH + SCRYPT_LENGTH;
 
 const keyring = createTestPairs({ type: 'ed25519' }, false);
 
@@ -15,7 +17,7 @@ describe('encode', (): void => {
   it('returns PKCS8 when no passphrase supplied', (): void => {
     expect(
       keyring.alice.encodePkcs8()
-    ).toHaveLength(PKCS8_LENGTH);
+    ).toHaveLength(DECODED_LENGTH);
   });
 
   it('returns encoded PKCS8 when passphrase supplied', (): void => {

packages/keyring/src/pair/encode.ts

@@ -1,27 +1,28 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type { PairInfo } from './types';
+import type { PairInfo } from './types.js';
 
-import { assert, u8aConcat } from '@polkadot/util';
+import { u8aConcat } from '@polkadot/util';
 import { naclEncrypt, scryptEncode, scryptToU8a } from '@polkadot/util-crypto';
 
-import { PKCS8_DIVIDER, PKCS8_HEADER } from './defaults';
+import { PAIR_DIV, PAIR_HDR } from './defaults.js';
 
+/**
+ * Encode a pair with the latest generation format (generation 3)
+ **/
 export function encodePair ({ publicKey, secretKey }: PairInfo, passphrase?: string): Uint8Array {
-  assert(secretKey, 'Expected a valid secretKey to be passed to encode');
+  if (!secretKey) {
+    throw new Error('Expected a valid secretKey to be passed to encode');
+  }
 
-  const encoded = u8aConcat(
-    PKCS8_HEADER,
-    secretKey,
-    PKCS8_DIVIDER,
-    publicKey
-  );
+  const encoded = u8aConcat(PAIR_HDR, secretKey, PAIR_DIV, publicKey);
 
   if (!passphrase) {
     return encoded;
   }
 
+  // this is only for generation 3 (previous generations are only handled in decoding)
   const { params, password, salt } = scryptEncode(passphrase);
   const { encrypted, nonce } = naclEncrypt(encoded, password.subarray(0, 32));
 

packages/keyring/src/pair/index.spec.ts

@@ -1,27 +1,23 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
+
 import { hexToU8a, u8aToHex } from '@polkadot/util';
 import { cryptoWaitReady, encodeAddress as toSS58, setSS58Format } from '@polkadot/util-crypto';
 
-import { PAIRSSR25519 } from '../testing';
-import { createTestPairs } from '../testingPairs';
-import { createPair } from '.';
+import { PAIRSSR25519 } from '../testing.js';
+import { createTestPairs } from '../testingPairs.js';
+import { createPair } from './index.js';
 
 const keyring = createTestPairs({ type: 'ed25519' }, false);
 
 const TEST_ADDRESS = '0x4119b2e6c3Cb618F4f0B93ac77f9BeeC7FF02887';
 
+await cryptoWaitReady();
+
 describe('pair', (): void => {
-  beforeEach(async (): Promise<void> => {
-    await cryptoWaitReady();
-  });
-
   const SIGNATURE = new Uint8Array([80, 191, 198, 147, 225, 207, 75, 88, 126, 39, 129, 109, 191, 38, 72, 181, 75, 254, 81, 143, 244, 79, 237, 38, 236, 141, 28, 252, 134, 26, 169, 234, 79, 33, 153, 158, 151, 34, 175, 188, 235, 20, 35, 135, 83, 120, 139, 211, 233, 130, 1, 208, 201, 215, 73, 80, 56, 98, 185, 196, 11, 8, 193, 14]);
-  const ENCRYPTED = new Uint8Array([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 132, 59, 53, 85, 227, 40, 107, 48, 234, 198, 238, 157, 238, 224, 235, 179, 75, 153, 241, 142, 254]);
-
-  // the last byte is changed from 254 -> 253
-  const ENCRYPTED_CHANGED = new Uint8Array([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 132, 59, 53, 85, 227, 40, 107, 48, 234, 198, 238, 157, 238, 224, 235, 179, 75, 153, 241, 142, 253]);
 
   it('has a publicKey', (): void => {
     expect(
@@ -98,93 +94,6 @@ describe('pair', (): void => {
     ).toBe(false);
   });
 
-  it('allows encrypting', (): void => {
-    const message = new Uint8Array([0x61, 0x62, 0x63, 0x64, 0x65]);
-
-    expect(
-      keyring.alice.encryptMessage(
-        message,
-        keyring.bob.publicKey,
-        new Uint8Array(24)
-      )
-    ).toEqual(ENCRYPTED);
-  });
-
-  it('validates a correctly encrypted message', (): void => {
-    const message = new Uint8Array([0x61, 0x62, 0x63, 0x64, 0x65]);
-
-    expect(
-      keyring.bob.decryptMessage(
-        ENCRYPTED,
-        keyring.alice.publicKey
-      )
-    ).toEqual(message);
-  });
-
-  it('fails a correctly encrypted message (message changed)', (): void => {
-    expect(
-      keyring.bob.decryptMessage(
-        ENCRYPTED_CHANGED,
-        keyring.alice.publicKey
-      )
-    ).toEqual(null);
-  });
-
-  it('fails a correctly encrypted message (sender changed)', (): void => {
-    expect(
-      keyring.bob.decryptMessage(
-        ENCRYPTED,
-        keyring.charlie.publicKey
-      )
-    ).toEqual(null);
-  });
-
-  it('fails a correctly encrypted message (receiver changed)', (): void => {
-    expect(
-      keyring.charlie.decryptMessage(
-        ENCRYPTED,
-        keyring.alice.publicKey
-      )
-    ).toEqual(null);
-  });
-
-  it('validates encryption between ed25519 & sr25519 key pairs', (): void => {
-    const PASS = 'testing';
-    const encodedA = keyring.alice.encodePkcs8(PASS);
-    const encodedB = keyring.bob.encodePkcs8(PASS);
-
-    const pairA = createPair({ toSS58, type: 'sr25519' }, { publicKey: keyring.alice.publicKey });
-    const pairB = createPair({ toSS58, type: 'sr25519' }, { publicKey: keyring.bob.publicKey });
-
-    pairA.decodePkcs8(PASS, encodedA);
-    pairB.decodePkcs8(PASS, encodedB);
-    const message = new Uint8Array([0x61, 0x62, 0x63, 0x64, 0x65]);
-
-    // alice-sr25519 -> bob-ed25519
-    const encrypted1 = pairA.encryptMessage(message, keyring.bob.publicKey);
-
-    // alice-sr25519 -> bob-sr25519
-    const encrypted2 = pairA.encryptMessage(message, pairB.publicKey);
-
-    // alice-ed25519 -> bob-sr25519
-    const encrypted3 = keyring.alice.encryptMessage(message, pairB.publicKey);
-
-    // decrypt: Bob-ed25519 - use alice-ed25519 pubkey
-    expect(
-      keyring.bob.decryptMessage(encrypted3, keyring.alice.publicKey)
-    ).toEqual(message);
-
-    // decrypt: Bob-ed25519 - use alice-sr25519 pubkey
-    expect(
-      keyring.bob.decryptMessage(encrypted1, pairA.publicKey)
-    ).toEqual(message);
-
-    // decrypt: Bob-sr25519 - use alice-sr25519 pubkey
-    expect(
-      pairB.decryptMessage(encrypted2, pairA.publicKey)
-    ).toEqual(message);
-  });
-
   it('allows setting/getting of meta', (): void => {
     keyring.bob.setMeta({ foo: 'bar', something: 'else' });
 
@@ -198,10 +107,12 @@ describe('pair', (): void => {
   it('allows encoding of address with different prefixes', (): void => {
     expect(keyring.alice.address).toEqual('5GoKvZWG5ZPYL1WUovuHW3zJBWBP5eT8CbqjdRY4Q6iMaQua');
 
+    // eslint-disable-next-line deprecation/deprecation
     setSS58Format(255);
 
     expect(keyring.alice.address).toEqual('yGHU8YKprxHbHdEv7oUK4rzMZXtsdhcXVG2CAMyC9WhzhjH2k');
 
+    // eslint-disable-next-line deprecation/deprecation
     setSS58Format(42);
   });
 
@@ -217,11 +128,11 @@ describe('pair', (): void => {
   });
 
   it('allows derivation on the pair', (): void => {
-    const alice = createPair({ toSS58, type: 'sr25519' }, { publicKey: PAIRSSR25519[0].publicKey, secretKey: PAIRSSR25519[0].secretKey }, {});
+    const alice = createPair({ toSS58, type: 'sr25519' }, { publicKey: hexToU8a(PAIRSSR25519[0].p), secretKey: hexToU8a(PAIRSSR25519[0].s) }, {});
     const stash = alice.derive('//stash');
     const soft = alice.derive('//funding/0');
 
-    expect(stash.publicKey).toEqual(PAIRSSR25519[1].publicKey);
+    expect(stash.publicKey).toEqual(hexToU8a(PAIRSSR25519[1].p));
     expect(soft.address).toEqual('5ECQNn7UueWHPFda5qUi4fTmTtyCnPvGnuoyVVSj5CboJh9J');
   });
 
@@ -274,22 +185,5 @@ describe('pair', (): void => {
       });
       expect(json.address).toEqual(u8aToHex(PUBLICDERIVED));
     });
-
-    it('denies access to encryptMessage/decryptMessage API', (): void => {
-      const PASS = 'testing';
-      const encoded = keyring.alice.encodePkcs8(PASS);
-
-      const pair = createPair({ toSS58, type: 'ethereum' }, { publicKey: keyring.alice.publicKey });
-
-      pair.decodePkcs8(PASS, encoded);
-
-      expect(
-        () => pair.encryptMessage(
-          new Uint8Array(4), // null message
-          keyring.bob.publicKey,
-          new Uint8Array(24)
-        )
-      ).toThrow('Secp256k1 not supported yet');
-    });
   });
 });

packages/keyring/src/pair/index.ts

@@ -1,17 +1,16 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type { HexString } from '@polkadot/util/types';
 import type { EncryptedJsonEncoding, Keypair, KeypairType } from '@polkadot/util-crypto/types';
-import type { KeyringPair, KeyringPair$Json, KeyringPair$Meta, SignOptions } from '../types';
-import type { PairInfo } from './types';
+import type { KeyringPair, KeyringPair$Json, KeyringPair$Meta, SignOptions } from '../types.js';
+import type { PairInfo } from './types.js';
 
-import { assert, objectSpread, u8aConcat, u8aEmpty, u8aEq, u8aToHex, u8aToU8a } from '@polkadot/util';
-import { blake2AsU8a, convertPublicKeyToCurve25519, convertSecretKeyToCurve25519, ed25519PairFromSeed as ed25519FromSeed, ed25519Sign, ethereumEncode, keccakAsU8a, keyExtractPath, keyFromPath, naclOpen, naclSeal, secp256k1Compress, secp256k1Expand, secp256k1PairFromSeed as secp256k1FromSeed, secp256k1Sign, signatureVerify, sr25519PairFromSeed as sr25519FromSeed, sr25519Sign, sr25519VrfSign, sr25519VrfVerify } from '@polkadot/util-crypto';
+import { objectSpread, u8aConcat, u8aEmpty, u8aEq, u8aToHex, u8aToU8a } from '@polkadot/util';
+import { blake2AsU8a, dilithiumAccountFromPublic, dilithiumPairFromSeed, dilithiumSign, dilithiumSizes, ed25519PairFromSeed as ed25519FromSeed, ed25519Sign, ethereumEncode, isDilithium, keccakAsU8a, keyExtractPath, keyFromPath, secp256k1Compress, secp256k1Expand, secp256k1PairFromSeed as secp256k1FromSeed, secp256k1Sign, signatureVerify, sr25519PairFromSeed as sr25519FromSeed, sr25519Sign, sr25519VrfSign, sr25519VrfVerify } from '@polkadot/util-crypto';
 
-import { decodePair } from './decode';
-import { encodePair } from './encode';
-import { pairToJson } from './toJson';
+import { decodePair } from './decode.js';
+import { encodePair } from './encode.js';
+import { pairToJson } from './toJson.js';
 
 interface Setup {
   toSS58: (publicKey: Uint8Array) => string;
@@ -21,27 +20,70 @@ interface Setup {
 const SIG_TYPE_NONE = new Uint8Array();
 
 const TYPE_FROM_SEED = {
+  dilithium65: (seed: Uint8Array) => dilithiumPairFromSeed(seed, 'dilithium65'),
+  dilithium87: (seed: Uint8Array) => dilithiumPairFromSeed(seed, 'dilithium87'),
   ecdsa: secp256k1FromSeed,
   ed25519: ed25519FromSeed,
   ethereum: secp256k1FromSeed,
   sr25519: sr25519FromSeed
 };
 
+// For the curve types these index Substrate's `MultiSignature`. For the ML-DSA
+// types they index the Quantus runtime's `DilithiumSignatureScheme`, where
+// `Dilithium87` is variant 0 and `Dilithium65` is variant 1 — a different enum
+// that happens to be reached by the same `withType` mechanism, so no special
+// casing is needed anywhere upstream of here.
 const TYPE_PREFIX = {
+  dilithium65: new Uint8Array([1]),
+  dilithium87: new Uint8Array([0]),
   ecdsa: new Uint8Array([2]),
   ed25519: new Uint8Array([0]),
   ethereum: new Uint8Array([2]),
   sr25519: new Uint8Array([1])
 };
 
-const TYPE_SIGNATURE = {
-  ecdsa: (m: Uint8Array, p: Partial<Keypair>) => secp256k1Sign(m, p, 'blake2'),
-  ed25519: ed25519Sign,
-  ethereum: (m: Uint8Array, p: Partial<Keypair>) => secp256k1Sign(m, p, 'keccak'),
-  sr25519: sr25519Sign
+// The ML-DSA arms take a context; the curve arms ignore the extra argument. The
+// signature is written out because TypeScript would otherwise infer the narrowest
+// common shape — the two-argument curve arms — and reject passing a context at all.
+type SignFn = (message: Uint8Array, pair: Partial<Keypair>, context?: Uint8Array) => Uint8Array;
+
+const TYPE_SIGNATURE: Record<KeypairType, SignFn> = {
+  dilithium65: (m, p, ctx) => dilithiumSign(m, p, 'dilithium65', requireContext(ctx)),
+  dilithium87: (m, p, ctx) => dilithiumSign(m, p, 'dilithium87', requireContext(ctx)),
+  ecdsa: (m, p) => secp256k1Sign(m, p, 'blake2'),
+  // Wrapped rather than passed directly: ed25519Sign and sr25519Sign take a
+  // third argument of their own (`onlyJs`), and letting it line up with the
+  // context slot would silently reinterpret a Uint8Array as a boolean.
+  ed25519: (m, p) => ed25519Sign(m, p),
+  ethereum: (m, p) => secp256k1Sign(m, p, 'keccak'),
+  sr25519: (m, p) => sr25519Sign(m, p)
 };
 
+/**
+ * A post-quantum pair will not sign without being told which context to use.
+ *
+ * See `SignOptions.context`. The alternative — defaulting to the extrinsic
+ * context — produces a valid signature that a spec-147 chain rejects, with
+ * nothing local able to explain why.
+ */
+function requireContext (context?: Uint8Array): Uint8Array {
+  if (!context) {
+    throw new Error('A signing context is required for post-quantum keypairs; pass options.context (see contextForSpec)');
+  }
+
+  return context;
+}
+
+// Every curve arm here is identity or a cheap re-encoding, because on Substrate
+// the address *is* the public key. The ML-DSA arms are the exception that the
+// rest of this file has to be read in light of: 1952 or 2592 bytes in, 32 out,
+// and no way back. `ecdsa` already hints at the shape — it hashes when given an
+// uncompressed key — but it stays reversible in the sense that matters, since
+// the signature carries a recoverable key. ML-DSA does not, which is why its
+// signatures carry the public key explicitly.
 const TYPE_ADDRESS = {
+  dilithium65: dilithiumAccountFromPublic,
+  dilithium87: dilithiumAccountFromPublic,
   ecdsa: (p: Uint8Array) => p.length > 32 ? blake2AsU8a(p) : p,
   ed25519: (p: Uint8Array) => p,
   ethereum: (p: Uint8Array) => p.length === 20 ? p : keccakAsU8a(secp256k1Expand(p)),
@@ -87,11 +129,21 @@ function vrfHash (proof: Uint8Array, context?: string | Uint8Array, extra?: stri
  * an `encoded` property that is assigned with the encoded public key in hex format, and an `encoding`
  * property that indicates whether the public key value of the `encoded` property is encoded or not.
  */
-export function createPair ({ toSS58, type }: Setup, { publicKey, secretKey }: PairInfo, meta: KeyringPair$Meta = {}, encoded: Uint8Array | null = null, encTypes?: EncryptedJsonEncoding[]): KeyringPair {
+export function createPair ({ toSS58, type }: Setup, { accountId, publicKey, secretKey }: PairInfo, meta: KeyringPair$Meta = {}, encoded: Uint8Array | null = null, encTypes?: EncryptedJsonEncoding[]): KeyringPair {
   const decodePkcs8 = (passphrase?: string, userEncoded?: Uint8Array | null): void => {
-    const decoded = decodePair(passphrase, userEncoded || encoded, encTypes);
+    // ML-DSA secrets are 4032/4896 bytes, which is neither of the two lengths
+    // decodePair would otherwise try. It has to be told.
+    const decoded = decodePair(passphrase, userEncoded || encoded, encTypes, isDilithium(type)
+      ? dilithiumSizes(type).secretKey
+      : undefined
+    );
 
-    if (decoded.secretKey.length === 64) {
+    // Upstream decides "is this a secret key or a seed?" by length, because for
+    // the curve schemes a 64-byte blob is a secret and a 32-byte one is a seed.
+    // An ML-DSA secret is neither, and would take the seed branch and be fed to
+    // keygen as entropy — producing a valid, wrong key in silence. The type
+    // knows the answer, so ask it.
+    if (isDilithium(type) || decoded.secretKey.length === 64) {
       publicKey = decoded.publicKey;
       secretKey = decoded.secretKey;
     } else {
@@ -100,6 +152,25 @@ export function createPair ({ toSS58, type }: Setup, { publicKey, secretKey }: P
       publicKey = pair.publicKey;
       secretKey = pair.secretKey;
     }
+
+    // The public key has only now arrived. If the pair was constructed from JSON
+    // it has been reporting an address carried as data since then, so check the
+    // two agree.
+    //
+    // This is not a paranoid check. For every other scheme the address *is* the
+    // public key, so a JSON file whose `address` field has been edited cannot
+    // decode at all. Here it decodes perfectly and yields a pair that reports an
+    // address its key does not control — a user would see the attacker's address
+    // in their own wallet and believe they held it.
+    if (accountId) {
+      const derived = TYPE_ADDRESS[type](publicKey);
+
+      if (!u8aEq(derived, accountId)) {
+        throw new Error('Decoded public key does not match the address in the account JSON');
+      }
+
+      accountId = undefined;
+    }
   };
 
   const recode = (passphrase?: string): Uint8Array => {
@@ -111,8 +182,15 @@ export function createPair ({ toSS58, type }: Setup, { publicKey, secretKey }: P
     return encoded;
   };
 
+  // While an ML-DSA pair restored from JSON is locked, its public key is still
+  // inside the encrypted blob and the account id cannot be computed — so use the
+  // one carried alongside. `decodePkcs8` clears it once the real key arrives and
+  // has been checked against it.
+  const addressRawOf = (): Uint8Array =>
+    accountId ?? TYPE_ADDRESS[type](publicKey);
+
   const encodeAddress = (): string => {
-    const raw = TYPE_ADDRESS[type](publicKey);
+    const raw = addressRawOf();
 
     return type === 'ethereum'
       ? ethereumEncode(raw)
@@ -124,7 +202,7 @@ export function createPair ({ toSS58, type }: Setup, { publicKey, secretKey }: P
       return encodeAddress();
     },
     get addressRaw (): Uint8Array {
-      const raw = TYPE_ADDRESS[type](publicKey);
+      const raw = addressRawOf();
 
       return type === 'ethereum'
         ? raw.slice(-20)
@@ -144,22 +222,19 @@ export function createPair ({ toSS58, type }: Setup, { publicKey, secretKey }: P
     },
     // eslint-disable-next-line sort-keys
     decodePkcs8,
-    decryptMessage: (encryptedMessageWithNonce: HexString | string | Uint8Array, senderPublicKey: HexString | string | Uint8Array): Uint8Array | null => {
-      assert(!isLocked(secretKey), 'Cannot encrypt with a locked key pair');
-      assert(!['ecdsa', 'ethereum'].includes(type), 'Secp256k1 not supported yet');
-
-      const messageU8a = u8aToU8a(encryptedMessageWithNonce);
-
-      return naclOpen(
-        messageU8a.slice(24, messageU8a.length),
-        messageU8a.slice(0, 24),
-        convertPublicKeyToCurve25519(u8aToU8a(senderPublicKey)),
-        convertSecretKeyToCurve25519(secretKey)
-      );
-    },
     derive: (suri: string, meta?: KeyringPair$Meta): KeyringPair => {
-      assert(type !== 'ethereum', 'Unable to derive on this keypair');
-      assert(!isLocked(secretKey), 'Cannot derive on a locked keypair');
+      if (type === 'ethereum') {
+        throw new Error('Unable to derive on this keypair');
+      } else if (isDilithium(type)) {
+        // Not "not implemented" — not possible. A child here would have to come
+        // from this pair's key material, and ML-DSA keys are not derivable from
+        // one another at all; the Quantus tree derives every account from the
+        // mnemonic independently. So the caller needs the mnemonic, not this
+        // pair, and saying that is more use than a generic refusal.
+        throw new Error(`Unable to derive from an existing ${type} pair; derive from the mnemonic with createFromUri instead`);
+      } else if (isLocked(secretKey)) {
+        throw new Error('Cannot derive on a locked keypair');
+      }
 
       const { path } = keyExtractPath(suri);
       const derived = keyFromPath({ publicKey, secretKey }, path, type);
@@ -169,28 +244,22 @@ export function createPair ({ toSS58, type }: Setup, { publicKey, secretKey }: P
     encodePkcs8: (passphrase?: string): Uint8Array => {
       return recode(passphrase);
     },
-    encryptMessage: (message: HexString | string | Uint8Array, recipientPublicKey: HexString | string | Uint8Array, nonceIn?: Uint8Array): Uint8Array => {
-      assert(!isLocked(secretKey), 'Cannot encrypt with a locked key pair');
-      assert(!['ecdsa', 'ethereum'].includes(type), 'Secp256k1 not supported yet');
-
-      const { nonce, sealed } = naclSeal(u8aToU8a(message), convertSecretKeyToCurve25519(secretKey), convertPublicKeyToCurve25519(u8aToU8a(recipientPublicKey)), nonceIn);
-
-      return u8aConcat(nonce, sealed);
-    },
     lock: (): void => {
       secretKey = new Uint8Array();
     },
     setMeta: (additional: KeyringPair$Meta): void => {
       meta = objectSpread({}, meta, additional);
     },
-    sign: (message: HexString | string | Uint8Array, options: SignOptions = {}): Uint8Array => {
-      assert(!isLocked(secretKey), 'Cannot sign with a locked key pair');
+    sign: (message: string | Uint8Array, options: SignOptions = {}): Uint8Array => {
+      if (isLocked(secretKey)) {
+        throw new Error('Cannot sign with a locked key pair');
+      }
 
       return u8aConcat(
         options.withType
           ? TYPE_PREFIX[type]
           : SIG_TYPE_NONE,
-        TYPE_SIGNATURE[type](u8aToU8a(message), { publicKey, secretKey })
+        TYPE_SIGNATURE[type](u8aToU8a(message), { publicKey, secretKey }, options.context)
       );
     },
     toJson: (passphrase?: string): KeyringPair$Json => {
@@ -208,21 +277,32 @@ export function createPair ({ toSS58, type }: Setup, { publicKey, secretKey }: P
     unlock: (passphrase?: string): void => {
       return decodePkcs8(passphrase);
     },
-    verify: (message: HexString | string | Uint8Array, signature: HexString | string | Uint8Array, signerPublic: HexString | string | Uint8Array): boolean => {
+    verify: (message: string | Uint8Array, signature: string | Uint8Array, signerPublic: string | Uint8Array): boolean => {
       return signatureVerify(message, signature, TYPE_ADDRESS[type](u8aToU8a(signerPublic))).isValid;
     },
-    vrfSign: (message: HexString | string | Uint8Array, context?: HexString | string | Uint8Array, extra?: string | Uint8Array): Uint8Array => {
-      assert(!isLocked(secretKey), 'Cannot sign with a locked key pair');
+    vrfSign: (message: string | Uint8Array, context?: string | Uint8Array, extra?: string | Uint8Array): Uint8Array => {
+      if (isLocked(secretKey)) {
+        throw new Error('Cannot sign with a locked key pair');
+      }
 
       if (type === 'sr25519') {
         return sr25519VrfSign(message, { secretKey }, context, extra);
       }
 
+      // There is no ML-DSA VRF. The construction below fakes one out of an
+      // ordinary signature, which is sound only because the underlying schemes
+      // are deterministic and unique — properties ML-DSA's signature does not
+      // have in the form this needs. Refuse rather than produce something that
+      // looks like a VRF output and is not verifiable as one.
+      if (isDilithium(type)) {
+        throw new Error(`VRF signing is not available for ${type}`);
+      }
+
       const proof = TYPE_SIGNATURE[type](u8aToU8a(message), { publicKey, secretKey });
 
       return u8aConcat(vrfHash(proof, context, extra), proof);
     },
-    vrfVerify: (message: HexString | string | Uint8Array, vrfResult: Uint8Array, signerPublic: HexString | Uint8Array | string, context?: HexString | string | Uint8Array, extra?: HexString | string | Uint8Array): boolean => {
+    vrfVerify: (message: string | Uint8Array, vrfResult: Uint8Array, signerPublic: Uint8Array | string, context?: string | Uint8Array, extra?: string | Uint8Array): boolean => {
       if (type === 'sr25519') {
         return sr25519VrfVerify(message, vrfResult, publicKey, context, extra);
       }

packages/keyring/src/pair/nobody.ts

@@ -1,12 +1,13 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type { KeyringPair, KeyringPair$Json, KeyringPair$Meta } from '../types';
-
-import { encodeAddress } from '@polkadot/util-crypto';
+import type { KeyringPair, KeyringPair$Json, KeyringPair$Meta } from '../types.js';
 
+// empty publicKey
 const publicKey = new Uint8Array(32);
-const address = encodeAddress(publicKey);
+
+// pre-computed via encodeAddress(publicKey)
+const address = '5C4hrfjw9DjXZTzV3MwzrrAr9P1MJhSrvWGWqi1eSuyUpnhM';
 
 const meta = {
   isTesting: true,
@@ -27,48 +28,32 @@ const json: KeyringPair$Json = {
 const pair: KeyringPair = {
   address,
   addressRaw: publicKey,
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  decodePkcs8: (passphrase?: string, encoded?: Uint8Array): void =>
+  decodePkcs8: (_passphrase?: string, _encoded?: Uint8Array): void =>
     undefined,
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  decryptMessage: (encryptedMessageWithNonce: string | Uint8Array, senderPublicKey: string | Uint8Array): Uint8Array | null =>
-    null,
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  derive: (suri: string, meta?: KeyringPair$Meta): KeyringPair =>
+  derive: (_suri: string, _meta?: KeyringPair$Meta): KeyringPair =>
     pair,
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  encodePkcs8: (passphrase?: string): Uint8Array =>
+  encodePkcs8: (_passphrase?: string): Uint8Array =>
     new Uint8Array(0),
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  encryptMessage: (message: string | Uint8Array, recipientPublicKey: string | Uint8Array, _nonce?: Uint8Array): Uint8Array =>
-    new Uint8Array(),
   isLocked: true,
   lock: (): void => {
     // no locking, it is always locked
   },
   meta,
   publicKey,
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  setMeta: (meta: KeyringPair$Meta): void =>
+  setMeta: (_meta: KeyringPair$Meta): void =>
     undefined,
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  sign: (message: Uint8Array): Uint8Array =>
+  sign: (_message: Uint8Array): Uint8Array =>
     new Uint8Array(64),
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  toJson: (passphrase?: string): KeyringPair$Json =>
+  toJson: (_passphrase?: string): KeyringPair$Json =>
     json,
   type: 'ed25519',
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  unlock: (passphrase?: string): void =>
+  unlock: (_passphrase?: string): void =>
     undefined,
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  verify: (message: Uint8Array, signature: Uint8Array): boolean =>
+  verify: (_message: Uint8Array, _signature: Uint8Array): boolean =>
     false,
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  vrfSign: (message: Uint8Array, context?: string | Uint8Array, extra?: string | Uint8Array): Uint8Array =>
+  vrfSign: (_message: Uint8Array, _context?: string | Uint8Array, _extra?: string | Uint8Array): Uint8Array =>
     new Uint8Array(96),
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  vrfVerify: (message: Uint8Array, vrfResult: Uint8Array, context?: string | Uint8Array, extra?: string | Uint8Array): boolean =>
+  vrfVerify: (_message: Uint8Array, _vrfResult: Uint8Array, _context?: string | Uint8Array, _extra?: string | Uint8Array): boolean =>
     false
 };
 

packages/keyring/src/pair/toJson.spec.ts

@@ -1,7 +1,9 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import { createTestPairs } from '../testingPairs';
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
+
+import { createTestPairs } from '../testingPairs.js';
 
 const keyring = createTestPairs({ type: 'ed25519' }, false);
 

packages/keyring/src/pair/toJson.ts

@@ -1,8 +1,8 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { KeypairType } from '@polkadot/util-crypto/types';
-import type { KeyringPair$Json, KeyringPair$Meta } from '../types';
+import type { KeyringPair$Json, KeyringPair$Meta } from '../types.js';
 
 import { objectSpread } from '@polkadot/util';
 import { jsonEncryptFormat } from '@polkadot/util-crypto';

packages/keyring/src/pair/types.ts

@@ -1,8 +1,23 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 export interface PairInfo {
+  /**
+   * The 32-byte account id, when it cannot be derived from `publicKey`.
+   *
+   * Only ML-DSA pairs need this, and only while locked. Everywhere else the
+   * address is a cheap function of the public key, so a pair restored from JSON
+   * can report its address before anyone supplies a password. A Quantus account
+   * id is a one-way Poseidon2 hash, and the public key lives inside the
+   * encrypted blob — so between `createFromJson` and `decodePkcs8` there is
+   * nothing to compute it from, and callers read `pair.address` in exactly that
+   * window.
+   *
+   * Carried as data rather than derived, and checked against the real public key
+   * once that arrives.
+   */
+  accountId?: Uint8Array | undefined;
   publicKey: Uint8Array;
-  secretKey?: Uint8Array;
+  secretKey?: Uint8Array | undefined;
   seed?: Uint8Array | null;
 }

packages/keyring/src/pair/vrf.spec.ts

@@ -1,29 +1,23 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type { KeyringPair } from '../types';
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
 
 import { u8aToHex } from '@polkadot/util';
 import { cryptoWaitReady, ed25519PairFromSeed, encodeAddress as toSS58, randomAsU8a, secp256k1PairFromSeed, sr25519PairFromSeed } from '@polkadot/util-crypto';
 
-import { createPair } from '.';
+import { createPair } from './index.js';
 
 const MESSAGE = 'this is a test message';
 const CONTEXT = 'some context';
 
+await cryptoWaitReady();
+
+const ecdsa = createPair({ toSS58, type: 'ecdsa' }, secp256k1PairFromSeed(randomAsU8a()));
+const ed25519 = createPair({ toSS58, type: 'ed25519' }, ed25519PairFromSeed(randomAsU8a()));
+const sr25519 = createPair({ toSS58, type: 'sr25519' }, sr25519PairFromSeed(randomAsU8a()));
+
 describe('vrf', (): void => {
-  let ecdsa: KeyringPair;
-  let ed25519: KeyringPair;
-  let sr25519: KeyringPair;
-
-  beforeAll(async (): Promise<void> => {
-    await cryptoWaitReady();
-
-    ecdsa = createPair({ toSS58, type: 'ecdsa' }, secp256k1PairFromSeed(randomAsU8a()));
-    ed25519 = createPair({ toSS58, type: 'ed25519' }, ed25519PairFromSeed(randomAsU8a()));
-    sr25519 = createPair({ toSS58, type: 'sr25519' }, sr25519PairFromSeed(randomAsU8a()));
-  });
-
   it('has deterministic signature values for ecdsa', (): void => {
     const sig1 = ecdsa.vrfSign(MESSAGE, CONTEXT);
     const sig2 = ecdsa.vrfSign(MESSAGE, CONTEXT);

packages/keyring/src/pairs.ts

@@ -1,10 +1,9 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type { HexString } from '@polkadot/util/types';
-import type { KeyringPair, KeyringPairs } from './types';
+import type { KeyringPair, KeyringPairs } from './types.js';
 
-import { assert, isHex, isU8a, u8aToHex, u8aToU8a } from '@polkadot/util';
+import { isHex, isU8a, u8aToHex, u8aToU8a } from '@polkadot/util';
 import { decodeAddress } from '@polkadot/util-crypto';
 
 type KeyringPairMap = Record<string, KeyringPair>;
@@ -22,19 +21,21 @@ export class Pairs implements KeyringPairs {
     return Object.values(this.#map);
   }
 
-  public get (address: HexString | string | Uint8Array): KeyringPair {
+  public get (address: string | Uint8Array): KeyringPair {
     const pair = this.#map[decodeAddress(address).toString()];
 
-    assert(pair, () => `Unable to retrieve keypair '${
-      isU8a(address) || isHex(address)
-        ? u8aToHex(u8aToU8a(address))
-        : address
-    }'`);
+    if (!pair) {
+      throw new Error(`Unable to retrieve keypair '${
+        isU8a(address) || isHex(address)
+          ? u8aToHex(u8aToU8a(address))
+          : address
+      }'`);
+    }
 
     return pair;
   }
 
-  public remove (address: HexString | string | Uint8Array): void {
+  public remove (address: string | Uint8Array): void {
     delete this.#map[decodeAddress(address).toString()];
   }
 }

packages/keyring/src/suri.spec.ts

@@ -1,6 +1,8 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
+
 // From https://github.com/paritytech/substrate/wiki/Secret-URI-Test-Vectors
 
 import type { KeypairType } from '@polkadot/util-crypto/types';
@@ -8,7 +10,7 @@ import type { KeypairType } from '@polkadot/util-crypto/types';
 import { u8aToHex } from '@polkadot/util';
 import { cryptoWaitReady } from '@polkadot/util-crypto';
 
-import Keyring from '.';
+import Keyring from './index.js';
 
 const PHRASE = 'bottom drive obey lake curtain smoke basket hold race lonely fit walk';
 const ETHEREUM_PHRASE = 'seed sock milk update focus rotate barely fade car face mechanic mercy';
@@ -87,15 +89,13 @@ const TESTS = {
   ]
 };
 
+await cryptoWaitReady();
+
 describe('keyring.addFromUri', (): void => {
-  Object.entries(TESTS).forEach(([type, tests]): void => {
+  for (const [type, tests] of Object.entries(TESTS)) {
     const keyring = new Keyring({ type: type as KeypairType });
 
-    beforeEach(async (): Promise<void> => {
-      await cryptoWaitReady();
-    });
-
-    describe(type, (): void => {
+    describe(`${type}`, (): void => {
       tests.forEach(({ pk, ss, uri }): void => {
         it(`creates ${uri}`, (): void => {
           const pair = keyring.addFromUri(uri, {}, type as KeypairType);
@@ -105,5 +105,5 @@ describe('keyring.addFromUri', (): void => {
         });
       });
     });
-  });
+  }
 });

packages/keyring/src/testing.ts

@@ -1,19 +1,20 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type { KeyringInstance, KeyringOptions } from './types';
+import type { HexString } from '@polkadot/util/types';
+import type { KeypairType } from '@polkadot/util-crypto/types';
+import type { KeyringInstance, KeyringOptions } from './types.js';
 
-import { assert, hexToU8a } from '@polkadot/util';
-import { KeypairType } from '@polkadot/util-crypto/types';
+import { hexToU8a } from '@polkadot/util';
 
-import { Keyring } from './keyring';
-import { createPair } from './pair';
+import { createPair } from './pair/index.js';
+import { Keyring } from './keyring.js';
 
 interface PairDef {
   name?: string;
-  publicKey: Uint8Array;
+  p: HexString;
+  s: HexString;
   seed?: string;
-  secretKey?: Uint8Array;
   type: KeypairType
 }
 
@@ -23,50 +24,50 @@ interface PairDef {
 // adding the keys when only the keyring is used.
 export const PAIRSSR25519: PairDef[] = [
   {
-    publicKey: hexToU8a('0xd43593c715fdd31c61141abd04a99fd6822c8558854ccde39a5684e7a56da27d'),
-    secretKey: hexToU8a('0x98319d4ff8a9508c4bb0cf0b5a78d760a0b2082c02775e6e82370816fedfff48925a225d97aa00682d6a59b95b18780c10d7032336e88f3442b42361f4a66011'), // nosemgrep
+    p: '0xd43593c715fdd31c61141abd04a99fd6822c8558854ccde39a5684e7a56da27d',
+    s: '0x98319d4ff8a9508c4bb0cf0b5a78d760a0b2082c02775e6e82370816fedfff48925a225d97aa00682d6a59b95b18780c10d7032336e88f3442b42361f4a66011', // nosemgrep
     seed: 'Alice',
     type: 'sr25519'
   },
   {
-    publicKey: hexToU8a('0xbe5ddb1579b72e84524fc29e78609e3caf42e85aa118ebfe0b0ad404b5bdd25f'),
-    secretKey: hexToU8a('0xe8da6c9d810e020f5e3c7f5af2dea314cbeaa0d72bc6421e92c0808a0c584a6046ab28e97c3ffc77fe12b5a4d37e8cd4afbfebbf2391ffc7cb07c0f38c023efd'), // nosemgrep
+    p: '0xbe5ddb1579b72e84524fc29e78609e3caf42e85aa118ebfe0b0ad404b5bdd25f',
+    s: '0xe8da6c9d810e020f5e3c7f5af2dea314cbeaa0d72bc6421e92c0808a0c584a6046ab28e97c3ffc77fe12b5a4d37e8cd4afbfebbf2391ffc7cb07c0f38c023efd', // nosemgrep
     seed: 'Alice//stash',
     type: 'sr25519'
   },
   {
-    publicKey: hexToU8a('0x8eaf04151687736326c9fea17e25fc5287613693c912909cb226aa4794f26a48'),
-    secretKey: hexToU8a('0x081ff694633e255136bdb456c20a5fc8fed21f8b964c11bb17ff534ce80ebd5941ae88f85d0c1bfc37be41c904e1dfc01de8c8067b0d6d5df25dd1ac0894a325'), // nosemgrep
+    p: '0x8eaf04151687736326c9fea17e25fc5287613693c912909cb226aa4794f26a48',
+    s: '0x081ff694633e255136bdb456c20a5fc8fed21f8b964c11bb17ff534ce80ebd5941ae88f85d0c1bfc37be41c904e1dfc01de8c8067b0d6d5df25dd1ac0894a325', // nosemgrep
     seed: 'Bob',
     type: 'sr25519'
   },
   {
-    publicKey: hexToU8a('0xfe65717dad0447d715f660a0a58411de509b42e6efb8375f562f58a554d5860e'),
-    secretKey: hexToU8a('0xc006507cdfc267a21532394c49ca9b754ca71de21e15a1cdf807c7ceab6d0b6c3ed408d9d35311540dcd54931933e67cf1ea10d46f75408f82b789d9bd212fde'), // nosemgrep
+    p: '0xfe65717dad0447d715f660a0a58411de509b42e6efb8375f562f58a554d5860e',
+    s: '0xc006507cdfc267a21532394c49ca9b754ca71de21e15a1cdf807c7ceab6d0b6c3ed408d9d35311540dcd54931933e67cf1ea10d46f75408f82b789d9bd212fde', // nosemgrep
     seed: 'Bob//stash',
     type: 'sr25519'
   },
   {
-    publicKey: hexToU8a('0x90b5ab205c6974c9ea841be688864633dc9ca8a357843eeacf2314649965fe22'),
-    secretKey: hexToU8a('0xa8f2d83016052e5d6d77b2f6fd5d59418922a09024cda701b3c34369ec43a7668faf12ff39cd4e5d92bb773972f41a7a5279ebc2ed92264bed8f47d344f8f18c'), // nosemgrep
+    p: '0x90b5ab205c6974c9ea841be688864633dc9ca8a357843eeacf2314649965fe22',
+    s: '0xa8f2d83016052e5d6d77b2f6fd5d59418922a09024cda701b3c34369ec43a7668faf12ff39cd4e5d92bb773972f41a7a5279ebc2ed92264bed8f47d344f8f18c', // nosemgrep
     seed: 'Charlie',
     type: 'sr25519'
   },
   {
-    publicKey: hexToU8a('0x306721211d5404bd9da88e0204360a1a9ab8b87c66c1bc2fcdd37f3c2222cc20'),
-    secretKey: hexToU8a('0x20e05482ca4677e0edbc58ae9a3a59f6ed3b1a9484ba17e64d6fe8688b2b7b5d108c4487b9323b98b11fe36cb301b084e920f7b7895536809a6d62a451b25568'), // nosemgrep
+    p: '0x306721211d5404bd9da88e0204360a1a9ab8b87c66c1bc2fcdd37f3c2222cc20',
+    s: '0x20e05482ca4677e0edbc58ae9a3a59f6ed3b1a9484ba17e64d6fe8688b2b7b5d108c4487b9323b98b11fe36cb301b084e920f7b7895536809a6d62a451b25568', // nosemgrep
     seed: 'Dave',
     type: 'sr25519'
   },
   {
-    publicKey: hexToU8a('0xe659a7a1628cdd93febc04a4e0646ea20e9f5f0ce097d9a05290d4a9e054df4e'),
-    secretKey: hexToU8a('0x683576abfd5dc35273e4264c23095a1bf21c14517bece57c7f0cc5c0ed4ce06a3dbf386b7828f348abe15d76973a72009e6ef86a5c91db2990cb36bb657c6587'), // nosemgrep
+    p: '0xe659a7a1628cdd93febc04a4e0646ea20e9f5f0ce097d9a05290d4a9e054df4e',
+    s: '0x683576abfd5dc35273e4264c23095a1bf21c14517bece57c7f0cc5c0ed4ce06a3dbf386b7828f348abe15d76973a72009e6ef86a5c91db2990cb36bb657c6587', // nosemgrep
     seed: 'Eve',
     type: 'sr25519'
   },
   {
-    publicKey: hexToU8a('0x1cbd2d43530a44705ad088af313e18f80b53ef16b36177cd4b77b846f2a5f07c'),
-    secretKey: hexToU8a('0xb835c20f450079cf4f513900ae9faf8df06ad86c681884122c752a4b2bf74d4303e4f21bc6cc62bb4eeed5a9cce642c25e2d2ac1464093b50f6196d78e3a7426'), // nosemgrep
+    p: '0x1cbd2d43530a44705ad088af313e18f80b53ef16b36177cd4b77b846f2a5f07c',
+    s: '0xb835c20f450079cf4f513900ae9faf8df06ad86c681884122c752a4b2bf74d4303e4f21bc6cc62bb4eeed5a9cce642c25e2d2ac1464093b50f6196d78e3a7426', // nosemgrep
     seed: 'Ferdie',
     type: 'sr25519'
   }
@@ -75,48 +76,50 @@ export const PAIRSSR25519: PairDef[] = [
 export const PAIRSETHEREUM: PairDef[] = [
   {
     name: 'Alith',
-    publicKey: hexToU8a('0x02509540919faacf9ab52146c9aa40db68172d83777250b28e4679176e49ccdd9f'),
-    secretKey: hexToU8a('0x5fb92d6e98884f76de468fa3f6278f8807c48bebc13595d45af5bdc4da702133'), // nosemgrep
+    p: '0x02509540919faacf9ab52146c9aa40db68172d83777250b28e4679176e49ccdd9f',
+    s: '0x5fb92d6e98884f76de468fa3f6278f8807c48bebc13595d45af5bdc4da702133', // nosemgrep
     type: 'ethereum'
   },
   {
     name: 'Baltathar',
-    publicKey: hexToU8a('0x033bc19e36ff1673910575b6727a974a9abd80c9a875d41ab3e2648dbfb9e4b518'),
-    secretKey: hexToU8a('0x8075991ce870b93a8870eca0c0f91913d12f47948ca0fd25b49c6fa7cdbeee8b'), // nosemgrep
+    p: '0x033bc19e36ff1673910575b6727a974a9abd80c9a875d41ab3e2648dbfb9e4b518',
+    s: '0x8075991ce870b93a8870eca0c0f91913d12f47948ca0fd25b49c6fa7cdbeee8b', // nosemgrep
     type: 'ethereum'
   },
   {
     name: 'Charleth',
-    publicKey: hexToU8a('0x0234637bdc0e89b5d46543bcbf8edff329d2702bc995e27e9af4b1ba009a3c2a5e'),
-    secretKey: hexToU8a('0x0b6e18cafb6ed99687ec547bd28139cafdd2bffe70e6b688025de6b445aa5c5b'), // nosemgrep
+    p: '0x0234637bdc0e89b5d46543bcbf8edff329d2702bc995e27e9af4b1ba009a3c2a5e',
+    s: '0x0b6e18cafb6ed99687ec547bd28139cafdd2bffe70e6b688025de6b445aa5c5b', // nosemgrep
     type: 'ethereum'
   },
   {
     name: 'Dorothy',
-    publicKey: hexToU8a('0x02a00d60b2b408c2a14c5d70cdd2c205db8985ef737a7e55ad20ea32cc9e7c417c'),
-    secretKey: hexToU8a('0x39539ab1876910bbf3a223d84a29e28f1cb4e2e456503e7e91ed39b2e7223d68'), // nosemgrep
+    p: '0x02a00d60b2b408c2a14c5d70cdd2c205db8985ef737a7e55ad20ea32cc9e7c417c',
+    s: '0x39539ab1876910bbf3a223d84a29e28f1cb4e2e456503e7e91ed39b2e7223d68', // nosemgrep
     type: 'ethereum'
   },
   {
     name: 'Ethan',
-    publicKey: hexToU8a('0x025cdc005b752651cd3f728fb9192182acb3a9c89e19072cbd5b03f3ee1f1b3ffa'),
-    secretKey: hexToU8a('0x7dce9bc8babb68fec1409be38c8e1a52650206a7ed90ff956ae8a6d15eeaaef4'), // nosemgrep
+    p: '0x025cdc005b752651cd3f728fb9192182acb3a9c89e19072cbd5b03f3ee1f1b3ffa',
+    s: '0x7dce9bc8babb68fec1409be38c8e1a52650206a7ed90ff956ae8a6d15eeaaef4', // nosemgrep
     type: 'ethereum'
   },
   {
     name: 'Faith',
-    publicKey: hexToU8a('0x037964b6c9d546da4646ada28a99e34acaa1d14e7aba861a9055f9bd200c8abf74'),
-    secretKey: hexToU8a('0xb9d2ea9a615f3165812e8d44de0d24da9bbd164b65c4f0573e1ce2c8dbd9c8df'), // nosemgrep
+    p: '0x037964b6c9d546da4646ada28a99e34acaa1d14e7aba861a9055f9bd200c8abf74',
+    s: '0xb9d2ea9a615f3165812e8d44de0d24da9bbd164b65c4f0573e1ce2c8dbd9c8df', // nosemgrep
     type: 'ethereum'
   }
 ];
 
 function createMeta (name?: string, seed?: string) {
-  assert(name || seed, 'Testing pair should have either a name or a seed');
+  if (!name && !seed) {
+    throw new Error('Testing pair should have either a name or a seed');
+  }
 
   return {
     isTesting: true,
-    name: name || (seed && seed.replace('//', '_').toLowerCase())
+    name: name || seed?.replace('//', '_').toLowerCase()
   };
 }
 
@@ -128,16 +131,20 @@ function createMeta (name?: string, seed?: string) {
  */
 export function createTestKeyring (options: KeyringOptions = {}, isDerived = true): KeyringInstance {
   const keyring = new Keyring(options);
-  const pairs = (options.type && options.type === 'ethereum')
+  const pairs = options.type === 'ethereum'
     ? PAIRSETHEREUM
     : PAIRSSR25519;
 
-  for (const { name, publicKey, secretKey, seed, type } of pairs) {
+  for (const { name, p, s, seed, type } of pairs) {
     const meta = createMeta(name, seed);
     const pair = !isDerived && !name && seed
       ? keyring.addFromUri(seed, meta, options.type)
       : keyring.addPair(
-        createPair({ toSS58: keyring.encodeAddress, type }, { publicKey, secretKey }, meta)
+        createPair(
+          { toSS58: keyring.encodeAddress, type },
+          { publicKey: hexToU8a(p), secretKey: hexToU8a(s) },
+          meta
+        )
       );
 
     pair.lock = (): void => {

packages/keyring/src/testingPairs.spec.ts

@@ -1,19 +1,19 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
+
 import { u8aToHex } from '@polkadot/util';
 import { cryptoWaitReady } from '@polkadot/util-crypto';
 
-import { createTestPairs } from './testingPairs';
-import Keyring from '.';
+import Keyring from './index.js';
+import { createTestPairs } from './testingPairs.js';
 
 const TEST_ADD = '0xf24FF3a9CF04c71Dbc94D0b566f7A27B94566cac';
 
-describe('testingPairs', (): void => {
-  beforeEach(async (): Promise<void> => {
-    await cryptoWaitReady();
-  });
+await cryptoWaitReady();
 
+describe('testingPairs', (): void => {
   it('creates without failing', (): void => {
     expect(
       Object.keys(createTestPairs())
@@ -42,12 +42,10 @@ describe('testingPairs', (): void => {
     const keyring = new Keyring({ type: 'ethereum' });
     const pair = keyring.createFromUri('0x5fb92d6e98884f76de468fa3f6278f8807c48bebc13595d45af5bdc4da702133');
 
-    expect(
-      pair && pair.address
-    ).toEqual(TEST_ADD);
+    expect(pair?.address).toEqual(TEST_ADD);
   });
 
-  it('checks eth test addresses', (): void => {
+  describe('checks eth test addresses', (): void => {
     const ring = createTestPairs({ type: 'ethereum' });
     const keyring = new Keyring({ type: 'ethereum' });
     // priv keys generated by  ganache-cli --mnemonic "bottom drive obey lake curtain smoke basket hold race lonely fit walk"
@@ -62,12 +60,20 @@ describe('testingPairs', (): void => {
       '0x4c42532034540267bf568198ccec4cb822a025da542861fcb146a5fab6433ff8',
       '0x94c49300a58d576011096bcb006aa06f5a91b34b4383891e8029c21dc39fbb8b'];
 
+    // @ts-expect-error We should not delete from the maps, however this is a test
     delete ring.nobody;
 
-    Object.keys(ring).forEach((testKeyring, i) => {
-      if (i < 6) {
-        expect(u8aToHex(ring[testKeyring].publicKey)).toEqual(u8aToHex(keyring.createFromUri(privKeys[i]).publicKey));
-      }
-    });
+    Object
+      .keys(ring)
+      .filter((_, i) => i < 6)
+      .forEach((testKeyring, i) => {
+        it(`checks #${i}`, (): void => {
+          expect(
+            u8aToHex(ring[testKeyring].publicKey)
+          ).toEqual(
+            u8aToHex(keyring.createFromUri(privKeys[i]).publicKey)
+          );
+        });
+      });
   });
 });

packages/keyring/src/testingPairs.ts

@@ -1,23 +1,56 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type { KeyringOptions, KeyringPair } from './types';
+import type { KeypairType } from '@polkadot/util-crypto/types';
+import type { KeyringOptions, KeyringPair } from './types.js';
 
-import { nobody } from './pair/nobody';
-import { createTestKeyring } from './testing';
+import { nobody } from './pair/nobody.js';
+import { createTestKeyring } from './testing.js';
 
 export interface TestKeyringMap {
+  nobody: KeyringPair;
+
   [index: string]: KeyringPair;
 }
 
-export function createTestPairs (options?: KeyringOptions, isDerived = true): TestKeyringMap {
+export interface TestKeyringMapSubstrate extends TestKeyringMap {
+  alice: KeyringPair;
+  bob: KeyringPair;
+  charlie: KeyringPair;
+  dave: KeyringPair;
+  eve: KeyringPair;
+  ferdie: KeyringPair;
+}
+
+export interface TestKeyringMapEthereum extends TestKeyringMap {
+  Alith: KeyringPair;
+  Baltathar: KeyringPair;
+  Charleth: KeyringPair;
+  Dorothy: KeyringPair;
+  Ethan: KeyringPair;
+  Faith: KeyringPair;
+}
+
+export type DetectMap<O extends KeyringOptions | undefined> = DetectPairType<O> extends 'ethereum'
+  ? TestKeyringMapEthereum
+  : TestKeyringMapSubstrate;
+
+export type DetectPairType<O extends KeyringOptions | undefined> = O extends KeyringOptions
+  ? O['type'] extends KeypairType
+    ? O['type']
+    : 'sr25519'
+  : 'sr25519';
+
+export function createTestPairs <O extends KeyringOptions, M = DetectMap<O>> (options?: O, isDerived = true): M {
   const keyring = createTestKeyring(options, isDerived);
   const pairs = keyring.getPairs();
   const map: TestKeyringMap = { nobody: nobody() };
 
   for (const p of pairs) {
-    map[p.meta.name as string] = p;
+    if (p.meta.name) {
+      map[p.meta.name] = p;
+    }
   }
 
-  return map;
+  return map as M;
 }

packages/keyring/src/types.ts

@@ -1,22 +1,89 @@
-// Copyright 2017-2022 @polkadot/keyring authors & contributors
+// Copyright 2017-2026 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { HexString } from '@polkadot/util/types';
 import type { EncryptedJson, Keypair, KeypairType, Prefix } from '@polkadot/util-crypto/types';
 
 export interface KeyringOptions {
+  /** The ss58Format to use for address encoding (defaults to 42) */
   ss58Format?: Prefix;
+  /** The type of keyring to create (defaults to ed25519) */
   type?: KeypairType;
 }
 
-export type KeyringPair$Meta = Record<string, unknown>;
+export interface KeyringPair$MetaHardware {
+  accountIndex?: number;
+  accountOffset?: number;
+  addressOffset?: number;
+  hardwareType?: 'ledger';
+}
+
+export interface KeyringPair$MetaFlags {
+  isDefaultAuthSelected?: boolean;
+  isExternal?: boolean;
+  isHardware?: boolean;
+  isHidden?: boolean;
+  isInjected?: boolean;
+  isMultisig?: boolean;
+  isProxied?: boolean;
+  isRecent?: boolean;
+  isTesting?: boolean;
+}
+
+export interface KeyringPair$MetaContract {
+  abi: string;
+  genesisHash?: HexString | null;
+}
+
+export interface KeyringPair$MetaExtension {
+  source?: string;
+}
+
+export interface KeyringPair$MetaMultisig {
+  threshold?: number;
+  who?: string[];
+}
+
+export interface KeyringPair$MetaParent {
+  parentAddress?: string;
+  parentName?: string;
+}
+
+export interface KeyringPair$Meta extends KeyringPair$MetaExtension, KeyringPair$MetaFlags, KeyringPair$MetaHardware, KeyringPair$MetaMultisig, KeyringPair$MetaParent {
+  address?: string;
+  contract?: KeyringPair$MetaContract;
+  genesisHash?: HexString | null;
+  name?: string;
+  suri?: string;
+  tags?: string[];
+  type?: KeypairType;
+  whenCreated?: number;
+  whenEdited?: number;
+  whenUsed?: number;
+
+  [key: string]: unknown;
+}
 
 export interface KeyringPair$Json extends EncryptedJson {
-  address: string | HexString;
+  /** The ss58 encoded address or the hex-encoded version (the latter is for ETH-compat chains) */
+  address: string;
+  /** The underlying metadata associated with the keypair */
   meta: KeyringPair$Meta;
 }
 
 export interface SignOptions {
+  /**
+   * The FIPS 204 domain-separation context, for post-quantum pairs.
+   *
+   * Mandatory for `dilithium65`/`dilithium87` and ignored by every other type.
+   * There is deliberately no default: Quantus extrinsics on spec >= 148 are
+   * verified under `QUANTUS_EXTRINSIC` and earlier ones under the empty context,
+   * and a signature made under the wrong one is cryptographically valid, rejected
+   * by the chain, and locally indistinguishable from a correct one. Only the
+   * caller knows the spec version, so only the caller can answer.
+   */
+  context?: Uint8Array;
+  /** Create a MultiSignature-compatible output with an indicator type */
   withType?: boolean;
 }
 
@@ -33,14 +100,12 @@ export interface KeyringPair {
   encodePkcs8 (passphrase?: string): Uint8Array;
   lock (): void;
   setMeta (meta: KeyringPair$Meta): void;
-  sign (message: HexString | string | Uint8Array, options?: SignOptions): Uint8Array;
+  sign (message: string | Uint8Array, options?: SignOptions): Uint8Array;
   toJson (passphrase?: string): KeyringPair$Json;
   unlock (passphrase?: string): void;
-  encryptMessage (message: HexString | string | Uint8Array, recipientPublicKey: HexString | string | Uint8Array, nonce?: Uint8Array): Uint8Array;
-  decryptMessage (encryptedMessageWithNonce: HexString | string | Uint8Array, senderPublicKey: HexString | string | Uint8Array): Uint8Array | null;
-  verify (message: HexString | string | Uint8Array, signature: Uint8Array, signerPublic: HexString | string | Uint8Array): boolean;
-  vrfSign (message: HexString | string | Uint8Array, context?: HexString | string | Uint8Array, extra?: HexString | string | Uint8Array): Uint8Array;
-  vrfVerify (message: HexString | string | Uint8Array, vrfResult: Uint8Array, signerPublic: HexString | Uint8Array | string, context?: HexString | string | Uint8Array, extra?: HexString | string | Uint8Array): boolean;
+  verify (message: string | Uint8Array, signature: Uint8Array, signerPublic: string | Uint8Array): boolean;
+  vrfSign (message: string | Uint8Array, context?: string | Uint8Array, extra?: string | Uint8Array): Uint8Array;
+  vrfVerify (message: string | Uint8Array, vrfResult: Uint8Array, signerPublic: string | Uint8Array, context?: string | Uint8Array, extra?: string | Uint8Array): boolean;
 }
 
 export interface KeyringPairs {
@@ -62,13 +127,13 @@ export interface KeyringInstance {
   addPair (pair: KeyringPair): KeyringPair;
   addFromAddress (address: string | Uint8Array, meta?: KeyringPair$Meta, encoded?: Uint8Array | null, type?: KeypairType, ignoreChecksum?: boolean): KeyringPair;
   addFromJson (pair: KeyringPair$Json, ignoreChecksum?: boolean): KeyringPair;
-  addFromMnemonic (mnemonic: string, meta?: KeyringPair$Meta, type?: KeypairType): KeyringPair;
+  addFromMnemonic (mnemonic: string, meta?: KeyringPair$Meta, type?: KeypairType, wordlist?: string[]): KeyringPair;
   addFromPair (pair: Keypair, meta?: KeyringPair$Meta, type?: KeypairType): KeyringPair
   addFromSeed (seed: Uint8Array, meta?: KeyringPair$Meta, type?: KeypairType): KeyringPair;
-  addFromUri (suri: string, meta?: KeyringPair$Meta, type?: KeypairType): KeyringPair;
+  addFromUri (suri: string, meta?: KeyringPair$Meta, type?: KeypairType, wordlist?: string[]): KeyringPair;
   createFromJson (json: KeyringPair$Json, ignoreChecksum?: boolean): KeyringPair;
   createFromPair (pair: Keypair, meta: KeyringPair$Meta, type: KeypairType): KeyringPair
-  createFromUri (suri: string, meta?: KeyringPair$Meta, type?: KeypairType): KeyringPair;
+  createFromUri (suri: string, meta?: KeyringPair$Meta, type?: KeypairType, wordlist?: string[]): KeyringPair;
   getPair (address: string | Uint8Array): KeyringPair;
   getPairs (): KeyringPair[];
   getPublicKeys (): Uint8Array[];

packages/keyring/tsconfig.build.json

@@ -5,6 +5,10 @@
     "outDir": "./build",
     "rootDir": "./src"
   },
+  "exclude": [
+    "**/*.spec.ts",
+    "**/mod.ts"
+  ],
   "references": [
     { "path": "../util/tsconfig.build.json" },
     { "path": "../util-crypto/tsconfig.build.json" }

packages/keyring/tsconfig.spec.json

@@ -0,0 +1,18 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "baseUrl": "..",
+    "outDir": "./build",
+    "rootDir": "./src",
+    "emitDeclarationOnly": false,
+    "noEmit": true
+  },
+  "include": [
+    "**/*.spec.ts"
+  ],
+  "references": [
+    { "path": "../keyring/tsconfig.build.json" },
+    { "path": "../util/tsconfig.build.json" },
+    { "path": "../util-crypto/tsconfig.build.json" }
+  ]
+}

packages/networks/LICENSE

@@ -1,201 +0,0 @@
-                              Apache License
-                        Version 2.0, January 2004
-                    http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-  "License" shall mean the terms and conditions for use, reproduction,
-  and distribution as defined by Sections 1 through 9 of this document.
-
-  "Licensor" shall mean the copyright owner or entity authorized by
-  the copyright owner that is granting the License.
-
-  "Legal Entity" shall mean the union of the acting entity and all
-  other entities that control, are controlled by, or are under common
-  control with that entity. For the purposes of this definition,
-  "control" means (i) the power, direct or indirect, to cause the
-  direction or management of such entity, whether by contract or
-  otherwise, or (ii) ownership of fifty percent (50%) or more of the
-  outstanding shares, or (iii) beneficial ownership of such entity.
-
-  "You" (or "Your") shall mean an individual or Legal Entity
-  exercising permissions granted by this License.
-
-  "Source" form shall mean the preferred form for making modifications,
-  including but not limited to software source code, documentation
-  source, and configuration files.
-
-  "Object" form shall mean any form resulting from mechanical
-  transformation or translation of a Source form, including but
-  not limited to compiled object code, generated documentation,
-  and conversions to other media types.
-
-  "Work" shall mean the work of authorship, whether in Source or
-  Object form, made available under the License, as indicated by a
-  copyright notice that is included in or attached to the work
-  (an example is provided in the Appendix below).
-
-  "Derivative Works" shall mean any work, whether in Source or Object
-  form, that is based on (or derived from) the Work and for which the
-  editorial revisions, annotations, elaborations, or other modifications
-  represent, as a whole, an original work of authorship. For the purposes
-  of this License, Derivative Works shall not include works that remain
-  separable from, or merely link (or bind by name) to the interfaces of,
-  the Work and Derivative Works thereof.
-
-  "Contribution" shall mean any work of authorship, including
-  the original version of the Work and any modifications or additions
-  to that Work or Derivative Works thereof, that is intentionally
-  submitted to Licensor for inclusion in the Work by the copyright owner
-  or by an individual or Legal Entity authorized to submit on behalf of
-  the copyright owner. For the purposes of this definition, "submitted"
-  means any form of electronic, verbal, or written communication sent
-  to the Licensor or its representatives, including but not limited to
-  communication on electronic mailing lists, source code control systems,
-  and issue tracking systems that are managed by, or on behalf of, the
-  Licensor for the purpose of discussing and improving the Work, but
-  excluding communication that is conspicuously marked or otherwise
-  designated in writing by the copyright owner as "Not a Contribution."
-
-  "Contributor" shall mean Licensor and any individual or Legal Entity
-  on behalf of whom a Contribution has been received by Licensor and
-  subsequently incorporated within the Work.
-
-2. Grant of Copyright License. Subject to the terms and conditions of
-  this License, each Contributor hereby grants to You a perpetual,
-  worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-  copyright license to reproduce, prepare Derivative Works of,
-  publicly display, publicly perform, sublicense, and distribute the
-  Work and such Derivative Works in Source or Object form.
-
-3. Grant of Patent License. Subject to the terms and conditions of
-  this License, each Contributor hereby grants to You a perpetual,
-  worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-  (except as stated in this section) patent license to make, have made,
-  use, offer to sell, sell, import, and otherwise transfer the Work,
-  where such license applies only to those patent claims licensable
-  by such Contributor that are necessarily infringed by their
-  Contribution(s) alone or by combination of their Contribution(s)
-  with the Work to which such Contribution(s) was submitted. If You
-  institute patent litigation against any entity (including a
-  cross-claim or counterclaim in a lawsuit) alleging that the Work
-  or a Contribution incorporated within the Work constitutes direct
-  or contributory patent infringement, then any patent licenses
-  granted to You under this License for that Work shall terminate
-  as of the date such litigation is filed.
-
-4. Redistribution. You may reproduce and distribute copies of the
-  Work or Derivative Works thereof in any medium, with or without
-  modifications, and in Source or Object form, provided that You
-  meet the following conditions:
-
-  (a) You must give any other recipients of the Work or
-      Derivative Works a copy of this License; and
-
-  (b) You must cause any modified files to carry prominent notices
-      stating that You changed the files; and
-
-  (c) You must retain, in the Source form of any Derivative Works
-      that You distribute, all copyright, patent, trademark, and
-      attribution notices from the Source form of the Work,
-      excluding those notices that do not pertain to any part of
-      the Derivative Works; and
-
-  (d) If the Work includes a "NOTICE" text file as part of its
-      distribution, then any Derivative Works that You distribute must
-      include a readable copy of the attribution notices contained
-      within such NOTICE file, excluding those notices that do not
-      pertain to any part of the Derivative Works, in at least one
-      of the following places: within a NOTICE text file distributed
-      as part of the Derivative Works; within the Source form or
-      documentation, if provided along with the Derivative Works; or,
-      within a display generated by the Derivative Works, if and
-      wherever such third-party notices normally appear. The contents
-      of the NOTICE file are for informational purposes only and
-      do not modify the License. You may add Your own attribution
-      notices within Derivative Works that You distribute, alongside
-      or as an addendum to the NOTICE text from the Work, provided
-      that such additional attribution notices cannot be construed
-      as modifying the License.
-
-  You may add Your own copyright statement to Your modifications and
-  may provide additional or different license terms and conditions
-  for use, reproduction, or distribution of Your modifications, or
-  for any such Derivative Works as a whole, provided Your use,
-  reproduction, and distribution of the Work otherwise complies with
-  the conditions stated in this License.
-
-5. Submission of Contributions. Unless You explicitly state otherwise,
-  any Contribution intentionally submitted for inclusion in the Work
-  by You to the Licensor shall be under the terms and conditions of
-  this License, without any additional terms or conditions.
-  Notwithstanding the above, nothing herein shall supersede or modify
-  the terms of any separate license agreement you may have executed
-  with Licensor regarding such Contributions.
-
-6. Trademarks. This License does not grant permission to use the trade
-  names, trademarks, service marks, or product names of the Licensor,
-  except as required for reasonable and customary use in describing the
-  origin of the Work and reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty. Unless required by applicable law or
-  agreed to in writing, Licensor provides the Work (and each
-  Contributor provides its Contributions) on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-  implied, including, without limitation, any warranties or conditions
-  of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-  PARTICULAR PURPOSE. You are solely responsible for determining the
-  appropriateness of using or redistributing the Work and assume any
-  risks associated with Your exercise of permissions under this License.
-
-8. Limitation of Liability. In no event and under no legal theory,
-  whether in tort (including negligence), contract, or otherwise,
-  unless required by applicable law (such as deliberate and grossly
-  negligent acts) or agreed to in writing, shall any Contributor be
-  liable to You for damages, including any direct, indirect, special,
-  incidental, or consequential damages of any character arising as a
-  result of this License or out of the use or inability to use the
-  Work (including but not limited to damages for loss of goodwill,
-  work stoppage, computer failure or malfunction, or any and all
-  other commercial damages or losses), even if such Contributor
-  has been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability. While redistributing
-  the Work or Derivative Works thereof, You may choose to offer,
-  and charge a fee for, acceptance of support, warranty, indemnity,
-  or other liability obligations and/or rights consistent with this
-  License. However, in accepting such obligations, You may act only
-  on Your own behalf and on Your sole responsibility, not on behalf
-  of any other Contributor, and only if You agree to indemnify,
-  defend, and hold each Contributor harmless for any liability
-  incurred by, or claims asserted against, such Contributor by reason
-  of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work.
-
-  To apply the Apache License to your work, attach the following
-  boilerplate notice, with the fields enclosed by brackets "[]"
-  replaced with your own identifying information. (Don't include
-  the brackets!)  The text should be enclosed in the appropriate
-  comment syntax for the file format. We also recommend that a
-  file or class name and description of purpose be included on the
-  same "printed page" as the copyright notice for easier
-  identification within third-party archives.
-
-Copyright [yyyy] [name of copyright owner]
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.

packages/networks/package.json

@@ -1,14 +1,12 @@
 {
   "author": "Jaco Greeff <jacogr@gmail.com>",
   "bugs": "https://github.com/polkadot-js/common/issues",
-  "contributors": [],
   "description": "A list of all available Substrate networks and their applicable prefixes",
   "engines": {
-    "node": ">=14.0.0"
+    "node": ">=18"
   },
   "homepage": "https://github.com/polkadot-js/common/tree/master/packages/networks#readme",
   "license": "Apache-2.0",
-  "maintainers": [],
   "name": "@polkadot/networks",
   "repository": {
     "directory": "packages/networks",
@@ -17,15 +15,14 @@
   },
   "sideEffects": false,
   "type": "module",
-  "version": "9.0.1",
+  "version": "14.0.3-quantus.2",
   "main": "index.js",
   "dependencies": {
-    "@babel/runtime": "^7.17.9",
-    "@polkadot/util": "9.0.1",
-    "@substrate/ss58-registry": "^1.17.0"
+    "@polkadot/util": "14.0.3",
+    "@substrate/ss58-registry": "^1.51.0",
+    "tslib": "^2.8.0"
   },
   "devDependencies": {
-    "@polkadot/hw-ledger": "9.0.1",
-    "@polkadot/x-fetch": "9.0.1"
+    "@polkadot/hw-ledger": "14.0.3"
   }
 }

packages/networks/src/crosscheck.spec.ts

@@ -1,75 +0,0 @@
-// Copyright 2017-2022 @polkadot/networks authors & contributors
-// SPDX-License-Identifier: Apache-2.0
-
-import type { Ss58Registry } from './types';
-
-import fs from 'fs';
-
-import { objectKeys, stringify } from '@polkadot/util';
-import { fetch } from '@polkadot/x-fetch';
-
-import { allNetworks } from './';
-
-const REGISTRY = 'https://raw.githubusercontent.com/paritytech/ss58-registry/main/ss58-registry.json';
-const OUTPUT = './.github/ss58-check.md';
-
-function assertAndLog (check: boolean, error: string): void {
-  if (!check) {
-    process.env.CI_LOG && fs.appendFileSync(OUTPUT, `
-
-${error}
-`);
-
-    throw new Error(error);
-  }
-}
-
-describe('check latest Substrate ss58 registry', (): void => {
-  let original: Ss58Registry;
-
-  beforeAll(async (): Promise<void> => {
-    original = (await (await fetch(REGISTRY)).json()) as Ss58Registry;
-  });
-
-  it('has the same number as the original', (): void => {
-    assertAndLog(allNetworks.length === original.registry.length, `Number of entries mismatched:: Expected ${original.registry.length} found ${allNetworks.length}`);
-  });
-
-  it('has no missing any entries', (): void => {
-    const missing = original.registry
-      .filter(({ prefix }) => !allNetworks.some((n) => n.prefix === prefix))
-      .map(({ displayName, prefix }) => `${displayName} (${prefix})`);
-
-    assertAndLog(!missing.length, `Missing entries found: ${stringify(missing, 2)}`);
-  });
-
-  it('has no extra entries', (): void => {
-    const missing = allNetworks
-      .filter(({ prefix }) => !original.registry.some((n) => n.prefix === prefix))
-      .map(({ displayName, prefix }) => `${displayName} (${prefix})`);
-
-    assertAndLog(!missing.length, `Extra entries found: ${stringify(missing, 2)}`);
-  });
-
-  it('has the same values as the original', (): void => {
-    const fields = objectKeys(original.schema);
-    const errors = original.registry
-      .map((n): [string, string[]] => {
-        const other = allNetworks.find(({ prefix }) => prefix === n.prefix);
-
-        return [
-          `${n.displayName} (${n.prefix})`,
-          other
-            ? fields.filter((f) =>
-              ['decimals', 'symbols'].includes(f)
-                ? stringify(n[f] || []) !== stringify(other[f] || [])
-                : stringify(n[f]) !== stringify(other[f])
-            )
-            : []
-        ];
-      })
-      .filter(([, fields]) => fields.length);
-
-    assertAndLog(!errors.length, `Mismatches found: ${stringify(errors.map(([n, m]) => `${n}:: ${m.join(', ')}`), 2)}`);
-  });
-});

packages/networks/src/defaults.spec.ts

@@ -1,25 +1,43 @@
-// Copyright 2017-2022 @polkadot/networks authors & contributors
+// Copyright 2017-2026 @polkadot/networks authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
+/// <reference types="@polkadot/dev-test/globals.d.ts" />
+
 import { ledgerApps } from '@polkadot/hw-ledger/defaults';
 import { isHex } from '@polkadot/util';
 
-import { knownGenesis, knownLedger } from './defaults';
+import { knownGenesis, knownLedger, knownTestnet } from './defaults/index.js';
 
 describe('defaults', (): void => {
+  const genesisKeys = Object.keys(knownGenesis);
+  const ledgerKeys = Object.keys(knownLedger);
+
   describe('genesis', (): void => {
     it('has hex values for all genesis chains', (): void => {
       expect(
-        Object.keys(knownGenesis).filter((network) =>
+        genesisKeys.filter((network) =>
           !knownGenesis[network].length ||
           knownGenesis[network].some((g) => !isHex(g, 256))
         )
       ).toEqual([]);
     });
 
+    // Upstream asserted the opposite: that no testnet appears in knownGenesis.
+    // This fork carries Quantus testnets deliberately — a wallet for a chain
+    // under development has to reach its testnet — so the assertion becomes that
+    // any testnet listed here is one we meant to list. See defaults/genesis.ts.
+    it('has genesis entries only for testnets we deliberately support', (): void => {
+      expect(
+        genesisKeys.filter((network) =>
+          knownTestnet[network] &&
+          !network.startsWith('quantus')
+        )
+      ).toEqual([]);
+    });
+
     it('has genesis for all Ledger chains', (): void => {
       expect(
-        Object.keys(knownLedger).filter((network) =>
+        ledgerKeys.filter((network) =>
           !knownGenesis[network]
         )
       ).toEqual([]);
@@ -29,7 +47,7 @@ describe('defaults', (): void => {
   describe('Ledger', (): void => {
     it('has entries for each of the apps (hwledger -> networks)', (): void => {
       expect(
-        Object.keys(knownLedger).filter((network) =>
+        ledgerKeys.filter((network) =>
           !ledgerApps[network]
         )
       ).toEqual([]);

packages/networks/src/defaults/genesis.ts

@@ -1,16 +1,37 @@
-// Copyright 2017-2022 @polkadot/networks authors & contributors
+// Copyright 2017-2026 @polkadot/networks authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type { KnownGenesis } from '../types';
+import type { KnownGenesis } from '../types.js';
 
-// NOTE: In the case where the network was hard-spooned and multiple genesisHashes
-// are provided, it needs to be in reverse order, i.e. most-recent first, oldest
-// last. This make lookups for the current a simple genesisHash[0]
-// (See Kusama as an example)
+// In the case where the network was hard-spooned and multiple genesisHashes
+// are provided, it needs to be in reverse order, i.e. most-recent goes first,
+// oldest goes last. This make lookups for the current a simple genesisHash[0]
+// where the latest ios always the first entry (See Kusama as an example)
+//
+// UPSTREAM SAID: "Apart from the test relays, this list is limited to live
+// parachains and live production networks. It does not and should not contain
+// any testnets, either stand-alone or connected to test relays such as
+// Westend/Rococo"
+//
+// THIS FORK DOES NOT. That rule keeps testnets out of polkadot-js/apps' chain
+// picker, which is a sensible product decision for a production explorer and the
+// wrong one for us. Quantus is a chain under active development, and a wallet
+// that cannot talk to its testnet is a wallet that cannot be tested against
+// anything but real funds. Testnets are first-class here.
+//
+// `isTestnet` is still set honestly, so a consumer that wants to hide them can;
+// what changed is that we no longer make that choice on the consumer's behalf.
+// See `toExpanded` in ../interfaces.ts.
 export const knownGenesis: KnownGenesis = {
   acala: [
     '0xfc41b9bd8ef8fe53d58c7ea67c794c7ec9a73daf05e6d54b14ff6342c99ba64c'
   ],
+  ajuna: [
+    '0xe358eb1d11b31255a286c12e44fe6780b7edb171d657905a97e39f71d9c6c3ee'
+  ],
+  'aleph-node': [
+    '0x70255b4d28de0fc4e1a193d7e175ad1ccef431598211c55538f1018651a0344e'
+  ],
   astar: [
     '0x9eb76c5184c4ab8679d2d5d819fdf90b9c001403e9e17da2e14b6d8aec4029c6'
   ],
@@ -18,11 +39,35 @@ export const knownGenesis: KnownGenesis = {
     '0xa85cfb9b9fd4d622a5b28289a02347af987d8f73fa3108450e2b4a11c1ce5755'
   ],
   bifrost: [
+    '0x262e1b2ad728475fd6fe88e62d34c200abe6fd693931ddad144059b1eb884e5b'
+  ],
+  'bifrost-kusama': [
     '0x9f28c6a68e0fc9646eff64935684f6eeeece527e37bbe1f213d22caa1d9d6bed'
   ],
+  bittensor: [
+    '0x2f0555cc76fc2840a25a6ea3b9637146806f1f44b090c175ffde2a7e5ab36c03'
+  ],
   centrifuge: [
+    '0xb3db41421702df9a7fcac62b53ffeac85f7853cc4e689e0b93aeb3db18c09d82',
     '0x67dddf2673b69e5f875f6f25277495834398eafd67f492e09f3f3345e003d1b5'
   ],
+  cere: [
+    '0x81443836a9a24caaa23f1241897d1235717535711d1d3fe24eae4fdc942c092c'
+  ],
+  composable: [
+    '0xdaab8df776eb52ec604a5df5d388bb62a050a0aaec4556a64265b9d42755552d'
+  ],
+  creditcoin3: [
+    '0x4436a7d64e363df85e065a894721002a86643283f9707338bf195d360ba2ee71', // cc3 mainnet
+    '0xfc4ec97a1c1f119c4353aecb4a17c7c0cf7b40d5d660143d8bad9117e9866572', // cc3 testnet/drynet
+    '0xfc9df99a665f964aed6649f275055e54df5e3420489538ed31d7788f53d11ef6' // cc3 devnet
+  ],
+  darwinia: [
+    '0xe71578b37a7c799b0ab4ee87ffa6f059a6b98f71f06fb8c84a8d88013a548ad6'
+  ],
+  dentnet: [
+    '0x0313f6a011d128d22f996703cbab05162e2fdc9e031493314fe6db79979c5ca7'
+  ],
   'dock-mainnet': [
     '0x6bfe24dca2a3be10f22212678ac13a6446ec764103c0f3471c71609eac384aae',
     '0xf73467c6544aa68df2ee546b135f955c46b90fa627e9b5d7935f41061bb8a5a9'
@@ -30,21 +75,41 @@ export const knownGenesis: KnownGenesis = {
   edgeware: [
     '0x742a2ca70c2fda6cee4f8df98d64c4c670a052d9568058982dad9d5a7a135c5b'
   ],
+  encointer: [
+    '0x7dd99936c1e9e6d1ce7d90eb6f33bea8393b4bf87677d675aa63c9cb3e8c5b5b'
+  ],
+  enjin: [
+    '0xd8761d3c88f26dc12875c00d3165f7d67243d56fc85b4cf19937601a7916e5a9'
+  ],
   equilibrium: [
     '0x6f1a800de3daff7f5e037ddf66ab22ce03ab91874debeddb1086f5f7dbd48925'
   ],
+  frequency: [
+    '0x4a587bf17a404e3572747add7aab7bbe56e805a5479c6c436f07f36fcc8d3ae1'
+  ],
   genshiro: [
     '0x9b8cefc0eb5c568b527998bdd76c184e2b76ae561be76e4667072230217ea243'
   ],
   hydradx: [
+    '0xafdc188f45c71dacbaa0b62e16a91f726c7b8699a9748cdf715459de6b7f366d', // Hydration | HydraDX Parachain
     '0xd2a620c27ec5cbc5621ff9a522689895074f7cca0d08e7134a7804e1a3ba86fc', // Snakenet Gen3-1
     '0x10af6e84234477d84dc572bac0789813b254aa490767ed06fb9591191d1073f9', // Snakenet Gen3
     '0x3d75507dd46301767e601265791da1d9cb47b6ebc94e87347b635e5bf58bd047', // Snakenet Gen2
     '0x0ed32bfcab4a83517fac88f2aa7cbc2f88d3ab93be9a12b6188a036bf8a943c2' // Snakenet Gen1
   ],
+  integritee: [
+    '0xcdedc8eadbfa209d3f207bba541e57c3c58a667b05a2e1d1e86353c9000758da', // on Kusama
+    '0xe13e7af377c64e83f95e0d70d5e5c3c01d697a84538776c5b9bbe0e7d7b6034c' // on Polkadot
+  ],
+  'interlay-parachain': [
+    '0xbf88efe70e9e0e916416e8bed61f2b45717f517d7f3523e33c7b001e5ffcbc72'
+  ],
   karura: [
     '0xbaf5aabe40646d11f0ee8abbdc64f4a4b7674925cba08e4a05ff9ebed6e2126b'
   ],
+  khala: [
+    '0xd43540ba6d3eb4897c28a77d48cb5b729fea37603cbbfc7a86a73b72adb3be8d'
+  ],
   kulupu: [
     '0xf7a99d3cb92853d00d5275c971c132c074636256583fee53b3bbe60d7b8769ba'
   ],
@@ -53,19 +118,69 @@ export const knownGenesis: KnownGenesis = {
     '0xe3777fa922cafbff200cadeaea1a76bd7898ad5b89f7848999058b50e715f636', // Kusama CC2
     '0x3fd7b9eb6a00376e5be61f01abb429ffb0b104be05eaff4d458da48fcd425baf' // Kusama CC1
   ],
-  'nodle-chain': [
-    '0xa3d114c2b8d0627c1aa9b134eafcf7d05ca561fdc19fb388bb9457f81809fb23'
+  liberland: [
+    '0x6bd89e052d67a45bb60a9a23e8581053d5e0d619f15cb9865946937e690c42d6'
+  ],
+  matrixchain: [
+    '0x3af4ff48ec76d2efc8476730f423ac07e25ad48f5f4c9dc39c778b164d808615'
+  ],
+  mythos: [
+    '0xf6ee56e9c5277df5b4ce6ae9983ee88f3cbed27d31beeb98f9f84f997a1ab0b9'
+  ],
+  nodle: [
+    '0x97da7ede98d7bad4e36b4d734b6055425a3be036da2a332ea5a7037656427a21'
+  ],
+  origintrail: [
+    '0xe7e0962324a3b86c83404dbea483f25fb5dab4c224791c81b756cfc948006174'
+  ],
+  p3d: [
+    '0x6c5894837ad89b6d92b114a2fb3eafa8fe3d26a54848e3447015442cd6ef4e66'
+  ],
+  parallel: [
+    '0xe61a41c53f5dcd0beb09df93b34402aada44cb05117b71059cce40a2723a4e97'
+  ],
+  peaq: [
+    '0xd2a5d385932d1f650dae03ef8e2748983779ee342c614f80854d32b8cd8fa48c'
+  ],
+  pendulum: [
+    '0x5d3c298622d5634ed019bf61ea4b71655030015bde9beb0d6a24743714462c86'
+  ],
+  phala: [
+    '0x1bb969d85965e4bb5a651abbedf21a54b6b31a21f66b5401cc3f1e286268d736'
   ],
   picasso: [
+    '0x6811a339673c9daa897944dcdac99c6e2939cc88245ed21951a0a3c9a2be75bc',
     '0xe8e7f0f4c4f5a00720b4821dbfddefea7490bcf0b19009961cc46957984e2c1c'
   ],
+  polimec: [
+    '0x7eb9354488318e7549c722669dcbdcdc526f1fef1420e7944667212f3601fdbd'
+  ],
+  polkadex: [
+    '0x3920bcb4960a1eef5580cd5367ff3f430eef052774f78468852f7b9cb39f8a3c'
+  ],
   polkadot: [
     '0x91b171bb158e2d3848fa23a9f1c25182fb8e20313b2c1eb49219da7a70ce90c3'
   ],
   polymesh: [
     '0x6fbd74e5e1d0a61d52ccfe9d4adaed16dd3a7caa37c6bc4d0c2fa12e8b2f4063'
   ],
+  // Quantus mainnet, read from the node with `chain_getBlockHash(0)` on
+  // 2026-09-09, the day it launched. Not the staging chain, which is
+  // `0xb0e90ed9f291a9194f79…` and which telemetry confusingly calls
+  // "Quantus Staging Mainnet".
+  quantus: [
+    '0xfb5487c0be6ae4ade2d41d16e50465129861636c2b8d61fa94d7a19631626fba'
+  ],
+  // Heisenberg, the public Quantus testnet. A testnet carrying a genesis hash is
+  // a deliberate departure from upstream — see the note above.
+  'quantus-heisenberg': [
+    '0xa5aa9e5c84d4a3722c152295e7973c9af522f2fb1ef7db5afaa3d5f4dc8d3b4f'
+  ],
+  quartz: [
+    '0xcd4d732201ebe5d6b014edda071c4203e16867305332301dc8d092044b28e554'
+  ],
   rococo: [
+    '0x6408de7737c59c238890533af25896a2c20608d8b380bb01029acb392781063e',
     '0xaaf2cd1b74b5f726895921259421b534124726263982522174147046b8827897',
     '0x037f5f3c8e67b314062025fc886fcd6238ea25a4a9b45dce8d246815c9ebe770',
     '0xc196f81260cf1686172b47a79cf002120735d7cb0eb1474e8adce56618456fff',
@@ -87,10 +202,32 @@ export const knownGenesis: KnownGenesis = {
   statemine: [
     '0x48239ef607d7928874027a43a67689209727dfb3d3dc5e5b03a39bdc2eda771a'
   ],
+  statemint: [
+    '0x68d56f15f85d3136970ec16946040bc1752654e906147f7e43e9d539d7c3de2f'
+  ],
   subsocial: [
     '0x0bd72c1c305172e1275278aaeb3f161e02eccb7a819e63f62d47bd53a28189f8'
   ],
+  ternoa: [
+    '0x6859c81ca95ef624c9dfe4dc6e3381c33e5d6509e35e147092bfbc780f777c4e'
+  ],
+  unique: [
+    '0x84322d9cddbf35088f1e54e9a85c967a41a56a4f43445768125e61af166c7d31'
+  ],
+  vara: [
+    '0xfe1b4c55fd4d668101126434206571a7838a8b6b93a6d1b95d607e78e6c53763'
+  ],
+  vtb: [
+    '0x286bc8414c7000ce1d6ee6a834e29a54c1784814b76243eb77ed0b2c5573c60f',
+    '0x7483b89572fb2bd687c7b9a93b242d0b237f9aba463aba07ec24503931038aaa'
+  ],
   westend: [
     '0xe143f23803ac50e8f6f8e62695d1ce9e4e1d68aa36c1cd2cfd15340213f3423e'
+  ],
+  xxnetwork: [
+    '0x50dd5d206917bf10502c68fb4d18a59fc8aa31586f4e8856b493e43544aa82aa'
+  ],
+  zeitgeist: [
+    '0x1bf2a2ecb4a868de66ea8610f2ce7c8c43706561b6476031315f6640fe38e060'
   ]
 };

packages/networks/src/defaults/icons.ts

@@ -1,7 +1,7 @@
-// Copyright 2017-2022 @polkadot/networks authors & contributors
+// Copyright 2017-2026 @polkadot/networks authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type { KnownIcon } from '../types';
+import type { KnownIcon } from '../types.js';
 
 // these are icon overrides
 export const knownIcon: KnownIcon = {