The mirror of the same mistake in keyring.createFromJson, fixed the same way.
restoreAccount passed `decodeAddress(json.address)` as the public key. For the
curve schemes that is correct — the address *is* the public key. An ML-DSA
account id is a one-way Poseidon2 hash, so this constructed a pair whose "public
key" was a hash of the public key. It did not throw; it produced a pair that was
simply wrong.
The public key is in `json.encoded`, still encrypted, and the pair is returned
*locked* with callers reading `pair.address` off it long before a password
appears. So it now passes an accountId — carried as data, used for the address
while locked, and checked against the real key once decodePkcs8 supplies one.
That check matters here as much as in the keyring: the address field sits outside
the encrypted blob, so a tampered one decodes cleanly and yields an account
displaying an address its key cannot sign for.
The 'ed25519' fallback for version-0 JSON is left alone. Those files predate the
crypto type being recorded and are by definition not Quantus, so the guess is
safe — but it is commented, because quantus/common#6 removes ed25519 from
KeypairType and this becomes a refusal.
Build plumbing, all of it dev-time only and all replaced by publishing these
packages to a registry (quantus/extension#2):
Resolutions point @polkadot/{keyring,util-crypto,networks,util} at the sibling
`common` checkout's build output, and @quantus/crypto at `wasm`.
tsconfig.base.json gains `*.d.ts` path mappings for them. Without these, node
resolves the portal symlink to its realpath and `@polkadot/util-crypto` then
resolves inside *common's* tree, where it is the workspace source directory with
no exports map — so EncryptedJson silently fails to resolve and KeyringPair$Json
loses `encoded` and `encoding`. The `*.d.ts` substitution has to come first
because NodeNext will not infer an extension for a bare path, and looks for a
`types` directory instead of `types.d.ts`.
tsconfig.json overrides those with the runtime `.js` view, because
@polkadot/dev-ts reads that file and would otherwise import a declaration file as
a module ("Debug Failure. Output generation failed"). tsc reads
tsconfig.build.json, which extends the base directly, so each gets the view it
needs.
The test script sets --preserve-symlinks, which yarn itself warns is required for
portals: without it the realpath problem above recurs at runtime.
Incidentally, `yarn lint` errors drop from 25 to 8 — resolving those types
removed a pile of `any`. The remaining 8 are upstream's own, in loadContract and
allowGenesis, and are left alone.
Refs quantus/ui#1
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
* chore: upgrade deps
* fix: correct capitalization of "Overview" in README
* fix: correct capitalization of "overview" in README
* fix: update typescript version in package.json and yarn.lock
* fix: downgrade typescript version to 5.5.4
