build: declare @quantus/crypto as a ui-keyring dev dependency

The ML-DSA restore spec imports contextForSpec from it, and polkadot-dev's build refuses a package whose sources import something undeclared. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
feat!: ui-keyring holds post-quantum keys only
2026-09-16 21:13:56 +03:00 · 2026-09-16 21:13:01 +03:00 · 2026-09-15 14:15:02 +03:00 · 2026-09-15 11:28:03 +03:00 · 2026-09-15 11:08:43 +03:00 · 2026-09-15 10:40:52 +03:00
131 changed files with 405 additions and 277 deletions
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 module.exports = require('@polkadot/dev/config/prettier.cjs');
@@ -13,3 +13,11 @@ logFilters:
 nodeLinker: node-modules
 yarnPath: .yarn/releases/yarn-4.5.1.cjs
 # @quantus packages come from the Gitea registry — safe as a whole-scope route
 # because we own every name in it. The forked @polkadot packages cannot be routed
 # the same way (most of that scope is unforked and lives on npm), so they are
 # pinned to tarball URLs in package.json resolutions instead.
 npmScopes:
  quantus:
    npmRegistryServer: "https://git.lair.cafe/api/packages/quantus/npm/"
@@ -1,5 +1,20 @@
 # CHANGELOG
 ## 3.16.7 Mar 25, 2026
 Changes:
 - Bump common to 14.0.3 ([#860](https://github.com/polkadot-js/ui/pull/860))
 - Set headers for 2026 ([#859](https://github.com/polkadot-js/ui/pull/859))
 ## 3.16.6 Dec 10, 2025
 Changes:
 - Upgraded polkadot-js dependencies ([#855](https://github.com/polkadot-js/ui/pull/855))
 ## 3.16.5 Dec 10, 2025
 Changes:
@@ -1,6 +1,6 @@
     735	Jaco                          	Adjust Vue peerDependency, >= 2.7 for defineComponent (#782)
-      38	Tarik Gul                     	3.14.1 (#835)
+      41	Tarik Gul                     	3.16.7 (#861)
-      21	Arjun Porwal                  	3.16.5 (#856)
+      22	Arjun Porwal                  	3.16.6 (#857)
       7	YJ                            	fix #224: decrease frame size to 1024, set multipart bool (#225)
       4	Antoine Estienne              	Refactor logic to better use prefix (#491)
       4	kwingram25                    	fix ff api url issue (#289)
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import baseConfig from '@polkadot/dev/config/eslint';
@@ -14,10 +14,10 @@
  },
  "sideEffects": false,
  "type": "module",
-  "version": "3.16.5",
+  "version": "3.16.7",
  "versions": {
-    "git": "3.16.5",
+    "git": "3.16.7",
-    "npm": "3.16.5"
+    "npm": "3.16.7"
  },
  "workspaces": [
    "packages/*"
@@ -34,7 +34,7 @@
  },
  "devDependencies": {
    "@polkadot/dev": "^0.83.3",
-    "@polkadot/x-bundle": "^14.0.1",
+    "@polkadot/x-bundle": "^14.0.3",
    "@types/node": "^22.10.5",
    "react": "^18.2.0",
    "react-dom": "^18.2.0",
@@ -42,6 +42,9 @@
    "react-native": "^0.73.1"
  },
  "resolutions": {
    "@polkadot/keyring": "https://git.lair.cafe/api/packages/quantus/npm/%40polkadot%2Fkeyring/-/14.0.3-quantus.3/keyring-14.0.3-quantus.3.tgz",
    "@polkadot/networks": "https://git.lair.cafe/api/packages/quantus/npm/%40polkadot%2Fnetworks/-/14.0.3-quantus.3/networks-14.0.3-quantus.3.tgz",
    "@polkadot/util-crypto": "https://git.lair.cafe/api/packages/quantus/npm/%40polkadot%2Futil-crypto/-/14.0.3-quantus.3/util-crypto-14.0.3-quantus.3.tgz",
    "typescript": "5.5.4"
  }
 }
@@ -18,14 +18,14 @@
    "./packageDetect.cjs"
  ],
  "type": "module",
-  "version": "3.16.5",
+  "version": "3.16.7",
  "main": "index.js",
  "dependencies": {
-    "@polkadot/keyring": "^14.0.1",
+    "@polkadot/keyring": "^14.0.3",
-    "@polkadot/ui-settings": "3.16.5",
+    "@polkadot/ui-settings": "3.16.7",
-    "@polkadot/ui-shared": "3.16.5",
+    "@polkadot/ui-shared": "3.16.7",
-    "@polkadot/util": "^14.0.1",
+    "@polkadot/util": "^14.0.3",
-    "@polkadot/util-crypto": "^14.0.1",
+    "@polkadot/util-crypto": "^14.0.3",
    "ethereum-blockies-base64": "^1.0.2",
    "jdenticon": "3.2.0",
    "react-copy-to-clipboard": "^5.1.0",
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Prefix } from '@polkadot/util-crypto/address/types';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 export * from './icons/index.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Props } from '../types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Props } from '../types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Props } from '../types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Props } from '../types.js';
@@ -1,4 +1,4 @@
-// Copyright 2018-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2018-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2018 Paritytech via paritytech/oo7/polkadot-identicon
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 export { Beachball } from './Beachball.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import './packageDetect.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Do not edit, auto-generated by @polkadot/dev
@@ -1,6 +1,6 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Do not edit, auto-generated by @polkadot/dev
-export const packageInfo = { name: '@polkadot/react-identicon', path: 'auto', type: 'auto', version: '3.16.5' };
+export const packageInfo = { name: '@polkadot/react-identicon', path: 'auto', type: 'auto', version: '3.16.7' };
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 export { styled } from 'styled-components';
@@ -1,4 +1,4 @@
-// Copyright 2018-2025 @polkadot/react-identicon authors & contributors
+// Copyright 2018-2026 @polkadot/react-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type React from 'react';
@@ -18,12 +18,12 @@
    "./packageDetect.cjs"
  ],
  "type": "module",
-  "version": "3.16.5",
+  "version": "3.16.7",
  "main": "index.js",
  "dependencies": {
-    "@polkadot/ui-settings": "3.16.5",
+    "@polkadot/ui-settings": "3.16.7",
-    "@polkadot/util": "^14.0.1",
+    "@polkadot/util": "^14.0.3",
-    "@polkadot/util-crypto": "^14.0.1",
+    "@polkadot/util-crypto": "^14.0.3",
    "@zxing/browser": "^0.1.5",
    "@zxing/library": "^0.21.2",
    "qrcode-generator": "^1.4.4",
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import React, { useEffect, useMemo, useRef, useState } from 'react';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import React, { useMemo } from 'react';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import React, { useMemo } from 'react';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { NetworkSpecsStruct } from '@polkadot/ui-settings/types';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import { BrowserQRCodeReader, type IScannerControls } from '@zxing/browser';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { HexString } from '@polkadot/util/types';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { HexString } from '@polkadot/util/types';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 export { QrDisplayAddress } from './DisplayAddress.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 export const ADDRESS_PREFIX = 'substrate';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import './packageDetect.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Do not edit, auto-generated by @polkadot/dev
@@ -1,6 +1,6 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Do not edit, auto-generated by @polkadot/dev
-export const packageInfo = { name: '@polkadot/react-qr', path: 'auto', type: 'auto', version: '3.16.5' };
+export const packageInfo = { name: '@polkadot/react-qr', path: 'auto', type: 'auto', version: '3.16.7' };
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import _qrcode from 'qrcode-generator';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 export { styled } from 'styled-components';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 /// <reference types="@polkadot/dev-test/globals.d.ts" />
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/react-qr authors & contributors
+// Copyright 2017-2026 @polkadot/react-qr authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import { isString, u8aConcat, u8aToU8a } from '@polkadot/util';
@@ -18,12 +18,12 @@
    "./packageDetect.cjs"
  ],
  "type": "module",
-  "version": "3.16.5",
+  "version": "3.16.7",
  "main": "index.js",
  "dependencies": {
-    "@polkadot/ui-shared": "3.16.5",
+    "@polkadot/ui-shared": "3.16.7",
-    "@polkadot/util": "^14.0.1",
+    "@polkadot/util": "^14.0.3",
-    "@polkadot/util-crypto": "^14.0.1",
+    "@polkadot/util-crypto": "^14.0.3",
    "react-native-svg": "^14.1.0",
    "tslib": "^2.8.1"
  },
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Prefix } from '@polkadot/util-crypto/address/types';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 export * from './icons/index.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Props } from '../types.js';
@@ -1,4 +1,4 @@
-// Copyright 2018-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2018-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Circle as CircleType } from '@polkadot/ui-shared/icons/types';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 export { default as Empty } from './Empty.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import './packageDetect.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Do not edit, auto-generated by @polkadot/dev
@@ -1,6 +1,6 @@
-// Copyright 2017-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2017-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Do not edit, auto-generated by @polkadot/dev
-export const packageInfo = { name: '@polkadot/reactnative-identicon', path: 'auto', type: 'auto', version: '3.16.5' };
+export const packageInfo = { name: '@polkadot/reactnative-identicon', path: 'auto', type: 'auto', version: '3.16.7' };
@@ -1,4 +1,4 @@
-// Copyright 2018-2025 @polkadot/reactnative-identicon authors & contributors
+// Copyright 2018-2026 @polkadot/reactnative-identicon authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 export interface Props {
@@ -17,19 +17,20 @@
    "./packageDetect.cjs"
  ],
  "type": "module",
-  "version": "3.16.5",
+  "version": "3.16.7-quantus.3",
  "main": "index.js",
  "dependencies": {
-    "@polkadot/keyring": "^14.0.1",
+    "@polkadot/keyring": "14.0.3-quantus.3",
-    "@polkadot/ui-settings": "3.16.5",
+    "@polkadot/ui-settings": "3.16.7",
-    "@polkadot/util": "^14.0.1",
+    "@polkadot/util": "^14.0.3",
-    "@polkadot/util-crypto": "^14.0.1",
+    "@polkadot/util-crypto": "14.0.3-quantus.3",
    "mkdirp": "^3.0.1",
    "rxjs": "^7.8.1",
    "store": "^2.0.12",
    "tslib": "^2.8.1"
  },
  "devDependencies": {
    "@quantus/crypto": "^0.3.0",
    "@types/mkdirp": "^2.0.0",
    "@types/store": "^2.0.5"
  },
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { KeyringInstance, KeyringPair } from '@polkadot/keyring/types';
@@ -125,8 +125,9 @@ export class Base {
      this.setDevMode(options.isDevelopment);
    }
-    // set Ethereum state
+    // Never Ethereum: the keyring holds only ML-DSA keys (quantus/common#6). Kept
-    this.#isEthereum = keyring.type === 'ethereum';
+    // as a property so callers written against upstream still read a boolean.
    this.#isEthereum = false;
    this.#keyring = keyring;
    this._genesisHash = options.genesisHash && (
@@ -0,0 +1,94 @@
 // Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 /// <reference types="@polkadot/dev-test/globals.d.ts" />
 import type { KeyringPair$Json } from '@polkadot/keyring/types';
 import { contextForSpec } from '@quantus/crypto';
 import { Keyring as BaseKeyring } from '@polkadot/keyring';
 import { dilithiumVerify } from '@polkadot/util-crypto';
 import { Keyring } from './Keyring.js';
 // crystal_alice, from the chain's dev genesis — a raw 32-byte seed straight into
 // ML-DSA-87 keygen. The address is what `quantus developer create-test-wallets`
 // prints, i.e. an independent implementation.
 const ALICE = 'qzk1Nxai3dZD9Cn5kwGcgL6mKxsfxwqdis7kDQJ52aJS2vSn7';
 const PASSWORD = 'not a good password';
 const MESSAGE = new Uint8Array([0x75, 0x69]);
 function backup (): KeyringPair$Json {
  const base = new BaseKeyring({ ss58Format: 189, type: 'dilithium87' });
  return base
    .addFromSeed(new Uint8Array(32), { name: 'crystal_alice' }, 'dilithium87')
    .toJson(PASSWORD);
 }
 // `loadAll` initialises `@polkadot/ui-settings`, which is a module singleton, so
 // it may be called once per *process* — not per instance. One keyring for the
 // whole file, loaded once.
 const uiKeyring = new Keyring();
 uiKeyring.loadAll({ ss58Format: 189, store: undefined, type: 'dilithium87' });
 describe('ui-keyring restoreAccount', (): void => {
  // Before the fix this constructed a pair whose "public key" was
  // decodeAddress(json.address) — i.e. a Poseidon2 hash of the public key, passed
  // off as the key itself. It did not throw; it produced a pair that was simply
  // wrong.
  it('restores an ML-DSA account to the right address', (): void => {
    const pair = uiKeyring.restoreAccount(backup(), PASSWORD);
    expect(pair.address).toEqual(ALICE);
    expect(pair.publicKey.length).toEqual(2592);
    expect(pair.addressRaw.length).toEqual(32);
  });
  it('restores an account that can sign for its own address', (): void => {
    const pair = uiKeyring.restoreAccount(backup(), PASSWORD);
    pair.decodePkcs8(PASSWORD);
    const context = contextForSpec(148);
    const signature = pair.sign(MESSAGE, { context });
    expect(dilithiumVerify(MESSAGE, signature, pair.addressRaw, 'dilithium87', context)).toEqual(true);
  });
  it('fails on a wrong password without half-restoring', (): void => {
    expect(() => uiKeyring.restoreAccount(backup(), 'wrong')).toThrow();
  });
  // The address field sits outside the encrypted blob. For the curve schemes a
  // tampered one cannot decode at all; here it decodes cleanly and would yield an
  // account displaying an address its key does not control.
  it('rejects JSON whose address does not match its key', (): void => {
    const base = new BaseKeyring({ ss58Format: 189, type: 'dilithium87' });
    const other = base.addFromSeed(new Uint8Array(32).fill(3), {}, 'dilithium87');
    expect(() => uiKeyring.restoreAccount({ ...backup(), address: other.address }, PASSWORD)).toThrow(/does not match the address/);
  });
  // quantus/common#6: a backup of a quantum-unsafe key is refused with the
  // reason, not decoded. This is the JSON a polkadot{.js} export of an ed25519
  // account carries.
  it('refuses a polkadot{.js} backup of a quantum-unsafe key, saying why', (): void => {
    const json = {
      address: '5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY',
      encoded: '0x00',
      encoding: { content: ['pkcs8', 'sr25519'], type: ['scrypt', 'xsalsa20-poly1305'], version: '3' },
      meta: { name: 'polkadot account' }
    } as unknown as KeyringPair$Json;
    expect(() => uiKeyring.restoreAccount(json, PASSWORD)).toThrow(/sr25519 keys are not quantum-safe and cannot be held here/);
  });
  it('refuses a file that does not record its key type', (): void => {
    const json = { ...backup(), encoding: { content: 'pkcs8', type: 'none', version: '0' } } as unknown as KeyringPair$Json;
    expect(() => uiKeyring.restoreAccount(json, PASSWORD)).toThrow(/does not record its key type/);
  });
 });
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { KeyringPair, KeyringPair$Json, KeyringPair$Meta } from '@polkadot/keyring/types';
@@ -8,10 +8,9 @@ import type { KeypairType } from '@polkadot/util-crypto/types';
 import type { AddressSubject, SingleAddress } from './observable/types.js';
 import type { CreateResult, KeyringAddress, KeyringAddressType, KeyringItemType, KeyringJson, KeyringJson$Meta, KeyringOptions, KeyringPairs$Json, KeyringStruct } from './types.js';
 import { createPair } from '@polkadot/keyring';
 import { chains } from '@polkadot/ui-settings';
 import { bnToBn, hexToU8a, isFunction, isHex, isString, objectSpread, stringify, stringToU8a, u8aSorted, u8aToString } from '@polkadot/util';
-import { base64Decode, createKeyMulti, jsonDecrypt, jsonEncrypt } from '@polkadot/util-crypto';
+import { createKeyMulti, jsonDecrypt, jsonEncrypt } from '@polkadot/util-crypto';
 import { env } from './observable/env.js';
 import { KeyringOption } from './options/index.js';
@@ -21,7 +20,7 @@ import { accountKey, accountRegex, addressKey, addressRegex, contractKey, contra
 const RECENT_EXPIRY = 24 * 60 * 60;
 // No accounts (or test accounts) should be loaded until after the chain determination.
-// Chain determination occurs outside of Keyring. Loading `keyring.loadAll({ type: 'ed25519' | 'sr25519' })` is triggered
+// Chain determination occurs outside of Keyring. Loading `keyring.loadAll({ type: 'dilithium65' | 'dilithium87' })` is triggered
 // from the API after the chain is received
 export class Keyring extends Base implements KeyringStruct {
  public readonly keyringOption = new KeyringOption();
@@ -327,15 +326,18 @@ export class Keyring extends Base implements KeyringStruct {
  }
  public restoreAccount (json: KeyringPair$Json, password: string): KeyringPair {
-    const cryptoType = Array.isArray(json.encoding.content) ? json.encoding.content[1] : 'ed25519';
+    // Version-0 JSON predates recording the key type, so it cannot be an ML-DSA
-    const encType = Array.isArray(json.encoding.type) ? json.encoding.type : [json.encoding.type];
+    // account. Upstream guessed ed25519; this keyring cannot hold one.
-    const pair = createPair(
+    if (!Array.isArray(json.encoding.content)) {
-      { toSS58: this.encodeAddress, type: cryptoType as KeypairType },
+      throw new Error('This account file does not record its key type, so it is not an ML-DSA account and cannot be restored here');
-      { publicKey: this.decodeAddress(json.address, true) },
+    }
-      json.meta,
+
-      isHex(json.encoded) ? hexToU8a(json.encoded) : base64Decode(json.encoded),
+    // Through the keyring rather than createPair directly, so a restore gets the
-      encType
+    // same refusal as every other entry point: a polkadot{.js} backup of an
-    );
+    // sr25519 or ed25519 account is told it is not quantum-safe, not decoded.
    // createFromJson also carries the address as an account id until the real
    // public key is decrypted, and checks the two agree when it is.
    const pair = this.keyring.createFromJson(json, true);
    // unlock, save account and then lock (locking cleans secretKey, so needs to be last)
    pair.decodePkcs8(password);
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import { Keyring } from './Keyring.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import { decodeAddress } from '@polkadot/keyring';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import './packageDetect.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Be able to import json in TS
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import { accountKey } from '../defaults.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import { addressKey } from '../defaults.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import { contractKey } from '../defaults.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import { BehaviorSubject } from 'rxjs';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { KeypairType } from '@polkadot/util-crypto/types';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { SubjectInfo } from './types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { BehaviorSubject } from 'rxjs';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Subscription } from 'rxjs';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { KeyringSectionOption } from './types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { KeyringItemType, KeyringStruct } from '../types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Do not edit, auto-generated by @polkadot/dev
@@ -1,6 +1,6 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Do not edit, auto-generated by @polkadot/dev
-export const packageInfo = { name: '@polkadot/ui-keyring', path: 'auto', type: 'auto', version: '3.16.5' };
+export const packageInfo = { name: '@polkadot/ui-keyring', path: 'auto', type: 'auto', version: '3.16.7-quantus.3' };
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { KeyringJson, KeyringStore } from '../types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { KeyringJson, KeyringStore } from '../types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 export { BrowserStore } from './Browser.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-keyring authors & contributors
+// Copyright 2017-2026 @polkadot/ui-keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { KeyringInstance as BaseKeyringInstance, KeyringOptions as KeyringOptionsBase, KeyringPair, KeyringPair$Json, KeyringPair$Meta } from '@polkadot/keyring/types';
@@ -18,11 +18,11 @@
    "./packageDetect.cjs"
  ],
  "type": "module",
-  "version": "3.16.5",
+  "version": "3.16.7",
  "main": "index.js",
  "dependencies": {
-    "@polkadot/networks": "^14.0.1",
+    "@polkadot/networks": "^14.0.3",
-    "@polkadot/util": "^14.0.1",
+    "@polkadot/util": "^14.0.3",
    "eventemitter3": "^5.0.1",
    "store": "^2.0.12",
    "tslib": "^2.8.1"
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Endpoint, EndpointType, Option, SettingsStruct } from './types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import { Settings, settings } from './Settings.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import { selectableNetworks } from '@polkadot/networks';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Option } from '../types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Option } from '../types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Option } from '../types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Option } from '../types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Option } from '../types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // matches https://polkadot.js.org & https://*.polkadot.io
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Option } from '../types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import { settings } from './bundle.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Do not edit, auto-generated by @polkadot/dev
@@ -1,6 +1,6 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Do not edit, auto-generated by @polkadot/dev
-export const packageInfo = { name: '@polkadot/ui-settings', path: 'auto', type: 'auto', version: '3.16.5' };
+export const packageInfo = { name: '@polkadot/ui-settings', path: 'auto', type: 'auto', version: '3.16.7' };
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-settings authors & contributors
+// Copyright 2017-2026 @polkadot/ui-settings authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 export interface Option {
@@ -18,15 +18,15 @@
    "./packageDetect.cjs"
  ],
  "type": "module",
-  "version": "3.16.5",
+  "version": "3.16.7",
  "main": "index.js",
  "dependencies": {
    "colord": "^2.9.3",
    "tslib": "^2.8.1"
  },
  "devDependencies": {
-    "@polkadot/util": "^14.0.1",
+    "@polkadot/util": "^14.0.3",
-    "@polkadot/util-crypto": "^14.0.1",
+    "@polkadot/util-crypto": "^14.0.3",
    "@types/xmlserializer": "^0.6.6",
    "xmlserializer": "^0.6.1"
  },
@@ -1,4 +1,4 @@
-// Copyright 2018-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2018-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 export * from './icons/index.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 /// <reference types="@polkadot/dev-test/globals.d.ts" />
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2016 Dan Finlay
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 /// <reference types="@polkadot/dev-test/globals.d.ts" />
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2016 Dan Finlay
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2016 Dan Finlay
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2016 Dan Finlay
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 /// <reference types="@polkadot/dev-test/globals.d.ts" />
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2016 Dan Finlay
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 /// <reference types="@polkadot/dev-test/globals.d.ts" />
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 import type { Seeder } from './types.js';
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 /// <reference types="@polkadot/dev-test/globals.d.ts" />
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @polkadot/ui-shared authors & contributors
+// Copyright 2017-2026 @polkadot/ui-shared authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2016 Dan Finlay
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
grenadeandClaude Opus 5	160d97c19b	build: declare @quantus/crypto as a ui-keyring dev dependency Lock Threads / lock (push) Has been cancelled Details The ML-DSA restore spec imports contextForSpec from it, and polkadot-dev's build refuses a package whose sources import something undeclared. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f	2026-09-16 21:13:56 +03:00
grenadeandClaude Opus 5	c7c23b7958	feat!: ui-keyring holds post-quantum keys only Follows quantus/common#6, which removed ed25519, sr25519, ecdsa and ethereum from the keyring (forks at 14.0.3-quantus.3). - restoreAccount now goes through keyring.createFromJson instead of building the pair itself. A restored backup therefore gets the same refusal as every other entry point: a polkadot{.js} export of an sr25519 or ed25519 account is told "<type> keys are not quantum-safe and cannot be held here", not decoded. - Version-0 JSON, which does not record its key type and so cannot be ML-DSA, is refused. Upstream guessed ed25519. - isEthereum is always false; it's kept so callers written against upstream still read a boolean. - loadAll already skips, with a warning, any stored account the keyring refuses, so a profile holding an old classical account still starts. The spec that pinned sr25519 restore as unchanged is replaced by the two refusals. ui-keyring 3.16.7-quantus.3, on the quantus.3 forks. yarn test 47 passing; lint clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f	2026-09-16 21:13:01 +03:00
grenadeandClaude Opus 5	2d6a9ad1b3	build: consume the forks at 14.0.3-quantus.2 Lock Threads / lock (push) Has been cancelled Details Picks up the networks fix (the quantum-safe gate moving out of the library list, which made @polkadot/api importable again) and Heisenberg's corrected HEI symbol. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f	2026-09-15 14:15:02 +03:00
rob thijssenandClaude Opus 5	18105d3ced	build: pin the forked packages at 14.0.3-quantus.1 Follows the rename in quantus/common. The point is not tidiness: with the forks numbered 14.0.3, a missing resolution here would have been satisfied from npm by the unforked upstream package, installing cleanly and silently dropping Quantus support. Now it fails with "No candidates found" — verified by removing the @polkadot/networks resolution and running an install. Refs quantus/extension#2 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f	2026-09-15 11:28:03 +03:00
rob thijssenandClaude Opus 5	f2a1ab3a72	build: consume the forked @polkadot packages from the registry, drop the scaffolding Removes every workaround the symlink approach needed, and reverts tsconfig to upstream's exactly. The three forked packages — @polkadot/{networks,util-crypto,keyring} — are now pinned to Gitea tarball URLs in resolutions. @polkadot/util is not, because this fork does not modify it; it comes from npm like the rest of the scope. Tarball URLs rather than routing the @polkadot scope to Gitea, because the scope is mostly not forked: routing it would send yarn looking for dozens of packages that are not there. @quantus is routed as a whole scope in .yarnrc.yml, which is safe because we own every name in it. Four things go away, all of which existed for one reason — node resolves a portal or link symlink to its realpath, after which @polkadot/util-crypto resolved inside common's tree, where it is a workspace source directory with no exports map: - resolutions pointing four packages at ../common/packages//build - tsconfig.base.json `.d.ts` path mappings, needed because NodeNext will not infer an extension for a bare path and looked for a `types` directory - tsconfig.json overriding those with a runtime `.js` view, because @polkadot/dev-ts reads that file and tried to import a declaration file as a module - --preserve-symlinks in the test scripts Also drops fflate and @quantus/crypto from ui-keyring's devDependencies; they were there only because `link:` does not install its target's dependencies. `yarn lint` now reports 0 errors, down from 25 on pristine upstream. Those were no-unsafe-assignment and no-unsafe-argument on values that were `any` purely because the types did not resolve. Refs quantus/extension#2, quantus/ui#1 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f	2026-09-15 11:08:43 +03:00
rob thijssenandClaude Opus 5	ec1399f3f3	fix(ui-keyring): restoreAccount cannot rebuild an ML-DSA public key from an address The mirror of the same mistake in keyring.createFromJson, fixed the same way. restoreAccount passed `decodeAddress(json.address)` as the public key. For the curve schemes that is correct — the address is the public key. An ML-DSA account id is a one-way Poseidon2 hash, so this constructed a pair whose "public key" was a hash of the public key. It did not throw; it produced a pair that was simply wrong. The public key is in `json.encoded`, still encrypted, and the pair is returned locked with callers reading `pair.address` off it long before a password appears. So it now passes an accountId — carried as data, used for the address while locked, and checked against the real key once decodePkcs8 supplies one. That check matters here as much as in the keyring: the address field sits outside the encrypted blob, so a tampered one decodes cleanly and yields an account displaying an address its key cannot sign for. The 'ed25519' fallback for version-0 JSON is left alone. Those files predate the crypto type being recorded and are by definition not Quantus, so the guess is safe — but it is commented, because quantus/common#6 removes ed25519 from KeypairType and this becomes a refusal. Build plumbing, all of it dev-time only and all replaced by publishing these packages to a registry (quantus/extension#2): Resolutions point @polkadot/{keyring,util-crypto,networks,util} at the sibling `common` checkout's build output, and @quantus/crypto at `wasm`. tsconfig.base.json gains `.d.ts` path mappings for them. Without these, node resolves the portal symlink to its realpath and `@polkadot/util-crypto` then resolves inside common's* tree, where it is the workspace source directory with no exports map — so EncryptedJson silently fails to resolve and KeyringPair$Json loses `encoded` and `encoding`. The `*.d.ts` substitution has to come first because NodeNext will not infer an extension for a bare path, and looks for a `types` directory instead of `types.d.ts`. tsconfig.json overrides those with the runtime `.js` view, because @polkadot/dev-ts reads that file and would otherwise import a declaration file as a module ("Debug Failure. Output generation failed"). tsc reads tsconfig.build.json, which extends the base directly, so each gets the view it needs. The test script sets --preserve-symlinks, which yarn itself warns is required for portals: without it the realpath problem above recurs at runtime. Incidentally, `yarn lint` errors drop from 25 to 8 — resolving those types removed a pile of `any`. The remaining 8 are upstream's own, in loadContract and allowGenesis, and are left alone. Refs quantus/ui#1 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f	2026-09-15 10:40:52 +03:00
github-actions[bot]	1d667d4dc0	[CI Skip] release/stable 3.16.7 Lock Threads / lock (push) Has been cancelled Details skip-checks: true	2026-03-26 19:24:07 +00:00
Tarik Gul	c60975d532	3.16.7 (#861 ) * 3.16.7 * Update Changelog	2026-03-26 21:22:47 +02:00
github-actions[bot]	816d22019b	[CI Skip] bump/beta 3.16.7-1-x skip-checks: true	2026-03-26 13:29:51 +00:00
Tarik Gul	ddca14ece2	Bump common to 14.0.3 (#860 )	2026-03-26 15:28:34 +02:00
github-actions[bot]	f5e26741da	[CI Skip] bump/beta 3.16.7-0-x skip-checks: true	2026-03-13 13:57:53 +00:00
Tarik Gul	c5ab15118d	Set headers for 2026 (#859 ) * Set headers for 2026 * remaining headers	2026-03-13 15:56:35 +02:00
github-actions[bot]	2e00b6e4e4	[CI Skip] release/stable 3.16.6 skip-checks: true	2025-12-10 06:42:02 +00:00
Arjun Porwal	8b483c6a1a	3.16.6 (#857 )	2025-12-10 12:10:43 +05:30