Accounts & keys

Seeds and keychains

import { generateSeed, keychainFromSeed } from 'arrekta-sdk'
 
const seed = generateSeed()                                  // random master seed
const keychain = keychainFromSeed(seed, { network: 'regtest' }) // scheme: ML-DSA-65 by default
 
keychain.address(0)        // 'rarrk1p…'  receive address #0
keychain.lock(0)           // its PUBKEY_HASH lock
keychain.key(0, 1)         // change key #0
keychain.signingKeys(20)   // the first 20 keys, for signing

Derivation is the wallet standard of §3.2: HMAC-SHA3-512, hardened-only paths m/9000'/0'/account'/change'/index'. Post-quantum keys have no extended public keys, so watch-only and multisig setups register each derived public key.

Single keys

import { privateKeyFromSeed } from 'arrekta-sdk'
 
const key = privateKeyFromSeed(seed32)          // 32-byte ML-DSA seed (FIPS 204 ξ)
key.publicKey                                   // scheme id ‖ raw public key
key.keyHash                                     // TH("pubkey", publicKey)
const sig = key.sign(message, 'ARRK-TX-v1')      // ML-DSA context string

ML-DSA-87 is available as an option (scheme) for higher security; ML-DSA-65 is the default.

Addresses

import { encodeAddress, decodeAddress } from 'arrekta-sdk'
 
const address = encodeAddress(lock, 'rarrk')
const lock2 = decodeAddress(address, 'rarrk')     // throws on a wrong prefix or checksum

Only bech32m is accepted. PUBKEY_HASH addresses start …1p, MULTISIG_HASH addresses …1z.

Coin addresses

Any coin can show the same account under its own ticker: the coin's ticker in lower case, then -t on testnet or -r on regtest (nothing on mainnet). A coin GOLD gives gold1…, gold-t1… and gold-r1…, all paying the same lock as the plain address. Every function that takes an address accepts both forms.

import { encodeCoinAddress, decodeCoinAddress, coinHrp } from 'arrekta-sdk'
 
const gold = encodeCoinAddress(lock, asset.ticker, 'regtest')   // 'gold-r1p…'
const { lock: same, ticker } = decodeCoinAddress(gold, 'regtest') // ticker 'GOLD'; null for a plain address
coinHrp('GOLD', 'testnet')                                        // 'gold-t'
encodeCoinAddress(lock, 'ARRK', 'regtest')                         // the plain 'rarrk1…'

The ticker is a label: the asset id decides what moves. Tickers are unique on chain, but a look-alike (MIC0 for MICO) is a different coin, so show the asset id. Wallets refuse to send one coin to an address tagged with another (ARRK is always accepted). Specification: §3.3.1.

Locks and policies

import { lockFromPublicKey, multisigLock, policyLock, htlc, vault, vesting } from 'arrekta-sdk'
 
lockFromPublicKey(pk)
multisigLock(2, [pkA, pkB, pkC])
policyLock(vault(primary, recovery, 720))

Policy builders: key, multi, after, older, sha3, and, or, thresh; templates htlc, vault, vesting. See Locks & policy locks.