era_connect library
Air-gapped ERA hardware wallet SDK: account linking and transaction signing over animated QR codes (BC-UR / Keystone-compatible registry).
The root library carries the EraConnect facade, the linking layer and
the QR transport. Per-chain modules are also importable on their own
(package:era_connect/evm.dart, .../bch.dart, ...), and the
verification helpers live in package:era_connect/verify.dart so their
curve arithmetic is only linked by apps that use it (do).
Classes
- AccountKey
- One exported account key, as the wallet list surfaces it.
- AnimatedUr
- Frame source for rendering a UR as an animated QR.
- AnimatedUrOptions
- Options for AnimatedUr.
- BchAccountView
-
Bitcoin Cash view:
m/44'/145'/0', CashAddr P2PKH addresses. - BchChain
-
Bitcoin Cash signing rides the structured
keystone-sign-request(6101) envelope, NOT the PSBT path: the device's PSBT signer cannot apply theSIGHASH_FORKID(0x41) sighash BCH consensus requires, so a dedicated FORKID signer sits behind this envelope instead. The SDK therefore builds the transaction container from structured inputs/outputs here — the one chain where it is more than a transport. - BchSignatureResult
-
A parsed
keystone-sign-resultreply. - BchSignRequestProps
- Inputs for BchChain.generateSignRequest.
- BchTxInput
- One UTXO the transaction spends. P2PKH only — that is what the device signs.
- BchTxOutput
- One output of a BCH sign request.
- BtcAccountView
-
Bitcoin view over one exported account. The default is the BIP-84
native-segwit account; pass
purposeto reach the other script types the device exports (44 = legacy P2PKH, 49 = nested segwit, 84 = native segwit, 86 = taproot). Which of those can sign MESSAGES depends on the firmware: 2.1.0+ signs 44/49/84 and refuses Taproot, older firmware signs legacy P2PKH alone. - BtcChain
- The Bitcoin-family chain module: PSBTs and BIP-137 message signing.
- BtcDataType
-
CBOR
dataTypevalues forbtc-sign-request. - BtcMessageSignatureResult
-
A parsed
btc-signaturereply. - BtcMessageSignRequestProps
- Inputs for BtcChain.generateMessageSignRequest.
- BtcPsbtResult
-
A parsed
crypto-psbt/crypto-psbt-extendreply. - BtcPsbtSignRequestProps
- Inputs for BtcChain.generatePsbtSignRequest.
- CardanoAccountView
-
Cardano view (CIP-1852): the exported account key supports SOFT public
derivation (BIP32-Ed25519), so payment (
0/i), change (1/i) and stake (2/0) verification keys derive locally. Bech32 ADDRESS assembly is left to Cardano tooling — deriveKey hands you the raw vkeys it needs. - CardanoCertKeyRef
- A certificate/withdrawal key the transaction additionally needs a witness from.
- CardanoChain
-
The Cardano chain module:
cardano-sign-requestout,cardano-signatureback. - CardanoSignatureResult
-
A parsed
cardano-signaturereply. - CardanoSignRequestProps
- Inputs for CardanoChain.generateSignRequest.
- CardanoUtxoRef
- One transaction input the device must sign for.
- CardanoWitness
-
One
[vkey, signature]pair from the reply's witness set. - CashAddrPayload
- A decoded CashAddr: script kind, hash160 and the prefix it carried.
- ChainContext
- Resolved SDK configuration handed to every chain module.
- CosmosAccountView
-
Cosmos view (
m/44'/118'/0'): one secp256k1 account key, addresses derived at0/index. The bech32 PREFIX is the caller's — every zone spends the same key under its own HRP (cosmos,osmo,celestia, ...), so there is no correct default and deriveAddress requires one. - CosmosChain
- Cosmos-SDK zones (and their Ethermint cousins) over the ERA wire.
- CosmosDataType
-
cosmos-sign-requestdataType (CBOR key 3). - CosmosSignatureResult
-
A parsed
cosmos-signature/evm-signaturereply. - CosmosSignRequestProps
- Props for CosmosChain.generateSignRequest.
- DeviceInfo
- Device metadata carried by the wallet export.
- DeviceProfile
- Timing/size constants of the device's own QR pipeline, for progress UI and timeouts.
- EraAccounts
-
The linked wallet: everything a software wallet extracts from the device's
crypto-multi-accountsQR. Parse once, store the source UR string, derive addresses locally — the device is not needed again until signing. - EraConnect
- The SDK facade: one instance per app, chain modules as lazy getters.
- EraConnectConfig
- SDK configuration. Everything is optional; the SDK performs NO network I/O ever.
- EthermintSignRequestProps
-
Ethermint-family chains (Injective, Evmos, Dymension, …) sign with
keccak-256 over Ethereum-style keys (
m/44'/60'/...) and travel as anevm-sign-requestinstead. - EvmAccountView
-
EVM view over the linked wallet: one account xpub, addresses derived at
0/index. - EvmChain
-
The EVM chain module:
eth-sign-requestout,eth-signatureback. - EvmDataType
-
eth-sign-requestdataType (CBOR key 3). - EvmSignatureResult
-
A parsed
eth-signaturereply. - EvmSignRequestProps
- Properties of an EVM sign request.
- ExpectedReply
- Optional expectations when parsing a reply standalone (outside SignRequest.scanner).
- HardwareCallRequest
- The pull-model linking request: display it, then scan the device's account export back.
- KeyDerivationCallProps
- Properties of a key-derivation hardware call.
- KeyDerivationSchema
- One derivation path the wallet asks the device to export.
- PathLevel
-
One BIP-32 derivation level: child index plus the hardened flag (
'). - QrLegProfile
- One direction of the QR pipeline.
- RawAccountEntry
-
Raw account entry parsed from a
crypto-multi-accounts(1103) export. - RawModule
-
Escape hatch for UR types this SDK has no dedicated module for (future
chains, custom registry items). You bring the CBOR; the SDK brings the UR
plumbing, fountain frames and the hardened scanner
(
EraConnect.scanner(expectedTypes: ...)). - RawMultiAccounts
- The decoded wallet export: master fingerprint, device metadata and the account entries.
- ScanComplete
- The scan is complete; ur is the assembled UR.
- ScanDuplicate
- A frame already seen this session (camera framerate re-reads).
- ScanFeedResult
- One outcome of feeding a frame to UrScanner.receivePart.
- ScanProgress
- The frame was consumed; the scan is not complete yet.
- ScanRejected
- The frame was turned away; see rejection.
- ScanRejection
- Why a scanned frame was turned away.
- SignedTronTx
-
The two halves of a signed Tron network
Transactionframe. -
SignRequest<
TResult> - A built sign request: the UR to display plus everything needed to consume the reply. The request id is minted at CONSTRUCTION so the same object that renders the QR also validates the echo — a reply carrying a different id (from an earlier, cancelled flow re-presented to the camera) is refused instead of accepted.
- SolanaAccountView
-
Solana view: Ed25519 has no public child derivation, so the device
pre-derives hardened accounts (
m/44'/501'/idx') and each entry IS a signer. The public key, base58, IS the address. - SolanaChain
-
The Solana chain module:
sol-sign-requestout,sol-signatureback. - SolSignatureResult
-
A parsed
sol-signaturereply. - SolSignRequestProps
- Inputs for SolanaChain.generateSignRequest.
- SolSignType
-
sol-sign-requestsignType (CBOR key 7). - SuiAccountView
- Sui view: like Solana, each fully-hardened exported entry IS a signer.
- SuiChain
- Sui signing over the ERA UR protocol.
- SuiSignatureResult
-
A parsed
sui-signaturereply. - SuiSignHashRequestProps
- Props for SuiChain.generateSignHashRequest.
- SuiSignRequestProps
- Props for SuiChain.generateSignRequest.
- TonAccountView
-
TON view: one Ed25519 key per account (
m/44'/607'/0'), shared by the V4R2 and V5R1 wallet contracts — the contract version affects only the ADDRESS, which this SDK leaves to TON tooling (derive it from publicKey with your TON library). - TonChain
-
TON:
ton-sign-request(7201) /ton-signature(7202). - TonDataType
-
ton-sign-requestdataType (CBOR key 3). - TonSignatureResult
-
A parsed
ton-signaturereply. - TonSignRequestProps
- Properties for TonChain.generateSignRequest.
- TronAccountView
-
Tron view: addresses derived at
0/index. - TronChain
-
Tron signing rides the structured
keystone-sign-request(6101) envelope — a gzip-compressed protobuf inside CBOR{1: gzip(protobuf), 2: origin}. The registry's generictron-sign-request(5101) is NOT accepted by the device and gets no response; do not emit it. - TronLatestBlock
- A live now-block anchor for a Tron transaction.
- TronSignatureResult
-
A parsed
keystone-sign-resultreply. - TronSignDisplay
- On-device display metadata for a Tron sign request.
- TronSignRequestProps
- Inputs for TronChain.generateSignRequest.
-
TypedUrScanner<
TResult> - A scanner whose completed UR parses into a typed result (a chain signature).
- Ur
- An immutable Uniform Resource: a registry type string plus its CBOR payload.
- UrLimits
- Bounds every field a scanned UR fragment can dictate, BEFORE that field is allowed to size an allocation or a loop.
- UrScanner
- Accumulates camera frames into a UR. Synchronous and non-throwing on the feed path (safe to call from camera callbacks); malformed frames come back as typed rejections, never exceptions.
- UrScannerOptions
- Options for UrScanner.
- XrpAccountView
-
XRP view (
m/44'/144'/0'). The device signs with ONE key — the address at0/0— so signingPath names it, and the hex ofderivePublicKey(0)is what an unsigned transaction'sSigningPubKeymust carry. pathFor is there for wallets that scan further addresses of the same account. - XrpChain
- XRP signing over the ERA UR protocol.
- XrpSignatureResult
-
A parsed
ur:bytesreply. - XrpSignRequestProps
-
XRP rides the XRP Toolkit convention: an untyped
ur:byteswhose CBOR payload is the transaction JSON (request) or the canonical signed XRPL binary (reply). There is NO request id and NO chain-specific UR type — the content itself is the only binding, which is whyverifyXrpSignature(from the verify library) is not optional on this chain.
Enums
- AccountChain
- Chain family of an exported account, matched by its derivation path — never by the note label.
- CashAddrType
- The two script kinds the device builds outputs for.
- DerivationAlgorithm
- The derivation algorithm a schema requests.
- DerivationCurve
- The curve a derivation schema requests.
- PsbtCoin
-
Bitcoin-family coins the PSBT path signs for (BCH rides its own FORKID
envelope: the
bchmodule).
Constants
- cashaddrPrefix → const String
- The default (mainnet) human-readable prefix.
- defaultFragmentLength → const int
- Default payload bytes per animated-QR fragment.
Functions
-
bchAddressFromPublicKey(
Uint8List publicKey33, {bool? withPrefix}) → String - CashAddr P2PKH address (Bitcoin Cash) from a compressed public key.
-
btcNestedSegwitAddressFromPublicKey(
Uint8List publicKey33, [bool testnet = false]) → String -
Nested segwit (P2SH-P2WPKH) base58check address (
3...). -
btcP2pkhAddressFromPublicKey(
Uint8List publicKey33, [bool testnet = false]) → String -
Legacy P2PKH base58check address (
1...). -
btcP2wpkhAddressFromPublicKey(
Uint8List publicKey33, [String hrp = 'bc']) → String - P2WPKH (witness v0) bech32 address.
-
cosmosAddressFromPublicKey(
Uint8List publicKey33, String prefix) → String -
Cosmos bech32 address: plain bech32 of the 20-byte hash160, with NO
witness-version prefix (that is a segwit thing, not a Cosmos one). Every
zone carries its own HRP over the same key, so
prefixis the caller's. -
decodeCashAddr(
String address, [String expectedPrefix = cashaddrPrefix]) → CashAddrPayload -
Decode a CashAddr, with or without its
prefix:. Only 20-byte P2PKH and P2SH payloads are accepted — those are the two script kinds the device builds outputs for. -
encodeCashAddr(
CashAddrType type, Uint8List hash, {String? prefix, bool? withPrefix}) → String - Encode a 20-byte hash160 as a CashAddr. Returns the bare form by default.
-
evmAddressFromPublicKey(
Uint8List publicKey33) → String - EIP-55 checksummed address from a compressed secp256k1 public key.
-
foldRecoveryId(
BigInt v) → int -
Fold parity / 27-28 / EIP-155 forms of
vto a 0/1 recovery id. -
formatPath(
List< PathLevel> levels) → String -
Render levels back into an
m/...path string. -
parsePath(
String path) → List< PathLevel> -
Parse
m/44'/60'/0'/0/5into levels. Throwsinvalid-propson anything else. -
parseWitnessSet(
Uint8List witnessSet) → List< CardanoWitness> -
[vkey, signature]pairs from a witness-set CBOR{0: #6.258([...])}(the set tag is optional). -
resolveContext(
[EraConnectConfig? config]) → ChainContext - Resolve a (possibly absent) config into the context chain modules consume.
-
solanaAddressFromPublicKey(
Uint8List publicKey32) → String - A Solana address IS the Ed25519 public key, base58.
-
splitSignedTronTx(
String rawTxHex) → SignedTronTx -
Split a signed Tron network
Transactionframe ({1: raw_data, 2: signature*}) from the reply'srawTxhex. Top-level fields must be length-delimited — anything else is not a transaction frame. -
suiAddressFromPublicKey(
Uint8List publicKey32) → String -
0xSui address: BLAKE2b-256 of the scheme flag (0x00 = Ed25519) plus the public key. -
suiIntentDigest(
Uint8List intentMessage) → Uint8List -
BLAKE2b-256 of the intent message — the digest the device signs for
sui-sign-request. -
tronAddressFromPublicKey(
Uint8List publicKey33) → String - Tron base58check address (0x41-prefixed keccak hash).
-
xrpAddressFromPublicKey(
Uint8List publicKey33) → String -
XRP classic address (
r...): base58check over0x00 || hash160(pubkey), with Bitcoin's double-SHA-256 checksum but XRPL's own base58 dictionary.base58CheckEncodeis hard-wired to the Bitcoin alphabet, so the four checksum bytes are appended explicitly here.
Typedefs
- BtcPurpose = int
- The BIP purpose values a Bitcoin export may carry (44, 49, 84 or 86).
- RandomBytesFn = Uint8List Function(int length)
-
A caller-supplied CSPRNG. Must return exactly
lengthbytes.
Exceptions / Errors
- EraSdkError
- Every error thrown by this SDK.