APPLICATIONS.md (2)

83-83: Prefer descriptive link text over raw URLs.

Improves readability and accessibility.

Apply this diff:

-  Joey Wallet is a secure, self-custody cryptocurrency wallet and gateway to Web3 decentralized applications (dApps) on the XRP Ledger (XRPL). Documentation and integration details are located at [https://docs.joeywallet.xyz/](https://docs.joeywallet.xyz).
+  Joey Wallet is a secure, self-custody cryptocurrency wallet and gateway to Web3 decentralized applications (dApps) on the XRP Ledger (XRPL). Documentation: [Joey Wallet Docs](https://docs.joeywallet.xyz).

-  Crossmark is a browser-first, self-custodial wallet built for interacting with the XRP Ledger. Send, receive, create value with ease. Documentation can be found at [https://docs.crossmark.io/](https://docs.crossmark.io/).
+  Crossmark is a browser-first, self-custodial wallet for interacting with the XRP Ledger. Documentation: [Crossmark Docs](https://docs.crossmark.io/).

Also applies to: 87-87

---

81-88: Optional: consider alphabetical ordering within the Wallets list.

If the section intends alphabetical order, place “Crossmark” and “Joey Wallet” accordingly.

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

packages/ripple-keypairs/src/index.ts (1)

98-109: Consider using existing getSigningScheme helper to simplify.

The function duplicates the algorithm-to-scheme mapping that already exists in getSigningScheme (lines 23-26). This would also eliminate the unreachable throw statement.

♻️ Proposed simplification

 function derivePublicKey(privateKey: string): string {
   const algorithm = getAlgorithmFromPrivateKey(privateKey)
-
-  if (algorithm === 'ecdsa-secp256k1') {
-    return secp256k1.deriveKeypairFromPrivateKey(privateKey).publicKey
-  }
-  // eslint-disable-next-line `@typescript-eslint/no-unnecessary-condition`
-  if (algorithm === 'ed25519') {
-    return ed25519.deriveKeypairFromPrivateKey(privateKey).publicKey
-  }
-  throw new Error('Unknown signing scheme algorithm')
+  return getSigningScheme(algorithm).deriveKeypairFromPrivateKey(privateKey).publicKey
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/ripple-keypairs/src/index.ts` around lines 98 - 109, derivePublicKey
duplicates algorithm detection; replace its use of getAlgorithmFromPrivateKey
with the existing getSigningScheme(privateKey) helper, then branch on the
returned signing scheme (e.g., 'ecdsa-secp256k1' vs 'ed25519') to call
secp256k1.deriveKeypairFromPrivateKey(...) or
ed25519.deriveKeypairFromPrivateKey(...) and return .publicKey; this reuses
getSigningScheme, removes duplicated mapping and makes the final throw
unreachable so it can be eliminated or reduced to a defensive assertion if
desired.

packages/xrpl/test/wallet/index.test.ts (4)

440-440: Inconsistent naming: use fromPrivateKey without space.

Other test suites use method names directly: fromSeed, fromSecret, fromMnemonic, fromEntropy. This should be fromPrivateKey (no space) for consistency.

♻️ Suggested fix

-  describe('from PrivateKey', function () {
+  describe('fromPrivateKey', function () {

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/xrpl/test/wallet/index.test.ts` at line 440, The test suite title is
using "from PrivateKey" with a space but should be consistent with other suites;
update the describe block that currently reads "from PrivateKey" to
"fromPrivateKey" so it matches the method naming style used by other tests
(e.g., fromSeed, fromSecret, fromMnemonic, fromEntropy) and ensures consistency
with the tested function name fromPrivateKey.

---

442-448: Use camelCase for variable names per JavaScript/TypeScript conventions.

Variable names like mockWallet_secp256k1 and mockWallet_ed25519 use snake_case which is inconsistent with the rest of the codebase.

♻️ Suggested fix

-      const mockWallet_secp256k1 = {
+      const mockWalletSecp256k1 = {
         address: 'rhvh5SrgBL5V8oeV9EpDuVszeJSSCEkbPc',
         ...
       }

-      const mockWallet_ed25519 = {
+      const mockWalletEd25519 = {
         address: 'rszPLM97iS8mFTndKQNexGhY1N9ionLVAx',
         ...
       }

Also applies to: 464-470

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/xrpl/test/wallet/index.test.ts` around lines 442 - 448, Rename the
snake_case test variables to camelCase (e.g., change mockWallet_secp256k1 ->
mockWalletSecp256k1 and mockWallet_ed25519 -> mockWalletEd25519) in the test
file; update every reference to these identifiers in tests (constructors,
assertions, imports/exports within the file) so the new names are used
consistently, keeping the object shapes and values unchanged and ensuring no
leftover snake_case identifiers remain.

---

440-483: Consider adding test for empty string input.

The fromPrivateKey implementation validates that privateKey is a non-empty string and throws ValidationError. Adding a test for this case would improve coverage:

💚 Suggested test addition

it('throws ValidationError for empty string', function () {
  assert.throws(
    () => Wallet.fromPrivateKey(''),
    /privateKey must be a non-empty string/u,
  )
})

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/xrpl/test/wallet/index.test.ts` around lines 440 - 483, Add a test
under the "from PrivateKey" suite (near the secp256k1/ed25519 tests) that calls
Wallet.fromPrivateKey with an empty string and asserts it throws the expected
ValidationError; specifically, add an it block that calls
Wallet.fromPrivateKey('') and asserts the thrown error matches /privateKey must
be a non-empty string/ (reference: Wallet.fromPrivateKey and the existing test
cases in this describe block).

---

456-460: Consider asserting specific error type or message in error tests.

The current tests only verify that an error is thrown, but don't validate the error type or message. This could mask unexpected errors.

♻️ Suggested enhancement

       it('throws error for malformed secp256k1 private key', function () {
-        assert.throws(() =>
-          Wallet.fromPrivateKey(mockWallet_secp256k1.privateKey.slice(0, 10)),
-        )
+        assert.throws(
+          () => Wallet.fromPrivateKey(mockWalletSecp256k1.privateKey.slice(0, 10)),
+          /Invalid private key/u,
+        )
       })

Also applies to: 477-481

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/xrpl/test/wallet/index.test.ts` around lines 456 - 460, The tests
that call Wallet.fromPrivateKey with malformed secp256k1 input should assert the
specific error type or message rather than only that something was thrown;
update the failing assertions (the test invoking
Wallet.fromPrivateKey(mockWallet_secp256k1.privateKey.slice(0, 10)) and the
similar case around lines 477-481) to pass a second argument to assert.throws
that checks either an error constructor or a RegExp for the expected message
(e.g., assert.throws(() => Wallet.fromPrivateKey(...), { name: 'Error', message:
/malformed|invalid private key/i }) or assert.throws(() =>
Wallet.fromPrivateKey(...), /invalid private key/)) so the tests validate the
exact failure mode from Wallet.fromPrivateKey.

packages/xrpl/src/Wallet/index.ts (1)

177-190: Consider supporting masterAddress option for Regular Key Pair use cases.

Other factory methods like fromSeed, fromEntropy, and fromMnemonic support a masterAddress option for Regular Key Pair scenarios. For API consistency, consider adding this option:

♻️ Suggested enhancement

   /**
    * Derives a wallet from a private key.
    *
    * `@param` privateKey - A string used to generate a keypair (publicKey/privateKey) to derive a wallet.
+   * `@param` opts - (Optional) Options to derive a Wallet.
+   * `@param` opts.masterAddress - Include if a Wallet uses a Regular Key Pair. It must be the master address of the account.
    * `@returns` A Wallet derived from a private key.
    *
    *  `@throws` ValidationError if private key is not a valid string
    */
-  public static fromPrivateKey(privateKey: string): Wallet {
+  public static fromPrivateKey(
+    privateKey: string,
+    opts: { masterAddress?: string } = {},
+  ): Wallet {
     if (!privateKey || typeof privateKey !== 'string') {
       throw new ValidationError('privateKey must be a non-empty string')
     }
-    return new Wallet(derivePublicKey(privateKey), privateKey)
+    return new Wallet(derivePublicKey(privateKey), privateKey, {
+      masterAddress: opts.masterAddress,
+    })
   }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/xrpl/src/Wallet/index.ts` around lines 177 - 190, Add an optional
options parameter to fromPrivateKey to accept a masterAddress for Regular Key
Pair scenarios: change signature to fromPrivateKey(privateKey: string, options?:
{ masterAddress?: string }): Wallet, validate that options.masterAddress (if
provided) is a non-empty string (throw ValidationError otherwise), and pass it
into the Wallet constructor (i.e., new Wallet(derivePublicKey(privateKey),
privateKey, options?.masterAddress)) so behavior matches
fromSeed/fromEntropy/fromMnemonic.

packages/ripple-keypairs/src/signing-schemes/ed25519/index.ts (1)

37-37: Consider using hexToBytes for consistency with the codebase.

The codebase imports hexToBytes from @xrplf/isomorphic/utils in other modules (e.g., packages/ripple-keypairs/src/index.ts). Using Buffer.from(normalizedPrivateKey, 'hex') works but is inconsistent with the browser-compatible utility pattern used elsewhere.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/ripple-keypairs/src/signing-schemes/ed25519/index.ts` at line 37,
Replace the direct Buffer.from call by using the shared hexToBytes utility:
import { hexToBytes } from '@xrplf/isomorphic/utils' and replace "const buffer =
Buffer.from(normalizedPrivateKey, 'hex')" with "const buffer =
hexToBytes(normalizedPrivateKey)" (or if the rest of the code requires a Node
Buffer, use Buffer.from(hexToBytes(normalizedPrivateKey))). This keeps
browser-compatible behavior consistent with other modules and reuses the
existing utility; update the import at the top of the module accordingly.

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro