chore(workspace): Bump version to 0.8.2 and add byte accessor methods to DerivedAccount/DerivedAddress

- Bump workspace version from 0.8.1 to 0.8.2
- Remove SECURITY.md file
- Add `private_key_bytes()` and `public_key_bytes()` methods to `kobe_primitives::DerivedAccount` for hex-to-bytes conversion with zeroization
- Add `private_key_bytes()` and `public_key_bytes()` methods to `kobe_btc::DerivedAddress` and `kobe_svm::DerivedAddress`
- Add `DeriveError::InvalidHex` variant for malformed hex dec

Author: gitctrlx

Cargo.lock

@@ -4,7 +4,7 @@ default-members = ["crates/kobe"]
 resolver = "3"
 
 [workspace.package]
-version = "0.8.1"
+version = "0.8.2"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/qntx/kobe"

Cargo.toml

@@ -51,6 +51,37 @@ pub struct DerivedAddress {
     pub address_type: AddressType,
 }
 
+impl DerivedAddress {
+    /// Decode the hex-encoded private key into raw 32-byte material.
+    ///
+    /// Returned buffer is zeroized on drop.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the stored hex is malformed or not exactly 32
+    /// bytes. Never produced by this workspace's derivers under normal use.
+    pub fn private_key_bytes(&self) -> Result<Zeroizing<[u8; 32]>, DeriveError> {
+        let mut buf = Zeroizing::new([0u8; 32]);
+        hex::decode_to_slice(self.private_key_hex.as_str(), buf.as_mut_slice()).map_err(|e| {
+            kobe_primitives::DeriveError::InvalidHex(alloc::format!("private_key_hex: {e}"))
+        })?;
+        Ok(buf)
+    }
+
+    /// Decode the hex-encoded compressed public key (33 bytes).
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the stored hex is malformed.
+    pub fn public_key_bytes(&self) -> Result<Vec<u8>, DeriveError> {
+        hex::decode(&self.public_key_hex)
+            .map_err(|e| {
+                kobe_primitives::DeriveError::InvalidHex(alloc::format!("public_key_hex: {e}"))
+            })
+            .map_err(Into::into)
+    }
+}
+
 impl<'a> Deriver<'a> {
     /// Create a new Bitcoin deriver from a wallet.
     ///
@@ -317,4 +348,19 @@ mod tests {
         let d2 = Deriver::new(&wallet2, Network::Mainnet).unwrap();
         assert_ne!(d1.derive(0).unwrap().address, d2.derive(0).unwrap().address);
     }
+
+    #[test]
+    fn bytes_accessors_roundtrip() {
+        let wallet = test_wallet();
+        let deriver = Deriver::new(&wallet, Network::Mainnet).unwrap();
+        let da = deriver.derive_with(AddressType::P2wpkh, 0).unwrap();
+
+        let sk = da.private_key_bytes().unwrap();
+        assert_eq!(sk.len(), 32);
+        assert_eq!(hex::encode(*sk), da.private_key_hex.as_str());
+
+        let pk = da.public_key_bytes().unwrap();
+        assert_eq!(pk.len(), 33);
+        assert_eq!(hex::encode(&pk), da.public_key_hex);
+    }
 }

SECURITY.md

@@ -12,12 +12,12 @@ categories = ["cryptography", "no-std"]
 [features]
 default = ["std"]
 std = ["alloc", "bip39/std", "zeroize/std"]
-alloc = ["bip39/alloc", "zeroize/alloc"]
+alloc = ["bip39/alloc", "zeroize/alloc", "dep:hex"]
 rand = ["bip39/rand"]
 rand_core = ["bip39/rand_core"]
 camouflage = ["dep:hmac", "dep:sha2", "alloc"]
-slip10 = ["dep:ed25519-dalek", "dep:hmac", "dep:sha2", "dep:hex", "alloc"]
-bip32 = ["dep:bip32-crate", "dep:k256", "dep:hex", "alloc"]
+slip10 = ["dep:ed25519-dalek", "dep:hmac", "dep:sha2", "alloc"]
+bip32 = ["dep:bip32-crate", "dep:k256", "alloc"]
 
 [dependencies]
 bip39.workspace = true

crates/kobe-btc/src/deriver.rs

@@ -44,6 +44,38 @@ impl DerivedAccount {
             address,
         }
     }
+
+    /// Decode the hex-encoded private key into raw 32-byte material.
+    ///
+    /// Every chain deriver in this workspace produces a 32-byte scalar
+    /// (secp256k1 for EVM/BTC/Cosmos/Tron/Spark/Filecoin/XRPL/Nostr,
+    /// Ed25519 for SVM/SUI/TON/Aptos), so the output is fixed-length.
+    /// The returned buffer is zeroized on drop.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the stored hex is malformed or not exactly
+    /// 32 bytes. Derivers in this workspace never produce malformed data,
+    /// so this error is unexpected in normal use.
+    pub fn private_key_bytes(&self) -> Result<Zeroizing<[u8; 32]>, DeriveError> {
+        let mut buf = Zeroizing::new([0u8; 32]);
+        hex::decode_to_slice(self.private_key.as_str(), buf.as_mut_slice())
+            .map_err(|e| DeriveError::InvalidHex(alloc::format!("private_key: {e}")))?;
+        Ok(buf)
+    }
+
+    /// Decode the hex-encoded public key into raw bytes.
+    ///
+    /// Length is chain-specific: 33 for compressed secp256k1, 65 for
+    /// uncompressed, 32 for Ed25519 / x-only secp256k1.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the stored hex is malformed.
+    pub fn public_key_bytes(&self) -> Result<Vec<u8>, DeriveError> {
+        hex::decode(&self.public_key)
+            .map_err(|e| DeriveError::InvalidHex(alloc::format!("public_key: {e}")))
+    }
 }
 
 /// Unified derivation trait implemented by all chain derivers.
@@ -98,3 +130,63 @@ pub trait DeriveExt: Derive {
 }
 
 impl<T: Derive> DeriveExt for T {}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn sample_account() -> DerivedAccount {
+        DerivedAccount::new(
+            String::from("m/44'/60'/0'/0/0"),
+            Zeroizing::new(String::from(
+                "1ab42cc412b618bdea3a599e3c9bae199ebf030895b039e9db1e30dafb12b727",
+            )),
+            String::from("0237b0bb7a8288d38ed49a524b5dc98cff3eb5ca824c9f9dc0dfdb3d9cd600f299"),
+            String::from("0x9858EfFD232B4033E47d90003D41EC34EcaEda94"),
+        )
+    }
+
+    #[test]
+    fn private_key_bytes_roundtrip() {
+        let acct = sample_account();
+        let bytes = acct.private_key_bytes().unwrap();
+        assert_eq!(bytes.len(), 32);
+        assert_eq!(hex::encode(*bytes), acct.private_key.as_str());
+    }
+
+    #[test]
+    fn public_key_bytes_roundtrip() {
+        let acct = sample_account();
+        let bytes = acct.public_key_bytes().unwrap();
+        assert_eq!(bytes.len(), 33);
+        assert_eq!(hex::encode(&bytes), acct.public_key);
+    }
+
+    #[test]
+    fn private_key_bytes_rejects_short_hex() {
+        let bad = DerivedAccount::new(
+            String::from("m/0"),
+            Zeroizing::new(String::from("deadbeef")),
+            String::new(),
+            String::new(),
+        );
+        assert!(matches!(
+            bad.private_key_bytes(),
+            Err(DeriveError::InvalidHex(_))
+        ));
+    }
+
+    #[test]
+    fn public_key_bytes_rejects_non_hex() {
+        let bad = DerivedAccount::new(
+            String::from("m/0"),
+            Zeroizing::new(String::new()),
+            String::from("not-hex!"),
+            String::new(),
+        );
+        assert!(matches!(
+            bad.public_key_bytes(),
+            Err(DeriveError::InvalidHex(_))
+        ));
+    }
+}

crates/kobe-primitives/Cargo.toml

@@ -68,6 +68,16 @@ pub enum DeriveError {
     #[cfg(feature = "bip32")]
     #[error("BIP-32: {0}")]
     Bip32Derivation(String),
+
+    /// Stored hex material is malformed.
+    ///
+    /// Produced by the byte-level accessors on `DerivedAccount` /
+    /// `DerivedAddress` when decoding their hex fields. Derivers in this
+    /// workspace never produce malformed hex, so this error indicates
+    /// externally-constructed data.
+    #[cfg(feature = "alloc")]
+    #[error("invalid hex: {0}")]
+    InvalidHex(String),
 }
 
 #[cfg(not(feature = "std"))]