Metatarz Wallet

{
  "signature": "0x…",              // EIP-191 sig over "registration:<ts>"
  "message": "registration:<ts>",
  "key_mode": "external",
  "canton_public_key": "0x02…"     // 33-byte compressed secp256k1 pubkey
}

{
  "signature": "0x…",              // EIP-191 sig over "registration:<ts>"
  "message": "registration:1710000000",
  "key_mode": "external",
  "canton_public_key": "0x02…",
  "topology_signature": "0x30…",   // DER sig over sha256(topology_hash)
  "transaction_hash": "0x9f2c…",   // topology_hash from prepare-topology
  "public_key_fingerprint": "1220ab…",
  "registration_token": "3f1c9d2e-…"
}

{
  "type": "transfer",
  "to": "user_a1b2c3d4::1220ab…", // party_id OR 0x… EVM address
  "amount": "12.5",
  "token": "CC",                  // must be in the allowed set
  "memo": "optional memo"         // required for most CEX deposits
}

{
  "type": "preapproval"           // or "preapproval2" (CBTC) / "preapproval3" (cETH)
}

{
  "transfer_id": "f3a1…",
  "signature": "0x30…",            // DER sig
  "signed_by": "1220ab…",          // Canton multihash fingerprint
  "transaction_hash": "0x7d4e9a…",
  "public_key": "0x02…",           // compressed secp256k1 pubkey
  "type": "transfer"               // or "preapproval"
}

import { ethers } from "ethers";
import { secp256k1 } from "@noble/curves/secp256k1";
import { sha256 } from "@noble/hashes/sha256";

const RPC_URL = "https://canton.rpc.wallet.metatarz.xyz";
const PRIVATE_KEY = "<PK>"
const provider = new ethers.JsonRpcProvider(RPC_URL);
const wallet = new ethers.Wallet(PRIVATE_KEY, provider);
const EVM_ADDRESS = wallet.address;
const COMPRESSED_PUBKEY = wallet.signingKey.compressedPublicKey;

// Derive a DER-encoded secp256k1 signature over sha256(hashHex)
export async function signHashDER(
  hashHex: string,
  privateKeyHex: string,
  raw = false,
): Promise<string> {
  const hash = ethers.getBytes(hashHex);
  const privateKey = ethers.getBytes(privateKeyHex);

  const signature = secp256k1.sign(
    raw ? hash : sha256(hash),
    privateKey,
    { prehash: false, lowS: true, format: "der" },
  );

  return signature.toHex();
}

const authHeaders = (message: string, signature: string) => ({
  "Content-Type": "application/json",
  "X-Message": message,
  "X-Signature": signature,
});

async function prepareTopology() {
  const message = "registration:" + Date.now();
  const signature = await wallet.signMessage(message);

  const res = await fetch(RPC_URL + "/register/prepare-topology", {
    method: "POST",
    headers: authHeaders(message, signature),
    body: JSON.stringify({
      signature,
      message,
      key_mode: "external",
      canton_public_key: COMPRESSED_PUBKEY,
    }),
  });

  const data = await res.json();

  // Already registered on-chain — nothing to sign
  if (data.user_exists) {
    return { alreadyRegistered: true, party: data.party, fingerprint: data.fingerprint };
  }

  return {
    alreadyRegistered: false,
    message,
    signature,
    topologyHash: data.topology_hash,               // sha256 over topology txs
    publicKeyFingerprint: data.public_key_fingerprint,
    registrationToken: data.registration_token,     // pass to step 2
  };
}

import { sha256 } from "ethers";
import { signingKeyToDER } from "./canton-signing"; // see note below

async function registerWallet() {
  const prepared = await prepareTopology();

  if (prepared.alreadyRegistered) {
    return { party: prepared.party, fingerprint: prepared.fingerprint };
  }

  // DER-sign with the user's secp256k1 key
  const topologySignature = await signHashDER(
    prepared.topologyHash,
    PRIVATE_KEY,
  );

  const res = await fetch(RPC_URL + "/register", {
    method: "POST",
    headers: authHeaders(message, signature),
    body: JSON.stringify({
      signature: prepared.signature,               // EIP-191 over registration:<ts>
      message: prepared.message,
      key_mode: "external",
      canton_public_key: COMPRESSED_PUBKEY,
      topology_signature: topologySignature,       // DER over sha256(topology_hash)
      transaction_hash: prepared.topologyHash,
      public_key_fingerprint: prepared.publicKeyFingerprint,
      registration_token: prepared.registrationToken,
    }),
  });

  if (!res.ok) {
    // 403 = not whitelisted · 409 = already registered · 410 = token expired
    throw new Error("registration failed: " + res.status);
  }

  return await res.json();
}

async function prepareTransfer({ to, amount, token, memo }) {
  const message = "transfer:" + Date.now();
  const signature = await wallet.signMessage(message);

  const res = await fetch(RPC_URL + "/api/v2/transfer/prepare", {
    method: "POST",
    headers: authHeaders(message, signature),
    body: JSON.stringify({
      type: "transfer",
      to,                                  // party_id OR 0x… EVM address
      amount,                              // decimal string, e.g. "12.5"
      token,                               // e.g. "CC", "USDCx", "CBTC"
      ...(memo ? { memo } : {}),           // required for most CEX deposits
    }),
  });

  const data = await res.json();

  if (data.code === 409) {
    // e.g. preapproval already exists — safe to surface to the user
    throw new Error("preapproval already exists");
  }
  if (!data.transaction_hash) {
    throw new Error("prepare failed");
  }

  return { message, signature, ...data };
}

async function executeTransfer(prepared) {
  const txHashSig = await signHashDER(
    prepared.transaction_hash,
    PRIVATE_KEY,
  );

  // party_id is "user_a1b2c3d4::1220ab…" — send the fingerprint half
  const signedBy = prepared.party_id.split("::")[1];

  const res = await fetch(RPC_URL + "/api/v2/transfer/execute", {
    method: "POST",
    headers: authHeaders(prepared.message, prepared.signature),
    body: JSON.stringify({
      transfer_id: prepared.transfer_id,
      signature: txHashSig,                // DER over sha256(transaction_hash)
      signed_by: signedBy,                 // Canton multihash fingerprint
      transaction_hash: prepared.transaction_hash,
      public_key: COMPRESSED_PUBKEY,
      type: "transfer",
    }),
  });

  if (!res.ok) {
    throw new Error("execute failed: " + res.status);
  }

  return await res.json();
}

async function sendCC({ to, amount, memo }) {
  const prepared = await prepareTransfer({
    to,
    amount,
    token: "CC",
    memo,
  });
  const result = await executeTransfer(prepared);
  return result.update_id;
}

// usage
const updateId = await sendCC({
  to: "user_deadbeef::1220…",
  amount: "1.5",
  memo: "invoice-42",
});
console.log("Canton update:", updateId);

// eth_call — balanceOf for a CIP-56 token
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "eth_call",
  "params": [
    {
      "to": "0xDE40000000000000000000000000000000000001",
      "data": "0x70a08231" + "000000000000000000000000" + "<address without 0x>"
    },
    "latest"
  ]
}

// request
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "eth_getBalance",
  "params": ["0xa1b2c3d4e5f6…", "latest"]
}

// USDCx — 0x70a08231 = balanceOf(address)
{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "eth_call",
  "params": [
    {
      "to": "0xDE40000000000000000000000000000000000001",
      "data": "0x70a08231000000000000000000000000a1b2c3d4e5f6…"
    },
    "latest"
  ]
}

import { BrowserProvider, parseEther } from "ethers";

const provider = new BrowserProvider(window.ethereum); // Metatarz injects here
const signer = await provider.getSigner();

// Metatarz intercepts this call and runs prepare → sign → execute
const tx = await signer.sendTransaction({
  to: "user_a1b2c3d4::1220ab…",
  value: parseEther("1.0"),
  // wallet also reads: memo, token — pass via your dApp's own UX
});

// tx.hash is a Canton update_id
console.log("Canton update:", tx.hash);