feat(finance): BTC basket flows, client scoping, and jewelry-box store

- Finance API: baskets, holdings, rebalances, deposits, bridge withdrawals, vault checks.
- Schemas: btc-basket; api-client finance types; workspace lockfile update.
- Vitest config for finance service; expanded tests.

Made-with: Cursor

packages/auth/src/did.ts

@@ -6,11 +6,13 @@
 import fetch from 'node-fetch';
 import { createVerify, createPublicKey } from 'crypto';
 import { decode as multibaseDecode } from 'multibase';
-import base58 from 'base58-universal';
 import { importJWK } from 'jose';
 import forge from 'node-forge';
 import { verify as ed25519Verify } from '@noble/ed25519';
 
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { decode: base58Decode }: { decode: (value: string) => Uint8Array } = require('base58-universal');
+
 export interface DIDDocument {
   id: string;
   '@context': string[];
@@ -89,7 +91,7 @@ export class DIDResolver {
       if (multibaseKey.startsWith('z')) {
         try {
           const base58Encoded = multibaseKey.slice(1);
-          const decoded = base58.decode(base58Encoded);
+          const decoded = base58Decode(base58Encoded);
           return Buffer.from(decoded);
         } catch {
           throw new Error('Failed to decode multibase key');
@@ -296,4 +298,3 @@ export class DIDResolver {
     }
   }
 }
-

packages/auth/src/entra-credential-images.ts

@@ -122,6 +122,9 @@ export async function prepareCredentialImage(
     if (imageData.startsWith('data:')) {
       // Extract base64 data
       const base64Data = imageData.split(',')[1];
+      if (!base64Data) {
+        throw new Error('Invalid image data URL: missing base64 payload');
+      }
       imageBuffer = Buffer.from(base64Data, 'base64');
     } else {
       imageBuffer = Buffer.from(imageData);
@@ -180,4 +183,3 @@ export function getRecommendedImageSpecs(): {
     maxSizeKB: 100, // Max 100KB recommended
   };
 }
-