api: Reject Unicode lookalikes in u5 conversion

The newly supported chars_to_u5 interface must not case-fold Unicode into valid Bech32 symbols. Lower only ASCII characters so lookalikes such as the Kelvin sign remain invalid, matching the normalization boundary enforced elsewhere.

Author: codex

src/codex32/bech32.py

@@ -19,6 +19,11 @@ def bech32_hrp_expand(hrp: str) -> list[int]:
     return [ord(x) >> 5 for x in hrp] + [0] + [ord(x) & 31 for x in hrp]
 
 
+def _ascii_lower(value: str) -> str:
+    """Lowercase ASCII letters without normalizing Unicode lookalikes."""
+    return "".join(character.lower() if character.isascii() else character for character in value)
+
+
 def u5_to_chars(values: list[int] | tuple[int, ...]) -> str:
     """Convert 5-bit values to Bech32 characters."""
 
@@ -32,7 +37,7 @@ def chars_to_u5(value: str, first_position: int = 1) -> list[int]:
     """Convert Bech32 characters to 5-bit values."""
 
     result: list[int] = []
-    for index, character in enumerate(value.lower()):
+    for index, character in enumerate(_ascii_lower(value)):
         position = CHARSET.find(character)
         if position < 0:
             label = "Apostrophe (')" if character == "'" else f"The character {character!r}"

tests/test_bech32.py

@@ -28,6 +28,11 @@ def test_u5_character_round_trip() -> None:
     assert chars_to_u5(CHARSET.upper()) == values
 
 
+def test_u5_character_conversion_does_not_fold_unicode_lookalikes() -> None:
+    with pytest.raises(InvalidCharacter, match="K"):
+        chars_to_u5("K")
+
+
 @pytest.mark.parametrize("value", (-1, 32))
 def test_u5_rejects_out_of_range_values(value: int) -> None:
     with pytest.raises(InvalidCharacter):