@bopen-io/wallet-toolbox 2.1.21-parity-fix.2 → 2.6.2-brc153.2

package/out/src/CWIStyleWalletManager.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CWIStyleWalletManager = exports.OverlayUMPTokenInteractor = exports.DEFAULT_PROFILE_ID = exports.ARGON2ID_DEFAULT_HASH_LENGTH = exports.ARGON2ID_DEFAULT_PARALLELISM = exports.ARGON2ID_DEFAULT_MEMORY_KIB = exports.ARGON2ID_DEFAULT_ITERATIONS = exports.PBKDF2_NUM_ROUNDS = void 0;
+exports.CWIStyleWalletManager = exports.OverlayUMPTokenInteractor = exports.UMPTokenLookupError = exports.DEFAULT_PROFILE_ID = exports.MAX_STATE_SNAPSHOT_BYTES = exports.PBKDF2_MAX_ITERATIONS = exports.KDF_MAX_HASH_LENGTH = exports.ARGON2ID_MAX_PARALLELISM = exports.ARGON2ID_MAX_MEMORY_KIB = exports.ARGON2ID_MAX_ITERATIONS = exports.ARGON2ID_DEFAULT_HASH_LENGTH = exports.ARGON2ID_DEFAULT_PARALLELISM = exports.ARGON2ID_DEFAULT_MEMORY_KIB = exports.ARGON2ID_DEFAULT_ITERATIONS = exports.PBKDF2_NUM_ROUNDS = void 0;
 const sdk_1 = require("@bsv/sdk");
-const hash_wasm_1 = require("hash-wasm");
 const PrivilegedKeyManager_1 = require("./sdk/PrivilegedKeyManager");
+const hashWasm_1 = require("./utility/hashWasm");
 /**
  * Number of rounds used in PBKDF2 for deriving password keys.
  */
@@ -15,6 +15,72 @@ exports.ARGON2ID_DEFAULT_ITERATIONS = 7;
 exports.ARGON2ID_DEFAULT_MEMORY_KIB = 131072;
 exports.ARGON2ID_DEFAULT_PARALLELISM = 1;
 exports.ARGON2ID_DEFAULT_HASH_LENGTH = 32;
+exports.ARGON2ID_MAX_ITERATIONS = 20;
+exports.ARGON2ID_MAX_MEMORY_KIB = 262144;
+exports.ARGON2ID_MAX_PARALLELISM = 16;
+exports.KDF_MAX_HASH_LENGTH = 64;
+exports.PBKDF2_MAX_ITERATIONS = 10_000_000;
+exports.MAX_STATE_SNAPSHOT_BYTES = 16 * 1024 * 1024;
+function isPositiveIntegerInRange(value, maximum) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0 && value <= maximum;
+}
+function isValidKdfConfig(kdf) {
+    if (kdf == null)
+        return false;
+    if (!isPositiveIntegerInRange(kdf.iterations, kdf.algorithm === 'argon2id' ? exports.ARGON2ID_MAX_ITERATIONS : exports.PBKDF2_MAX_ITERATIONS)) {
+        return false;
+    }
+    if (kdf.algorithm === 'pbkdf2-sha512') {
+        return kdf.hashLength === undefined || isPositiveIntegerInRange(kdf.hashLength, exports.KDF_MAX_HASH_LENGTH);
+    }
+    if (kdf.algorithm !== 'argon2id')
+        return false;
+    return (isPositiveIntegerInRange(kdf.memoryKiB, exports.ARGON2ID_MAX_MEMORY_KIB) &&
+        isPositiveIntegerInRange(kdf.parallelism, exports.ARGON2ID_MAX_PARALLELISM) &&
+        isPositiveIntegerInRange(kdf.hashLength, exports.KDF_MAX_HASH_LENGTH));
+}
+function findKdfVersionFieldIndex(protocolFields) {
+    const hasMetadataWithProfiles = protocolFields.length >= 15 &&
+        protocolFields[12]?.length === 1 &&
+        protocolFields[12][0] === 3;
+    if (hasMetadataWithProfiles)
+        return 12;
+    const hasMetadataWithoutProfiles = protocolFields.length >= 14 &&
+        protocolFields[11]?.length === 1 &&
+        protocolFields[11][0] === 3;
+    return hasMetadataWithoutProfiles ? 11 : -1;
+}
+function addProfilesField(token, protocolFields, kdfVersionFieldIndex) {
+    const hasProfilesField = kdfVersionFieldIndex === 12 || (kdfVersionFieldIndex !== 11 && protocolFields[11] != null);
+    if (!hasProfilesField || protocolFields[11].length === 0)
+        return true;
+    if (protocolFields[11].length > exports.MAX_STATE_SNAPSHOT_BYTES)
+        return false;
+    token.profilesEncrypted = protocolFields[11];
+    return true;
+}
+function addPasswordKdf(token, protocolFields, kdfVersionFieldIndex) {
+    if (kdfVersionFieldIndex === -1)
+        return true;
+    const kdfAlgorithmField = protocolFields[kdfVersionFieldIndex + 1];
+    const kdfParamsField = protocolFields[kdfVersionFieldIndex + 2];
+    if (kdfAlgorithmField == null || kdfParamsField == null || kdfParamsField.length > 1024) {
+        return false;
+    }
+    const kdfParams = JSON.parse(sdk_1.Utils.toUTF8(kdfParamsField));
+    const passwordKdf = {
+        algorithm: sdk_1.Utils.toUTF8(kdfAlgorithmField),
+        iterations: kdfParams.iterations,
+        memoryKiB: kdfParams.memoryKiB,
+        parallelism: kdfParams.parallelism,
+        hashLength: kdfParams.hashLength
+    };
+    if (!isValidKdfConfig(passwordKdf))
+        return false;
+    token.umpVersion = 3;
+    token.passwordKdf = passwordKdf;
+    return true;
+}
 function isLikelyDerSignatureField(field) {
     if (!field || field.length < 8 || field.length > 80) {
         return false;
@@ -39,12 +105,12 @@ function stripVerifiedPushDropSignature(fields, lockingPublicKey) {
         for (let i = 0; i < protocolFieldCount; i++) {
             dataLength += fields[i].length;
         }
-        const dataToVerify = new Array(dataLength);
+        const dataToVerify = Array.from({ length: dataLength }, () => 0);
         let writeOffset = 0;
         for (let i = 0; i < protocolFieldCount; i++) {
             const field = fields[i];
-            for (let j = 0; j < field.length; j++) {
-                dataToVerify[writeOffset++] = field[j];
+            for (const byte of field) {
+                dataToVerify[writeOffset++] = byte;
             }
         }
         const signature = sdk_1.Signature.fromDER(trailingField);
@@ -52,7 +118,7 @@ function stripVerifiedPushDropSignature(fields, lockingPublicKey) {
             return fields.slice(0, protocolFieldCount);
         }
     }
-    catch (_a) {
+    catch {
         return fields;
     }
     return fields;
@@ -68,13 +134,12 @@ function stripVerifiedPushDropSignature(fields, lockingPublicKey) {
  * @returns               Derived key bytes.
  */
 async function pbkdf2NativeOrWasm(passwordBytes, salt, iterations, keyLen, hash = 'sha512') {
-    var _a;
     // ----- fast-path: WebCrypto (both browser & recent Node expose globalThis.crypto.subtle)
-    const subtle = (_a = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto) === null || _a === void 0 ? void 0 : _a.subtle;
-    if (subtle) {
+    const subtle = globalThis?.crypto?.subtle;
+    if (subtle != null) {
         try {
             const baseKey = await subtle.importKey('raw', new Uint8Array(passwordBytes), { name: 'PBKDF2' }, 
-            /*extractable*/ false, ['deriveBits']);
+            /* extractable */ false, ['deriveBits']);
             const bits = await subtle.deriveBits({
                 name: 'PBKDF2',
                 salt: new Uint8Array(salt),
@@ -83,13 +148,13 @@ async function pbkdf2NativeOrWasm(passwordBytes, salt, iterations, keyLen, hash
             }, baseKey, keyLen * 8);
             return Array.from(new Uint8Array(bits));
         }
-        catch (err) {
-            //console.warn('[pbkdf2] WebCrypto path failed → falling back to JS implementation', err)
-            /* fall through */
+        catch {
+            // WebCrypto is unavailable or refused the algorithm (e.g. non-secure context, old
+            // Safari).  Fall through to the pure-JS hash-wasm implementation below.
         }
     }
-    const hashFunction = hash === 'sha256' ? (0, hash_wasm_1.createSHA256)() : (0, hash_wasm_1.createSHA512)();
-    const derived = await (0, hash_wasm_1.pbkdf2)({
+    const hashFunction = hash === 'sha256' ? (0, hashWasm_1.createSHA256)() : (0, hashWasm_1.createSHA512)();
+    const derived = await (0, hashWasm_1.pbkdf2)({
         password: new Uint8Array(passwordBytes),
         salt: new Uint8Array(salt),
         iterations,
@@ -110,19 +175,21 @@ async function pbkdf2NativeOrWasm(passwordBytes, salt, iterations, keyLen, hash
  * @returns              Derived password key bytes.
  */
 async function derivePasswordKey(token, passwordBytes, overrideKdf) {
-    var _a, _b, _c, _d, _e;
     const kdf = overrideKdf || token.passwordKdf;
+    if (kdf != null && !isValidKdfConfig(kdf)) {
+        throw new Error('UMP token contains unsupported or unsafe KDF parameters.');
+    }
     // Legacy token or explicit PBKDF2 request
-    if (!kdf || kdf.algorithm === 'pbkdf2-sha512') {
-        return pbkdf2NativeOrWasm(passwordBytes, token.passwordSalt, (_a = kdf === null || kdf === void 0 ? void 0 : kdf.iterations) !== null && _a !== void 0 ? _a : exports.PBKDF2_NUM_ROUNDS, 32, 'sha512');
+    if (kdf == null || kdf.algorithm === 'pbkdf2-sha512') {
+        return await pbkdf2NativeOrWasm(passwordBytes, token.passwordSalt, kdf?.iterations ?? exports.PBKDF2_NUM_ROUNDS, 32, 'sha512');
     }
     // Argon2id path (UMP v3)
     if (kdf.algorithm === 'argon2id') {
-        const iterations = (_b = kdf.iterations) !== null && _b !== void 0 ? _b : exports.ARGON2ID_DEFAULT_ITERATIONS;
-        const memorySize = (_c = kdf.memoryKiB) !== null && _c !== void 0 ? _c : exports.ARGON2ID_DEFAULT_MEMORY_KIB;
-        const parallelism = (_d = kdf.parallelism) !== null && _d !== void 0 ? _d : exports.ARGON2ID_DEFAULT_PARALLELISM;
-        const hashLength = (_e = kdf.hashLength) !== null && _e !== void 0 ? _e : exports.ARGON2ID_DEFAULT_HASH_LENGTH;
-        const hash = await (0, hash_wasm_1.argon2id)({
+        const iterations = kdf.iterations ?? exports.ARGON2ID_DEFAULT_ITERATIONS;
+        const memorySize = kdf.memoryKiB ?? exports.ARGON2ID_DEFAULT_MEMORY_KIB;
+        const parallelism = kdf.parallelism ?? exports.ARGON2ID_DEFAULT_PARALLELISM;
+        const hashLength = kdf.hashLength ?? exports.ARGON2ID_DEFAULT_HASH_LENGTH;
+        const hash = await (0, hashWasm_1.argon2id)({
             password: new Uint8Array(passwordBytes),
             salt: new Uint8Array(token.passwordSalt),
             iterations,
@@ -139,6 +206,43 @@ async function derivePasswordKey(token, passwordBytes, overrideKdf) {
  * Unique Identifier for the default profile (16 zero bytes).
  */
 exports.DEFAULT_PROFILE_ID = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+function isByteArrayOfLength(value, length) {
+    return (Array.isArray(value) &&
+        value.length === length &&
+        value.every(byte => Number.isInteger(byte) && byte >= 0 && byte <= 255));
+}
+function isValidProfile(value) {
+    if (value == null || typeof value !== 'object')
+        return false;
+    const profile = value;
+    return (typeof profile.name === 'string' &&
+        profile.name.length > 0 &&
+        profile.name.length <= 250 &&
+        isByteArrayOfLength(profile.id, 16) &&
+        isByteArrayOfLength(profile.primaryPad, 32) &&
+        isByteArrayOfLength(profile.privilegedPad, 32) &&
+        typeof profile.createdAt === 'number' &&
+        Number.isFinite(profile.createdAt) &&
+        profile.createdAt >= 0);
+}
+/**
+ * Raised when a UMP lookup yields neither a verified token nor a clean empty response.
+ *
+ * Callers must offer retry/recovery rather than treating this error as a new
+ * account. Diagnostics contain counts only and never hashes, keys, or tokens.
+ */
+class UMPTokenLookupError extends Error {
+    reason;
+    diagnostics;
+    code = 'WERR_UMP_LOOKUP_INDETERMINATE';
+    constructor(reason, diagnostics, options) {
+        super('Unable to determine whether the wallet account already exists. Retry or use account recovery.', options);
+        this.reason = reason;
+        this.diagnostics = diagnostics;
+        this.name = 'UMPTokenLookupError';
+    }
+}
+exports.UMPTokenLookupError = UMPTokenLookupError;
 /**
  * @class OverlayUMPTokenInteractor
  *
@@ -152,15 +256,26 @@ exports.DEFAULT_PROFILE_ID = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
  * 3) Consuming (spending) an old token if provided.
  */
 class OverlayUMPTokenInteractor {
+    /**
+     * A `LookupResolver` instance used to query overlay networks.
+     */
+    resolver;
+    /**
+     * A SHIP broadcaster that can be used to publish updated UMP tokens
+     * under the `tm_users` topic to overlay service peers.
+     */
+    broadcaster;
+    telemetry;
     /**
      * Construct a new OverlayUMPTokenInteractor.
      *
      * @param resolver     A LookupResolver instance for performing overlay queries (ls_users).
      * @param broadcaster  A SHIPBroadcaster instance for sharing new or updated tokens across the `tm_users` overlay.
      */
-    constructor(resolver = new sdk_1.LookupResolver(), broadcaster = new sdk_1.SHIPBroadcaster(['tm_users'])) {
+    constructor(resolver = new sdk_1.LookupResolver(), broadcaster = new sdk_1.SHIPBroadcaster(['tm_users']), telemetry) {
         this.resolver = resolver;
         this.broadcaster = broadcaster;
+        this.telemetry = new sdk_1.Telemetry(telemetry);
     }
     /**
      * Finds a UMP token on-chain by the given presentation key hash, if it exists.
@@ -170,13 +285,10 @@ class OverlayUMPTokenInteractor {
      * @returns A UMPToken object (including currentOutpoint) if found, otherwise undefined.
      */
     async findByPresentationKeyHash(hash) {
-        // Query ls_users for the given presentationHash
-        const question = {
+        return await this.findToken({
             service: 'ls_users',
             query: { presentationHash: sdk_1.Utils.toHex(hash) }
-        };
-        const answer = await this.resolver.query(question);
-        return this.parseLookupAnswer(answer);
+        }, 'presentation');
     }
     /**
      * Finds a UMP token on-chain by the given recovery key hash, if it exists.
@@ -186,12 +298,258 @@ class OverlayUMPTokenInteractor {
      * @returns A UMPToken object (including currentOutpoint) if found, otherwise undefined.
      */
     async findByRecoveryKeyHash(hash) {
-        const question = {
+        return await this.findToken({
             service: 'ls_users',
             query: { recoveryHash: sdk_1.Utils.toHex(hash) }
+        }, 'recovery');
+    }
+    async findToken(question, lookupKind) {
+        const correlationId = this.telemetry.enabled === true ? this.telemetry.createCorrelationId() : undefined;
+        const startedAt = Date.now();
+        this.telemetry.capture({
+            name: 'wallet-toolbox.ump.lookup.started',
+            component: 'wallet-toolbox.ump',
+            severity: 'debug',
+            correlationId,
+            attributes: { lookupKind }
+        });
+        let resolution;
+        try {
+            resolution = await this.resolver.queryDetailed(question, undefined, {
+                waitForAllHosts: true,
+                correlationId
+            });
+        }
+        catch (error) {
+            const diagnostics = this.emptyLookupDiagnostics(correlationId);
+            this.captureLookupFailure(lookupKind, 'lookup-unavailable', diagnostics, startedAt, error);
+            throw new UMPTokenLookupError('lookup-unavailable', diagnostics, { cause: error });
+        }
+        const diagnostics = this.toLookupDiagnostics(resolution);
+        const tokens = this.parseLookupAnswers(resolution.answer);
+        const expectedHash = question.query[lookupKind === 'presentation' ? 'presentationHash' : 'recoveryHash'].toLowerCase();
+        const matchingTokens = tokens.filter(token => sdk_1.Utils.toHex(lookupKind === 'presentation' ? token.presentationHash : token.recoveryHash).toLowerCase() ===
+            expectedHash);
+        // A verified token is positive account-existence evidence. Empty, malformed,
+        // rejected, or unavailable peers cannot override it. The resolver de-duplicates
+        // identical outputs, so multiple matching tokens represent distinct records.
+        // Competing records are usually stale renditions: a token update spends its
+        // predecessor's outpoint, so the newest rendition is the sole candidate not
+        // spent by another candidate's transaction history. Only unrelated (forked)
+        // tokens remain indeterminate.
+        if (matchingTokens.length > 1) {
+            const newest = this.resolveNewestToken(matchingTokens, resolution.answer.outputs);
+            if (newest != null) {
+                this.captureLookupCompleted(lookupKind, 'found', diagnostics, startedAt, {
+                    supersededTokens: matchingTokens.length - 1
+                });
+                return newest;
+            }
+            const reason = 'token-ambiguous';
+            this.captureLookupFailure(lookupKind, reason, diagnostics, startedAt);
+            throw new UMPTokenLookupError(reason, diagnostics);
+        }
+        if (matchingTokens.length === 1) {
+            this.captureLookupCompleted(lookupKind, 'found', diagnostics, startedAt);
+            return matchingTokens[0];
+        }
+        // A clean empty response is sufficient negative evidence once no verified
+        // token exists. Malformed outputs and failed peers are ignored so they cannot
+        // deny onboarding by advertising corrupt data or remaining unavailable.
+        if (resolution.progress.emptyHosts > 0) {
+            this.captureLookupCompleted(lookupKind, 'not-found', diagnostics, startedAt);
+            return undefined;
+        }
+        const reason = resolution.answer.outputs.length > 0 ? 'token-malformed' : 'lookup-incomplete';
+        this.captureLookupFailure(lookupKind, reason, diagnostics, startedAt);
+        throw new UMPTokenLookupError(reason, diagnostics);
+    }
+    /**
+     * Picks the newest rendition among distinct verified tokens, when possible.
+     *
+     * The on-chain UMP protocol expresses token updates by consumption: the
+     * transaction creating a new rendition spends the previous rendition's
+     * outpoint (there is no rendition counter field in the current format).
+     * A candidate is therefore superseded when any other candidate's ancestry
+     * (available from its BEEF) spends the candidate's outpoint.
+     *
+     * @returns The single unsuperseded candidate, or undefined when supersession
+     * cannot be established for every stale candidate (e.g. forked tokens).
+     */
+    resolveNewestToken(matchingTokens, outputs) {
+        const candidates = new Map();
+        for (const token of matchingTokens) {
+            if (token.currentOutpoint == null)
+                return undefined;
+            candidates.set(token.currentOutpoint, token);
+        }
+        // Hosts may serve the same token with different BEEF depth, so evidence
+        // for a candidate is merged across every copy rather than first-wins: a
+        // shallow copy must not mask the supersession proof a deeper copy carries.
+        const evidenceByCandidate = new Map();
+        for (const output of outputs) {
+            try {
+                const tx = sdk_1.Transaction.fromBEEF(output.beef);
+                const outpoint = `${tx.id('hex')}.${output.outputIndex}`;
+                if (!candidates.has(outpoint))
+                    continue;
+                const evidence = evidenceByCandidate.get(outpoint) ?? { txs: [], spent: new Set() };
+                evidence.txs.push(tx);
+                this.collectSpentOutpoints(tx, evidence.spent, new Set());
+                evidenceByCandidate.set(outpoint, evidence);
+            }
+            catch {
+                // Malformed outputs never produced candidates; nothing to correlate.
+            }
+        }
+        // Without an evidence transaction for every candidate, an unexamined
+        // candidate would trivially survive — refuse to guess.
+        if (evidenceByCandidate.size !== candidates.size)
+            return undefined;
+        const survivors = [...candidates.keys()].filter(outpoint => ![...evidenceByCandidate.entries()].some(([other, { spent }]) => other !== outpoint && spent.has(outpoint)));
+        if (survivors.length === 1)
+            return candidates.get(survivors[0]);
+        // Forked candidates: no spend relationship connects them. Updating a token
+        // requires unlocking its predecessor, so a candidate whose transaction
+        // provably consumed a same-identity token demonstrates continuity of key
+        // control; a freshly minted competitor (funding inputs only) is the anomaly
+        // — typically a historical erroneous re-onboarding. Prefer the sole proven
+        // continuation; anything less decisive stays indeterminate.
+        const provenContinuations = survivors.filter(outpoint => {
+            const evidence = evidenceByCandidate.get(outpoint);
+            const token = candidates.get(outpoint);
+            return (evidence != null && token != null && evidence.txs.some(tx => this.consumesSameIdentityToken(tx, token)));
+        });
+        if (provenContinuations.length !== 1)
+            return undefined;
+        return candidates.get(provenContinuations[0]);
+    }
+    /**
+     * Whether `tx` spends an input whose source output (available in the BEEF)
+     * decodes as a UMP token sharing the candidate's presentation or recovery
+     * hash — on-chain proof that the candidate is an update of a same-identity
+     * predecessor rather than an independently minted token.
+     */
+    consumesSameIdentityToken(tx, token) {
+        const presentationHash = sdk_1.Utils.toHex(token.presentationHash);
+        const recoveryHash = sdk_1.Utils.toHex(token.recoveryHash);
+        for (const input of tx.inputs) {
+            const source = input.sourceTransaction;
+            if (source == null || input.sourceOutputIndex == null)
+                continue;
+            const sourceOutput = source.outputs[input.sourceOutputIndex];
+            if (sourceOutput == null)
+                continue;
+            try {
+                const decoded = sdk_1.PushDrop.decode(sourceOutput.lockingScript);
+                if (decoded.fields == null)
+                    continue;
+                const fields = stripVerifiedPushDropSignature(decoded.fields, decoded.lockingPublicKey);
+                if (fields.length < 11 || fields[6]?.length !== 32 || fields[7]?.length !== 32)
+                    continue;
+                if (sdk_1.Utils.toHex(fields[6]) === presentationHash || sdk_1.Utils.toHex(fields[7]) === recoveryHash) {
+                    return true;
+                }
+            }
+            catch {
+                continue;
+            }
+        }
+        return false;
+    }
+    /**
+     * Accumulates every outpoint spent by `tx` and by the ancestor transactions
+     * embedded in its BEEF, so supersession is detected even when intermediate
+     * renditions are absent from the lookup answer. Iterative so arbitrarily
+     * long update chains cannot exhaust the call stack.
+     */
+    collectSpentOutpoints(tx, spent, visited) {
+        const pending = [tx];
+        while (pending.length > 0) {
+            const current = pending.pop();
+            const txid = current.id('hex');
+            if (visited.has(txid))
+                continue;
+            visited.add(txid);
+            for (const input of current.inputs) {
+                const sourceTxid = input.sourceTXID ?? input.sourceTransaction?.id('hex');
+                if (sourceTxid == null || input.sourceOutputIndex == null)
+                    continue;
+                spent.add(`${sourceTxid}.${input.sourceOutputIndex}`);
+                if (input.sourceTransaction != null) {
+                    pending.push(input.sourceTransaction);
+                }
+            }
+        }
+    }
+    emptyLookupDiagnostics(correlationId) {
+        return {
+            hostCount: 0,
+            completedHosts: 0,
+            successfulHosts: 0,
+            emptyHosts: 0,
+            failedHosts: 0,
+            rejectedHosts: 0,
+            freeformHosts: 0,
+            outputCount: 0,
+            ...(correlationId !== undefined ? { correlationId } : {})
         };
-        const answer = await this.resolver.query(question);
-        return this.parseLookupAnswer(answer);
+    }
+    toLookupDiagnostics(resolution) {
+        const progress = resolution.progress;
+        return {
+            hostCount: progress.hostCount,
+            completedHosts: progress.completedHosts,
+            successfulHosts: progress.successfulHosts,
+            emptyHosts: progress.emptyHosts,
+            failedHosts: progress.failedHosts,
+            rejectedHosts: progress.rejectedHosts,
+            freeformHosts: progress.freeformHosts,
+            outputCount: resolution.answer.outputs.length,
+            ...(progress.correlationId !== undefined ? { correlationId: progress.correlationId } : {})
+        };
+    }
+    lookupDiagnosticAttributes(diagnostics) {
+        return {
+            hostCount: diagnostics.hostCount,
+            completedHosts: diagnostics.completedHosts,
+            successfulHosts: diagnostics.successfulHosts,
+            emptyHosts: diagnostics.emptyHosts,
+            failedHosts: diagnostics.failedHosts,
+            rejectedHosts: diagnostics.rejectedHosts,
+            freeformHosts: diagnostics.freeformHosts,
+            outputCount: diagnostics.outputCount
+        };
+    }
+    captureLookupCompleted(lookupKind, result, diagnostics, startedAt, extraAttributes = {}) {
+        this.telemetry.capture({
+            name: 'wallet-toolbox.ump.lookup.completed',
+            component: 'wallet-toolbox.ump',
+            severity: 'info',
+            correlationId: diagnostics.correlationId,
+            attributes: {
+                lookupKind,
+                result,
+                durationMs: Date.now() - startedAt,
+                ...this.lookupDiagnosticAttributes(diagnostics),
+                ...extraAttributes
+            }
+        });
+    }
+    captureLookupFailure(lookupKind, reason, diagnostics, startedAt, error) {
+        this.telemetry.capture({
+            name: 'wallet-toolbox.ump.lookup.indeterminate',
+            component: 'wallet-toolbox.ump',
+            severity: 'warn',
+            correlationId: diagnostics.correlationId,
+            attributes: {
+                lookupKind,
+                reason,
+                durationMs: Date.now() - startedAt,
+                ...this.lookupDiagnosticAttributes(diagnostics)
+            },
+            error
+        });
     }
     /**
      * Creates or updates (replaces) a UMP token on-chain. If `oldTokenToConsume` is provided,
@@ -207,7 +565,38 @@ class OverlayUMPTokenInteractor {
      */
     async buildAndSend(wallet, // This wallet MUST be the one built for the default profile
     adminOriginator, token, oldTokenToConsume) {
-        // 1) Construct the data fields for the new UMP token.
+        // 1) Construct the data fields and PushDrop locking script for the new UMP token.
+        const fields = this.buildUMPTokenFields(token);
+        const script = await new sdk_1.PushDrop(wallet, adminOriginator).lock(fields, [2, 'admin user management token'], '1', 'self', 
+        /* forSelf= */ true, 
+        /* includeSignature= */ true);
+        const tokenOutput = [{ lockingScript: script.toHex(), satoshis: 1, outputDescription: 'New UMP token output' }];
+        // 2) Resolve the old-token input (if provided) and create the action.
+        const { resolvedOldToken, inputToken } = await this.resolveOldTokenInput(oldTokenToConsume);
+        const inputs = resolvedOldToken?.currentOutpoint
+            ? [
+                {
+                    outpoint: resolvedOldToken.currentOutpoint,
+                    unlockingScriptLength: 73,
+                    inputDescription: 'Consume old UMP token'
+                }
+            ]
+            : [];
+        const createResult = await this.createUMPAction(wallet, adminOriginator, inputs, tokenOutput, inputToken, resolvedOldToken);
+        // 3) If the wallet fully processed it (no signable tx), broadcast and return.
+        if (!createResult.signableTransaction) {
+            return await this.broadcastFinishedUMPAction(createResult);
+        }
+        // 4) Sign and broadcast: with old token input or without.
+        const reference = createResult.signableTransaction.reference;
+        const partialTx = sdk_1.Transaction.fromBEEF(createResult.signableTransaction.tx);
+        if (resolvedOldToken?.currentOutpoint) {
+            return await this.signAndBroadcastWithOldToken(wallet, adminOriginator, reference, partialTx);
+        }
+        return await this.signAndBroadcastNewToken(wallet, adminOriginator, reference);
+    }
+    /** Assembles the ordered number[][] fields array from a UMPToken. */
+    buildUMPTokenFields(token) {
         const fields = [];
         fields[0] = token.passwordSalt;
         fields[1] = token.passwordPresentationPrimary;
@@ -220,146 +609,110 @@ class OverlayUMPTokenInteractor {
         fields[8] = token.presentationKeyEncrypted;
         fields[9] = token.passwordKeyEncrypted;
         fields[10] = token.recoveryKeyEncrypted;
-        // Optional field for encrypted profiles
-        if (token.profilesEncrypted) {
+        if (token.profilesEncrypted != null)
             fields[11] = token.profilesEncrypted;
-        }
-        // V3 fields: umpVersion, kdfAlgorithm, kdfParams
-        if (token.umpVersion === 3 && token.passwordKdf) {
-            const versionFieldIndex = token.profilesEncrypted ? 12 : 11;
-            fields[versionFieldIndex] = [token.umpVersion]; // Single byte
-            fields[versionFieldIndex + 1] = sdk_1.Utils.toArray(token.passwordKdf.algorithm, 'utf8');
-            // Construct kdfParams JSON
-            const kdfParams = {
-                iterations: token.passwordKdf.iterations
-            };
-            if (token.passwordKdf.memoryKiB !== undefined) {
+        if (token.umpVersion === 3 && token.passwordKdf != null) {
+            const vi = token.profilesEncrypted == null ? 11 : 12;
+            fields[vi] = [token.umpVersion];
+            fields[vi + 1] = sdk_1.Utils.toArray(token.passwordKdf.algorithm, 'utf8');
+            const kdfParams = { iterations: token.passwordKdf.iterations };
+            if (token.passwordKdf.memoryKiB !== undefined)
                 kdfParams.memoryKiB = token.passwordKdf.memoryKiB;
-            }
-            if (token.passwordKdf.parallelism !== undefined) {
+            if (token.passwordKdf.parallelism !== undefined)
                 kdfParams.parallelism = token.passwordKdf.parallelism;
-            }
-            if (token.passwordKdf.hashLength !== undefined) {
+            if (token.passwordKdf.hashLength !== undefined)
                 kdfParams.hashLength = token.passwordKdf.hashLength;
-            }
-            fields[versionFieldIndex + 2] = sdk_1.Utils.toArray(JSON.stringify(kdfParams), 'utf8');
-        }
-        // 2) Create a PushDrop script referencing these fields, locked with the admin key.
-        // The signature will be added as trailing metadata by PushDrop (not part of protocol fields).
-        const script = await new sdk_1.PushDrop(wallet, adminOriginator).lock(fields, [2, 'admin user management token'], // protocolID
-        '1', // keyID
-        'self', // counterparty
-        /*forSelf=*/ true, 
-        /*includeSignature=*/ true);
-        // 3) Prepare the createAction call. If oldTokenToConsume is provided, gather the outpoint.
-        const inputs = [];
-        let inputToken;
-        if (oldTokenToConsume === null || oldTokenToConsume === void 0 ? void 0 : oldTokenToConsume.currentOutpoint) {
-            inputToken = await this.findByOutpoint(oldTokenToConsume.currentOutpoint);
-            // If there is no token on the overlay, we can't consume it. Just start over with a new token.
-            if (!inputToken) {
-                oldTokenToConsume = undefined;
-                // Otherwise, add the input
-            }
-            else {
-                inputs.push({
-                    outpoint: oldTokenToConsume.currentOutpoint,
-                    unlockingScriptLength: 73, // typical signature length
-                    inputDescription: 'Consume old UMP token'
-                });
-            }
+            fields[vi + 2] = sdk_1.Utils.toArray(JSON.stringify(kdfParams), 'utf8');
         }
-        const outputs = [
-            {
-                lockingScript: script.toHex(),
-                satoshis: 1,
-                outputDescription: 'New UMP token output'
-            }
-        ];
-        // 4) Build the partial transaction via createAction.
-        let createResult;
+        return fields;
+    }
+    /** Looks up the old token on the overlay; returns undefined resolved token if not found. */
+    async resolveOldTokenInput(oldTokenToConsume) {
+        if (!oldTokenToConsume?.currentOutpoint)
+            return { resolvedOldToken: undefined, inputToken: undefined };
+        const inputToken = await this.findByOutpoint(oldTokenToConsume.currentOutpoint);
+        if (inputToken == null) {
+            throw new Error('The previous UMP token could not be resolved; refusing to publish a duplicate token.');
+        }
+        return { resolvedOldToken: oldTokenToConsume, inputToken };
+    }
+    /** Creates the UMP action without dropping a required old-token input on failure. */
+    async createUMPAction(wallet, adminOriginator, inputs, outputs, inputToken, resolvedOldToken) {
         try {
-            createResult = await wallet.createAction({
-                description: oldTokenToConsume ? 'Renew UMP token (consume old, create new)' : 'Create new UMP token',
+            return await wallet.createAction({
+                description: resolvedOldToken == null ? 'Create new UMP token' : 'Renew UMP token (consume old, create new)',
                 inputs,
                 outputs,
-                inputBEEF: inputToken === null || inputToken === void 0 ? void 0 : inputToken.beef,
-                options: {
-                    randomizeOutputs: false,
-                    acceptDelayedBroadcast: false
-                }
-            }, adminOriginator);
-        }
-        catch (e) {
-            console.error('Error with UMP token update. Attempting a last-ditch effort to get a new one', e);
-            createResult = await wallet.createAction({
-                description: 'Recover UMP token',
-                outputs,
-                options: {
-                    randomizeOutputs: false,
-                    acceptDelayedBroadcast: false
-                }
+                inputBEEF: inputToken?.beef,
+                options: { randomizeOutputs: false, acceptDelayedBroadcast: false }
             }, adminOriginator);
         }
-        // If the transaction is fully processed by the wallet
-        if (!createResult.signableTransaction) {
-            const finalTxid = createResult.txid || (createResult.tx ? sdk_1.Transaction.fromAtomicBEEF(createResult.tx).id('hex') : undefined);
-            if (!finalTxid) {
-                throw new Error('No signableTransaction and no final TX found.');
-            }
-            // Now broadcast to `tm_users` using SHIP
-            const broadcastTx = sdk_1.Transaction.fromAtomicBEEF(createResult.tx);
-            const result = await this.broadcaster.broadcast(broadcastTx);
-            console.log('BROADCAST RESULT', result);
-            return `${finalTxid}.0`;
-        }
-        // 5) If oldTokenToConsume is present, we must sign the input referencing it.
-        //    (If there's no old token, there's nothing to sign for the input.)
-        let finalTxid = '';
-        const reference = createResult.signableTransaction.reference;
-        const partialTx = sdk_1.Transaction.fromBEEF(createResult.signableTransaction.tx);
-        if (oldTokenToConsume === null || oldTokenToConsume === void 0 ? void 0 : oldTokenToConsume.currentOutpoint) {
-            // Unlock the old token with a matching PushDrop unlocker
-            const unlocker = new sdk_1.PushDrop(wallet, adminOriginator).unlock([2, 'admin user management token'], '1', 'self');
-            const unlockingScript = await unlocker.sign(partialTx, 0);
-            // Provide it to the wallet
-            const signResult = await wallet.signAction({
-                reference,
-                spends: {
-                    0: {
-                        unlockingScript: unlockingScript.toHex()
-                    }
-                }
-            }, adminOriginator);
-            finalTxid = signResult.txid || (signResult.tx ? sdk_1.Transaction.fromAtomicBEEF(signResult.tx).id('hex') : '');
-            if (!finalTxid) {
-                throw new Error('Could not finalize transaction for renewed UMP token.');
-            }
-            // 6) Broadcast to `tm_users`
-            const finalAtomicTx = signResult.tx;
-            if (!finalAtomicTx) {
-                throw new Error('Final transaction data missing after signing renewed UMP token.');
-            }
-            const broadcastTx = sdk_1.Transaction.fromAtomicBEEF(finalAtomicTx);
-            const result = await this.broadcaster.broadcast(broadcastTx);
-            console.log('BROADCAST RESULT', result);
-            return `${finalTxid}.0`;
-        }
-        else {
-            // Fallback for creating a new token (no input spending)
-            const signResult = await wallet.signAction({ reference, spends: {} }, adminOriginator);
-            finalTxid = signResult.txid || (signResult.tx ? sdk_1.Transaction.fromAtomicBEEF(signResult.tx).id('hex') : '');
-            if (!finalTxid) {
-                throw new Error('Failed to finalize new UMP token transaction.');
-            }
-            const finalAtomicTx = signResult.tx;
-            if (!finalAtomicTx) {
-                throw new Error('Final transaction data missing after signing new UMP token.');
+        catch (error) {
+            this.telemetry.capture({
+                name: 'wallet-toolbox.ump.action.failed',
+                component: 'wallet-toolbox.ump',
+                severity: 'error',
+                attributes: {
+                    operation: resolvedOldToken == null ? 'create' : 'renew',
+                    oldTokenInputRequired: resolvedOldToken != null
+                },
+                error
+            });
+            throw error;
+        }
+    }
+    /** Handles a fully-finalized (no signable tx) createAction result — broadcasts and returns outpoint. */
+    async broadcastFinishedUMPAction(createResult) {
+        const finalTxid = createResult.txid || (createResult.tx != null ? sdk_1.Transaction.fromAtomicBEEF(createResult.tx).id('hex') : undefined);
+        if (!finalTxid)
+            throw new Error('No signableTransaction and no final TX found.');
+        if (createResult.tx == null)
+            throw new Error('No final TX data to broadcast.');
+        const broadcastTx = sdk_1.Transaction.fromAtomicBEEF(createResult.tx);
+        const result = await this.broadcaster.broadcast(broadcastTx);
+        this.assertSuccessfulBroadcast(result, 'create-finalized');
+        return `${finalTxid}.0`;
+    }
+    /** Signs the old-token input and broadcasts — used during UMP token renewal. */
+    async signAndBroadcastWithOldToken(wallet, adminOriginator, reference, partialTx) {
+        const unlocker = new sdk_1.PushDrop(wallet, adminOriginator).unlock([2, 'admin user management token'], '1', 'self');
+        const unlockingScript = await unlocker.sign(partialTx, 0);
+        const signResult = await wallet.signAction({ reference, spends: { 0: { unlockingScript: unlockingScript.toHex() } } }, adminOriginator);
+        const finalTxid = signResult.txid || (signResult.tx == null ? '' : sdk_1.Transaction.fromAtomicBEEF(signResult.tx).id('hex'));
+        if (!finalTxid)
+            throw new Error('Could not finalize transaction for renewed UMP token.');
+        if (signResult.tx == null)
+            throw new Error('Final transaction data missing after signing renewed UMP token.');
+        const result = await this.broadcaster.broadcast(sdk_1.Transaction.fromAtomicBEEF(signResult.tx));
+        this.assertSuccessfulBroadcast(result, 'renew');
+        return `${finalTxid}.0`;
+    }
+    /** Signs without input spending and broadcasts — used when creating a brand-new UMP token. */
+    async signAndBroadcastNewToken(wallet, adminOriginator, reference) {
+        const signResult = await wallet.signAction({ reference, spends: {} }, adminOriginator);
+        const finalTxid = signResult.txid || (signResult.tx == null ? '' : sdk_1.Transaction.fromAtomicBEEF(signResult.tx).id('hex'));
+        if (!finalTxid)
+            throw new Error('Failed to finalize new UMP token transaction.');
+        if (signResult.tx == null)
+            throw new Error('Final transaction data missing after signing new UMP token.');
+        const result = await this.broadcaster.broadcast(sdk_1.Transaction.fromAtomicBEEF(signResult.tx));
+        this.assertSuccessfulBroadcast(result, 'create');
+        return `${finalTxid}.0`;
+    }
+    assertSuccessfulBroadcast(result, operation) {
+        const succeeded = result.status === 'success';
+        this.telemetry.capture({
+            name: succeeded ? 'wallet-toolbox.ump.broadcast.completed' : 'wallet-toolbox.ump.broadcast.failed',
+            component: 'wallet-toolbox.ump',
+            severity: succeeded ? 'info' : 'error',
+            attributes: {
+                operation,
+                outcome: result.status,
+                ...(result.status === 'error' ? { code: result.code } : {})
             }
-            const broadcastTx = sdk_1.Transaction.fromAtomicBEEF(finalAtomicTx);
-            const result = await this.broadcaster.broadcast(broadcastTx);
-            console.log('BROADCAST RESULT', result);
-            return `${finalTxid}.0`;
+        });
+        if (!succeeded) {
+            throw new Error(`UMP token broadcast failed (${result.code}).`);
         }
     }
     /**
@@ -371,35 +724,36 @@ class OverlayUMPTokenInteractor {
      * @returns The parsed UMPToken or `undefined` if none found/decodable.
      */
     parseLookupAnswer(answer) {
-        var _a, _b, _c;
-        if (answer.type !== 'output-list') {
-            return undefined;
-        }
-        if (!answer.outputs || answer.outputs.length === 0) {
-            return undefined;
+        return this.parseLookupAnswers(answer)[0];
+    }
+    parseLookupAnswers(answer) {
+        if (answer.type !== 'output-list' || answer.outputs.length === 0)
+            return [];
+        const tokens = [];
+        for (const output of answer.outputs) {
+            const token = this.parseLookupOutput(output);
+            if (token != null)
+                tokens.push(token);
         }
-        const { beef, outputIndex } = answer.outputs[0];
+        return tokens;
+    }
+    parseLookupOutput(output) {
         try {
-            const tx = sdk_1.Transaction.fromBEEF(beef);
-            const outpoint = `${tx.id('hex')}.${outputIndex}`;
-            const decoded = sdk_1.PushDrop.decode(tx.outputs[outputIndex].lockingScript);
-            // Expecting 11 or more fields for UMP
-            if (!decoded.fields || decoded.fields.length < 11) {
-                console.warn(`Unexpected number of fields in UMP token: ${(_a = decoded.fields) === null || _a === void 0 ? void 0 : _a.length}`);
+            const tx = sdk_1.Transaction.fromBEEF(output.beef);
+            const txOutput = tx.outputs[output.outputIndex];
+            if (txOutput == null)
+                return undefined;
+            const decoded = sdk_1.PushDrop.decode(txOutput.lockingScript);
+            if (decoded.fields == null || decoded.fields.length < 11 || decoded.fields.length > 16) {
+                return undefined;
+            }
+            const protocolFields = stripVerifiedPushDropSignature(decoded.fields, decoded.lockingPublicKey);
+            if (protocolFields.length < 11 ||
+                protocolFields.slice(0, 11).some(field => field.length === 0 || field.length > exports.MAX_STATE_SNAPSHOT_BYTES)) {
                 return undefined;
             }
-            // Parse protocol fields, excluding the trailing PushDrop signature only when
-            // it is cryptographically valid for the preceding field payload.
-            let protocolFields = stripVerifiedPushDropSignature(decoded.fields, decoded.lockingPublicKey);
-            // Detect v3 token metadata in either layout:
-            // - with profilesEncrypted present: [0..10]=core, [11]=profiles, [12]=version, [13]=algorithm, [14]=params
-            // - without profilesEncrypted:      [0..10]=core, [11]=version, [12]=algorithm, [13]=params
-            const hasV3MetadataWithProfiles = protocolFields.length >= 15 && ((_b = protocolFields[12]) === null || _b === void 0 ? void 0 : _b.length) === 1 && protocolFields[12][0] === 3;
-            const hasV3MetadataWithoutProfiles = protocolFields.length >= 14 && ((_c = protocolFields[11]) === null || _c === void 0 ? void 0 : _c.length) === 1 && protocolFields[11][0] === 3;
-            const kdfVersionFieldIndex = hasV3MetadataWithProfiles ? 12 : hasV3MetadataWithoutProfiles ? 11 : -1;
-            // Build the UMP token from these fields, preserving outpoint
-            const t = {
-                // Core fields (unchanged for all versions)
+            const kdfVersionFieldIndex = findKdfVersionFieldIndex(protocolFields);
+            const token = {
                 passwordSalt: protocolFields[0],
                 passwordPresentationPrimary: protocolFields[1],
                 passwordRecoveryPrimary: protocolFields[2],
@@ -411,41 +765,17 @@ class OverlayUMPTokenInteractor {
                 presentationKeyEncrypted: protocolFields[8],
                 passwordKeyEncrypted: protocolFields[9],
                 recoveryKeyEncrypted: protocolFields[10],
-                currentOutpoint: outpoint
+                currentOutpoint: `${tx.id('hex')}.${output.outputIndex}`
             };
-            // Encrypted profiles (optional, all versions)
-            const hasProfilesField = hasV3MetadataWithProfiles || (!hasV3MetadataWithoutProfiles && !!protocolFields[11]);
-            if (hasProfilesField && protocolFields[11] && protocolFields[11].length > 0) {
-                t.profilesEncrypted = protocolFields[11];
-            }
-            // V3 fields: umpVersion, kdfAlgorithm, kdfParams (fields 12, 13, 14)
-            if (kdfVersionFieldIndex !== -1) {
-                t.umpVersion = protocolFields[kdfVersionFieldIndex][0]; // Single byte value 3
-                const kdfAlgorithmField = protocolFields[kdfVersionFieldIndex + 1];
-                const kdfParamsField = protocolFields[kdfVersionFieldIndex + 2];
-                if (!kdfAlgorithmField || !kdfParamsField) {
-                    return t;
-                }
-                const kdfAlgorithm = sdk_1.Utils.toUTF8(kdfAlgorithmField);
-                const kdfParamsJson = sdk_1.Utils.toUTF8(kdfParamsField);
-                try {
-                    const kdfParams = JSON.parse(kdfParamsJson);
-                    t.passwordKdf = {
-                        algorithm: kdfAlgorithm,
-                        iterations: kdfParams.iterations,
-                        memoryKiB: kdfParams.memoryKiB,
-                        parallelism: kdfParams.parallelism,
-                        hashLength: kdfParams.hashLength
-                    };
-                }
-                catch (e) {
-                    console.warn('Failed to parse v3 KDF params:', e);
-                }
-            }
-            return t;
+            if (token.presentationHash.length !== 32 || token.recoveryHash.length !== 32)
+                return undefined;
+            if (!addProfilesField(token, protocolFields, kdfVersionFieldIndex))
+                return undefined;
+            if (!addPasswordKdf(token, protocolFields, kdfVersionFieldIndex))
+                return undefined;
+            return token;
         }
-        catch (e) {
-            console.error('Failed to parse or decode UMP token:', e);
+        catch {
             return undefined;
         }
     }
@@ -455,19 +785,35 @@ class OverlayUMPTokenInteractor {
      * @returns The result so that we can use it to unlock the transaction
      */
     async findByOutpoint(outpoint) {
-        const results = await this.resolver.query({
-            service: 'ls_users',
-            query: {
-                outpoint
-            }
-        });
-        if (results.type !== 'output-list') {
-            return undefined;
+        const correlationId = this.telemetry.enabled === true ? this.telemetry.createCorrelationId() : undefined;
+        const startedAt = Date.now();
+        let resolution;
+        try {
+            resolution = await this.resolver.queryDetailed({
+                service: 'ls_users',
+                query: {
+                    outpoint
+                }
+            }, undefined, {
+                waitForAllHosts: true,
+                correlationId
+            });
         }
-        if (!results.outputs || !results.outputs.length) {
+        catch (error) {
+            const diagnostics = this.emptyLookupDiagnostics(correlationId);
+            this.captureLookupFailure('outpoint', 'lookup-unavailable', diagnostics, startedAt, error);
+            throw new UMPTokenLookupError('lookup-unavailable', diagnostics, { cause: error });
+        }
+        if (resolution.answer.outputs.length === 0) {
+            const p = resolution.progress;
+            if (p.emptyHosts === 0) {
+                const diagnostics = this.toLookupDiagnostics(resolution);
+                this.captureLookupFailure('outpoint', 'lookup-incomplete', diagnostics, startedAt);
+                throw new UMPTokenLookupError('lookup-incomplete', diagnostics);
+            }
             return undefined;
         }
-        return results.outputs[0];
+        return resolution.answer.outputs[0];
     }
 }
 exports.OverlayUMPTokenInteractor = OverlayUMPTokenInteractor;
@@ -477,6 +823,98 @@ exports.OverlayUMPTokenInteractor = OverlayUMPTokenInteractor;
  * supporting multiple user profiles under a single account.
  */
 class CWIStyleWalletManager {
+    /**
+     * Whether the user is currently authenticated (i.e., root keys are available).
+     */
+    authenticated;
+    /**
+     * Resolves once the optional snapshot (if provided to the constructor) has been
+     * fully loaded and the wallet is ready to accept calls.
+     * When no snapshot is provided this resolves immediately.
+     * Await `ready` before calling wallet methods after constructing with a snapshot.
+     */
+    get ready() {
+        this._readyInit ??= this._init();
+        return this._readyInit;
+    }
+    _readyInit;
+    _initSnapshot;
+    /**
+     * The domain name of the administrative originator (wallet operator / vendor, or your own).
+     */
+    adminOriginator;
+    /**
+     * The system that locates and publishes UMP tokens on-chain.
+     */
+    UMPTokenInteractor;
+    /**
+     * Privacy-bounded diagnostic channel for wallet state transitions.
+     */
+    telemetry;
+    /**
+     * A function called to persist the newly generated recovery key.
+     * It should generally trigger a UI prompt where the user is asked to write it down.
+     */
+    recoveryKeySaver;
+    /**
+     * Asks the user to enter their password, for a given reason.
+     * The test function can be used to see if the password is correct before resolving.
+     * Only resolve with the correct password or reject with an error.
+     * Resolving with an incorrect password will throw an error.
+     */
+    passwordRetriever;
+    /**
+     * Optional function to fund a new Wallet after the new-user flow.
+     */
+    newWalletFunder;
+    /**
+     * Builds the underlying wallet for a specific profile.
+     */
+    walletBuilder;
+    /**
+     * Current mode of authentication.
+     */
+    authenticationMode = 'presentation-key-and-password';
+    /**
+     * Indicates new user or existing user flow.
+     */
+    authenticationFlow = 'unknown';
+    /**
+     * The current UMP token in use.
+     */
+    currentUMPToken;
+    /**
+     * Temporarily retained presentation key.
+     */
+    presentationKey;
+    /**
+     * Temporarily retained recovery key.
+     */
+    recoveryKey;
+    /**
+     * The user's *root* primary key, derived from authentication factors.
+     */
+    rootPrimaryKey;
+    /**
+     * The currently active profile ID (null or DEFAULT_PROFILE_ID means default profile).
+     */
+    activeProfileId = exports.DEFAULT_PROFILE_ID;
+    /**
+     * List of loaded non-default profiles.
+     */
+    profiles = [];
+    /**
+     * The underlying wallet instance for the *active* profile.
+     */
+    underlying;
+    /**
+     * Privileged key manager associated with the *root* keys, aware of the active profile.
+     */
+    rootPrivilegedKeyManager;
+    /**
+     * KDF configuration for new UMP tokens. Defaults to Argon2id for v3 tokens.
+     */
+    kdfConfig;
     /**
      * Constructs a new CWIStyleWalletManager.
      *
@@ -489,49 +927,54 @@ class CWIStyleWalletManager {
      * @param stateSnapshot     Optional previously saved state snapshot.
      * @param kdfConfig         Optional KDF configuration for new UMP tokens.
      */
-    constructor(adminOriginator, walletBuilder, interactor = new OverlayUMPTokenInteractor(), recoveryKeySaver, passwordRetriever, newWalletFunder, stateSnapshot, kdfConfig) {
-        var _a, _b, _c, _d, _e;
-        /**
-         * Current mode of authentication.
-         */
-        this.authenticationMode = 'presentation-key-and-password';
-        /**
-         * Indicates new user or existing user flow.
-         */
-        this.authenticationFlow = 'new-user';
-        /**
-         * The currently active profile ID (null or DEFAULT_PROFILE_ID means default profile).
-         */
-        this.activeProfileId = exports.DEFAULT_PROFILE_ID;
-        /**
-         * List of loaded non-default profiles.
-         */
-        this.profiles = [];
+    constructor(...[adminOriginator, walletBuilder, interactor, recoveryKeySaver, passwordRetriever, newWalletFunder, stateSnapshot, kdfConfig, telemetry]) {
         this.adminOriginator = adminOriginator;
         this.walletBuilder = walletBuilder;
-        this.UMPTokenInteractor = interactor;
+        this.telemetry = new sdk_1.Telemetry(telemetry);
+        this.UMPTokenInteractor = interactor ?? new OverlayUMPTokenInteractor(undefined, undefined, telemetry);
         this.recoveryKeySaver = recoveryKeySaver;
         this.passwordRetriever = passwordRetriever;
         this.authenticated = false;
         this.newWalletFunder = newWalletFunder;
         // Initialize KDF config with Argon2id defaults for v3 tokens
+        const kdfAlgorithm = kdfConfig?.algorithm ?? 'argon2id';
         this.kdfConfig = {
-            algorithm: (_a = kdfConfig === null || kdfConfig === void 0 ? void 0 : kdfConfig.algorithm) !== null && _a !== void 0 ? _a : 'argon2id',
-            iterations: (_b = kdfConfig === null || kdfConfig === void 0 ? void 0 : kdfConfig.iterations) !== null && _b !== void 0 ? _b : exports.ARGON2ID_DEFAULT_ITERATIONS,
-            memoryKiB: (_c = kdfConfig === null || kdfConfig === void 0 ? void 0 : kdfConfig.memoryKiB) !== null && _c !== void 0 ? _c : exports.ARGON2ID_DEFAULT_MEMORY_KIB,
-            parallelism: (_d = kdfConfig === null || kdfConfig === void 0 ? void 0 : kdfConfig.parallelism) !== null && _d !== void 0 ? _d : exports.ARGON2ID_DEFAULT_PARALLELISM,
-            hashLength: (_e = kdfConfig === null || kdfConfig === void 0 ? void 0 : kdfConfig.hashLength) !== null && _e !== void 0 ? _e : exports.ARGON2ID_DEFAULT_HASH_LENGTH
+            algorithm: kdfAlgorithm,
+            iterations: kdfConfig?.iterations ?? (kdfAlgorithm === 'argon2id' ? exports.ARGON2ID_DEFAULT_ITERATIONS : exports.PBKDF2_NUM_ROUNDS),
+            memoryKiB: kdfConfig?.memoryKiB ?? exports.ARGON2ID_DEFAULT_MEMORY_KIB,
+            parallelism: kdfConfig?.parallelism ?? exports.ARGON2ID_DEFAULT_PARALLELISM,
+            hashLength: kdfConfig?.hashLength ?? exports.ARGON2ID_DEFAULT_HASH_LENGTH
         };
-        // If a saved snapshot is provided, attempt to load it.
-        // Note: loadSnapshot now returns a promise. We don't await it here,
-        // as the constructor must be synchronous. The caller should check
-        // `this.authenticated` after construction if a snapshot was provided.
-        if (stateSnapshot) {
-            this.loadSnapshot(stateSnapshot).catch(err => {
-                console.error('Failed to load snapshot during construction:', err);
-                // Clear potentially partially loaded state
-                this.destroy();
+        if (!isValidKdfConfig(this.kdfConfig)) {
+            throw new Error('Unsupported or unsafe KDF configuration.');
+        }
+        // Store snapshot for lazy init; callers await ready before calling wallet methods.
+        this._initSnapshot = stateSnapshot;
+    }
+    async _init() {
+        if (this._initSnapshot !== undefined) {
+            this.telemetry.capture({
+                name: 'wallet-toolbox.snapshot.initialization.started',
+                component: 'wallet-toolbox.cwi-manager',
+                severity: 'debug'
             });
+            try {
+                await this.loadSnapshot(this._initSnapshot);
+                this.telemetry.capture({
+                    name: 'wallet-toolbox.snapshot.initialization.completed',
+                    component: 'wallet-toolbox.cwi-manager',
+                    severity: 'info'
+                });
+            }
+            catch (error) {
+                this.telemetry.capture({
+                    name: 'wallet-toolbox.snapshot.initialization.failed',
+                    component: 'wallet-toolbox.cwi-manager',
+                    severity: 'error',
+                    error
+                });
+                throw error;
+            }
         }
     }
     // --- Authentication Methods ---
@@ -545,9 +988,36 @@ class CWIStyleWalletManager {
         if (this.authenticationMode === 'recovery-key-and-password') {
             throw new Error('Presentation key is not needed in this mode');
         }
+        if (key.length !== 32 || key.some(byte => !Number.isInteger(byte) || byte < 0 || byte > 255)) {
+            throw new TypeError('Presentation key must contain exactly 32 bytes.');
+        }
+        this.authenticationFlow = 'unknown';
         const hash = sdk_1.Hash.sha256(key);
-        const token = await this.UMPTokenInteractor.findByPresentationKeyHash(hash);
-        if (!token) {
+        const startedAt = Date.now();
+        this.telemetry.capture({
+            name: 'wallet-toolbox.authentication.account-lookup.started',
+            component: 'wallet-toolbox.cwi-manager',
+            severity: 'debug',
+            attributes: { lookupKind: 'presentation' }
+        });
+        let token;
+        try {
+            token = await this.UMPTokenInteractor.findByPresentationKeyHash(hash);
+        }
+        catch (error) {
+            this.telemetry.capture({
+                name: 'wallet-toolbox.authentication.account-lookup.failed',
+                component: 'wallet-toolbox.cwi-manager',
+                severity: 'warn',
+                attributes: {
+                    lookupKind: 'presentation',
+                    durationMs: Date.now() - startedAt
+                },
+                error
+            });
+            throw error;
+        }
+        if (token == null) {
             // No token found -> New user
             this.authenticationFlow = 'new-user';
             this.presentationKey = key;
@@ -558,124 +1028,120 @@ class CWIStyleWalletManager {
             this.presentationKey = key;
             this.currentUMPToken = token;
         }
+        this.telemetry.capture({
+            name: 'wallet-toolbox.authentication.account-lookup.completed',
+            component: 'wallet-toolbox.cwi-manager',
+            severity: 'info',
+            attributes: {
+                lookupKind: 'presentation',
+                accountStatus: this.authenticationFlow,
+                durationMs: Date.now() - startedAt
+            }
+        });
     }
     /**
      * Provides the password.
      */
     async providePassword(password) {
-        if (this.authenticated) {
+        if (this.authenticated)
             throw new Error('User is already authenticated');
-        }
         if (this.authenticationMode === 'presentation-key-and-recovery-key') {
             throw new Error('Password is not needed in this mode');
         }
+        if (this.authenticationFlow === 'unknown') {
+            throw new Error('Determine account status with a presentation or recovery key before providing a password.');
+        }
         if (this.authenticationFlow === 'existing-user') {
-            // Existing user flow
-            if (!this.currentUMPToken) {
-                throw new Error('Provide presentation or recovery key first.');
-            }
-            // Use token-driven KDF (legacy PBKDF2 or v3 Argon2id)
-            const derivedPasswordKey = await derivePasswordKey(this.currentUMPToken, sdk_1.Utils.toArray(password, 'utf8'));
-            let rootPrimaryKey;
-            let rootPrivilegedKey; // Only needed for recovery mode
-            if (this.authenticationMode === 'presentation-key-and-password') {
-                if (!this.presentationKey)
-                    throw new Error('No presentation key found!');
-                const xorKey = this.XOR(this.presentationKey, derivedPasswordKey);
-                rootPrimaryKey = new sdk_1.SymmetricKey(xorKey).decrypt(this.currentUMPToken.passwordPresentationPrimary);
-            }
-            else {
-                // 'recovery-key-and-password'
-                if (!this.recoveryKey)
-                    throw new Error('No recovery key found!');
-                const primaryDecryptionKey = this.XOR(this.recoveryKey, derivedPasswordKey);
-                rootPrimaryKey = new sdk_1.SymmetricKey(primaryDecryptionKey).decrypt(this.currentUMPToken.passwordRecoveryPrimary);
-                const privilegedDecryptionKey = this.XOR(rootPrimaryKey, derivedPasswordKey);
-                rootPrivilegedKey = new sdk_1.SymmetricKey(privilegedDecryptionKey).decrypt(this.currentUMPToken.passwordPrimaryPrivileged);
-            }
-            // Build root infrastructure, load profiles, and switch to default profile initially
-            await this.setupRootInfrastructure(rootPrimaryKey, rootPrivilegedKey);
-            await this.switchProfile(this.activeProfileId);
+            await this.handleExistingUserPassword(password);
         }
         else {
-            // New user flow (only 'presentation-key-and-password')
-            if (this.authenticationMode !== 'presentation-key-and-password') {
-                throw new Error('New-user flow requires presentation key and password mode.');
-            }
-            if (!this.presentationKey) {
-                throw new Error('No presentation key provided for new-user flow.');
-            }
-            // Generate new keys/salt
-            const recoveryKey = (0, sdk_1.Random)(32);
-            await this.recoveryKeySaver(recoveryKey);
-            const passwordSalt = (0, sdk_1.Random)(32);
-            // Build temporary token with KDF config for password derivation
-            const tempTokenForKdf = {
-                passwordSalt,
-                passwordKdf: this.kdfConfig
-            };
-            const passwordKey = await derivePasswordKey(tempTokenForKdf, sdk_1.Utils.toArray(password, 'utf8'));
-            const rootPrimaryKey = (0, sdk_1.Random)(32);
-            const rootPrivilegedKey = (0, sdk_1.Random)(32);
-            // Build XOR keys
-            const presentationPassword = new sdk_1.SymmetricKey(this.XOR(this.presentationKey, passwordKey));
-            const presentationRecovery = new sdk_1.SymmetricKey(this.XOR(this.presentationKey, recoveryKey));
-            const recoveryPassword = new sdk_1.SymmetricKey(this.XOR(recoveryKey, passwordKey));
-            const primaryPassword = new sdk_1.SymmetricKey(this.XOR(rootPrimaryKey, passwordKey));
-            // Temp manager for encryption
-            const tempPrivilegedKeyManager = new PrivilegedKeyManager_1.PrivilegedKeyManager(async () => new sdk_1.PrivateKey(rootPrivilegedKey));
-            // Build new UMP token (v3 with KDF metadata, no profiles initially)
-            const newToken = {
-                passwordSalt,
-                passwordPresentationPrimary: presentationPassword.encrypt(rootPrimaryKey),
-                passwordRecoveryPrimary: recoveryPassword.encrypt(rootPrimaryKey),
-                presentationRecoveryPrimary: presentationRecovery.encrypt(rootPrimaryKey),
-                passwordPrimaryPrivileged: primaryPassword.encrypt(rootPrivilegedKey),
-                presentationRecoveryPrivileged: presentationRecovery.encrypt(rootPrivilegedKey),
-                presentationHash: sdk_1.Hash.sha256(this.presentationKey),
-                recoveryHash: sdk_1.Hash.sha256(recoveryKey),
-                presentationKeyEncrypted: (await tempPrivilegedKeyManager.encrypt({
-                    plaintext: this.presentationKey,
-                    protocolID: [2, 'admin key wrapping'],
-                    keyID: '1'
-                })).ciphertext,
-                passwordKeyEncrypted: (await tempPrivilegedKeyManager.encrypt({
-                    plaintext: passwordKey,
-                    protocolID: [2, 'admin key wrapping'],
-                    keyID: '1'
-                })).ciphertext,
-                recoveryKeyEncrypted: (await tempPrivilegedKeyManager.encrypt({
-                    plaintext: recoveryKey,
-                    protocolID: [2, 'admin key wrapping'],
-                    keyID: '1'
-                })).ciphertext,
-                profilesEncrypted: undefined, // No profiles yet
-                umpVersion: 3, // UMP protocol version 3
-                passwordKdf: this.kdfConfig // KDF metadata for v3
-            };
-            this.currentUMPToken = newToken;
-            // Setup root infrastructure and switch to default profile
-            await this.setupRootInfrastructure(rootPrimaryKey);
-            await this.switchProfile(exports.DEFAULT_PROFILE_ID);
-            // Fund the *default* wallet if funder provided
-            if (this.newWalletFunder && this.underlying) {
-                try {
-                    await this.newWalletFunder(this.presentationKey, this.underlying, this.adminOriginator);
-                }
-                catch (e) {
-                    console.error('Error funding new wallet:', e);
-                    const message = e instanceof Error ? e.message : String(e);
-                    throw new Error(`Failed to fund new wallet before publishing UMP token: ${message}`);
-                }
+            await this.handleNewUserPassword(password);
+        }
+    }
+    /** Handles the password step for an existing user — derives keys, sets up infrastructure. */
+    async handleExistingUserPassword(password) {
+        if (this.currentUMPToken == null)
+            throw new Error('Provide presentation or recovery key first.');
+        const derivedPasswordKey = await derivePasswordKey(this.currentUMPToken, sdk_1.Utils.toArray(password, 'utf8'));
+        let rootPrimaryKey;
+        let rootPrivilegedKey;
+        if (this.authenticationMode === 'presentation-key-and-password') {
+            if (this.presentationKey == null)
+                throw new Error('No presentation key found!');
+            rootPrimaryKey = new sdk_1.SymmetricKey(this.XOR(this.presentationKey, derivedPasswordKey)).decrypt(this.currentUMPToken.passwordPresentationPrimary);
+        }
+        else {
+            // 'recovery-key-and-password'
+            if (this.recoveryKey == null)
+                throw new Error('No recovery key found!');
+            const primaryDecryptionKey = this.XOR(this.recoveryKey, derivedPasswordKey);
+            rootPrimaryKey = new sdk_1.SymmetricKey(primaryDecryptionKey).decrypt(this.currentUMPToken.passwordRecoveryPrimary);
+            rootPrivilegedKey = new sdk_1.SymmetricKey(this.XOR(rootPrimaryKey, derivedPasswordKey)).decrypt(this.currentUMPToken.passwordPrimaryPrivileged);
+        }
+        await this.setupRootInfrastructure(rootPrimaryKey, rootPrivilegedKey);
+        await this.switchProfile(this.activeProfileId);
+    }
+    /** Handles the password step for a new user — generates keys, builds UMP token, publishes on-chain. */
+    async handleNewUserPassword(password) {
+        if (this.authenticationMode !== 'presentation-key-and-password') {
+            throw new Error('New-user flow requires presentation key and password mode.');
+        }
+        if (this.presentationKey == null)
+            throw new Error('No presentation key provided for new-user flow.');
+        // Generate new keys/salt
+        const recoveryKey = (0, sdk_1.Random)(32);
+        await this.recoveryKeySaver(recoveryKey);
+        const passwordSalt = (0, sdk_1.Random)(32);
+        const passwordKey = await derivePasswordKey({ passwordSalt, passwordKdf: this.kdfConfig }, sdk_1.Utils.toArray(password, 'utf8'));
+        const rootPrimaryKey = (0, sdk_1.Random)(32);
+        const rootPrivilegedKey = (0, sdk_1.Random)(32);
+        // Build XOR-combined symmetric keys
+        const presentationPassword = new sdk_1.SymmetricKey(this.XOR(this.presentationKey, passwordKey));
+        const presentationRecovery = new sdk_1.SymmetricKey(this.XOR(this.presentationKey, recoveryKey));
+        const recoveryPassword = new sdk_1.SymmetricKey(this.XOR(recoveryKey, passwordKey));
+        const primaryPassword = new sdk_1.SymmetricKey(this.XOR(rootPrimaryKey, passwordKey));
+        const tempPrivilegedKeyManager = new PrivilegedKeyManager_1.PrivilegedKeyManager(async () => new sdk_1.PrivateKey(rootPrivilegedKey));
+        const wrapKey = async (plaintext) => (await tempPrivilegedKeyManager.encrypt({ plaintext, protocolID: [2, 'admin key wrapping'], keyID: '1' }))
+            .ciphertext;
+        // Build new UMP token (v3 with KDF metadata, no profiles initially)
+        const newToken = {
+            passwordSalt,
+            passwordPresentationPrimary: presentationPassword.encrypt(rootPrimaryKey),
+            passwordRecoveryPrimary: recoveryPassword.encrypt(rootPrimaryKey),
+            presentationRecoveryPrimary: presentationRecovery.encrypt(rootPrimaryKey),
+            passwordPrimaryPrivileged: primaryPassword.encrypt(rootPrivilegedKey),
+            presentationRecoveryPrivileged: presentationRecovery.encrypt(rootPrivilegedKey),
+            presentationHash: sdk_1.Hash.sha256(this.presentationKey),
+            recoveryHash: sdk_1.Hash.sha256(recoveryKey),
+            presentationKeyEncrypted: await wrapKey(this.presentationKey),
+            passwordKeyEncrypted: await wrapKey(passwordKey),
+            recoveryKeyEncrypted: await wrapKey(recoveryKey),
+            profilesEncrypted: undefined,
+            umpVersion: 3,
+            passwordKdf: this.kdfConfig
+        };
+        this.currentUMPToken = newToken;
+        await this.setupRootInfrastructure(rootPrimaryKey);
+        await this.switchProfile(exports.DEFAULT_PROFILE_ID);
+        // Fund the *default* wallet if funder provided
+        if (this.newWalletFunder != null && this.underlying != null) {
+            try {
+                await this.newWalletFunder(this.presentationKey, this.underlying, this.adminOriginator);
             }
-            // Publish the new UMP token *after* potentially funding
-            // We need the default profile wallet to sign the UMP creation TX
-            if (!this.underlying) {
-                throw new Error('Default profile wallet not built before attempting to publish UMP token.');
+            catch (error) {
+                this.telemetry.capture({
+                    name: 'wallet-toolbox.authentication.new-wallet-funding.failed',
+                    component: 'wallet-toolbox.cwi-manager',
+                    severity: 'error',
+                    error: new Error('New wallet funding failed.')
+                });
+                const message = error instanceof Error ? error.message : String(error);
+                throw new Error(`Failed to fund new wallet before publishing UMP token: ${message}`, { cause: error });
             }
-            this.currentUMPToken.currentOutpoint = await this.UMPTokenInteractor.buildAndSend(this.underlying, // Use the default profile wallet
-            this.adminOriginator, newToken);
         }
+        if (this.underlying == null)
+            throw new Error('Default profile wallet not built before attempting to publish UMP token.');
+        this.currentUMPToken.currentOutpoint = await this.UMPTokenInteractor.buildAndSend(this.underlying, this.adminOriginator, newToken);
     }
     /**
      * Provides the recovery key.
@@ -690,11 +1156,14 @@ class CWIStyleWalletManager {
         if (this.authenticationMode === 'presentation-key-and-password') {
             throw new Error('No recovery key required in this mode');
         }
+        if (recoveryKey.length !== 32 || recoveryKey.some(byte => !Number.isInteger(byte) || byte < 0 || byte > 255)) {
+            throw new TypeError('Recovery key must contain exactly 32 bytes.');
+        }
         if (this.authenticationMode === 'recovery-key-and-password') {
             // Wait for password
             const hash = sdk_1.Hash.sha256(recoveryKey);
             const token = await this.UMPTokenInteractor.findByRecoveryKeyHash(hash);
-            if (!token)
+            if (token == null)
                 throw new Error('No user found with this recovery key');
             this.authenticationFlow = 'existing-user';
             this.recoveryKey = recoveryKey;
@@ -702,9 +1171,9 @@ class CWIStyleWalletManager {
         }
         else {
             // 'presentation-key-and-recovery-key'
-            if (!this.presentationKey)
+            if (this.presentationKey == null)
                 throw new Error('Provide the presentation key first');
-            if (!this.currentUMPToken)
+            if (this.currentUMPToken == null)
                 throw new Error('Current UMP token not found');
             const xorKey = this.XOR(this.presentationKey, recoveryKey);
             const rootPrimaryKey = new sdk_1.SymmetricKey(xorKey).decrypt(this.currentUMPToken.presentationRecoveryPrimary);
@@ -723,7 +1192,7 @@ class CWIStyleWalletManager {
      * @returns Encrypted snapshot bytes.
      */
     saveSnapshot() {
-        if (!this.rootPrimaryKey || !this.currentUMPToken) {
+        if (this.rootPrimaryKey == null || this.currentUMPToken == null) {
             throw new Error('No root primary key or current UMP token set');
         }
         const snapshotKey = (0, sdk_1.Random)(32);
@@ -746,7 +1215,20 @@ class CWIStyleWalletManager {
         snapshotWriter.write(snapshotKey);
         snapshotWriter.write(this.activeProfileId); // Active profile ID
         snapshotWriter.write(snapshotPayload); // Encrypted data
-        return snapshotWriter.toArray();
+        const snapshot = snapshotWriter.toArray();
+        if (snapshot.length > exports.MAX_STATE_SNAPSHOT_BYTES) {
+            throw new Error('Snapshot exceeds the maximum supported size.');
+        }
+        this.telemetry.capture({
+            name: 'wallet-toolbox.snapshot.saved',
+            component: 'wallet-toolbox.cwi-manager',
+            severity: 'info',
+            attributes: {
+                formatVersion: 2,
+                profileCount: this.profiles.length
+            }
+        });
+        return snapshot;
     }
     /**
      * Loads a previously saved state snapshot. Restores root key, UMP token, profiles, and active profile.
@@ -756,6 +1238,11 @@ class CWIStyleWalletManager {
      */
     async loadSnapshot(snapshot) {
         try {
+            if (snapshot.length === 0 ||
+                snapshot.length > exports.MAX_STATE_SNAPSHOT_BYTES ||
+                snapshot.some(byte => !Number.isInteger(byte) || byte < 0 || byte > 255)) {
+                throw new Error('Snapshot is empty, oversized, or contains invalid bytes.');
+            }
             const reader = new sdk_1.Utils.Reader(snapshot);
             const version = reader.readUInt8();
             let snapshotKey;
@@ -788,25 +1275,41 @@ class CWIStyleWalletManager {
             await this.setupRootInfrastructure(rootPrimaryKey); // Will automatically load profiles
             await this.switchProfile(activeProfileId); // Switch to the profile saved in the snapshot
             this.authenticationFlow = 'existing-user'; // Loading implies existing user
+            this.telemetry.capture({
+                name: 'wallet-toolbox.snapshot.loaded',
+                component: 'wallet-toolbox.cwi-manager',
+                severity: 'info',
+                attributes: {
+                    formatVersion: version,
+                    profileCount: this.profiles.length
+                }
+            });
         }
         catch (error) {
             this.destroy(); // Clear state on error
-            throw new Error(`Failed to load snapshot: ${error.message}`);
+            this.telemetry.capture({
+                name: 'wallet-toolbox.snapshot.load-failed',
+                component: 'wallet-toolbox.cwi-manager',
+                severity: 'error',
+                error
+            });
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            throw new Error(`Failed to load snapshot: ${message}`, { cause: error });
         }
     }
     async syncUMPToken() {
-        if (!this.authenticated || !this.currentUMPToken || !this.rootPrimaryKey) {
+        if (!this.authenticated || this.currentUMPToken == null || this.rootPrimaryKey == null) {
             throw new Error('Wallet not authenticated or missing UMP token.');
         }
         const currentToken = this.currentUMPToken;
         let refreshed;
-        if (currentToken.presentationHash && currentToken.presentationHash.length) {
+        if (currentToken.presentationHash && currentToken.presentationHash.length > 0) {
             refreshed = await this.UMPTokenInteractor.findByPresentationKeyHash(currentToken.presentationHash);
         }
-        if (!refreshed && currentToken.recoveryHash && currentToken.recoveryHash.length) {
+        if (refreshed == null && currentToken.recoveryHash && currentToken.recoveryHash.length > 0) {
             refreshed = await this.UMPTokenInteractor.findByRecoveryKeyHash(currentToken.recoveryHash);
         }
-        if (!refreshed) {
+        if (refreshed == null) {
             return false;
         }
         if (refreshed.currentOutpoint &&
@@ -833,7 +1336,7 @@ class CWIStyleWalletManager {
         this.profiles = [];
         this.activeProfileId = exports.DEFAULT_PROFILE_ID;
         this.authenticationMode = 'presentation-key-and-password';
-        this.authenticationFlow = 'new-user';
+        this.authenticationFlow = 'unknown';
     }
     // --- Profile Management Methods ---
     /**
@@ -873,7 +1376,10 @@ class CWIStyleWalletManager {
      * @returns The ID of the newly created profile.
      */
     async addProfile(name) {
-        if (!this.authenticated || !this.rootPrimaryKey || !this.currentUMPToken || !this.rootPrivilegedKeyManager) {
+        if (!this.authenticated ||
+            this.rootPrimaryKey == null ||
+            this.currentUMPToken == null ||
+            this.rootPrivilegedKeyManager == null) {
             throw new Error('Wallet not fully initialized or authenticated.');
         }
         // Ensure name is unique (including 'default')
@@ -904,7 +1410,10 @@ class CWIStyleWalletManager {
      * @param profileId The 16-byte ID of the profile to delete.
      */
     async deleteProfile(profileId) {
-        if (!this.authenticated || !this.rootPrimaryKey || !this.currentUMPToken || !this.rootPrivilegedKeyManager) {
+        if (!this.authenticated ||
+            this.rootPrimaryKey == null ||
+            this.currentUMPToken == null ||
+            this.rootPrivilegedKeyManager == null) {
             throw new Error('Wallet not fully initialized or authenticated.');
         }
         if (profileId.every(x => x === 0)) {
@@ -931,7 +1440,7 @@ class CWIStyleWalletManager {
      * @param profileId The 16-byte ID of the profile to switch to (use DEFAULT_PROFILE_ID for default).
      */
     async switchProfile(profileId) {
-        if (!this.authenticated || !this.rootPrimaryKey || !this.rootPrivilegedKeyManager) {
+        if (!this.authenticated || this.rootPrimaryKey == null || this.rootPrivilegedKeyManager == null) {
             throw new Error('Cannot switch profile: Wallet not authenticated or root keys missing.');
         }
         let profilePrimaryKey;
@@ -945,7 +1454,7 @@ class CWIStyleWalletManager {
         else {
             // Switching to a non-default profile
             const profile = this.profiles.find(p => p.id.every((x, i) => x === profileId[i]));
-            if (!profile) {
+            if (profile == null) {
                 throw new Error('Profile not found.');
             }
             profilePrimaryKey = this.XOR(this.rootPrimaryKey, profile.primaryPad);
@@ -959,9 +1468,7 @@ class CWIStyleWalletManager {
             const rootPrivileged = await this.rootPrivilegedKeyManager.getPrivilegedKey(reason);
             const rootPrivilegedBytes = rootPrivileged.toArray();
             // Apply the profile's pad if applicable
-            const profilePrivilegedBytes = profilePrivilegedPad
-                ? this.XOR(rootPrivilegedBytes, profilePrivilegedPad)
-                : rootPrivilegedBytes;
+            const profilePrivilegedBytes = profilePrivilegedPad == null ? rootPrivilegedBytes : this.XOR(rootPrivilegedBytes, profilePrivilegedPad);
             return new sdk_1.PrivateKey(profilePrivilegedBytes);
         });
         // Build the underlying wallet for the specific profile
@@ -974,13 +1481,15 @@ class CWIStyleWalletManager {
      * Changes the user's password. Re-wraps keys and updates the UMP token.
      */
     async changePassword(newPassword) {
-        var _a;
-        if (!this.authenticated || !this.currentUMPToken || !this.rootPrimaryKey || !this.rootPrivilegedKeyManager) {
+        if (!this.authenticated ||
+            this.currentUMPToken == null ||
+            this.rootPrimaryKey == null ||
+            this.rootPrivilegedKeyManager == null) {
             throw new Error('Not authenticated or missing required data.');
         }
         const passwordSalt = (0, sdk_1.Random)(32);
         // Preserve current token's KDF metadata (or use manager's kdfConfig for legacy tokens)
-        const kdfToUse = (_a = this.currentUMPToken.passwordKdf) !== null && _a !== void 0 ? _a : this.kdfConfig;
+        const kdfToUse = this.currentUMPToken.passwordKdf ?? this.kdfConfig;
         const tempTokenForKdf = {
             passwordSalt,
             passwordKdf: kdfToUse
@@ -998,16 +1507,19 @@ class CWIStyleWalletManager {
      * Retrieves the current recovery key. Requires privileged access.
      */
     async getRecoveryKey() {
-        if (!this.authenticated || !this.currentUMPToken || !this.rootPrivilegedKeyManager) {
+        if (!this.authenticated || this.currentUMPToken == null || this.rootPrivilegedKeyManager == null) {
             throw new Error('Not authenticated or missing required data.');
         }
-        return this.getFactor('recoveryKey');
+        return await this.getFactor('recoveryKey');
     }
     /**
      * Changes the user's recovery key. Prompts user to save the new key.
      */
     async changeRecoveryKey() {
-        if (!this.authenticated || !this.currentUMPToken || !this.rootPrimaryKey || !this.rootPrivilegedKeyManager) {
+        if (!this.authenticated ||
+            this.currentUMPToken == null ||
+            this.rootPrimaryKey == null ||
+            this.rootPrivilegedKeyManager == null) {
             throw new Error('Not authenticated or missing required data.');
         }
         // Decrypt existing factors needed
@@ -1025,7 +1537,10 @@ class CWIStyleWalletManager {
      * Changes the user's presentation key.
      */
     async changePresentationKey(newPresentationKey) {
-        if (!this.authenticated || !this.currentUMPToken || !this.rootPrimaryKey || !this.rootPrivilegedKeyManager) {
+        if (!this.authenticated ||
+            this.currentUMPToken == null ||
+            this.rootPrimaryKey == null ||
+            this.rootPrivilegedKeyManager == null) {
             throw new Error('Not authenticated or missing required data.');
         }
         if (newPresentationKey.length !== 32) {
@@ -1039,7 +1554,7 @@ class CWIStyleWalletManager {
         recoveryKey, this.rootPrimaryKey, rootPrivilegedKey, this.profiles // Preserve profiles
         );
         // Update the temporarily stored key if it was set
-        if (this.presentationKey) {
+        if (this.presentationKey != null) {
             this.presentationKey = newPresentationKey;
         }
     }
@@ -1052,7 +1567,7 @@ class CWIStyleWalletManager {
             // Provide more context in error
             throw new Error(`XOR length mismatch: ${n1.length} vs ${n2.length}`);
         }
-        const r = new Array(n1.length);
+        const r = Array.from({ length: n1.length }, () => 0);
         for (let i = 0; i < n1.length; i++) {
             r[i] = n1[i] ^ n2[i];
         }
@@ -1066,7 +1581,7 @@ class CWIStyleWalletManager {
      * @returns The decrypted key bytes.
      */
     async getFactor(factorName) {
-        if (!this.authenticated || !this.currentUMPToken || !this.rootPrivilegedKeyManager) {
+        if (!this.authenticated || this.currentUMPToken == null || this.rootPrivilegedKeyManager == null) {
             throw new Error(`Cannot get factor "${factorName}": Wallet not ready.`);
         }
         const protocolID = [2, 'admin key wrapping']; // Protocol used for encrypting factors
@@ -1103,8 +1618,15 @@ class CWIStyleWalletManager {
             }
         }
         catch (error) {
-            console.error(`Error decrypting factor ${factorName}:`, error);
-            throw new Error(`Failed to decrypt factor "${factorName}": ${error.message}`);
+            this.telemetry.capture({
+                name: 'wallet-toolbox.authentication.factor-decryption.failed',
+                component: 'wallet-toolbox.cwi-manager',
+                severity: 'error',
+                attributes: { factor: factorName },
+                error
+            });
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            throw new Error(`Failed to decrypt factor "${factorName}": ${message}`, { cause: error });
         }
     }
     /**
@@ -1114,7 +1636,7 @@ class CWIStyleWalletManager {
     async updateAuthFactors(passwordSalt, passwordKey, presentationKey, recoveryKey, rootPrimaryKey, rootPrivilegedKey, // Explicitly pass the root key bytes
     profiles // Pass current/new profiles list
     ) {
-        if (!this.authenticated || !this.rootPrimaryKey || !this.currentUMPToken) {
+        if (!this.authenticated || this.rootPrimaryKey == null || this.currentUMPToken == null) {
             throw new Error('Wallet is not properly authenticated or missing data for update.');
         }
         // Ensure we have the OLD token to consume
@@ -1131,7 +1653,7 @@ class CWIStyleWalletManager {
         const tempRootPrivilegedKeyManager = new PrivilegedKeyManager_1.PrivilegedKeyManager(async () => new sdk_1.PrivateKey(rootPrivilegedKey));
         // Encrypt profiles if provided
         let profilesEncrypted;
-        if (profiles && profiles.length > 0) {
+        if (profiles != null && profiles.length > 0) {
             const profilesJson = JSON.stringify(profiles);
             const profilesBytes = sdk_1.Utils.toArray(profilesJson, 'utf8');
             profilesEncrypted = new sdk_1.SymmetricKey(rootPrimaryKey).encrypt(profilesBytes);
@@ -1166,12 +1688,12 @@ class CWIStyleWalletManager {
                 keyID: '1'
             })).ciphertext,
             profilesEncrypted, // Add encrypted profiles
-            ...(kdfMetadata
-                ? {
+            ...(kdfMetadata == null
+                ? {}
+                : {
                     umpVersion: 3,
                     passwordKdf: kdfMetadata
-                }
-                : {})
+                })
             // currentOutpoint will be set after publishing
         };
         // We need the wallet built for the DEFAULT profile to publish the UMP token.
@@ -1179,11 +1701,16 @@ class CWIStyleWalletManager {
         const currentActiveId = this.activeProfileId;
         let walletToUse = this.underlying;
         if (!currentActiveId.every(x => x === 0)) {
-            console.log('Temporarily switching to default profile to update UMP token...');
+            this.telemetry.capture({
+                name: 'wallet-toolbox.ump.profile-switch.started',
+                component: 'wallet-toolbox.cwi-manager',
+                severity: 'debug',
+                attributes: { reason: 'token-update' }
+            });
             await this.switchProfile(exports.DEFAULT_PROFILE_ID); // This rebuilds this.underlying
             walletToUse = this.underlying;
         }
-        if (!walletToUse) {
+        if (walletToUse == null) {
             throw new Error('Default profile wallet could not be activated for UMP token update.');
         }
         // Publish the new token on-chain, consuming the old one
@@ -1197,8 +1724,13 @@ class CWIStyleWalletManager {
         finally {
             // Switch back if we temporarily switched
             if (!currentActiveId.every(x => x === 0)) {
-                console.log('Switching back to original profile...');
                 await this.switchProfile(currentActiveId);
+                this.telemetry.capture({
+                    name: 'wallet-toolbox.ump.profile-switch.completed',
+                    component: 'wallet-toolbox.cwi-manager',
+                    severity: 'debug',
+                    attributes: { reason: 'token-update' }
+                });
             }
         }
     }
@@ -1230,7 +1762,7 @@ class CWIStyleWalletManager {
         writeArray(token.passwordKeyEncrypted); // 9
         writeArray(token.recoveryKeyEncrypted); // 10
         // Write optional profiles field
-        if (token.profilesEncrypted && token.profilesEncrypted.length > 0) {
+        if (token.profilesEncrypted != null && token.profilesEncrypted.length > 0) {
             writer.writeUInt8(1); // Flag indicating profiles present
             writeArray(token.profilesEncrypted);
         }
@@ -1280,6 +1812,9 @@ class CWIStyleWalletManager {
         }
         const readArray = () => {
             const length = reader.readVarIntNum();
+            if (length <= 0 || length > exports.MAX_STATE_SNAPSHOT_BYTES) {
+                throw new Error('UMP token field exceeds allowed bounds.');
+            }
             return reader.read(length);
         };
         // Read standard fields (order matches serialization)
@@ -1313,18 +1848,16 @@ class CWIStyleWalletManager {
                 const algorithm = sdk_1.Utils.toUTF8(algorithmBytes);
                 const kdfParamsBytes = readArray();
                 const kdfParamsJson = sdk_1.Utils.toUTF8(kdfParamsBytes);
-                try {
-                    const kdfParams = JSON.parse(kdfParamsJson);
-                    passwordKdf = {
-                        algorithm,
-                        iterations: kdfParams.iterations,
-                        memoryKiB: kdfParams.memoryKiB,
-                        parallelism: kdfParams.parallelism,
-                        hashLength: kdfParams.hashLength
-                    };
-                }
-                catch (e) {
-                    console.warn('Failed to parse KDF params during deserialization:', e);
+                const kdfParams = JSON.parse(kdfParamsJson);
+                passwordKdf = {
+                    algorithm,
+                    iterations: kdfParams.iterations,
+                    memoryKiB: kdfParams.memoryKiB,
+                    parallelism: kdfParams.parallelism,
+                    hashLength: kdfParams.hashLength
+                };
+                if (!isValidKdfConfig(passwordKdf)) {
+                    throw new Error('Serialized UMP token contains unsupported or unsafe KDF parameters.');
                 }
             }
         }
@@ -1332,6 +1865,9 @@ class CWIStyleWalletManager {
         const outpointLen = reader.readVarIntNum();
         const outpointBytes = reader.read(outpointLen);
         const currentOutpoint = sdk_1.Utils.toUTF8(outpointBytes);
+        if (currentOutpoint.length > 128 || !/^[^\s.:]+[.:]\d+$/.test(currentOutpoint)) {
+            throw new Error('Serialized UMP token contains an invalid outpoint.');
+        }
         const token = {
             passwordSalt,
             passwordPresentationPrimary,
@@ -1360,18 +1896,16 @@ class CWIStyleWalletManager {
      * @param ephemeralRootPrivilegedKey Optional root privileged key (e.g., during recovery flows).
      */
     async setupRootInfrastructure(rootPrimaryKey, ephemeralRootPrivilegedKey) {
-        if (!this.currentUMPToken) {
+        if (this.currentUMPToken == null) {
             throw new Error('A UMP token must exist before setting up root infrastructure!');
         }
         this.rootPrimaryKey = rootPrimaryKey;
         // Store ephemeral key if provided, for one-time use by the manager
-        let oneTimePrivilegedKey = ephemeralRootPrivilegedKey
-            ? new sdk_1.PrivateKey(ephemeralRootPrivilegedKey)
-            : undefined;
+        let oneTimePrivilegedKey = ephemeralRootPrivilegedKey == null ? undefined : new sdk_1.PrivateKey(ephemeralRootPrivilegedKey);
         // Create the ROOT PrivilegedKeyManager
         this.rootPrivilegedKeyManager = new PrivilegedKeyManager_1.PrivilegedKeyManager(async (reason) => {
             // 1. Use one-time key if available (for recovery)
-            if (oneTimePrivilegedKey) {
+            if (oneTimePrivilegedKey != null) {
                 const tempKey = oneTimePrivilegedKey;
                 oneTimePrivilegedKey = undefined; // Consume it
                 return tempKey;
@@ -1384,7 +1918,10 @@ class CWIStyleWalletManager {
                     const decryptedPrivileged = new sdk_1.SymmetricKey(privilegedDecryptor).decrypt(this.currentUMPToken.passwordPrimaryPrivileged);
                     return !!decryptedPrivileged; // Test passes if decryption works
                 }
-                catch (e) {
+                catch {
+                    // Decryption failure means the password candidate is wrong — this is the
+                    // expected rejection path for an incorrect password.  Returning false causes
+                    // the password-retriever loop to prompt the user again rather than crashing.
                     return false;
                 }
             });
@@ -1396,18 +1933,26 @@ class CWIStyleWalletManager {
         });
         // Decrypt and load profiles if present in the token
         this.profiles = []; // Clear existing profiles before loading
-        if (this.currentUMPToken.profilesEncrypted && this.currentUMPToken.profilesEncrypted.length > 0) {
+        if (this.currentUMPToken.profilesEncrypted != null && this.currentUMPToken.profilesEncrypted.length > 0) {
             try {
                 const decryptedProfileBytes = new sdk_1.SymmetricKey(rootPrimaryKey).decrypt(this.currentUMPToken.profilesEncrypted);
                 const profilesJson = sdk_1.Utils.toUTF8(decryptedProfileBytes);
-                this.profiles = JSON.parse(profilesJson);
+                const profiles = JSON.parse(profilesJson);
+                if (!Array.isArray(profiles) || profiles.length > 1000 || !profiles.every(isValidProfile)) {
+                    throw new Error('Decrypted profile data is invalid or exceeds supported bounds.');
+                }
+                this.profiles = profiles;
             }
             catch (error) {
-                console.error('Failed to decrypt or parse profiles:', error);
-                // Decide if this should be fatal or just log and continue without profiles
-                this.profiles = []; // Ensure profiles are empty on error
-                // Optionally re-throw or handle more gracefully
-                throw new Error(`Failed to load profiles: ${error.message}`);
+                this.profiles = [];
+                this.telemetry.capture({
+                    name: 'wallet-toolbox.profile.load-failed',
+                    component: 'wallet-toolbox.cwi-manager',
+                    severity: 'error',
+                    error
+                });
+                const message = error instanceof Error ? error.message : 'Unknown error';
+                throw new Error(`Failed to load profiles: ${message}`, { cause: error });
             }
         }
         this.authenticated = true;
@@ -1424,7 +1969,7 @@ class CWIStyleWalletManager {
         if (!this.authenticated) {
             throw new Error('User is not authenticated.');
         }
-        if (!this.underlying) {
+        if (this.underlying == null) {
             // This might happen if authentication succeeded but profile switching failed
             throw new Error('Underlying wallet for the active profile is not initialized.');
         }
@@ -1435,91 +1980,91 @@ class CWIStyleWalletManager {
     // Example proxy method (repeat pattern for all others)
     async getPublicKey(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.getPublicKey(args, originator);
+        return await this.underlying.getPublicKey(args, originator);
     }
     async revealCounterpartyKeyLinkage(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.revealCounterpartyKeyLinkage(args, originator);
+        return await this.underlying.revealCounterpartyKeyLinkage(args, originator);
     }
     async revealSpecificKeyLinkage(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.revealSpecificKeyLinkage(args, originator);
+        return await this.underlying.revealSpecificKeyLinkage(args, originator);
     }
     async encrypt(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.encrypt(args, originator);
+        return await this.underlying.encrypt(args, originator);
     }
     async decrypt(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.decrypt(args, originator);
+        return await this.underlying.decrypt(args, originator);
     }
     async createHmac(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.createHmac(args, originator);
+        return await this.underlying.createHmac(args, originator);
     }
     async verifyHmac(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.verifyHmac(args, originator);
+        return await this.underlying.verifyHmac(args, originator);
     }
     async createSignature(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.createSignature(args, originator);
+        return await this.underlying.createSignature(args, originator);
     }
     async verifySignature(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.verifySignature(args, originator);
+        return await this.underlying.verifySignature(args, originator);
     }
     async createAction(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.createAction(args, originator);
+        return await this.underlying.createAction(args, originator);
     }
     async signAction(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.signAction(args, originator);
+        return await this.underlying.signAction(args, originator);
     }
     async abortAction(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.abortAction(args, originator);
+        return await this.underlying.abortAction(args, originator);
     }
     async listActions(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.listActions(args, originator);
+        return await this.underlying.listActions(args, originator);
     }
     async internalizeAction(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.internalizeAction(args, originator);
+        return await this.underlying.internalizeAction(args, originator);
     }
     async listOutputs(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.listOutputs(args, originator);
+        return await this.underlying.listOutputs(args, originator);
     }
     async relinquishOutput(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.relinquishOutput(args, originator);
+        return await this.underlying.relinquishOutput(args, originator);
     }
     async acquireCertificate(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.acquireCertificate(args, originator);
+        return await this.underlying.acquireCertificate(args, originator);
     }
     async listCertificates(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.listCertificates(args, originator);
+        return await this.underlying.listCertificates(args, originator);
     }
     async proveCertificate(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.proveCertificate(args, originator);
+        return await this.underlying.proveCertificate(args, originator);
     }
     async relinquishCertificate(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.relinquishCertificate(args, originator);
+        return await this.underlying.relinquishCertificate(args, originator);
     }
     async discoverByIdentityKey(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.discoverByIdentityKey(args, originator);
+        return await this.underlying.discoverByIdentityKey(args, originator);
     }
     async discoverByAttributes(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.discoverByAttributes(args, originator);
+        return await this.underlying.discoverByAttributes(args, originator);
     }
     async isAuthenticated(_, originator) {
         if (!this.authenticated) {
@@ -1534,26 +2079,26 @@ class CWIStyleWalletManager {
         if (originator === this.adminOriginator) {
             throw new Error('External applications are not allowed to use the admin originator.');
         }
-        while (!this.authenticated || !this.underlying) {
+        while (!this.authenticated || this.underlying == null) {
             await new Promise(resolve => setTimeout(resolve, 100));
         }
         return await this.underlying.waitForAuthentication({}, originator);
     }
     async getHeight(_, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.getHeight({}, originator);
+        return await this.underlying.getHeight({}, originator);
     }
     async getHeaderForHeight(args, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.getHeaderForHeight(args, originator);
+        return await this.underlying.getHeaderForHeight(args, originator);
     }
     async getNetwork(_, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.getNetwork({}, originator);
+        return await this.underlying.getNetwork({}, originator);
     }
     async getVersion(_, originator) {
         this.checkAuthAndUnderlying(originator);
-        return this.underlying.getVersion({}, originator);
+        return await this.underlying.getVersion({}, originator);
     }
 }
 exports.CWIStyleWalletManager = CWIStyleWalletManager;