@bsv/wallet-toolbox 2.13.0 → 2.13.2

package/out/src/CWIStyleWalletManager.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CWIStyleWalletManager = exports.OverlayUMPTokenInteractor = exports.UMPTokenLookupError = exports.DEFAULT_PROFILE_ID = exports.MAX_STATE_SNAPSHOT_BYTES = exports.PBKDF2_MAX_ITERATIONS = exports.KDF_MAX_HASH_LENGTH = exports.ARGON2ID_MAX_PARALLELISM = exports.ARGON2ID_MAX_MEMORY_KIB = exports.ARGON2ID_MAX_ITERATIONS = exports.ARGON2ID_DEFAULT_HASH_LENGTH = exports.ARGON2ID_DEFAULT_PARALLELISM = exports.ARGON2ID_DEFAULT_MEMORY_KIB = exports.ARGON2ID_DEFAULT_ITERATIONS = exports.PBKDF2_NUM_ROUNDS = void 0;
 const sdk_1 = require("@bsv/sdk");
+const Hash_1 = require("@bsv/sdk/primitives/Hash");
+const utils_1 = require("@bsv/sdk/primitives/utils");
 const PrivilegedKeyManager_1 = require("./sdk/PrivilegedKeyManager");
 const hashWasm_1 = require("./utility/hashWasm");
 const CWI_COMPONENT = 'wallet-toolbox.cwi-manager';
@@ -64,9 +66,9 @@ function addPasswordKdf(token, protocolFields, kdfVersionFieldIndex) {
     if (kdfAlgorithmField == null || kdfParamsField == null || kdfParamsField.length > 1024) {
         return false;
     }
-    const kdfParams = JSON.parse(sdk_1.Utils.toUTF8(kdfParamsField));
+    const kdfParams = JSON.parse((0, utils_1.toUTF8)(kdfParamsField));
     const passwordKdf = {
-        algorithm: sdk_1.Utils.toUTF8(kdfAlgorithmField),
+        algorithm: (0, utils_1.toUTF8)(kdfAlgorithmField),
         iterations: kdfParams.iterations,
         memoryKiB: kdfParams.memoryKiB,
         parallelism: kdfParams.parallelism,
@@ -120,6 +122,24 @@ function stripVerifiedPushDropSignature(fields, lockingPublicKey) {
     }
     return fields;
 }
+function decodeAuthenticatedUMPFields(lockingScript) {
+    const decoded = (0, sdk_1.decodeCanonicalPushDrop)(lockingScript, {
+        fieldCount: [12, 13, 15, 16],
+        maximumFieldBytes: exports.MAX_STATE_SNAPSHOT_BYTES,
+        maximumPayloadBytes: exports.MAX_STATE_SNAPSHOT_BYTES
+    });
+    const fields = stripVerifiedPushDropSignature(decoded.fields, decoded.lockingPublicKey);
+    if (fields.length !== decoded.fields.length - 1) {
+        throw new Error('UMP token field signature is missing or invalid');
+    }
+    const kdfVersionFieldIndex = findKdfVersionFieldIndex(fields);
+    if ((kdfVersionFieldIndex === -1 && fields.length > 12) ||
+        (kdfVersionFieldIndex === 11 && fields.length !== 14) ||
+        (kdfVersionFieldIndex === 12 && fields.length !== 15)) {
+        throw new Error('UMP token field layout is invalid');
+    }
+    return { ...decoded, fields };
+}
 /**
  * PBKDF-2 that prefers WebCrypto and falls back to hash-wasm.
  *
@@ -284,7 +304,7 @@ class OverlayUMPTokenInteractor {
     async findByPresentationKeyHash(hash, options) {
         return this.findToken({
             service: 'ls_users',
-            query: { presentationHash: sdk_1.Utils.toHex(hash) }
+            query: { presentationHash: (0, utils_1.toHex)(hash) }
         }, 'presentation', options);
     }
     /**
@@ -297,7 +317,7 @@ class OverlayUMPTokenInteractor {
     async findByRecoveryKeyHash(hash, options) {
         return this.findToken({
             service: 'ls_users',
-            query: { recoveryHash: sdk_1.Utils.toHex(hash) }
+            query: { recoveryHash: (0, utils_1.toHex)(hash) }
         }, 'recovery', options);
     }
     async findToken(question, lookupKind, options) {
@@ -325,7 +345,7 @@ class OverlayUMPTokenInteractor {
         const diagnostics = this.diagnosticsFor(resolution);
         const tokens = this.parseLookupAnswers(resolution.answer);
         const expectedHash = question.query[lookupKind === 'presentation' ? 'presentationHash' : 'recoveryHash'].toLowerCase();
-        const matchingTokens = tokens.filter(token => sdk_1.Utils.toHex(lookupKind === 'presentation' ? token.presentationHash : token.recoveryHash).toLowerCase() ===
+        const matchingTokens = tokens.filter(token => (0, utils_1.toHex)(lookupKind === 'presentation' ? token.presentationHash : token.recoveryHash).toLowerCase() ===
             expectedHash);
         // A verified token is positive account-existence evidence. Empty, malformed,
         // rejected, or unavailable peers cannot override it. The resolver de-duplicates
@@ -435,8 +455,8 @@ class OverlayUMPTokenInteractor {
      * predecessor rather than an independently minted token.
      */
     consumesIdentity(tx, token) {
-        const presentationHash = sdk_1.Utils.toHex(token.presentationHash);
-        const recoveryHash = sdk_1.Utils.toHex(token.recoveryHash);
+        const presentationHash = (0, utils_1.toHex)(token.presentationHash);
+        const recoveryHash = (0, utils_1.toHex)(token.recoveryHash);
         for (const input of tx.inputs) {
             const source = input.sourceTransaction;
             if (source == null || input.sourceOutputIndex == null)
@@ -445,13 +465,10 @@ class OverlayUMPTokenInteractor {
             if (sourceOutput == null)
                 continue;
             try {
-                const decoded = sdk_1.PushDrop.decode(sourceOutput.lockingScript);
-                if (decoded.fields == null)
-                    continue;
-                const fields = stripVerifiedPushDropSignature(decoded.fields, decoded.lockingPublicKey);
+                const { fields } = decodeAuthenticatedUMPFields(sourceOutput.lockingScript);
                 if (fields.length < 11 || fields[6]?.length !== 32 || fields[7]?.length !== 32)
                     continue;
-                if (sdk_1.Utils.toHex(fields[6]) === presentationHash || sdk_1.Utils.toHex(fields[7]) === recoveryHash) {
+                if ((0, utils_1.toHex)(fields[6]) === presentationHash || (0, utils_1.toHex)(fields[7]) === recoveryHash) {
                     return true;
                 }
             }
@@ -574,9 +591,13 @@ class OverlayUMPTokenInteractor {
         const script = await new sdk_1.PushDrop(wallet, adminOriginator).lock(fields, [2, 'admin user management token'], '1', 'self', 
         /* forSelf= */ true, 
         /* includeSignature= */ true);
-        const tokenOutput = [{ lockingScript: script.toHex(), satoshis: 1, outputDescription: 'New UMP token output' }];
+        const tokenScript = script.toHex();
+        const tokenOutput = [{ lockingScript: tokenScript, satoshis: 1, outputDescription: 'New UMP token output' }];
         // 2) Resolve the old-token input (if provided) and create the action.
         const { resolvedOldToken, inputToken } = await this.resolveOldInput(oldTokenToConsume);
+        if (resolvedOldToken != null && inputToken != null) {
+            await this.assertOwnedUMPInput(wallet, adminOriginator, resolvedOldToken, inputToken);
+        }
         const inputs = resolvedOldToken?.currentOutpoint
             ? [
                 {
@@ -586,18 +607,37 @@ class OverlayUMPTokenInteractor {
                 }
             ]
             : [];
-        const createResult = await this.createAction(wallet, adminOriginator, inputs, tokenOutput, inputToken, resolvedOldToken);
-        // 3) If the wallet fully processed it (no signable tx), broadcast and return.
-        if (!createResult.signableTransaction) {
-            return this.broadcastFinal(createResult);
+        const createArgs = {
+            description: resolvedOldToken == null ? 'Create new UMP token' : 'Renew UMP token (consume old, create new)',
+            inputs,
+            outputs: tokenOutput,
+            inputBEEF: inputToken?.beef,
+            options: { randomizeOutputs: false, acceptDelayedBroadcast: false }
+        };
+        const inputSigners = Object.create(null);
+        if (resolvedOldToken?.currentOutpoint != null) {
+            const unlocker = new sdk_1.PushDrop(wallet, adminOriginator).unlock([2, 'admin user management token'], '1', 'self');
+            inputSigners[resolvedOldToken.currentOutpoint] = async (transaction, inputIndex) => await unlocker.sign(transaction, inputIndex);
+        }
+        const operation = resolvedOldToken == null ? 'create' : 'renew';
+        let transaction;
+        try {
+            transaction = await this.completeUMPAction(wallet, createArgs, inputSigners, adminOriginator);
         }
-        // 4) Sign and broadcast: with old token input or without.
-        const reference = createResult.signableTransaction.reference;
-        const partialTx = sdk_1.Transaction.fromBEEF(createResult.signableTransaction.tx);
-        if (resolvedOldToken?.currentOutpoint) {
-            return this.renewToken(wallet, adminOriginator, reference, partialTx);
+        catch (error) {
+            this.telemetry.capture({
+                name: 'wallet-toolbox.ump.action.failed',
+                component: 'wallet-toolbox.ump',
+                severity: 'error',
+                attributes: {
+                    operation,
+                    oldTokenInputRequired: resolvedOldToken != null
+                },
+                error
+            });
+            throw error;
         }
-        return this.broadcastNew(wallet, adminOriginator, reference);
+        return await this.broadcastUMPTransaction(transaction, tokenScript, operation);
     }
     /** Assembles the ordered number[][] fields array from a UMPToken. */
     tokenFields(token) {
@@ -618,7 +658,7 @@ class OverlayUMPTokenInteractor {
         if (token.umpVersion === 3 && token.passwordKdf != null) {
             const vi = token.profilesEncrypted == null ? 11 : 12;
             fields[vi] = [token.umpVersion];
-            fields[vi + 1] = sdk_1.Utils.toArray(token.passwordKdf.algorithm, 'utf8');
+            fields[vi + 1] = (0, utils_1.toArray)(token.passwordKdf.algorithm, 'utf8');
             const kdfParams = { iterations: token.passwordKdf.iterations };
             if (token.passwordKdf.memoryKiB !== undefined)
                 kdfParams.memoryKiB = token.passwordKdf.memoryKiB;
@@ -626,7 +666,7 @@ class OverlayUMPTokenInteractor {
                 kdfParams.parallelism = token.passwordKdf.parallelism;
             if (token.passwordKdf.hashLength !== undefined)
                 kdfParams.hashLength = token.passwordKdf.hashLength;
-            fields[vi + 2] = sdk_1.Utils.toArray(JSON.stringify(kdfParams), 'utf8');
+            fields[vi + 2] = (0, utils_1.toArray)(JSON.stringify(kdfParams), 'utf8');
         }
         return fields;
     }
@@ -640,71 +680,47 @@ class OverlayUMPTokenInteractor {
         }
         return { resolvedOldToken: oldTokenToConsume, inputToken };
     }
-    /** Creates the UMP action without dropping a required old-token input on failure. */
-    async createAction(wallet, adminOriginator, inputs, outputs, inputToken, resolvedOldToken) {
-        try {
-            return await wallet.createAction({
-                description: resolvedOldToken == null ? 'Create new UMP token' : 'Renew UMP token (consume old, create new)',
-                inputs,
-                outputs,
-                inputBEEF: inputToken?.beef,
-                options: { randomizeOutputs: false, acceptDelayedBroadcast: false }
-            }, adminOriginator);
-        }
-        catch (error) {
-            this.telemetry.capture({
-                name: 'wallet-toolbox.ump.action.failed',
-                component: 'wallet-toolbox.ump',
-                severity: 'error',
-                attributes: {
-                    operation: resolvedOldToken == null ? 'create' : 'renew',
-                    oldTokenInputRequired: resolvedOldToken != null
-                },
-                error
-            });
-            throw error;
-        }
-    }
-    /** Handles a fully-finalized (no signable tx) createAction result — broadcasts and returns outpoint. */
-    async broadcastFinal(createResult) {
-        const finalTxid = createResult.txid || (createResult.tx != null ? sdk_1.Transaction.fromAtomicBEEF(createResult.tx).id('hex') : undefined);
-        if (!finalTxid)
-            throw new Error('UMP transaction was not finalized.');
-        if (createResult.tx == null)
-            throw new Error('UMP transaction data missing.');
-        const broadcastTx = sdk_1.Transaction.fromAtomicBEEF(createResult.tx);
-        const result = await this.broadcaster.broadcast(broadcastTx);
-        this.assertBroadcast(result, 'create-finalized');
-        return `${finalTxid}.0`;
-    }
-    /** Signs the old-token input and broadcasts — used during UMP token renewal. */
-    async renewToken(wallet, adminOriginator, reference, partialTx) {
-        const unlocker = new sdk_1.PushDrop(wallet, adminOriginator).unlock([2, 'admin user management token'], '1', 'self');
-        const unlockingScript = await unlocker.sign(partialTx, 0);
-        const signResult = await wallet.signAction({ reference, spends: { 0: { unlockingScript: unlockingScript.toHex() } } }, adminOriginator);
-        const finalTxid = signResult.txid || (signResult.tx == null ? '' : sdk_1.Transaction.fromAtomicBEEF(signResult.tx).id('hex'));
-        if (!finalTxid)
-            throw new Error('Could not finalize renewed UMP token.');
-        if (signResult.tx == null)
-            throw new Error('Renewed UMP token transaction data missing.');
-        const result = await this.broadcaster.broadcast(sdk_1.Transaction.fromAtomicBEEF(signResult.tx));
-        this.assertBroadcast(result, 'renew');
-        return `${finalTxid}.0`;
-    }
-    /** Signs without input spending and broadcasts — used when creating a brand-new UMP token. */
-    async broadcastNew(wallet, adminOriginator, reference) {
-        const signResult = await wallet.signAction({ reference, spends: {} }, adminOriginator);
-        const finalTxid = signResult.txid || (signResult.tx == null ? '' : sdk_1.Transaction.fromAtomicBEEF(signResult.tx).id('hex'));
-        if (!finalTxid)
-            throw new Error('Could not finalize new UMP token.');
-        if (signResult.tx == null)
-            throw new Error('New UMP token transaction data missing.');
-        const result = await this.broadcaster.broadcast(sdk_1.Transaction.fromAtomicBEEF(signResult.tx));
-        this.assertBroadcast(result, 'create');
-        return `${finalTxid}.0`;
-    }
-    assertBroadcast(result, operation) {
-        const succeeded = result.status === 'success';
+    /** Proves the exact predecessor is an authenticated token controlled by this wallet. */
+    async assertOwnedUMPInput(wallet, adminOriginator, oldToken, inputToken) {
+        const transaction = sdk_1.Transaction.fromBEEF(inputToken.beef);
+        const sourceOutput = transaction.outputs[inputToken.outputIndex];
+        if (sourceOutput == null)
+            throw new Error('Previous UMP token source output is missing.');
+        const decoded = decodeAuthenticatedUMPFields(sourceOutput.lockingScript);
+        if (decoded.fields[6]?.length !== 32 ||
+            decoded.fields[7]?.length !== 32 ||
+            (0, utils_1.toHex)(decoded.fields[6]) !== (0, utils_1.toHex)(oldToken.presentationHash) ||
+            (0, utils_1.toHex)(decoded.fields[7]) !== (0, utils_1.toHex)(oldToken.recoveryHash)) {
+            throw new Error('Previous UMP token identity does not match its authenticated source.');
+        }
+        const { publicKey } = await wallet.getPublicKey({
+            protocolID: [2, 'admin user management token'],
+            keyID: '1',
+            counterparty: 'self',
+            forSelf: true
+        }, adminOriginator);
+        if (publicKey.toLowerCase() !== decoded.lockingPublicKey.toString().toLowerCase()) {
+            throw new Error('Previous UMP token is not controlled by this wallet.');
+        }
+    }
+    /** Completes an action only after exact request, input, output, and final-transaction binding. */
+    async completeUMPAction(wallet, createArgs, inputSigners, adminOriginator) {
+        return await (0, sdk_1.completeBoundAction)(wallet, createArgs, { inputSigners }, adminOriginator);
+    }
+    /** Broadcasts a bound UMP transaction and returns the exact, uniquely matching token output. */
+    async broadcastUMPTransaction(transaction, tokenScript, operation) {
+        const normalizedScript = tokenScript.toLowerCase();
+        const matchingOutputs = transaction.outputs.flatMap((output, index) => output.satoshis === 1 && output.lockingScript.toHex().toLowerCase() === normalizedScript ? [index] : []);
+        if (matchingOutputs.length !== 1) {
+            throw new Error('Final UMP transaction must contain exactly one requested token output.');
+        }
+        const txid = transaction.id('hex');
+        const result = await this.broadcaster.broadcast(transaction);
+        this.assertBroadcast(result, operation, txid);
+        return `${txid}.${matchingOutputs[0]}`;
+    }
+    assertBroadcast(result, operation, expectedTxid) {
+        const succeeded = result.status === 'success' && result.txid.toLowerCase() === expectedTxid.toLowerCase();
         this.telemetry.capture({
             name: succeeded ? 'wallet-toolbox.ump.broadcast.completed' : 'wallet-toolbox.ump.broadcast.failed',
             component: 'wallet-toolbox.ump',
@@ -716,7 +732,8 @@ class OverlayUMPTokenInteractor {
             }
         });
         if (!succeeded) {
-            throw new Error(`UMP token broadcast failed (${result.code}).`);
+            const reason = result.status === 'error' ? result.code : 'transaction ID mismatch';
+            throw new Error(`UMP token broadcast failed (${reason}).`);
         }
     }
     /**
@@ -747,11 +764,7 @@ class OverlayUMPTokenInteractor {
             const txOutput = tx.outputs[output.outputIndex];
             if (txOutput == null)
                 return undefined;
-            const decoded = sdk_1.PushDrop.decode(txOutput.lockingScript);
-            if (decoded.fields == null || decoded.fields.length < 11 || decoded.fields.length > 16) {
-                return undefined;
-            }
-            const protocolFields = stripVerifiedPushDropSignature(decoded.fields, decoded.lockingPublicKey);
+            const { fields: protocolFields } = decodeAuthenticatedUMPFields(txOutput.lockingScript);
             if (protocolFields.length < 11 ||
                 protocolFields.slice(0, 11).some(field => field.length === 0 || field.length > exports.MAX_STATE_SNAPSHOT_BYTES)) {
                 return undefined;
@@ -791,6 +804,14 @@ class OverlayUMPTokenInteractor {
     async findByOutpoint(outpoint) {
         const correlationId = this.telemetry.enabled === true ? this.telemetry.createCorrelationId() : undefined;
         const startedAt = Date.now();
+        const match = /^([0-9a-f]{64})\.(0|[1-9]\d*)$/i.exec(outpoint);
+        const requestedOutputIndex = match == null ? Number.NaN : Number(match[2]);
+        if (match == null || !Number.isSafeInteger(requestedOutputIndex) || requestedOutputIndex > 0xffffffff) {
+            const diagnostics = this.emptyStats(correlationId);
+            this.lookupFailed('outpoint', 'token-malformed', diagnostics, startedAt);
+            throw new UMPTokenLookupError('token-malformed', diagnostics);
+        }
+        const normalizedOutpoint = `${match[1].toLowerCase()}.${requestedOutputIndex}`;
         let resolution;
         try {
             resolution = await this.resolver.queryDetailed({
@@ -817,7 +838,31 @@ class OverlayUMPTokenInteractor {
             }
             return undefined;
         }
-        return resolution.answer.outputs[0];
+        const diagnostics = this.diagnosticsFor(resolution);
+        const matchingOutputs = [];
+        try {
+            for (const output of resolution.answer.outputs) {
+                if (!Number.isSafeInteger(output.outputIndex) || output.outputIndex < 0 || output.outputIndex > 0xffffffff) {
+                    throw new Error('UMP lookup returned an invalid output index');
+                }
+                const transaction = sdk_1.Transaction.fromBEEF(output.beef);
+                if (transaction.outputs[output.outputIndex] == null ||
+                    `${transaction.id('hex')}.${output.outputIndex}` !== normalizedOutpoint) {
+                    throw new Error('UMP lookup substituted the requested outpoint');
+                }
+                matchingOutputs.push(output);
+            }
+        }
+        catch (error) {
+            this.lookupFailed('outpoint', 'token-malformed', diagnostics, startedAt, error);
+            throw new UMPTokenLookupError('token-malformed', diagnostics, { cause: error });
+        }
+        if (matchingOutputs.length === 0) {
+            this.lookupFailed('outpoint', 'token-malformed', diagnostics, startedAt);
+            throw new UMPTokenLookupError('token-malformed', diagnostics);
+        }
+        matchingOutputs.sort((left, right) => right.beef.length - left.beef.length);
+        return matchingOutputs[0];
     }
 }
 exports.OverlayUMPTokenInteractor = OverlayUMPTokenInteractor;
@@ -998,7 +1043,7 @@ class CWIStyleWalletManager {
             throw new TypeError('Presentation key must contain exactly 32 bytes.');
         }
         this.authenticationFlow = 'unknown';
-        const hash = sdk_1.Hash.sha256(key);
+        const hash = (0, Hash_1.sha256)(key);
         const startedAt = Date.now();
         this.telemetry.capture({
             name: 'wallet-toolbox.authentication.account-lookup.started',
@@ -1068,7 +1113,7 @@ class CWIStyleWalletManager {
     async unlockExisting(password) {
         if (this.currentUMPToken == null)
             throw new Error('Provide presentation or recovery key first.');
-        const derivedPasswordKey = await derivePasswordKey(this.currentUMPToken, sdk_1.Utils.toArray(password, 'utf8'));
+        const derivedPasswordKey = await derivePasswordKey(this.currentUMPToken, (0, utils_1.toArray)(password, 'utf8'));
         let rootPrimaryKey;
         let rootPrivilegedKey;
         if (this.authenticationMode === 'presentation-key-and-password') {
@@ -1098,7 +1143,7 @@ class CWIStyleWalletManager {
         const recoveryKey = (0, sdk_1.Random)(32);
         await this.recoveryKeySaver(recoveryKey);
         const passwordSalt = (0, sdk_1.Random)(32);
-        const passwordKey = await derivePasswordKey({ passwordSalt, passwordKdf: this.kdfConfig }, sdk_1.Utils.toArray(password, 'utf8'));
+        const passwordKey = await derivePasswordKey({ passwordSalt, passwordKdf: this.kdfConfig }, (0, utils_1.toArray)(password, 'utf8'));
         const rootPrimaryKey = (0, sdk_1.Random)(32);
         const rootPrivilegedKey = (0, sdk_1.Random)(32);
         // Build XOR-combined symmetric keys
@@ -1117,8 +1162,8 @@ class CWIStyleWalletManager {
             presentationRecoveryPrimary: presentationRecovery.encrypt(rootPrimaryKey),
             passwordPrimaryPrivileged: primaryPassword.encrypt(rootPrivilegedKey),
             presentationRecoveryPrivileged: presentationRecovery.encrypt(rootPrivilegedKey),
-            presentationHash: sdk_1.Hash.sha256(this.presentationKey),
-            recoveryHash: sdk_1.Hash.sha256(recoveryKey),
+            presentationHash: (0, Hash_1.sha256)(this.presentationKey),
+            recoveryHash: (0, Hash_1.sha256)(recoveryKey),
             presentationKeyEncrypted: await wrapKey(this.presentationKey),
             passwordKeyEncrypted: await wrapKey(passwordKey),
             recoveryKeyEncrypted: await wrapKey(recoveryKey),
@@ -1167,7 +1212,7 @@ class CWIStyleWalletManager {
         }
         if (this.authenticationMode === 'recovery-key-and-password') {
             // Wait for password
-            const hash = sdk_1.Hash.sha256(recoveryKey);
+            const hash = (0, Hash_1.sha256)(recoveryKey);
             const token = await this.UMPTokenInteractor.findByRecoveryKeyHash(hash);
             if (token == null)
                 throw new Error('No user found with this recovery key');
@@ -1202,7 +1247,7 @@ class CWIStyleWalletManager {
             throw new Error('No root primary key or current UMP token set');
         }
         const snapshotKey = (0, sdk_1.Random)(32);
-        const snapshotPreimageWriter = new sdk_1.Utils.Writer();
+        const snapshotPreimageWriter = new utils_1.Writer();
         // Write root primary key
         snapshotPreimageWriter.write(this.rootPrimaryKey);
         // Write serialized UMP token (must have outpoint)
@@ -1216,7 +1261,7 @@ class CWIStyleWalletManager {
         const snapshotPreimage = snapshotPreimageWriter.toArray();
         const snapshotPayload = new sdk_1.SymmetricKey(snapshotKey).encrypt(snapshotPreimage);
         // Build final snapshot (Version 2)
-        const snapshotWriter = new sdk_1.Utils.Writer();
+        const snapshotWriter = new utils_1.Writer();
         snapshotWriter.writeUInt8(2); // Version
         snapshotWriter.write(snapshotKey);
         snapshotWriter.write(this.activeProfileId); // Active profile ID
@@ -1249,7 +1294,7 @@ class CWIStyleWalletManager {
                 snapshot.some(byte => !Number.isInteger(byte) || byte < 0 || byte > 255)) {
                 throw new Error('Snapshot is empty, oversized, or contains invalid bytes.');
             }
-            const reader = new sdk_1.Utils.Reader(snapshot);
+            const reader = new utils_1.Reader(snapshot);
             const version = reader.readUInt8();
             let snapshotKey;
             let encryptedPayload;
@@ -1268,11 +1313,11 @@ class CWIStyleWalletManager {
             }
             // Decrypt payload
             const decryptedPayload = new sdk_1.SymmetricKey(snapshotKey).decrypt(encryptedPayload);
-            const payloadReader = new sdk_1.Utils.Reader(decryptedPayload);
+            const payloadReader = new utils_1.Reader(decryptedPayload);
             // Read root primary key
             const rootPrimaryKey = payloadReader.read(32);
             // Read serialized UMP token
-            const tokenLen = payloadReader.readVarIntNum();
+            const tokenLen = payloadReader.readVarIntNumStrict(false);
             const tokenBytes = payloadReader.read(tokenLen);
             const token = this.deserializeUMPToken(tokenBytes);
             // Assign loaded data
@@ -1500,7 +1545,7 @@ class CWIStyleWalletManager {
             passwordSalt,
             passwordKdf: kdfToUse
         };
-        const newPasswordKey = await derivePasswordKey(tempTokenForKdf, sdk_1.Utils.toArray(newPassword, 'utf8'));
+        const newPasswordKey = await derivePasswordKey(tempTokenForKdf, (0, utils_1.toArray)(newPassword, 'utf8'));
         // Decrypt existing factors needed for re-encryption, using the *root* privileged key manager
         const recoveryKey = await this.getFactor('recoveryKey');
         const presentationKey = await this.getFactor('presentationKey');
@@ -1661,7 +1706,7 @@ class CWIStyleWalletManager {
         let profilesEncrypted;
         if (profiles != null && profiles.length > 0) {
             const profilesJson = JSON.stringify(profiles);
-            const profilesBytes = sdk_1.Utils.toArray(profilesJson, 'utf8');
+            const profilesBytes = (0, utils_1.toArray)(profilesJson, 'utf8');
             profilesEncrypted = new sdk_1.SymmetricKey(rootPrimaryKey).encrypt(profilesBytes);
         }
         // Construct the new UMP token data.
@@ -1676,8 +1721,8 @@ class CWIStyleWalletManager {
             presentationRecoveryPrimary: presentationRecovery.encrypt(rootPrimaryKey),
             passwordPrimaryPrivileged: primaryPassword.encrypt(rootPrivilegedKey),
             presentationRecoveryPrivileged: presentationRecovery.encrypt(rootPrivilegedKey),
-            presentationHash: sdk_1.Hash.sha256(presentationKey),
-            recoveryHash: sdk_1.Hash.sha256(recoveryKey),
+            presentationHash: (0, Hash_1.sha256)(presentationKey),
+            recoveryHash: (0, Hash_1.sha256)(recoveryKey),
             presentationKeyEncrypted: (await tempRootPrivilegedKeyManager.encrypt({
                 plaintext: presentationKey,
                 protocolID: [2, 'admin key wrapping'],
@@ -1748,7 +1793,7 @@ class CWIStyleWalletManager {
         if (!token.currentOutpoint) {
             throw new Error('Token must have outpoint for serialization');
         }
-        const writer = new sdk_1.Utils.Writer();
+        const writer = new utils_1.Writer();
         const hasKdfMetadata = token.umpVersion === 3 && token.passwordKdf;
         writer.writeUInt8(hasKdfMetadata ? 3 : 2); // Version 3 for KDF, 2 for legacy
         const writeArray = (arr) => {
@@ -1779,7 +1824,7 @@ class CWIStyleWalletManager {
         if (hasKdfMetadata) {
             writer.writeUInt8(1); // Flag indicating KDF metadata present
             writer.writeUInt8(token.umpVersion); // On-chain UMP version
-            const algorithmBytes = sdk_1.Utils.toArray(token.passwordKdf.algorithm, 'utf8');
+            const algorithmBytes = (0, utils_1.toArray)(token.passwordKdf.algorithm, 'utf8');
             writeArray(algorithmBytes);
             // Serialize KDF params as JSON
             const kdfParams = {
@@ -1794,7 +1839,7 @@ class CWIStyleWalletManager {
             if (token.passwordKdf.hashLength !== undefined) {
                 kdfParams.hashLength = token.passwordKdf.hashLength;
             }
-            const kdfParamsBytes = sdk_1.Utils.toArray(JSON.stringify(kdfParams), 'utf8');
+            const kdfParamsBytes = (0, utils_1.toArray)(JSON.stringify(kdfParams), 'utf8');
             writeArray(kdfParamsBytes);
         }
         else if (writer.toArray()[0] === 3) {
@@ -1802,7 +1847,7 @@ class CWIStyleWalletManager {
             writer.writeUInt8(0); // Flag indicating no KDF metadata
         }
         // Write outpoint string
-        const outpointBytes = sdk_1.Utils.toArray(token.currentOutpoint, 'utf8');
+        const outpointBytes = (0, utils_1.toArray)(token.currentOutpoint, 'utf8');
         writer.writeVarIntNum(outpointBytes.length);
         writer.write(outpointBytes);
         return writer.toArray();
@@ -1811,13 +1856,13 @@ class CWIStyleWalletManager {
      * Deserializes a UMP token from binary format (Handles Version 1, 2, and 3).
      */
     deserializeUMPToken(bin) {
-        const reader = new sdk_1.Utils.Reader(bin);
+        const reader = new utils_1.Reader(bin);
         const version = reader.readUInt8();
         if (version !== 1 && version !== 2 && version !== 3) {
             throw new Error(`Unsupported UMP token serialization version: ${version}`);
         }
         const readArray = () => {
-            const length = reader.readVarIntNum();
+            const length = reader.readVarIntNumStrict(false);
             if (length <= 0 || length > exports.MAX_STATE_SNAPSHOT_BYTES) {
                 throw new Error('UMP token field exceeds allowed bounds.');
             }
@@ -1851,9 +1896,9 @@ class CWIStyleWalletManager {
             if (kdfFlag === 1) {
                 umpVersion = reader.readUInt8(); // On-chain UMP version
                 const algorithmBytes = readArray();
-                const algorithm = sdk_1.Utils.toUTF8(algorithmBytes);
+                const algorithm = (0, utils_1.toUTF8)(algorithmBytes);
                 const kdfParamsBytes = readArray();
-                const kdfParamsJson = sdk_1.Utils.toUTF8(kdfParamsBytes);
+                const kdfParamsJson = (0, utils_1.toUTF8)(kdfParamsBytes);
                 const kdfParams = JSON.parse(kdfParamsJson);
                 passwordKdf = {
                     algorithm,
@@ -1868,9 +1913,9 @@ class CWIStyleWalletManager {
             }
         }
         // Read outpoint string
-        const outpointLen = reader.readVarIntNum();
+        const outpointLen = reader.readVarIntNumStrict(false);
         const outpointBytes = reader.read(outpointLen);
-        const currentOutpoint = sdk_1.Utils.toUTF8(outpointBytes);
+        const currentOutpoint = (0, utils_1.toUTF8)(outpointBytes);
         if (currentOutpoint.length > 128 || !/^[^\s.:]+[.:]\d+$/.test(currentOutpoint)) {
             throw new Error('Serialized UMP token contains an invalid outpoint.');
         }
@@ -1919,7 +1964,7 @@ class CWIStyleWalletManager {
             // 2. Otherwise, derive from password
             const password = await this.passwordRetriever(reason, async (passwordCandidate) => {
                 try {
-                    const derivedPasswordKey = await derivePasswordKey(this.currentUMPToken, sdk_1.Utils.toArray(passwordCandidate, 'utf8'));
+                    const derivedPasswordKey = await derivePasswordKey(this.currentUMPToken, (0, utils_1.toArray)(passwordCandidate, 'utf8'));
                     const privilegedDecryptor = this.XOR(this.rootPrimaryKey, derivedPasswordKey);
                     const decryptedPrivileged = new sdk_1.SymmetricKey(privilegedDecryptor).decrypt(this.currentUMPToken.passwordPrimaryPrivileged);
                     return !!decryptedPrivileged; // Test passes if decryption works
@@ -1932,7 +1977,7 @@ class CWIStyleWalletManager {
                 }
             });
             // Decrypt the root privileged key using the confirmed password (with token-driven KDF)
-            const derivedPasswordKey = await derivePasswordKey(this.currentUMPToken, sdk_1.Utils.toArray(password, 'utf8'));
+            const derivedPasswordKey = await derivePasswordKey(this.currentUMPToken, (0, utils_1.toArray)(password, 'utf8'));
             const privilegedDecryptor = this.XOR(this.rootPrimaryKey, derivedPasswordKey);
             const rootPrivilegedBytes = new sdk_1.SymmetricKey(privilegedDecryptor).decrypt(this.currentUMPToken.passwordPrimaryPrivileged);
             return new sdk_1.PrivateKey(rootPrivilegedBytes); // Return the ROOT key object
@@ -1942,7 +1987,7 @@ class CWIStyleWalletManager {
         if (this.currentUMPToken.profilesEncrypted != null && this.currentUMPToken.profilesEncrypted.length > 0) {
             try {
                 const decryptedProfileBytes = new sdk_1.SymmetricKey(rootKey).decrypt(this.currentUMPToken.profilesEncrypted);
-                const profilesJson = sdk_1.Utils.toUTF8(decryptedProfileBytes);
+                const profilesJson = (0, utils_1.toUTF8)(decryptedProfileBytes);
                 const profiles = JSON.parse(profilesJson);
                 if (!Array.isArray(profiles) || profiles.length > 1000 || !profiles.every(isValidProfile)) {
                     throw new Error('Decrypted profile data is invalid or exceeds supported bounds.');