@dynamic-labs-wallet/node-midnight 0.0.0 → 1.0.115

package/index.cjs

@@ -0,0 +1,1092 @@
+'use strict';
+
+var node = require('@dynamic-labs-wallet/node');
+var ledger = require('@midnight-ntwrk/ledger-v8');
+var walletSdkAddressFormat = require('@midnight-ntwrk/wallet-sdk-address-format');
+var bip32 = require('@scure/bip32');
+var bech32 = require('bech32');
+
+function _interopNamespaceDefault(e) {
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var ledger__namespace = /*#__PURE__*/_interopNamespaceDefault(ledger);
+
+/**
+ * Facade network tag: which Midnight network the wallet runtime (relay, indexer,
+ * proof server, sync state) operates against. Distinct from the numeric
+ * replay-protection id below.
+ */ // 0 = non-mainnet, 1 = Mainnet — baked into the transaction hash to prevent
+// cross-network replay.
+var MIDNIGHT_NETWORK_IDS = {
+    mainnet: 1,
+    preview: 0,
+    preprod: 0,
+    undeployed: 0
+};
+/**
+ * Resolves a caller-supplied network identifier (numeric 0/1, network name, or
+ * `midnight:<network>` chainId) to the facade network tag. Defaults to 'preview'.
+ */ var resolveMidnightNetworkTag = function(networkId) {
+    if (networkId === undefined || networkId === null) return 'preview';
+    if (typeof networkId === 'number') return networkId === 1 ? 'mainnet' : 'preview';
+    var name = networkId.includes(':') ? networkId.split(':')[1] : networkId;
+    return name === 'mainnet' ? 'mainnet' : 'preview';
+};
+var ERROR_KEYGEN_FAILED = 'Error with keygen';
+var ERROR_CREATE_WALLET_ACCOUNT = 'Error creating midnight wallet account';
+var ERROR_IMPORT_PRIVATE_KEY = 'Error importing private key';
+var ERROR_EXPORT_PRIVATE_KEY = 'Error exporting private key';
+var ERROR_SIGN_MESSAGE = 'Error signing message';
+var ERROR_ACCOUNT_ADDRESS_REQUIRED = 'Account address is required';
+
+function _array_like_to_array$1(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_with_holes$1(arr) {
+    if (Array.isArray(arr)) return arr;
+}
+function _iterable_to_array_limit$1(arr, i) {
+    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
+    if (_i == null) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
+        }
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && _i["return"] != null) _i["return"]();
+        } finally{
+            if (_d) throw _e;
+        }
+    }
+    return _arr;
+}
+function _non_iterable_rest$1() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _sliced_to_array$1(arr, i) {
+    return _array_with_holes$1(arr) || _iterable_to_array_limit$1(arr, i) || _unsupported_iterable_to_array$1(arr, i) || _non_iterable_rest$1();
+}
+function _unsupported_iterable_to_array$1(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$1(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$1(o, minLen);
+}
+/** Bech32m HRPs (BIP-0350) for Midnight unshielded addresses, per network. */ var ADDRESS_PREFIXES = {
+    mainnet: 'mn_addr',
+    preview: 'mn_addr_preview',
+    preprod: 'mn_addr_preprod',
+    undeployed: 'mn_addr_undeployed'
+};
+/**
+ * Encodes a 32-byte Midnight address hash as a bech32m address.
+ *
+ * The input is the *address hash* (`ledger.addressFromKey()` — a Poseidon hash
+ * of the verifying key), not the raw public key. Use {@link addressHashFromPublicKey}
+ * to produce it.
+ */ var deriveMidnightAddress = function(param) {
+    var addressHashHex = param.addressHashHex, _param_network = param.network, network = _param_network === void 0 ? 'preview' : _param_network;
+    var bytes = Buffer.from(addressHashHex, 'hex');
+    if (bytes.length !== 32) {
+        throw new Error("Invalid address hash length: ".concat(bytes.length, ", expected 32"));
+    }
+    return bech32.bech32m.encode(ADDRESS_PREFIXES[network], bech32.bech32m.toWords(bytes));
+};
+// `'mn_addr'` is a strict prefix of every other value in ADDRESS_PREFIXES,
+// so naive `startsWith` checks hit `mainnet` for any Midnight address. Always
+// check longest prefix first (descending).
+var PREFIX_ENTRIES_LONGEST_FIRST = Object.entries(ADDRESS_PREFIXES).slice().sort(function(a, b) {
+    return b[1].length - a[1].length;
+});
+var isValidMidnightAddress = function(address) {
+    try {
+        var hasValidPrefix = PREFIX_ENTRIES_LONGEST_FIRST.some(function(param) {
+            var _param = _sliced_to_array$1(param, 2), prefix = _param[1];
+            return address.startsWith(prefix);
+        });
+        if (!hasValidPrefix) return false;
+        var decoded = bech32.bech32m.decode(address, 120);
+        return Buffer.from(bech32.bech32m.fromWords(decoded.words)).length === 32;
+    } catch (e) {
+        return false;
+    }
+};
+var decodeMidnightAddress = function(address) {
+    if (!isValidMidnightAddress(address)) {
+        throw new Error('Invalid Midnight address');
+    }
+    var decoded = bech32.bech32m.decode(address, 120);
+    return Buffer.from(bech32.bech32m.fromWords(decoded.words));
+};
+var getNetworkFromAddress = function(address) {
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = PREFIX_ENTRIES_LONGEST_FIRST[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var _step_value = _sliced_to_array$1(_step.value, 2), network = _step_value[0], prefix = _step_value[1];
+            if (address.startsWith(prefix)) {
+                return network;
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    throw new Error('Unknown network prefix in Midnight address');
+};
+/**
+ * Normalizes an MPC-returned BIP340 public key to the 32-byte x-only hex form
+ * that `ledger.addressFromKey()` expects, dropping the 02/03 parity byte if the
+ * key arrived in 33-byte compressed form.
+ */ var toXOnlyPublicKeyHex = function(publicKeyHex) {
+    var normalized = publicKeyHex.startsWith('0x') ? publicKeyHex.slice(2) : publicKeyHex;
+    if (normalized.length === 66 && (normalized.startsWith('02') || normalized.startsWith('03'))) {
+        return normalized.slice(2);
+    }
+    if (normalized.length === 64) {
+        return normalized;
+    }
+    throw new Error("Invalid BIP340 public key length: ".concat(normalized.length, " hex chars, expected 64 or 66"));
+};
+
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_with_holes(arr) {
+    if (Array.isArray(arr)) return arr;
+}
+function _assert_this_initialized(self) {
+    if (self === void 0) {
+        throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
+    }
+    return self;
+}
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _call_super(_this, derived, args) {
+    derived = _get_prototype_of(derived);
+    return _possible_constructor_return(_this, _is_native_reflect_construct() ? Reflect.construct(derived, args || [], _get_prototype_of(_this).constructor) : derived.apply(_this, args));
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _defineProperties(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties(Constructor.prototype, protoProps);
+    return Constructor;
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _get_prototype_of(o) {
+    _get_prototype_of = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o) {
+        return o.__proto__ || Object.getPrototypeOf(o);
+    };
+    return _get_prototype_of(o);
+}
+function _inherits(subClass, superClass) {
+    if (typeof superClass !== "function" && superClass !== null) {
+        throw new TypeError("Super expression must either be null or a function");
+    }
+    subClass.prototype = Object.create(superClass && superClass.prototype, {
+        constructor: {
+            value: subClass,
+            writable: true,
+            configurable: true
+        }
+    });
+    if (superClass) _set_prototype_of(subClass, superClass);
+}
+function _instanceof(left, right) {
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _iterable_to_array_limit(arr, i) {
+    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
+    if (_i == null) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
+        }
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && _i["return"] != null) _i["return"]();
+        } finally{
+            if (_d) throw _e;
+        }
+    }
+    return _arr;
+}
+function _non_iterable_rest() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _possible_constructor_return(self, call) {
+    if (call && (_type_of(call) === "object" || typeof call === "function")) {
+        return call;
+    }
+    return _assert_this_initialized(self);
+}
+function _set_prototype_of(o, p) {
+    _set_prototype_of = Object.setPrototypeOf || function setPrototypeOf(o, p) {
+        o.__proto__ = p;
+        return o;
+    };
+    return _set_prototype_of(o, p);
+}
+function _sliced_to_array(arr, i) {
+    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array(arr, i) || _non_iterable_rest();
+}
+function _type_of(obj) {
+    "@swc/helpers - typeof";
+    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+}
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
+function _is_native_reflect_construct() {
+    try {
+        var result = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function() {}));
+    } catch (_) {}
+    return (_is_native_reflect_construct = function() {
+        return !!result;
+    })();
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, g, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    };
+    return g = {
+        next: verb(0),
+        "throw": verb(1),
+        "return": verb(2)
+    }, typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+        return this;
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(_)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+var logError = node.createLogError('node-midnight');
+// Unshielded is NON-hardened to match the server's MPC signing path (Sodot's
+// derivePrivateKeyFromXpriv is non-hardened-only). Shielded and dust are hardened Midnight-canonical paths; those roles are signed
+// entirely client-side, so the Sodot constraint does not apply.
+var ROLE_DERIVATION_PATHS = {
+    unshielded: 'm/44/2400/0/0/0',
+    shielded: "m/44'/2400'/0'/3/0",
+    dust: "m/44'/2400'/0'/2/0"
+};
+var DynamicMidnightWalletClient = /*#__PURE__*/ function(DynamicWalletClient) {
+    _inherits(DynamicMidnightWalletClient, DynamicWalletClient);
+    function DynamicMidnightWalletClient(param) {
+        var environmentId = param.environmentId, baseApiUrl = param.baseApiUrl, baseMPCRelayApiUrl = param.baseMPCRelayApiUrl, debug = param.debug, enableMPCAccelerator = param.enableMPCAccelerator, logger = param.logger, _param_network = param.network, network = _param_network === void 0 ? 'preview' : _param_network;
+        _class_call_check(this, DynamicMidnightWalletClient);
+        var _this;
+        _this = _call_super(this, DynamicMidnightWalletClient, [
+            {
+                environmentId: environmentId,
+                baseApiUrl: baseApiUrl,
+                baseMPCRelayApiUrl: baseMPCRelayApiUrl,
+                debug: debug,
+                enableMPCAccelerator: enableMPCAccelerator,
+                logger: logger
+            }
+        ]), _define_property(_this, "chainName", 'MIDNIGHT'), _define_property(_this, "network", void 0), /**
+   * Derives the bech32m unshielded account address from a BIP340 public key.
+   * The address is the Poseidon hash of the verifying key, not the key itself.
+   */ _define_property(_this, "deriveAccountAddress", function(param) {
+            var publicKeyHex = param.publicKeyHex, network = param.network;
+            var addressHashHex = ledger__namespace.addressFromKey(toXOnlyPublicKeyHex(publicKeyHex));
+            return deriveMidnightAddress({
+                addressHashHex: addressHashHex,
+                network: network !== null && network !== void 0 ? network : _this.network
+            });
+        });
+        _this.network = network;
+        return _this;
+    }
+    _create_class(DynamicMidnightWalletClient, [
+        {
+            key: "createWalletAccount",
+            value: /**
+   * Creates a new wallet account.
+   * @param thresholdSignatureScheme - The threshold signature scheme to use for the wallet.
+   * @param password - The password to use for the wallet.
+   * @param onError - The function to call if an error occurs.
+   * @param backUpToDynamic - Whether to back up the external server key shares to the client share service. By default, it is false.
+   * @returns The walletMetadata, public key hex, raw public key, and external server key shares.
+   */ function createWalletAccount(param) {
+                var thresholdSignatureScheme = param.thresholdSignatureScheme, password = param.password, onError = param.onError, _param_backUpToDynamic = param.backUpToDynamic, backUpToDynamic = _param_backUpToDynamic === void 0 ? false : _param_backUpToDynamic;
+                var _this = this;
+                return _async_to_generator(function() {
+                    var resolvedWalletId, resolvedShareSetId, serverAccountAddress, ceremonyCompleteResolver, ceremonyCompletePromise, _ref, rawPublicKey, externalServerKeyShares, publicKeyHex, accountAddress, chainConfig, walletMetadata, _ref1, keySharesWithBackupStatus, backupInfo, error;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                _state.trys.push([
+                                    0,
+                                    4,
+                                    ,
+                                    5
+                                ]);
+                                ceremonyCompletePromise = new Promise(function(resolve) {
+                                    ceremonyCompleteResolver = resolve;
+                                });
+                                return [
+                                    4,
+                                    _this.keyGen({
+                                        thresholdSignatureScheme: thresholdSignatureScheme,
+                                        chainName: _this.chainName,
+                                        password: password,
+                                        backUpToDynamic: backUpToDynamic,
+                                        onError: onError,
+                                        onCeremonyComplete: function(accountAddress, walletId, shareSetId) {
+                                            resolvedWalletId = walletId;
+                                            resolvedShareSetId = shareSetId;
+                                            serverAccountAddress = accountAddress;
+                                            ceremonyCompleteResolver(undefined);
+                                        }
+                                    })
+                                ];
+                            case 1:
+                                _ref = _state.sent(), rawPublicKey = _ref.rawPublicKey, externalServerKeyShares = _ref.externalServerKeyShares;
+                                return [
+                                    4,
+                                    ceremonyCompletePromise
+                                ];
+                            case 2:
+                                _state.sent();
+                                if (!rawPublicKey || !externalServerKeyShares || !resolvedWalletId || !(typeof rawPublicKey === 'string' || _instanceof(rawPublicKey, Uint8Array))) {
+                                    throw new Error(ERROR_KEYGEN_FAILED);
+                                }
+                                publicKeyHex = typeof rawPublicKey === 'string' ? rawPublicKey : Buffer.from(rawPublicKey).toString('hex');
+                                accountAddress = _this.deriveAccountAddress({
+                                    publicKeyHex: publicKeyHex
+                                });
+                                // The browser client takes the server's address verbatim because the
+                                // Poseidon hash is WASM-only there; in Node we derive it locally. Warn
+                                // rather than throw on divergence — the server's is authoritative.
+                                if (serverAccountAddress && serverAccountAddress !== accountAddress) {
+                                    _this.logger.warn("[Midnight] Locally derived address ".concat(accountAddress, " differs from server address ").concat(serverAccountAddress));
+                                }
+                                chainConfig = node.getMPCChainConfig(_this.chainName);
+                                walletMetadata = {
+                                    walletId: resolvedWalletId,
+                                    accountAddress: accountAddress,
+                                    chainName: _this.chainName,
+                                    thresholdSignatureScheme: thresholdSignatureScheme,
+                                    derivationPath: JSON.stringify(Object.fromEntries(chainConfig.derivationPath.map(function(value, index) {
+                                        return [
+                                            index,
+                                            value
+                                        ];
+                                    }))),
+                                    shareSetId: resolvedShareSetId
+                                };
+                                return [
+                                    4,
+                                    _this.storeEncryptedBackupByWalletWithRetry({
+                                        accountAddress: accountAddress,
+                                        externalServerKeyShares: externalServerKeyShares,
+                                        password: password,
+                                        backUpToDynamic: backUpToDynamic,
+                                        walletMetadata: walletMetadata
+                                    })
+                                ];
+                            case 3:
+                                _ref1 = _state.sent(), keySharesWithBackupStatus = _ref1.keySharesWithBackupStatus, backupInfo = _ref1.backupInfo;
+                                walletMetadata.externalServerKeySharesBackupInfo = backupInfo;
+                                return [
+                                    2,
+                                    {
+                                        walletMetadata: walletMetadata,
+                                        publicKeyHex: publicKeyHex,
+                                        rawPublicKey: rawPublicKey,
+                                        externalServerKeyShares: externalServerKeyShares,
+                                        externalKeySharesWithBackupStatus: keySharesWithBackupStatus
+                                    }
+                                ];
+                            case 4:
+                                error = _state.sent();
+                                logError({
+                                    message: ERROR_CREATE_WALLET_ACCOUNT,
+                                    error: error,
+                                    context: {}
+                                });
+                                throw new Error(ERROR_CREATE_WALLET_ACCOUNT, {
+                                    cause: error
+                                });
+                            case 5:
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                })();
+            }
+        },
+        {
+            key: "signMessage",
+            value: /**
+   * Signs a message using MPC
+   * @param message - The message to sign
+   * @param walletMetadata - Wallet metadata (the full object returned by createWalletAccount/importPrivateKey, with backupInfo merged from any subsequent updatePassword/refresh/reshare)
+   * @param password - The password for encrypted backup shares
+   * @param externalServerKeyShares - The external server key shares
+   * @param onError - The function to call if an error occurs
+   * @returns The signature as a base64 string
+   */ function signMessage(param) {
+                var message = param.message, walletMetadata = param.walletMetadata, _param_password = param.password, password = _param_password === void 0 ? undefined : _param_password, externalServerKeyShares = param.externalServerKeyShares, onError = param.onError;
+                var _this = this;
+                return _async_to_generator(function() {
+                    var accountAddress, messageHex, signature, error;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                accountAddress = walletMetadata.accountAddress;
+                                if (!accountAddress) {
+                                    throw new Error(ERROR_ACCOUNT_ADDRESS_REQUIRED);
+                                }
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    3,
+                                    ,
+                                    4
+                                ]);
+                                // The signing API expects hex; policy validation needs the original bytes.
+                                messageHex = Buffer.from(message).toString('hex');
+                                return [
+                                    4,
+                                    _this.sign({
+                                        message: messageHex,
+                                        accountAddress: accountAddress,
+                                        chainName: _this.chainName,
+                                        password: password,
+                                        externalServerKeyShares: externalServerKeyShares,
+                                        onError: onError,
+                                        walletMetadata: walletMetadata,
+                                        context: {
+                                            midnightMessage: message
+                                        }
+                                    })
+                                ];
+                            case 2:
+                                signature = _state.sent();
+                                return [
+                                    2,
+                                    Buffer.from(signature).toString('base64')
+                                ];
+                            case 3:
+                                error = _state.sent();
+                                logError({
+                                    message: ERROR_SIGN_MESSAGE,
+                                    error: error,
+                                    context: {
+                                        accountAddress: accountAddress
+                                    }
+                                });
+                                throw new Error(ERROR_SIGN_MESSAGE, {
+                                    cause: error
+                                });
+                            case 4:
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                })();
+            }
+        },
+        {
+            key: "exportPrivateKey",
+            value: /**
+   * Exports the private key for a given wallet.
+   *
+   * Returns the unshielded (role 0) key at the wallet's derivation path. The
+   * shielded and dust role keys need the master xprv, which `exportKey` does
+   * not surface — see the package README.
+   *
+   * @param walletMetadata - Wallet metadata (the full object returned by createWalletAccount/importPrivateKey, with backupInfo merged from any subsequent updatePassword/refresh/reshare)
+   * @param password - The password for encrypted backup shares
+   * @param externalServerKeyShares - The external server key shares
+   * @returns The private key as a hex string
+   */ function exportPrivateKey(param) {
+                var walletMetadata = param.walletMetadata, _param_password = param.password, password = _param_password === void 0 ? undefined : _param_password, externalServerKeyShares = param.externalServerKeyShares;
+                var _this = this;
+                return _async_to_generator(function() {
+                    var accountAddress, derivedPrivateKey, error;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                accountAddress = walletMetadata.accountAddress;
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    3,
+                                    ,
+                                    4
+                                ]);
+                                return [
+                                    4,
+                                    _this.exportKey({
+                                        accountAddress: accountAddress,
+                                        chainName: _this.chainName,
+                                        password: password,
+                                        externalServerKeyShares: externalServerKeyShares,
+                                        walletMetadata: walletMetadata
+                                    })
+                                ];
+                            case 2:
+                                derivedPrivateKey = _state.sent().derivedPrivateKey;
+                                if (!derivedPrivateKey) {
+                                    throw new Error('Derived private key is undefined');
+                                }
+                                return [
+                                    2,
+                                    derivedPrivateKey.slice(0, 64)
+                                ];
+                            case 3:
+                                error = _state.sent();
+                                logError({
+                                    message: ERROR_EXPORT_PRIVATE_KEY,
+                                    error: error,
+                                    context: {
+                                        accountAddress: accountAddress
+                                    }
+                                });
+                                throw new Error(ERROR_EXPORT_PRIVATE_KEY);
+                            case 4:
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                })();
+            }
+        },
+        {
+            key: "offlineExportPrivateKey",
+            value: /**
+   * Exports the private key offline using key shares
+   * @param keyShares - The key shares to export the private key for
+   * @param derivationPath - The derivation path
+   * @returns The derived private key
+   *
+   * `derivationPath` is the JSON-serialized index map that
+   * `walletMetadata.derivationPath` carries (e.g. `'{"0":44,"1":2400,"2":0,"3":0,"4":0}'`
+   * or `'[44,2400,0,0,0]'`). BIP-32 strings such as `"m/44'/2400'/0'/0/0"` are rejected.
+   * Omit it to export without path derivation.
+   */ function offlineExportPrivateKey(param) {
+                var keyShares = param.keyShares, derivationPath = param.derivationPath;
+                var _this = this;
+                return _async_to_generator(function() {
+                    var derivedPrivateKey;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    _this.offlineExportKey({
+                                        chainName: _this.chainName,
+                                        keyShares: keyShares,
+                                        derivationPath: derivationPath
+                                    })
+                                ];
+                            case 1:
+                                derivedPrivateKey = _state.sent().derivedPrivateKey;
+                                return [
+                                    2,
+                                    {
+                                        derivedPrivateKey: derivedPrivateKey
+                                    }
+                                ];
+                        }
+                    });
+                })();
+            }
+        },
+        {
+            key: "importPrivateKey",
+            value: /**
+   * Imports a private key.
+   * @param privateKey - The private key to import.
+   * @param chainName - The chain name to use for the wallet.
+   * @param thresholdSignatureScheme - The threshold signature scheme to use for the wallet.
+   * @param password - The password to use for the wallet.
+   * @param onError - The function to call if an error occurs.
+   * @param backUpToDynamic - Whether to back up the external server key shares to the client share service.
+   * @param publicAddressCheck - Optional public address to verify against the derived address.
+   * @returns The walletMetadata, public key hex, raw public key, and external server key shares.
+   */ function importPrivateKey(param) {
+                var privateKey = param.privateKey, chainName = param.chainName, thresholdSignatureScheme = param.thresholdSignatureScheme, password = param.password, onError = param.onError, _param_backUpToDynamic = param.backUpToDynamic, backUpToDynamic = _param_backUpToDynamic === void 0 ? false : _param_backUpToDynamic, publicAddressCheck = param.publicAddressCheck;
+                var _this = this;
+                return _async_to_generator(function() {
+                    var resolvedWalletId, resolvedShareSetId, ceremonyCompleteResolver, ceremonyCompletePromise, formattedPrivateKey, derivedAddress, _ref, rawPublicKey, externalServerKeyShares, resultPublicKeyHex, accountAddress, chainConfig, walletMetadata, _ref1, keySharesWithBackupStatus, backupInfo, error;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                _state.trys.push([
+                                    0,
+                                    4,
+                                    ,
+                                    5
+                                ]);
+                                ceremonyCompletePromise = new Promise(function(resolve) {
+                                    ceremonyCompleteResolver = resolve;
+                                });
+                                formattedPrivateKey = privateKey.startsWith('0x') ? privateKey.slice(2) : privateKey;
+                                derivedAddress = _this.deriveAccountAddress({
+                                    publicKeyHex: _this.getPublicKeyFromPrivateKey(formattedPrivateKey)
+                                });
+                                if (publicAddressCheck && derivedAddress !== publicAddressCheck) {
+                                    throw new Error("Public address mismatch: derived address ".concat(derivedAddress, " !== public address ").concat(publicAddressCheck));
+                                }
+                                return [
+                                    4,
+                                    _this.importRawPrivateKey({
+                                        chainName: chainName,
+                                        thresholdSignatureScheme: thresholdSignatureScheme,
+                                        privateKey: formattedPrivateKey,
+                                        password: password,
+                                        backUpToDynamic: backUpToDynamic,
+                                        onCeremonyComplete: function(_accountAddress, walletId, shareSetId) {
+                                            resolvedWalletId = walletId;
+                                            resolvedShareSetId = shareSetId;
+                                            ceremonyCompleteResolver(undefined);
+                                        },
+                                        onError: function(e) {
+                                            logError({
+                                                message: 'importPrivateKey: onError',
+                                                error: e,
+                                                context: {}
+                                            });
+                                            onError === null || onError === void 0 ? void 0 : onError(e);
+                                        }
+                                    })
+                                ];
+                            case 1:
+                                _ref = _state.sent(), rawPublicKey = _ref.rawPublicKey, externalServerKeyShares = _ref.externalServerKeyShares;
+                                return [
+                                    4,
+                                    ceremonyCompletePromise
+                                ];
+                            case 2:
+                                _state.sent();
+                                if (!rawPublicKey || !externalServerKeyShares || !resolvedWalletId || !(typeof rawPublicKey === 'string' || _instanceof(rawPublicKey, Uint8Array))) {
+                                    throw new Error(ERROR_IMPORT_PRIVATE_KEY);
+                                }
+                                resultPublicKeyHex = typeof rawPublicKey === 'string' ? rawPublicKey : Buffer.from(rawPublicKey).toString('hex');
+                                accountAddress = _this.deriveAccountAddress({
+                                    publicKeyHex: resultPublicKeyHex
+                                });
+                                if (accountAddress !== derivedAddress) {
+                                    throw new Error("Public key mismatch: derived address ".concat(accountAddress, " !== expected ").concat(derivedAddress));
+                                }
+                                chainConfig = node.getMPCChainConfig(_this.chainName);
+                                walletMetadata = {
+                                    walletId: resolvedWalletId,
+                                    accountAddress: accountAddress,
+                                    chainName: _this.chainName,
+                                    thresholdSignatureScheme: thresholdSignatureScheme,
+                                    derivationPath: JSON.stringify(Object.fromEntries(chainConfig.derivationPath.map(function(value, index) {
+                                        return [
+                                            index,
+                                            value
+                                        ];
+                                    }))),
+                                    shareSetId: resolvedShareSetId
+                                };
+                                return [
+                                    4,
+                                    _this.storeEncryptedBackupByWalletWithRetry({
+                                        accountAddress: accountAddress,
+                                        externalServerKeyShares: externalServerKeyShares,
+                                        password: password,
+                                        backUpToDynamic: backUpToDynamic,
+                                        walletMetadata: walletMetadata
+                                    })
+                                ];
+                            case 3:
+                                _ref1 = _state.sent(), keySharesWithBackupStatus = _ref1.keySharesWithBackupStatus, backupInfo = _ref1.backupInfo;
+                                walletMetadata.externalServerKeySharesBackupInfo = backupInfo;
+                                return [
+                                    2,
+                                    {
+                                        walletMetadata: walletMetadata,
+                                        publicKeyHex: resultPublicKeyHex,
+                                        rawPublicKey: rawPublicKey,
+                                        externalServerKeyShares: externalServerKeyShares,
+                                        externalKeySharesWithBackupStatus: keySharesWithBackupStatus
+                                    }
+                                ];
+                            case 4:
+                                error = _state.sent();
+                                logError({
+                                    message: ERROR_IMPORT_PRIVATE_KEY,
+                                    error: error,
+                                    context: {}
+                                });
+                                onError === null || onError === void 0 ? void 0 : onError(error);
+                                throw new Error(ERROR_IMPORT_PRIVATE_KEY);
+                            case 5:
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                })();
+            }
+        },
+        {
+            /**
+   * Derives the BIP340 verifying key from a private key
+   * @param privateKeyHex - The private key as a hex string
+   * @returns The verifying key as a hex string
+   */ key: "getPublicKeyFromPrivateKey",
+            value: function getPublicKeyFromPrivateKey(privateKeyHex) {
+                try {
+                    var privateKeyBytes = Buffer.from(privateKeyHex, 'hex');
+                    if (privateKeyBytes.length !== 32) {
+                        throw new Error("Invalid private key length: ".concat(privateKeyBytes.length, ", expected 32"));
+                    }
+                    return ledger__namespace.signatureVerifyingKey(privateKeyHex);
+                } catch (error) {
+                    // Deliberately not logging the error: it originates from a WASM call that
+                    // received the private key, so its message could echo key material into
+                    // logs. The error is re-thrown intact for the caller to inspect.
+                    this.logger.debug('[Midnight] getPublicKeyFromPrivateKey failed');
+                    throw error;
+                }
+            }
+        },
+        {
+            key: "getRoleKeys",
+            value: /**
+   * Derives the unshielded, shielded, and dust role keys from the wallet's MPC
+   * master xprv.
+   *
+   * Deliberately not persisted: these are plaintext secrets, and writing them
+   * to disk or a cache would trade a per-session MPC export for a durable
+   * exfiltration target. Callers should hold the result only as long as the
+   * operation needs it.
+   *
+   * @returns The three role private keys as hex strings
+   */ function getRoleKeys(param) {
+                var walletMetadata = param.walletMetadata, _param_password = param.password, password = _param_password === void 0 ? undefined : _param_password, externalServerKeyShares = param.externalServerKeyShares, elevatedAccessToken = param.elevatedAccessToken;
+                var _this = this;
+                return _async_to_generator(function() {
+                    var keyExportRaw, master, roleKeys;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    _this.exportMasterKeyMaterial({
+                                        accountAddress: walletMetadata.accountAddress,
+                                        chainName: _this.chainName,
+                                        password: password,
+                                        externalServerKeyShares: externalServerKeyShares,
+                                        elevatedAccessToken: elevatedAccessToken,
+                                        walletMetadata: walletMetadata
+                                    })
+                                ];
+                            case 1:
+                                keyExportRaw = _state.sent().keyExportRaw;
+                                master = bip32.HDKey.fromExtendedKey(keyExportRaw);
+                                roleKeys = Object.entries(ROLE_DERIVATION_PATHS).map(function(param) {
+                                    var _param = _sliced_to_array(param, 2), role = _param[0], path = _param[1];
+                                    var privateKey = master.derive(path).privateKey;
+                                    if (!privateKey) {
+                                        throw new Error("BIP32 derivation returned null privateKey for the ".concat(role, " role"));
+                                    }
+                                    return [
+                                        role,
+                                        Buffer.from(privateKey).toString('hex')
+                                    ];
+                                });
+                                return [
+                                    2,
+                                    Object.fromEntries(roleKeys)
+                                ];
+                        }
+                    });
+                })();
+            }
+        },
+        {
+            key: "getAddresses",
+            value: /**
+   * Derives the wallet's three receiving addresses.
+   *
+   * Only the unshielded address comes from the MPC keygen (secp256k1/BIP340);
+   * shielded uses JubJub and dust BLS12-381, so both are derived client-side
+   * from the role keys. Requires an MPC export, but no facade or sync.
+   *
+   * @returns bech32m addresses for the requested network
+   */ function getAddresses(access) {
+                var _this = this;
+                return _async_to_generator(function() {
+                    var network, encodeId, roleKeys, shieldedSecretKeys, shielded, dust, dustSecretKey;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                network = resolveMidnightNetworkTag(access.networkId);
+                                // Preview keeps the bare tag; mainnet is the library's `mainnet` symbol.
+                                encodeId = network === 'mainnet' ? walletSdkAddressFormat.mainnet : 'preview';
+                                return [
+                                    4,
+                                    _this.getRoleKeys(access)
+                                ];
+                            case 1:
+                                roleKeys = _state.sent();
+                                shieldedSecretKeys = ledger__namespace.ZswapSecretKeys.fromSeed(new Uint8Array(Buffer.from(roleKeys.shielded, 'hex')));
+                                shielded = walletSdkAddressFormat.MidnightBech32m.encode(encodeId, new walletSdkAddressFormat.ShieldedAddress(new walletSdkAddressFormat.ShieldedCoinPublicKey(Buffer.from(shieldedSecretKeys.coinPublicKey, 'hex')), new walletSdkAddressFormat.ShieldedEncryptionPublicKey(Buffer.from(shieldedSecretKeys.encryptionPublicKey, 'hex')))).toString();
+                                try {
+                                    dustSecretKey = ledger__namespace.DustSecretKey.fromSeed(new Uint8Array(Buffer.from(roleKeys.dust, 'hex')));
+                                    dust = walletSdkAddressFormat.MidnightBech32m.encode(encodeId, new walletSdkAddressFormat.DustAddress(dustSecretKey.publicKey)).toString();
+                                } catch (err) {
+                                    _this.logger.warn('[Midnight] getAddresses: dust address derivation failed', err);
+                                }
+                                return [
+                                    2,
+                                    {
+                                        unshielded: access.walletMetadata.accountAddress,
+                                        shielded: shielded,
+                                        dust: dust
+                                    }
+                                ];
+                        }
+                    });
+                })();
+            }
+        },
+        {
+            key: "getMidnightWallets",
+            value: /**
+   * Gets all Midnight wallets
+   * @returns Array of Midnight wallets
+   */ function getMidnightWallets() {
+                var _this = this;
+                return _async_to_generator(function() {
+                    var wallets;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    _this.getWallets()
+                                ];
+                            case 1:
+                                wallets = _state.sent();
+                                return [
+                                    2,
+                                    wallets.filter(function(wallet) {
+                                        return wallet.chainName === _this.chainName;
+                                    })
+                                ];
+                        }
+                    });
+                })();
+            }
+        }
+    ]);
+    return DynamicMidnightWalletClient;
+}(node.DynamicWalletClient);
+
+exports.DynamicMidnightWalletClient = DynamicMidnightWalletClient;
+exports.ERROR_ACCOUNT_ADDRESS_REQUIRED = ERROR_ACCOUNT_ADDRESS_REQUIRED;
+exports.ERROR_CREATE_WALLET_ACCOUNT = ERROR_CREATE_WALLET_ACCOUNT;
+exports.ERROR_EXPORT_PRIVATE_KEY = ERROR_EXPORT_PRIVATE_KEY;
+exports.ERROR_IMPORT_PRIVATE_KEY = ERROR_IMPORT_PRIVATE_KEY;
+exports.ERROR_KEYGEN_FAILED = ERROR_KEYGEN_FAILED;
+exports.ERROR_SIGN_MESSAGE = ERROR_SIGN_MESSAGE;
+exports.MIDNIGHT_NETWORK_IDS = MIDNIGHT_NETWORK_IDS;
+exports.decodeMidnightAddress = decodeMidnightAddress;
+exports.deriveMidnightAddress = deriveMidnightAddress;
+exports.getNetworkFromAddress = getNetworkFromAddress;
+exports.isValidMidnightAddress = isValidMidnightAddress;
+exports.resolveMidnightNetworkTag = resolveMidnightNetworkTag;
+exports.toXOnlyPublicKeyHex = toXOnlyPublicKeyHex;