@dynamic-labs/bitcoin 5.3.1 → 5.4.0

package/CHANGELOG.md

@@ -1,4 +1,43 @@
 
+## [5.4.0](https://github.com/dynamic-labs/dynamic-auth/compare/v5.3.2...v5.4.0) (2026-08-25)
+
+
+### Features
+
+* **aleo:** wire up signMessage on the WaaS Aleo connector ([#12235](https://github.com/dynamic-labs/dynamic-auth/issues/12235)) ([e56cbf5](https://github.com/dynamic-labs/dynamic-auth/commit/e56cbf5546bdcc21ce916dece43ae36dcea9b808))
+* **waas:** thread isRawScalarImport through importPrivateKey for ed25519 chains ([#12220](https://github.com/dynamic-labs/dynamic-auth/issues/12220)) ([ced9efa](https://github.com/dynamic-labs/dynamic-auth/commit/ced9efac5fa5a4a1280383419f56fe22733722cd))
+* **webview:** add policies message contract and controller ([#12248](https://github.com/dynamic-labs/dynamic-auth/issues/12248)) ([8557c1e](https://github.com/dynamic-labs/dynamic-auth/commit/8557c1ed3861e12f1f06b2bb610184813b577daa))
+
+
+### Bug Fixes
+
+* **bitcoin:** pass the wallet's address type when signing ([#12265](https://github.com/dynamic-labs/dynamic-auth/issues/12265)) ([b8a8eab](https://github.com/dynamic-labs/dynamic-auth/commit/b8a8eab7e4cc294cc307fb10ea6814e76111a274))
+* remediate high-severity tar vulnerability and prune a dead override ([#12268](https://github.com/dynamic-labs/dynamic-auth/issues/12268)) ([6b1b343](https://github.com/dynamic-labs/dynamic-auth/commit/6b1b343e7947e8da30012446677e342ae9bfe14a))
+* **waas-svm:** fix retry-classification and environmentId gaps in [#12240](https://github.com/dynamic-labs/dynamic-auth/issues/12240) ([#12247](https://github.com/dynamic-labs/dynamic-auth/issues/12247)) ([e79cecc](https://github.com/dynamic-labs/dynamic-auth/commit/e79ceccd424c48c3a7f45fdd6ea288c269ac0171))
+* **wallet-connect:** reopen WalletConnect IndexedDB when the browser closes the connection ([#12262](https://github.com/dynamic-labs/dynamic-auth/issues/12262)) ([1a20dde](https://github.com/dynamic-labs/dynamic-auth/commit/1a20ddeaeec590ae3390c9e47ef3c14738379b83))
+
+
+### Performance Improvements
+
+* **ethereum-gasless-core:** parallel 7702 auth signing and long-poll sponsored-tx status ([#12225](https://github.com/dynamic-labs/dynamic-auth/issues/12225)) ([53ca916](https://github.com/dynamic-labs/dynamic-auth/commit/53ca91668f8dd839c52d55a0e5d7bb5257f7f415))
+
+### [5.3.2](https://github.com/dynamic-labs/dynamic-auth/compare/v5.3.1...v5.3.2) (2026-08-19)
+
+
+### Features
+
+* **bitcoin:** add allowedSighash to embedded wallet signPsbt ([#12233](https://github.com/dynamic-labs/dynamic-auth/issues/12233)) ([d0ff829](https://github.com/dynamic-labs/dynamic-auth/commit/d0ff8291a3d1771d5ca356172acc10af94349b15))
+* **bitcoin:** forward signingIndexes to embedded PSBT signing ([#12211](https://github.com/dynamic-labs/dynamic-auth/issues/12211)) ([733da3d](https://github.com/dynamic-labs/dynamic-auth/commit/733da3d32f39a9ae6d813df84fcff6350ba12eb5))
+* expose createOfflineRecoveryShares SDK function in webview and legacy client ([#12239](https://github.com/dynamic-labs/dynamic-auth/issues/12239)) ([c8056e8](https://github.com/dynamic-labs/dynamic-auth/commit/c8056e8d5a1c66ac0146b046bc7cc198de118f0b))
+
+
+### Bug Fixes
+
+* **bitcoin:** parse PSBTs with the active network's address encoding ([#12219](https://github.com/dynamic-labs/dynamic-auth/issues/12219)) ([8b151e2](https://github.com/dynamic-labs/dynamic-auth/commit/8b151e23440094cfa0d48728e1d0f19de567ca05))
+* **bitcoin:** stop ensureActiveAccount from resetting a switched network ([#12215](https://github.com/dynamic-labs/dynamic-auth/issues/12215)) ([86668b7](https://github.com/dynamic-labs/dynamic-auth/commit/86668b79d23cd89b7e96518551cdaecab7dd5ce3))
+* remediate high-severity dependency vulnerabilities ([#12238](https://github.com/dynamic-labs/dynamic-auth/issues/12238)) ([a4fc78c](https://github.com/dynamic-labs/dynamic-auth/commit/a4fc78ca27ee44ce6a1038c4e0d07f55528b4994))
+* **waas-svm:** retry SVM gas sponsorship before falling back, then throw ([#12240](https://github.com/dynamic-labs/dynamic-auth/issues/12240)) ([f599a7a](https://github.com/dynamic-labs/dynamic-auth/commit/f599a7af55727e06373772acf574ee7c43e56bbb))
+
 ### [5.3.1](https://github.com/dynamic-labs/dynamic-auth/compare/v5.3.0...v5.3.1) (2026-08-14)
 
 ## [5.3.0](https://github.com/dynamic-labs/dynamic-auth/compare/v5.2.0...v5.3.0) (2026-08-12)

package/package.cjs

@@ -3,6 +3,6 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "5.3.1";
+var version = "5.4.0";
 
 exports.version = version;

package/package.js

@@ -1,4 +1,4 @@
 'use client'
-var version = "5.3.1";
+var version = "5.4.0";
 
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/bitcoin",
-  "version": "5.3.1",
+  "version": "5.4.0",
   "description": "A React SDK for implementing wallet web3 authentication and authorization to your website.",
   "author": "Dynamic Labs, Inc.",
   "license": "MIT",
@@ -18,24 +18,24 @@
   },
   "homepage": "https://www.dynamic.xyz/",
   "dependencies": {
-    "@dynamic-labs-wallet/browser-wallet-client": "1.0.92",
+    "@dynamic-labs-wallet/browser-wallet-client": "1.0.106",
     "@dynamic-labs-wallet/forward-mpc-client": "1.0.1",
     "@bitcoinerlab/secp256k1": "1.1.1",
     "@btckit/types": "0.0.19",
-    "@dynamic-labs/sdk-api-core": "0.0.1118",
+    "@dynamic-labs/sdk-api-core": "0.12.0",
     "@wallet-standard/app": "1.0.1",
     "@wallet-standard/base": "1.0.1",
     "bitcoinjs-lib": "6.1.5",
     "ecpair": "2.1.0",
     "sats-connect": "4.2.1",
     "jsontokens": "4.0.1",
-    "@dynamic-labs/assert-package-version": "5.3.1",
-    "@dynamic-labs/logger": "5.3.1",
-    "@dynamic-labs/types": "5.3.1",
-    "@dynamic-labs/utils": "5.3.1",
-    "@dynamic-labs/waas": "5.3.1",
-    "@dynamic-labs/wallet-book": "5.3.1",
-    "@dynamic-labs/wallet-connector-core": "5.3.1",
+    "@dynamic-labs/assert-package-version": "5.4.0",
+    "@dynamic-labs/logger": "5.4.0",
+    "@dynamic-labs/types": "5.4.0",
+    "@dynamic-labs/utils": "5.4.0",
+    "@dynamic-labs/waas": "5.4.0",
+    "@dynamic-labs/wallet-book": "5.4.0",
+    "@dynamic-labs/wallet-connector-core": "5.4.0",
     "eventemitter3": "5.0.1"
   },
   "peerDependencies": {}

package/src/connectors/DynamicWaasBitcoinConnector/DynamicWaasBitcoinConnector.cjs

@@ -17,6 +17,7 @@ var BitcoinWalletConnector = require('../BitcoinWalletConnector.cjs');
 require('@wallet-standard/app');
 require('jsontokens');
 var btcToSatoshis = require('../../utils/btcToSatoshis/btcToSatoshis.cjs');
+var getBitcoinNetwork = require('../../utils/getBitcoinNetwork/getBitcoinNetwork.cjs');
 var PsbtParser = require('../../utils/psbtParser/PsbtParser.cjs');
 var BitcoinUiTransaction = require('../../utils/BitcoinUiTransaction/BitcoinUiTransaction.cjs');
 
@@ -135,6 +136,32 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
                 : 'mainnet');
         });
     }
+    /**
+     * The address type the wallet's key was derived under, read back from the
+     * address itself.
+     *
+     * `bitcoinConfig.addressType` is the only thing that selects a BTC
+     * derivation path downstream (`getMPCChainConfig` throws without it), and a
+     * wallet created by an import carries no server-side derivation metadata to
+     * fall back on — so signing an imported wallet failed while a
+     * Dynamic-created one signed fine. The address already encodes the answer:
+     * witness v0 is P2WPKH (native segwit), v1 is P2TR (taproot), which are
+     * exactly the two types `importPrivateKey` accepts.
+     *
+     * Falls back to native segwit for an address that is not bech32 (a legacy
+     * P2PKH/P2SH encoding cannot come from this connector's own import or
+     * create paths) so a decode failure can never make signing impossible.
+     */
+    getAddressTypeForSigning(walletAddress) {
+        try {
+            const { version } = bitcoinjsLib.address.fromBech32(walletAddress);
+            return (version === 1 ? 'taproot' : 'native_segwit');
+        }
+        catch (error) {
+            this.logger.warn('Could not read the address type from the wallet address; assuming native segwit', { error, walletAddress });
+            return 'native_segwit';
+        }
+    }
     supportsNetworkSwitching() {
         return true;
     }
@@ -161,26 +188,65 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
         });
     }
     /**
-     * Finds the credential that owns the active address, either as its primary
-     * (mainnet) address or as one of its network-tagged additional addresses.
+     * Finds the credential that owns `address`, either as its primary (mainnet)
+     * address or as one of its network-tagged additional addresses.
      *
      * This connector is shared across every Bitcoin wallet of the user —
      * `verifiedCredentials` holds them all — so the owning credential must be
-     * looked up by the active address. Reading `verifiedCredential` instead
-     * would always answer with the user's *first* wallet.
+     * looked up by address. Reading `verifiedCredential` instead would always
+     * answer with the user's *first* wallet.
      */
-    findCredentialForActiveAddress() {
+    findCredentialForAddress(address) {
         var _a;
-        const { activeAccountAddress } = this;
-        if (!activeAccountAddress) {
+        if (!address) {
             return undefined;
         }
         return ((_a = this.verifiedCredentials) !== null && _a !== void 0 ? _a : []).find((credential) => {
             var _a;
-            return (credential === null || credential === void 0 ? void 0 : credential.address) === activeAccountAddress ||
-                ((_a = credential === null || credential === void 0 ? void 0 : credential.walletAdditionalAddresses) !== null && _a !== void 0 ? _a : []).some((additionalAddress) => additionalAddress.address === activeAccountAddress);
+            return (credential === null || credential === void 0 ? void 0 : credential.address) === address ||
+                ((_a = credential === null || credential === void 0 ? void 0 : credential.walletAdditionalAddresses) !== null && _a !== void 0 ? _a : []).some((additionalAddress) => additionalAddress.address === address);
         });
     }
+    /** @see findCredentialForAddress */
+    findCredentialForActiveAddress() {
+        return this.findCredentialForAddress(this.activeAccountAddress);
+    }
+    /**
+     * True when `accountAddress` belongs to the same wallet as the currently
+     * active address — including when the active address is a *different*
+     * network-tagged encoding of that same wallet (e.g. the testnet address
+     * set by switchNetwork, compared against the wallet's primary mainnet
+     * address).
+     *
+     * Used by getWalletClientByAddress to avoid clobbering an explicit
+     * switchNetwork: callers like ensureActiveAccount re-assert the wallet's
+     * primary address before every send/sign, and setting activeAccountAddress
+     * back to that primary address would silently undo the network switch —
+     * UTXO/PSBT/broadcast calls would then run against the wrong (likely
+     * unfunded) encoding while getNetwork still reports the switched network.
+     *
+     * Compares the two resolved credential *objects* by reference rather than
+     * by id: both lookups run against the same verifiedCredentials array in
+     * the same synchronous call, so `.find()` returns the identical element
+     * for both addresses whenever they belong to the same wallet. Comparing
+     * `.id` instead would be wrong whenever accountAddress doesn't resolve to
+     * any known credential yet (e.g. a brand-new wallet not yet synced) —
+     * `undefined === undefined` would falsely read as "same wallet".
+     */
+    isSameWalletAddress(accountAddress) {
+        if (!this.activeAccountAddress) {
+            return false;
+        }
+        if (accountAddress === this.activeAccountAddress) {
+            return true;
+        }
+        const activeCredential = this.findCredentialForActiveAddress();
+        if (!activeCredential) {
+            return false;
+        }
+        const candidateCredential = this.findCredentialForAddress(accountAddress);
+        return (Boolean(candidateCredential) && candidateCredential === activeCredential);
+    }
     /**
      * Wallet identity: keyshares/wallet records are keyed by the wallet's
      * primary (mainnet) address. On testnet the active address is the same
@@ -302,7 +368,11 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
      * Signs a Partially Signed Bitcoin Transaction (PSBT) for embedded wallets
      *
      * Embedded wallets only support PSBT format and automatically sign all inputs
-     * that belong to the wallet address. Always uses SIGHASH_ALL (0x01).
+     * that belong to the wallet address, unless `signingIndexes` narrows that set.
+     *
+     * The sighash type is read from the PSBT itself, falling back to
+     * SIGHASH_DEFAULT (0x00) for Taproot and SIGHASH_ALL (0x01) otherwise.
+     * `allowedSighash` restricts which declared types are accepted.
      *
      * @param request - The PSBT signing request. Only unsignedPsbtBase64 is required.
      * @returns The signed (but not finalized) PSBT response
@@ -331,12 +401,14 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
                 accountAddress: walletIdentityAddress,
             });
             const signedTransaction = yield walletClient.signTransaction({
+                allowedSighash: request.allowedSighash,
                 authToken: (_d = this.getAuthToken) === null || _d === void 0 ? void 0 : _d.call(this),
                 elevatedAccessToken,
                 mfaToken,
                 password,
                 senderAddress: walletIdentityAddress,
                 signedSessionId,
+                signingIndexes: request.signingIndexes,
                 transaction: request.unsignedPsbtBase64,
             });
             return {
@@ -472,12 +544,18 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
         });
     }
     /**
-     * Gets the wallet client for a specific account address and sets it as active
+     * Gets the wallet client for a specific account address and sets it as
+     * active — unless `accountAddress` is just a different network-tagged
+     * encoding of the wallet that's already active (see isSameWalletAddress),
+     * in which case the current (possibly switchNetwork'd) active address is
+     * left untouched.
      * @param accountAddress - The Bitcoin account address
      * @returns The WaaS wallet client instance
      */
     getWalletClientByAddress({ accountAddress }) {
-        this.setActiveAccountAddress(accountAddress);
+        if (!this.isSameWalletAddress(accountAddress)) {
+            this.setActiveAccountAddress(accountAddress);
+        }
         return this.getWaasWalletClient();
     }
     /**
@@ -497,7 +575,7 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
      */
     validateActiveWallet(expectedAddress) {
         return _tslib.__awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d;
+            var _a;
             const walletClient = yield this.getWaasWalletClient();
             const targetWallet = yield walletClient.getWallet({
                 accountAddress: expectedAddress,
@@ -511,8 +589,12 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
             const isWalletActive = walletConnectorCore.isSameAddress(targetWallet.accountAddress, this.activeAccountAddress || '', this.connectedChain);
             // The active address may be a per-network encoding of this same wallet
             // (one key, network-tagged additional addresses). Resetting it here would
-            // silently un-switch the selected network.
-            const isPerNetworkVariantOfWallet = (_d = (_c = (_b = this.verifiedCredential) === null || _b === void 0 ? void 0 : _b.walletAdditionalAddresses) === null || _c === void 0 ? void 0 : _c.some((addr) => addr.address === this.activeAccountAddress)) !== null && _d !== void 0 ? _d : false;
+            // silently un-switch the selected network. Resolved via isSameWalletAddress
+            // (which looks up the credential that actually owns the active address)
+            // rather than `verifiedCredential`, which is always the user's *first*
+            // wallet — using it here would wrongly reset the address for any other
+            // wallet the user validates.
+            const isPerNetworkVariantOfWallet = this.isSameWalletAddress(targetWallet.accountAddress);
             if (!isWalletActive && !isPerNetworkVariantOfWallet) {
                 this.activeAccountAddress = targetWallet.accountAddress;
             }
@@ -547,10 +629,14 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
                 accountAddress: this.getWalletIdentityAddress(),
             });
             const messageString = typeof message === 'string' ? message : message.raw;
+            const walletIdentityAddress = this.getWalletIdentityAddress();
             return walletClient.signMessage({
-                accountAddress: this.getWalletIdentityAddress(),
+                accountAddress: walletIdentityAddress,
                 authToken: (_e = this.getAuthToken) === null || _e === void 0 ? void 0 : _e.call(this),
-                bitcoinConfig: { network: yield this.getBitcoinNetworkEnum() },
+                bitcoinConfig: {
+                    addressType: this.getAddressTypeForSigning(walletIdentityAddress),
+                    network: yield this.getBitcoinNetworkEnum(),
+                },
                 context,
                 elevatedAccessToken,
                 message: messageString,
@@ -665,7 +751,7 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
      * @returns Parsed transaction data with inputs and outputs, or null if parsing fails
      */
     parsePsbt(psbtInput) {
-        return PsbtParser.PsbtParser.parsePsbt(psbtInput);
+        return PsbtParser.PsbtParser.parsePsbt(psbtInput, this.getPsbtNetwork());
     }
     /**
      * Parse a PSBT or finalized transaction from hex format
@@ -673,7 +759,7 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
      * @returns Parsed transaction data with inputs and outputs, or null if parsing fails
      */
     parseHexPsbt(psbtHex) {
-        return PsbtParser.PsbtParser.parseHexPsbt(psbtHex);
+        return PsbtParser.PsbtParser.parseHexPsbt(psbtHex, this.getPsbtNetwork());
     }
     /**
      * Parse a PSBT or finalized transaction from base64 format
@@ -681,7 +767,17 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
      * @returns Parsed transaction data with inputs and outputs, or null if parsing fails
      */
     parseBase64Psbt(psbtBase64) {
-        return PsbtParser.PsbtParser.parseBase64Psbt(psbtBase64);
+        return PsbtParser.PsbtParser.parseBase64Psbt(psbtBase64, this.getPsbtNetwork());
+    }
+    /**
+     * bitcoinjs network for the address encoding the parsers should emit.
+     * Derived from the active address rather than activeNetworkId, which is
+     * in-memory only and can report mainnet while a testnet address is active.
+     */
+    getPsbtNetwork() {
+        return this.activeAccountAddress
+            ? getBitcoinNetwork.getBitcoinNetwork(this.activeAccountAddress)
+            : bitcoinjsLib.networks.bitcoin;
     }
     /**
      * Gets the public key for the active account
@@ -772,6 +868,7 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
                 accountAddress: this.getWalletIdentityAddress(),
                 authToken: (_d = this.getAuthToken) === null || _d === void 0 ? void 0 : _d.call(this),
                 bitcoinConfig: {
+                    addressType: this.getAddressTypeForSigning(this.getWalletIdentityAddress()),
                     network: yield this.getBitcoinNetworkEnum(),
                 },
                 elevatedAccessToken,

package/src/connectors/DynamicWaasBitcoinConnector/DynamicWaasBitcoinConnector.d.ts

@@ -92,13 +92,14 @@ declare const DynamicWaasBitcoinConnector_base: (abstract new (...args: any[]) =
     }): Promise<{
         shareSetId: string;
     }>;
-    importPrivateKey({ privateKey, thresholdSignatureScheme, publicAddressCheck, addressType, legacyWalletId, password, }: {
+    importPrivateKey({ privateKey, thresholdSignatureScheme, publicAddressCheck, addressType, legacyWalletId, password, isRawScalarImport, }: {
         privateKey: string;
         thresholdSignatureScheme?: string | undefined;
         publicAddressCheck?: string | undefined;
         addressType?: string | undefined;
         legacyWalletId?: string | undefined;
         password?: string | undefined;
+        isRawScalarImport?: boolean | undefined;
     }): Promise<void>;
     migrateFromFireblocks({ deviceId, jwt, walletPassword, ncwStorage, expectedAddresses, coinTypes, password, }: {
         deviceId: string;
@@ -189,13 +190,30 @@ declare const DynamicWaasBitcoinConnector_base: (abstract new (...args: any[]) =
     getWalletRecoveryState({ accountAddress, }: {
         accountAddress: string;
     }): Promise<import("@dynamic-labs-wallet/browser-wallet-client").WalletRecoveryState>;
+    createOfflineRecoveryShares({ accountAddress, password, cloudProviderAccessToken, mfaToken, }: {
+        accountAddress: string;
+        password?: string | undefined;
+        cloudProviderAccessToken?: string | undefined;
+        mfaToken?: string | undefined;
+    }): Promise<void>;
     endSession(reason?: import("@dynamic-labs-sdk/client").LogoutReason | undefined): Promise<void>;
     getActiveAccountAddress(): Promise<string | undefined>;
     getConnectedAccounts(): Promise<string[]>;
     generateTraceId(): string;
     buildErrorInstrumentContext(error: unknown): {
         errorCode: string | import("@dynamic-labs/utils").ErrorCode;
-        errorMessage: string;
+        errorMessage: string; /**
+         * Wallet identity: keyshares/wallet records are keyed by the wallet's
+         * primary (mainnet) address. On testnet the active address is the same
+         * wallet's per-network encoding — WaaS lookups (password, signing) must use
+         * the primary address (the same key signs both encodings).
+         *
+         * Resolved from the credential that owns the active address, so a user with
+         * several Bitcoin wallets gets the identity of the wallet being spent from.
+         * Never falls back to another wallet's address: a substituted key produces a
+         * signature that looks valid locally and is rejected by the network, so the
+         * failure has to surface here instead.
+         */
         errorType: string | undefined;
     } | {
         errorCode: string;
@@ -281,6 +299,23 @@ export declare class DynamicWaasBitcoinConnector extends DynamicWaasBitcoinConne
      * the active address automatically.
      */
     private getBitcoinNetworkEnum;
+    /**
+     * The address type the wallet's key was derived under, read back from the
+     * address itself.
+     *
+     * `bitcoinConfig.addressType` is the only thing that selects a BTC
+     * derivation path downstream (`getMPCChainConfig` throws without it), and a
+     * wallet created by an import carries no server-side derivation metadata to
+     * fall back on — so signing an imported wallet failed while a
+     * Dynamic-created one signed fine. The address already encodes the answer:
+     * witness v0 is P2WPKH (native segwit), v1 is P2TR (taproot), which are
+     * exactly the two types `importPrivateKey` accepts.
+     *
+     * Falls back to native segwit for an address that is not bech32 (a legacy
+     * P2PKH/P2SH encoding cannot come from this connector's own import or
+     * create paths) so a decode failure can never make signing impossible.
+     */
+    private getAddressTypeForSigning;
     supportsNetworkSwitching(): boolean;
     /**
      * Testnet when the testnet network (id 2) is selected — drives the widget's
@@ -295,15 +330,40 @@ export declare class DynamicWaasBitcoinConnector extends DynamicWaasBitcoinConne
      */
     getBalance(address: string): Promise<string | undefined>;
     /**
-     * Finds the credential that owns the active address, either as its primary
-     * (mainnet) address or as one of its network-tagged additional addresses.
+     * Finds the credential that owns `address`, either as its primary (mainnet)
+     * address or as one of its network-tagged additional addresses.
      *
      * This connector is shared across every Bitcoin wallet of the user —
      * `verifiedCredentials` holds them all — so the owning credential must be
-     * looked up by the active address. Reading `verifiedCredential` instead
-     * would always answer with the user's *first* wallet.
+     * looked up by address. Reading `verifiedCredential` instead would always
+     * answer with the user's *first* wallet.
      */
+    private findCredentialForAddress;
+    /** @see findCredentialForAddress */
     private findCredentialForActiveAddress;
+    /**
+     * True when `accountAddress` belongs to the same wallet as the currently
+     * active address — including when the active address is a *different*
+     * network-tagged encoding of that same wallet (e.g. the testnet address
+     * set by switchNetwork, compared against the wallet's primary mainnet
+     * address).
+     *
+     * Used by getWalletClientByAddress to avoid clobbering an explicit
+     * switchNetwork: callers like ensureActiveAccount re-assert the wallet's
+     * primary address before every send/sign, and setting activeAccountAddress
+     * back to that primary address would silently undo the network switch —
+     * UTXO/PSBT/broadcast calls would then run against the wrong (likely
+     * unfunded) encoding while getNetwork still reports the switched network.
+     *
+     * Compares the two resolved credential *objects* by reference rather than
+     * by id: both lookups run against the same verifiedCredentials array in
+     * the same synchronous call, so `.find()` returns the identical element
+     * for both addresses whenever they belong to the same wallet. Comparing
+     * `.id` instead would be wrong whenever accountAddress doesn't resolve to
+     * any known credential yet (e.g. a brand-new wallet not yet synced) —
+     * `undefined === undefined` would falsely read as "same wallet".
+     */
+    private isSameWalletAddress;
     /**
      * Wallet identity: keyshares/wallet records are keyed by the wallet's
      * primary (mainnet) address. On testnet the active address is the same
@@ -354,7 +414,11 @@ export declare class DynamicWaasBitcoinConnector extends DynamicWaasBitcoinConne
      * Signs a Partially Signed Bitcoin Transaction (PSBT) for embedded wallets
      *
      * Embedded wallets only support PSBT format and automatically sign all inputs
-     * that belong to the wallet address. Always uses SIGHASH_ALL (0x01).
+     * that belong to the wallet address, unless `signingIndexes` narrows that set.
+     *
+     * The sighash type is read from the PSBT itself, falling back to
+     * SIGHASH_DEFAULT (0x00) for Taproot and SIGHASH_ALL (0x01) otherwise.
+     * `allowedSighash` restricts which declared types are accepted.
      *
      * @param request - The PSBT signing request. Only unsignedPsbtBase64 is required.
      * @returns The signed (but not finalized) PSBT response
@@ -414,7 +478,11 @@ export declare class DynamicWaasBitcoinConnector extends DynamicWaasBitcoinConne
         legacyWalletId?: string;
     }): Promise<void>;
     /**
-     * Gets the wallet client for a specific account address and sets it as active
+     * Gets the wallet client for a specific account address and sets it as
+     * active — unless `accountAddress` is just a different network-tagged
+     * encoding of the wallet that's already active (see isSameWalletAddress),
+     * in which case the current (possibly switchNetwork'd) active address is
+     * left untouched.
      * @param accountAddress - The Bitcoin account address
      * @returns The WaaS wallet client instance
      */
@@ -480,6 +548,12 @@ export declare class DynamicWaasBitcoinConnector extends DynamicWaasBitcoinConne
      * @returns Parsed transaction data with inputs and outputs, or null if parsing fails
      */
     parseBase64Psbt(psbtBase64: string): ParsedTransaction | null;
+    /**
+     * bitcoinjs network for the address encoding the parsers should emit.
+     * Derived from the active address rather than activeNetworkId, which is
+     * in-memory only and can report mainnet while a testnet address is active.
+     */
+    private getPsbtNetwork;
     /**
      * Gets the public key for the active account
      * Falls back to the account address if public key retrieval fails

package/src/connectors/DynamicWaasBitcoinConnector/DynamicWaasBitcoinConnector.js

@@ -1,6 +1,6 @@
 'use client'
 import { __awaiter } from '../../../_virtual/_tslib.js';
-import { networks, Psbt } from 'bitcoinjs-lib';
+import { address, networks, Psbt } from 'bitcoinjs-lib';
 import { Logger } from '@dynamic-labs/logger';
 import { MFAAction, TokenScope } from '@dynamic-labs/sdk-api-core';
 import { DynamicError } from '@dynamic-labs/utils';
@@ -13,6 +13,7 @@ import { BitcoinWalletConnector } from '../BitcoinWalletConnector.js';
 import '@wallet-standard/app';
 import 'jsontokens';
 import { btcToSatoshis } from '../../utils/btcToSatoshis/btcToSatoshis.js';
+import { getBitcoinNetwork } from '../../utils/getBitcoinNetwork/getBitcoinNetwork.js';
 import { PsbtParser } from '../../utils/psbtParser/PsbtParser.js';
 import { BitcoinUiTransaction } from '../../utils/BitcoinUiTransaction/BitcoinUiTransaction.js';
 
@@ -131,6 +132,32 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
                 : 'mainnet');
         });
     }
+    /**
+     * The address type the wallet's key was derived under, read back from the
+     * address itself.
+     *
+     * `bitcoinConfig.addressType` is the only thing that selects a BTC
+     * derivation path downstream (`getMPCChainConfig` throws without it), and a
+     * wallet created by an import carries no server-side derivation metadata to
+     * fall back on — so signing an imported wallet failed while a
+     * Dynamic-created one signed fine. The address already encodes the answer:
+     * witness v0 is P2WPKH (native segwit), v1 is P2TR (taproot), which are
+     * exactly the two types `importPrivateKey` accepts.
+     *
+     * Falls back to native segwit for an address that is not bech32 (a legacy
+     * P2PKH/P2SH encoding cannot come from this connector's own import or
+     * create paths) so a decode failure can never make signing impossible.
+     */
+    getAddressTypeForSigning(walletAddress) {
+        try {
+            const { version } = address.fromBech32(walletAddress);
+            return (version === 1 ? 'taproot' : 'native_segwit');
+        }
+        catch (error) {
+            this.logger.warn('Could not read the address type from the wallet address; assuming native segwit', { error, walletAddress });
+            return 'native_segwit';
+        }
+    }
     supportsNetworkSwitching() {
         return true;
     }
@@ -157,26 +184,65 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
         });
     }
     /**
-     * Finds the credential that owns the active address, either as its primary
-     * (mainnet) address or as one of its network-tagged additional addresses.
+     * Finds the credential that owns `address`, either as its primary (mainnet)
+     * address or as one of its network-tagged additional addresses.
      *
      * This connector is shared across every Bitcoin wallet of the user —
      * `verifiedCredentials` holds them all — so the owning credential must be
-     * looked up by the active address. Reading `verifiedCredential` instead
-     * would always answer with the user's *first* wallet.
+     * looked up by address. Reading `verifiedCredential` instead would always
+     * answer with the user's *first* wallet.
      */
-    findCredentialForActiveAddress() {
+    findCredentialForAddress(address) {
         var _a;
-        const { activeAccountAddress } = this;
-        if (!activeAccountAddress) {
+        if (!address) {
             return undefined;
         }
         return ((_a = this.verifiedCredentials) !== null && _a !== void 0 ? _a : []).find((credential) => {
             var _a;
-            return (credential === null || credential === void 0 ? void 0 : credential.address) === activeAccountAddress ||
-                ((_a = credential === null || credential === void 0 ? void 0 : credential.walletAdditionalAddresses) !== null && _a !== void 0 ? _a : []).some((additionalAddress) => additionalAddress.address === activeAccountAddress);
+            return (credential === null || credential === void 0 ? void 0 : credential.address) === address ||
+                ((_a = credential === null || credential === void 0 ? void 0 : credential.walletAdditionalAddresses) !== null && _a !== void 0 ? _a : []).some((additionalAddress) => additionalAddress.address === address);
         });
     }
+    /** @see findCredentialForAddress */
+    findCredentialForActiveAddress() {
+        return this.findCredentialForAddress(this.activeAccountAddress);
+    }
+    /**
+     * True when `accountAddress` belongs to the same wallet as the currently
+     * active address — including when the active address is a *different*
+     * network-tagged encoding of that same wallet (e.g. the testnet address
+     * set by switchNetwork, compared against the wallet's primary mainnet
+     * address).
+     *
+     * Used by getWalletClientByAddress to avoid clobbering an explicit
+     * switchNetwork: callers like ensureActiveAccount re-assert the wallet's
+     * primary address before every send/sign, and setting activeAccountAddress
+     * back to that primary address would silently undo the network switch —
+     * UTXO/PSBT/broadcast calls would then run against the wrong (likely
+     * unfunded) encoding while getNetwork still reports the switched network.
+     *
+     * Compares the two resolved credential *objects* by reference rather than
+     * by id: both lookups run against the same verifiedCredentials array in
+     * the same synchronous call, so `.find()` returns the identical element
+     * for both addresses whenever they belong to the same wallet. Comparing
+     * `.id` instead would be wrong whenever accountAddress doesn't resolve to
+     * any known credential yet (e.g. a brand-new wallet not yet synced) —
+     * `undefined === undefined` would falsely read as "same wallet".
+     */
+    isSameWalletAddress(accountAddress) {
+        if (!this.activeAccountAddress) {
+            return false;
+        }
+        if (accountAddress === this.activeAccountAddress) {
+            return true;
+        }
+        const activeCredential = this.findCredentialForActiveAddress();
+        if (!activeCredential) {
+            return false;
+        }
+        const candidateCredential = this.findCredentialForAddress(accountAddress);
+        return (Boolean(candidateCredential) && candidateCredential === activeCredential);
+    }
     /**
      * Wallet identity: keyshares/wallet records are keyed by the wallet's
      * primary (mainnet) address. On testnet the active address is the same
@@ -298,7 +364,11 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
      * Signs a Partially Signed Bitcoin Transaction (PSBT) for embedded wallets
      *
      * Embedded wallets only support PSBT format and automatically sign all inputs
-     * that belong to the wallet address. Always uses SIGHASH_ALL (0x01).
+     * that belong to the wallet address, unless `signingIndexes` narrows that set.
+     *
+     * The sighash type is read from the PSBT itself, falling back to
+     * SIGHASH_DEFAULT (0x00) for Taproot and SIGHASH_ALL (0x01) otherwise.
+     * `allowedSighash` restricts which declared types are accepted.
      *
      * @param request - The PSBT signing request. Only unsignedPsbtBase64 is required.
      * @returns The signed (but not finalized) PSBT response
@@ -327,12 +397,14 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
                 accountAddress: walletIdentityAddress,
             });
             const signedTransaction = yield walletClient.signTransaction({
+                allowedSighash: request.allowedSighash,
                 authToken: (_d = this.getAuthToken) === null || _d === void 0 ? void 0 : _d.call(this),
                 elevatedAccessToken,
                 mfaToken,
                 password,
                 senderAddress: walletIdentityAddress,
                 signedSessionId,
+                signingIndexes: request.signingIndexes,
                 transaction: request.unsignedPsbtBase64,
             });
             return {
@@ -468,12 +540,18 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
         });
     }
     /**
-     * Gets the wallet client for a specific account address and sets it as active
+     * Gets the wallet client for a specific account address and sets it as
+     * active — unless `accountAddress` is just a different network-tagged
+     * encoding of the wallet that's already active (see isSameWalletAddress),
+     * in which case the current (possibly switchNetwork'd) active address is
+     * left untouched.
      * @param accountAddress - The Bitcoin account address
      * @returns The WaaS wallet client instance
      */
     getWalletClientByAddress({ accountAddress }) {
-        this.setActiveAccountAddress(accountAddress);
+        if (!this.isSameWalletAddress(accountAddress)) {
+            this.setActiveAccountAddress(accountAddress);
+        }
         return this.getWaasWalletClient();
     }
     /**
@@ -493,7 +571,7 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
      */
     validateActiveWallet(expectedAddress) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d;
+            var _a;
             const walletClient = yield this.getWaasWalletClient();
             const targetWallet = yield walletClient.getWallet({
                 accountAddress: expectedAddress,
@@ -507,8 +585,12 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
             const isWalletActive = isSameAddress(targetWallet.accountAddress, this.activeAccountAddress || '', this.connectedChain);
             // The active address may be a per-network encoding of this same wallet
             // (one key, network-tagged additional addresses). Resetting it here would
-            // silently un-switch the selected network.
-            const isPerNetworkVariantOfWallet = (_d = (_c = (_b = this.verifiedCredential) === null || _b === void 0 ? void 0 : _b.walletAdditionalAddresses) === null || _c === void 0 ? void 0 : _c.some((addr) => addr.address === this.activeAccountAddress)) !== null && _d !== void 0 ? _d : false;
+            // silently un-switch the selected network. Resolved via isSameWalletAddress
+            // (which looks up the credential that actually owns the active address)
+            // rather than `verifiedCredential`, which is always the user's *first*
+            // wallet — using it here would wrongly reset the address for any other
+            // wallet the user validates.
+            const isPerNetworkVariantOfWallet = this.isSameWalletAddress(targetWallet.accountAddress);
             if (!isWalletActive && !isPerNetworkVariantOfWallet) {
                 this.activeAccountAddress = targetWallet.accountAddress;
             }
@@ -543,10 +625,14 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
                 accountAddress: this.getWalletIdentityAddress(),
             });
             const messageString = typeof message === 'string' ? message : message.raw;
+            const walletIdentityAddress = this.getWalletIdentityAddress();
             return walletClient.signMessage({
-                accountAddress: this.getWalletIdentityAddress(),
+                accountAddress: walletIdentityAddress,
                 authToken: (_e = this.getAuthToken) === null || _e === void 0 ? void 0 : _e.call(this),
-                bitcoinConfig: { network: yield this.getBitcoinNetworkEnum() },
+                bitcoinConfig: {
+                    addressType: this.getAddressTypeForSigning(walletIdentityAddress),
+                    network: yield this.getBitcoinNetworkEnum(),
+                },
                 context,
                 elevatedAccessToken,
                 message: messageString,
@@ -661,7 +747,7 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
      * @returns Parsed transaction data with inputs and outputs, or null if parsing fails
      */
     parsePsbt(psbtInput) {
-        return PsbtParser.parsePsbt(psbtInput);
+        return PsbtParser.parsePsbt(psbtInput, this.getPsbtNetwork());
     }
     /**
      * Parse a PSBT or finalized transaction from hex format
@@ -669,7 +755,7 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
      * @returns Parsed transaction data with inputs and outputs, or null if parsing fails
      */
     parseHexPsbt(psbtHex) {
-        return PsbtParser.parseHexPsbt(psbtHex);
+        return PsbtParser.parseHexPsbt(psbtHex, this.getPsbtNetwork());
     }
     /**
      * Parse a PSBT or finalized transaction from base64 format
@@ -677,7 +763,17 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
      * @returns Parsed transaction data with inputs and outputs, or null if parsing fails
      */
     parseBase64Psbt(psbtBase64) {
-        return PsbtParser.parseBase64Psbt(psbtBase64);
+        return PsbtParser.parseBase64Psbt(psbtBase64, this.getPsbtNetwork());
+    }
+    /**
+     * bitcoinjs network for the address encoding the parsers should emit.
+     * Derived from the active address rather than activeNetworkId, which is
+     * in-memory only and can report mainnet while a testnet address is active.
+     */
+    getPsbtNetwork() {
+        return this.activeAccountAddress
+            ? getBitcoinNetwork(this.activeAccountAddress)
+            : networks.bitcoin;
     }
     /**
      * Gets the public key for the active account
@@ -768,6 +864,7 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
                 accountAddress: this.getWalletIdentityAddress(),
                 authToken: (_d = this.getAuthToken) === null || _d === void 0 ? void 0 : _d.call(this),
                 bitcoinConfig: {
+                    addressType: this.getAddressTypeForSigning(this.getWalletIdentityAddress()),
                     network: yield this.getBitcoinNetworkEnum(),
                 },
                 elevatedAccessToken,

package/src/index.d.ts

@@ -1,9 +1,9 @@
-import { OkxConnector } from './connectors';
+import { OkxConnector, DynamicWaasBitcoinConnector } from './connectors';
 export { BitcoinWalletConnector, type BitcoinWalletConnectorOpts, } from './connectors';
 export type { BitcoinTransaction, BitcoinSignProtocol, BitcoinSignPsbtRequest, BitcoinSignPsbtResponse, BitcoinWalletStandardMethods, SignPsbtOptions, EmbeddedWalletSignPsbtRequest, } from './types';
 export * from './utils';
 export * from './wallet';
 export { UnisatConnector, BitcoinSatsConnectConnector, DynamicWaasBitcoinConnector, } from './connectors';
-export declare const BitcoinWalletConnectors: (props: any) => (import("dist/packages/wallet-connector-core/src").WalletConnectorConstructor | typeof OkxConnector)[];
+export declare const BitcoinWalletConnectors: (props: any) => (import("dist/packages/wallet-connector-core/src").WalletConnectorConstructor | typeof OkxConnector | typeof DynamicWaasBitcoinConnector)[];
 export { BitcoinProviderHelper } from './bitcoinProviderHelper';
 export { DUST_LIMIT, HTTP_STATUS_NOT_FOUND, HTTP_STATUS_TOO_MANY_REQUESTS, } from './const';

package/src/types.d.ts

@@ -67,6 +67,19 @@ export type EmbeddedWalletSignPsbtRequest = {
      * Embedded wallets only support PSBT format, not raw transaction hex.
      */
     unsignedPsbtBase64: string;
+    /**
+     * Optional subset of PSBT input indexes to sign. When provided, only these
+     * indexes are signed (they must still belong to the wallet's own address).
+     * When omitted, behavior is unchanged: all wallet-owned inputs are signed.
+     */
+    signingIndexes?: number[];
+    /**
+     * Optional allow-list of sighash types. The sighash type itself is read from
+     * the PSBT (BIP-174 `PSBT_IN_SIGHASH_TYPE`) — this only restricts which
+     * declared types are accepted, and signing throws if an input declares one
+     * outside the list. When omitted, any declared type is signed.
+     */
+    allowedSighash?: number[];
 };
 export type SatsConnectSignTransactionInput = {
     message?: string;

package/src/utils/psbtParser/PsbtParser.cjs

@@ -13,16 +13,19 @@ class PsbtParser {
      * Parse a PSBT or finalized transaction and extract transaction information
      * Auto-detects format (hex/base64) and type (PSBT/finalized transaction)
      * @param psbtInput - The PSBT or finalized transaction in Base64 or hex format
+     * @param network - Network used to encode the extracted addresses. Scripts are
+     * network-agnostic, so passing the wrong one silently renders a valid address
+     * under the wrong prefix (a testnet output shown as `bc1…`).
      * @returns Parsed transaction data with inputs and outputs
      * @throws Error if parsing fails
      */
-    static parsePsbt(psbtInput) {
+    static parsePsbt(psbtInput, network = bitcoinjsLib.networks.bitcoin) {
         const isHex = /^[0-9a-fA-F]+$/.test(psbtInput) && psbtInput.length > 100;
         if (isHex) {
-            return PsbtParser.parseHexPsbt(psbtInput);
+            return PsbtParser.parseHexPsbt(psbtInput, network);
         }
         else {
-            return PsbtParser.parseBase64Psbt(psbtInput);
+            return PsbtParser.parseBase64Psbt(psbtInput, network);
         }
     }
     /**
@@ -31,14 +34,14 @@ class PsbtParser {
      * @returns Parsed transaction data with inputs and outputs
      * @throws Error if parsing fails
      */
-    static parseHexPsbt(psbtHex) {
+    static parseHexPsbt(psbtHex, network = bitcoinjsLib.networks.bitcoin) {
         try {
             try {
-                const psbt = bitcoinjsLib.Psbt.fromHex(psbtHex, { network: bitcoinjsLib.networks.bitcoin });
-                return PsbtParser.extractPsbtData(psbt);
+                const psbt = bitcoinjsLib.Psbt.fromHex(psbtHex, { network });
+                return PsbtParser.extractPsbtData(psbt, network);
             }
             catch (psbtError) {
-                return PsbtParser.parseFinalizedTransactionHex(psbtHex);
+                return PsbtParser.parseFinalizedTransactionHex(psbtHex, network);
             }
         }
         catch (error) {
@@ -51,14 +54,14 @@ class PsbtParser {
      * @returns Parsed transaction data with inputs and outputs
      * @throws Error if parsing fails
      */
-    static parseBase64Psbt(psbtBase64) {
+    static parseBase64Psbt(psbtBase64, network = bitcoinjsLib.networks.bitcoin) {
         try {
             try {
-                const psbt = bitcoinjsLib.Psbt.fromBase64(psbtBase64, { network: bitcoinjsLib.networks.bitcoin });
-                return PsbtParser.extractPsbtData(psbt);
+                const psbt = bitcoinjsLib.Psbt.fromBase64(psbtBase64, { network });
+                return PsbtParser.extractPsbtData(psbt, network);
             }
             catch (psbtError) {
-                return PsbtParser.parseFinalizedTransactionBase64(psbtBase64);
+                return PsbtParser.parseFinalizedTransactionBase64(psbtBase64, network);
             }
         }
         catch (error) {
@@ -71,7 +74,7 @@ class PsbtParser {
      * @param psbt - The parsed PSBT object
      * @returns Parsed transaction data with inputs and outputs
      */
-    static extractPsbtData(psbt) {
+    static extractPsbtData(psbt, network) {
         const inputs = [];
         const outputs = [];
         psbt.txInputs.forEach((txInput, index) => {
@@ -83,7 +86,7 @@ class PsbtParser {
             if (input.witnessUtxo) {
                 inputData.value = input.witnessUtxo.value;
                 try {
-                    inputData.address = bitcoinjsLib.address.fromOutputScript(input.witnessUtxo.script, bitcoinjsLib.networks.bitcoin);
+                    inputData.address = bitcoinjsLib.address.fromOutputScript(input.witnessUtxo.script, network);
                 }
                 catch (e) {
                     // Address extraction failed
@@ -95,7 +98,7 @@ class PsbtParser {
                     const prevOut = prevTx.outs[txInput.index];
                     inputData.value = prevOut.value;
                     try {
-                        inputData.address = bitcoinjsLib.address.fromOutputScript(prevOut.script, bitcoinjsLib.networks.bitcoin);
+                        inputData.address = bitcoinjsLib.address.fromOutputScript(prevOut.script, network);
                     }
                     catch (e) {
                         // Address extraction failed
@@ -107,7 +110,7 @@ class PsbtParser {
             }
             inputs.push(inputData);
         });
-        PsbtParser.extractOutputs(psbt.txOutputs, outputs);
+        PsbtParser.extractOutputs(psbt.txOutputs, outputs, network);
         return { inputs, outputs };
     }
     /**
@@ -116,13 +119,13 @@ class PsbtParser {
      * @param txOutputs - Array of transaction outputs (from PSBT or Transaction)
      * @param outputs - Array to populate with parsed output data
      */
-    static extractOutputs(txOutputs, outputs) {
+    static extractOutputs(txOutputs, outputs, network) {
         txOutputs.forEach((txOutput) => {
             const outputData = {
                 value: txOutput.value,
             };
             try {
-                outputData.address = bitcoinjsLib.address.fromOutputScript(txOutput.script, bitcoinjsLib.networks.bitcoin);
+                outputData.address = bitcoinjsLib.address.fromOutputScript(txOutput.script, network);
             }
             catch (e) {
                 // Address extraction failed - continue without address
@@ -136,10 +139,10 @@ class PsbtParser {
      * @returns Parsed transaction data with inputs and outputs
      * @throws Error if parsing fails
      */
-    static parseFinalizedTransactionHex(txHex) {
+    static parseFinalizedTransactionHex(txHex, network) {
         try {
             const tx = bitcoinjsLib.Transaction.fromHex(txHex);
-            return PsbtParser.extractTransactionData(tx);
+            return PsbtParser.extractTransactionData(tx, network);
         }
         catch (error) {
             throw new Error(`Failed to parse finalized transaction hex: ${error instanceof Error ? error.message : String(error)}`);
@@ -151,11 +154,11 @@ class PsbtParser {
      * @returns Parsed transaction data with inputs and outputs
      * @throws Error if parsing fails
      */
-    static parseFinalizedTransactionBase64(txBase64) {
+    static parseFinalizedTransactionBase64(txBase64, network) {
         try {
             const buffer = Buffer.from(txBase64, 'base64');
             const tx = bitcoinjsLib.Transaction.fromBuffer(buffer);
-            return PsbtParser.extractTransactionData(tx);
+            return PsbtParser.extractTransactionData(tx, network);
         }
         catch (error) {
             throw new Error(`Failed to parse finalized transaction base64: ${error instanceof Error ? error.message : String(error)}`);
@@ -167,7 +170,7 @@ class PsbtParser {
      * @param tx - The parsed Transaction object
      * @returns Parsed transaction data with inputs and outputs
      */
-    static extractTransactionData(tx) {
+    static extractTransactionData(tx, network) {
         const inputs = [];
         const outputs = [];
         tx.ins.forEach((input) => {
@@ -177,7 +180,7 @@ class PsbtParser {
             };
             inputs.push(inputData);
         });
-        PsbtParser.extractOutputs(tx.outs, outputs);
+        PsbtParser.extractOutputs(tx.outs, outputs, network);
         return { inputs, outputs };
     }
 }

package/src/utils/psbtParser/PsbtParser.d.ts

@@ -1,3 +1,4 @@
+import { type Network } from 'bitcoinjs-lib';
 import type { ParsedTransaction } from '../../types';
 /**
  * Utility class for parsing PSBTs and finalized Bitcoin transactions
@@ -7,24 +8,27 @@ export declare class PsbtParser {
      * Parse a PSBT or finalized transaction and extract transaction information
      * Auto-detects format (hex/base64) and type (PSBT/finalized transaction)
      * @param psbtInput - The PSBT or finalized transaction in Base64 or hex format
+     * @param network - Network used to encode the extracted addresses. Scripts are
+     * network-agnostic, so passing the wrong one silently renders a valid address
+     * under the wrong prefix (a testnet output shown as `bc1…`).
      * @returns Parsed transaction data with inputs and outputs
      * @throws Error if parsing fails
      */
-    static parsePsbt(psbtInput: string): ParsedTransaction;
+    static parsePsbt(psbtInput: string, network?: Network): ParsedTransaction;
     /**
      * Parse a PSBT or finalized transaction from hex format
      * @param psbtHex - The PSBT or finalized transaction in hex format
      * @returns Parsed transaction data with inputs and outputs
      * @throws Error if parsing fails
      */
-    static parseHexPsbt(psbtHex: string): ParsedTransaction;
+    static parseHexPsbt(psbtHex: string, network?: Network): ParsedTransaction;
     /**
      * Parse a PSBT or finalized transaction from base64 format
      * @param psbtBase64 - The PSBT or finalized transaction in base64 format
      * @returns Parsed transaction data with inputs and outputs
      * @throws Error if parsing fails
      */
-    static parseBase64Psbt(psbtBase64: string): ParsedTransaction;
+    static parseBase64Psbt(psbtBase64: string, network?: Network): ParsedTransaction;
     /**
      * Extract transaction data from a PSBT
      * Shared logic used by both parseHexPsbt and parseBase64Psbt

package/src/utils/psbtParser/PsbtParser.js

@@ -1,5 +1,5 @@
 'use client'
-import { Psbt, networks, address, Transaction } from 'bitcoinjs-lib';
+import { networks, Psbt, address, Transaction } from 'bitcoinjs-lib';
 
 /**
  * Utility class for parsing PSBTs and finalized Bitcoin transactions
@@ -9,16 +9,19 @@ class PsbtParser {
      * Parse a PSBT or finalized transaction and extract transaction information
      * Auto-detects format (hex/base64) and type (PSBT/finalized transaction)
      * @param psbtInput - The PSBT or finalized transaction in Base64 or hex format
+     * @param network - Network used to encode the extracted addresses. Scripts are
+     * network-agnostic, so passing the wrong one silently renders a valid address
+     * under the wrong prefix (a testnet output shown as `bc1…`).
      * @returns Parsed transaction data with inputs and outputs
      * @throws Error if parsing fails
      */
-    static parsePsbt(psbtInput) {
+    static parsePsbt(psbtInput, network = networks.bitcoin) {
         const isHex = /^[0-9a-fA-F]+$/.test(psbtInput) && psbtInput.length > 100;
         if (isHex) {
-            return PsbtParser.parseHexPsbt(psbtInput);
+            return PsbtParser.parseHexPsbt(psbtInput, network);
         }
         else {
-            return PsbtParser.parseBase64Psbt(psbtInput);
+            return PsbtParser.parseBase64Psbt(psbtInput, network);
         }
     }
     /**
@@ -27,14 +30,14 @@ class PsbtParser {
      * @returns Parsed transaction data with inputs and outputs
      * @throws Error if parsing fails
      */
-    static parseHexPsbt(psbtHex) {
+    static parseHexPsbt(psbtHex, network = networks.bitcoin) {
         try {
             try {
-                const psbt = Psbt.fromHex(psbtHex, { network: networks.bitcoin });
-                return PsbtParser.extractPsbtData(psbt);
+                const psbt = Psbt.fromHex(psbtHex, { network });
+                return PsbtParser.extractPsbtData(psbt, network);
             }
             catch (psbtError) {
-                return PsbtParser.parseFinalizedTransactionHex(psbtHex);
+                return PsbtParser.parseFinalizedTransactionHex(psbtHex, network);
             }
         }
         catch (error) {
@@ -47,14 +50,14 @@ class PsbtParser {
      * @returns Parsed transaction data with inputs and outputs
      * @throws Error if parsing fails
      */
-    static parseBase64Psbt(psbtBase64) {
+    static parseBase64Psbt(psbtBase64, network = networks.bitcoin) {
         try {
             try {
-                const psbt = Psbt.fromBase64(psbtBase64, { network: networks.bitcoin });
-                return PsbtParser.extractPsbtData(psbt);
+                const psbt = Psbt.fromBase64(psbtBase64, { network });
+                return PsbtParser.extractPsbtData(psbt, network);
             }
             catch (psbtError) {
-                return PsbtParser.parseFinalizedTransactionBase64(psbtBase64);
+                return PsbtParser.parseFinalizedTransactionBase64(psbtBase64, network);
             }
         }
         catch (error) {
@@ -67,7 +70,7 @@ class PsbtParser {
      * @param psbt - The parsed PSBT object
      * @returns Parsed transaction data with inputs and outputs
      */
-    static extractPsbtData(psbt) {
+    static extractPsbtData(psbt, network) {
         const inputs = [];
         const outputs = [];
         psbt.txInputs.forEach((txInput, index) => {
@@ -79,7 +82,7 @@ class PsbtParser {
             if (input.witnessUtxo) {
                 inputData.value = input.witnessUtxo.value;
                 try {
-                    inputData.address = address.fromOutputScript(input.witnessUtxo.script, networks.bitcoin);
+                    inputData.address = address.fromOutputScript(input.witnessUtxo.script, network);
                 }
                 catch (e) {
                     // Address extraction failed
@@ -91,7 +94,7 @@ class PsbtParser {
                     const prevOut = prevTx.outs[txInput.index];
                     inputData.value = prevOut.value;
                     try {
-                        inputData.address = address.fromOutputScript(prevOut.script, networks.bitcoin);
+                        inputData.address = address.fromOutputScript(prevOut.script, network);
                     }
                     catch (e) {
                         // Address extraction failed
@@ -103,7 +106,7 @@ class PsbtParser {
             }
             inputs.push(inputData);
         });
-        PsbtParser.extractOutputs(psbt.txOutputs, outputs);
+        PsbtParser.extractOutputs(psbt.txOutputs, outputs, network);
         return { inputs, outputs };
     }
     /**
@@ -112,13 +115,13 @@ class PsbtParser {
      * @param txOutputs - Array of transaction outputs (from PSBT or Transaction)
      * @param outputs - Array to populate with parsed output data
      */
-    static extractOutputs(txOutputs, outputs) {
+    static extractOutputs(txOutputs, outputs, network) {
         txOutputs.forEach((txOutput) => {
             const outputData = {
                 value: txOutput.value,
             };
             try {
-                outputData.address = address.fromOutputScript(txOutput.script, networks.bitcoin);
+                outputData.address = address.fromOutputScript(txOutput.script, network);
             }
             catch (e) {
                 // Address extraction failed - continue without address
@@ -132,10 +135,10 @@ class PsbtParser {
      * @returns Parsed transaction data with inputs and outputs
      * @throws Error if parsing fails
      */
-    static parseFinalizedTransactionHex(txHex) {
+    static parseFinalizedTransactionHex(txHex, network) {
         try {
             const tx = Transaction.fromHex(txHex);
-            return PsbtParser.extractTransactionData(tx);
+            return PsbtParser.extractTransactionData(tx, network);
         }
         catch (error) {
             throw new Error(`Failed to parse finalized transaction hex: ${error instanceof Error ? error.message : String(error)}`);
@@ -147,11 +150,11 @@ class PsbtParser {
      * @returns Parsed transaction data with inputs and outputs
      * @throws Error if parsing fails
      */
-    static parseFinalizedTransactionBase64(txBase64) {
+    static parseFinalizedTransactionBase64(txBase64, network) {
         try {
             const buffer = Buffer.from(txBase64, 'base64');
             const tx = Transaction.fromBuffer(buffer);
-            return PsbtParser.extractTransactionData(tx);
+            return PsbtParser.extractTransactionData(tx, network);
         }
         catch (error) {
             throw new Error(`Failed to parse finalized transaction base64: ${error instanceof Error ? error.message : String(error)}`);
@@ -163,7 +166,7 @@ class PsbtParser {
      * @param tx - The parsed Transaction object
      * @returns Parsed transaction data with inputs and outputs
      */
-    static extractTransactionData(tx) {
+    static extractTransactionData(tx, network) {
         const inputs = [];
         const outputs = [];
         tx.ins.forEach((input) => {
@@ -173,7 +176,7 @@ class PsbtParser {
             };
             inputs.push(inputData);
         });
-        PsbtParser.extractOutputs(tx.outs, outputs);
+        PsbtParser.extractOutputs(tx.outs, outputs, network);
         return { inputs, outputs };
     }
 }