@dynamic-labs/bitcoin 5.3.2 → 5.4.1

package/CHANGELOG.md

@@ -1,4 +1,38 @@
 
+### [5.4.1](https://github.com/dynamic-labs/dynamic-auth/compare/v5.4.0...v5.4.1) (2026-08-26)
+
+
+### Bug Fixes
+
+* **webview-controller:** resolve which keychain key a session belongs to ([#12246](https://github.com/dynamic-labs/dynamic-auth/issues/12246)) ([3d110db](https://github.com/dynamic-labs/dynamic-auth/commit/3d110db831c6e9d82d07d86841f5c7733924b17e))
+* **bitcoin:** forward the password through the BTC importPrivateKey override ([#12278](https://github.com/dynamic-labs/dynamic-auth/issues/12278)) ([21e1df3](https://github.com/dynamic-labs/dynamic-auth/commit/21e1df3e33e96e2efdb15ffa0fd29a441056202e))
+* **react-native-extension:** recover 4.x expo-secure-store sessions on keychain miss ([#12254](https://github.com/dynamic-labs/dynamic-auth/issues/12254)) ([217e991](https://github.com/dynamic-labs/dynamic-auth/commit/217e991838f3073c12e2d2fab7a2e12830faad9e)), closes [#12092](https://github.com/dynamic-labs/dynamic-auth/issues/12092) [#12092](https://github.com/dynamic-labs/dynamic-auth/issues/12092) [#12092](https://github.com/dynamic-labs/dynamic-auth/issues/12092) [#12092](https://github.com/dynamic-labs/dynamic-auth/issues/12092) [#12242](https://github.com/dynamic-labs/dynamic-auth/issues/12242) [#12242](https://github.com/dynamic-labs/dynamic-auth/issues/12242)
+* **transaction-card:** use walletConnector prop for network/fee instead of primaryWallet ([#12063](https://github.com/dynamic-labs/dynamic-auth/issues/12063)) ([81314d2](https://github.com/dynamic-labs/dynamic-auth/commit/81314d25fba4b20ab89631bc2d9ceeb9e2b6b2ac))
+* **waas-svm:** instrument sponsorship retry attempts ([#12281](https://github.com/dynamic-labs/dynamic-auth/issues/12281)) ([7273a4b](https://github.com/dynamic-labs/dynamic-auth/commit/7273a4bc456cad512c0e9fbcd2abd66532a2f7df))
+* **webview-controller:** recover 4.x secure-storage sessions and surface init failures ([#12242](https://github.com/dynamic-labs/dynamic-auth/issues/12242)) ([b51605c](https://github.com/dynamic-labs/dynamic-auth/commit/b51605cc9bdbb5d695173192c502a58d899bbbdd)), closes [#12094](https://github.com/dynamic-labs/dynamic-auth/issues/12094) [#12095](https://github.com/dynamic-labs/dynamic-auth/issues/12095) [#12098](https://github.com/dynamic-labs/dynamic-auth/issues/12098) [dynamic-labs/flutter-sdk#256](https://github.com/dynamic-labs/flutter-sdk/issues/256)
+
+## [5.4.0](https://github.com/dynamic-labs/dynamic-auth/compare/v5.3.2...v5.4.0) (2026-08-25)
+
+
+### Features
+
+* **aleo:** wire up signMessage on the WaaS Aleo connector ([#12235](https://github.com/dynamic-labs/dynamic-auth/issues/12235)) ([e56cbf5](https://github.com/dynamic-labs/dynamic-auth/commit/e56cbf5546bdcc21ce916dece43ae36dcea9b808))
+* **waas:** thread isRawScalarImport through importPrivateKey for ed25519 chains ([#12220](https://github.com/dynamic-labs/dynamic-auth/issues/12220)) ([ced9efa](https://github.com/dynamic-labs/dynamic-auth/commit/ced9efac5fa5a4a1280383419f56fe22733722cd))
+* **webview:** add policies message contract and controller ([#12248](https://github.com/dynamic-labs/dynamic-auth/issues/12248)) ([8557c1e](https://github.com/dynamic-labs/dynamic-auth/commit/8557c1ed3861e12f1f06b2bb610184813b577daa))
+
+
+### Bug Fixes
+
+* **bitcoin:** pass the wallet's address type when signing ([#12265](https://github.com/dynamic-labs/dynamic-auth/issues/12265)) ([b8a8eab](https://github.com/dynamic-labs/dynamic-auth/commit/b8a8eab7e4cc294cc307fb10ea6814e76111a274))
+* remediate high-severity tar vulnerability and prune a dead override ([#12268](https://github.com/dynamic-labs/dynamic-auth/issues/12268)) ([6b1b343](https://github.com/dynamic-labs/dynamic-auth/commit/6b1b343e7947e8da30012446677e342ae9bfe14a))
+* **waas-svm:** fix retry-classification and environmentId gaps in [#12240](https://github.com/dynamic-labs/dynamic-auth/issues/12240) ([#12247](https://github.com/dynamic-labs/dynamic-auth/issues/12247)) ([e79cecc](https://github.com/dynamic-labs/dynamic-auth/commit/e79ceccd424c48c3a7f45fdd6ea288c269ac0171))
+* **wallet-connect:** reopen WalletConnect IndexedDB when the browser closes the connection ([#12262](https://github.com/dynamic-labs/dynamic-auth/issues/12262)) ([1a20dde](https://github.com/dynamic-labs/dynamic-auth/commit/1a20ddeaeec590ae3390c9e47ef3c14738379b83))
+
+
+### Performance Improvements
+
+* **ethereum-gasless-core:** parallel 7702 auth signing and long-poll sponsored-tx status ([#12225](https://github.com/dynamic-labs/dynamic-auth/issues/12225)) ([53ca916](https://github.com/dynamic-labs/dynamic-auth/commit/53ca91668f8dd839c52d55a0e5d7bb5257f7f415))
+
 ### [5.3.2](https://github.com/dynamic-labs/dynamic-auth/compare/v5.3.1...v5.3.2) (2026-08-19)
 
 

package/package.cjs

@@ -3,6 +3,6 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "5.3.2";
+var version = "5.4.1";
 
 exports.version = version;

package/package.js

@@ -1,4 +1,4 @@
 'use client'
-var version = "5.3.2";
+var version = "5.4.1";
 
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/bitcoin",
-  "version": "5.3.2",
+  "version": "5.4.1",
   "description": "A React SDK for implementing wallet web3 authentication and authorization to your website.",
   "author": "Dynamic Labs, Inc.",
   "license": "MIT",
@@ -29,13 +29,13 @@
     "ecpair": "2.1.0",
     "sats-connect": "4.2.1",
     "jsontokens": "4.0.1",
-    "@dynamic-labs/assert-package-version": "5.3.2",
-    "@dynamic-labs/logger": "5.3.2",
-    "@dynamic-labs/types": "5.3.2",
-    "@dynamic-labs/utils": "5.3.2",
-    "@dynamic-labs/waas": "5.3.2",
-    "@dynamic-labs/wallet-book": "5.3.2",
-    "@dynamic-labs/wallet-connector-core": "5.3.2",
+    "@dynamic-labs/assert-package-version": "5.4.1",
+    "@dynamic-labs/logger": "5.4.1",
+    "@dynamic-labs/types": "5.4.1",
+    "@dynamic-labs/utils": "5.4.1",
+    "@dynamic-labs/waas": "5.4.1",
+    "@dynamic-labs/wallet-book": "5.4.1",
+    "@dynamic-labs/wallet-connector-core": "5.4.1",
     "eventemitter3": "5.0.1"
   },
   "peerDependencies": {}

package/src/connectors/DynamicWaasBitcoinConnector/DynamicWaasBitcoinConnector.cjs

@@ -136,6 +136,32 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
                 : 'mainnet');
         });
     }
+    /**
+     * The address type the wallet's key was derived under, read back from the
+     * address itself.
+     *
+     * `bitcoinConfig.addressType` is the only thing that selects a BTC
+     * derivation path downstream (`getMPCChainConfig` throws without it), and a
+     * wallet created by an import carries no server-side derivation metadata to
+     * fall back on — so signing an imported wallet failed while a
+     * Dynamic-created one signed fine. The address already encodes the answer:
+     * witness v0 is P2WPKH (native segwit), v1 is P2TR (taproot), which are
+     * exactly the two types `importPrivateKey` accepts.
+     *
+     * Falls back to native segwit for an address that is not bech32 (a legacy
+     * P2PKH/P2SH encoding cannot come from this connector's own import or
+     * create paths) so a decode failure can never make signing impossible.
+     */
+    getAddressTypeForSigning(walletAddress) {
+        try {
+            const { version } = bitcoinjsLib.address.fromBech32(walletAddress);
+            return (version === 1 ? 'taproot' : 'native_segwit');
+        }
+        catch (error) {
+            this.logger.warn('Could not read the address type from the wallet address; assuming native segwit', { error, walletAddress });
+            return 'native_segwit';
+        }
+    }
     supportsNetworkSwitching() {
         return true;
     }
@@ -474,33 +500,29 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
         const _super = Object.create(null, {
             createWalletAccount: { get: () => super.createWalletAccount }
         });
-        return _tslib.__awaiter(this, arguments, void 0, function* ({ thresholdSignatureScheme = 'TWO_OF_TWO', password, bitcoinConfig, } = {}) {
-            var _a;
+        return _tslib.__awaiter(this, arguments, void 0, function* (params = {}) {
+            var _a, _b;
             const finalBitcoinConfig = {
-                addressType: ((_a = bitcoinConfig === null || bitcoinConfig === void 0 ? void 0 : bitcoinConfig.addressType) !== null && _a !== void 0 ? _a : 'native_segwit'),
+                addressType: ((_b = (_a = params.bitcoinConfig) === null || _a === void 0 ? void 0 : _a.addressType) !== null && _b !== void 0 ? _b : 'native_segwit'),
                 network: yield this.getBitcoinNetworkEnum(),
             };
-            return _super.createWalletAccount.call(this, {
-                bitcoinConfig: finalBitcoinConfig,
-                password,
-                thresholdSignatureScheme,
-            });
+            // Spread, so a field added to CreateWalletAccountParams later still
+            // reaches the base instead of being silently dropped here.
+            return _super.createWalletAccount.call(this, Object.assign(Object.assign({}, params), { bitcoinConfig: finalBitcoinConfig }));
         });
     }
     /**
-     * Override importPrivateKey to require and validate addressType for Bitcoin
-     * @param privateKey - The private key to import (WIF format for Bitcoin)
-     * @param thresholdSignatureScheme - The threshold signature scheme (default: 'TWO_OF_TWO')
-     * @param publicAddressCheck - Optional public address to verify against
-     * @param addressType - Required address type for Bitcoin ('native_segwit' or 'taproot')
-     * @param legacyWalletId - Optional ID of the legacy wallet being upgraded
+     * Requires and validates `addressType` for Bitcoin, then delegates.
+     * @param params - See ImportPrivateKeyParams. `addressType` is mandatory
+     * here ('native_segwit' or 'taproot') and `privateKey` is WIF.
      * @throws {DynamicError} If addressType is missing or invalid for BTC
      */
-    importPrivateKey(_a) {
+    importPrivateKey(params) {
         const _super = Object.create(null, {
             importPrivateKey: { get: () => super.importPrivateKey }
         });
-        return _tslib.__awaiter(this, arguments, void 0, function* ({ privateKey, thresholdSignatureScheme = 'TWO_OF_TWO', publicAddressCheck, addressType, legacyWalletId, }) {
+        return _tslib.__awaiter(this, void 0, void 0, function* () {
+            const { addressType } = params;
             if (!addressType) {
                 throw new utils.DynamicError('addressType is required for BTC importPrivateKey', 'addresstype_is_required_for_btc_importprivatekey');
             }
@@ -508,13 +530,10 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
             if (!validAddressTypes.includes(addressType)) {
                 throw new utils.DynamicError(`Invalid addressType: ${addressType}. Must be one of: ${validAddressTypes.join(', ')}`, 'invalid_addresstype_must_be_one_of');
             }
-            return _super.importPrivateKey.call(this, {
-                addressType,
-                legacyWalletId,
-                privateKey,
-                publicAddressCheck,
-                thresholdSignatureScheme,
-            });
+            // Forwarded whole, never field-by-field: a re-declared parameter list is
+            // how `password` silently stopped reaching the base (see
+            // ImportPrivateKeyParams).
+            return _super.importPrivateKey.call(this, params);
         });
     }
     /**
@@ -603,10 +622,14 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
                 accountAddress: this.getWalletIdentityAddress(),
             });
             const messageString = typeof message === 'string' ? message : message.raw;
+            const walletIdentityAddress = this.getWalletIdentityAddress();
             return walletClient.signMessage({
-                accountAddress: this.getWalletIdentityAddress(),
+                accountAddress: walletIdentityAddress,
                 authToken: (_e = this.getAuthToken) === null || _e === void 0 ? void 0 : _e.call(this),
-                bitcoinConfig: { network: yield this.getBitcoinNetworkEnum() },
+                bitcoinConfig: {
+                    addressType: this.getAddressTypeForSigning(walletIdentityAddress),
+                    network: yield this.getBitcoinNetworkEnum(),
+                },
                 context,
                 elevatedAccessToken,
                 message: messageString,
@@ -838,6 +861,7 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
                 accountAddress: this.getWalletIdentityAddress(),
                 authToken: (_d = this.getAuthToken) === null || _d === void 0 ? void 0 : _d.call(this),
                 bitcoinConfig: {
+                    addressType: this.getAddressTypeForSigning(this.getWalletIdentityAddress()),
                     network: yield this.getBitcoinNetworkEnum(),
                 },
                 elevatedAccessToken,

package/src/connectors/DynamicWaasBitcoinConnector/DynamicWaasBitcoinConnector.d.ts

@@ -1,8 +1,7 @@
-import { BitcoinConfig } from '@dynamic-labs-wallet/browser-wallet-client';
 import { Logger } from '@dynamic-labs/logger';
 import { JwtVerifiedCredential, MFAAction, SignMessageContext, TokenScope } from '@dynamic-labs/sdk-api-core';
 import { GenericNetwork, IUITransaction, WalletUiUtils } from '@dynamic-labs/types';
-import { BitcoinSignPsbtResponse, Chain, IDynamicWaasConnector, ISendBalanceWalletConnector, InternalWalletConnector } from '@dynamic-labs/wallet-connector-core';
+import { BitcoinSignPsbtResponse, Chain, CreateWalletAccountParams, IDynamicWaasConnector, ISendBalanceWalletConnector, ImportPrivateKeyParams, InternalWalletConnector } from '@dynamic-labs/wallet-connector-core';
 import type { DynamicWaasBitcoinConnectorProps, ParsedTransaction } from '../../types';
 import { BitcoinTransaction, EmbeddedWalletSignPsbtRequest } from '../../types';
 import { BitcoinWalletConnector } from '../BitcoinWalletConnector';
@@ -67,12 +66,7 @@ declare const DynamicWaasBitcoinConnector_base: (abstract new (...args: any[]) =
     getWaasWalletClient(traceContext?: import("dist/packages/waas/utils/instrumentation").TraceContext | undefined, { forceRebuild }?: {
         forceRebuild?: boolean | undefined;
     } | undefined): Promise<import("@dynamic-labs-wallet/browser-wallet-client").DynamicWalletClient>;
-    createWalletAccount({ thresholdSignatureScheme, password, bitcoinConfig, businessAccountId, }?: {
-        thresholdSignatureScheme?: string | undefined;
-        password?: string | undefined;
-        bitcoinConfig?: BitcoinConfig | undefined;
-        businessAccountId?: string | undefined;
-    } | undefined): Promise<{
+    createWalletAccount({ thresholdSignatureScheme, password, bitcoinConfig, businessAccountId, }?: CreateWalletAccountParams | undefined): Promise<{
         chainName: string;
         accountAddress: string;
         publicKeyHex: string;
@@ -92,25 +86,18 @@ declare const DynamicWaasBitcoinConnector_base: (abstract new (...args: any[]) =
     }): Promise<{
         shareSetId: string;
     }>;
-    importPrivateKey({ privateKey, thresholdSignatureScheme, publicAddressCheck, addressType, legacyWalletId, password, }: {
-        privateKey: string;
-        thresholdSignatureScheme?: string | undefined;
-        publicAddressCheck?: string | undefined;
-        addressType?: string | undefined;
-        legacyWalletId?: string | undefined;
-        password?: string | undefined;
-    }): Promise<void>;
+    importPrivateKey({ privateKey, thresholdSignatureScheme, publicAddressCheck, addressType, legacyWalletId, password, isRawScalarImport, }: ImportPrivateKeyParams): Promise<void>;
     migrateFromFireblocks({ deviceId, jwt, walletPassword, ncwStorage, expectedAddresses, coinTypes, password, }: {
         deviceId: string;
         jwt: string;
         walletPassword: string;
-        ncwStorage: Record<string, string>; /**
-         * Gets the current Bitcoin network id (1 mainnet, 2 testnet)
-         */
+        ncwStorage: Record<string, string>;
         expectedAddresses: Record<string, string>;
         coinTypes?: Record<string, number> | undefined;
         password?: string | undefined;
-    }): Promise<Record<string, unknown>>;
+    }): Promise<Record<string, unknown>>; /**
+     * Gets the current Bitcoin network id (1 mainnet, 2 testnet)
+     */
     exportPrivateKey({ accountAddress, displayContainer, password, }?: {
         accountAddress?: string | undefined;
         displayContainer?: HTMLIFrameElement | undefined;
@@ -119,10 +106,7 @@ declare const DynamicWaasBitcoinConnector_base: (abstract new (...args: any[]) =
     getExportHandler(): {
         clear: () => void;
     };
-    exportClientKeyshares({ accountAddress, password, }: {
-        accountAddress: string;
-        password?: string | undefined;
-    }): Promise<void>;
+    exportClientKeyshares({ accountAddress, password, }: import("@dynamic-labs/wallet-connector-core").ExportClientKeysharesParams): Promise<void>;
     runBackupLifecycle({ provider, accountAddress, password, performBackup, }: {
         provider: string;
         accountAddress: string;
@@ -138,11 +122,7 @@ declare const DynamicWaasBitcoinConnector_base: (abstract new (...args: any[]) =
             };
         }) => Promise<void>;
     }): Promise<void>;
-    backupKeySharesToGoogleDrive({ accountAddress, password, googleDriveAccessToken, }: {
-        accountAddress: string;
-        password?: string | undefined;
-        googleDriveAccessToken?: string | undefined;
-    }): Promise<void>;
+    backupKeySharesToGoogleDrive({ accountAddress, password, googleDriveAccessToken, }: import("@dynamic-labs/wallet-connector-core").BackupKeySharesToGoogleDriveParams): Promise<void>;
     exportClientKeysharesFromGoogleDrive({ accountAddress, password, }: {
         accountAddress: string;
         password?: string | undefined;
@@ -156,24 +136,13 @@ declare const DynamicWaasBitcoinConnector_base: (abstract new (...args: any[]) =
     }): Promise<void>;
     hideICloudSignIn(): Promise<void>;
     isICloudAuthenticated(): Promise<boolean>;
-    refreshWalletAccountShares({ accountAddress, password, }: {
-        accountAddress: string;
-        password?: string | undefined;
-    }): Promise<void>;
-    reshareWalletAccountShares({ accountAddress, thresholdSignatureScheme, password, }: {
-        accountAddress: string;
-        thresholdSignatureScheme: string;
-        password?: string | undefined;
-    }): Promise<void>;
+    refreshWalletAccountShares({ accountAddress, password, }: import("@dynamic-labs/wallet-connector-core").RefreshWalletAccountSharesParams): Promise<void>;
+    reshareWalletAccountShares({ accountAddress, thresholdSignatureScheme, password, }: import("@dynamic-labs/wallet-connector-core").ReshareWalletAccountSharesParams): Promise<void>;
     revokeDelegation({ accountAddress, password, }: {
         accountAddress: string;
         password?: string | undefined;
     }): Promise<void>;
-    updatePassword({ accountAddress, existingPassword, newPassword, }: {
-        accountAddress: string;
-        existingPassword?: string | undefined;
-        newPassword: string;
-    }): Promise<void>;
+    updatePassword({ accountAddress, existingPassword, newPassword, }: import("@dynamic-labs/wallet-connector-core").UpdatePasswordParams): Promise<void>;
     setPassword({ accountAddress, newPassword, }: {
         accountAddress: string;
         newPassword: string;
@@ -289,6 +258,23 @@ export declare class DynamicWaasBitcoinConnector extends DynamicWaasBitcoinConne
      * the active address automatically.
      */
     private getBitcoinNetworkEnum;
+    /**
+     * The address type the wallet's key was derived under, read back from the
+     * address itself.
+     *
+     * `bitcoinConfig.addressType` is the only thing that selects a BTC
+     * derivation path downstream (`getMPCChainConfig` throws without it), and a
+     * wallet created by an import carries no server-side derivation metadata to
+     * fall back on — so signing an imported wallet failed while a
+     * Dynamic-created one signed fine. The address already encodes the answer:
+     * witness v0 is P2WPKH (native segwit), v1 is P2TR (taproot), which are
+     * exactly the two types `importPrivateKey` accepts.
+     *
+     * Falls back to native segwit for an address that is not bech32 (a legacy
+     * P2PKH/P2SH encoding cannot come from this connector's own import or
+     * create paths) so a decode failure can never make signing impossible.
+     */
+    private getAddressTypeForSigning;
     supportsNetworkSwitching(): boolean;
     /**
      * Testnet when the testnet network (id 2) is selected — drives the widget's
@@ -424,32 +410,19 @@ export declare class DynamicWaasBitcoinConnector extends DynamicWaasBitcoinConne
      * @param bitcoinConfig - Bitcoin configuration (addressType, network)
      * @returns The created wallet account information
      */
-    createWalletAccount({ thresholdSignatureScheme, password, bitcoinConfig, }?: {
-        thresholdSignatureScheme?: string;
-        password?: string;
-        bitcoinConfig?: BitcoinConfig;
-    }): Promise<{
+    createWalletAccount(params?: CreateWalletAccountParams): Promise<{
         chainName: string;
         accountAddress: string;
         publicKeyHex: string;
         rawPublicKey: string | Uint8Array | undefined;
     }>;
     /**
-     * Override importPrivateKey to require and validate addressType for Bitcoin
-     * @param privateKey - The private key to import (WIF format for Bitcoin)
-     * @param thresholdSignatureScheme - The threshold signature scheme (default: 'TWO_OF_TWO')
-     * @param publicAddressCheck - Optional public address to verify against
-     * @param addressType - Required address type for Bitcoin ('native_segwit' or 'taproot')
-     * @param legacyWalletId - Optional ID of the legacy wallet being upgraded
+     * Requires and validates `addressType` for Bitcoin, then delegates.
+     * @param params - See ImportPrivateKeyParams. `addressType` is mandatory
+     * here ('native_segwit' or 'taproot') and `privateKey` is WIF.
      * @throws {DynamicError} If addressType is missing or invalid for BTC
      */
-    importPrivateKey({ privateKey, thresholdSignatureScheme, publicAddressCheck, addressType, legacyWalletId, }: {
-        privateKey: string;
-        thresholdSignatureScheme?: string;
-        publicAddressCheck?: string;
-        addressType?: string;
-        legacyWalletId?: string;
-    }): Promise<void>;
+    importPrivateKey(params: ImportPrivateKeyParams): Promise<void>;
     /**
      * Gets the wallet client for a specific account address and sets it as
      * active — unless `accountAddress` is just a different network-tagged

package/src/connectors/DynamicWaasBitcoinConnector/DynamicWaasBitcoinConnector.js

@@ -1,6 +1,6 @@
 'use client'
 import { __awaiter } from '../../../_virtual/_tslib.js';
-import { networks, Psbt } from 'bitcoinjs-lib';
+import { address, networks, Psbt } from 'bitcoinjs-lib';
 import { Logger } from '@dynamic-labs/logger';
 import { MFAAction, TokenScope } from '@dynamic-labs/sdk-api-core';
 import { DynamicError } from '@dynamic-labs/utils';
@@ -132,6 +132,32 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
                 : 'mainnet');
         });
     }
+    /**
+     * The address type the wallet's key was derived under, read back from the
+     * address itself.
+     *
+     * `bitcoinConfig.addressType` is the only thing that selects a BTC
+     * derivation path downstream (`getMPCChainConfig` throws without it), and a
+     * wallet created by an import carries no server-side derivation metadata to
+     * fall back on — so signing an imported wallet failed while a
+     * Dynamic-created one signed fine. The address already encodes the answer:
+     * witness v0 is P2WPKH (native segwit), v1 is P2TR (taproot), which are
+     * exactly the two types `importPrivateKey` accepts.
+     *
+     * Falls back to native segwit for an address that is not bech32 (a legacy
+     * P2PKH/P2SH encoding cannot come from this connector's own import or
+     * create paths) so a decode failure can never make signing impossible.
+     */
+    getAddressTypeForSigning(walletAddress) {
+        try {
+            const { version } = address.fromBech32(walletAddress);
+            return (version === 1 ? 'taproot' : 'native_segwit');
+        }
+        catch (error) {
+            this.logger.warn('Could not read the address type from the wallet address; assuming native segwit', { error, walletAddress });
+            return 'native_segwit';
+        }
+    }
     supportsNetworkSwitching() {
         return true;
     }
@@ -470,33 +496,29 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
         const _super = Object.create(null, {
             createWalletAccount: { get: () => super.createWalletAccount }
         });
-        return __awaiter(this, arguments, void 0, function* ({ thresholdSignatureScheme = 'TWO_OF_TWO', password, bitcoinConfig, } = {}) {
-            var _a;
+        return __awaiter(this, arguments, void 0, function* (params = {}) {
+            var _a, _b;
             const finalBitcoinConfig = {
-                addressType: ((_a = bitcoinConfig === null || bitcoinConfig === void 0 ? void 0 : bitcoinConfig.addressType) !== null && _a !== void 0 ? _a : 'native_segwit'),
+                addressType: ((_b = (_a = params.bitcoinConfig) === null || _a === void 0 ? void 0 : _a.addressType) !== null && _b !== void 0 ? _b : 'native_segwit'),
                 network: yield this.getBitcoinNetworkEnum(),
             };
-            return _super.createWalletAccount.call(this, {
-                bitcoinConfig: finalBitcoinConfig,
-                password,
-                thresholdSignatureScheme,
-            });
+            // Spread, so a field added to CreateWalletAccountParams later still
+            // reaches the base instead of being silently dropped here.
+            return _super.createWalletAccount.call(this, Object.assign(Object.assign({}, params), { bitcoinConfig: finalBitcoinConfig }));
         });
     }
     /**
-     * Override importPrivateKey to require and validate addressType for Bitcoin
-     * @param privateKey - The private key to import (WIF format for Bitcoin)
-     * @param thresholdSignatureScheme - The threshold signature scheme (default: 'TWO_OF_TWO')
-     * @param publicAddressCheck - Optional public address to verify against
-     * @param addressType - Required address type for Bitcoin ('native_segwit' or 'taproot')
-     * @param legacyWalletId - Optional ID of the legacy wallet being upgraded
+     * Requires and validates `addressType` for Bitcoin, then delegates.
+     * @param params - See ImportPrivateKeyParams. `addressType` is mandatory
+     * here ('native_segwit' or 'taproot') and `privateKey` is WIF.
      * @throws {DynamicError} If addressType is missing or invalid for BTC
      */
-    importPrivateKey(_a) {
+    importPrivateKey(params) {
         const _super = Object.create(null, {
             importPrivateKey: { get: () => super.importPrivateKey }
         });
-        return __awaiter(this, arguments, void 0, function* ({ privateKey, thresholdSignatureScheme = 'TWO_OF_TWO', publicAddressCheck, addressType, legacyWalletId, }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { addressType } = params;
             if (!addressType) {
                 throw new DynamicError('addressType is required for BTC importPrivateKey', 'addresstype_is_required_for_btc_importprivatekey');
             }
@@ -504,13 +526,10 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
             if (!validAddressTypes.includes(addressType)) {
                 throw new DynamicError(`Invalid addressType: ${addressType}. Must be one of: ${validAddressTypes.join(', ')}`, 'invalid_addresstype_must_be_one_of');
             }
-            return _super.importPrivateKey.call(this, {
-                addressType,
-                legacyWalletId,
-                privateKey,
-                publicAddressCheck,
-                thresholdSignatureScheme,
-            });
+            // Forwarded whole, never field-by-field: a re-declared parameter list is
+            // how `password` silently stopped reaching the base (see
+            // ImportPrivateKeyParams).
+            return _super.importPrivateKey.call(this, params);
         });
     }
     /**
@@ -599,10 +618,14 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
                 accountAddress: this.getWalletIdentityAddress(),
             });
             const messageString = typeof message === 'string' ? message : message.raw;
+            const walletIdentityAddress = this.getWalletIdentityAddress();
             return walletClient.signMessage({
-                accountAddress: this.getWalletIdentityAddress(),
+                accountAddress: walletIdentityAddress,
                 authToken: (_e = this.getAuthToken) === null || _e === void 0 ? void 0 : _e.call(this),
-                bitcoinConfig: { network: yield this.getBitcoinNetworkEnum() },
+                bitcoinConfig: {
+                    addressType: this.getAddressTypeForSigning(walletIdentityAddress),
+                    network: yield this.getBitcoinNetworkEnum(),
+                },
                 context,
                 elevatedAccessToken,
                 message: messageString,
@@ -834,6 +857,7 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
                 accountAddress: this.getWalletIdentityAddress(),
                 authToken: (_d = this.getAuthToken) === null || _d === void 0 ? void 0 : _d.call(this),
                 bitcoinConfig: {
+                    addressType: this.getAddressTypeForSigning(this.getWalletIdentityAddress()),
                     network: yield this.getBitcoinNetworkEnum(),
                 },
                 elevatedAccessToken,