@hardkas/accounts 0.11.1-alpha → 0.11.4-alpha

package/dist/index.js

@@ -1,3 +1,47 @@
+import {
+  DEV_ACCOUNTS_PASSWORD,
+  KaspaWasmPrivateKeySigner,
+  assertSigningNetworkAllowed,
+  createDevSigner,
+  ensureDevAccounts,
+  getOrCreateDevAccount,
+  listDevAccountsSync
+} from "./chunk-TY5CXPHB.js";
+import "./chunk-WRRHW2WO.js";
+import {
+  createEmptyRealAccountStore,
+  describeAccount,
+  getDefaultRealAccountsPath,
+  getRealDevAccount,
+  importRealDevAccount,
+  listHardkasAccounts,
+  listRealDevAccounts,
+  loadOrCreateRealAccountStore,
+  loadRealAccountStore,
+  loadRealAccountStoreSync,
+  removeRealDevAccount,
+  resolveHardkasAccount,
+  resolveHardkasAccountAddress,
+  resolveRealAccountOrAddress,
+  saveRealAccountStore,
+  validateAccountName,
+  validateAddressNetwork,
+  validateAddressPrefix
+} from "./chunk-ILASLDZU.js";
+import {
+  detectCapabilities,
+  getKaspaSigningBackendStatus,
+  loadKaspaWasm
+} from "./chunk-6DPO5V3N.js";
+import {
+  KeystoreManager
+} from "./chunk-YLG2NIAU.js";
+import {
+  LazyAccountAuthorizer,
+  PrivateKeyAuthorizer,
+  StaticSignatureScriptAuthorizer
+} from "./chunk-MRXCDBKH.js";
+
 // src/simulated.ts
 var SimulatedSigner = class {
   constructor(account) {
@@ -13,458 +57,6 @@ var SimulatedSigner = class {
   }
 };
 
-// src/resolve.ts
-import fs2 from "fs";
-import path2 from "path";
-import { createDeterministicAccounts } from "@hardkas/localnet";
-
-// src/real-accounts.ts
-import fs from "fs";
-import path from "path";
-import { writeFileAtomicSync } from "@hardkas/core";
-import {
-  HARDKAS_VERSION,
-  ARTIFACT_SCHEMAS,
-  ARTIFACT_VERSION
-} from "@hardkas/artifacts";
-function getDefaultRealAccountsPath(cwd) {
-  const root = cwd ?? process.cwd();
-  return path.join(root, ".hardkas", "accounts.real.json");
-}
-function createEmptyRealAccountStore() {
-  return {
-    schema: ARTIFACT_SCHEMAS.REAL_ACCOUNT_STORE,
-    hardkasVersion: HARDKAS_VERSION,
-    version: ARTIFACT_VERSION,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    networkId: "simnet",
-    mode: "real",
-    connectionMode: "node",
-    warning: "HardKAS: Development account store. Encrypted storage is default. Unsafe plaintext storage is legacy.",
-    accounts: []
-  };
-}
-function loadRealAccountStoreSync(options) {
-  const filePath = options?.path || getDefaultRealAccountsPath(options?.cwd);
-  if (!fs.existsSync(filePath)) {
-    return null;
-  }
-  try {
-    const data = fs.readFileSync(filePath, "utf-8");
-    const store = JSON.parse(data);
-    for (const a of store.accounts) {
-      if ("privateKey" in a && a.privateKey !== void 0) {
-        if (a.privateKey === null || a.privateKey === "" || a.privateKey === "[object Object]" || typeof a.privateKey === "object" || typeof a.privateKey === "string" && a.privateKey.includes("__wbg_ptr") || typeof a.privateKey === "object" && "__wbg_ptr" in a.privateKey) {
-          const err = new Error(
-            "CORRUPTED_PRIVATE_KEY_SERIALIZATION: This account was generated by a broken alpha and must be regenerated. The private key was not recoverably stored."
-          );
-          err.code = "CORRUPTED_PRIVATE_KEY_SERIALIZATION";
-          throw err;
-        }
-      }
-    }
-    const plaintextAccounts = store.accounts.filter((a) => a.privateKey);
-    if (plaintextAccounts.length > 0) {
-      const names = plaintextAccounts.map((a) => a.name).join(", ");
-      console.warn(
-        `
-  \u26A0\uFE0F  [SECURITY WARNING] Plaintext private keys detected in legacy account store for: ${names}`
-      );
-      console.warn(`     Location: ${filePath}`);
-      console.warn(
-        `     Recommendation: Re-import these accounts using encrypted keystores.
-`
-      );
-    }
-    return store;
-  } catch (e) {
-    throw new Error(
-      `Failed to load real account store at ${filePath}: ${e instanceof Error ? e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e) : String(e)}`
-    );
-  }
-}
-async function loadRealAccountStore(options) {
-  return loadRealAccountStoreSync(options);
-}
-async function loadOrCreateRealAccountStore(options) {
-  const store = await loadRealAccountStore(options);
-  if (store) return store;
-  const newStore = createEmptyRealAccountStore();
-  await saveRealAccountStore(newStore, options);
-  return newStore;
-}
-async function saveRealAccountStore(store, options) {
-  const filePath = options?.path || getDefaultRealAccountsPath(options?.cwd);
-  try {
-    writeFileAtomicSync(filePath, JSON.stringify(store, null, 2), {
-      encoding: "utf-8",
-      mode: 384
-    });
-  } catch (e) {
-    throw new Error(
-      `Failed to save real account store at ${filePath}: ${e instanceof Error ? e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e) : String(e)}`
-    );
-  }
-}
-function validateAccountName(name) {
-  if (!name) {
-    throw new Error("Account name is required.");
-  }
-  const nameRegex = /^[a-zA-Z0-9_-]+$/;
-  if (!nameRegex.test(name)) {
-    throw new Error(
-      `Invalid account name '${name}'. Only letters, numbers, dashes and underscores are allowed.`
-    );
-  }
-}
-function validateAddressPrefix(address) {
-  if (!address) {
-    throw new Error("Address is required.");
-  }
-  const validPrefixes = ["kaspa:", "kaspatest:", "kaspasim:"];
-  const hasValidPrefix = validPrefixes.some((prefix) => address.startsWith(prefix));
-  if (!hasValidPrefix) {
-    const err = new Error(
-      `HARDKAS_INVALID_ADDRESS: Invalid address '${address}'. Must start with one of: ${validPrefixes.join(", ")}`
-    );
-    err.code = "HARDKAS_INVALID_ADDRESS";
-    throw err;
-  }
-}
-function validateAddressNetwork(address, networkId, allowMainnet) {
-  if (address.startsWith("kaspa:sim_")) {
-    return;
-  }
-  validateAddressPrefix(address);
-  let expectedPrefix;
-  if (networkId === "mainnet") {
-    expectedPrefix = "kaspa:";
-  } else if (networkId === "testnet-10" || networkId === "testnet-11") {
-    expectedPrefix = "kaspatest:";
-  } else if (networkId === "simnet" || networkId === "devnet" || networkId === "simulated") {
-    expectedPrefix = "kaspasim:";
-  } else {
-    return;
-  }
-  if (expectedPrefix !== "kaspa:" && address.startsWith("kaspa:") && allowMainnet) {
-    return;
-  }
-  if (!address.startsWith(expectedPrefix)) {
-    const err = new Error(
-      `NETWORK_ADDRESS_MISMATCH: Address '${address}' does not match the expected prefix '${expectedPrefix}' for network '${networkId}'.`
-    );
-    err.code = "NETWORK_ADDRESS_MISMATCH";
-    throw err;
-  }
-}
-function importRealDevAccount(store, account) {
-  validateAccountName(account.name);
-  validateAddressPrefix(account.address);
-  if (store.accounts.some((a) => a.name.toLowerCase() === account.name.toLowerCase())) {
-    throw new Error(`Account with name '${account.name}' already exists.`);
-  }
-  const newAccount = {
-    ...account,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  return {
-    ...store,
-    accounts: [...store.accounts, newAccount]
-  };
-}
-function removeRealDevAccount(store, name) {
-  const index = store.accounts.findIndex(
-    (a) => a.name.toLowerCase() === name.toLowerCase()
-  );
-  if (index === -1) {
-    throw new Error(`Account with name '${name}' not found.`);
-  }
-  const newAccounts = [...store.accounts];
-  newAccounts.splice(index, 1);
-  return {
-    ...store,
-    accounts: newAccounts
-  };
-}
-function getRealDevAccount(store, name) {
-  return store.accounts.find((a) => a.name.toLowerCase() === name.toLowerCase()) || null;
-}
-function listRealDevAccounts(store) {
-  return store.accounts;
-}
-function resolveRealAccountOrAddress(store, nameOrAddress) {
-  const account = store ? getRealDevAccount(store, nameOrAddress) : null;
-  if (account) {
-    return { address: account.address, name: account.name };
-  }
-  if (nameOrAddress.startsWith("kaspa:") || nameOrAddress.startsWith("kaspatest:") || nameOrAddress.startsWith("kaspasim:")) {
-    return { address: nameOrAddress };
-  }
-  throw new Error(
-    `'${nameOrAddress}' is not a registered real account name and is not a valid Kaspa address.`
-  );
-}
-
-// src/resolve.ts
-function resolveHardkasAccount(options) {
-  const { nameOrAddress, config } = options;
-  if (nameOrAddress.startsWith("kaspa:") || nameOrAddress.startsWith("kaspatest:") || nameOrAddress.startsWith("kaspasim:")) {
-    return {
-      name: nameOrAddress,
-      kind: "external-wallet",
-      address: nameOrAddress
-    };
-  }
-  let alias = nameOrAddress;
-  if (alias === "0") alias = "alice";
-  if (alias === "1") alias = "bob";
-  const workspaceRoot = config?.cwd || process.cwd();
-  const devAccountPath = path2.join(
-    workspaceRoot,
-    ".hardkas",
-    "dev-accounts",
-    `${alias}.json`
-  );
-  if (fs2.existsSync(devAccountPath)) {
-    try {
-      const data = fs2.readFileSync(devAccountPath, "utf-8");
-      const keystore = JSON.parse(data);
-      if (keystore.type === "hardkas.encryptedKeystore.v2") {
-        return {
-          name: alias,
-          kind: "kaspa-private-key",
-          address: keystore.metadata?.address,
-          keystorePath: devAccountPath
-        };
-      }
-    } catch (e) {
-    }
-  }
-  const keystoreJsonPath = path2.join(workspaceRoot, ".hardkas", "keystore.json");
-  if (fs2.existsSync(keystoreJsonPath)) {
-    try {
-      const data = fs2.readFileSync(keystoreJsonPath, "utf-8");
-      const ks = JSON.parse(data);
-      if (ks[alias]) {
-        return {
-          name: alias,
-          kind: ks[alias].type === "simulated" ? "simulated" : "kaspa-private-key",
-          address: ks[alias].address
-        };
-      }
-    } catch (e) {
-    }
-  }
-  if (config?.accounts && config.accounts[alias]) {
-    const accConfig = config.accounts[alias];
-    return {
-      name: alias,
-      ...accConfig
-    };
-  }
-  const realStore = loadRealAccountStoreSync({ cwd: workspaceRoot });
-  const realAcc = realStore ? getRealDevAccount(realStore, alias) : null;
-  if (realAcc) {
-    return {
-      name: realAcc.name,
-      kind: "kaspa-private-key",
-      // Assuming Kaspa for now, could be extensible
-      address: realAcc.address,
-      ...realAcc.privateKeyEnv ? { privateKeyEnv: realAcc.privateKeyEnv } : {},
-      ...realAcc.privateKey ? { privateKey: realAcc.privateKey } : {}
-    };
-  }
-  const detAccounts = createDeterministicAccounts();
-  const det = detAccounts.find((a) => a.name === alias);
-  if (det) {
-    return {
-      name: det.name,
-      kind: "simulated",
-      address: det.address,
-      evmAddress: det.evmAddress
-    };
-  }
-  const available = listHardkasAccounts(config).map((a) => a.name).join(", ");
-  throw new Error(
-    `Unknown HardKAS account '${nameOrAddress}'. Available accounts: ${available}`
-  );
-}
-function listHardkasAccounts(config) {
-  const accounts = /* @__PURE__ */ new Map();
-  const detAccounts = createDeterministicAccounts();
-  for (const det of detAccounts) {
-    accounts.set(det.name, {
-      name: det.name,
-      kind: "simulated",
-      address: det.address,
-      evmAddress: det.evmAddress
-    });
-  }
-  const workspaceRoot = config?.cwd || process.cwd();
-  const devAccountsDir = path2.join(workspaceRoot, ".hardkas", "dev-accounts");
-  if (fs2.existsSync(devAccountsDir)) {
-    const files = fs2.readdirSync(devAccountsDir);
-    for (const file of files) {
-      if (file.endsWith(".json")) {
-        try {
-          const name = path2.basename(file, ".json");
-          const data = fs2.readFileSync(path2.join(devAccountsDir, file), "utf-8");
-          const keystore = JSON.parse(data);
-          if (keystore.type === "hardkas.encryptedKeystore.v2") {
-            accounts.set(name, {
-              name,
-              kind: "kaspa-private-key",
-              address: keystore.payload?.address || keystore.metadata?.address,
-              keystorePath: path2.join(devAccountsDir, file)
-            });
-          }
-        } catch (e) {
-        }
-      }
-    }
-  }
-  const keystoreJsonPath = path2.join(workspaceRoot, ".hardkas", "keystore.json");
-  if (fs2.existsSync(keystoreJsonPath)) {
-    try {
-      const data = fs2.readFileSync(keystoreJsonPath, "utf-8");
-      const ks = JSON.parse(data);
-      for (const [name, acc] of Object.entries(ks)) {
-        if (acc.type === "simulated") {
-          accounts.set(name, {
-            name,
-            kind: "simulated",
-            address: acc.address
-          });
-        } else {
-          accounts.set(name, {
-            name,
-            kind: "kaspa-private-key",
-            address: acc.address
-          });
-        }
-      }
-    } catch (e) {
-    }
-  }
-  const realStore = loadRealAccountStoreSync({ cwd: workspaceRoot });
-  if (realStore) {
-    for (const realAcc of listRealDevAccounts(realStore)) {
-      accounts.set(realAcc.name, {
-        name: realAcc.name,
-        kind: "kaspa-private-key",
-        address: realAcc.address,
-        ...realAcc.privateKeyEnv ? { privateKeyEnv: realAcc.privateKeyEnv } : {},
-        ...realAcc.privateKey ? { privateKey: realAcc.privateKey } : {}
-      });
-    }
-  }
-  const keystoreDir = path2.join(process.cwd(), ".hardkas", "keystore");
-  if (fs2.existsSync(keystoreDir)) {
-    const files = fs2.readdirSync(keystoreDir);
-    for (const file of files) {
-      if (file.endsWith(".json")) {
-        try {
-          const name = path2.basename(file, ".json");
-          const data = fs2.readFileSync(path2.join(keystoreDir, file), "utf-8");
-          const keystore = JSON.parse(data);
-          if (keystore.type === "hardkas.encryptedKeystore.v2") {
-            accounts.set(name, {
-              name,
-              kind: "kaspa-private-key",
-              address: keystore.payload?.address || keystore.metadata?.address,
-              // Payloads are encrypted, but address might be in metadata
-              keystorePath: path2.join(keystoreDir, file)
-            });
-          }
-        } catch (e) {
-        }
-      }
-    }
-  }
-  if (config?.accounts) {
-    for (const [name, accConfig] of Object.entries(config.accounts)) {
-      const existing = accounts.get(name);
-      if (existing && existing.kind === "kaspa-private-key" && accConfig.kind === "simulated") {
-        continue;
-      }
-      accounts.set(name, {
-        name,
-        ...accConfig
-      });
-    }
-  }
-  return Array.from(accounts.values());
-}
-async function resolveHardkasAccountAddress(accountOrAddress, config, context = "L1") {
-  if (accountOrAddress.startsWith("kaspa:") || accountOrAddress.startsWith("kaspatest:") || accountOrAddress.startsWith("kaspasim:")) {
-    if (context === "L2") {
-      throw new Error(
-        `Invalid L2 address provided: ${accountOrAddress}. Expected EVM address or account alias.`
-      );
-    }
-    if (!accountOrAddress.startsWith("kaspa:sim_")) {
-      try {
-        const kaspa = await import("kaspa-wasm");
-        try {
-          if (typeof kaspa.Address === "function" || kaspa.Address) {
-            new kaspa.Address(accountOrAddress);
-          }
-        } catch (e) {
-          const err = new Error(
-            `HARDKAS_INVALID_ADDRESS: Invalid Kaspa address format or checksum.`
-          );
-          err.code = "HARDKAS_INVALID_ADDRESS";
-          throw err;
-        }
-      } catch (e) {
-        if (e instanceof Error && e.code === "HARDKAS_INVALID_ADDRESS") throw e;
-        if (e instanceof Error && (e.code === "ERR_MODULE_NOT_FOUND" || (e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e)).includes("Cannot find module") || (e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e)).includes("kaspa-wasm"))) {
-          const err = new Error(
-            "ADDRESS_VALIDATOR_UNAVAILABLE: The Kaspa address validator backend is not available."
-          );
-          err.code = "ADDRESS_VALIDATOR_UNAVAILABLE";
-          throw err;
-        }
-        throw e;
-      }
-    }
-    return accountOrAddress;
-  }
-  if (accountOrAddress.startsWith("0x") && accountOrAddress.length === 42) {
-    return accountOrAddress;
-  }
-  const account = resolveHardkasAccount({ nameOrAddress: accountOrAddress, config });
-  if (context === "L2") {
-    const evmAddress = account.evmAddress;
-    if (!evmAddress) {
-      throw new Error(
-        `Account '${account.name}' does not have an EVM address configured for L2.`
-      );
-    }
-    return evmAddress;
-  }
-  if (!account.address) {
-    throw new Error(`Account '${account.name}' does not have a resolved address yet.`);
-  }
-  return account.address;
-}
-function describeAccount(account) {
-  const desc = {
-    name: account.name,
-    kind: account.kind
-  };
-  if (account.address) {
-    desc.address = account.address;
-  }
-  if (account.kind === "kaspa-private-key" || account.kind === "evm-private-key") {
-    desc.privateKeyEnv = account.privateKeyEnv;
-  }
-  if (account.kind === "external-wallet" && account.walletId) {
-    desc.walletId = account.walletId;
-  }
-  return desc;
-}
-
 // src/evm-export.ts
 async function prepareEvmAccountExport(account, networkId, options = {}) {
   if (networkId === "mainnet" || networkId.startsWith("testnet")) {
@@ -528,538 +120,11 @@ function getRequiredEnv(name) {
 // src/signer.ts
 import {
   createSimulatedSignedTxArtifact,
-  calculateContentHash as calculateContentHash2,
-  HARDKAS_VERSION as HARDKAS_VERSION2,
+  calculateContentHash,
+  HARDKAS_VERSION,
   createLineageTransition
 } from "@hardkas/artifacts";
 import { systemRuntimeContext } from "@hardkas/core";
-
-// src/signer-backend.ts
-async function loadKaspaWasm() {
-  try {
-    return await import("kaspa-wasm");
-  } catch (error) {
-    const err = new Error(
-      "SIGNER_BACKEND_UNAVAILABLE: Official Kaspa WASM backend is required to sign transactions.\nInstall it via: npm install kaspa-wasm"
-    );
-    err.code = "SIGNER_BACKEND_UNAVAILABLE";
-    throw err;
-  }
-}
-async function getKaspaSigningBackendStatus() {
-  try {
-    const sdk = await loadKaspaWasm();
-    return {
-      available: true,
-      name: "Kaspa WASM SDK",
-      version: sdk.version || "unknown"
-    };
-  } catch (error) {
-    return {
-      available: false,
-      name: "None",
-      error: error instanceof Error ? error.message : String(error)
-    };
-  }
-}
-
-// src/kaspa-wasm-signer.ts
-import { calculateContentHash } from "@hardkas/artifacts";
-
-// src/keystore.ts
-import fs3 from "fs";
-import path3 from "path";
-import crypto from "crypto";
-import { argon2id } from "hash-wasm";
-import { writeFileAtomic } from "@hardkas/core";
-var KeystoreManager = class {
-  /**
-   * Keystore container format version. Separate from ARTIFACT_VERSION.
-   * This versions the encrypted keystore envelope, not HardKAS artifacts.
-   */
-  static KEYSTORE_FORMAT_VERSION = "2.0.0";
-  static KEYSTORE_FORMAT_TYPE = "hardkas.encryptedKeystore.v2";
-  /**
-   * Creates an encrypted keystore from a payload and password.
-   */
-  static async createEncryptedKeystore(payload, password, options) {
-    if (!password) throw new Error("Password cannot be empty.");
-    if (password.length < 8)
-      throw new Error("Password must be at least 8 characters long.");
-    const salt = crypto.randomBytes(16);
-    const nonce = crypto.randomBytes(12);
-    const iterations = options.iterations || 3;
-    const memory = options.memory || 65536;
-    const parallelism = options.parallelism || 1;
-    const derivedKeyHex = await argon2id({
-      password,
-      salt,
-      parallelism,
-      iterations,
-      memorySize: memory,
-      hashLength: 32,
-      // 256 bits for AES-256
-      outputType: "hex"
-    });
-    const derivedKey = Buffer.from(derivedKeyHex, "hex");
-    const cipher = crypto.createCipheriv("aes-256-gcm", derivedKey, nonce);
-    const encryptedPayload = Buffer.concat([
-      cipher.update(JSON.stringify(payload), "utf8"),
-      cipher.final()
-    ]);
-    const tag = cipher.getAuthTag();
-    derivedKey.fill(0);
-    return {
-      version: this.KEYSTORE_FORMAT_VERSION,
-      type: this.KEYSTORE_FORMAT_TYPE,
-      kdf: {
-        algorithm: "argon2id",
-        memory,
-        iterations,
-        parallelism,
-        salt: salt.toString("base64")
-      },
-      cipher: {
-        algorithm: "aes-256-gcm",
-        nonce: nonce.toString("base64"),
-        tag: tag.toString("base64")
-      },
-      encryptedPayload: encryptedPayload.toString("base64"),
-      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      metadata: {
-        label: options.label,
-        network: options.network,
-        address: payload.address
-      }
-    };
-  }
-  /**
-   * Decrypts an encrypted keystore using a password.
-   */
-  static async decryptEncryptedKeystore(keystore, password) {
-    if (keystore.version !== this.KEYSTORE_FORMAT_VERSION) {
-      return {
-        success: false,
-        error: `Unsupported keystore version: ${keystore.version}`
-      };
-    }
-    try {
-      const salt = Buffer.from(keystore.kdf.salt, "base64");
-      const nonce = Buffer.from(keystore.cipher.nonce, "base64");
-      const tag = Buffer.from(keystore.cipher.tag, "base64");
-      const encryptedData = Buffer.from(keystore.encryptedPayload, "base64");
-      const derivedKeyHex = await argon2id({
-        password,
-        salt,
-        parallelism: keystore.kdf.parallelism,
-        iterations: keystore.kdf.iterations,
-        memorySize: keystore.kdf.memory,
-        hashLength: 32,
-        outputType: "hex"
-      });
-      const derivedKey = Buffer.from(derivedKeyHex, "hex");
-      const decipher = crypto.createDecipheriv("aes-256-gcm", derivedKey, nonce);
-      decipher.setAuthTag(tag);
-      const decrypted = Buffer.concat([decipher.update(encryptedData), decipher.final()]);
-      derivedKey.fill(0);
-      const payload = JSON.parse(decrypted.toString("utf8"));
-      return { success: true, payload };
-    } catch (e) {
-      return { success: false, error: "Invalid password or corrupted keystore." };
-    }
-  }
-  /**
-   * Verifies if the password is correct for the keystore.
-   */
-  static async verifyKeystorePassword(keystore, password) {
-    const result = await this.decryptEncryptedKeystore(keystore, password);
-    return result.success;
-  }
-  /**
-   * Changes the password of an encrypted keystore.
-   */
-  static async changeKeystorePassword(keystore, oldPassword, newPassword) {
-    const unlock = await this.decryptEncryptedKeystore(keystore, oldPassword);
-    if (!unlock.success || !unlock.payload) {
-      throw new Error("Invalid current password.");
-    }
-    return this.createEncryptedKeystore(unlock.payload, newPassword, {
-      label: keystore.metadata.label,
-      network: keystore.metadata.network,
-      iterations: keystore.kdf.iterations,
-      memory: keystore.kdf.memory,
-      parallelism: keystore.kdf.parallelism
-    });
-  }
-  /**
-   * Loads an encrypted keystore from the filesystem.
-   */
-  static async loadEncryptedKeystore(filePath) {
-    try {
-      const data = await fs3.promises.readFile(filePath, "utf-8");
-      const keystore = JSON.parse(data);
-      if (keystore.type !== this.KEYSTORE_FORMAT_TYPE) {
-        throw new Error(`Invalid keystore type: ${keystore.type}`);
-      }
-      return keystore;
-    } catch (e) {
-      throw new Error(
-        `Failed to load keystore at ${filePath}: ${e instanceof Error ? e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e) : String(e)}`
-      );
-    }
-  }
-  /**
-   * Saves an encrypted keystore to the filesystem.
-   */
-  static async saveEncryptedKeystore(filePath, keystore) {
-    try {
-      const dir = path3.dirname(filePath);
-      if (!fs3.existsSync(dir)) {
-        await fs3.promises.mkdir(dir, { recursive: true });
-      }
-      await writeFileAtomic(filePath, JSON.stringify(keystore, null, 2), {
-        encoding: "utf-8",
-        mode: 384
-      });
-    } catch (e) {
-      throw new Error(
-        `Failed to save keystore at ${filePath}: ${e instanceof Error ? e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e) : String(e)}`
-      );
-    }
-  }
-};
-
-// src/dev-accounts.ts
-import fs4 from "fs";
-import path4 from "path";
-import crypto2 from "crypto";
-import { deterministicCompare } from "@hardkas/core";
-var DEV_ACCOUNTS_PASSWORD = "hardkas-local-dev";
-var SIMNET_DETERMINISTIC_SEED = "hardkas-deterministic-simnet-seed-v1";
-async function ensureDevAccounts(workspaceDir) {
-  const devAccountsDir = path4.join(workspaceDir, ".hardkas", "dev-accounts");
-  if (!fs4.existsSync(devAccountsDir)) {
-    await fs4.promises.mkdir(devAccountsDir, { recursive: true });
-  }
-  await getOrCreateDevAccount(workspaceDir, 0, "alice");
-  await getOrCreateDevAccount(workspaceDir, 1, "bob");
-}
-async function getOrCreateDevAccount(workspaceDir, index, alias) {
-  const devAccountsDir = path4.join(workspaceDir, ".hardkas", "dev-accounts");
-  const filePath = path4.join(devAccountsDir, `${alias}.json`);
-  if (fs4.existsSync(filePath)) {
-    const keystore2 = await KeystoreManager.loadEncryptedKeystore(filePath);
-    const unlock = await KeystoreManager.decryptEncryptedKeystore(
-      keystore2,
-      DEV_ACCOUNTS_PASSWORD
-    );
-    if (!unlock.success || !unlock.payload) {
-      throw new Error(
-        `Failed to decrypt dev account ${alias}. Expected password: ${DEV_ACCOUNTS_PASSWORD}`
-      );
-    }
-    return {
-      address: unlock.payload.address,
-      privateKey: unlock.payload.privateKey,
-      publicKey: unlock.payload.publicKey
-    };
-  }
-  const seedString = `${SIMNET_DETERMINISTIC_SEED}-${index}`;
-  const privateKeyHex = crypto2.createHash("sha256").update(seedString).digest("hex");
-  const network = "simnet";
-  const isSimnet = ["simnet", "kaspasim", "local"].includes(network);
-  let address = "";
-  let privateKey = "";
-  let publicKey = "";
-  try {
-    if (isSimnet) {
-      let kaspaWasm;
-      try {
-        kaspaWasm = await import(
-          /* @vite-ignore */
-          "kaspa-wasm"
-        );
-      } catch (e) {
-        console.warn(`
-[Warning] kaspa-wasm is not installed. Required for simnet.`);
-        return { address: "", privateKey: "", publicKey: "" };
-      }
-      const privKey = new kaspaWasm.PrivateKey(privateKeyHex);
-      const kp = privKey.toKeypair();
-      address = kp.toAddress(network).toString();
-      publicKey = kp.publicKey;
-      privateKey = privateKeyHex;
-    } else {
-      let sdkModule;
-      try {
-        sdkModule = await import(
-          /* @vite-ignore */
-          "@kaspa/core-lib"
-        );
-      } catch (e) {
-        console.warn(`
-[Warning] @kaspa/core-lib is not installed.`);
-        return { address: "", privateKey: "", publicKey: "" };
-      }
-      const sdk = sdkModule.default || sdkModule;
-      if (typeof sdk.initRuntime === "function") {
-        await sdk.initRuntime();
-      }
-      const privKey = new sdk.PrivateKey(privateKeyHex);
-      const pubKey = privKey.toPublicKey();
-      try {
-        address = pubKey.toAddress(network).toString();
-      } catch (e) {
-        const msg = e instanceof Error ? e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e) : String(e);
-        if (msg.includes("Second argument must be") || msg.includes("Unsupported")) {
-          const err = new Error("DEV_ACCOUNT_BACKEND_UNSUPPORTED_NETWORK");
-          err.code = "DEV_ACCOUNT_BACKEND_UNSUPPORTED_NETWORK";
-          throw err;
-        }
-        throw e;
-      }
-      publicKey = pubKey.toString();
-      privateKey = privKey.toString();
-    }
-  } catch (e) {
-    const msg = e instanceof Error ? e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e) : String(e);
-    if (msg === "DEV_ACCOUNT_BACKEND_UNSUPPORTED_NETWORK") {
-      throw e;
-    }
-    console.warn(`
-[Warning] Could not generate dev account '${alias}'.
-${msg}`);
-    return { address: "", privateKey: "", publicKey: "" };
-  }
-  const accountData = {
-    address,
-    privateKey,
-    publicKey
-  };
-  if (!fs4.existsSync(devAccountsDir)) {
-    await fs4.promises.mkdir(devAccountsDir, { recursive: true });
-  }
-  const payload = {
-    address: accountData.address,
-    privateKey: accountData.privateKey,
-    network: "simnet"
-  };
-  if (accountData.publicKey) {
-    payload.publicKey = accountData.publicKey;
-  }
-  const keystore = await KeystoreManager.createEncryptedKeystore(
-    payload,
-    DEV_ACCOUNTS_PASSWORD,
-    {
-      label: alias,
-      network: "simnet"
-    }
-  );
-  await KeystoreManager.saveEncryptedKeystore(filePath, keystore);
-  return accountData;
-}
-function listDevAccountsSync(workspaceDir) {
-  const devAccountsDir = path4.join(workspaceDir, ".hardkas", "dev-accounts");
-  if (!fs4.existsSync(devAccountsDir)) {
-    return [];
-  }
-  const accounts = [];
-  const files = fs4.readdirSync(devAccountsDir);
-  for (const file of files) {
-    if (file.endsWith(".json")) {
-      const name = path4.basename(file, ".json");
-      try {
-        const data = fs4.readFileSync(path4.join(devAccountsDir, file), "utf-8");
-        const keystore = JSON.parse(data);
-        if (keystore.type === "hardkas.encryptedKeystore.v2") {
-          accounts.push({
-            name,
-            address: keystore.metadata?.address || ""
-          });
-        }
-      } catch (e) {
-      }
-    }
-  }
-  accounts.sort((a, b) => deterministicCompare(a.name, b.name));
-  return accounts;
-}
-
-// src/kaspa-wasm-signer.ts
-function toHex(arr) {
-  return Buffer.from(arr).toString("hex");
-}
-function parseWasmTxToRpc(wasmTxStr) {
-  let parsed = JSON.parse(wasmTxStr);
-  if (typeof parsed === "string") {
-    parsed = JSON.parse(parsed);
-  }
-  const txInner = parsed.tx ? parsed.tx.inner : parsed.inner;
-  if (!txInner) throw new Error("Could not find inner tx data");
-  return {
-    version: txInner.version || 0,
-    inputs: (txInner.inputs || []).map((i) => ({
-      previousOutpoint: {
-        transactionId: i.inner.previousOutpoint.inner.transactionId,
-        index: i.inner.previousOutpoint.inner.index
-      },
-      signatureScript: toHex(i.inner.signatureScript),
-      sequence: i.inner.sequence || 0,
-      sigOpCount: i.inner.sigOpCount || 1
-    })),
-    outputs: (txInner.outputs || []).map((o) => ({
-      amount: o.inner.value.toString(),
-      scriptPublicKey: {
-        version: parseInt(o.inner.scriptPublicKey.substring(0, 4), 16) || 0,
-        scriptPublicKey: o.inner.scriptPublicKey.substring(4)
-      }
-    })),
-    lockTime: txInner.lockTime || 0,
-    subnetworkId: txInner.subnetworkId || "0000000000000000000000000000000000000000",
-    gas: txInner.gas || 0,
-    payload: txInner.payload && txInner.payload.length > 0 ? toHex(txInner.payload) : ""
-  };
-}
-var KaspaWasmPrivateKeySigner = class {
-  constructor(options) {
-    this.options = options;
-  }
-  options;
-  kind = "kaspa-private-key";
-  async signTxPlan(input) {
-    const plan = input.planArtifact;
-    const account = this.options.account;
-    const sdk = await loadKaspaWasm();
-    assertSigningNetworkAllowed({
-      network: plan.networkId,
-      mode: plan.mode,
-      allowMainnet: this.options.allowMainnet
-    });
-    let pkValue = account.privateKeyEnv ? process.env[account.privateKeyEnv] : void 0;
-    if (!pkValue && account.privateKey) {
-      if (plan.networkId === "mainnet") {
-        throw new Error(
-          `Mainnet guard: Unsafe plaintext privateKey fallback is forbidden on mainnet for account '${account.name}'. Use privateKeyEnv instead.`
-        );
-      }
-      pkValue = account.privateKey;
-    }
-    if (!pkValue && account.keystorePath) {
-      try {
-        const keystore = await KeystoreManager.loadEncryptedKeystore(
-          account.keystorePath
-        );
-        const unlock = await KeystoreManager.decryptEncryptedKeystore(
-          keystore,
-          DEV_ACCOUNTS_PASSWORD
-        );
-        if (unlock.success && unlock.payload) {
-          pkValue = unlock.payload.privateKey;
-        }
-      } catch (e) {
-      }
-    }
-    if (!pkValue) {
-      const err = new Error(
-        `DEV_ACCOUNT_KEY_UNAVAILABLE: Missing required private key for account '${account.name}'.`
-      );
-      err.code = "DEV_ACCOUNT_KEY_UNAVAILABLE";
-      throw err;
-    }
-    if (typeof pkValue !== "string" || pkValue.trim() === "" || !/^[0-9a-fA-F]{64}$/.test(pkValue)) {
-      const err = new Error(
-        "INVALID_PRIVATE_KEY_MATERIAL: Private key must be a valid 64-character hex string."
-      );
-      err.code = "INVALID_PRIVATE_KEY_MATERIAL";
-      throw err;
-    }
-    try {
-      const privateKey = new sdk.PrivateKey(pkValue);
-      const utxos = plan.inputs.map((u) => {
-        if (!u.outpoint.transactionId || u.outpoint.index === void 0) {
-          throw new Error(`UTXO is missing transactionId or index. Re-run tx plan.`);
-        }
-        const spk = u.scriptPublicKey;
-        if (!spk) {
-          throw new Error(
-            "UTXO is missing scriptPublicKey. Real signing flows must never fabricate cryptographic state."
-          );
-        }
-        return {
-          address: plan.from.address,
-          outpoint: {
-            transactionId: u.outpoint.transactionId,
-            index: u.outpoint.index
-          },
-          utxoEntry: {
-            amount: BigInt(u.amountSompi),
-            scriptPublicKey: spk,
-            blockDaaScore: BigInt(u.blockDaaScore || "0"),
-            isCoinbase: !!u.isCoinbase
-          }
-        };
-      });
-      const outputs = plan.outputs.map((o) => {
-        if (!o.address) throw new Error("Output is missing address.");
-        return {
-          address: o.address,
-          amount: BigInt(o.amountSompi)
-        };
-      });
-      const changeAddress = plan.change?.address ? new sdk.Address(plan.change.address) : void 0;
-      const priorityFee = BigInt(plan.estimatedFeeSompi);
-      const unsignedTx = sdk.createTransaction(
-        utxos,
-        outputs,
-        changeAddress,
-        priorityFee
-      );
-      const signedTx = sdk.signTransaction(unsignedTx, [privateKey], true);
-      const rawTx = JSON.stringify(parseWasmTxToRpc(signedTx.toString()));
-      return {
-        signatureKind: "kaspa-private-key",
-        signerAddress: account.address || privateKey.toAddress(plan.networkId).toString(),
-        signedTransaction: {
-          format: "hex",
-          payload: rawTx
-        },
-        txId: signedTx.id,
-        signature: {
-          // We use the txid as the signature identifier in the artifact
-          value: signedTx.id || calculateContentHash(plan)
-        }
-      };
-    } catch (error) {
-      throw new Error(
-        `Kaspa WASM signing failed: ${error instanceof Error ? error.message : String(error)}`
-      );
-    }
-  }
-};
-function assertSigningNetworkAllowed(input) {
-  const isMainnet = input.network === "mainnet";
-  if (isMainnet && !input.allowMainnet) {
-    throw new Error(
-      "Mainnet signing is disabled by default. Use --allow-mainnet-signing only if you understand the risks."
-    );
-  }
-}
-
-// src/signer.ts
-var SimulatedTxPlanSigner = class {
-  kind = "simulated";
-  async signTxPlan(input) {
-    const plan = input.planArtifact;
-    return {
-      signatureKind: "simulated",
-      signerAddress: plan.from.address,
-      signedTransaction: {
-        format: "simulated",
-        payload: `simulated-signed-tx:${plan.planId}`
-      }
-    };
-  }
-};
 var UnsupportedRealKaspaSigner = class {
   kind = "unsupported";
   async signTxPlan(_input) {
@@ -1069,55 +134,52 @@ var UnsupportedRealKaspaSigner = class {
   }
 };
 async function signTxPlanArtifact(input) {
-  const { planArtifact, account } = input;
+  const { planArtifact, account, authorizers } = input;
   const planRecord = planArtifact;
   if (planArtifact.schema === "hardkas.txPlan") {
   } else if (planRecord.status !== "built" && planRecord.status !== "unsigned") {
     throw new Error(`Cannot sign artifact with status: ${planRecord.status}`);
   }
   if (planArtifact.mode === "simulated") {
-    if (account.kind !== "simulated") {
-      throw new Error(
-        `Simulated plans must be signed with simulated accounts (account '${account.name}' is '${account.kind}').`
-      );
-    }
-  } else {
-    if (account.kind === "simulated") {
-      throw new Error(
-        `Real Kaspa transaction plans (mode: ${planArtifact.mode}) cannot be signed with simulated accounts.`
-      );
-    }
+    return createSimulatedSignedTxArtifact(
+      planArtifact,
+      `simulated-signed-tx:${planArtifact.planId}`,
+      systemRuntimeContext
+    );
   }
   if (planArtifact.networkId === "mainnet" && !input.allowMainnet) {
     throw new Error(
       "Mainnet signing is disabled by default. Use --allow-mainnet-signing only if you understand the risks."
     );
   }
-  if (account.kind === "simulated") {
-    return createSimulatedSignedTxArtifact(
-      planArtifact,
-      `simulated-signed-tx:${planArtifact.planId}`,
-      systemRuntimeContext
+  if (account && account.kind === "simulated") {
+    throw new Error(
+      `Real Kaspa transaction plans (mode: ${planArtifact.mode}) cannot be signed with simulated accounts.`
     );
   }
-  if (account.kind === "kaspa-private-key") {
-    const status = await getKaspaSigningBackendStatus();
+  if (!account || account.kind === "kaspa-private-key" || typeof account.authorize === "function") {
+    const status = await getKaspaSigningBackendStatus(input.config?.wasm);
     if (!status.available) {
       throw new Error(
         `Real Kaspa signing is not available: ${status.error || "Unknown error"}. Ensure 'kaspa' package is installed.`
       );
     }
-    const signer = new KaspaWasmPrivateKeySigner({
+    const signerOptions = {
       account,
       allowMainnet: input.allowMainnet
-    });
+    };
+    if (input.config?.wasm) {
+      signerOptions.wasmConfig = input.config.wasm;
+    }
+    const signer = new KaspaWasmPrivateKeySigner(signerOptions);
     const result = await signer.signTxPlan({
       planArtifact,
-      accountName: account.name
+      ...account?.name ? { accountName: account.name } : {},
+      ...input.authorizers ? { authorizers: input.authorizers } : {}
     });
     const artifact = {
       schema: "hardkas.signedTx",
-      hardkasVersion: HARDKAS_VERSION2,
+      hardkasVersion: HARDKAS_VERSION,
       version: "1.0.0-alpha",
       status: "signed",
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -1140,7 +202,7 @@ async function signTxPlanArtifact(input) {
       ...planArtifact.networkProfileRef ? { networkProfileRef: planArtifact.networkProfileRef } : {},
       ...planArtifact.assumptionRef ? { assumptionRef: planArtifact.assumptionRef } : {}
     };
-    const contentHash = calculateContentHash2(artifact);
+    const contentHash = calculateContentHash(artifact);
     artifact.signedId = `signed-${contentHash.slice(0, 16)}`;
     artifact.contentHash = contentHash;
     if (artifact.lineage) {
@@ -1148,16 +210,16 @@ async function signTxPlanArtifact(input) {
     }
     return artifact;
   }
-  if (account.kind === "external-wallet") {
+  if (account && account.kind === "external-wallet") {
     throw new Error("External wallet signing is not implemented yet.");
   }
-  if (account.kind === "evm-private-key") {
+  if (account && account.kind === "evm-private-key") {
     throw new Error(
       "EVM accounts are reserved for future Igra support and cannot sign Kaspa L1 transactions."
     );
   }
   const accountRecord = account;
-  throw new Error(`Unsupported account kind for signing: ${accountRecord.kind}`);
+  throw new Error(`Unsupported account kind for signing: ${accountRecord ? accountRecord.kind : "unknown"}`);
 }
 
 // src/kaspa-sdk-keygen.ts
@@ -1186,8 +248,8 @@ var KaspaSdkKeyGenerator = class {
     const network = options?.networkId || this.networkId;
     try {
       if (typeof sdk.PrivateKey === "function") {
-        const crypto3 = await import("crypto");
-        const randomBytes = crypto3.randomBytes(32);
+        const crypto = await import("crypto");
+        const randomBytes = crypto.randomBytes(32);
         const hex = randomBytes.toString("hex");
         const privKey = new sdk.PrivateKey(hex);
         const kp = privKey.toKeypair();
@@ -1224,173 +286,6 @@ async function createLocalKaspaWallet(options) {
   return await keygen.generateAccount();
 }
 
-// src/fixture-signer.ts
-import {
-  calculateContentHash as calculateContentHash3,
-  HARDKAS_VERSION as HARDKAS_VERSION3,
-  ARTIFACT_VERSION as ARTIFACT_VERSION2,
-  CURRENT_HASH_VERSION
-} from "@hardkas/artifacts";
-function toHex2(arr) {
-  return Buffer.from(arr).toString("hex");
-}
-function parseWasmTxToRpc2(wasmTxStr) {
-  let parsed = JSON.parse(wasmTxStr);
-  while (typeof parsed === "string") {
-    parsed = JSON.parse(parsed);
-  }
-  const txInner = parsed.tx ? parsed.tx.inner : parsed.inner;
-  if (!txInner) throw new Error("Could not find inner tx data");
-  return {
-    version: txInner.version || 0,
-    inputs: (txInner.inputs || []).map((i) => ({
-      previousOutpoint: {
-        transactionId: i.inner.previousOutpoint.inner.transactionId,
-        index: i.inner.previousOutpoint.inner.index
-      },
-      signatureScript: toHex2(i.inner.signatureScript),
-      sequence: i.inner.sequence || 0,
-      sigOpCount: i.inner.sigOpCount || 1
-    })),
-    outputs: (txInner.outputs || []).map((o) => ({
-      value: o.inner.value,
-      scriptPublicKey: {
-        version: parseInt(o.inner.scriptPublicKey.substring(0, 4), 16) || 0,
-        script: o.inner.scriptPublicKey.substring(4)
-      }
-    })),
-    lockTime: txInner.lockTime || 0,
-    subnetworkId: txInner.subnetworkId || "0000000000000000000000000000000000000000",
-    gas: txInner.gas || 0,
-    payload: txInner.payload && txInner.payload.length > 0 ? toHex2(txInner.payload) : "",
-    mass: txInner.mass || 0
-  };
-}
-var HardkasFixtureSigner = class {
-  networkId;
-  // A deterministic, known private key exclusively for Docker tests.
-  FIXTURE_PK = "b7e151628aed2a6abf7158809cf4f3c762e7160f38b4da56a784d9045190cfef";
-  constructor(networkId = "simnet") {
-    this.networkId = networkId;
-    if (networkId === "mainnet") {
-      throw new Error("FixtureSigner cannot be used on mainnet.");
-    }
-  }
-  async loadKaspa() {
-    try {
-      return await import("kaspa-wasm");
-    } catch (e) {
-      const err = new Error(
-        "SIGNER_BACKEND_UNAVAILABLE: Official Kaspa WASM backend is required to sign transactions.\nInstall it via: npm install kaspa-wasm"
-      );
-      err.code = "SIGNER_BACKEND_UNAVAILABLE";
-      throw err;
-    }
-  }
-  async getAddress() {
-    const kaspa = await this.loadKaspa();
-    const privKey = new kaspa.PrivateKey(this.FIXTURE_PK);
-    return privKey.toKeypair().toAddress(this.networkId).toString();
-  }
-  async signTransaction(plan) {
-    if (plan.networkId === "mainnet") {
-      throw new Error("FixtureSigner refuses to sign mainnet transactions.");
-    }
-    const kaspa = await this.loadKaspa();
-    const privateKey = new kaspa.PrivateKey(this.FIXTURE_PK);
-    const utxos = plan.inputs.map((u) => {
-      if (!u.outpoint.transactionId || u.outpoint.index === void 0) {
-        throw new Error(`UTXO is missing transactionId or index. Re-run tx plan.`);
-      }
-      const spk = u.scriptPublicKey;
-      if (!spk) {
-        throw new Error(
-          "UTXO is missing scriptPublicKey. Real signing flows must never fabricate cryptographic state."
-        );
-      }
-      return {
-        address: plan.from.address,
-        outpoint: {
-          transactionId: u.outpoint.transactionId,
-          index: u.outpoint.index
-        },
-        utxoEntry: {
-          amount: BigInt(u.amountSompi),
-          scriptPublicKey: spk,
-          blockDaaScore: BigInt(u.blockDaaScore || "0"),
-          isCoinbase: !!u.isCoinbase
-        }
-      };
-    });
-    const outputs = plan.outputs.map((o) => {
-      if (!o.address) throw new Error("Output is missing address.");
-      return {
-        address: o.address,
-        amount: BigInt(o.amountSompi)
-      };
-    });
-    let changeAddress;
-    if (plan.change && plan.change.address) {
-      changeAddress = new kaspa.Address(plan.change.address);
-    } else {
-      changeAddress = new kaspa.Address(plan.from.address);
-    }
-    const priorityFee = BigInt(plan.estimatedFeeSompi || "0");
-    const unsignedTx = kaspa.createTransaction(
-      utxos,
-      outputs,
-      changeAddress,
-      priorityFee
-    );
-    const signedTx = kaspa.signTransaction(unsignedTx, [privateKey], true);
-    console.log("SIGNED TX TOSTRING:", signedTx.toString());
-    const rawTx = JSON.stringify(parseWasmTxToRpc2(signedTx.toString()));
-    const draft = {
-      schema: "hardkas.signedTx",
-      schemaVersion: "hardkas.artifact.v1",
-      hardkasVersion: HARDKAS_VERSION3,
-      version: ARTIFACT_VERSION2,
-      hashVersion: CURRENT_HASH_VERSION,
-      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      status: "signed",
-      txId: signedTx.id,
-      sourcePlanId: plan.planId,
-      networkId: plan.networkId,
-      mode: plan.mode,
-      from: plan.from,
-      to: plan.to,
-      amountSompi: plan.amountSompi,
-      unsignedPayloadHash: plan.contentHash,
-      signedTransaction: {
-        format: "hex",
-        payload: rawTx
-      },
-      metadata: {
-        signerBackend: "kaspa-wasm",
-        fixture: true,
-        networkGuard: "mainnet_rejected"
-      },
-      signatureMetadata: [
-        {
-          signer: "hardkas-local-docker-test-only",
-          signedAt: (/* @__PURE__ */ new Date()).toISOString()
-        }
-      ],
-      lineage: {
-        artifactId: "",
-        lineageId: plan.lineage?.lineageId || plan.contentHash || "0".repeat(64),
-        parentArtifactId: plan.contentHash || plan.planId,
-        rootArtifactId: plan.lineage?.rootArtifactId || plan.contentHash || plan.planId
-      }
-    };
-    const hash = calculateContentHash3(draft, CURRENT_HASH_VERSION);
-    draft.signedId = `signed-${hash.slice(0, 16)}`;
-    draft.contentHash = hash;
-    if (draft.lineage) draft.lineage.artifactId = hash;
-    return draft;
-  }
-};
-
 // src/real-signer.ts
 var UnsupportedRealTxSigner = class {
   async sign() {
@@ -1424,11 +319,6 @@ var KaspaSdkRealTxSigner = class {
     if (!account.privateKey) {
       throw new Error("Account has no private key available for signing.");
     }
-    if (plan.from.address !== account.address) {
-      throw new Error(
-        `Address mismatch: Plan requires ${plan.from.address}, but account has ${account.address}.`
-      );
-    }
     try {
       const privateKey = new sdk.PrivateKey(account.privateKey);
       const utxos = plan.inputs.map((u) => {
@@ -1437,19 +327,30 @@ var KaspaSdkRealTxSigner = class {
             `UTXO ${u.outpoint.transactionId}:${u.outpoint.index} is missing scriptPublicKey required for signing.`
           );
         }
-        const spk = u.scriptPublicKey;
-        return new sdk.UtxoEntry(
-          BigInt(u.amountSompi),
-          spk,
-          u.outpoint.transactionId,
-          u.outpoint.index,
-          plan.from.address
-        );
+        let spkHex = String(u.scriptPublicKey);
+        let spkVersion = 0;
+        if (spkHex.length >= 68) {
+          spkVersion = parseInt(spkHex.slice(0, 4), 16) || 0;
+          spkHex = spkHex.slice(4);
+        }
+        return {
+          address: account.address,
+          outpoint: {
+            transactionId: u.outpoint.transactionId,
+            index: u.outpoint.index
+          },
+          utxoEntry: {
+            amount: BigInt(u.amountSompi),
+            scriptPublicKey: new sdk.ScriptPublicKey(spkVersion, spkHex),
+            blockDaaScore: BigInt(u.blockDaaScore ?? 0),
+            isCoinbase: u.isCoinbase ?? false
+          }
+        };
       });
-      const outputs = [
-        new sdk.PaymentOutput(new sdk.Address(plan.to.address), BigInt(plan.amountSompi))
-      ];
-      const changeAddress = plan.change ? new sdk.Address(plan.change.address) : void 0;
+      const outputs = plan.outputs.map(
+        (o) => new sdk.PaymentOutput(new sdk.Address(o.address), BigInt(o.amountSompi))
+      );
+      const changeAddress = plan.change ? plan.change.address : account.address;
       const priorityFee = BigInt(plan.estimatedFeeSompi);
       const unsignedTx = sdk.createTransaction(
         utxos,
@@ -1458,17 +359,22 @@ var KaspaSdkRealTxSigner = class {
         priorityFee
       );
       const signedTx = sdk.signTransaction(unsignedTx, [privateKey], true);
-      const payload = signedTx.serialize ? signedTx.serialize() : JSON.stringify(signedTx.toRpcTransaction());
-      const txId = signedTx.id;
+      const innerTx = signedTx.tx || signedTx;
+      const txId = innerTx?.id;
+      const payload = JSON.stringify(
+        innerTx.toJSON(),
+        (_k, v) => typeof v === "bigint" ? v.toString() : v
+      );
       return {
         signedTransaction: {
           format: "kaspa-sdk",
-          payload
+          payload,
+          raw: innerTx
         },
         txId
       };
     } catch (e) {
-      const msg = e instanceof Error ? e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e) : String(e);
+      const msg = e instanceof Error ? e.message : String(e);
       if (msg.includes("is not a constructor") || msg.includes("is not a function")) {
         throw new Error(
           `Kaspa SDK signer adapter could not find required transaction signing primitives: ${msg}`
@@ -1489,8 +395,8 @@ var UnsupportedKaspaKeyGenerator = class {
 };
 
 // src/keystore-lock.ts
-import fs5 from "fs";
-import path5 from "path";
+import fs from "fs";
+import path from "path";
 async function withKeystoreLock(filePath, operation) {
   const lockFilePath = `${filePath}.lock`;
   const staleTimeoutMs = parseInt(process.env.HARDKAS_KEYSTORE_LOCK_STALE_MS || "30000", 10);
@@ -1498,15 +404,15 @@ async function withKeystoreLock(filePath, operation) {
   const start = Date.now();
   while (true) {
     try {
-      fs5.mkdirSync(path5.dirname(lockFilePath), { recursive: true });
-      fs5.writeFileSync(lockFilePath, process.pid.toString(), { flag: "wx" });
+      fs.mkdirSync(path.dirname(lockFilePath), { recursive: true });
+      fs.writeFileSync(lockFilePath, process.pid.toString(), { flag: "wx" });
       break;
     } catch (err) {
       if (err.code === "EEXIST") {
-        const stats = fs5.statSync(lockFilePath, { throwIfNoEntry: false });
+        const stats = fs.statSync(lockFilePath, { throwIfNoEntry: false });
         if (stats && Date.now() - stats.mtimeMs > staleTimeoutMs) {
           try {
-            fs5.unlinkSync(lockFilePath);
+            fs.unlinkSync(lockFilePath);
           } catch (e) {
           }
           continue;
@@ -1527,39 +433,41 @@ async function withKeystoreLock(filePath, operation) {
     return await operation();
   } finally {
     try {
-      fs5.unlinkSync(lockFilePath);
+      fs.unlinkSync(lockFilePath);
     } catch (e) {
     }
   }
 }
 async function appendToKeystoreJson(workspaceRoot, alias, accountData) {
-  const keystorePath = path5.join(workspaceRoot, ".hardkas", "keystore.json");
-  const tempPath = path5.join(workspaceRoot, ".hardkas", `keystore-${process.pid}-${Date.now()}.json.tmp`);
+  const keystorePath = path.join(workspaceRoot, ".hardkas", "keystore.json");
+  const tempPath = path.join(workspaceRoot, ".hardkas", `keystore-${process.pid}-${Date.now()}.json.tmp`);
   await withKeystoreLock(keystorePath, async () => {
     let ks = {};
-    if (fs5.existsSync(keystorePath)) {
+    if (fs.existsSync(keystorePath)) {
       try {
-        const data = await fs5.promises.readFile(keystorePath, "utf-8");
+        const data = await fs.promises.readFile(keystorePath, "utf-8");
         ks = JSON.parse(data);
       } catch (e) {
       }
     }
     ks[alias] = accountData;
-    const fd = await fs5.promises.open(tempPath, "w");
+    const fd = await fs.promises.open(tempPath, "w");
     try {
       await fd.writeFile(JSON.stringify(ks, null, 2));
       await fd.sync();
     } finally {
       await fd.close();
     }
-    await fs5.promises.rename(tempPath, keystorePath);
-    const written = await fs5.promises.readFile(keystorePath, "utf-8");
+    await fs.promises.rename(tempPath, keystorePath);
+    const written = await fs.promises.readFile(keystorePath, "utf-8");
     JSON.parse(written);
   });
 }
 
 // src/address-manager.ts
 import { createHash } from "crypto";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
 function resolveChain(chain) {
   if (chain === "receive" || chain === 0) return 0;
   if (chain === "change" || chain === 1) return 1;
@@ -1588,9 +496,16 @@ var AddressManager = {
       addressIndex: opts.addressIndex
     });
     const payload = `${opts.seedRef}:${derivationPath}:${network}`;
-    const hash = createHash("sha256").update(payload).digest("hex").slice(0, 42);
-    const prefix = network.includes("sim") ? "kaspasim" : "kaspatest";
-    const address = `${prefix}:q${hash}`;
+    const hash = createHash("sha256").update(payload).digest("hex");
+    let address;
+    try {
+      const kaspa = require2("kaspa-wasm");
+      const priv = new kaspa.PrivateKey(hash);
+      address = priv.toKeypair().toAddress(network).toString();
+    } catch (e) {
+      const prefix = network.includes("sim") ? "kaspasim" : "kaspatest";
+      address = `${prefix}:q${hash.slice(0, 42)}`;
+    }
     return {
       address,
       path: derivationPath,
@@ -1693,31 +608,31 @@ var WalletManagerImpl = class {
 var WalletManager = new WalletManagerImpl();
 
 // src/wallet-state-store.ts
-import * as fs6 from "fs";
-import * as path6 from "path";
+import * as fs2 from "fs";
+import * as path2 from "path";
 var WalletStateStoreJson = class {
   filePath;
   constructor(options) {
-    this.filePath = options?.filePath || path6.join(process.cwd(), ".hardkas", "wallet-state.json");
+    this.filePath = options?.filePath || path2.join(process.cwd(), ".hardkas", "wallet-state.json");
   }
   /**
    * Ensures the directory exists before saving.
    */
   ensureDir() {
-    const dir = path6.dirname(this.filePath);
-    if (!fs6.existsSync(dir)) {
-      fs6.mkdirSync(dir, { recursive: true });
+    const dir = path2.dirname(this.filePath);
+    if (!fs2.existsSync(dir)) {
+      fs2.mkdirSync(dir, { recursive: true });
     }
   }
   /**
    * Loads the entire state file into memory.
    */
   loadAll() {
-    if (!fs6.existsSync(this.filePath)) {
+    if (!fs2.existsSync(this.filePath)) {
       return {};
     }
     try {
-      return JSON.parse(fs6.readFileSync(this.filePath, "utf-8"));
+      return JSON.parse(fs2.readFileSync(this.filePath, "utf-8"));
     } catch (e) {
       process.stderr.write(`[WalletStateStore] corrupt state file at ${this.filePath} \u2014 resetting indices to 0. Cause: ${e}
 `);
@@ -1730,8 +645,8 @@ var WalletStateStoreJson = class {
   saveAll(data) {
     this.ensureDir();
     const tmp = this.filePath + ".tmp";
-    fs6.writeFileSync(tmp, JSON.stringify(data, null, 2), "utf-8");
-    fs6.renameSync(tmp, this.filePath);
+    fs2.writeFileSync(tmp, JSON.stringify(data, null, 2), "utf-8");
+    fs2.renameSync(tmp, this.filePath);
   }
   /**
    * Retrieves the state for a specific wallet.
@@ -1773,13 +688,14 @@ var WalletStateStoreJson = class {
 export {
   AddressManager,
   DEV_ACCOUNTS_PASSWORD,
-  HardkasFixtureSigner,
   KaspaSdkKeyGenerator,
   KaspaSdkRealTxSigner,
   KaspaWasmPrivateKeySigner,
   KeystoreManager,
+  LazyAccountAuthorizer,
+  PrivateKeyAuthorizer,
   SimulatedSigner,
-  SimulatedTxPlanSigner,
+  StaticSignatureScriptAuthorizer,
   UnsupportedKaspaKeyGenerator,
   UnsupportedRealKaspaSigner,
   UnsupportedRealTxSigner,
@@ -1788,9 +704,11 @@ export {
   WalletStateStoreJson,
   appendToKeystoreJson,
   assertSigningNetworkAllowed,
+  createDevSigner,
   createEmptyRealAccountStore,
   createLocalKaspaWallet,
   describeAccount,
+  detectCapabilities,
   ensureDevAccounts,
   getDefaultRealAccountsPath,
   getKaspaSigningBackendStatus,