@laceio/sdk 0.1.1 → 0.1.2-canary.0

package/dist/signer-factory-BA7WFJVZ.js

@@ -0,0 +1,282 @@
+import { a as __toESM } from "./rolldown-runtime-OvD0k9op.js";
+import "./_web-crypto-random-bytes-Bo-GTcRS.js";
+import { n as import_buffer, r as init__polyfill_buffer_patch } from "./_polyfill-buffer-patch-yNxN4d5E.js";
+import "./libsodium-wrappers-BhbOA8dQ.js";
+import "./codecs-Dc1Krpbt.js";
+import { t as SecretBox } from "./secret-box-DUR0ACYz.js";
+import { c as require_dist, l as require_src, s as BitcoinNetworkId, t as AddressType } from "./address-B9ntKL8K.js";
+import "./safe-buffer-B_vMqJWU.js";
+import { n as deriveAccountRootKeyPair, r as deriveChildKeyPair, t as ChainType } from "./keyDerivation-D3k9XyHg.js";
+import "./browser-B1eMbDwh.js";
+import { n as HexBytes } from "./bytes.vo-BB7_4JK6.js";
+import { t as Redacted } from "./redacted-BmE2aXqr.js";
+import { t as AuthenticationCancelledError } from "./types-CJT6XF2c.js";
+import { n as BitcoinNetwork } from "./types-B8uiJn-X.js";
+import { t as signBitcoinTransactionWithSeed } from "./sign-bitcoin-transaction-with-seed-D4z62-jV.js";
+import { from, switchMap, throwError } from "rxjs";
+//#region ../../packages/module/blockchain-bitcoin/src/signing/varint.ts
+var import_dist = /* @__PURE__ */ __toESM(require_dist());
+var import_src = /* @__PURE__ */ __toESM(require_src());
+init__polyfill_buffer_patch();
+/** Encodes a length as a Bitcoin varint. */
+const varint = (length) => {
+	if (length < 253) return import_buffer.Buffer.from([length]);
+	if (length <= 65535) {
+		const buffer = import_buffer.Buffer.alloc(3);
+		buffer[0] = 253;
+		buffer.writeUInt16LE(length, 1);
+		return buffer;
+	}
+	const buffer = import_buffer.Buffer.alloc(5);
+	buffer[0] = 254;
+	buffer.writeUInt32LE(length, 1);
+	return buffer;
+};
+/** Encodes a string as its varint byte length followed by its UTF-8 bytes. */
+const varstr = (text) => {
+	const bytes = import_buffer.Buffer.from(text, "utf8");
+	return import_buffer.Buffer.concat([varint(bytes.length), bytes]);
+};
+//#endregion
+//#region ../../packages/module/blockchain-bitcoin/src/signing/bip137-sign-message.ts
+init__polyfill_buffer_patch();
+const MESSAGE_MAGIC = "Bitcoin Signed Message:\n";
+/**
+* Header base for the compact signature: 27 + 4. The +4 marks a compressed
+* public key, giving the 31-34 header range that Unisat and Electrum emit
+* for segwit addresses. BIP-137's bech32 range (39-42) is deliberately not
+* used because many verifiers reject it.
+*/
+const COMPRESSED_HEADER_BASE = 31;
+/**
+* Computes the Bitcoin signed-message digest:
+* `sha256d(varstr("Bitcoin Signed Message:\n") || varstr(message))`.
+*/
+const magicHash = (message) => import_src.crypto.hash256(import_buffer.Buffer.concat([varstr(MESSAGE_MAGIC), varstr(message)]));
+/**
+* Signs a message using the BIP-137 compact recoverable ECDSA scheme.
+*
+* Signs the magic hash of the message with RFC 6979 deterministic ECDSA and
+* returns the hex-encoded 65-byte compact signature header || r || s, where
+* header = 27 + recoveryId + 4 (compressed public key).
+*/
+const bip137SignMessage = (params, request) => {
+	const digest = magicHash(request.message);
+	const { signature, recoveryId } = import_dist.signRecoverable(new Uint8Array(digest), new Uint8Array(params.privateKey));
+	return { signature: HexBytes(import_buffer.Buffer.concat([import_buffer.Buffer.from([COMPRESSED_HEADER_BASE + recoveryId]), import_buffer.Buffer.from(signature)]).toString("hex")) };
+};
+//#endregion
+//#region ../../packages/module/blockchain-bitcoin/src/signing/bip322-sign-data.ts
+init__polyfill_buffer_patch();
+import_src.initEccLib(import_dist);
+const BIP322_TAG = "BIP0322-signed-message";
+/**
+* Computes the BIP-322 tagged message hash.
+*
+* Uses BIP-340 tagged hashing: SHA256(SHA256(tag) || SHA256(tag) || message).
+*/
+const bip322MessageHash = (message) => {
+	const tagHash = import_src.crypto.sha256(import_buffer.Buffer.from(BIP322_TAG, "utf8"));
+	const prefix = import_buffer.Buffer.concat([tagHash, tagHash]);
+	return import_src.crypto.sha256(import_buffer.Buffer.concat([prefix, import_buffer.Buffer.from(message, "utf8")]));
+};
+/**
+* Builds the BIP-322 virtual "to_spend" transaction.
+*
+* This transaction embeds the message hash in its scriptSig and the
+* signing address's scriptPubKey as its output. It is never broadcast —
+* it exists only to create a spendable output for the "to_sign" transaction.
+*/
+const buildToSpend = (messageHash, outputScript) => {
+	const tx = new import_src.Transaction();
+	tx.version = 0;
+	tx.locktime = 0;
+	tx.addInput(import_buffer.Buffer.alloc(32, 0), 4294967295, 0, import_buffer.Buffer.concat([import_buffer.Buffer.from([0, 32]), messageHash]));
+	tx.addOutput(outputScript, 0);
+	return tx;
+};
+/**
+* Serializes a witness stack into the BIP-322 Simple proof format.
+*
+* Format: varint(item_count) (varint(item_length) item_bytes)*
+* For P2WPKH: 2 items, an ECDSA signature with SIGHASH_ALL and the compressed
+* public key.
+*/
+const serializeWitness = (witness) => {
+	const parts = [varint(witness.length)];
+	for (const item of witness) parts.push(varint(item.length), item);
+	return import_buffer.Buffer.concat(parts);
+};
+/**
+* Signs a message using BIP-322 Generic Signed Message Format (P2WPKH Simple proof).
+*
+* Constructs the virtual to_spend/to_sign transaction pair per BIP-322,
+* signs with the provided key using BIP-143 segwit v0 digest, and returns
+* the serialized witness stack as a hex-encoded string.
+*/
+const bip322SignData = (params, request) => {
+	const { privateKey, publicKey, network } = params;
+	const messageHash = bip322MessageHash(request.message);
+	const outputScript = import_src.address.toOutputScript(request.address, network);
+	const toSpend = buildToSpend(messageHash, outputScript);
+	const psbt = new import_src.Psbt({ network });
+	psbt.setVersion(0);
+	psbt.setLocktime(0);
+	psbt.addInput({
+		hash: toSpend.getHash(),
+		index: 0,
+		sequence: 0,
+		witnessUtxo: {
+			script: outputScript,
+			value: 0
+		}
+	});
+	psbt.addOutput({
+		script: import_buffer.Buffer.from([106]),
+		value: 0
+	});
+	const signer = {
+		publicKey,
+		sign: (hash) => import_buffer.Buffer.from(import_dist.sign(new Uint8Array(hash), new Uint8Array(privateKey)))
+	};
+	psbt.signInput(0, signer);
+	psbt.finalizeInput(0);
+	const witness = psbt.extractTransaction().ins[0].witness;
+	return { signature: HexBytes(serializeWitness(witness).toString("hex")) };
+};
+//#endregion
+//#region ../../packages/module/blockchain-bitcoin/src/signing/bitcoin-in-memory-data-signer.ts
+init__polyfill_buffer_patch();
+/**
+* Signs arbitrary messages using BIP-137 compact recoverable ECDSA (the
+* default) or BIP-322 Generic Signed Message Format, selected by the
+* request's signatureType.
+*
+* Follows the same authentication and key derivation pattern as
+* BitcoinInMemoryTransactionSigner: triggers user authentication,
+* decrypts the root private key, derives the P2WPKH signing key,
+* and produces the requested proof.
+*/
+var BitcoinInMemoryDataSigner = class {
+	#encryptedRootPrivateKey;
+	#auth;
+	#network;
+	#accountIndex;
+	constructor(props) {
+		this.#encryptedRootPrivateKey = props.encryptedRootPrivateKey;
+		this.#auth = props.auth;
+		this.#network = props.network;
+		this.#accountIndex = props.accountIndex;
+	}
+	signData(request) {
+		return this.#auth.authenticate().pipe(switchMap((confirmed) => {
+			if (!confirmed) return throwError(() => new AuthenticationCancelledError());
+			return this.#auth.accessAuthSecret((authSecret) => from(this.#signData(authSecret, request)));
+		}));
+	}
+	async #signData(authSecret, request) {
+		let rootPrivateKey = null;
+		try {
+			const encryptedSeed = import_buffer.Buffer.from(this.#encryptedRootPrivateKey, "hex");
+			const decryptedBytes = await SecretBox.open(encryptedSeed, authSecret);
+			rootPrivateKey = Redacted.make(import_buffer.Buffer.from(decryptedBytes));
+			const childKeyPair = deriveChildKeyPair(deriveAccountRootKeyPair({
+				seed: Redacted.value(rootPrivateKey),
+				addressType: AddressType.NativeSegWit,
+				network: this.#network,
+				account: this.#accountIndex
+			}).pair.privateKey, ChainType.External, 0);
+			const bitcoinJsNetwork = this.#network === BitcoinNetwork.Mainnet ? import_src.networks.bitcoin : import_src.networks.testnet;
+			const derivedAddress = import_src.payments.p2wpkh({
+				pubkey: import_buffer.Buffer.from(childKeyPair.pair.publicKey, "hex"),
+				network: bitcoinJsNetwork
+			}).address;
+			if (derivedAddress !== request.address) throw new Error(`Address mismatch: requested ${request.address} but derived key produces ${derivedAddress}`);
+			const childPrivateKey = import_buffer.Buffer.from(childKeyPair.pair.privateKey, "hex");
+			try {
+				if (request.signatureType === "bip322-simple") return bip322SignData({
+					privateKey: childPrivateKey,
+					publicKey: import_buffer.Buffer.from(childKeyPair.pair.publicKey, "hex"),
+					network: bitcoinJsNetwork
+				}, request);
+				return bip137SignMessage({ privateKey: childPrivateKey }, request);
+			} finally {
+				childPrivateKey.fill(0);
+			}
+		} finally {
+			if (rootPrivateKey) Redacted.unsafeWipe(rootPrivateKey);
+		}
+	}
+};
+//#endregion
+//#region ../../packages/module/blockchain-bitcoin/src/signing/bitcoin-in-memory-transaction-signer.ts
+init__polyfill_buffer_patch();
+/** Signs Bitcoin transactions using an in-memory wallet. */
+var BitcoinInMemoryTransactionSigner = class {
+	#encryptedRootPrivateKey;
+	#auth;
+	constructor(params) {
+		this.#encryptedRootPrivateKey = params.encryptedRootPrivateKey;
+		this.#auth = params.auth;
+	}
+	sign(request) {
+		return this.#auth.authenticate().pipe(switchMap((confirmed) => {
+			if (!confirmed) return throwError(() => new AuthenticationCancelledError());
+			return this.#auth.accessAuthSecret((authSecret) => from(this.#signTransaction(request.serializedTx, this.#encryptedRootPrivateKey, authSecret)));
+		}));
+	}
+	async #signTransaction(serializedTx, encryptedRootPrivateKey, authSecret) {
+		let rootPrivateKey = null;
+		try {
+			const encryptedSeed = import_buffer.Buffer.from(encryptedRootPrivateKey, "hex");
+			const decryptedBytes = await SecretBox.open(encryptedSeed, authSecret);
+			rootPrivateKey = Redacted.make(import_buffer.Buffer.from(decryptedBytes));
+			return signBitcoinTransactionWithSeed(serializedTx, Redacted.value(rootPrivateKey));
+		} finally {
+			if (rootPrivateKey) Redacted.unsafeWipe(rootPrivateKey);
+		}
+	}
+};
+//#endregion
+//#region ../../packages/module/blockchain-bitcoin/src/signing/bitcoin-in-memory-signer-factory.ts
+var BitcoinInMemorySignerFactory = class {
+	canSign(account) {
+		return account.accountType === "InMemory" && account.blockchainName === "Bitcoin";
+	}
+	createTransactionSigner(context) {
+		this.#assertSupported(context);
+		return new BitcoinInMemoryTransactionSigner({
+			encryptedRootPrivateKey: this.#extractEncryptedRootPrivateKey(context),
+			auth: context.auth
+		});
+	}
+	createDataSigner(context) {
+		const account = this.#assertSupported(context);
+		const encryptedRootPrivateKey = this.#extractEncryptedRootPrivateKey(context);
+		const networkId = account.blockchainSpecific.networkId;
+		const network = networkId ? BitcoinNetworkId.getBitcoinNetwork(networkId) : void 0;
+		if (!network) throw new Error(`Cannot resolve Bitcoin network from networkId: ${String(networkId)}`);
+		return new BitcoinInMemoryDataSigner({
+			encryptedRootPrivateKey,
+			auth: context.auth,
+			network,
+			accountIndex: account.blockchainSpecific.accountIndex
+		});
+	}
+	#assertSupported(context) {
+		const account = context.wallet.accounts.find((a) => a.accountId === context.accountId);
+		if (!account || !this.canSign(account)) throw new Error(`BitcoinInMemorySignerFactory does not support account type: ${account?.accountType ?? "unknown"}`);
+		return account;
+	}
+	#extractEncryptedRootPrivateKey(context) {
+		const { wallet } = context;
+		const encryptedRootPrivateKey = wallet.blockchainSpecific.Bitcoin?.encryptedRootPrivateKey;
+		if (!encryptedRootPrivateKey) throw new Error("Wallet is missing Bitcoin encrypted root private key");
+		return encryptedRootPrivateKey;
+	}
+};
+//#endregion
+//#region ../../packages/module/blockchain-bitcoin/src/exposed-modules/signer-factory.ts
+const initSignerFactory = () => new BitcoinInMemorySignerFactory();
+//#endregion
+export { initSignerFactory as default };

package/dist/signer-factory-Cwd6o-lG.cjs

@@ -0,0 +1,281 @@
+const require_rolldown_runtime = require("./rolldown-runtime-Br2OG8yv.cjs");
+const require__polyfill_buffer_patch = require("./_polyfill-buffer-patch-CM8X7JiY.cjs");
+require("./codecs-Cswkg7Tm.cjs");
+const require_secret_box = require("./secret-box-DrjLZuS1.cjs");
+const require_address = require("./address-BXp-mY8H.cjs");
+require("./safe-buffer-DYOwEfHB.cjs");
+require("./pbkdf2-CIW-oWrm.cjs");
+const require_bytes_vo = require("./bytes.vo-BNRquqaO.cjs");
+const require_redacted = require("./redacted-CRZJLS3w.cjs");
+const require_types = require("./types-DWbVZpnF.cjs");
+const require_types$1 = require("./types-CLRUYpfe.cjs");
+const require_keyDerivation = require("./keyDerivation-u0nBA93T.cjs");
+require("./bn-d3nSOIf7.cjs");
+const require_sign_bitcoin_transaction_with_seed = require("./sign-bitcoin-transaction-with-seed-DsLYXnCY.cjs");
+let rxjs = require("rxjs");
+//#region ../../packages/module/blockchain-bitcoin/src/signing/varint.ts
+var import_dist = /* @__PURE__ */ require_rolldown_runtime.__toESM(require_address.require_dist());
+var import_src = /* @__PURE__ */ require_rolldown_runtime.__toESM(require_address.require_src());
+require__polyfill_buffer_patch.init__polyfill_buffer_patch();
+/** Encodes a length as a Bitcoin varint. */
+const varint = (length) => {
+	if (length < 253) return require__polyfill_buffer_patch.import_buffer.Buffer.from([length]);
+	if (length <= 65535) {
+		const buffer = require__polyfill_buffer_patch.import_buffer.Buffer.alloc(3);
+		buffer[0] = 253;
+		buffer.writeUInt16LE(length, 1);
+		return buffer;
+	}
+	const buffer = require__polyfill_buffer_patch.import_buffer.Buffer.alloc(5);
+	buffer[0] = 254;
+	buffer.writeUInt32LE(length, 1);
+	return buffer;
+};
+/** Encodes a string as its varint byte length followed by its UTF-8 bytes. */
+const varstr = (text) => {
+	const bytes = require__polyfill_buffer_patch.import_buffer.Buffer.from(text, "utf8");
+	return require__polyfill_buffer_patch.import_buffer.Buffer.concat([varint(bytes.length), bytes]);
+};
+//#endregion
+//#region ../../packages/module/blockchain-bitcoin/src/signing/bip137-sign-message.ts
+require__polyfill_buffer_patch.init__polyfill_buffer_patch();
+const MESSAGE_MAGIC = "Bitcoin Signed Message:\n";
+/**
+* Header base for the compact signature: 27 + 4. The +4 marks a compressed
+* public key, giving the 31-34 header range that Unisat and Electrum emit
+* for segwit addresses. BIP-137's bech32 range (39-42) is deliberately not
+* used because many verifiers reject it.
+*/
+const COMPRESSED_HEADER_BASE = 31;
+/**
+* Computes the Bitcoin signed-message digest:
+* `sha256d(varstr("Bitcoin Signed Message:\n") || varstr(message))`.
+*/
+const magicHash = (message) => import_src.crypto.hash256(require__polyfill_buffer_patch.import_buffer.Buffer.concat([varstr(MESSAGE_MAGIC), varstr(message)]));
+/**
+* Signs a message using the BIP-137 compact recoverable ECDSA scheme.
+*
+* Signs the magic hash of the message with RFC 6979 deterministic ECDSA and
+* returns the hex-encoded 65-byte compact signature header || r || s, where
+* header = 27 + recoveryId + 4 (compressed public key).
+*/
+const bip137SignMessage = (params, request) => {
+	const digest = magicHash(request.message);
+	const { signature, recoveryId } = import_dist.signRecoverable(new Uint8Array(digest), new Uint8Array(params.privateKey));
+	return { signature: require_bytes_vo.HexBytes(require__polyfill_buffer_patch.import_buffer.Buffer.concat([require__polyfill_buffer_patch.import_buffer.Buffer.from([COMPRESSED_HEADER_BASE + recoveryId]), require__polyfill_buffer_patch.import_buffer.Buffer.from(signature)]).toString("hex")) };
+};
+//#endregion
+//#region ../../packages/module/blockchain-bitcoin/src/signing/bip322-sign-data.ts
+require__polyfill_buffer_patch.init__polyfill_buffer_patch();
+import_src.initEccLib(import_dist);
+const BIP322_TAG = "BIP0322-signed-message";
+/**
+* Computes the BIP-322 tagged message hash.
+*
+* Uses BIP-340 tagged hashing: SHA256(SHA256(tag) || SHA256(tag) || message).
+*/
+const bip322MessageHash = (message) => {
+	const tagHash = import_src.crypto.sha256(require__polyfill_buffer_patch.import_buffer.Buffer.from(BIP322_TAG, "utf8"));
+	const prefix = require__polyfill_buffer_patch.import_buffer.Buffer.concat([tagHash, tagHash]);
+	return import_src.crypto.sha256(require__polyfill_buffer_patch.import_buffer.Buffer.concat([prefix, require__polyfill_buffer_patch.import_buffer.Buffer.from(message, "utf8")]));
+};
+/**
+* Builds the BIP-322 virtual "to_spend" transaction.
+*
+* This transaction embeds the message hash in its scriptSig and the
+* signing address's scriptPubKey as its output. It is never broadcast —
+* it exists only to create a spendable output for the "to_sign" transaction.
+*/
+const buildToSpend = (messageHash, outputScript) => {
+	const tx = new import_src.Transaction();
+	tx.version = 0;
+	tx.locktime = 0;
+	tx.addInput(require__polyfill_buffer_patch.import_buffer.Buffer.alloc(32, 0), 4294967295, 0, require__polyfill_buffer_patch.import_buffer.Buffer.concat([require__polyfill_buffer_patch.import_buffer.Buffer.from([0, 32]), messageHash]));
+	tx.addOutput(outputScript, 0);
+	return tx;
+};
+/**
+* Serializes a witness stack into the BIP-322 Simple proof format.
+*
+* Format: varint(item_count) (varint(item_length) item_bytes)*
+* For P2WPKH: 2 items, an ECDSA signature with SIGHASH_ALL and the compressed
+* public key.
+*/
+const serializeWitness = (witness) => {
+	const parts = [varint(witness.length)];
+	for (const item of witness) parts.push(varint(item.length), item);
+	return require__polyfill_buffer_patch.import_buffer.Buffer.concat(parts);
+};
+/**
+* Signs a message using BIP-322 Generic Signed Message Format (P2WPKH Simple proof).
+*
+* Constructs the virtual to_spend/to_sign transaction pair per BIP-322,
+* signs with the provided key using BIP-143 segwit v0 digest, and returns
+* the serialized witness stack as a hex-encoded string.
+*/
+const bip322SignData = (params, request) => {
+	const { privateKey, publicKey, network } = params;
+	const messageHash = bip322MessageHash(request.message);
+	const outputScript = import_src.address.toOutputScript(request.address, network);
+	const toSpend = buildToSpend(messageHash, outputScript);
+	const psbt = new import_src.Psbt({ network });
+	psbt.setVersion(0);
+	psbt.setLocktime(0);
+	psbt.addInput({
+		hash: toSpend.getHash(),
+		index: 0,
+		sequence: 0,
+		witnessUtxo: {
+			script: outputScript,
+			value: 0
+		}
+	});
+	psbt.addOutput({
+		script: require__polyfill_buffer_patch.import_buffer.Buffer.from([106]),
+		value: 0
+	});
+	const signer = {
+		publicKey,
+		sign: (hash) => require__polyfill_buffer_patch.import_buffer.Buffer.from(import_dist.sign(new Uint8Array(hash), new Uint8Array(privateKey)))
+	};
+	psbt.signInput(0, signer);
+	psbt.finalizeInput(0);
+	const witness = psbt.extractTransaction().ins[0].witness;
+	return { signature: require_bytes_vo.HexBytes(serializeWitness(witness).toString("hex")) };
+};
+//#endregion
+//#region ../../packages/module/blockchain-bitcoin/src/signing/bitcoin-in-memory-data-signer.ts
+require__polyfill_buffer_patch.init__polyfill_buffer_patch();
+/**
+* Signs arbitrary messages using BIP-137 compact recoverable ECDSA (the
+* default) or BIP-322 Generic Signed Message Format, selected by the
+* request's signatureType.
+*
+* Follows the same authentication and key derivation pattern as
+* BitcoinInMemoryTransactionSigner: triggers user authentication,
+* decrypts the root private key, derives the P2WPKH signing key,
+* and produces the requested proof.
+*/
+var BitcoinInMemoryDataSigner = class {
+	#encryptedRootPrivateKey;
+	#auth;
+	#network;
+	#accountIndex;
+	constructor(props) {
+		this.#encryptedRootPrivateKey = props.encryptedRootPrivateKey;
+		this.#auth = props.auth;
+		this.#network = props.network;
+		this.#accountIndex = props.accountIndex;
+	}
+	signData(request) {
+		return this.#auth.authenticate().pipe((0, rxjs.switchMap)((confirmed) => {
+			if (!confirmed) return (0, rxjs.throwError)(() => new require_types.AuthenticationCancelledError());
+			return this.#auth.accessAuthSecret((authSecret) => (0, rxjs.from)(this.#signData(authSecret, request)));
+		}));
+	}
+	async #signData(authSecret, request) {
+		let rootPrivateKey = null;
+		try {
+			const encryptedSeed = require__polyfill_buffer_patch.import_buffer.Buffer.from(this.#encryptedRootPrivateKey, "hex");
+			const decryptedBytes = await require_secret_box.SecretBox.open(encryptedSeed, authSecret);
+			rootPrivateKey = require_redacted.Redacted.make(require__polyfill_buffer_patch.import_buffer.Buffer.from(decryptedBytes));
+			const childKeyPair = require_keyDerivation.deriveChildKeyPair(require_keyDerivation.deriveAccountRootKeyPair({
+				seed: require_redacted.Redacted.value(rootPrivateKey),
+				addressType: require_address.AddressType.NativeSegWit,
+				network: this.#network,
+				account: this.#accountIndex
+			}).pair.privateKey, require_keyDerivation.ChainType.External, 0);
+			const bitcoinJsNetwork = this.#network === require_types$1.BitcoinNetwork.Mainnet ? import_src.networks.bitcoin : import_src.networks.testnet;
+			const derivedAddress = import_src.payments.p2wpkh({
+				pubkey: require__polyfill_buffer_patch.import_buffer.Buffer.from(childKeyPair.pair.publicKey, "hex"),
+				network: bitcoinJsNetwork
+			}).address;
+			if (derivedAddress !== request.address) throw new Error(`Address mismatch: requested ${request.address} but derived key produces ${derivedAddress}`);
+			const childPrivateKey = require__polyfill_buffer_patch.import_buffer.Buffer.from(childKeyPair.pair.privateKey, "hex");
+			try {
+				if (request.signatureType === "bip322-simple") return bip322SignData({
+					privateKey: childPrivateKey,
+					publicKey: require__polyfill_buffer_patch.import_buffer.Buffer.from(childKeyPair.pair.publicKey, "hex"),
+					network: bitcoinJsNetwork
+				}, request);
+				return bip137SignMessage({ privateKey: childPrivateKey }, request);
+			} finally {
+				childPrivateKey.fill(0);
+			}
+		} finally {
+			if (rootPrivateKey) require_redacted.Redacted.unsafeWipe(rootPrivateKey);
+		}
+	}
+};
+//#endregion
+//#region ../../packages/module/blockchain-bitcoin/src/signing/bitcoin-in-memory-transaction-signer.ts
+require__polyfill_buffer_patch.init__polyfill_buffer_patch();
+/** Signs Bitcoin transactions using an in-memory wallet. */
+var BitcoinInMemoryTransactionSigner = class {
+	#encryptedRootPrivateKey;
+	#auth;
+	constructor(params) {
+		this.#encryptedRootPrivateKey = params.encryptedRootPrivateKey;
+		this.#auth = params.auth;
+	}
+	sign(request) {
+		return this.#auth.authenticate().pipe((0, rxjs.switchMap)((confirmed) => {
+			if (!confirmed) return (0, rxjs.throwError)(() => new require_types.AuthenticationCancelledError());
+			return this.#auth.accessAuthSecret((authSecret) => (0, rxjs.from)(this.#signTransaction(request.serializedTx, this.#encryptedRootPrivateKey, authSecret)));
+		}));
+	}
+	async #signTransaction(serializedTx, encryptedRootPrivateKey, authSecret) {
+		let rootPrivateKey = null;
+		try {
+			const encryptedSeed = require__polyfill_buffer_patch.import_buffer.Buffer.from(encryptedRootPrivateKey, "hex");
+			const decryptedBytes = await require_secret_box.SecretBox.open(encryptedSeed, authSecret);
+			rootPrivateKey = require_redacted.Redacted.make(require__polyfill_buffer_patch.import_buffer.Buffer.from(decryptedBytes));
+			return require_sign_bitcoin_transaction_with_seed.signBitcoinTransactionWithSeed(serializedTx, require_redacted.Redacted.value(rootPrivateKey));
+		} finally {
+			if (rootPrivateKey) require_redacted.Redacted.unsafeWipe(rootPrivateKey);
+		}
+	}
+};
+//#endregion
+//#region ../../packages/module/blockchain-bitcoin/src/signing/bitcoin-in-memory-signer-factory.ts
+var BitcoinInMemorySignerFactory = class {
+	canSign(account) {
+		return account.accountType === "InMemory" && account.blockchainName === "Bitcoin";
+	}
+	createTransactionSigner(context) {
+		this.#assertSupported(context);
+		return new BitcoinInMemoryTransactionSigner({
+			encryptedRootPrivateKey: this.#extractEncryptedRootPrivateKey(context),
+			auth: context.auth
+		});
+	}
+	createDataSigner(context) {
+		const account = this.#assertSupported(context);
+		const encryptedRootPrivateKey = this.#extractEncryptedRootPrivateKey(context);
+		const networkId = account.blockchainSpecific.networkId;
+		const network = networkId ? require_address.BitcoinNetworkId.getBitcoinNetwork(networkId) : void 0;
+		if (!network) throw new Error(`Cannot resolve Bitcoin network from networkId: ${String(networkId)}`);
+		return new BitcoinInMemoryDataSigner({
+			encryptedRootPrivateKey,
+			auth: context.auth,
+			network,
+			accountIndex: account.blockchainSpecific.accountIndex
+		});
+	}
+	#assertSupported(context) {
+		const account = context.wallet.accounts.find((a) => a.accountId === context.accountId);
+		if (!account || !this.canSign(account)) throw new Error(`BitcoinInMemorySignerFactory does not support account type: ${account?.accountType ?? "unknown"}`);
+		return account;
+	}
+	#extractEncryptedRootPrivateKey(context) {
+		const { wallet } = context;
+		const encryptedRootPrivateKey = wallet.blockchainSpecific.Bitcoin?.encryptedRootPrivateKey;
+		if (!encryptedRootPrivateKey) throw new Error("Wallet is missing Bitcoin encrypted root private key");
+		return encryptedRootPrivateKey;
+	}
+};
+//#endregion
+//#region ../../packages/module/blockchain-bitcoin/src/exposed-modules/signer-factory.ts
+const initSignerFactory = () => new BitcoinInMemorySignerFactory();
+//#endregion
+exports.default = initSignerFactory;

package/dist/{signer-factory-9URFliA5.js → signer-factory-DObB55D4.js}

@@ -1,6 +1,9 @@
-import "./libsodium-wrappers-UH0LaOUE.js";
-import "./util-BaLzwa32.js";
-import { a as CardanoInMemoryTransactionSigner, i as deriveDRepKeyHash, n as createCardanoKeyAgentFromEncryptedRoot, o as CardanoInMemoryDataSigner, t as withCollateralOwnershipGuard } from "./guarded-transaction-signer-CpKLj8Kp.js";
+import "./_web-crypto-random-bytes-Bo-GTcRS.js";
+import "./_polyfill-buffer-patch-yNxN4d5E.js";
+import "./libsodium-wrappers-BhbOA8dQ.js";
+import "./codecs-Dc1Krpbt.js";
+import "./util-Cp5cZkfK.js";
+import { a as CardanoInMemoryTransactionSigner, i as deriveDRepKeyHash, n as createCardanoKeyAgentFromEncryptedRoot, o as CardanoInMemoryDataSigner, t as withCollateralOwnershipGuard } from "./guarded-transaction-signer-P6Rp1faj.js";
 import { defer, from, switchMap } from "rxjs";
 //#region ../../packages/module/blockchain-cardano/src/signing/cardano-in-memory-signer-factory.ts
 /**