@qntx/wallet-worker 0.5.2 → 0.7.0

package/dist/kernel.node.js

@@ -72,9 +72,6 @@ import { parentPort, workerData } from "node:worker_threads";
 var NostrError = class extends Error {
   name = "NostrError";
 };
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
 var HexError = class extends NostrError {
   name = "HexError";
 };
@@ -1829,7 +1826,7 @@ class KernelError extends Error {
     this.corrupted = corrupted;
   }
 }
-// ../wallet/dist/core-Dmz5SbyJ.mjs
+// ../wallet/dist/core-Cq5h9X0X.mjs
 var ValidationError = class extends Error {
   name = "ValidationError";
 };
@@ -1970,6 +1967,7 @@ var publicKey = str(64, /^[0-9a-f]{64}$/);
 var credentialId = str(1364, /^[A-Za-z0-9_-]+$/);
 var safeTime = int(0, Number.MAX_SAFE_INTEGER);
 var groupIndex = int(0, 2147483647);
+var identityIndex = int(0, 2147483646);
 var factor = union(obj({ kind: literal("hardware") }), obj({
   kind: literal("password"),
   password: bytes(1, 1024)
@@ -2196,7 +2194,7 @@ var CORE_METHODS = {
   }
 };
 
-// ../wallet/dist/protocol-DvzlUKB8.mjs
+// ../wallet/dist/protocol-DbpLncEB.mjs
 var MAX_FACTOR_CHARS = 512;
 var MAX_STRING_BYTES = 64000;
 var MAX_PAYLOAD_CHARS = 1400000;
@@ -2218,15 +2216,11 @@ var backupEnvelope = obj({
   factors: arr(backupEnvelopeFactor, 5, 1),
   payload: str(MAX_PAYLOAD_CHARS)
 });
-var backupHeader = obj({
-  wallets: arr(obj({
-    walletId: str(128),
-    origin: union(literal("mnemonic"), literal("passkey")),
-    words: union(literal(12), literal(15), literal(18), literal(21), literal(24))
-  }), 1000),
-  importedNostrKeyCount: int(0, 1e4),
-  importedChainKeyCount: int(0, 1e4)
-});
+var backupHeader = obj({ wallets: arr(obj({
+  walletId: str(128),
+  origin: union(literal("mnemonic"), literal("passkey")),
+  words: union(literal(12), literal(15), literal(18), literal(21), literal(24))
+}), 1000) });
 var backupEnvelopeText = str(MAX_ENVELOPE_CHARS);
 var backupInfo = obj({
   id: str(32, /^[0-9a-f]{32}$/),
@@ -2375,36 +2369,19 @@ var CHAINS_METHODS = {
   }
 };
 var hex128 = str(128, /^[0-9a-f]{128}$/);
-var nostrKeyRef = union(obj({
+var nostrKeyRef = obj({
   kind: literal("derived"),
   walletId,
-  groupIndex
-}), obj({
-  kind: literal("standalone"),
-  id: publicKey
-}), obj({
-  kind: literal("nip46-client"),
-  id: publicKey
-}));
-var nostrKeyInfo = union(obj({
-  ref: nostrKeyRef,
-  publicKey,
-  origin: union(literal("nsec"), literal("ncryptsec"), literal("generated")),
-  backedUp: bool,
-  createdAt: safeTime
-}), obj({
+  index: identityIndex
+});
+var nostrKeyInfo = obj({
   ref: nostrKeyRef,
   publicKey,
-  origin: union(literal("derived"), literal("nip46-client")),
   createdAt: safeTime
-}));
-var nostrStatus = obj({ keys: arr(nostrKeyInfo, MAX_SNAPSHOT_ITEMS) });
-var keyResult = obj({
-  key: nostrKeyInfo,
-  session: sessionId
 });
+var nostrStatus = obj({ keys: arr(nostrKeyInfo, MAX_SNAPSHOT_ITEMS) });
 var derivedNostrKey = obj({
-  groupIndex,
+  index: identityIndex,
   publicKey
 });
 var tags = arr(arr(str(MAX_TAG_ITEM), 64), MAX_TAGS);
@@ -2432,14 +2409,6 @@ var rumor = obj({
   tags,
   content: str(MAX_TEXT)
 });
-var nostrImportInput = union(obj({
-  kind: literal("nsec"),
-  nsec: bytes(1, 256)
-}), obj({
-  kind: literal("ncryptsec"),
-  ncryptsec: str(512, /^ncryptsec1/),
-  password: bytes(1, 1024)
-}));
 var nostrExportFormat = union(obj({ kind: literal("nsec") }), obj({
   kind: literal("ncryptsec"),
   password: bytes(1, 1024)
@@ -2456,7 +2425,7 @@ var NOSTR_METHODS = {
     presence: false,
     params: obj({
       walletId,
-      from: groupIndex,
+      from: identityIndex,
       count: int(1, 20)
     }),
     result: obj({ keys: arr(derivedNostrKey, 20) })
@@ -2466,38 +2435,14 @@ var NOSTR_METHODS = {
     presence: false,
     params: obj({
       walletId,
-      groupIndex
-    }),
-    result: nostrKeyInfo
-  },
-  "nostr.importKey": {
-    session: false,
-    presence: true,
-    params: obj({
-      input: nostrImportInput,
-      factor: opt(factor)
+      index: identityIndex
     }),
-    result: keyResult
-  },
-  "nostr.generateKey": {
-    session: false,
-    presence: true,
-    params: obj({ factor: opt(factor) }),
-    result: keyResult
-  },
-  "nostr.createNip46ClientKey": {
-    session: true,
-    presence: false,
-    params: nullValue,
     result: nostrKeyInfo
   },
   "nostr.removeKey": {
     session: true,
     presence: true,
-    params: obj({
-      publicKey,
-      verify: opt(factor)
-    }),
+    params: obj({ publicKey }),
     result: nullValue
   },
   "nostr.exportKey": {
@@ -2551,6 +2496,39 @@ var NOSTR_METHODS = {
       events: arr(signedEvent, 64)
     }),
     result: obj({ results: arr(union(obj({ ok: rumor }), obj({ err: walletErrorCode })), 64) })
+  },
+  "nostr.syncKey": {
+    session: true,
+    presence: false,
+    params: obj({ walletId }),
+    result: obj({ publicKey })
+  },
+  "nostr.syncSign": {
+    session: true,
+    presence: false,
+    params: obj({
+      walletId,
+      event: signEventInput
+    }),
+    result: signedEvent
+  },
+  "nostr.syncEncrypt": {
+    session: true,
+    presence: false,
+    params: obj({
+      walletId,
+      text: str(MAX_TEXT)
+    }),
+    result: textResult
+  },
+  "nostr.syncDecrypt": {
+    session: true,
+    presence: false,
+    params: obj({
+      walletId,
+      text: str(MAX_TEXT * 4)
+    }),
+    result: textResult
   }
 };
 var MAX_LEAVES = 256;
@@ -2736,6 +2714,27 @@ var decimalU128 = (value) => {
     throw new ValidationError;
   return value;
 };
+var outflowIntents = [
+  obj({
+    kind: literal("exit"),
+    address: str(128),
+    amountSats: satsAmount(),
+    maxFeeSats: satsAmount()
+  }),
+  obj({
+    kind: literal("onchain"),
+    address: str(128),
+    maxFeeSats: satsAmount()
+  }),
+  obj({
+    kind: literal("token"),
+    tokenIdentifier: bytes(32),
+    receivers: arr(obj({
+      ownerPublicKey: bytes(33),
+      amount: decimalU128
+    }), 256, 1)
+  })
+];
 var approveIntent = union(obj({
   kind: literal("transfer"),
   receivers: arr(obj({
@@ -2747,23 +2746,7 @@ var approveIntent = union(obj({
   invoice: str(4096),
   amountSats: opt(satsAmount()),
   maxFeeSats: satsAmount()
-}), obj({
-  kind: literal("exit"),
-  address: str(128),
-  amountSats: satsAmount(),
-  maxFeeSats: satsAmount()
-}), obj({
-  kind: literal("onchain"),
-  address: str(128),
-  maxFeeSats: satsAmount()
-}), obj({
-  kind: literal("token"),
-  tokenIdentifier: bytes(32),
-  receivers: arr(obj({
-    ownerPublicKey: bytes(33),
-    amount: decimalU128
-  }), 256, 1)
-}));
+}), ...outflowIntents);
 var approvalSummary = union(obj({
   kind: literal("transfer"),
   receivers: arr(obj({
@@ -2775,23 +2758,7 @@ var approvalSummary = union(obj({
   paymentHash: bytes(32),
   invoiceAmountSats: opt(satsAmount()),
   maxFeeSats: satsAmount()
-}), obj({
-  kind: literal("exit"),
-  address: str(128),
-  amountSats: satsAmount(),
-  maxFeeSats: satsAmount()
-}), obj({
-  kind: literal("onchain"),
-  address: str(128),
-  maxFeeSats: satsAmount()
-}), obj({
-  kind: literal("token"),
-  tokenIdentifier: bytes(32),
-  receivers: arr(obj({
-    ownerPublicKey: bytes(33),
-    amount: decimalU128
-  }), 256, 1)
-}));
+}), ...outflowIntents);
 var SPARK_METHODS = {
   "spark.identityPublicKey": {
     session: true,
@@ -2916,7 +2883,7 @@ var SPARK_METHODS = {
     result: approvalSummary
   }
 };
-var PROTOCOL_VERSION = 1;
+var PROTOCOL_VERSION = 2;
 var UNATTRIBUTED_ID = 0;
 var MAX_REQUEST_BYTES = 1048576;
 function requestBytes(value) {
@@ -2966,7 +2933,7 @@ function isProtocolValue(value) {
   return Object.values(value).every(isProtocolValue);
 }
 var statusPayload = obj({
-  protocol: literal(1),
+  protocol: literal(2),
   vault: union(literal("uninitialized"), literal("locked"), literal("unlocked"), literal("corrupted"), literal("unsupported"), literal("unavailable")),
   factors: arr(factorInfo, MAX_SNAPSHOT_ITEMS),
   wallets: arr(walletInfo, MAX_SNAPSHOT_ITEMS),
@@ -2991,11 +2958,11 @@ var errorPayload = obj({
   retryAt: opt(safeTime)
 });
 var kernelEvent = union(obj({
-  v: literal(1),
+  v: literal(2),
   event: literal("status"),
   status: statusPayload
 }), obj({
-  v: literal(1),
+  v: literal(2),
   event: literal("locked"),
   reason: lockReason
 }));
@@ -3929,14 +3896,8 @@ function asPublicKey(value) {
   }
   return value;
 }
-function asGroupIndex(value) {
-  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > 2147483647) {
-    throw headerFailure();
-  }
-  return value;
-}
-function asBoolean(value) {
-  if (typeof value !== "boolean") {
+function asIdentityIndex(value) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > 2147483646) {
     throw headerFailure();
   }
   return value;
@@ -4250,7 +4211,7 @@ var RECORD_KIND_PATTERN = /^[a-z][a-z0-9-]{0,31}$/;
 function isRecordKind(kind) {
   return RECORD_KIND_PATTERN.test(kind);
 }
-var VAULT_FORMAT = 2;
+var VAULT_FORMAT = 3;
 
 // ../wallet-kernel/src/vault/vault.ts
 var BACKOFF_MS = [30000, 60000, 300000];
@@ -6877,6 +6838,14 @@ async function seedFromMnemonic(mnemonic, passphrase, pbkdf2) {
 async function seedFromEntropy(entropy, pbkdf2) {
   return seedFromMnemonic(mnemonicFromEntropy(entropy), "", pbkdf2);
 }
+async function withSeed(pbkdf2, entropy, use) {
+  const seed = await seedFromEntropy(entropy, pbkdf2);
+  try {
+    return await use(seed);
+  } finally {
+    wipe(seed);
+  }
+}
 
 // ../wallet-kernel/src/session/session.ts
 function wipePendingFactor(pending) {
@@ -7050,6 +7019,14 @@ class Session {
 }
 
 // ../wallet-kernel/src/commands/vault.ts
+async function withWalletSeed(pbkdf2, dek, record, use) {
+  const entropy = openRecord(dek, record);
+  try {
+    return await withSeed(pbkdf2, entropy, use);
+  } finally {
+    wipe(entropy);
+  }
+}
 var EMPTY_IMAGE = { meta: undefined, records: [], factors: [] };
 async function unlockVault(ctx, params) {
   await ctx.reload();
@@ -7134,13 +7111,10 @@ async function removeFactor(ctx, params, requestSession) {
 
 // ../wallet-kernel/src/commands/wallets.ts
 async function deriveWalletMaterial(platform, entropy) {
-  const seed = await seedFromEntropy(entropy, platform.pbkdf2);
-  try {
+  return withSeed(platform.pbkdf2, entropy, (seed) => {
     const master = masterKey(seed);
     return { master, walletId: walletIdOf(master) };
-  } finally {
-    wipe(seed);
-  }
+  });
 }
 async function walletMaterial(platform, entropy, origin, words) {
   const { master, walletId } = await deriveWalletMaterial(platform, entropy);
@@ -7480,13 +7454,11 @@ function parseHeader(text) {
   return header;
 }
 var PAYLOAD_WALLET = 1;
-var PAYLOAD_NOSTR = 2;
-var PAYLOAD_CHAIN = 3;
-function encodePayload(wallets, nostrSecrets) {
-  const size = 1 + wallets.reduce((acc, w) => acc + 3 + w.entropy.length, 0) + nostrSecrets.length * 33;
+function encodePayload(wallets) {
+  const size = 1 + wallets.reduce((acc, w) => acc + 3 + w.entropy.length, 0);
   const out = new Uint8Array(size);
   let off = 0;
-  out[off++] = 1;
+  out[off++] = 2;
   for (const w of wallets) {
     out[off++] = PAYLOAD_WALLET;
     out[off++] = ORIGIN_BYTE[w.origin] ?? 0;
@@ -7494,19 +7466,13 @@ function encodePayload(wallets, nostrSecrets) {
     out.set(w.entropy, off);
     off += w.entropy.length;
   }
-  for (const s of nostrSecrets) {
-    out[off++] = PAYLOAD_NOSTR;
-    out.set(s, off);
-    off += s.length;
-  }
   return out;
 }
 function decodePayload2(bytes) {
-  if (bytes.length === 0 || bytes[0] !== 1) {
+  if (bytes.length === 0 || bytes[0] !== 2) {
     throw new KernelError("integrity", "backup: bad payload version");
   }
   const wallets = [];
-  const nostrSecrets = [];
   let off = 1;
   while (off < bytes.length) {
     const tag = bytes[off++];
@@ -7526,17 +7492,6 @@ function decodePayload2(bytes) {
       }
       wallets.push({ origin, entropy: bytes.slice(off, off + len) });
       off += len;
-    } else if (tag === PAYLOAD_NOSTR) {
-      if (off + 32 > bytes.length) {
-        throw new KernelError("integrity", "backup: truncated payload");
-      }
-      nostrSecrets.push(bytes.slice(off, off + 32));
-      off += 32;
-    } else if (tag === PAYLOAD_CHAIN) {
-      if (off + 33 > bytes.length) {
-        throw new KernelError("integrity", "backup: truncated payload");
-      }
-      off += 33;
     } else {
       throw new KernelError("integrity", "backup: unknown payload tag");
     }
@@ -7544,7 +7499,7 @@ function decodePayload2(bytes) {
   if (off !== bytes.length) {
     throw new KernelError("integrity", "backup: payload length mismatch");
   }
-  return { wallets, nostrSecrets };
+  return { wallets };
 }
 function collectContents(ctx, dek) {
   const wallets = [];
@@ -7567,13 +7522,10 @@ function collectContents(ctx, dek) {
         throw error;
       }
     }
-    const nostrSecrets = ctx.modules.flatMap((module) => module.backupSecrets(ctx.image, dek));
     const header = JSON.stringify({
-      wallets: wallets.map(({ walletId, origin, words }) => ({ walletId, origin, words })),
-      importedNostrKeyCount: nostrSecrets.length,
-      importedChainKeyCount: 0
+      wallets: wallets.map(({ walletId, origin, words }) => ({ walletId, origin, words }))
     });
-    return { wallets, nostrSecrets, header };
+    return { wallets, header };
   } catch (error) {
     for (const wallet of wallets) {
       wallet.entropy.fill(0);
@@ -7585,9 +7537,6 @@ function wipeContents(contents) {
   for (const wallet of contents.wallets) {
     wallet.entropy.fill(0);
   }
-  for (const secretKey of contents.nostrSecrets) {
-    secretKey.fill(0);
-  }
 }
 var PURPOSE_PROTECTION = 2;
 function backupMaterialOf(result) {
@@ -7710,7 +7659,7 @@ function updateBackup(ctx, _params, requestSession) {
   const bek = openRecord(dek, record);
   const contents = collectContents(ctx, dek);
   try {
-    const plaintext = encodePayload(contents.wallets, contents.nostrSecrets);
+    const plaintext = encodePayload(contents.wallets);
     const sealedPayload = seal(bek, plaintext, payloadContext(contents.header), "", ctx.platform.random);
     try {
       const envelope = {
@@ -7780,7 +7729,7 @@ async function restoreBackup(ctx, params, requestSession) {
     }
     const header = parseHeader(envelope.header);
     const decoded = decodePayload2(plaintext);
-    if (decoded.nostrSecrets.length !== header.importedNostrKeyCount || decoded.wallets.length !== header.wallets.length) {
+    if (decoded.wallets.length !== header.wallets.length) {
       plaintext.fill(0);
       throw new KernelError("integrity", "backup: payload does not match header");
     }
@@ -7812,9 +7761,6 @@ async function restoreBackup(ctx, params, requestSession) {
           records.push(record);
           restored.push(walletInfoOf(material, backup, now));
         }
-        for (const module of ctx.modules) {
-          records.push(...module.backupRecords(ctx.platform, ctx.image, gated.dek, decoded.nostrSecrets, now));
-        }
         if (gated.uninitialized) {
           records.push(backupKeyRecord(ctx, gated.dek, bek, envelope.factors));
         }
@@ -7832,9 +7778,6 @@ async function restoreBackup(ctx, params, requestSession) {
       for (const wallet of decoded.wallets) {
         wallet.entropy.fill(0);
       }
-      for (const secretKey of decoded.nostrSecrets) {
-        secretKey.fill(0);
-      }
     }
   } finally {
     bek.fill(0);
@@ -8034,7 +7977,30 @@ var ChainError = class extends Error {
   }
 };
 
-// ../wallet-chains/dist/message-DtIS0ZWB.mjs
+// ../wallet-chains/dist/account-ref-C2qrDbVT.mjs
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isAccountRef = (value) => {
+  if (!isRecord2(value) || typeof value["kind"] !== "string")
+    return false;
+  if (value["kind"] === "hd")
+    return typeof value["walletId"] === "string" && typeof value["groupIndex"] === "number" && typeof value["template"] === "string";
+  return value["kind"] === "imported" && typeof value["keyId"] === "string" && typeof value["family"] === "string";
+};
+var requestBase = (request) => {
+  if (!isRecord2(request))
+    throw new ChainError("invalid-request", "request must be an object");
+  const { network, account } = request;
+  if (typeof network !== "string")
+    throw new ChainError("invalid-request", "request.network must be a string");
+  if (!isAccountRef(account))
+    throw new ChainError("invalid-request", "request.account must be an AccountRef");
+  return {
+    network,
+    account
+  };
+};
+
+// ../wallet-chains/dist/message-DuJ5KSRT.mjs
 var MAINNET_BIP32 = {
   public: 76067358,
   private: 76066276
@@ -8185,15 +8151,15 @@ var signLegacyMessage = (message, privateKey) => {
 };
 
 // ../wallet-chains/dist/bitcoin.mjs
-var isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var derivationPaths = (map) => {
-  const entries = map instanceof Map ? [...map.values()] : Array.isArray(map) ? map : isRecord$2(map) ? Object.values(map) : [];
+  const entries = map instanceof Map ? [...map.values()] : Array.isArray(map) ? map : isRecord$1(map) ? Object.values(map) : [];
   const paths = [];
   for (const entry of entries) {
     const value = Array.isArray(entry) ? entry[1] : entry;
-    if (!isRecord$2(value))
+    if (!isRecord$1(value))
       continue;
-    const { path } = isRecord$2(value["der"]) ? value["der"] : value;
+    const { path } = isRecord$1(value["der"]) ? value["der"] : value;
     if (Array.isArray(path) && path.every((p) => typeof p === "number"))
       paths.push(path);
   }
@@ -8332,26 +8298,10 @@ var decodeBitcoinPsbt = (request, ownScripts = /* @__PURE__ */ new Set) => {
     verifiability
   };
 };
-var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var isAccountRef = (value) => {
-  if (!isRecord2(value) || typeof value["kind"] !== "string")
-    return false;
-  if (value["kind"] === "hd")
-    return typeof value["walletId"] === "string" && typeof value["groupIndex"] === "number" && typeof value["template"] === "string";
-  return value["kind"] === "imported" && typeof value["keyId"] === "string" && typeof value["family"] === "string";
-};
 var common = (request) => {
-  const { network } = request;
-  const { account } = request;
-  if (typeof network !== "string")
-    throw new ChainError("invalid-request", "request.network must be a string");
-  if (!isAccountRef(account))
-    throw new ChainError("invalid-request", "request.account must be an AccountRef");
-  bitcoinNetwork(network);
-  return {
-    network,
-    account
-  };
+  const base = requestBase(request);
+  bitcoinNetwork(base.network);
+  return base;
 };
 var messageTarget = (address, network, format) => {
   if (typeof address !== "string")
@@ -8421,26 +8371,6 @@ var normalizeBitcoin = (request) => {
 };
 var decodeMessageTarget = (request) => messageTarget(request.address, request.network, request.format);
 
-// ../wallet-chains/dist/bitcoin-sign.mjs
-var signBitcoinPsbt = (psbt, inputs, auxRand) => {
-  const tx = Transaction.fromPSBT(psbt);
-  for (const { index, privateKey } of inputs) {
-    if (privateKey.length !== 32)
-      throw new ChainError("invalid-request", `input ${index}: private key must be 32 bytes`);
-    if (!tx.signIdx(privateKey, index, undefined, auxRand(index)))
-      throw new ChainError("invalid-request", `input ${index}: key cannot sign`);
-  }
-  return tx.toPSBT(0);
-};
-var signBitcoinMessage = (request, privateKey, auxRand) => {
-  if (privateKey.length !== 32)
-    throw new ChainError("invalid-request", "private key must be 32 bytes");
-  if (request.format === "legacy")
-    return signLegacyMessage(request.message, privateKey);
-  const scriptPubKey = OutScript.encode(Address(bitcoinNetwork(request.network).params).decode(request.address));
-  return signBip322Simple(request.message, scriptPubKey, privateKey, auxRand);
-};
-
 // ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/sha3.js
 var _0n4 = BigInt(0);
 var _1n4 = BigInt(1);
@@ -8664,15 +8594,15 @@ class Keccak {
 var genKeccak = (suffix, blockLen, outputLen, info = {}) => createHasher(() => new Keccak(blockLen, suffix, outputLen), info);
 var keccak_256 = /* @__PURE__ */ genKeccak(1, 136, 32);
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/version.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/version.js
 var version = "0.1.1";
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/errors.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/errors.js
 function getVersion() {
   return version;
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/Errors.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/Errors.js
 class BaseError extends Error {
   details;
   docs;
@@ -8752,7 +8682,7 @@ function walk(err, fn) {
   return fn ? null : err;
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/bytes.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/bytes.js
 function assertSize(bytes, size_) {
   if (size(bytes) > size_)
     throw new SizeOverflowError({
@@ -8821,7 +8751,7 @@ function trim(value, options = {}) {
   return start === 0 && end === value.length ? value : value.slice(start, end);
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/codec/hex.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/codec/hex.js
 var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_v, i) => i.toString(16).padStart(2, "0"));
 var nibbleTable = /* @__PURE__ */ (() => {
   const table = new Uint8Array(256).fill(255);
@@ -8909,7 +8839,7 @@ class InvalidLengthError extends BaseError {
   }
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/codec/int.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/codec/int.js
 function bytesToBigInt(value, signed) {
   const len = value.length;
   if (len === 0)
@@ -8966,11 +8896,11 @@ class IntegerOutOfRangeError extends BaseError {
   }
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/codec/utf8.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/codec/utf8.js
 var encoder = /* @__PURE__ */ new TextEncoder;
 var decoder = /* @__PURE__ */ new TextDecoder;
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/Json.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/Json.js
 var bigIntSuffix = "#__bigint";
 function stringify(value, replacer, space) {
   return JSON.stringify(value, (key, value) => {
@@ -8982,9 +8912,9 @@ function stringify(value, replacer, space) {
   }, space);
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/Hex.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/Hex.js
 function assert(value, options = {}) {
-  const { strict = false } = options;
+  const { even = false, strict = false } = options;
   if (typeof value !== "string")
     throw new InvalidHexTypeError(value);
   if (strict) {
@@ -8993,6 +8923,8 @@ function assert(value, options = {}) {
   }
   if (!value.startsWith("0x"))
     throw new InvalidHexValueError2(value);
+  if (even && value.length % 2 !== 0)
+    throw new InvalidLengthError2(value);
 }
 function concat2(...values) {
   if (values.length === 0)
@@ -9116,9 +9048,9 @@ function toBytes(hex, options = {}) {
   return hexToBytes4(value);
 }
 function validate2(value, options = {}) {
-  const { strict = false } = options;
+  const { even = false, strict = false } = options;
   try {
-    assert(value, { strict });
+    assert(value, { even, strict });
     return true;
   } catch {
     return false;
@@ -9134,6 +9066,8 @@ class InvalidHexTypeError extends BaseError {
   }
 }
 var InvalidHexValueError2 = InvalidHexValueError;
+var InvalidLengthError2 = InvalidLengthError;
+
 class SizeOverflowError2 extends BaseError {
   name = "Hex.SizeOverflowError";
   constructor({ givenSize, maxSize }) {
@@ -9155,7 +9089,7 @@ class SizeExceedsPaddingSizeError2 extends BaseError {
   }
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/hex.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/hex.js
 function assertSize2(hex, size_) {
   const len = hex.length - 2;
   const size = len + 1 >> 1;
@@ -9216,7 +9150,7 @@ function trim2(value, options = {}) {
   return `0x${data.slice(start, end)}`;
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/Bytes.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/Bytes.js
 function from2(value) {
   if (value instanceof Uint8Array)
     return value;
@@ -9327,7 +9261,7 @@ class SizeExceedsPaddingSizeError extends BaseError {
   }
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/lru.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/lru.js
 class BoundedMap extends Map {
   maxSize;
   constructor(size) {
@@ -9344,20 +9278,20 @@ class BoundedMap extends Map {
   }
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/Caches.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/Caches.js
 var caches = {
   checksum: /* @__PURE__ */ new BoundedMap(32768)
 };
 var checksum = caches.checksum;
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/engine.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/engine.js
 var overrides = {};
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/hash.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/hash.js
 var keccak256Default = (input) => keccak_256(input);
 var keccak256 = (input) => (overrides.Hash?.keccak256 ?? keccak256Default)(input);
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/Hash.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/Hash.js
 function keccak2562(value, options = {}) {
   const isBytes = value instanceof Uint8Array;
   const { as = isBytes ? "Bytes" : "Hex" } = options;
@@ -9367,7 +9301,7 @@ function keccak2562(value, options = {}) {
   return fromBytes(bytes);
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/address.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/address.js
 var length = 42;
 var ZERO2 = 48;
 var NINE = 57;
@@ -9420,7 +9354,7 @@ function lowercase(value) {
   return String.fromCharCode.apply(null, out);
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/Address.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/Address.js
 function assert2(value, options = {}) {
   const { strict = true } = options;
   const kind = classify(value);
@@ -9500,7 +9434,7 @@ class InvalidChecksumError extends BaseError {
   }
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/regex.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/regex.js
 function execTyped(regex, string) {
   const match = regex.exec(string);
   return match?.groups;
@@ -9509,7 +9443,7 @@ var bytesRegex = /^bytes([1-9]|1[0-9]|2[0-9]|3[0-2])?$/;
 var integerRegex = /^u?int(8|16|24|32|40|48|56|64|72|80|88|96|104|112|120|128|136|144|152|160|168|176|184|192|200|208|216|224|232|240|248|256)?$/;
 var isTupleRegex = /^\(.+?\).*?$/;
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/formatAbiParameter.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/formatAbiParameter.js
 var tupleRegex = /^tuple(?<array>(\[(\d*)\])*)$/;
 function formatAbiParameter(abiParameter) {
   let type = abiParameter.type;
@@ -9536,7 +9470,7 @@ function formatAbiParameter(abiParameter) {
   return type;
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/formatAbiParameters.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/formatAbiParameters.js
 function formatAbiParameters(abiParameters) {
   let params = "";
   const length = abiParameters.length;
@@ -9549,7 +9483,7 @@ function formatAbiParameters(abiParameters) {
   return params;
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/errors.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/errors.js
 class InvalidAbiItemError extends BaseError {
   name = "AbiItem.InvalidAbiItemError";
   constructor({ signature }) {
@@ -9684,7 +9618,7 @@ class CircularReferenceError extends BaseError {
   }
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/runtime/signatures.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/runtime/signatures.js
 var errorSignatureRegex = /^error (?<name>[a-zA-Z$_][a-zA-Z0-9$_]*)\((?<parameters>.*?)\)$/;
 function isErrorSignature(signature) {
   return errorSignatureRegex.test(signature);
@@ -9744,7 +9678,7 @@ var functionModifiers = new Set([
   "storage"
 ]);
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/runtime/cache.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/runtime/cache.js
 function getParameterCacheKey(param, type, structs) {
   let structKey = "";
   if (structs)
@@ -9813,7 +9747,7 @@ var parameterCache = new Map([
   ]
 ]);
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/runtime/utils.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/runtime/utils.js
 function parseSignature(signature, structs = {}) {
   if (isFunctionSignature(signature))
     return parseFunctionSignature(signature, structs);
@@ -10012,7 +9946,7 @@ function isValidDataLocation(type, isArray) {
   return isArray || type === "bytes" || type === "string" || type === "tuple";
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/runtime/structs.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/runtime/structs.js
 function parseStructs(signatures) {
   const shallowStructs = {};
   const signaturesLength = signatures.length;
@@ -10082,7 +10016,7 @@ function resolveStructs(abiParameters = [], structs = {}, ancestors = new Set) {
   return components;
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/Solidity.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/Solidity.js
 var arrayRegex = /^(.*)\[([0-9]*)\]$/;
 var bytesRegex2 = /^bytes([1-9]|1[0-9]|2[0-9]|3[0-2])?$/;
 var integerRegex2 = /^(u?int)(8|16|24|32|40|48|56|64|72|80|88|96|104|112|120|128|136|144|152|160|168|176|184|192|200|208|216|224|232|240|248|256)?$/;
@@ -10183,7 +10117,7 @@ var maxUint240 = 2n ** 240n - 1n;
 var maxUint248 = 2n ** 248n - 1n;
 var maxUint256 = 2n ** 256n - 1n;
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/abiParameters.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/abiParameters.js
 function decodeParameter(cursor, param, options) {
   const { checksumAddress, staticPosition } = options;
   const arrayComponents = getArrayComponents(param.type);
@@ -10725,7 +10659,7 @@ function hasDynamicChild(param) {
   return false;
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/cursor.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/cursor.js
 var staticCursor = {
   bytes: new Uint8Array,
   dataView: new DataView(new ArrayBuffer(0)),
@@ -10916,7 +10850,7 @@ class RecursiveReadLimitExceededError extends BaseError {
   }
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/AbiParameters.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/AbiParameters.js
 function decode2(parameters, data, options = {}) {
   const { as = "Array", checksumAddress = true } = options;
   const bytes = typeof data === "string" ? fromHex(data) : data;
@@ -11092,7 +11026,7 @@ class InvalidTypeError extends BaseError {
   }
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/TypedData.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/TypedData.js
 function assert3(value) {
   const { domain, message, primaryType, types } = value;
   const validateValue = (type, value, name) => {
@@ -11204,7 +11138,7 @@ function encodeType(value) {
 function extractEip712DomainTypes(domain) {
   return [
     typeof domain?.name === "string" && { name: "name", type: "string" },
-    domain?.version && { name: "version", type: "string" },
+    typeof domain?.version === "string" && { name: "version", type: "string" },
     (typeof domain?.chainId === "number" || typeof domain?.chainId === "bigint") && {
       name: "chainId",
       type: "uint256"
@@ -11387,7 +11321,7 @@ function validateReference(type) {
     throw new InvalidStructTypeError({ type });
 }
 
-// ../wallet-chains/dist/typed-data-C6XANSQF.mjs
+// ../wallet-chains/dist/typed-data-Cf1g7JVv.mjs
 var isEvmAddress = (value) => /^0x[0-9a-fA-F]{40}$/.test(value);
 function checksumEvmAddress(address) {
   if (!isEvmAddress(address))
@@ -11594,7 +11528,7 @@ var typedDataWarnings = (parsed) => parsed.chainIdMismatch ? [{
   message: "typed-data domain.chainId does not match the request network"
 }] : [];
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/formatAbiItem.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/formatAbiItem.js
 function formatAbiItem(abiItem) {
   if (abiItem.type === "function")
     return `function ${abiItem.name}(${formatAbiParameters(abiItem.inputs)})${abiItem.stateMutability && abiItem.stateMutability !== "nonpayable" ? ` ${abiItem.stateMutability}` : ""}${abiItem.outputs?.length ? ` returns (${formatAbiParameters(abiItem.outputs)})` : ""}`;
@@ -11609,7 +11543,7 @@ function formatAbiItem(abiItem) {
   return "receive() external payable";
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/parseAbiItem.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/human-readable/parseAbiItem.js
 function parseAbiItem(signature) {
   let abiItem;
   if (typeof signature === "string")
@@ -11630,7 +11564,7 @@ function parseAbiItem(signature) {
   return abiItem;
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/abiItem.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/abiItem.js
 function normalizeSignature(signature) {
   let active = true;
   let current = "";
@@ -11675,8 +11609,6 @@ function normalizeSignature(signature) {
 }
 var integerTypeRegex = /^u?int(8|16|24|32|40|48|56|64|72|80|88|96|104|112|120|128|136|144|152|160|168|176|184|192|200|208|216|224|232|240|248|256)?$/;
 var fixedBytesTypeRegex = /^bytes([1-9]|1[0-9]|2[0-9]|3[0-2])?$/;
-var arrayTypeRegex = /[a-z]+[1-9]{0,3}(\[[0-9]{0,}\])+$/;
-var arraySuffixStripRegex = /(\[[0-9]{0,}\])$/;
 function isArgOfType(arg, abiParameter) {
   const argType = typeof arg;
   const abiParameterType = abiParameter.type;
@@ -11692,16 +11624,18 @@ function isArgOfType(arg, abiParameter) {
     default: {
       if (abiParameterType === "tuple" && "components" in abiParameter)
         return Object.values(abiParameter.components).every((component, index) => {
-          return isArgOfType(Object.values(arg)[index], component);
+          return argType === "object" && isArgOfType(getComponentValue(arg, component, index), component);
         });
       if (integerTypeRegex.test(abiParameterType))
         return argType === "number" || argType === "bigint";
       if (fixedBytesTypeRegex.test(abiParameterType))
         return argType === "string" || arg instanceof Uint8Array;
-      if (arrayTypeRegex.test(abiParameterType)) {
-        return Array.isArray(arg) && arg.every((x) => isArgOfType(x, {
+      const arrayComponents = getArrayComponents(abiParameterType);
+      if (arrayComponents) {
+        const [length, type] = arrayComponents;
+        return Array.isArray(arg) && (length === null || arg.length === length) && arg.every((x) => isArgOfType(x, {
           ...abiParameter,
-          type: abiParameterType.replace(arraySuffixStripRegex, "")
+          type
         }));
       }
       return false;
@@ -11712,8 +11646,33 @@ function getAmbiguousTypes(sourceParameters, targetParameters, args) {
   for (let parameterIndex = 0;parameterIndex < sourceParameters.length; parameterIndex++) {
     const sourceParameter = sourceParameters[parameterIndex];
     const targetParameter = targetParameters[parameterIndex];
-    if (sourceParameter.type === "tuple" && targetParameter.type === "tuple" && "components" in sourceParameter && "components" in targetParameter)
-      return getAmbiguousTypes(sourceParameter.components, targetParameter.components, args[parameterIndex]);
+    if (!targetParameter)
+      continue;
+    if (sourceParameter.type === "tuple" && targetParameter.type === "tuple" && "components" in sourceParameter && "components" in targetParameter) {
+      const value = args[parameterIndex];
+      const types = getAmbiguousTypes(sourceParameter.components, targetParameter.components, sourceParameter.components.map((component, index) => getComponentValue(value, component, index)));
+      if (types)
+        return types;
+      continue;
+    }
+    const sourceArray = getArrayComponents(sourceParameter.type);
+    const targetArray = getArrayComponents(targetParameter.type);
+    if (sourceArray && targetArray) {
+      const types = getAmbiguousTypes([
+        {
+          ...sourceParameter,
+          type: sourceArray[1]
+        }
+      ], [
+        {
+          ...targetParameter,
+          type: targetArray[1]
+        }
+      ], [args[parameterIndex]?.[0]]);
+      if (types)
+        return types;
+      continue;
+    }
     const sourceType = sourceParameter.type;
     const targetType = targetParameter.type;
     const arg = args[parameterIndex];
@@ -11721,14 +11680,19 @@ function getAmbiguousTypes(sourceParameters, targetParameters, args) {
     if (sourceType === "address" && targetType === "bytes20" || sourceType === "bytes20" && targetType === "address")
       ambiguous = true;
     else if (sourceType === "address" && targetType === "string" || sourceType === "string" && targetType === "address" || sourceType === "address" && targetType === "bytes" || sourceType === "bytes" && targetType === "address")
-      ambiguous = validate3(arg, { strict: false });
+      ambiguous = arg === undefined || validate3(arg, { strict: false });
     if (ambiguous)
       return [sourceType, targetType];
   }
   return;
 }
+function getComponentValue(arg, component, index) {
+  if (Array.isArray(arg))
+    return arg[index];
+  return arg?.[component.name];
+}
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/AbiItem.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/AbiItem.js
 function from3(abiItem, options = {}) {
   const { prepare = true } = options;
   const item = (() => {
@@ -11896,7 +11860,7 @@ class InvalidSelectorSizeError extends BaseError {
   }
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/AbiFunction.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/AbiFunction.js
 function decodeData(...parameters) {
   const [abiFunction, data, options] = (() => {
     if (Array.isArray(parameters[0])) {
@@ -11958,7 +11922,7 @@ function getSelector2(abiItem) {
   return getSelector(abiItem);
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/PersonalMessage.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/PersonalMessage.js
 var erc191PrefixHex = "0x19" + fromString(`Ethereum Signed Message:
 `).slice(2);
 function encode3(data) {
@@ -11969,7 +11933,7 @@ function getSignPayload2(data) {
   return keccak2562(encode3(data));
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/Signature.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/Signature.js
 function assert4(signature, options = {}) {
   const { recovered } = options;
   if (typeof signature.r === "undefined")
@@ -12093,8 +12057,8 @@ function fromRecoveredBytes(bytes) {
 }
 function toHex(signature) {
   assert4(signature);
-  const r = signature.r;
-  const s = signature.s;
+  const r = padLeft(signature.r, 32);
+  const s = padLeft(signature.s, 32);
   const signature_ = concat2(r, s, typeof signature.yParity === "number" ? fromNumber(yParityToV(signature.yParity), { size: 1 }) : "0x");
   return signature_;
 }
@@ -12166,7 +12130,7 @@ class InvalidVError extends BaseError {
   }
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/cryptoIo.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/cryptoIo.js
 function formatSignature(signature, as) {
   if (as === "Hex")
     return toHex(signature);
@@ -12175,7 +12139,7 @@ function formatSignature(signature, as) {
   return signature;
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/secp256k1.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/secp256k1.js
 var signDefault = (payload, privateKey, options) => secp256k1.sign(payload, privateKey, {
   ...options,
   format: "recovered",
@@ -12183,9 +12147,9 @@ var signDefault = (payload, privateKey, options) => secp256k1.sign(payload, priv
 });
 var sign = (payload, privateKey, options) => (overrides.Secp256k1?.sign ?? signDefault)(payload, privateKey, options);
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/entropy.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/entropy.js
 var extraEntropy = false;
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/Secp256k1.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/Secp256k1.js
 function sign2(options) {
   const { as = "Object", extraEntropy: extraEntropy2 = extraEntropy, hash, payload, privateKey } = options;
   const sigBytes = sign(from2(payload), from2(privateKey), {
@@ -12198,7 +12162,7 @@ function sign2(options) {
 var fromPrfDomain = fromString2("ox.secp256k1.fromPrf.v1");
 var fromSeedDomain = fromString2("ox.secp256k1.fromSeed.v1");
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/AccessList.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/AccessList.js
 function toTupleList(accessList) {
   if (!accessList || accessList.length === 0)
     return [];
@@ -12223,7 +12187,7 @@ class InvalidStorageKeySizeError extends BaseError {
   }
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/internal/tx.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/internal/tx.js
 function quantityToHex(value) {
   if (value === undefined || value === null)
     return "0x";
@@ -12232,7 +12196,7 @@ function quantityToHex(value) {
   return fromNumber(value);
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/Rlp.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/Rlp.js
 function from6(value, options) {
   const { as } = options;
   const ctx = { lengths: [], cursor: 0 };
@@ -12475,7 +12439,7 @@ function invalidNibble(hex) {
   return new BaseError(`Invalid hex string \`${hex}\`.`);
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/TxEnvelopeEip2930.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/TxEnvelopeEip2930.js
 function assert5(envelope) {
   const { chainId, gasPrice, to } = envelope;
   if (chainId <= 0)
@@ -12519,7 +12483,7 @@ function serialize(envelope, options = {}) {
   return concat2("0x01", fromHex3(serialized));
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/TxEnvelopeLegacy.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/TxEnvelopeLegacy.js
 function assert6(envelope) {
   const { chainId, gasPrice, to } = envelope;
   if (to)
@@ -12596,7 +12560,7 @@ function serialize2(envelope, options = {}) {
   return fromHex3(serialized);
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/Value.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/Value.js
 var exponents = {
   wei: 0,
   gwei: 9,
@@ -12629,7 +12593,7 @@ class InvalidDecimalsError extends BaseError {
   }
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/TxEnvelope.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/TxEnvelope.js
 class FeeCapTooHighError extends BaseError {
   name = "TransactionEnvelope.FeeCapTooHighError";
   constructor({ feeCap } = {}) {
@@ -12660,7 +12624,7 @@ class TipAboveFeeCapError extends BaseError {
   }
 }
 
-// ../../node_modules/.bun/ox@1.8.9+ff0372d108591aba/node_modules/ox/dist/core/TxEnvelopeEip1559.js
+// ../../node_modules/.bun/ox@1.8.12+ff0372d108591aba/node_modules/ox/dist/core/TxEnvelopeEip1559.js
 var serializedType = "0x02";
 function assert7(envelope) {
   const { chainId, maxPriorityFeePerGas, maxFeePerGas, to } = envelope;
@@ -12932,24 +12896,10 @@ var decodeEvm = (request, table = evmTokenTable) => {
     verifiability: "opaque"
   };
 };
-var isAccountRef2 = (value) => {
-  if (!isRecord3(value) || typeof value["kind"] !== "string")
-    return false;
-  if (value["kind"] === "hd")
-    return typeof value["walletId"] === "string" && typeof value["groupIndex"] === "number" && typeof value["template"] === "string";
-  if (value["kind"] === "imported")
-    return typeof value["keyId"] === "string" && typeof value["family"] === "string";
-  return false;
-};
 var normalizeEvm = (request) => {
   if (!isRecord3(request) || typeof request["kind"] !== "string")
     throw new ChainError("invalid-request", "request must be an object with a kind");
-  const { network } = request;
-  const { account } = request;
-  if (typeof network !== "string")
-    throw new ChainError("invalid-request", "request.network must be a string");
-  if (!isAccountRef2(account))
-    throw new ChainError("invalid-request", "request.account must be an AccountRef");
+  const { network, account } = requestBase(request);
   const chainId = networkChainId(network);
   if (request["kind"] === "evm.transaction") {
     const tx = normalizeEvmTransaction(request["tx"]);
@@ -12988,79 +12938,6 @@ var normalizeEvm = (request) => {
   throw new ChainError("unsupported", `unsupported sign request kind: ${request["kind"]}`);
 };
 
-// ../wallet-chains/dist/evm-sign.mjs
-function assertHex2(value, field) {
-  if (!/^0x(?:[0-9a-fA-F]{2})*$/.test(value))
-    throw new ChainError("invalid-quantity", `${field} must be 0x-prefixed bytes`);
-}
-var hex = (value, field) => {
-  assertHex2(value, field);
-  return value;
-};
-var key = (privateKey) => {
-  if (privateKey.length !== 32)
-    throw new ChainError("invalid-request", "private key must be 32 bytes");
-  return fromBytes(privateKey);
-};
-var accessEntry = (entry) => ({
-  address: hex(entry.address, "accessList.address"),
-  storageKeys: entry.storageKeys.map((k) => hex(k, "accessList.storageKeys"))
-});
-var sign3 = (payload, privateKey) => sign2({
-  payload,
-  privateKey,
-  as: "Object"
-});
-var signEvmTransaction = (tx, privateKey) => {
-  const privateKeyHex = key(privateKey);
-  const base = {
-    chainId: tx.chainId,
-    to: tx.to === undefined ? undefined : hex(tx.to, "to"),
-    data: hex(tx.data, "data"),
-    value: BigInt(tx.value),
-    nonce: BigInt(tx.nonce),
-    gas: BigInt(tx.gas)
-  };
-  if (tx.type === "legacy") {
-    const envelope = {
-      ...base,
-      type: "legacy",
-      gasPrice: BigInt(tx.gasPrice)
-    };
-    const signature = sign3(getSignPayload4(envelope), privateKeyHex);
-    return toBytes(serialize2(envelope, { signature }));
-  }
-  if (tx.type === "eip2930") {
-    const envelope = {
-      ...base,
-      type: "eip2930",
-      gasPrice: BigInt(tx.gasPrice),
-      accessList: tx.accessList.map(accessEntry)
-    };
-    const signature = sign3(getSignPayload3(envelope), privateKeyHex);
-    return toBytes(serialize(envelope, { signature }));
-  }
-  const envelope = {
-    ...base,
-    type: "eip1559",
-    accessList: tx.accessList.map(accessEntry),
-    maxFeePerGas: BigInt(tx.maxFeePerGas),
-    maxPriorityFeePerGas: BigInt(tx.maxPriorityFeePerGas)
-  };
-  const signature = sign3(getSignPayload5(envelope), privateKeyHex);
-  return toBytes(serialize3(envelope, { signature }));
-};
-var rs_v = (signature) => toBytes2(signature);
-var signEvmPersonalMessage = (message, privateKey) => {
-  const payload = getSignPayload2(fromBytes(message));
-  return rs_v(from5(sign3(payload, key(privateKey))));
-};
-var signEvmTypedData = (typedData, privateKey) => {
-  const { json } = parseTypedData(typedData, "eip155:1");
-  const payload = getSignPayload(json);
-  return rs_v(from5(sign3(payload, key(privateKey))));
-};
-
 // ../../node_modules/.bun/@solana+errors@8.5.0+ff0372d108591aba/node_modules/@solana/errors/dist/index.node.mjs
 var SOLANA_ERROR__BLOCK_HEIGHT_EXCEEDED = 1;
 var SOLANA_ERROR__INVALID_NONCE = 2;
@@ -14535,14 +14412,14 @@ var parseCompiledMessage = (bytes) => {
     lookupAddresses: lookups.map((l) => l.lookupTableAddress)
   };
 };
-var isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isStringArray = (value) => Array.isArray(value) && value.every((v) => typeof v === "string");
 var isNumberArray = (value) => Array.isArray(value) && value.every((v) => typeof v === "number");
-var isArrayLike = (value) => isRecord$1(value) && typeof value["length"] === "number";
-var isIx = (value) => isRecord$1(value) && typeof value["programAddressIndex"] === "number" && (value["accountIndices"] === undefined || isNumberArray(value["accountIndices"]) || isArrayLike(value["accountIndices"])) && value["data"] instanceof Uint8Array;
-var isLookup = (value) => isRecord$1(value) && typeof value["lookupTableAddress"] === "string" && (isNumberArray(value["readonlyIndexes"]) || value["readonlyIndexes"] instanceof Uint8Array) && (isNumberArray(value["writableIndexes"]) || value["writableIndexes"] instanceof Uint8Array);
+var isArrayLike = (value) => isRecord4(value) && typeof value["length"] === "number";
+var isIx = (value) => isRecord4(value) && typeof value["programAddressIndex"] === "number" && (value["accountIndices"] === undefined || isNumberArray(value["accountIndices"]) || isArrayLike(value["accountIndices"])) && value["data"] instanceof Uint8Array;
+var isLookup = (value) => isRecord4(value) && typeof value["lookupTableAddress"] === "string" && (isNumberArray(value["readonlyIndexes"]) || value["readonlyIndexes"] instanceof Uint8Array) && (isNumberArray(value["writableIndexes"]) || value["writableIndexes"] instanceof Uint8Array);
 var asCompiledMessage = (value) => {
-  if (!isRecord$1(value) || !isRecord$1(value["header"]))
+  if (!isRecord4(value) || !isRecord4(value["header"]))
     throw new ChainError("invalid-request", "compiled message failed to decode");
   const { header } = value;
   const { staticAccounts } = value;
@@ -14763,14 +14640,6 @@ var decodeTransaction2 = (request, signer, table) => {
   };
 };
 var decodeSolana = (request, signer, table = solanaTokenTable) => decodeTransaction2(request, signer, table);
-var isRecord4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var isAccountRef3 = (value) => {
-  if (!isRecord4(value) || typeof value["kind"] !== "string")
-    return false;
-  if (value["kind"] === "hd")
-    return typeof value["walletId"] === "string" && typeof value["groupIndex"] === "number" && typeof value["template"] === "string";
-  return value["kind"] === "imported" && typeof value["keyId"] === "string" && typeof value["family"] === "string";
-};
 var solanaNetwork = (network) => {
   if (!SOLANA_NETWORKS.includes(network))
     throw new ChainError("unsupported", `unknown Solana network: ${network}`);
@@ -14781,7 +14650,7 @@ var validateLookupTablesRaw = (tables) => {
   if (!Array.isArray(tables))
     throw new ChainError("unknown-field", "lookupTables must be an array");
   const parsed = tables.map((t) => {
-    if (!isRecord4(t) || typeof t["address"] !== "string" || !Array.isArray(t["addresses"]))
+    if (!isRecord2(t) || typeof t["address"] !== "string" || !Array.isArray(t["addresses"]))
       throw new ChainError("unknown-field", "lookupTables entries must be { address, addresses }");
     const addresses = t["addresses"].map((a) => {
       if (typeof a !== "string")
@@ -14797,14 +14666,9 @@ var validateLookupTablesRaw = (tables) => {
   return parsed;
 };
 var normalizeSolana = (request, signer) => {
-  if (!isRecord4(request) || typeof request["kind"] !== "string")
+  if (!isRecord2(request) || typeof request["kind"] !== "string")
     throw new ChainError("invalid-request", "request must be an object with a kind");
-  const { network } = request;
-  const { account } = request;
-  if (typeof network !== "string")
-    throw new ChainError("invalid-request", "request.network must be a string");
-  if (!isAccountRef3(account))
-    throw new ChainError("invalid-request", "request.account must be an AccountRef");
+  const { network, account } = requestBase(request);
   solanaNetwork(network);
   if (!isSolanaAddress(signer))
     throw new ChainError("invalid-address", "signer is not a base58 address");
@@ -14850,16 +14714,24 @@ var normalizeSolana = (request, signer) => {
   throw new ChainError("unsupported", `unsupported sign request kind: ${request["kind"]}`);
 };
 
-// ../wallet-chains/dist/solana-sign.mjs
-var signSolanaMessage = (message, privateKey) => {
+// ../wallet-chains/dist/bitcoin-sign.mjs
+var signBitcoinPsbt = (psbt, inputs, auxRand) => {
+  const tx = Transaction.fromPSBT(psbt);
+  for (const { index, privateKey } of inputs) {
+    if (privateKey.length !== 32)
+      throw new ChainError("invalid-request", `input ${index}: private key must be 32 bytes`);
+    if (!tx.signIdx(privateKey, index, undefined, auxRand(index)))
+      throw new ChainError("invalid-request", `input ${index}: key cannot sign`);
+  }
+  return tx.toPSBT(0);
+};
+var signBitcoinMessage = (request, privateKey, auxRand) => {
   if (privateKey.length !== 32)
-    throw new ChainError("invalid-request", "private key must be a 32-byte seed");
-  if (message.length === 0)
-    throw new ChainError("invalid-request", "message must not be empty");
-  const signature = ed25519.sign(message, privateKey);
-  if (signature.length !== 64)
-    throw new ChainError("invalid-request", "ed25519 produced a malformed signature");
-  return signature;
+    throw new ChainError("invalid-request", "private key must be 32 bytes");
+  if (request.format === "legacy")
+    return signLegacyMessage(request.message, privateKey);
+  const scriptPubKey = OutScript.encode(Address(bitcoinNetwork(request.network).params).decode(request.address));
+  return signBip322Simple(request.message, scriptPubKey, privateKey, auxRand);
 };
 
 // ../wallet-kernel/src/modules/chains/prompt.ts
@@ -14926,15 +14798,407 @@ function chainPrompt(locale, intent) {
   return { title, description: joinLines(lines.length === 0 ? [catalog.generic] : lines) };
 }
 
-// ../wallet-kernel/src/modules/chains/index.ts
+// ../wallet-kernel/src/modules/chains/shared.ts
 var BTC_PURPOSE = {
   "btc.bip44": 44,
   "btc.bip49": 49,
   "btc.bip84": 84,
   "btc.bip86": 86
 };
+var isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v) && !(v instanceof Uint8Array);
+var deepEqual = (a, b) => {
+  if (a === b) {
+    return true;
+  }
+  if (a instanceof Uint8Array || b instanceof Uint8Array) {
+    return a instanceof Uint8Array && b instanceof Uint8Array && a.length === b.length && a.every((byte, i) => byte === b[i]);
+  }
+  if (Array.isArray(a) || Array.isArray(b)) {
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
+  }
+  if (!isObj(a) || !isObj(b)) {
+    return false;
+  }
+  const ka = Object.keys(a);
+  const kb = new Set(Object.keys(b));
+  return ka.length === kb.size && ka.every((k) => kb.has(k) && deepEqual(a[k], b[k]));
+};
+function mapChainError(error) {
+  if (error instanceof ChainError) {
+    throw new KernelError("invalid-input", "invalid sign request");
+  }
+  throw error;
+}
+
+// ../wallet-kernel/src/modules/chains/bitcoin.ts
 var isPath = (path) => Array.isArray(path) && path.every((p) => typeof p === "number");
-var hex2 = (bytes) => bytes.reduce((acc, b) => acc + b.toString(16).padStart(2, "0"), "");
+var hex = (bytes) => bytes.reduce((acc, b) => acc + b.toString(16).padStart(2, "0"), "");
+var derivationOf = (owner, fingerprint, purpose) => {
+  if (purpose === 86) {
+    const claimed = (der) => der.fingerprint === fingerprint && isPath(der.path);
+    for (const [key, value] of owner.tapBip32Derivation ?? []) {
+      if (claimed(value.der)) {
+        return { pubkey: key, fingerprint: value.der.fingerprint, path: value.der.path };
+      }
+    }
+    return;
+  }
+  for (const [key, value] of owner.bip32Derivation ?? []) {
+    if (value.fingerprint === fingerprint) {
+      return { pubkey: key, fingerprint: value.fingerprint, path: value.path };
+    }
+  }
+  return;
+};
+var expectedPub = (purpose, pub) => purpose === 86 ? pub.slice(1) : pub;
+var expectedScript = (purpose, pub) => purpose === 86 ? p2tr(pub.slice(1)).script : purpose === 49 ? p2sh(p2wpkh(pub)).script : purpose === 44 ? p2pkh(pub).script : p2wpkh(pub).script;
+var childAt = (b, path) => {
+  const [purposePath, coinPath, groupPath, change, index] = path;
+  if (path.length !== 5 || purposePath !== b.purpose + b.hardened || coinPath !== b.coinType + b.hardened || groupPath !== b.account.groupIndex + b.hardened || change === undefined || index === undefined || change !== 0 && change !== 1 || index < 0 || index >= b.hardened) {
+    throw new KernelError("invalid-input", "derivation path is not this account's");
+  }
+  const child = b.accountNode.deriveChild(change).deriveChild(index);
+  b.children.push(child);
+  return child;
+};
+var bitcoinInput = (b, tx, idx) => {
+  const input = tx.getInput(idx);
+  const entry = derivationOf(input, b.master.fingerprint, b.purpose);
+  if (entry === undefined) {
+    throw new KernelError("invalid-input", `input ${idx}: derivation entry is not this account's`);
+  }
+  const child = childAt(b, entry.path);
+  const pub = child.publicKey;
+  const priv = child.privateKey;
+  if (pub === null || priv === null) {
+    throw new KernelError("integrity", "no key at derivation path");
+  }
+  if (!deepEqual(entry.pubkey, expectedPub(b.purpose, pub))) {
+    throw new KernelError("invalid-input", `input ${idx}: derivation pubkey is not ours`);
+  }
+  if (b.purpose === 44) {
+    if (input.nonWitnessUtxo === undefined) {
+      throw new KernelError("invalid-input", `input ${idx}: P2PKH spend requires nonWitnessUtxo`);
+    }
+    const vout = input.index;
+    const outs = input.nonWitnessUtxo.outputs;
+    const prevScript = vout === undefined ? undefined : outs[vout]?.script;
+    if (prevScript === undefined || !deepEqual(prevScript, expectedScript(b.purpose, pub))) {
+      throw new KernelError("invalid-input", `input ${idx}: nonWitnessUtxo prevout is not this key's`);
+    }
+  } else {
+    const prevout = input.witnessUtxo;
+    if (prevout === undefined || !deepEqual(prevout.script, expectedScript(b.purpose, pub))) {
+      throw new KernelError("invalid-input", `input ${idx}: prevout script is not this key's`);
+    }
+    if (b.purpose === 49 && (input.redeemScript === undefined || !deepEqual(input.redeemScript, p2wpkh(pub).script))) {
+      throw new KernelError("invalid-input", `input ${idx}: redeemScript is not this key's`);
+    }
+  }
+  return { index: idx, privateKey: priv };
+};
+var bitcoinOwnScripts = (b, tx) => {
+  const ownScripts = new Set;
+  for (let i = 0;i < tx.outputsLength; i++) {
+    const output = tx.getOutput(i);
+    if (output.script === undefined) {
+      continue;
+    }
+    const entry = derivationOf(output, b.master.fingerprint, b.purpose);
+    if (entry === undefined) {
+      continue;
+    }
+    try {
+      const child = childAt(b, entry.path);
+      const pub = child.publicKey;
+      if (pub !== null && deepEqual(output.script, expectedScript(b.purpose, pub))) {
+        ownScripts.add(hex(output.script));
+      }
+    } catch {
+      continue;
+    }
+  }
+  return ownScripts;
+};
+var executeBitcoinPsbt = (b, request, random, intentOnly) => {
+  const tx = Transaction.fromPSBT(request.psbt);
+  const inputs = request.sign.map((idx) => bitcoinInput(b, tx, idx));
+  const ownScripts = bitcoinOwnScripts(b, tx);
+  let normalized;
+  try {
+    normalized = normalizeBitcoin(request);
+  } catch (error) {
+    mapChainError(error);
+  }
+  if (!deepEqual(normalized, request)) {
+    throw new KernelError("invalid-input", "request is not normalized");
+  }
+  let intent;
+  try {
+    intent = decodeBitcoinPsbt(request, ownScripts);
+  } catch (error) {
+    mapChainError(error);
+  }
+  if (intentOnly) {
+    return { prompt: intent };
+  }
+  return {
+    kind: "bitcoin.psbt",
+    signedPsbt: signBitcoinPsbt(request.psbt, inputs, () => random(32))
+  };
+};
+var executeBitcoinMessage = (b, request, random, intentOnly) => {
+  if (request.format === "legacy" && b.account.template !== "btc.bip44") {
+    throw new KernelError("unsupported", "legacy message format is btc.bip44-only");
+  }
+  const child = childAt(b, [
+    b.purpose + b.hardened,
+    b.coinType + b.hardened,
+    b.account.groupIndex + b.hardened,
+    request.change,
+    request.index
+  ]);
+  const pub = child.publicKey;
+  const priv = child.privateKey;
+  if (pub === null || priv === null) {
+    throw new KernelError("integrity", "no key at derivation path");
+  }
+  const derived = b.purpose === 86 ? p2tr(pub.slice(1), undefined, b.net.params).address : b.purpose === 49 ? p2sh(p2wpkh(pub, b.net.params), b.net.params).address : b.purpose === 44 ? p2pkh(pub, b.net.params).address : p2wpkh(pub, b.net.params).address;
+  if (derived !== request.address) {
+    throw new KernelError("invalid-input", "address is not ours");
+  }
+  let normalized;
+  try {
+    normalized = normalizeBitcoin(request);
+  } catch (error) {
+    mapChainError(error);
+  }
+  if (!deepEqual(normalized, request)) {
+    throw new KernelError("invalid-input", "request is not normalized");
+  }
+  try {
+    decodeMessageTarget(request);
+  } catch (error) {
+    mapChainError(error);
+  }
+  if (intentOnly) {
+    return { prompt: MESSAGE_INTENT };
+  }
+  return {
+    kind: "bitcoin.message",
+    signature: signBitcoinMessage(request, priv, () => random(32))
+  };
+};
+var executeBitcoin = (random, request, account, seed, intentOnly) => {
+  const net = bitcoinNetwork(request.network);
+  const master = HDKey.fromMasterSeed(seed, net.bip32);
+  try {
+    const purpose = BTC_PURPOSE[account.template] ?? 84;
+    const { coinType } = net;
+    const hardened = 2147483648;
+    const accountNode = master.derive(`m/${purpose}'/${coinType}'/${account.groupIndex}'`);
+    const children = [];
+    const b = {
+      master,
+      accountNode,
+      children,
+      purpose,
+      coinType,
+      hardened,
+      account,
+      net
+    };
+    try {
+      if (request.kind === "bitcoin.psbt") {
+        return executeBitcoinPsbt(b, request, random, intentOnly);
+      }
+      return executeBitcoinMessage(b, request, random, intentOnly);
+    } finally {
+      for (const child of children) {
+        child.wipePrivateData();
+      }
+      accountNode.wipePrivateData();
+    }
+  } finally {
+    master.wipePrivateData();
+  }
+};
+
+// ../wallet-chains/dist/evm-sign.mjs
+function assertHex2(value, field) {
+  if (!/^0x(?:[0-9a-fA-F]{2})*$/.test(value))
+    throw new ChainError("invalid-quantity", `${field} must be 0x-prefixed bytes`);
+}
+var hex2 = (value, field) => {
+  assertHex2(value, field);
+  return value;
+};
+var key = (privateKey) => {
+  if (privateKey.length !== 32)
+    throw new ChainError("invalid-request", "private key must be 32 bytes");
+  return fromBytes(privateKey);
+};
+var accessEntry = (entry) => ({
+  address: hex2(entry.address, "accessList.address"),
+  storageKeys: entry.storageKeys.map((k) => hex2(k, "accessList.storageKeys"))
+});
+var sign3 = (payload, privateKey) => sign2({
+  payload,
+  privateKey,
+  as: "Object"
+});
+var signEvmTransaction = (tx, privateKey) => {
+  const privateKeyHex = key(privateKey);
+  const base = {
+    chainId: tx.chainId,
+    to: tx.to === undefined ? undefined : hex2(tx.to, "to"),
+    data: hex2(tx.data, "data"),
+    value: BigInt(tx.value),
+    nonce: BigInt(tx.nonce),
+    gas: BigInt(tx.gas)
+  };
+  if (tx.type === "legacy") {
+    const envelope = {
+      ...base,
+      type: "legacy",
+      gasPrice: BigInt(tx.gasPrice)
+    };
+    const signature = sign3(getSignPayload4(envelope), privateKeyHex);
+    return toBytes(serialize2(envelope, { signature }));
+  }
+  if (tx.type === "eip2930") {
+    const envelope = {
+      ...base,
+      type: "eip2930",
+      gasPrice: BigInt(tx.gasPrice),
+      accessList: tx.accessList.map(accessEntry)
+    };
+    const signature = sign3(getSignPayload3(envelope), privateKeyHex);
+    return toBytes(serialize(envelope, { signature }));
+  }
+  const envelope = {
+    ...base,
+    type: "eip1559",
+    accessList: tx.accessList.map(accessEntry),
+    maxFeePerGas: BigInt(tx.maxFeePerGas),
+    maxPriorityFeePerGas: BigInt(tx.maxPriorityFeePerGas)
+  };
+  const signature = sign3(getSignPayload5(envelope), privateKeyHex);
+  return toBytes(serialize3(envelope, { signature }));
+};
+var rs_v = (signature) => toBytes2(signature);
+var signEvmPersonalMessage = (message, privateKey) => {
+  const payload = getSignPayload2(fromBytes(message));
+  return rs_v(from5(sign3(payload, key(privateKey))));
+};
+var signEvmTypedData = (typedData, privateKey) => {
+  const { json } = parseTypedData(typedData, "eip155:1");
+  const payload = getSignPayload(json);
+  return rs_v(from5(sign3(payload, key(privateKey))));
+};
+
+// ../wallet-kernel/src/modules/chains/evm.ts
+var executeEvm = (request, account, seed, intentOnly) => {
+  const master = HDKey.fromMasterSeed(seed);
+  try {
+    const child = master.derive(`m/44'/60'/0'/0/${account.groupIndex}`);
+    try {
+      const priv = child.privateKey;
+      if (priv === null) {
+        throw new KernelError("integrity", "no private key at account path");
+      }
+      let normalized;
+      try {
+        normalized = normalizeEvm(request);
+      } catch (error) {
+        mapChainError(error);
+      }
+      if (!deepEqual(normalized, request)) {
+        throw new KernelError("invalid-input", "request is not normalized");
+      }
+      let intent;
+      try {
+        intent = decodeEvm(request);
+      } catch (error) {
+        mapChainError(error);
+      }
+      if (intentOnly) {
+        return { prompt: intent };
+      }
+      if (request.kind === "evm.transaction") {
+        return {
+          kind: "evm.transaction",
+          signedTransaction: signEvmTransaction(request.tx, priv)
+        };
+      }
+      if (request.kind === "evm.personal-message") {
+        return {
+          kind: "evm.personal-message",
+          signature: signEvmPersonalMessage(request.message, priv)
+        };
+      }
+      return {
+        kind: "evm.typed-data",
+        signature: signEvmTypedData(request.typedData, priv)
+      };
+    } finally {
+      child.wipePrivateData();
+    }
+  } finally {
+    master.wipePrivateData();
+  }
+};
+
+// ../wallet-chains/dist/solana-sign.mjs
+var signSolanaMessage = (message, privateKey) => {
+  if (privateKey.length !== 32)
+    throw new ChainError("invalid-request", "private key must be a 32-byte seed");
+  if (message.length === 0)
+    throw new ChainError("invalid-request", "message must not be empty");
+  const signature = ed25519.sign(message, privateKey);
+  if (signature.length !== 64)
+    throw new ChainError("invalid-request", "ed25519 produced a malformed signature");
+  return signature;
+};
+
+// ../wallet-kernel/src/modules/chains/solana.ts
+var executeSolana = (request, account, seed, intentOnly) => {
+  const root = HDKey2.fromMasterSeed(seed);
+  const child = root.derive(`m/44'/501'/${account.groupIndex}'/0'`);
+  try {
+    const priv = child.privateKey;
+    const signer = solanaAddressFromPublicKey(ed25519.getPublicKey(priv));
+    let normalized;
+    try {
+      normalized = normalizeSolana(request, signer);
+    } catch (error) {
+      mapChainError(error);
+    }
+    if (!deepEqual(normalized, request)) {
+      throw new KernelError("invalid-input", "request is not normalized");
+    }
+    let intent = MESSAGE_INTENT;
+    if (request.kind === "solana.transaction") {
+      try {
+        intent = decodeSolana(request, signer);
+      } catch (error) {
+        mapChainError(error);
+      }
+    }
+    if (intentOnly) {
+      return { prompt: intent };
+    }
+    return {
+      kind: request.kind,
+      signature: signSolanaMessage(request.message, priv)
+    };
+  } finally {
+    wipe(child.privateKey);
+    wipe(root.privateKey);
+  }
+};
+
+// ../wallet-kernel/src/modules/chains/index.ts
 var checkNetwork = (template, network) => {
   if (template.startsWith("evm.") && !network.startsWith("eip155:")) {
     throw new KernelError("invalid-input", "evm.bip44 requires an eip155 network");
@@ -14991,382 +15255,86 @@ var accountFor = (master, seed, template, network, groupIndex) => {
     account.wipePrivateData();
   }
 };
-var isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v) && !(v instanceof Uint8Array);
-var deepEqual = (a, b) => {
-  if (a === b) {
-    return true;
-  }
-  if (a instanceof Uint8Array || b instanceof Uint8Array) {
-    return a instanceof Uint8Array && b instanceof Uint8Array && a.length === b.length && a.every((byte, i) => byte === b[i]);
-  }
-  if (Array.isArray(a) || Array.isArray(b)) {
-    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
-  }
-  if (!isObj(a) || !isObj(b)) {
-    return false;
-  }
-  const ka = Object.keys(a);
-  const kb = new Set(Object.keys(b));
-  return ka.length === kb.size && ka.every((k) => kb.has(k) && deepEqual(a[k], b[k]));
-};
-function mapChainError(error) {
-  if (error instanceof ChainError) {
-    throw new KernelError("invalid-input", "invalid sign request");
+var walletAccounts = async (ctx, params, session) => {
+  const { dek } = ctx.session.require(session);
+  const record = ctx.image.records.find((entry) => entry.kind === "entropy" && entry.id === params.walletId);
+  if (record === undefined) {
+    throw new KernelError("not-found", "no such wallet");
   }
-  throw error;
-}
-function createChainsModule() {
-  const vault = {
-    ownsRecord: () => false,
-    claimUnlocked: (records) => records,
-    forget: () => {
-      return;
-    },
-    lock: () => {
-      return;
-    },
-    backupSecrets: () => [],
-    backupRecords: () => [],
-    walletDeleteOps: () => []
-  };
-  const handlers = {
-    "wallet.accounts": async (ctx, params, session) => {
-      const { dek } = ctx.session.require(session);
-      const record = ctx.image.records.find((entry) => entry.kind === "entropy" && entry.id === params.walletId);
-      if (record === undefined) {
-        throw new KernelError("not-found", "no such wallet");
-      }
-      checkNetwork(params.template, params.network);
-      const entropy = openRecord(dek, record);
-      let seed;
-      try {
-        seed = await seedFromEntropy(entropy, ctx.platform.pbkdf2);
-      } finally {
-        wipe(entropy);
-      }
-      try {
-        const master = HDKey.fromMasterSeed(seed, params.template.startsWith("btc.") ? bitcoinNetwork(params.network).bip32 : undefined);
-        try {
-          return accountFor(master, seed, params.template, params.network, params.groupIndex);
-        } finally {
-          master.wipePrivateData();
-        }
-      } finally {
-        wipe(seed);
-      }
-    },
-    "chain.sign": async (ctx, params, session) => {
-      const { dek } = ctx.session.require(session);
-      const { request, verify } = params;
-      const { account } = request;
-      if (account.kind !== "hd") {
-        throw new KernelError("unsupported", "imported accounts are not yet supported");
-      }
-      const [family] = request.kind.split(".", 1);
-      const expected = family === "evm" ? ["evm.bip44"] : family === "solana" ? ["solana.bip44-change"] : ["btc.bip44", "btc.bip49", "btc.bip84", "btc.bip86"];
-      if (!expected.includes(account.template)) {
-        throw new KernelError("invalid-input", "account template does not match the request family");
-      }
-      const record = ctx.image.records.find((entry) => entry.kind === "entropy" && entry.id === account.walletId);
-      if (record === undefined) {
-        throw new KernelError("not-found", "no such wallet");
-      }
-      const execute = (seed, intentOnly) => {
-        if (request.kind === "evm.transaction" || request.kind === "evm.personal-message" || request.kind === "evm.typed-data") {
-          const master = HDKey.fromMasterSeed(seed);
-          try {
-            const child = master.derive(`m/44'/60'/0'/0/${account.groupIndex}`);
-            try {
-              const priv = child.privateKey;
-              if (priv === null) {
-                throw new KernelError("integrity", "no private key at account path");
-              }
-              let normalized;
-              try {
-                normalized = normalizeEvm(request);
-              } catch (error) {
-                mapChainError(error);
-              }
-              if (!deepEqual(normalized, request)) {
-                throw new KernelError("invalid-input", "request is not normalized");
-              }
-              let intent;
-              try {
-                intent = decodeEvm(request);
-              } catch (error) {
-                mapChainError(error);
-              }
-              if (intentOnly) {
-                return { prompt: intent };
-              }
-              if (request.kind === "evm.transaction") {
-                return {
-                  kind: "evm.transaction",
-                  signedTransaction: signEvmTransaction(request.tx, priv)
-                };
-              }
-              if (request.kind === "evm.personal-message") {
-                return {
-                  kind: "evm.personal-message",
-                  signature: signEvmPersonalMessage(request.message, priv)
-                };
-              }
-              return {
-                kind: "evm.typed-data",
-                signature: signEvmTypedData(request.typedData, priv)
-              };
-            } finally {
-              child.wipePrivateData();
-            }
-          } finally {
-            master.wipePrivateData();
-          }
-        }
-        if (request.kind === "bitcoin.psbt" || request.kind === "bitcoin.message") {
-          const net = bitcoinNetwork(request.network);
-          const master = HDKey.fromMasterSeed(seed, net.bip32);
-          try {
-            const purpose = BTC_PURPOSE[account.template] ?? 84;
-            const { coinType } = net;
-            const hardened = 2147483648;
-            const accountNode = master.derive(`m/${purpose}'/${coinType}'/${account.groupIndex}'`);
-            const children = [];
-            const derivation = (owner) => {
-              if (purpose === 86) {
-                const claimed = (der) => der.fingerprint === master.fingerprint && isPath(der.path);
-                for (const [key, value] of owner.tapBip32Derivation ?? []) {
-                  if (claimed(value.der)) {
-                    return {
-                      pubkey: key,
-                      fingerprint: value.der.fingerprint,
-                      path: value.der.path
-                    };
-                  }
-                }
-                return;
-              }
-              for (const [key, value] of owner.bip32Derivation ?? []) {
-                if (value.fingerprint === master.fingerprint) {
-                  return { pubkey: key, fingerprint: value.fingerprint, path: value.path };
-                }
-              }
-              return;
-            };
-            const childAt = (path) => {
-              const [purposePath, coinPath, groupPath, change, index] = path;
-              if (path.length !== 5 || purposePath !== purpose + hardened || coinPath !== coinType + hardened || groupPath !== account.groupIndex + hardened || change === undefined || index === undefined || change !== 0 && change !== 1 || index < 0 || index >= hardened) {
-                throw new KernelError("invalid-input", "derivation path is not this account's");
-              }
-              const child = accountNode.deriveChild(change).deriveChild(index);
-              children.push(child);
-              return child;
-            };
-            const expectedPub = (pub) => purpose === 86 ? pub.slice(1) : pub;
-            const expectedScript = (pub) => purpose === 86 ? p2tr(pub.slice(1)).script : purpose === 49 ? p2sh(p2wpkh(pub)).script : purpose === 44 ? p2pkh(pub).script : p2wpkh(pub).script;
-            try {
-              if (request.kind === "bitcoin.psbt") {
-                const tx = Transaction.fromPSBT(request.psbt);
-                const inputs = [];
-                for (const idx of request.sign) {
-                  const input = tx.getInput(idx);
-                  const entry = derivation(input);
-                  if (entry === undefined) {
-                    throw new KernelError("invalid-input", `input ${idx}: derivation entry is not this account's`);
-                  }
-                  const child = childAt(entry.path);
-                  const pub = child.publicKey;
-                  const priv = child.privateKey;
-                  if (pub === null || priv === null) {
-                    throw new KernelError("integrity", "no key at derivation path");
-                  }
-                  if (!deepEqual(entry.pubkey, expectedPub(pub))) {
-                    throw new KernelError("invalid-input", `input ${idx}: derivation pubkey is not ours`);
-                  }
-                  if (purpose === 44) {
-                    if (input.nonWitnessUtxo === undefined) {
-                      throw new KernelError("invalid-input", `input ${idx}: P2PKH spend requires nonWitnessUtxo`);
-                    }
-                    const vout = input.index;
-                    const outs = input.nonWitnessUtxo.outputs;
-                    const prevScript = vout === undefined ? undefined : outs[vout]?.script;
-                    if (prevScript === undefined || !deepEqual(prevScript, expectedScript(pub))) {
-                      throw new KernelError("invalid-input", `input ${idx}: nonWitnessUtxo prevout is not this key's`);
-                    }
-                  } else {
-                    const prevout = input.witnessUtxo;
-                    if (prevout === undefined || !deepEqual(prevout.script, expectedScript(pub))) {
-                      throw new KernelError("invalid-input", `input ${idx}: prevout script is not this key's`);
-                    }
-                    if (purpose === 49 && (input.redeemScript === undefined || !deepEqual(input.redeemScript, p2wpkh(pub).script))) {
-                      throw new KernelError("invalid-input", `input ${idx}: redeemScript is not this key's`);
-                    }
-                  }
-                  inputs.push({ index: idx, privateKey: priv });
-                }
-                const ownScripts = new Set;
-                for (let i = 0;i < tx.outputsLength; i++) {
-                  const output = tx.getOutput(i);
-                  if (output.script === undefined) {
-                    continue;
-                  }
-                  const entry = derivation(output);
-                  if (entry === undefined) {
-                    continue;
-                  }
-                  try {
-                    const child = childAt(entry.path);
-                    const pub = child.publicKey;
-                    if (pub !== null && deepEqual(output.script, expectedScript(pub))) {
-                      ownScripts.add(hex2(output.script));
-                    }
-                  } catch {
-                    continue;
-                  }
-                }
-                let normalized;
-                try {
-                  normalized = normalizeBitcoin(request);
-                } catch (error) {
-                  mapChainError(error);
-                }
-                if (!deepEqual(normalized, request)) {
-                  throw new KernelError("invalid-input", "request is not normalized");
-                }
-                let intent;
-                try {
-                  intent = decodeBitcoinPsbt(request, ownScripts);
-                } catch (error) {
-                  mapChainError(error);
-                }
-                if (intentOnly) {
-                  return { prompt: intent };
-                }
-                return {
-                  kind: "bitcoin.psbt",
-                  signedPsbt: signBitcoinPsbt(request.psbt, inputs, () => ctx.platform.random(32))
-                };
-              }
-              if (request.format === "legacy" && account.template !== "btc.bip44") {
-                throw new KernelError("unsupported", "legacy message format is btc.bip44-only");
-              }
-              const child = childAt([
-                purpose + hardened,
-                coinType + hardened,
-                account.groupIndex + hardened,
-                request.change,
-                request.index
-              ]);
-              const pub = child.publicKey;
-              const priv = child.privateKey;
-              if (pub === null || priv === null) {
-                throw new KernelError("integrity", "no key at derivation path");
-              }
-              const derived = purpose === 86 ? p2tr(pub.slice(1), undefined, net.params).address : purpose === 49 ? p2sh(p2wpkh(pub, net.params), net.params).address : purpose === 44 ? p2pkh(pub, net.params).address : p2wpkh(pub, net.params).address;
-              if (derived !== request.address) {
-                throw new KernelError("invalid-input", "address is not ours");
-              }
-              let normalized;
-              try {
-                normalized = normalizeBitcoin(request);
-              } catch (error) {
-                mapChainError(error);
-              }
-              if (!deepEqual(normalized, request)) {
-                throw new KernelError("invalid-input", "request is not normalized");
-              }
-              try {
-                decodeMessageTarget(request);
-              } catch (error) {
-                mapChainError(error);
-              }
-              if (intentOnly) {
-                return { prompt: MESSAGE_INTENT };
-              }
-              return {
-                kind: "bitcoin.message",
-                signature: signBitcoinMessage(request, priv, () => ctx.platform.random(32))
-              };
-            } finally {
-              for (const child of children) {
-                child.wipePrivateData();
-              }
-              accountNode.wipePrivateData();
-            }
-          } finally {
-            master.wipePrivateData();
-          }
-        }
-        const root = HDKey2.fromMasterSeed(seed);
-        const child = root.derive(`m/44'/501'/${account.groupIndex}'/0'`);
-        try {
-          const priv = child.privateKey;
-          const signer = solanaAddressFromPublicKey(ed25519.getPublicKey(priv));
-          let normalized;
-          try {
-            normalized = normalizeSolana(request, signer);
-          } catch (error) {
-            mapChainError(error);
-          }
-          if (!deepEqual(normalized, request)) {
-            throw new KernelError("invalid-input", "request is not normalized");
-          }
-          let intent = MESSAGE_INTENT;
-          if (request.kind === "solana.transaction") {
-            try {
-              intent = decodeSolana(request, signer);
-            } catch (error) {
-              mapChainError(error);
-            }
-          }
-          if (intentOnly) {
-            return { prompt: intent };
-          }
-          return {
-            kind: request.kind,
-            signature: signSolanaMessage(request.message, priv)
-          };
-        } finally {
-          wipe(child.privateKey);
-          wipe(root.privateKey);
-        }
-      };
-      const withSeed = async (run) => {
-        const entropy = openRecord(dek, record);
-        let seed;
-        try {
-          seed = await seedFromEntropy(entropy, ctx.platform.pbkdf2);
-        } finally {
-          wipe(entropy);
-        }
-        try {
-          return run(seed);
-        } finally {
-          wipe(seed);
-        }
-      };
-      const prepared = await withSeed((seed) => execute(seed, true));
-      if (!("prompt" in prepared)) {
-        throw new KernelError("integrity", "unreachable: prepare pass signed");
-      }
-      await verifyFactor(ctx.platform, ctx.image, verify, dek, () => chainPrompt(promptLocale(ctx.platform.keystore?.locale ?? "en"), prepared.prompt));
-      ctx.session.require(session);
-      const signed = await withSeed((seed) => execute(seed, false));
-      if ("prompt" in signed) {
-        throw new KernelError("integrity", "unreachable: sign pass did not sign");
-      }
-      return signed;
+  checkNetwork(params.template, params.network);
+  return withWalletSeed(ctx.platform.pbkdf2, dek, record, (seed) => {
+    const master = HDKey.fromMasterSeed(seed, params.template.startsWith("btc.") ? bitcoinNetwork(params.network).bip32 : undefined);
+    try {
+      return accountFor(master, seed, params.template, params.network, params.groupIndex);
+    } finally {
+      master.wipePrivateData();
+    }
+  });
+};
+var chainSign = async (ctx, params, session) => {
+  const { dek } = ctx.session.require(session);
+  const { request, verify } = params;
+  const { account } = request;
+  if (account.kind !== "hd") {
+    throw new KernelError("unsupported", "imported accounts are not yet supported");
+  }
+  const [family] = request.kind.split(".", 1);
+  const expected = family === "evm" ? ["evm.bip44"] : family === "solana" ? ["solana.bip44-change"] : ["btc.bip44", "btc.bip49", "btc.bip84", "btc.bip86"];
+  if (!expected.includes(account.template)) {
+    throw new KernelError("invalid-input", "account template does not match the request family");
+  }
+  const record = ctx.image.records.find((entry) => entry.kind === "entropy" && entry.id === account.walletId);
+  if (record === undefined) {
+    throw new KernelError("not-found", "no such wallet");
+  }
+  const execute = (seed, intentOnly) => {
+    if (request.kind === "evm.transaction" || request.kind === "evm.personal-message" || request.kind === "evm.typed-data") {
+      return executeEvm(request, account, seed, intentOnly);
     }
+    if (request.kind === "bitcoin.psbt" || request.kind === "bitcoin.message") {
+      return executeBitcoin(ctx.platform.random, request, account, seed, intentOnly);
+    }
+    return executeSolana(request, account, seed, intentOnly);
+  };
+  const withSeed = async (run) => withWalletSeed(ctx.platform.pbkdf2, dek, record, run);
+  const prepared = await withSeed((seed) => execute(seed, true));
+  if (!("prompt" in prepared)) {
+    throw new KernelError("integrity", "unreachable: prepare pass signed");
+  }
+  await verifyFactor(ctx.platform, ctx.image, verify, dek, () => chainPrompt(promptLocale(ctx.platform.keystore?.locale ?? "en"), prepared.prompt));
+  ctx.session.require(session);
+  const signed = await withSeed((seed) => execute(seed, false));
+  if ("prompt" in signed) {
+    throw new KernelError("integrity", "unreachable: sign pass did not sign");
+  }
+  return signed;
+};
+function createChainsModule() {
+  const vault = {
+    ownsRecord: () => false,
+    claimUnlocked: (records) => records,
+    forget: () => {
+      return;
+    },
+    lock: () => {
+      return;
+    },
+    walletDeleteOps: () => []
+  };
+  const handlers = {
+    "wallet.accounts": walletAccounts,
+    "chain.sign": chainSign
   };
   return { vault, handlers };
 }
 
 // ../wallet-kernel/src/modules/nostr/derive.ts
 var NIP06_PATH = "m/44'/1237'/i'/0/0";
-function nostrKeyAt(master, groupIndex) {
-  if (!Number.isSafeInteger(groupIndex) || groupIndex < 0 || groupIndex > 2147483647) {
-    throw new KernelError("invalid-input", "group index out of range");
+function nostrKeyAt(master, index) {
+  if (!Number.isSafeInteger(index) || index < 0 || index > 2147483647) {
+    throw new KernelError("invalid-input", "identity index out of range");
   }
-  const path = NIP06_PATH.split("/").map((segment) => segment === "i'" ? `${groupIndex}'` : segment).join("/");
+  const path = NIP06_PATH.split("/").map((segment) => segment === "i'" ? `${index}'` : segment).join("/");
   const node = master.derive(path);
   try {
     const key = node.privateKey;
@@ -15381,32 +15349,6 @@ function nostrKeyAt(master, groupIndex) {
 
 // ../../node_modules/.bun/@qntx+nostr@0.15.3+ea9f70ecde856c26/node_modules/@qntx/nostr/dist/nips/nip19.mjs
 var Bech32MaxSize2 = 5000;
-var Nip19Error2 = class extends NostrError {
-  name = "Nip19Error";
-};
-function parseTLV(data) {
-  const result = {};
-  let rest = data;
-  while (rest.length > 0) {
-    if (rest.length < 2)
-      throw new Nip19Error2("not enough data to read TLV");
-    const t = rest.at(0);
-    const l = rest.at(1);
-    if (t === undefined || l === undefined)
-      throw new Nip19Error2("not enough data to read TLV");
-    const v = rest.slice(2, 2 + l);
-    rest = rest.slice(2 + l);
-    if (v.length < l)
-      throw new Nip19Error2(`not enough data to read on TLV ${t}`);
-    result[t] = result[t] ?? [];
-    result[t].push(v);
-  }
-  return result;
-}
-function assertNip19Kind(kind) {
-  if (!Number.isInteger(kind) || kind < 0 || kind > 65535)
-    throw new Nip19Error2(`invalid kind: ${kind}`);
-}
 function encodeBech32(prefix, data) {
   const words = bech32.toWords(data);
   return bech32.encode(prefix, words, Bech32MaxSize2);
@@ -15418,106 +15360,6 @@ function nsecEncode2(key) {
   assertByteLength(key, 32, "secret key");
   return encodeBytes("nsec", key);
 }
-function readUint32(bytes) {
-  return new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(0);
-}
-function decode3(code) {
-  let prefix;
-  let data;
-  try {
-    const { prefix: hrp, words } = bech32.decode(code, Bech32MaxSize2);
-    prefix = hrp;
-    data = new Uint8Array(bech32.fromWords(words));
-  } catch (error) {
-    throw new Nip19Error2(`invalid bech32: ${errorMessage(error)}`, { cause: error });
-  }
-  switch (prefix) {
-    case "nprofile": {
-      const tlv = parseTLV(data);
-      if (!tlv[0]?.[0])
-        throw new Nip19Error2("missing TLV 0 for nprofile");
-      if (tlv[0][0].length !== 32)
-        throw new Nip19Error2("TLV 0 should be 32 bytes");
-      return {
-        type: "nprofile",
-        data: {
-          pubkey: bytesToHex$1(tlv[0][0]),
-          relays: tlv[1] ? tlv[1].map((d) => utf8Decoder.decode(d)) : []
-        }
-      };
-    }
-    case "nevent": {
-      const tlv = parseTLV(data);
-      if (!tlv[0]?.[0])
-        throw new Nip19Error2("missing TLV 0 for nevent");
-      if (tlv[0][0].length !== 32)
-        throw new Nip19Error2("TLV 0 should be 32 bytes");
-      if (tlv[2]?.[0] && tlv[2][0].length !== 32)
-        throw new Nip19Error2("TLV 2 should be 32 bytes");
-      if (tlv[3]?.[0] && tlv[3][0].length !== 4)
-        throw new Nip19Error2("TLV 3 should be 4 bytes");
-      const pointer = {
-        id: bytesToHex$1(tlv[0][0]),
-        relays: tlv[1] ? tlv[1].map((d) => utf8Decoder.decode(d)) : []
-      };
-      const author = tlv[2]?.[0];
-      if (author !== undefined)
-        pointer.author = bytesToHex$1(author);
-      const kind = tlv[3]?.[0];
-      if (kind !== undefined) {
-        pointer.kind = readUint32(kind);
-        assertNip19Kind(pointer.kind);
-      }
-      return {
-        type: "nevent",
-        data: pointer
-      };
-    }
-    case "naddr": {
-      const tlv = parseTLV(data);
-      if (!tlv[0]?.[0])
-        throw new Nip19Error2("missing TLV 0 for naddr");
-      if (!tlv[2]?.[0])
-        throw new Nip19Error2("missing TLV 2 for naddr");
-      if (tlv[2][0].length !== 32)
-        throw new Nip19Error2("TLV 2 should be 32 bytes");
-      if (!tlv[3]?.[0])
-        throw new Nip19Error2("missing TLV 3 for naddr");
-      if (tlv[3][0].length !== 4)
-        throw new Nip19Error2("TLV 3 should be 4 bytes");
-      const naddrKind = readUint32(tlv[3][0]);
-      assertNip19Kind(naddrKind);
-      return {
-        type: "naddr",
-        data: {
-          identifier: utf8Decoder.decode(tlv[0][0]),
-          pubkey: bytesToHex$1(tlv[2][0]),
-          kind: naddrKind,
-          relays: tlv[1] ? tlv[1].map((d) => utf8Decoder.decode(d)) : []
-        }
-      };
-    }
-    case "nsec":
-      if (data.length !== 32)
-        throw new Nip19Error2("nsec must be 32 bytes");
-      if (!secp256k1.utils.isValidSecretKey(data))
-        throw new Nip19Error2("invalid nsec secret key");
-      return {
-        type: "nsec",
-        data
-      };
-    case "npub":
-    case "note":
-      if (data.length !== 32)
-        throw new Nip19Error2(`${prefix} must be 32 bytes`);
-      return {
-        type: prefix,
-        data: bytesToHex$1(data)
-      };
-    default:
-      throw new Nip19Error2(`unknown prefix ${prefix}`);
-  }
-}
 
 // ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/scrypt.js
 function XorAndSalsa(prev, pi, input, ii, out, oi) {
@@ -15682,7 +15524,6 @@ async function scryptAsync(password, salt, opts) {
 var VERSION2 = 2;
 var SALT_LEN = 16;
 var NONCE_LEN = 24;
-var PAYLOAD_LEN = 91;
 var LOGN_MIN = 1;
 var LOGN_MAX = 22;
 var SCRYPT_R = 8;
@@ -15726,60 +15567,6 @@ async function encrypt4(secretKey, password, opts) {
   const bytes = concatBytes(Uint8Array.from([VERSION2]), Uint8Array.from([logn]), salt, nonce, aad, ciphertext);
   return encodeBytes("ncryptsec", bytes);
 }
-async function decrypt4(ncryptsec, password, opts) {
-  const { maxLogN } = opts;
-  if (!Number.isInteger(maxLogN) || maxLogN < LOGN_MIN || maxLogN > LOGN_MAX)
-    throw new Nip49Error(`invalid maxLogN ${maxLogN}, expected integer ${LOGN_MIN}..${LOGN_MAX}`);
-  let prefix;
-  let b;
-  try {
-    const decoded = bech32.decode(ncryptsec, Bech32MaxSize2);
-    ({ prefix } = decoded);
-    b = new Uint8Array(bech32.fromWords(decoded.words));
-  } catch (error) {
-    throw new Nip49Error("invalid ncryptsec", { cause: error });
-  }
-  if (prefix !== "ncryptsec")
-    throw new Nip49Error(`invalid prefix ${prefix}, expected 'ncryptsec'`);
-  if (b.length !== PAYLOAD_LEN)
-    throw new Nip49Error("invalid ncryptsec length");
-  const version = b.at(0);
-  if (version === undefined)
-    throw new Nip49Error("invalid ncryptsec length");
-  if (version !== VERSION2)
-    throw new Nip49Error(`invalid version ${version}, expected 0x02`);
-  const logn = b.at(1);
-  if (logn === undefined)
-    throw new Nip49Error("invalid ncryptsec length");
-  if (logn > maxLogN)
-    throw new Nip49Error(`logn ${logn} exceeds maxLogN ${maxLogN}`);
-  const salt = b.subarray(2, 18);
-  const nonce = b.subarray(18, 42);
-  const ksb = b.at(42);
-  if (ksb === undefined)
-    throw new Nip49Error("invalid ncryptsec length");
-  if (ksb !== 0 && ksb !== 1 && ksb !== 2)
-    throw new Nip49Error(`invalid key security byte ${ksb}, expected 0x00, 0x01, or 0x02`);
-  const aad = Uint8Array.from([ksb]);
-  const ciphertext = b.subarray(43);
-  try {
-    const key = await deriveKey(password, salt, logn, opts.scrypt ?? nobleScrypt);
-    try {
-      const secret = xchacha20poly1305(key, nonce, aad).decrypt(ciphertext);
-      if (!secp256k1.utils.isValidSecretKey(secret)) {
-        secret.fill(0);
-        throw new Nip49Error("invalid secret key");
-      }
-      return secret;
-    } finally {
-      key.fill(0);
-    }
-  } catch (error) {
-    if (error instanceof Nip49Error)
-      throw error;
-    throw new Nip49Error("failed to decrypt", { cause: error });
-  }
-}
 
 // ../wallet-kernel/src/modules/nostr/pool.ts
 class SignerPool {
@@ -15822,63 +15609,6 @@ class SignerPool {
     this.signers.clear();
   }
 }
-function generateSecretKey(random, backend) {
-  for (;; ) {
-    const candidate = random(32);
-    try {
-      Keys.fromSecretKey(candidate, backend);
-      return candidate;
-    } catch {
-      wipe(candidate);
-    }
-  }
-}
-function secretKeyFromNsec(nsec) {
-  const text = decodeUtf8Secret(nsec);
-  try {
-    const decoded = decode3(text);
-    if (decoded.type !== "nsec") {
-      throw new KernelError("invalid-input", "expected an nsec bech32 string");
-    }
-    return new Uint8Array(decoded.data);
-  } catch (error) {
-    if (error instanceof KernelError) {
-      throw error;
-    }
-    throw new KernelError("invalid-input", "invalid nsec");
-  }
-}
-async function secretKeyFromNcryptsec(ncryptsec, password, maxLogN, scrypt) {
-  const text = decodeUtf8Secret(password);
-  let payload;
-  try {
-    const decoded = bech32.decode(ncryptsec, Bech32MaxSize2);
-    payload = new Uint8Array(bech32.fromWords(decoded.words));
-    if (decoded.prefix !== "ncryptsec" || payload.length !== 91 || payload.at(0) !== 2) {
-      throw new KernelError("invalid-input", "malformed ncryptsec");
-    }
-  } catch (error) {
-    if (error instanceof KernelError) {
-      throw error;
-    }
-    throw new KernelError("invalid-input", "malformed ncryptsec");
-  }
-  const logN = payload.at(1) ?? 0;
-  if (logN > maxLogN) {
-    throw new KernelError("unsupported", "ncryptsec scrypt logN exceeds the policy limit");
-  }
-  try {
-    return await decrypt4(ncryptsec, text, {
-      maxLogN,
-      ...scrypt === undefined ? {} : { scrypt }
-    });
-  } catch (error) {
-    if (error instanceof Nip49Error && error.cause instanceof RangeError) {
-      throw new KernelError("unavailable", "ncryptsec scrypt allocation failed");
-    }
-    throw new KernelError("wrong-password", "invalid ncryptsec or wrong password");
-  }
-}
 function nsecFromSecretKey(secretKey) {
   return new TextEncoder().encode(nsecEncode2(secretKey));
 }
@@ -15918,58 +15648,27 @@ async function unwrapGiftWrap(pool, publicKey, event, backend) {
 // ../wallet-kernel/src/modules/nostr/record.ts
 var NOSTR_KEY_KIND = "nostr-key";
 function encodeNostrKeyHeader(header) {
-  if (header.origin === "derived") {
-    return JSON.stringify({
-      publicKey: header.publicKey,
-      origin: header.origin,
-      walletId: header.walletId,
-      groupIndex: header.groupIndex,
-      createdAt: header.createdAt
-    });
-  }
-  return header.origin === "nip46-client" ? JSON.stringify({
-    publicKey: header.publicKey,
-    origin: header.origin,
-    createdAt: header.createdAt
-  }) : JSON.stringify({
+  return JSON.stringify({
     publicKey: header.publicKey,
-    origin: header.origin,
-    backedUp: header.backedUp,
+    walletId: header.walletId,
+    index: header.index,
     createdAt: header.createdAt
   });
 }
 function parseNostrKeyHeader(text) {
   const object = headerObject(text);
-  const publicKey = asPublicKey(object["publicKey"]);
-  const createdAt = asCreatedAt(object["createdAt"]);
-  if (object["origin"] === "derived") {
-    expectKeys(object, ["publicKey", "origin", "walletId", "groupIndex", "createdAt"]);
-    return {
-      publicKey,
-      origin: "derived",
-      walletId: asWalletId(object["walletId"]),
-      groupIndex: asGroupIndex(object["groupIndex"]),
-      createdAt
-    };
-  }
-  if (object["origin"] === "nip46-client") {
-    expectKeys(object, ["publicKey", "origin", "createdAt"]);
-    return { publicKey, origin: "nip46-client", createdAt };
-  }
-  expectKeys(object, ["publicKey", "origin", "backedUp", "createdAt"]);
-  const { origin } = object;
-  if (origin !== "nsec" && origin !== "ncryptsec" && origin !== "generated") {
-    throw headerFailure();
-  }
-  return { publicKey, origin, backedUp: asBoolean(object["backedUp"]), createdAt };
+  expectKeys(object, ["publicKey", "walletId", "index", "createdAt"]);
+  return {
+    publicKey: asPublicKey(object["publicKey"]),
+    walletId: asWalletId(object["walletId"]),
+    index: asIdentityIndex(object["index"]),
+    createdAt: asCreatedAt(object["createdAt"])
+  };
 }
 function nostrKeyInfo2(header) {
-  const standalone = header.origin !== "derived" && header.origin !== "nip46-client";
   return {
-    ref: header.origin === "derived" ? { kind: "derived", walletId: header.walletId, groupIndex: header.groupIndex } : header.origin === "nip46-client" ? { kind: "nip46-client", id: header.publicKey } : { kind: "standalone", id: header.publicKey },
+    ref: { kind: "derived", walletId: header.walletId, index: header.index },
     publicKey: header.publicKey,
-    origin: header.origin,
-    ...standalone ? { backedUp: header.backedUp } : {},
     createdAt: header.createdAt
   };
 }
@@ -15977,14 +15676,39 @@ function nostrStatus2(records) {
   const keys = [];
   let corrupted = false;
   for (const record of records) {
-    try {
-      keys.push(nostrKeyInfo2(parseNostrKeyHeader(record.header)));
-    } catch {
-      corrupted = true;
+    if (record.kind === NOSTR_KEY_KIND) {
+      try {
+        keys.push(nostrKeyInfo2(parseNostrKeyHeader(record.header)));
+      } catch {
+        corrupted = true;
+      }
+    } else if (record.kind === NOSTR_SYNC_KEY_KIND) {
+      try {
+        parseSyncKeyHeader(record.header);
+      } catch {
+        corrupted = true;
+      }
     }
   }
   return { keys, corrupted };
 }
+var NOSTR_SYNC_KEY_KIND = "nostr-sync-key";
+function encodeSyncKeyHeader(header) {
+  return JSON.stringify({
+    publicKey: header.publicKey,
+    walletId: header.walletId,
+    createdAt: header.createdAt
+  });
+}
+function parseSyncKeyHeader(text) {
+  const object = headerObject(text);
+  expectKeys(object, ["publicKey", "walletId", "createdAt"]);
+  return {
+    publicKey: asPublicKey(object["publicKey"]),
+    walletId: asWalletId(object["walletId"]),
+    createdAt: asCreatedAt(object["createdAt"])
+  };
+}
 
 // ../wallet-kernel/src/modules/nostr/keys.ts
 function keyRecord(ctx, dek, secretKey, header) {
@@ -15995,114 +15719,57 @@ function ensureNewKey(ctx, publicKey) {
     throw new KernelError("already-exists", "nostr key already exists");
   }
 }
-async function addKey(ctx, secretKey, origin, backedUp, factor, requestSession) {
-  const gated = gate(ctx, factor, requestSession);
-  const publicKey = getPublicKey(secretKey);
-  ensureNewKey(ctx, publicKey);
-  const header = {
-    publicKey,
-    origin,
-    backedUp,
-    createdAt: ctx.platform.now()
-  };
-  const record = keyRecord(ctx, gated.dek, secretKey, header);
-  const session = await commitRecords(ctx, gated, factor, [record]);
-  return { key: nostrKeyInfo2(header), session };
-}
-async function importKey(ctx, params, requestSession) {
-  const { input } = params;
-  const secretKey = input.kind === "nsec" ? secretKeyFromNsec(input.nsec) : await secretKeyFromNcryptsec(input.ncryptsec, input.password, ctx.platform.policy.maxScryptLogN);
-  try {
-    return await addKey(ctx, secretKey, input.kind, true, params.factor, requestSession);
-  } finally {
-    wipe(secretKey);
-  }
-}
-async function generateKey(ctx, params, requestSession) {
-  const secretKey = generateSecretKey(ctx.platform.random, ctx.platform.backends.nostr);
-  try {
-    return await addKey(ctx, secretKey, "generated", false, params.factor, requestSession);
-  } finally {
-    wipe(secretKey);
-  }
-}
-async function createNip46ClientKey(ctx, requestSession) {
-  const { dek } = ctx.session.require(requestSession);
-  const secretKey = generateSecretKey(ctx.platform.random, ctx.platform.backends.nostr);
-  try {
-    const publicKey = getPublicKey(secretKey);
-    ensureNewKey(ctx, publicKey);
-    const header = {
-      publicKey,
-      origin: "nip46-client",
-      createdAt: ctx.platform.now()
-    };
-    await ctx.commit([{ op: "put-record", record: keyRecord(ctx, dek, secretKey, header) }]);
-    return nostrKeyInfo2(header);
-  } finally {
-    wipe(secretKey);
-  }
-}
 async function deriveKey2(ctx, params, requestSession) {
   const { dek } = ctx.session.require(requestSession);
   const record = findRecord(ctx.image, "entropy", params.walletId);
-  const entropy = openRecord(dek, record);
-  const seed = await seedFromEntropy(entropy, ctx.platform.pbkdf2);
-  wipe(entropy);
-  const master = masterKey(seed);
-  wipe(seed);
-  try {
-    const secretKey = nostrKeyAt(master, params.groupIndex);
+  return withWalletSeed(ctx.platform.pbkdf2, dek, record, async (seed) => {
+    const master = masterKey(seed);
     try {
-      const publicKey = getPublicKey(secretKey);
-      ensureNewKey(ctx, publicKey);
-      const header = {
-        publicKey,
-        origin: "derived",
-        walletId: params.walletId,
-        groupIndex: params.groupIndex,
-        createdAt: ctx.platform.now()
-      };
-      await ctx.commit([{ op: "put-record", record: keyRecord(ctx, dek, secretKey, header) }]);
-      return nostrKeyInfo2(header);
+      const secretKey = nostrKeyAt(master, params.index);
+      try {
+        const publicKey = getPublicKey(secretKey);
+        ensureNewKey(ctx, publicKey);
+        const header = {
+          publicKey,
+          walletId: params.walletId,
+          index: params.index,
+          createdAt: ctx.platform.now()
+        };
+        await ctx.commit([{ op: "put-record", record: keyRecord(ctx, dek, secretKey, header) }]);
+        return nostrKeyInfo2(header);
+      } finally {
+        wipe(secretKey);
+      }
     } finally {
-      wipe(secretKey);
+      master.wipePrivateData();
     }
-  } finally {
-    master.wipePrivateData();
-  }
+  });
 }
 async function discover(ctx, params, requestSession) {
   const { dek } = ctx.session.require(requestSession);
   const record = findRecord(ctx.image, "entropy", params.walletId);
-  const entropy = openRecord(dek, record);
+  if (params.from + params.count - 1 > 2147483646) {
+    throw new KernelError("invalid-input", "identity range exceeds 0x7ffffffe");
+  }
   const keys = [];
-  const seed = await seedFromEntropy(entropy, ctx.platform.pbkdf2);
-  wipe(entropy);
-  const master = masterKey(seed);
-  wipe(seed);
-  try {
-    for (let i = 0;i < params.count; i++) {
-      const groupIndex = params.from + i;
-      const secretKey = nostrKeyAt(master, groupIndex);
-      keys.push({ groupIndex, publicKey: getPublicKey(secretKey) });
-      wipe(secretKey);
+  return withWalletSeed(ctx.platform.pbkdf2, dek, record, (seed) => {
+    const master = masterKey(seed);
+    try {
+      for (let i = 0;i < params.count; i++) {
+        const index = params.from + i;
+        const secretKey = nostrKeyAt(master, index);
+        keys.push({ index, publicKey: getPublicKey(secretKey) });
+        wipe(secretKey);
+      }
+      return { keys };
+    } finally {
+      master.wipePrivateData();
     }
-    return { keys };
-  } finally {
-    master.wipePrivateData();
-  }
+  });
 }
 async function removeKey(ctx, params, requestSession) {
-  const { dek } = ctx.session.require(requestSession);
-  const record = findRecord(ctx.image, NOSTR_KEY_KIND, params.publicKey);
-  const header = parseNostrKeyHeader(record.header);
-  if (header.origin !== "nip46-client") {
-    if (params.verify === undefined) {
-      throw new KernelError("invalid-input", "factor verification is required");
-    }
-    await verifyFactor(ctx.platform, ctx.image, params.verify, dek, corePromptFor(ctx.platform.keystore, "remove-key"));
-  }
+  ctx.session.require(requestSession);
+  findRecord(ctx.image, NOSTR_KEY_KIND, params.publicKey);
   await ctx.commit([{ op: "delete-record", kind: NOSTR_KEY_KIND, id: params.publicKey }]);
   return null;
 }
@@ -16110,60 +15777,132 @@ async function exportKey(ctx, params, requestSession) {
   const { dek } = ctx.session.require(requestSession);
   await verifyFactor(ctx.platform, ctx.image, params.verify, dek, corePromptFor(ctx.platform.keystore, "export-key"));
   const record = findRecord(ctx.image, NOSTR_KEY_KIND, params.publicKey);
-  const header = parseNostrKeyHeader(record.header);
   const secretKey = openRecord(dek, record);
   try {
     const exported = params.format.kind === "nsec" ? nsecFromSecretKey(secretKey) : await ncryptsecFromSecretKey(secretKey, params.format.password);
-    if (header.origin !== "derived" && header.origin !== "nip46-client" && !header.backedUp) {
-      const updated = { ...header, backedUp: true };
-      await ctx.commit([
-        {
-          op: "put-record",
-          record: keyRecord(ctx, dek, secretKey, updated)
+    return exported;
+  } finally {
+    wipe(secretKey);
+  }
+}
+
+// ../wallet-kernel/src/modules/nostr/ops.ts
+async function sign4(ctx, pool, params, requestSession) {
+  ctx.session.require(requestSession);
+  return signEvent2(pool, params.publicKey, params.event);
+}
+async function nip04Encrypt(ctx, pool, params, requestSession) {
+  ctx.session.require(requestSession);
+  return pool.get(params.publicKey).nip04Encrypt(params.peer, params.text);
+}
+async function nip04Decrypt(ctx, pool, params, requestSession) {
+  ctx.session.require(requestSession);
+  return pool.get(params.publicKey).nip04Decrypt(params.peer, params.text);
+}
+async function nip44Encrypt(ctx, pool, params, requestSession) {
+  ctx.session.require(requestSession);
+  return pool.get(params.publicKey).nip44Encrypt(params.peer, params.text);
+}
+async function nip44Decrypt(ctx, pool, params, requestSession) {
+  ctx.session.require(requestSession);
+  return pool.get(params.publicKey).nip44Decrypt(params.peer, params.text);
+}
+async function unwrapGiftWraps(ctx, pool, params, requestSession) {
+  ctx.session.require(requestSession);
+  const results = [];
+  for (const event of params.events) {
+    results.push(await unwrapGiftWrap(pool, params.publicKey, event, ctx.platform.backends.nostr));
+  }
+  return { results };
+}
+
+// ../wallet-kernel/src/modules/nostr/sync.ts
+var SYNC_INDEX = 2147483647;
+function syncRecord(ctx, walletId) {
+  findRecord(ctx.image, "entropy", walletId);
+  for (const record of ctx.image.records) {
+    if (record.kind === NOSTR_SYNC_KEY_KIND) {
+      const header = parseSyncKeyHeader(record.header);
+      if (header.walletId === walletId) {
+        return record;
+      }
+    }
+  }
+  throw new KernelError("not-found", "no sync key for this wallet");
+}
+async function syncKey(ctx, params, requestSession) {
+  const { dek } = ctx.session.require(requestSession);
+  try {
+    return { publicKey: parseSyncKeyHeader(syncRecord(ctx, params.walletId).header).publicKey };
+  } catch (error) {
+    if (!(error instanceof KernelError && error.code === "not-found")) {
+      throw error;
+    }
+  }
+  const wallet = findRecord(ctx.image, "entropy", params.walletId);
+  return withWalletSeed(ctx.platform.pbkdf2, dek, wallet, async (seed) => {
+    const master = masterKey(seed);
+    try {
+      const secretKey = nostrKeyAt(master, SYNC_INDEX);
+      try {
+        const publicKey = getPublicKey(secretKey);
+        const header = {
+          publicKey,
+          walletId: params.walletId,
+          createdAt: ctx.platform.now()
+        };
+        const record = sealRecord(ctx.platform, dek, NOSTR_SYNC_KEY_KIND, publicKey, encodeSyncKeyHeader(header), new Uint8Array(secretKey));
+        try {
+          await ctx.commit([{ op: "put-record", record }]);
+        } catch (error) {
+          if (!(error instanceof KernelError && error.code === "conflict")) {
+            throw error;
+          }
+          return {
+            publicKey: parseSyncKeyHeader(syncRecord(ctx, params.walletId).header).publicKey
+          };
         }
-      ]);
+        return { publicKey };
+      } finally {
+        wipe(secretKey);
+      }
+    } finally {
+      master.wipePrivateData();
     }
-    return exported;
-  } finally {
-    wipe(secretKey);
-  }
-}
-
-// ../wallet-kernel/src/modules/nostr/ops.ts
-async function sign4(ctx, pool, params, requestSession) {
-  ctx.session.require(requestSession);
-  return signEvent2(pool, params.publicKey, params.event);
-}
-async function nip04Encrypt(ctx, pool, params, requestSession) {
-  ctx.session.require(requestSession);
-  return pool.get(params.publicKey).nip04Encrypt(params.peer, params.text);
+  });
 }
-async function nip04Decrypt(ctx, pool, params, requestSession) {
-  ctx.session.require(requestSession);
-  return pool.get(params.publicKey).nip04Decrypt(params.peer, params.text);
+function requireSyncSigner(ctx, pool, walletId) {
+  const record = syncRecord(ctx, walletId);
+  const { publicKey } = parseSyncKeyHeader(record.header);
+  return pool.get(publicKey);
 }
-async function nip44Encrypt(ctx, pool, params, requestSession) {
+async function syncSign(ctx, pool, params, requestSession) {
   ctx.session.require(requestSession);
-  return pool.get(params.publicKey).nip44Encrypt(params.peer, params.text);
+  if (params.event.kind !== 30078) {
+    throw new KernelError("invalid-input", "sync signer authors kind-30078 events only");
+  }
+  const signer = requireSyncSigner(ctx, pool, params.walletId);
+  return signEvent2(pool, signer.keys.publicKey, params.event);
 }
-async function nip44Decrypt(ctx, pool, params, requestSession) {
+async function syncEncrypt(ctx, pool, params, requestSession) {
   ctx.session.require(requestSession);
-  return pool.get(params.publicKey).nip44Decrypt(params.peer, params.text);
+  const signer = requireSyncSigner(ctx, pool, params.walletId);
+  const { publicKey } = signer.keys;
+  return signer.nip44Encrypt(publicKey, params.text);
 }
-async function unwrapGiftWraps(ctx, pool, params, requestSession) {
+async function syncDecrypt(ctx, pool, params, requestSession) {
   ctx.session.require(requestSession);
-  const results = [];
-  for (const event of params.events) {
-    results.push(await unwrapGiftWrap(pool, params.publicKey, event, ctx.platform.backends.nostr));
-  }
-  return { results };
+  const signer = requireSyncSigner(ctx, pool, params.walletId);
+  const { publicKey } = signer.keys;
+  return signer.nip44Decrypt(publicKey, params.text);
 }
 
 // ../wallet-kernel/src/modules/nostr/index.ts
 function createNostrModule(backend) {
   const pool = new SignerPool(backend);
+  const syncPool = new SignerPool(backend);
   const vault = {
-    ownsRecord: (kind) => kind === NOSTR_KEY_KIND,
+    ownsRecord: (kind) => kind === NOSTR_KEY_KIND || kind === NOSTR_SYNC_KEY_KIND,
     claimUnlocked: (records) => {
       const unclaimed = [];
       for (const record of records) {
@@ -16172,6 +15911,11 @@ function createNostrModule(backend) {
           if (claimed !== record.id) {
             throw new KernelError("integrity", "nostr key does not match its record", undefined, true);
           }
+        } else if (record.kind === NOSTR_SYNC_KEY_KIND) {
+          const claimed = syncPool.add(record.plaintext);
+          if (claimed !== record.id) {
+            throw new KernelError("integrity", "sync key does not match its record", undefined, true);
+          }
         } else {
           unclaimed.push(record);
         }
@@ -16181,61 +15925,35 @@ function createNostrModule(backend) {
     forget: (kind, id) => {
       if (kind === NOSTR_KEY_KIND) {
         pool.remove(id);
+      } else if (kind === NOSTR_SYNC_KEY_KIND) {
+        syncPool.remove(id);
       }
     },
     lock: () => {
       pool.dispose();
+      syncPool.dispose();
     },
     walletDeleteOps: (image, walletId) => {
       const ops = [];
       for (const record of image.records) {
-        if (record.kind !== NOSTR_KEY_KIND) {
-          continue;
-        }
-        const header = parseNostrKeyHeader(record.header);
-        if (header.origin === "derived" && header.walletId === walletId) {
-          ops.push({ op: "delete-record", kind: NOSTR_KEY_KIND, id: record.id });
+        if (record.kind === NOSTR_KEY_KIND) {
+          const header = parseNostrKeyHeader(record.header);
+          if (header.walletId === walletId) {
+            ops.push({ op: "delete-record", kind: NOSTR_KEY_KIND, id: record.id });
+          }
+        } else if (record.kind === NOSTR_SYNC_KEY_KIND) {
+          const header = parseSyncKeyHeader(record.header);
+          if (header.walletId === walletId) {
+            ops.push({ op: "delete-record", kind: NOSTR_SYNC_KEY_KIND, id: record.id });
+          }
         }
       }
       return ops;
-    },
-    backupSecrets: (image, dek) => {
-      const secrets = [];
-      for (const record of image.records) {
-        if (record.kind !== NOSTR_KEY_KIND) {
-          continue;
-        }
-        const header = parseNostrKeyHeader(record.header);
-        if (header.origin === "derived" || header.origin === "nip46-client") {
-          continue;
-        }
-        secrets.push(openRecord(dek, record));
-      }
-      return secrets;
-    },
-    backupRecords: (platform, image, dek, secrets, now) => {
-      const records = [];
-      for (const secretKey of secrets) {
-        const publicKey = getPublicKey(secretKey);
-        if (image.records.some((r) => r.kind === NOSTR_KEY_KIND && r.id === publicKey)) {
-          continue;
-        }
-        records.push(sealRecord(platform, dek, NOSTR_KEY_KIND, publicKey, encodeNostrKeyHeader({
-          publicKey,
-          origin: "nsec",
-          backedUp: true,
-          createdAt: now
-        }), secretKey));
-      }
-      return records;
     }
   };
   const handlers = {
     "nostr.discover": async (ctx, params, session) => discover(ctx, params, session),
     "nostr.deriveKey": async (ctx, params, session) => deriveKey2(ctx, params, session),
-    "nostr.importKey": async (ctx, params, session) => importKey(ctx, params, session),
-    "nostr.generateKey": async (ctx, params, session) => generateKey(ctx, params, session),
-    "nostr.createNip46ClientKey": async (ctx, _params, session) => createNip46ClientKey(ctx, session),
     "nostr.removeKey": async (ctx, params, session) => removeKey(ctx, params, session),
     "nostr.exportKey": async (ctx, params, session) => exportKey(ctx, params, session),
     "nostr.signEvent": async (ctx, params, session) => sign4(ctx, pool, params, session),
@@ -16243,7 +15961,11 @@ function createNostrModule(backend) {
     "nostr.nip04Decrypt": async (ctx, params, session) => nip04Decrypt(ctx, pool, params, session),
     "nostr.nip44Encrypt": async (ctx, params, session) => nip44Encrypt(ctx, pool, params, session),
     "nostr.nip44Decrypt": async (ctx, params, session) => nip44Decrypt(ctx, pool, params, session),
-    "nostr.unwrapGiftWraps": async (ctx, params, session) => unwrapGiftWraps(ctx, pool, params, session)
+    "nostr.unwrapGiftWraps": async (ctx, params, session) => unwrapGiftWraps(ctx, pool, params, session),
+    "nostr.syncKey": async (ctx, params, session) => syncKey(ctx, params, session),
+    "nostr.syncSign": async (ctx, params, session) => syncSign(ctx, syncPool, params, session),
+    "nostr.syncEncrypt": async (ctx, params, session) => syncEncrypt(ctx, syncPool, params, session),
+    "nostr.syncDecrypt": async (ctx, params, session) => syncDecrypt(ctx, syncPool, params, session)
   };
   return {
     vault,
@@ -16427,228 +16149,241 @@ var decodeIntent = (rt, account, intent) => {
   }
   return result;
 };
-function createSparkModule() {
-  const signers = new Map;
-  const approvals = new Map;
-  let backendPromise;
-  let runtimePromise;
-  const sparkRuntime = async () => {
-    runtimePromise ??= (async () => {
-      try {
-        return await loadSparkRuntime();
-      } catch (error) {
-        runtimePromise = undefined;
-        throw error instanceof KernelError ? error : new KernelError("unavailable", "spark runtime failed to load");
-      }
-    })();
-    return runtimePromise;
-  };
-  const liveApprovals = (ctx, key) => {
-    const now = ctx.platform.elapsed();
-    const live = (approvals.get(key) ?? []).filter((approval) => approval.deadline > now);
-    if (live.length === 0) {
-      approvals.delete(key);
-    } else {
-      approvals.set(key, live);
-    }
-    return live;
-  };
-  const backend = async (ctx) => {
-    backendPromise ??= (async () => {
-      try {
-        return await ctx.platform.backends.spark();
-      } catch (error) {
-        backendPromise = undefined;
-        throw error instanceof KernelError ? error : new KernelError("unavailable", "spark backend failed to load");
-      }
-    })();
-    return backendPromise;
-  };
-  const disposeAll = () => {
-    for (const signer of signers.values()) {
-      signer.dispose();
-    }
-    signers.clear();
-    approvals.clear();
-  };
-  const disposeWallet = (walletId) => {
-    for (const [key, signer] of signers) {
-      if (key.startsWith(`${walletId}/`)) {
-        signer.dispose();
-        signers.delete(key);
-      }
-    }
-    for (const key of approvals.keys()) {
-      if (key.startsWith(`${walletId}/`)) {
-        approvals.delete(key);
-      }
-    }
-  };
-  const poison = () => {
-    backendPromise = undefined;
-    disposeAll();
-    return new KernelError("unavailable", "spark backend was disposed after a wasm fault");
-  };
-  const mapError = (error) => {
-    if (error instanceof KernelError) {
-      return error;
-    }
-    if (isNamed(error, "WasmPoisonedError")) {
-      return poison();
-    }
-    if (isNamed(error, "SparkInputError")) {
-      return new KernelError("invalid-input", "spark signer rejected the request");
-    }
-    return new KernelError("integrity", "spark signer call failed");
-  };
-  const signerFor = async (ctx, account, requestSession) => {
-    const { dek } = ctx.session.require(requestSession);
-    const record = ctx.image.records.find((entry) => entry.kind === "entropy" && entry.id === account.walletId);
-    if (record === undefined) {
-      disposeWallet(account.walletId);
-      throw new KernelError("not-found", "no such wallet");
-    }
-    const existing = signers.get(poolKey(account));
-    if (existing !== undefined) {
-      return existing;
-    }
-    const entropy = openRecord(dek, record);
-    const seed = await seedFromEntropy(entropy, ctx.platform.pbkdf2);
-    wipe(entropy);
-    let accountKey;
-    const rt = await sparkRuntime();
+var sparkRuntime = async (state) => {
+  state.runtimePromise ??= (async () => {
     try {
-      accountKey = rt.sparkAccountKey(seed, account.network, account.network === "mainnet" ? account.groupIndex + 1 : account.groupIndex);
+      return await loadSparkRuntime();
     } catch (error) {
-      throw mapError(error);
-    } finally {
-      wipe(seed);
+      state.runtimePromise = undefined;
+      throw error instanceof KernelError ? error : new KernelError("unavailable", "spark runtime failed to load");
     }
-    const crypto2 = await backend(ctx);
+  })();
+  return state.runtimePromise;
+};
+var liveApprovals = (state, ctx, key) => {
+  const now = ctx.platform.elapsed();
+  const live = (state.approvals.get(key) ?? []).filter((approval) => approval.deadline > now);
+  if (live.length === 0) {
+    state.approvals.delete(key);
+  } else {
+    state.approvals.set(key, live);
+  }
+  return live;
+};
+var backend = async (state, ctx) => {
+  state.backendPromise ??= (async () => {
     try {
-      const signer = rt.createSparkSigner({
-        crypto: crypto2,
-        accountKey,
-        network: account.network,
-        random: ctx.platform.random,
-        authorize: async (outflow) => authorizeWithCtx(ctx, account, outflow)
-      });
-      signers.set(poolKey(account), signer);
-      return signer;
+      return await ctx.platform.backends.spark();
     } catch (error) {
-      throw mapError(error);
-    } finally {
-      wipe(accountKey);
+      state.backendPromise = undefined;
+      throw error instanceof KernelError ? error : new KernelError("unavailable", "spark backend failed to load");
     }
-  };
-  const authorizeWithCtx = async (ctx, account, outflow) => {
-    const rt = await sparkRuntime();
-    if (outflow.kind === "swap") {
-      return;
+  })();
+  return state.backendPromise;
+};
+var disposeAll = (state) => {
+  for (const signer of state.signers.values()) {
+    signer.dispose();
+  }
+  state.signers.clear();
+  state.approvals.clear();
+};
+var disposeWallet = (state, walletId) => {
+  for (const [key, signer] of state.signers) {
+    if (key.startsWith(`${walletId}/`)) {
+      signer.dispose();
+      state.signers.delete(key);
     }
-    const key = poolKey(account);
-    const live = liveApprovals(ctx, key);
-    for (const approval of live) {
-      const { intent } = approval;
-      if (outflow.kind === "transfer" && intent.kind === "transfer") {
-        const covered = outflow.receivers.every((receiver) => intent.receivers.some((wanted) => equalBytes(wanted.identityPublicKey, receiver.identityPublicKey) && receiver.amountSats <= wanted.amountSats));
-        if (covered) {
-          live.splice(live.indexOf(approval), 1);
-          return;
-        }
-        continue;
-      }
-      if (outflow.kind === "lightning" && intent.kind === "lightning") {
-        const signer = signers.get(key);
-        const { paymentHash } = approval.decoded;
-        const budget = approval.decoded.invoiceAmountSats;
-        if (signer === undefined || paymentHash === undefined || budget === undefined) {
-          continue;
-        }
-        const expected = rt.lightningSendHtlcScript({
-          paymentHash,
-          sspIdentityPublicKey: rt.sparkNetworkConfig(account.network).ssp.identityPublicKey,
-          identityPublicKey: await signer.identityPublicKey()
-        });
-        if (!equalBytes(expected, outflow.htlcOutputScript)) {
-          continue;
-        }
-        const fresh = outflow.leaves.filter((leaf) => !approval.spentLeaves.has(bytesToHex(leaf.publicKey)));
-        const total = fresh.reduce((sum, leaf) => sum + leaf.amountSats, 0) + [...approval.spentLeaves.values()].reduce((sum, v) => sum + v, 0);
-        if (total > budget + intent.maxFeeSats) {
-          continue;
-        }
-        for (const leaf of fresh) {
-          approval.spentLeaves.set(bytesToHex(leaf.publicKey), leaf.amountSats);
-        }
-        return;
-      }
-      if (outflow.kind === "exit" && intent.kind === "exit") {
-        const { addressScript } = approval.decoded;
-        if (addressScript === undefined) {
-          continue;
-        }
-        const pays = outflow.exitOutputs.some((output) => equalBytes(output.script, addressScript) && output.amountSats >= intent.amountSats);
-        if (!pays) {
-          continue;
-        }
-        const fresh = outflow.leaves.filter((leaf) => !approval.spentLeaves.has(bytesToHex(leaf.publicKey)));
-        const total = fresh.reduce((sum, leaf) => sum + leaf.amountSats, 0) + [...approval.spentLeaves.values()].reduce((sum, v) => sum + v, 0);
-        if (total > intent.amountSats + intent.maxFeeSats) {
-          continue;
-        }
-        for (const leaf of fresh) {
-          approval.spentLeaves.set(bytesToHex(leaf.publicKey), leaf.amountSats);
-        }
-        return;
-      }
-      if (outflow.kind === "onchain" && intent.kind === "onchain") {
-        const { addressScript } = approval.decoded;
-        if (addressScript === undefined) {
-          continue;
-        }
-        const every = outflow.outputs.every((output) => equalBytes(output.script, rt.EPHEMERAL_ANCHOR_SCRIPT) || equalBytes(output.script, addressScript));
-        if (!every) {
-          continue;
-        }
-        const fee = outflow.inputSats - outflow.totalSats;
-        if (fee > intent.maxFeeSats) {
-          continue;
-        }
-        live.splice(live.indexOf(approval), 1);
-        return;
-      }
-      if (outflow.kind === "token" && intent.kind === "token") {
-        const signer = signers.get(key);
-        if (signer === undefined) {
-          continue;
-        }
-        const identity = await signer.identityPublicKey();
-        const covered = outflow.outputs.every((output) => {
-          if (equalBytes(output.ownerPublicKey, identity)) {
-            return true;
-          }
-          if (!equalBytes(output.tokenIdentifier, intent.tokenIdentifier)) {
-            return false;
-          }
-          return intent.receivers.some((wanted) => equalBytes(wanted.ownerPublicKey, output.ownerPublicKey) && output.amount <= BigInt(wanted.amount));
-        });
-        if (!covered) {
-          continue;
-        }
-        live.splice(live.indexOf(approval), 1);
-        return;
-      }
+  }
+  for (const key of state.approvals.keys()) {
+    if (key.startsWith(`${walletId}/`)) {
+      state.approvals.delete(key);
     }
-    throw approvalRequired();
-  };
-  const call = async (ctx, account, requestSession, run) => {
-    const signer = await signerFor(ctx, account, requestSession);
-    try {
-      return await run(signer);
-    } catch (error) {
-      throw mapError(error);
+  }
+};
+var poison = (state) => {
+  state.backendPromise = undefined;
+  disposeAll(state);
+  return new KernelError("unavailable", "spark backend was disposed after a wasm fault");
+};
+var mapError = (state, error) => {
+  if (error instanceof KernelError) {
+    return error;
+  }
+  if (isNamed(error, "WasmPoisonedError")) {
+    return poison(state);
+  }
+  if (isNamed(error, "SparkInputError")) {
+    return new KernelError("invalid-input", "spark signer rejected the request");
+  }
+  return new KernelError("integrity", "spark signer call failed");
+};
+var signerFor = async (state, ctx, account, requestSession) => {
+  const { dek } = ctx.session.require(requestSession);
+  const record = ctx.image.records.find((entry) => entry.kind === "entropy" && entry.id === account.walletId);
+  if (record === undefined) {
+    disposeWallet(state, account.walletId);
+    throw new KernelError("not-found", "no such wallet");
+  }
+  const existing = state.signers.get(poolKey(account));
+  if (existing !== undefined) {
+    return existing;
+  }
+  let accountKey;
+  const rt = await sparkRuntime(state);
+  try {
+    accountKey = await withWalletSeed(ctx.platform.pbkdf2, dek, record, (seed) => rt.sparkAccountKey(seed, account.network, account.network === "mainnet" ? account.groupIndex + 1 : account.groupIndex));
+  } catch (error) {
+    throw mapError(state, error);
+  }
+  const crypto2 = await backend(state, ctx);
+  try {
+    const signer = rt.createSparkSigner({
+      crypto: crypto2,
+      accountKey,
+      network: account.network,
+      random: ctx.platform.random,
+      authorize: async (outflow) => authorizeWithCtx(state, ctx, account, outflow)
+    });
+    state.signers.set(poolKey(account), signer);
+    return signer;
+  } catch (error) {
+    throw mapError(state, error);
+  } finally {
+    wipe(accountKey);
+  }
+};
+var transferCovered = (outflow, intent) => outflow.receivers.every((receiver) => intent.receivers.some((wanted) => equalBytes(wanted.identityPublicKey, receiver.identityPublicKey) && receiver.amountSats <= wanted.amountSats));
+var lightningCovered = async (state, rt, key, network, outflow, approval, intent) => {
+  const signer = state.signers.get(key);
+  const { paymentHash } = approval.decoded;
+  const budget = approval.decoded.invoiceAmountSats;
+  if (signer === undefined || paymentHash === undefined || budget === undefined) {
+    return false;
+  }
+  const expected = rt.lightningSendHtlcScript({
+    paymentHash,
+    sspIdentityPublicKey: rt.sparkNetworkConfig(network).ssp.identityPublicKey,
+    identityPublicKey: await signer.identityPublicKey()
+  });
+  if (!equalBytes(expected, outflow.htlcOutputScript)) {
+    return false;
+  }
+  const fresh = outflow.leaves.filter((leaf) => !approval.spentLeaves.has(bytesToHex(leaf.publicKey)));
+  const total = fresh.reduce((sum, leaf) => sum + leaf.amountSats, 0) + [...approval.spentLeaves.values()].reduce((sum, v) => sum + v, 0);
+  if (total > budget + intent.maxFeeSats) {
+    return false;
+  }
+  for (const leaf of fresh) {
+    approval.spentLeaves.set(bytesToHex(leaf.publicKey), leaf.amountSats);
+  }
+  return true;
+};
+var exitCovered = (outflow, approval, intent) => {
+  const { addressScript } = approval.decoded;
+  if (addressScript === undefined) {
+    return false;
+  }
+  const pays = outflow.exitOutputs.some((output) => equalBytes(output.script, addressScript) && output.amountSats >= intent.amountSats);
+  if (!pays) {
+    return false;
+  }
+  const fresh = outflow.leaves.filter((leaf) => !approval.spentLeaves.has(bytesToHex(leaf.publicKey)));
+  const total = fresh.reduce((sum, leaf) => sum + leaf.amountSats, 0) + [...approval.spentLeaves.values()].reduce((sum, v) => sum + v, 0);
+  if (total > intent.amountSats + intent.maxFeeSats) {
+    return false;
+  }
+  for (const leaf of fresh) {
+    approval.spentLeaves.set(bytesToHex(leaf.publicKey), leaf.amountSats);
+  }
+  return true;
+};
+var onchainCovered = (rt, outflow, approval, intent) => {
+  const { addressScript } = approval.decoded;
+  if (addressScript === undefined) {
+    return false;
+  }
+  const every = outflow.outputs.every((output) => equalBytes(output.script, rt.EPHEMERAL_ANCHOR_SCRIPT) || equalBytes(output.script, addressScript));
+  if (!every) {
+    return false;
+  }
+  const fee = outflow.inputSats - outflow.totalSats;
+  return fee <= intent.maxFeeSats;
+};
+var tokenCovered = async (state, key, outflow, intent) => {
+  const signer = state.signers.get(key);
+  if (signer === undefined) {
+    return false;
+  }
+  const identity = await signer.identityPublicKey();
+  return outflow.outputs.every((output) => {
+    if (equalBytes(output.ownerPublicKey, identity)) {
+      return true;
+    }
+    if (!equalBytes(output.tokenIdentifier, intent.tokenIdentifier)) {
+      return false;
+    }
+    return intent.receivers.some((wanted) => equalBytes(wanted.ownerPublicKey, output.ownerPublicKey) && output.amount <= BigInt(wanted.amount));
+  });
+};
+var authorizeWithCtx = async (state, ctx, account, outflow) => {
+  const rt = await sparkRuntime(state);
+  if (outflow.kind === "swap") {
+    return;
+  }
+  const key = poolKey(account);
+  const live = liveApprovals(state, ctx, key);
+  for (const approval of live) {
+    const { intent } = approval;
+    const covered = outflow.kind === "transfer" && intent.kind === "transfer" ? transferCovered(outflow, intent) : outflow.kind === "lightning" && intent.kind === "lightning" ? await lightningCovered(state, rt, key, account.network, outflow, approval, intent) : outflow.kind === "exit" && intent.kind === "exit" ? exitCovered(outflow, approval, intent) : outflow.kind === "onchain" && intent.kind === "onchain" ? onchainCovered(rt, outflow, approval, intent) : outflow.kind === "token" && intent.kind === "token" ? await tokenCovered(state, key, outflow, intent) : false;
+    if (covered) {
+      live.splice(live.indexOf(approval), 1);
+      return;
     }
+  }
+  throw approvalRequired();
+};
+var call = async (state, ctx, account, requestSession, run) => {
+  const signer = await signerFor(state, ctx, account, requestSession);
+  try {
+    return await run(signer);
+  } catch (error) {
+    throw mapError(state, error);
+  }
+};
+var sparkApprove = async (state, ctx, params, session) => {
+  const { dek } = ctx.session.require(session);
+  const record = ctx.image.records.find((entry) => entry.kind === "entropy" && entry.id === params.account.walletId);
+  if (record === undefined) {
+    throw new KernelError("not-found", "no such wallet");
+  }
+  const key = poolKey(params.account);
+  if (liveApprovals(state, ctx, key).length >= APPROVAL_MAX_PER_ACCOUNT) {
+    throw new KernelError("invalid-input", "approval cap reached for this account");
+  }
+  const { summary, decoded } = decodeIntent(await sparkRuntime(state), params.account, params.intent);
+  await verifyFactor(ctx.platform, ctx.image, params.verify, dek, () => sparkPrompt(promptLocale(ctx.platform.keystore?.locale ?? "en"), summary));
+  ctx.session.require(session);
+  const live = liveApprovals(state, ctx, key);
+  if (live.length >= APPROVAL_MAX_PER_ACCOUNT) {
+    throw new KernelError("invalid-input", "approval cap reached for this account");
+  }
+  live.push({
+    intent: params.intent,
+    deadline: ctx.platform.elapsed() + APPROVAL_TTL_MS,
+    decoded,
+    summary,
+    spentLeaves: new Map
+  });
+  state.approvals.set(key, live);
+  return summary;
+};
+function createSparkModule() {
+  const state = {
+    signers: new Map,
+    approvals: new Map,
+    backendPromise: undefined,
+    runtimePromise: undefined
   };
   const vault = {
     ownsRecord: () => false,
@@ -16657,56 +16392,28 @@ function createSparkModule() {
       return;
     },
     lock: () => {
-      disposeAll();
+      disposeAll(state);
     },
-    backupSecrets: () => [],
-    backupRecords: () => [],
     walletDeleteOps: (_image, walletId) => {
-      disposeWallet(walletId);
+      disposeWallet(state, walletId);
       return [];
     }
   };
   const handlers = {
-    "spark.identityPublicKey": async (ctx, params, session) => call(ctx, params.account, session, async (signer) => signer.identityPublicKey()),
-    "spark.publicKeys": async (ctx, params, session) => call(ctx, params.account, session, async (signer) => signer.publicKeys(params.keys)),
-    "spark.receivedPublicKeys": async (ctx, params, session) => call(ctx, params.account, session, async (signer) => signer.receivedPublicKeys(params.ciphertexts)),
-    "spark.newCommitments": async (ctx, params, session) => call(ctx, params.account, session, async (signer) => signer.newCommitments(params.count)),
-    "spark.signFrost": async (ctx, params, session) => call(ctx, params.account, session, async (signer) => signer.signFrost(params.jobs)),
-    "spark.aggregateFrost": async (ctx, params, session) => call(ctx, params.account, session, async (signer) => signer.aggregateFrost(params.jobs)),
-    "spark.signIdentity": async (ctx, params, session) => call(ctx, params.account, session, async (signer) => signer.signIdentity(params.statement)),
-    "spark.signKeySpend": async (ctx, params, session) => call(ctx, params.account, session, async (signer) => signer.signKeySpend(params.key, params.target)),
-    "spark.signHtlcTimeout": async (ctx, params, session) => call(ctx, params.account, session, async (signer) => signer.signHtlcTimeout(params.request)),
-    "spark.prepareTransfer": async (ctx, params, session) => call(ctx, params.account, session, async (signer) => signer.prepareTransfer(params.request)),
-    "spark.prepareClaim": async (ctx, params, session) => call(ctx, params.account, session, async (signer) => signer.prepareClaim(params.request)),
-    "spark.prepareLightningReceive": async (ctx, params, session) => call(ctx, params.account, session, async (signer) => signer.prepareLightningReceive()),
-    "spark.claimStaticDeposit": async (ctx, params, session) => call(ctx, params.account, session, async (signer) => signer.claimStaticDeposit(params.request)),
-    "spark.approve": async (ctx, params, session) => {
-      const { dek } = ctx.session.require(session);
-      const record = ctx.image.records.find((entry) => entry.kind === "entropy" && entry.id === params.account.walletId);
-      if (record === undefined) {
-        throw new KernelError("not-found", "no such wallet");
-      }
-      const key = poolKey(params.account);
-      if (liveApprovals(ctx, key).length >= APPROVAL_MAX_PER_ACCOUNT) {
-        throw new KernelError("invalid-input", "approval cap reached for this account");
-      }
-      const { summary, decoded } = decodeIntent(await sparkRuntime(), params.account, params.intent);
-      await verifyFactor(ctx.platform, ctx.image, params.verify, dek, () => sparkPrompt(promptLocale(ctx.platform.keystore?.locale ?? "en"), summary));
-      ctx.session.require(session);
-      const live = liveApprovals(ctx, key);
-      if (live.length >= APPROVAL_MAX_PER_ACCOUNT) {
-        throw new KernelError("invalid-input", "approval cap reached for this account");
-      }
-      live.push({
-        intent: params.intent,
-        deadline: ctx.platform.elapsed() + APPROVAL_TTL_MS,
-        decoded,
-        summary,
-        spentLeaves: new Map
-      });
-      approvals.set(key, live);
-      return summary;
-    }
+    "spark.identityPublicKey": async (ctx, params, session) => call(state, ctx, params.account, session, async (signer) => signer.identityPublicKey()),
+    "spark.publicKeys": async (ctx, params, session) => call(state, ctx, params.account, session, async (signer) => signer.publicKeys(params.keys)),
+    "spark.receivedPublicKeys": async (ctx, params, session) => call(state, ctx, params.account, session, async (signer) => signer.receivedPublicKeys(params.ciphertexts)),
+    "spark.newCommitments": async (ctx, params, session) => call(state, ctx, params.account, session, async (signer) => signer.newCommitments(params.count)),
+    "spark.signFrost": async (ctx, params, session) => call(state, ctx, params.account, session, async (signer) => signer.signFrost(params.jobs)),
+    "spark.aggregateFrost": async (ctx, params, session) => call(state, ctx, params.account, session, async (signer) => signer.aggregateFrost(params.jobs)),
+    "spark.signIdentity": async (ctx, params, session) => call(state, ctx, params.account, session, async (signer) => signer.signIdentity(params.statement)),
+    "spark.signKeySpend": async (ctx, params, session) => call(state, ctx, params.account, session, async (signer) => signer.signKeySpend(params.key, params.target)),
+    "spark.signHtlcTimeout": async (ctx, params, session) => call(state, ctx, params.account, session, async (signer) => signer.signHtlcTimeout(params.request)),
+    "spark.prepareTransfer": async (ctx, params, session) => call(state, ctx, params.account, session, async (signer) => signer.prepareTransfer(params.request)),
+    "spark.prepareClaim": async (ctx, params, session) => call(state, ctx, params.account, session, async (signer) => signer.prepareClaim(params.request)),
+    "spark.prepareLightningReceive": async (ctx, params, session) => call(state, ctx, params.account, session, async (signer) => signer.prepareLightningReceive()),
+    "spark.claimStaticDeposit": async (ctx, params, session) => call(state, ctx, params.account, session, async (signer) => signer.claimStaticDeposit(params.request)),
+    "spark.approve": async (ctx, params, session) => sparkApprove(state, ctx, params, session)
   };
   return { vault, handlers };
 }
@@ -17232,6 +16939,39 @@ function isNodeWorkerData(value) {
   return data !== undefined && Object.keys(data).sort().join(",") === "idleMinutes,storePort" && isIdleMinutes(data["idleMinutes"]) && typeof data["storePort"] === "object" && data["storePort"] !== null;
 }
 
+// src/worker/subtle.ts
+var SUBTLE_HASH = {
+  sha256: "SHA-256",
+  sha512: "SHA-512"
+};
+var subtlePbkdf2 = async (hash, password, salt, iterations, length) => {
+  const passwordCopy = new Uint8Array(password);
+  const saltCopy = new Uint8Array(salt);
+  try {
+    const key = await crypto.subtle.importKey("raw", passwordCopy, "PBKDF2", false, ["deriveBits"]);
+    const bits = await crypto.subtle.deriveBits({ name: "PBKDF2", hash: SUBTLE_HASH[hash] ?? "SHA-256", salt: saltCopy, iterations }, key, length * 8);
+    return new Uint8Array(bits);
+  } finally {
+    passwordCopy.fill(0);
+  }
+};
+
+// src/worker/platform.ts
+var basePlatform = () => ({
+  random: (length) => crypto.getRandomValues(new Uint8Array(length)),
+  now: () => Date.now(),
+  elapsed: () => performance.now(),
+  setTimer: (delayMs, fn) => {
+    const timer = setTimeout(fn, delayMs);
+    return () => {
+      clearTimeout(timer);
+    };
+  },
+  pbkdf2: subtlePbkdf2,
+  keystore: undefined,
+  passkey: undefined
+});
+
 // src/worker/spark.ts
 async function loadSparkBackend(readWasm) {
   const { loadSparkWasm, SPARK_WASM_INTEGRITY } = await import("./browser-1vpxmqwn.js");
@@ -17317,23 +17057,6 @@ function createStoreClient(port) {
   };
 }
 
-// src/worker/subtle.ts
-var SUBTLE_HASH = {
-  sha256: "SHA-256",
-  sha512: "SHA-512"
-};
-var subtlePbkdf2 = async (hash, password, salt, iterations, length) => {
-  const passwordCopy = new Uint8Array(password);
-  const saltCopy = new Uint8Array(salt);
-  try {
-    const key = await crypto.subtle.importKey("raw", passwordCopy, "PBKDF2", false, ["deriveBits"]);
-    const bits = await crypto.subtle.deriveBits({ name: "PBKDF2", hash: SUBTLE_HASH[hash] ?? "SHA-256", salt: saltCopy, iterations }, key, length * 8);
-    return new Uint8Array(bits);
-  } finally {
-    passwordCopy.fill(0);
-  }
-};
-
 // src/worker/node.ts
 var main = parentPort;
 if (main === null) {
@@ -17348,18 +17071,7 @@ var data = {
 };
 data.storePort.start();
 var platform = {
-  random: (length) => crypto.getRandomValues(new Uint8Array(length)),
-  now: () => Date.now(),
-  elapsed: () => performance.now(),
-  setTimer: (delayMs, fn) => {
-    const timer = setTimeout(fn, delayMs);
-    return () => {
-      clearTimeout(timer);
-    };
-  },
-  pbkdf2: subtlePbkdf2,
-  keystore: undefined,
-  passkey: undefined,
+  ...basePlatform(),
   store: createStoreClient({
     post: (message) => {
       data.storePort.postMessage(message);