@sidhujag/sysweb3-keyring 1.0.626 → 1.0.628

package/cjs/keyring-core.js

@@ -0,0 +1,2512 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyringCore = void 0;
+const secp256k1_1 = __importDefault(require("@bitcoinerlab/secp256k1"));
+const sysweb3_network_1 = require("@sidhujag/sysweb3-network");
+const bip32_1 = require("bip32");
+const bs58check_1 = __importDefault(require("bs58check"));
+const crypto_1 = __importDefault(require("crypto"));
+const crypto_js_1 = __importDefault(require("crypto-js"));
+const mapValues_1 = __importDefault(require("lodash/mapValues"));
+const omit_1 = __importDefault(require("lodash/omit"));
+const syscoinjs = __importStar(require("syscoinjs-lib"));
+const BIP84 = __importStar(require("syscoinjs-lib/bip84-replacement"));
+// Reference embedded bitcoinjs from syscoinjs-lib
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const bjs = syscoinjs.utils.bitcoinjs;
+const LEGACY_ENCRYPTION_KDF = 'pbkdf2-sha512-20000';
+const SLH_DSA_DERIVATION_VERSION = 1;
+// Preserve Pali v1 SLH derivation: first 32 bytes of the account-scoped HMAC.
+// Pali expands this setup secret into the 48-byte SLH skSeed/skPrf/pkSeed tuple.
+const SLH_DSA_SETUP_SECRET_HEX_LENGTH = 64;
+const SLH_DSA_PARAMETER_SET = 'SLH-DSA-SHA2-128-24';
+const ethers_v6_1 = require("./ethers-v6");
+const initial_state_1 = require("./initial-state");
+const private_records_1 = require("./private-records");
+const signers_1 = require("./signers");
+const storage_core_1 = require("./storage-core");
+const ethereum_1 = require("./transactions/ethereum");
+const evm_local_signer_1 = require("./transactions/evm-local-signer");
+const syscoin_core_1 = require("./transactions/syscoin-core");
+const types_1 = require("./types");
+const blockbook_cache_1 = require("./utils/blockbook-cache");
+const derivation_paths_1 = require("./utils/derivation-paths");
+const psbt_account_scope_1 = require("./utils/psbt-account-scope");
+const watch_descriptor_1 = require("./utils/watch-descriptor");
+// Dynamic ETH HD path generation - will be computed as needed
+/**
+ * Secure Buffer implementation for sensitive data
+ * Provides explicit memory clearing capability
+ */
+class SecureBuffer {
+    constructor(data) {
+        this._isCleared = false;
+        if (typeof data === 'string') {
+            this.buffer = Buffer.from(data, 'utf8');
+        }
+        else {
+            this.buffer = Buffer.from(data);
+        }
+    }
+    get() {
+        if (this._isCleared || !this.buffer) {
+            throw new Error('SecureBuffer has been cleared');
+        }
+        return Buffer.from(this.buffer); // Return copy
+    }
+    toString() {
+        if (this._isCleared || !this.buffer) {
+            throw new Error('SecureBuffer has been cleared');
+        }
+        return this.buffer.toString('utf8');
+    }
+    clear() {
+        if (!this._isCleared && this.buffer) {
+            // Zeroing must not depend on a working platform random source.
+            this.buffer.fill(0);
+            this.buffer = null;
+            this._isCleared = true;
+        }
+    }
+    isCleared() {
+        return this._isCleared;
+    }
+}
+class KeyringCore {
+    constructor(dependencies) {
+        // Store getter function for accessing Redux state
+        this.getVaultState = null;
+        // Method to inject store getter from Pali side
+        this.setVaultStateGetter = (getter) => {
+            this.getVaultState = getter;
+        };
+        // Helper method to get current vault state
+        this.getVault = () => {
+            if (!this.getVaultState) {
+                throw new Error('Vault state getter not configured. Call setVaultStateGetter() first.');
+            }
+            const vault = this.getVaultState();
+            // DEFENSIVE CHECK: Ensure vault state is properly structured
+            if (!vault) {
+                throw new Error('Vault state is undefined. Ensure Redux store is properly initialized with vault state.');
+            }
+            if (!vault.activeNetwork) {
+                throw new Error('Vault state is missing activeNetwork. Ensure vault state is properly initialized before keyring operations.');
+            }
+            if (!vault.activeAccount) {
+                throw new Error('Vault state is missing activeAccount. Ensure vault state is properly initialized before keyring operations.');
+            }
+            return vault;
+        };
+        // Helper to get active chain from vault state (replaces this.activeChain)
+        this.getActiveChain = () => {
+            return this.getVault().activeNetwork.kind;
+        };
+        this.accountAddressExists = (accounts, address, caseInsensitive = false) => {
+            const expectedAddress = caseInsensitive ? address.toLowerCase() : address;
+            return Object.values(accounts || {}).some((accountsByType) => Object.values(accountsByType || {}).some((account) => {
+                if (!account?.address) {
+                    return false;
+                }
+                const accountAddress = caseInsensitive
+                    ? account.address.toLowerCase()
+                    : account.address;
+                return accountAddress === expectedAddress;
+            }));
+        };
+        // Secure session data - using Buffers that can be explicitly cleared
+        this.sessionPassword = null;
+        this.sessionMnemonic = null; // can be a mnemonic or a zprv, can be changed to a zprv when using an imported wallet
+        this.privateRecordSessionRevision = 0;
+        this.createSyscoinTransactions = () => new syscoin_core_1.SyscoinTransactionsCore(this.getSigner, this.getReadOnlySigner, this.getAccountsState, this.getAddress, this.syscoinHardwareSigners, this.capturePsbtSigningContext);
+        this.requireLedgerSigner = () => {
+            if (!this.ledgerSigner)
+                throw (0, syscoin_core_1.createHardwareSignerUnavailableError)('Ledger');
+            return this.ledgerSigner;
+        };
+        this.requireTrezorSigner = () => {
+            if (!this.trezorSigner)
+                throw (0, syscoin_core_1.createHardwareSignerUnavailableError)('Trezor');
+            return this.trezorSigner;
+        };
+        // ===================================== PUBLIC METHODS - KEYRING MANAGER FOR HD - SYS ALL ===================================== //
+        this.setStorage = (client) => {
+            if (!this.storage.setClient) {
+                throw new Error('Storage replacement is unavailable in this host');
+            }
+            this.storage.setClient(client);
+        };
+        this.validateAccountType = (account) => {
+            return account.isImported === true
+                ? types_1.KeyringAccountType.Imported
+                : types_1.KeyringAccountType.HDAccount;
+        };
+        this.isUnlocked = () => !!this.sessionPassword && !this.sessionPassword.isCleared();
+        this.lockWallet = async () => {
+            this.privateRecordSessionRevision++;
+            // Clear secure session data
+            if (this.sessionPassword) {
+                this.sessionPassword.clear();
+                this.sessionPassword = null;
+            }
+            if (this.sessionMnemonic) {
+                this.sessionMnemonic.clear();
+                this.sessionMnemonic = null;
+            }
+            // Clear transaction handlers that may hold HD signers
+            if (this.syscoinTransaction) {
+                // Replace with empty object to clear references
+                this.syscoinTransaction = {};
+            }
+            // NOTE: We intentionally don't clear ethereumTransaction here because
+            // polling needs the web3Provider even when the wallet is locked.
+            // Clean up hardware wallet connections (await to ensure HID is released)
+            if (this.ledgerSigner) {
+                try {
+                    await this.ledgerSigner.destroy();
+                }
+                catch (_) {
+                    // ignore
+                }
+            }
+            if (this.trezorSigner) {
+                try {
+                    await this.trezorSigner.destroy();
+                }
+                catch (_) {
+                    // ignore
+                }
+            }
+        };
+        // Direct secure transfer of session data to another keyring
+        this.transferSessionTo = (targetKeyring) => {
+            if (!this.isUnlocked()) {
+                throw new Error('Source keyring must be unlocked to transfer session');
+            }
+            // Cross-wallet transfers must fail before either keyring's buffers change.
+            if (!(targetKeyring instanceof KeyringCore) ||
+                targetKeyring.authority !== this.authority ||
+                targetKeyring.storage !== this.storage ||
+                targetKeyring.vaultPersistence !== this.vaultPersistence) {
+                throw new Error('Cannot transfer session between different wallet authorities');
+            }
+            if (targetKeyring === this)
+                return;
+            // Transfer ownership of our buffers to the target
+            if (!this.sessionPassword || !this.sessionMnemonic) {
+                throw new Error('Session data is missing during transfer');
+            }
+            this.privateRecordSessionRevision++;
+            targetKeyring.acceptSessionFrom(this);
+            // Null out our references (do NOT clear buffers - target owns them now)
+            this.sessionPassword = null;
+            this.sessionMnemonic = null;
+        };
+        // The checked transfer path never dispatches through a public host receiver.
+        this.acceptSessionFrom = (source) => {
+            if (source.authority !== this.authority ||
+                source.storage !== this.storage ||
+                source.vaultPersistence !== this.vaultPersistence) {
+                throw new Error('Cannot transfer session between different wallet authorities');
+            }
+            if (!source.sessionPassword || !source.sessionMnemonic) {
+                throw new Error('Session data is missing during transfer');
+            }
+            this.replaceSessionBuffers(source.sessionPassword, source.sessionMnemonic);
+        };
+        // Legacy trusted-host API. SoftwareKeyring disables direct buffer injection.
+        this.receiveSessionOwnership = (sessionPassword, sessionMnemonic) => this.replaceSessionBuffers(sessionPassword, sessionMnemonic);
+        this.replaceSessionBuffers = (sessionPassword, sessionMnemonic) => {
+            this.privateRecordSessionRevision++;
+            // Clear any existing data first
+            if (this.sessionPassword) {
+                this.sessionPassword.clear();
+            }
+            if (this.sessionMnemonic) {
+                this.sessionMnemonic.clear();
+            }
+            // Take ownership of the actual SecureBuffer objects
+            // No copying - these are the original objects
+            this.sessionPassword = sessionPassword;
+            this.sessionMnemonic = sessionMnemonic;
+        };
+        this.addNewAccount = async (label) => {
+            // Check if wallet is unlocked
+            if (!this.isUnlocked()) {
+                throw new Error('Wallet must be unlocked to add new accounts');
+            }
+            // addNewAccount should only create accounts from the main seed
+            // For importing accounts (including zprvs), use importAccount
+            if (this.getActiveChain() === sysweb3_network_1.INetworkType.Syscoin) {
+                return await this.addNewAccountToSyscoinChain(label);
+            }
+            else {
+                // EVM chainType
+                return await this.addNewAccountToEth(label);
+            }
+        };
+        this.createSmartAccount = async ({ address, deriveAccount, label, metadata, }) => {
+            const vault = this.getVault();
+            const { accounts } = vault;
+            const smartAccounts = accounts[types_1.KeyringAccountType.SmartAccount] || {};
+            const nextId = this.getNextAccountId(smartAccounts);
+            const derived = deriveAccount
+                ? await deriveAccount(nextId)
+                : { address, metadata };
+            if (!derived.address) {
+                throw new Error('Smart account address is required');
+            }
+            if (this.accountAddressExists(accounts, derived.address, true)) {
+                throw new Error('Account already exists on your Wallet.');
+            }
+            return {
+                address: derived.address,
+                balances: {
+                    [sysweb3_network_1.INetworkType.Syscoin]: 0,
+                    [sysweb3_network_1.INetworkType.Ethereum]: 0,
+                },
+                id: nextId,
+                isImported: false,
+                isLedgerWallet: false,
+                isSmartAccount: true,
+                isTrezorWallet: false,
+                label: label || `Smart Account ${nextId + 1}`,
+                smartAccount: derived.metadata,
+                xprv: '',
+                xpub: derived.address,
+            };
+        };
+        this.getNewChangeAddress = async () => {
+            const vault = this.getVault();
+            const { accounts, activeAccount } = vault;
+            const account = accounts[activeAccount.type]?.[activeAccount.id];
+            if (!account) {
+                throw new Error('Active account not found');
+            }
+            const { xpub, isImported, address } = account;
+            // For imported single-address accounts, always return the single address
+            const looksLikeSingleAddress = isImported &&
+                xpub === address &&
+                !this.isDescriptor(xpub) &&
+                !this.isXpubLike(xpub);
+            if (looksLikeSingleAddress)
+                return address;
+            return await this.getAddress(xpub, true); // Don't skip increment - get next unused
+        };
+        this.getChangeAddress = async (id) => {
+            const vault = this.getVault();
+            const { accounts, activeAccount } = vault;
+            const account = accounts[activeAccount.type]?.[id];
+            if (!account) {
+                throw new Error(`Account with id ${id} not found`);
+            }
+            const { xpub, isImported, address } = account;
+            if (isImported &&
+                xpub === address &&
+                !this.isDescriptor(xpub) &&
+                !this.isXpubLike(xpub))
+                return address;
+            return await this.getAddress(xpub, true);
+        };
+        this.getPubkey = async (id, isChangeAddress) => {
+            const vault = this.getVault();
+            const { accounts, activeAccount } = vault;
+            const account = accounts[activeAccount.type]?.[id];
+            if (!account) {
+                throw new Error(`Account with id ${id} not found`);
+            }
+            const { xpub, isImported, address } = account;
+            // Guard: single-address imported are watch-only
+            if (isImported && xpub === address) {
+                throw new Error('Public key not available for single-address imported accounts');
+            }
+            // Guard: descriptor/xpub watch-only (no xprv and not hardware)
+            if (this.isWatchOnlyAccount(account)) {
+                throw new Error('Public key not available for watch-only accounts');
+            }
+            return await this.getCurrentAddressPubkey(xpub, isChangeAddress);
+        };
+        this.getBip32Path = async (id, isChangeAddress) => {
+            const vault = this.getVault();
+            const { accounts, activeAccount } = vault;
+            const account = accounts[activeAccount.type]?.[id];
+            if (!account) {
+                throw new Error(`Account with id ${id} not found`);
+            }
+            const { xpub, isImported, address } = account;
+            // Guard: single-address imported are watch-only
+            if (isImported && xpub === address) {
+                throw new Error('BIP32 path not available for single-address imported accounts');
+            }
+            // Guard: descriptor/xpub watch-only (no xprv and not hardware)
+            if (this.isWatchOnlyAccount(account)) {
+                throw new Error('BIP32 path not available for watch-only accounts');
+            }
+            return await this.getCurrentAddressBip32Path(xpub, isChangeAddress);
+        };
+        this.updateReceivingAddress = async () => {
+            const vault = this.getVault();
+            const { accounts, activeAccount } = vault;
+            const account = accounts[activeAccount.type]?.[activeAccount.id];
+            if (!account) {
+                throw new Error('Active account not found');
+            }
+            const { xpub, isImported, address } = account;
+            if (isImported &&
+                xpub === address &&
+                !this.isDescriptor(xpub) &&
+                !this.isXpubLike(xpub))
+                return address;
+            const nextAddress = await this.getAddress(xpub, false);
+            // NOTE: Address updates should be dispatched to Redux store, not updated here
+            // The calling code should handle the Redux dispatch
+            return nextAddress;
+        };
+        this.getAccountById = (id, accountType) => {
+            const vault = this.getVault();
+            const accounts = vault.accounts[accountType];
+            const account = accounts[id];
+            if (!account) {
+                throw new Error('Account not found');
+            }
+            return (0, omit_1.default)(account, 'xprv');
+        };
+        this.getPrivateKeyByAccountId = async (id, accountType, pwd) => {
+            try {
+                // Validate password using vault salt (same pattern as getSeed)
+                if (!this.sessionPassword) {
+                    throw new Error('Unlock wallet first');
+                }
+                // Get vault salt for password validation
+                const vaultKeys = await this.storage.get('vault-keys');
+                if (!vaultKeys || !vaultKeys.salt) {
+                    throw new Error('Vault keys not found');
+                }
+                const genPwd = await this.deriveStoredSessionKey(pwd, vaultKeys);
+                if (this.getSessionPasswordString() !== genPwd) {
+                    throw new Error('Invalid password');
+                }
+                const vault = this.getVault();
+                const account = vault.accounts[accountType][id];
+                if (!account) {
+                    throw new Error('Account not found');
+                }
+                // Decrypt the stored private key using secure method
+                const decryptedPrivateKey = this.withSecureData((sessionPwd) => {
+                    const decrypted = crypto_js_1.default.AES.decrypt(account.xprv, sessionPwd).toString(crypto_js_1.default.enc.Utf8);
+                    if (!decrypted) {
+                        throw new Error('Failed to decrypt private key. Invalid password or corrupted data.');
+                    }
+                    return decrypted;
+                });
+                // NOTE: Returning decrypted private key as string is necessary for compatibility
+                // Callers should handle this sensitive data carefully
+                return decryptedPrivateKey;
+            }
+            catch (error) {
+                this.validateAndHandleErrorByMessage(error.message);
+                throw error;
+            }
+        };
+        this.getActiveAccount = () => {
+            const vault = this.getVault();
+            const { accounts, activeAccount } = vault;
+            const activeAccountId = activeAccount.id;
+            const activeAccountType = activeAccount.type;
+            return {
+                activeAccount: (0, omit_1.default)(accounts[activeAccountType][activeAccountId], 'xprv'),
+                activeAccountType,
+            };
+        };
+        this.isDescriptor = (s) => /^(addr|pkh|wpkh|sh|wsh|tr|combo|multi|sortedmulti)\s*\(/i.test(s || '');
+        this.isXpubLike = (s) => /^(xpub|tpub|zpub|vpub)/i.test(s || '');
+        this.getEncryptedXprv = (hd) => {
+            return this.withSecureData((sessionPwd) => {
+                return crypto_js_1.default.AES.encrypt(this.getSysActivePrivateKey(hd), sessionPwd).toString();
+            });
+        };
+        this.getSeed = async (pwd) => {
+            if (!this.sessionPassword) {
+                throw new Error('Unlock wallet first');
+            }
+            // Get vault salt for password validation (consistent with getPrivateKeyByAccountId)
+            const vaultKeys = await this.storage.get('vault-keys');
+            if (!vaultKeys || !vaultKeys.salt) {
+                throw new Error('Vault keys not found');
+            }
+            const genPwd = await this.deriveStoredSessionKey(pwd, vaultKeys);
+            if (this.getSessionPasswordString() !== genPwd) {
+                throw new Error('Invalid password');
+            }
+            // v4 vault is encrypted with the derived session password key (PBKDF2 output)
+            let { mnemonic } = await this.vaultPersistence.getDecryptedVault(genPwd);
+            if (!mnemonic) {
+                throw new Error('Mnemonic not found in vault or is empty');
+            }
+            // Try to detect if mnemonic is encrypted or plain text
+            const isLikelyPlainMnemonic = mnemonic.includes(' ') &&
+                (mnemonic.split(' ').length === 12 || mnemonic.split(' ').length === 24);
+            if (!isLikelyPlainMnemonic) {
+                try {
+                    mnemonic = crypto_js_1.default.AES.decrypt(mnemonic, pwd).toString(crypto_js_1.default.enc.Utf8);
+                }
+                catch (decryptError) {
+                    // If decryption fails, assume mnemonic is already decrypted
+                    console.warn('Mnemonic decryption failed in getSeed, using as-is:', decryptError.message);
+                }
+            }
+            if (!mnemonic) {
+                throw new Error('Failed to decrypt mnemonic or mnemonic is empty after decryption');
+            }
+            return mnemonic;
+        };
+        this.deriveSLHDSASetupSecretForAccount = async ({ accountIndex, }) => {
+            if (!this.sessionPassword) {
+                throw new Error('Unlock wallet first');
+            }
+            const mnemonic = this.getDecryptedMnemonic();
+            const normalizedMnemonic = mnemonic.normalize('NFKD');
+            const seed = crypto_js_1.default.PBKDF2(normalizedMnemonic, `mnemonic`.normalize('NFKD'), {
+                hasher: crypto_js_1.default.algo.SHA512,
+                iterations: 2048,
+                keySize: 512 / 32,
+            });
+            const derivationLabel = `PALI/${SLH_DSA_PARAMETER_SET}/v${SLH_DSA_DERIVATION_VERSION}/account/${accountIndex}`;
+            const digest = crypto_js_1.default.HmacSHA512(derivationLabel, crypto_js_1.default.enc.Hex.parse(seed.toString(crypto_js_1.default.enc.Hex)));
+            return {
+                derivationLabel,
+                setupSecretHex: digest
+                    .toString(crypto_js_1.default.enc.Hex)
+                    .slice(0, SLH_DSA_SETUP_SECRET_HEX_LENGTH),
+            };
+        };
+        this.encryptSLHDSASessionState = (plainText) => {
+            return this.withSecureData((sessionPwd) => crypto_js_1.default.AES.encrypt(plainText, sessionPwd).toString());
+        };
+        this.decryptSLHDSASessionState = (cipherText) => {
+            return this.withSecureData((sessionPwd) => {
+                const plainText = crypto_js_1.default.AES.decrypt(cipherText, sessionPwd).toString(crypto_js_1.default.enc.Utf8);
+                if (!plainText) {
+                    throw new Error('Failed to decrypt SLH-DSA session state');
+                }
+                return plainText;
+            });
+        };
+        this.setSignerNetwork = async (network) => {
+            // With multi-keyring architecture, each keyring is dedicated to specific slip44
+            if (sysweb3_network_1.INetworkType.Ethereum !== network.kind &&
+                sysweb3_network_1.INetworkType.Syscoin !== network.kind) {
+                throw new Error('Unsupported chain');
+            }
+            // Validate network/chain type compatibility
+            if (network.kind === sysweb3_network_1.INetworkType.Ethereum &&
+                this.getActiveChain() === sysweb3_network_1.INetworkType.Syscoin) {
+                throw new Error('Cannot use Ethereum chain type with Syscoin network');
+            }
+            if (network.kind === sysweb3_network_1.INetworkType.Syscoin &&
+                this.getActiveChain() === sysweb3_network_1.INetworkType.Ethereum) {
+                throw new Error('Cannot use Syscoin chain type with Ethereum network');
+            }
+            // CRITICAL: Prevent UTXO-to-UTXO network switching within same keyring
+            // Each UTXO network should have its own KeyringManager instance based on slip44
+            const vault = this.getVault();
+            if (this.getActiveChain() === sysweb3_network_1.INetworkType.Syscoin && vault.activeNetwork) {
+                const currentSlip44 = vault.activeNetwork.slip44;
+                const newSlip44 = network.slip44;
+                if (currentSlip44 !== newSlip44) {
+                    throw new Error(`Cannot switch between different UTXO networks within the same keyring. ` +
+                        `Current network uses slip44=${currentSlip44}, target network uses slip44=${newSlip44}. ` +
+                        `Each UTXO network requires a separate KeyringManager instance.`);
+                }
+            }
+            try {
+                // With multi-keyring architecture:
+                // - UTXO: Each keyring is dedicated to one network (slip44), so this is only called during initialization
+                // - EVM: All EVM networks share slip44=60, so network can change within the same keyring
+                if (network.kind === sysweb3_network_1.INetworkType.Syscoin) {
+                    // For UTXO networks: validate that active account exists (accounts should be created via addNewAccount/initialize)
+                    const accountId = vault.activeAccount.id || 0;
+                    const accountType = vault.activeAccount.type || types_1.KeyringAccountType.HDAccount;
+                    const accounts = vault.accounts[accountType];
+                    if (!accounts[accountId] || !accounts[accountId].xpub) {
+                        throw new Error(`Active account ${accountType}:${accountId} does not exist. Create accounts using addNewAccount() or initializeWalletSecurely() first.`);
+                    }
+                    // No additional setup needed - on-demand signers will be created when needed
+                }
+                else if (network.kind === sysweb3_network_1.INetworkType.Ethereum) {
+                    // For EVM networks: we primarily need a correct provider for the active network.
+                    // Active account validation can be temporarily inconsistent during network switching
+                    // (e.g., placeholder activeAccount like Trezor:0 before accounts hydrate), and provider
+                    // setup does not depend on it. So treat missing active account as a warning, not a hard error.
+                    const accountId = vault.activeAccount.id || 0;
+                    const accountType = vault.activeAccount.type || types_1.KeyringAccountType.HDAccount;
+                    const accounts = vault.accounts[accountType];
+                    if (!accounts?.[accountId]) {
+                        console.warn(`[KeyringManager] Active account ${accountType}:${accountId} not found while setting EVM network; continuing to set provider`);
+                    }
+                    // Set up EVM provider for network switching
+                    await this.setSignerEVM(network);
+                }
+                return {
+                    success: true,
+                };
+            }
+            catch (err) {
+                console.log('ERROR setSignerNetwork', {
+                    err,
+                });
+                this.validateAndHandleErrorByMessage(err.message);
+                //Rollback to previous values
+                console.error('Set Signer Network failed with', err);
+                return { success: false };
+            }
+        };
+        this.forgetMainWallet = async (pwd) => {
+            const vaultKeys = await this.storage.get('vault-keys');
+            if (!vaultKeys || !vaultKeys.salt) {
+                throw new Error('Vault keys not found');
+            }
+            const genPwd = await this.deriveStoredSessionKey(pwd, vaultKeys);
+            if (!this.sessionPassword) {
+                throw new Error('Unlock wallet first');
+            }
+            else if (this.getSessionPasswordString() !== genPwd) {
+                throw new Error('Invalid password');
+            }
+            await this.clearTemporaryLocalKeys();
+        };
+        this.importWeb3Account = (mnemonicOrPrivKey) => {
+            // Check if it's a hex string (Ethereum private key)
+            if ((0, ethers_v6_1.isHexString)(mnemonicOrPrivKey)) {
+                return (0, evm_local_signer_1.privateKeyToAccount)(mnemonicOrPrivKey);
+            }
+            // Check if it's a zprv/tprv (Syscoin private key)
+            const zprvPrefixes = ['zprv', 'tprv', 'vprv', 'xprv'];
+            if (zprvPrefixes.some((prefix) => mnemonicOrPrivKey.startsWith(prefix))) {
+                throw new Error('Syscoin extended private keys (zprv/tprv) should be imported using importAccount, not importWeb3Account');
+            }
+            // Otherwise, assume it's a mnemonic
+            return (0, evm_local_signer_1.deriveEvmAccountFromMnemonic)(mnemonicOrPrivKey, (0, derivation_paths_1.getAddressDerivationPath)('eth', 60, 0, false, 0));
+        };
+        this.getAccountXpub = () => {
+            const vault = this.getVault();
+            const { activeAccount } = vault;
+            const account = vault.accounts[activeAccount.type]?.[activeAccount.id];
+            if (!account) {
+                throw new Error('Active account not found');
+            }
+            return account.xpub;
+        };
+        this.isSeedValid = (seedPhrase) => BIP84.validateMnemonic(seedPhrase);
+        this.createNewSeed = (wordCount) => {
+            // Map BIP39 word counts to entropy strength
+            const wordCountToStrength = {
+                12: 128,
+                15: 160,
+                18: 192,
+                21: 224,
+                24: 256,
+            };
+            const strength = wordCount ? wordCountToStrength[wordCount] : 128;
+            return strength
+                ? BIP84.generateMnemonic(strength)
+                : BIP84.generateMnemonic();
+        };
+        this.getUTXOState = () => {
+            const vault = this.getVault();
+            if (vault.activeNetwork.kind !== sysweb3_network_1.INetworkType.Syscoin) {
+                throw new Error('Cannot get state in a ethereum network');
+            }
+            const utxOAccounts = (0, mapValues_1.default)(vault.accounts.HDAccount, (value) => (0, omit_1.default)(value, 'xprv'));
+            return {
+                ...vault,
+                accounts: {
+                    [types_1.KeyringAccountType.HDAccount]: utxOAccounts,
+                    [types_1.KeyringAccountType.Imported]: {},
+                    [types_1.KeyringAccountType.Trezor]: {},
+                    [types_1.KeyringAccountType.Ledger]: {},
+                },
+            };
+        };
+        this.getActiveUTXOAccountState = () => {
+            const vault = this.getVault();
+            const { activeAccount } = vault;
+            return {
+                ...vault.accounts.HDAccount[activeAccount.id],
+                xprv: undefined,
+            };
+        };
+        this.getNetwork = () => this.getVault().activeNetwork;
+        this.createEthAccount = (privateKey) => (0, evm_local_signer_1.privateKeyToAccount)(privateKey);
+        // Helper to get current account data from backend
+        this.fetchCurrentAccountData = async (xpub, isChangeAddress) => {
+            const vault = this.getVault();
+            const { activeNetwork } = vault;
+            // Use read-only signer for backend calls - works for all account types including hardware wallets
+            const { main } = this.getReadOnlySigner();
+            const options = 'tokens=used&details=tokens';
+            // In-flight deduplicated: concurrent callers within a send flow
+            // (fee estimation, PSBT creation, signing) share a single request
+            const { tokens } = await (0, blockbook_cache_1.fetchBackendAccountCached)(main.blockbookURL, xpub, options);
+            const { receivingIndex, changeIndex } = this.setLatestIndexesFromXPubTokens(tokens);
+            // Get network configuration for BIP84 using network-provided pub type macros
+            const networkConfig = (0, sysweb3_network_1.getNetworkConfig)(activeNetwork.slip44, activeNetwork.currency);
+            const pubTypes = networkConfig?.types?.zPubType;
+            if (!pubTypes) {
+                throw new Error('Missing zPubType in network configuration');
+            }
+            const networks = networkConfig.networks;
+            const currentAccount = new BIP84.fromZPub(xpub, pubTypes, networks);
+            const addressIndex = isChangeAddress ? changeIndex : receivingIndex;
+            return {
+                currentAccount,
+                addressIndex,
+                main,
+            };
+        };
+        this.getAddress = async (xpub, isChangeAddress, options) => {
+            if (this.isDescriptor(xpub)) {
+                // The BIP84 history scanner below cannot choose a descriptor's next
+                // unused index. Import can derive index zero locally, but rotation must
+                // not reinterpret a descriptor as a BIP84 extended key.
+                if (!options?.forceIndex0) {
+                    throw new Error('Address rotation is not supported for watch-only descriptors');
+                }
+                return (0, watch_descriptor_1.deriveDescriptorAddress)(xpub, this.getVault().activeNetwork, {
+                    change: isChangeAddress,
+                });
+            }
+            const { currentAccount, addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
+            const effectiveIndex = options?.forceIndex0 ? 0 : addressIndex;
+            const address = currentAccount.getAddress(effectiveIndex, isChangeAddress, 84);
+            return address;
+        };
+        this.getCurrentAddressPubkey = async (xpub, isChangeAddress) => {
+            const { currentAccount, addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
+            // BIP84 returns the public key as a hex string directly
+            return currentAccount.getPublicKey(addressIndex, isChangeAddress);
+        };
+        this.getCurrentAddressBip32Path = async (xpub, isChangeAddress) => {
+            const vault = this.getVault();
+            const { activeAccount, activeNetwork } = vault;
+            const { addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
+            // Use the utility function to generate the proper derivation path
+            const coinShortcut = activeNetwork.currency.toLowerCase(); // e.g., 'sys', 'btc'
+            const path = (0, derivation_paths_1.getAddressDerivationPath)(coinShortcut, activeNetwork.slip44, activeAccount.id, isChangeAddress, addressIndex);
+            return path;
+        };
+        this.logout = () => {
+            this.lockWallet();
+        };
+        /**
+         * PRIVATE METHODS
+         */
+        // ===================================== AUXILIARY METHOD - FOR TRANSACTIONS CLASSES ===================================== //
+        this.getDecryptedPrivateKey = (targetAccount) => {
+            try {
+                const vault = this.getVault();
+                const { accounts } = vault;
+                const activeAccount = targetAccount || vault.activeAccount;
+                const activeAccountId = activeAccount.id;
+                const activeAccountType = activeAccount.type;
+                const isLedger = activeAccountType === types_1.KeyringAccountType.Ledger;
+                const isTrezor = activeAccountType === types_1.KeyringAccountType.Trezor;
+                const isHardwareWallet = isTrezor || isLedger;
+                if (!this.sessionPassword)
+                    throw new Error('Wallet is locked cant proceed with transaction');
+                const activeAccountData = accounts[activeAccountType][activeAccountId];
+                if (!activeAccountData) {
+                    throw new Error(`Active account (${activeAccountType}:${activeAccountId}) not found. Account switching may be in progress.`);
+                }
+                const { xprv, address } = activeAccountData;
+                if (isLedger || activeAccountData.isLedgerWallet)
+                    this.requireLedgerSigner();
+                if (isTrezor || activeAccountData.isTrezorWallet)
+                    this.requireTrezorSigner();
+                if (isHardwareWallet) {
+                    return {
+                        address,
+                        decryptedPrivateKey: '',
+                    };
+                }
+                if (!xprv) {
+                    throw new Error(`Private key not found for account ${activeAccountType}:${activeAccountId}. Account may not be fully initialized.`);
+                }
+                let decryptedPrivateKey;
+                try {
+                    decryptedPrivateKey = this.withSecureData((sessionPwd) => {
+                        return crypto_js_1.default.AES.decrypt(xprv, sessionPwd).toString(crypto_js_1.default.enc.Utf8);
+                    });
+                }
+                catch (decryptError) {
+                    throw new Error(`Failed to decrypt private key for account ${activeAccountType}:${activeAccountId}. The wallet may be locked or corrupted.`);
+                }
+                if (!decryptedPrivateKey) {
+                    throw new Error(`Decrypted private key is empty for account ${activeAccountType}:${activeAccountId}. Invalid password or corrupted data.`);
+                }
+                // For EVM accounts, validate that the derived address matches the stored address
+                // This helps catch account switching race conditions early
+                if (this.getActiveChain() === sysweb3_network_1.INetworkType.Ethereum) {
+                    try {
+                        const derivedAccount = (0, evm_local_signer_1.privateKeyToAccount)(decryptedPrivateKey);
+                        if (derivedAccount.address.toLowerCase() !== address.toLowerCase()) {
+                            throw new Error(`Address mismatch for account ${activeAccountType}:${activeAccountId}. Expected ${address} but derived ${derivedAccount.address}. Account switching may be in progress.`);
+                        }
+                    }
+                    catch (addressError) {
+                        throw new Error(`Failed to validate EVM address for account ${activeAccountType}:${activeAccountId}: ${addressError.message}`);
+                    }
+                }
+                return {
+                    address,
+                    decryptedPrivateKey,
+                };
+            }
+            catch (error) {
+                const vaultForLogging = this.getVault();
+                const isTestEnv = typeof process !== 'undefined' && process?.env?.NODE_ENV === 'test';
+                if (!isTestEnv) {
+                    console.error('ERROR getDecryptedPrivateKey', {
+                        error: error.message,
+                        activeChain: this.getActiveChain(),
+                        vault: {
+                            activeAccountId: vaultForLogging?.activeAccount?.id,
+                            activeAccountType: vaultForLogging?.activeAccount?.type,
+                        },
+                    });
+                }
+                this.validateAndHandleErrorByMessage(error.message);
+                throw error;
+            }
+        };
+        this.capturePsbtSigningContext = () => {
+            const session = this.sessionPassword;
+            const vault = this.getVault();
+            const selected = { ...vault.activeAccount };
+            const account = vault.accounts[selected.type]?.[selected.id];
+            const identity = { address: account?.address, xpub: account?.xpub };
+            const network = { ...vault.activeNetwork };
+            const assertCurrent = () => {
+                const current = this.getVault();
+                const currentAccount = current.accounts[selected.type]?.[selected.id];
+                if (!session ||
+                    session.isCleared() ||
+                    this.sessionPassword !== session ||
+                    current.activeAccount.id !== selected.id ||
+                    current.activeAccount.type !== selected.type ||
+                    currentAccount?.address !== identity.address ||
+                    currentAccount?.xpub !== identity.xpub ||
+                    current.activeNetwork.kind !== network.kind ||
+                    current.activeNetwork.chainId !== network.chainId ||
+                    current.activeNetwork.slip44 !== network.slip44 ||
+                    current.activeNetwork.url !== network.url) {
+                    throw new Error('Wallet signing context changed');
+                }
+            };
+            assertCurrent();
+            return assertCurrent;
+        };
+        this.getSigner = () => {
+            if (!this.sessionPassword) {
+                throw new Error('Wallet is locked cant proceed with transaction');
+            }
+            if (this.getActiveChain() !== sysweb3_network_1.INetworkType.Syscoin) {
+                throw new Error('Switch to UTXO chain');
+            }
+            const vault = this.getVault();
+            const { activeAccount } = vault;
+            const accountId = activeAccount.id;
+            const accountType = activeAccount.type;
+            const assertCurrent = this.capturePsbtSigningContext();
+            // Determine signer type: HD or WIF single-address
+            let signerForUse;
+            if (accountType === types_1.KeyringAccountType.HDAccount) {
+                signerForUse = this.createOnDemandUTXOSigner(accountId);
+            }
+            else if (accountType === types_1.KeyringAccountType.Imported) {
+                // Decrypt stored key material
+                const decrypted = this.withSecureData((sessionPwd) => {
+                    const account = vault.accounts[types_1.KeyringAccountType.Imported][accountId];
+                    const res = crypto_js_1.default.AES.decrypt(account.xprv, sessionPwd).toString(crypto_js_1.default.enc.Utf8);
+                    if (!res)
+                        throw new Error('Failed to decrypt imported account key');
+                    return res;
+                });
+                if (this.isZprv(decrypted)) {
+                    signerForUse = this.createFreshUTXOSigner(decrypted, accountId);
+                }
+                else {
+                    // Treat as WIF single-address signer wrapper exposing sign(psbt)
+                    const network = vault.activeNetwork;
+                    const { networks } = (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency);
+                    const isTestnet = network.slip44 === 1;
+                    const bitcoinjsNetwork = isTestnet
+                        ? networks.testnet
+                        : networks.mainnet;
+                    signerForUse = {
+                        sign: async (psbt) => {
+                            return await syscoinjs.utils.signWithWIF(psbt, decrypted, bitcoinjsNetwork);
+                        },
+                    };
+                }
+            }
+            else {
+                throw new Error(`Unsupported account type for UTXO signing: ${accountType}`);
+            }
+            const scope = {
+                account: vault.accounts[accountType][accountId],
+                accountId,
+                accountType,
+                network: vault.activeNetwork,
+            };
+            if (typeof signerForUse.getRootNode === 'function') {
+                const getRootNode = signerForUse.getRootNode.bind(signerForUse);
+                const guardPath = (0, psbt_account_scope_1.createPsbtDerivationGuard)(scope);
+                signerForUse.getRootNode = () => {
+                    const root = getRootNode();
+                    const scopedRoot = Object.create(root);
+                    scopedRoot.derivePath = (path) => {
+                        guardPath(path);
+                        return root.derivePath(path);
+                    };
+                    return scopedRoot;
+                };
+            }
+            const sign = signerForUse.sign.bind(signerForUse);
+            signerForUse.sign = async (psbt) => {
+                assertCurrent();
+                (0, psbt_account_scope_1.assertPsbtAccountScope)(psbt, scope);
+                const result = await sign(psbt);
+                assertCurrent();
+                return result;
+            };
+            // Create syscoinjs instance with current network (no need to attach signer for signing flow)
+            const network = vault.activeNetwork;
+            const networkConfig = (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency);
+            const isTestnet = network.slip44 === 1;
+            const bitcoinjsNetwork = isTestnet
+                ? networkConfig?.networks?.testnet
+                : networkConfig?.networks?.mainnet;
+            const syscoinMainSigner = new syscoinjs.SyscoinJSLib(null, network.url, bitcoinjsNetwork);
+            return {
+                hd: signerForUse,
+                main: syscoinMainSigner,
+            };
+        };
+        // Read-only version that works when wallet is locked
+        this.getReadOnlySigner = () => {
+            if (this.getActiveChain() !== sysweb3_network_1.INetworkType.Syscoin) {
+                throw new Error('Switch to UTXO chain');
+            }
+            // Create syscoinjs instance without HD signer for read-only operations
+            const vault = this.getVault();
+            const network = vault.activeNetwork;
+            const networkConfig = (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency);
+            const isTestnet = network.slip44 === 1;
+            const bitcoinjsNetwork = isTestnet
+                ? networkConfig?.networks?.testnet
+                : networkConfig?.networks?.mainnet;
+            const syscoinMainSigner = new syscoinjs.SyscoinJSLib(null, // No HD signer needed for read-only operations
+            network.url, bitcoinjsNetwork);
+            return {
+                main: syscoinMainSigner,
+            };
+        };
+        this.getAccountsState = () => {
+            const vault = this.getVault();
+            const { accounts, activeAccount, activeNetwork } = vault;
+            return {
+                activeAccountId: activeAccount.id,
+                accounts,
+                activeAccountType: activeAccount.type,
+                activeNetwork,
+            };
+        };
+        /**
+         *
+         * @param password
+         * @param salt
+         * @returns derived key: hex string
+         */
+        this.encryptSHA512 = (password, salt) => {
+            // Session/encryption key derivation (used to encrypt/decrypt xprv in-memory and persisted state).
+            // PBKDF2 with SHA-512, 20,000 iterations (prod default), 256-bit output.
+            // NOTE: Tests override iterations to keep CI fast.
+            const isTestEnv = typeof process !== 'undefined' && process?.env?.NODE_ENV === 'test';
+            const iterations = Number.parseInt(process?.env?.SYSWEB3_PBKDF2_ENC_ITERS || '', 10) ||
+                (isTestEnv ? 1000 : 20000);
+            const key = crypto_js_1.default.PBKDF2(password, crypto_js_1.default.enc.Hex.parse(salt), {
+                keySize: 256 / 32, // 256 bits
+                iterations,
+                hasher: crypto_js_1.default.algo.SHA512,
+            });
+            return key.toString();
+        };
+        this.hasWebCrypto = () => {
+            // MV3 service worker & extension pages: globalThis.crypto.subtle exists.
+            // Jest tests mock global.crypto without subtle -> fallback to CryptoJS.
+            return !!globalThis?.crypto?.subtle;
+        };
+        this.hexToBytes = (hex) => {
+            const clean = (hex || '').trim();
+            if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length % 2 !== 0) {
+                throw new Error('Invalid hex string');
+            }
+            const out = new Uint8Array(clean.length / 2);
+            for (let i = 0; i < out.length; i++) {
+                out[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+            }
+            return out;
+        };
+        this.bytesToHex = (bytes) => {
+            const u8 = new Uint8Array(bytes);
+            let hex = '';
+            for (let i = 0; i < u8.length; i++) {
+                hex += u8[i].toString(16).padStart(2, '0');
+            }
+            return hex;
+        };
+        this.getEncIterations = () => {
+            const isTestEnv = typeof process !== 'undefined' && process?.env?.NODE_ENV === 'test';
+            return (Number.parseInt(process?.env?.SYSWEB3_PBKDF2_ENC_ITERS || '', 10) ||
+                (isTestEnv ? 1000 : 900000));
+        };
+        this.getSysActivePrivateKey = (hd) => {
+            if (hd === null)
+                throw new Error('No HD Signer');
+            const accountIndex = hd.Signer.accountIndex;
+            // Verify the account exists now
+            if (!hd.Signer.accounts.has(accountIndex)) {
+                throw new Error(`Account at index ${accountIndex} could not be created`);
+            }
+            return hd.Signer.accounts.get(accountIndex).getAccountPrivateKey();
+        };
+        this.getInitialAccountData = ({ label, signer, sysAccount, xprv, }) => {
+            const { address, xpub } = sysAccount;
+            return {
+                id: signer.Signer.accountIndex,
+                label: label || `Account ${signer.Signer.accountIndex + 1}`,
+                xpub,
+                xprv,
+                address,
+                isTrezorWallet: false,
+                isLedgerWallet: false,
+                isImported: false,
+            };
+        };
+        this.getFormattedBackendAccount = async ({ signer, }) => {
+            // MUCH SIMPLER: Just use the signer directly - no BIP84 needed!
+            // Get address directly from the signer (always correct for current network)
+            const address = signer.createAddress(0, false, 84);
+            const xpub = signer.getAccountXpub();
+            return {
+                address,
+                xpub,
+            };
+        };
+        this.setLatestIndexesFromXPubTokens = function (tokens) {
+            let changeIndexInternal = -1, receivingIndexInternal = -1;
+            if (tokens) {
+                tokens.forEach((token) => {
+                    if (!token.transfers || !token.path) {
+                        return {
+                            changeIndex: changeIndexInternal + 1,
+                            receivingIndex: receivingIndexInternal + 1,
+                        };
+                    }
+                    const transfers = parseInt(token.transfers, 10);
+                    if (token.path && transfers > 0) {
+                        const splitPath = token.path.split('/');
+                        if (splitPath.length >= 6) {
+                            const change = parseInt(splitPath[4], 10);
+                            const index = parseInt(splitPath[5], 10);
+                            if (change === 1) {
+                                if (index > changeIndexInternal) {
+                                    changeIndexInternal = index;
+                                }
+                            }
+                            else if (index > receivingIndexInternal) {
+                                receivingIndexInternal = index;
+                            }
+                        }
+                    }
+                });
+            }
+            return {
+                changeIndex: changeIndexInternal + 1,
+                receivingIndex: receivingIndexInternal + 1,
+            };
+        };
+        this.getBasicWeb3AccountInfo = (id, label) => {
+            return {
+                id,
+                isTrezorWallet: false,
+                isLedgerWallet: false,
+                label: label ? label : `Account ${id + 1}`,
+            };
+        };
+        this.setDerivedWeb3Accounts = async (id, label) => {
+            try {
+                // For account creation, derive from mnemonic (since account doesn't exist yet)
+                const mnemonic = this.getDecryptedMnemonic();
+                const derivationPath = (0, derivation_paths_1.getAddressDerivationPath)('eth', 60, 0, false, id);
+                const derivedAccount = (0, evm_local_signer_1.deriveEvmAccountFromMnemonic)(mnemonic, derivationPath);
+                const basicAccountInfo = this.getBasicWeb3AccountInfo(id, label);
+                const createdAccount = {
+                    address: derivedAccount.address,
+                    xpub: derivedAccount.publicKey,
+                    xprv: this.withSecureData((sessionPwd) => {
+                        return crypto_js_1.default.AES.encrypt(derivedAccount.privateKey, sessionPwd).toString();
+                    }),
+                    isImported: false,
+                    ...basicAccountInfo,
+                    balances: { syscoin: 0, ethereum: 0 },
+                };
+                // NOTE: Account creation should be dispatched to Redux store, not stored here
+                // Return the account data for Pali to add to store
+                return createdAccount;
+            }
+            catch (error) {
+                console.log('ERROR setDerivedWeb3Accounts', {
+                    error,
+                });
+                this.validateAndHandleErrorByMessage(error.message);
+                throw error;
+            }
+        };
+        this.setSignerEVM = async (network) => {
+            const abortController = new AbortController();
+            try {
+                // With multi-keyring architecture, this is only called on EVM keyrings
+                this.ethereumTransaction.setWeb3Provider(network);
+                abortController.abort();
+            }
+            catch (error) {
+                abortController.abort();
+                throw new Error(`SetSignerEVM: Failed with ${error}`);
+            }
+        };
+        this.clearTemporaryLocalKeys = async () => {
+            // Clear the vault completely.
+            // For v4, the vault is encrypted with a derived key, so the safest wipe is to delete the stored blob.
+            await this.storage.deleteItem('vault');
+            // Remove vault-keys from storage so no vault exists at all
+            await this.storage.deleteItem('vault-keys');
+            console.log('[KeyringManager] Temporary local keys cleared');
+            this.logout();
+        };
+        // NEW: Separate session initialization from account creation
+        this.initializeSession = async (seedPhrase, password) => {
+            // Validate inputs first
+            if (!BIP84.validateMnemonic(seedPhrase)) {
+                throw new Error('Invalid Seed');
+            }
+            const [vault, vaultKeys] = await Promise.all([
+                this.storage.get('vault'),
+                this.storage.get('vault-keys'),
+            ]);
+            const hasVault = vault !== undefined && vault !== null;
+            const hasVaultKeys = vaultKeys !== undefined && vaultKeys !== null;
+            const livePassword = this.sessionPassword;
+            const liveMnemonic = this.sessionMnemonic;
+            // Only an already-unlocked, matching session may repeat initialization.
+            // Restoring any existing wallet must use unlock(), never rewrite its vault.
+            if (livePassword &&
+                liveMnemonic &&
+                !livePassword.isCleared() &&
+                !liveMnemonic.isCleared()) {
+                if (!hasVault || !hasVaultKeys || !vaultKeys.salt) {
+                    throw new Error('Cannot initialize a new vault over existing wallet storage');
+                }
+                const sessionPasswordSaltedHash = await this.deriveStoredSessionKey(password, vaultKeys);
+                if (livePassword === this.sessionPassword &&
+                    liveMnemonic === this.sessionMnemonic &&
+                    sessionPasswordSaltedHash === this.getSessionPasswordString()) {
+                    // Same password - check if it's the same mnemonic to ensure full idempotency
+                    let currentMnemonic;
+                    try {
+                        currentMnemonic = this.withSecureData((sessionPwd, sessionMnemonic) => {
+                            return crypto_js_1.default.AES.decrypt(sessionMnemonic, sessionPwd).toString(crypto_js_1.default.enc.Utf8);
+                        });
+                    }
+                    catch (error) {
+                        // If we can't decrypt, fall through to error
+                    }
+                    if (currentMnemonic === seedPhrase) {
+                        const storedVault = await this.vaultPersistence.getDecryptedVault(sessionPasswordSaltedHash);
+                        if (livePassword === this.sessionPassword &&
+                            liveMnemonic === this.sessionMnemonic &&
+                            !livePassword.isCleared() &&
+                            !liveMnemonic.isCleared() &&
+                            storedVault?.mnemonic === seedPhrase) {
+                            // This is a read-only identity check, not a second vault write.
+                            return;
+                        }
+                    }
+                }
+                // Different password or mnemonic - this is not a simple re-initialization
+                throw new Error('Wallet already initialized with different parameters. Unlock the existing wallet or explicitly remove it before starting setup.');
+            }
+            if (hasVault || hasVaultKeys) {
+                throw new Error('Cannot initialize a new vault over existing wallet storage');
+            }
+            const salt = crypto_1.default.randomBytes(16).toString('hex');
+            // v4 stores only the salt on disk. A genuinely fresh initialization always
+            // commits its own salt and ciphertext together under the vault mutex.
+            const sessionPasswordSaltedHash = await this.deriveStoredSessionKey(password, { salt });
+            // Encrypt and store vault (mnemonic storage) - now uses single vault for all networks
+            await this.vaultPersistence.setEncryptedVault({
+                mnemonic: seedPhrase, // Store plain mnemonic - setEncryptedVault will encrypt the entire vault
+            }, 
+            // v4 vault is encrypted with the derived session password key (PBKDF2 output)
+            sessionPasswordSaltedHash, { salt });
+            await this.recreateSessionFromVault(sessionPasswordSaltedHash);
+        };
+        // NEW: Create first account without signer setup
+        this.createFirstAccount = async (label) => {
+            if (!this.sessionPassword || !this.sessionMnemonic) {
+                throw new Error('Session must be initialized first. Call initializeSession.');
+            }
+            const vault = this.getVault();
+            const network = vault.activeNetwork;
+            if (network.kind === sysweb3_network_1.INetworkType.Syscoin) {
+                // UTXO accounts get network-aware labels since each network has separate keyrings
+                const defaultLabel = label || this.generateNetworkAwareLabel(0, network);
+                // Create UTXO account using on-demand signer
+                const freshHDSigner = this.createOnDemandUTXOSigner(0);
+                const sysAccount = await this.getFormattedBackendAccount({
+                    signer: freshHDSigner,
+                });
+                const encryptedXprv = this.getEncryptedXprv(freshHDSigner);
+                return {
+                    ...this.getInitialAccountData({
+                        label: defaultLabel,
+                        signer: freshHDSigner,
+                        sysAccount,
+                        xprv: encryptedXprv,
+                    }),
+                    balances: { syscoin: 0, ethereum: 0 },
+                };
+            }
+            else {
+                // EVM accounts get generic labels since they work across all EVM networks
+                const defaultLabel = label || 'Account 1';
+                return await this.setDerivedWeb3Accounts(0, defaultLabel);
+            }
+        };
+        this.initializeWalletSecurely = async (seedPhrase, password) => {
+            // Use new separated approach
+            await this.initializeSession(seedPhrase, password);
+            return await this.createFirstAccount();
+        };
+        if (!dependencies ||
+            typeof dependencies.authority !== 'object' ||
+            dependencies.authority === null) {
+            throw new TypeError('Keyring core requires an explicit wallet authority');
+        }
+        if (typeof dependencies.vaultPersistence?.getDecryptedVault !== 'function' ||
+            typeof dependencies.vaultPersistence?.setEncryptedVault !== 'function') {
+            throw new TypeError('Keyring core requires bound vault persistence');
+        }
+        this.authority = dependencies.authority;
+        this.storage = dependencies.storage;
+        this.vaultPersistence = dependencies.vaultPersistence;
+        this.ledgerSigner = dependencies.ledgerSigner;
+        this.trezorSigner = dependencies.trezorSigner;
+        this.syscoinHardwareSigners = { ...dependencies.syscoinHardwareSigners };
+        this.writeUtf8Diagnostic(false);
+        this.utf8Error = false;
+        this.initialTrezorAccountState = initial_state_1.initialActiveTrezorAccountState;
+        this.initialLedgerAccountState = initial_state_1.initialActiveLedgerAccountState;
+        this.syscoinTransaction = this.createSyscoinTransactions();
+        this.ethereumTransaction = new ethereum_1.EthereumTransactions(this.getNetwork, this.getDecryptedPrivateKey, this.getAccountsState, this.ledgerSigner, this.trezorSigner, this.capturePsbtSigningContext);
+    }
+    // Convenience method for complete setup after construction
+    async initialize(seed, password, network) {
+        // Set the network if provided (this is crucial for proper address derivation)
+        if (network) {
+            await this.setSignerNetwork(network);
+        }
+        // Use the new secure initialization method (eliminates temporary plaintext storage)
+        const account = await this.initializeWalletSecurely(seed, password);
+        // NOTE: Active account management is now handled by vault state/Redux
+        // No need to explicitly set active account - it's managed externally
+        return account;
+    }
+    /**
+     * Returns canLogin:false only when the first vault authentication fails.
+     * Storage, platform and session restoration failures reject so callers do
+     * not charge a failed password attempt for an operational error.
+     */
+    async unlock(password) {
+        let authenticated = false;
+        try {
+            const vaultKeys = await this.storage.get('vault-keys');
+            if (!vaultKeys) {
+                throw new Error('Vault keys not found. Reload the wallet and try again.');
+            }
+            // v4: Validate password by deriving the session key once and decrypting the vault with it.
+            // This avoids an extra KDF pass just for a stored verifier.
+            const { salt } = vaultKeys;
+            // Derive session encryption key (in-memory only) used to encrypt/decrypt xprv fields
+            // IMPORTANT: This MUST NOT be the same value as the stored verifier above.
+            let sessionPasswordKey = await this.deriveStoredSessionKey(password, vaultKeys);
+            // Handle migration from old vault format with currentSessionSalt
+            if (vaultKeys.currentSessionSalt) {
+                console.log('[KeyringManager] Detected old vault format, handling session migration...');
+                // The old format used currentSessionSalt for session data encryption
+                // We need to use it temporarily to decrypt the mnemonic correctly
+                const oldSessionPassword = this.encryptSHA512(password, vaultKeys.currentSessionSalt);
+                // v3 CBC vaults use the raw password; migrated GCM vaults use the
+                // derived key. Selecting by stored format also permits a safe retry
+                // if the vault write succeeded but the metadata write was interrupted.
+                const { mnemonic } = await this.vaultPersistence.getDecryptedVault(sessionPasswordKey, password);
+                authenticated = true;
+                const isValidSecret = (value) => {
+                    if (typeof value !== 'string' || !value)
+                        return false;
+                    if (this.isSeedValid(value))
+                        return true;
+                    // Imported extended private keys can also be stored as the secret.
+                    if (!/^(xprv|yprv|zprv|tprv|uprv|vprv)/.test(value))
+                        return false;
+                    try {
+                        const decoded = bs58check_1.default.decode(value);
+                        return (decoded.length === 78 &&
+                            decoded[45] === 0 &&
+                            secp256k1_1.default.isPrivate(decoded.subarray(46)));
+                    }
+                    catch {
+                        return false;
+                    }
+                };
+                let decryptedMnemonic = mnemonic;
+                if (!isValidSecret(decryptedMnemonic) && typeof mnemonic === 'string') {
+                    for (const legacyKey of [password, oldSessionPassword]) {
+                        try {
+                            const candidate = crypto_js_1.default.AES.decrypt(mnemonic, legacyKey).toString(crypto_js_1.default.enc.Utf8);
+                            if (isValidSecret(candidate)) {
+                                decryptedMnemonic = candidate;
+                                break;
+                            }
+                        }
+                        catch (error) {
+                            if (error?.message !== 'Malformed UTF-8 data')
+                                throw error;
+                        }
+                    }
+                }
+                if (!isValidSecret(decryptedMnemonic)) {
+                    throw new Error('Legacy vault secret could not be recovered. Existing vault preserved.');
+                }
+                // Do not change either stored record until a valid secret is recovered.
+                await this.vaultPersistence.setEncryptedVault({ mnemonic: decryptedMnemonic }, sessionPasswordKey);
+                console.log('[KeyringManager] Vault mnemonic format normalized');
+                // Remove currentSessionSalt from vault-keys (v4 keeps only the salt on disk)
+                const migratedVaultKeys = {
+                    salt: vaultKeys.salt,
+                };
+                await this.storage.set('vault-keys', migratedVaultKeys);
+                console.log('[KeyringManager] Old vault format migration completed');
+            }
+            // v4 vault is encrypted with the derived session password key (PBKDF2 output).
+            // If the password is wrong, this will throw and we return canLogin:false below.
+            let decryptedVault;
+            let legacyProfile = vaultKeys.keyDerivation === LEGACY_ENCRYPTION_KDF;
+            try {
+                decryptedVault = await this.vaultPersistence.getDecryptedVault(sessionPasswordKey);
+            }
+            catch (error) {
+                // Only the historical CBC fallback used the 20k key without metadata.
+                // Never try it for GCM, malformed records, or platform/storage failures.
+                const rawVault = error instanceof storage_core_1.VaultAuthenticationError &&
+                    !vaultKeys.keyDerivation &&
+                    !vaultKeys.currentSessionSalt
+                    ? await this.storage.get('vault')
+                    : undefined;
+                if (typeof rawVault !== 'string' || rawVault.trim().startsWith('{')) {
+                    throw error;
+                }
+                const legacyKey = await this.deriveLegacySessionKey(password, salt);
+                decryptedVault = await this.vaultPersistence.getDecryptedVault(legacyKey);
+                authenticated = true;
+                sessionPasswordKey = legacyKey;
+                // Keep the historical account wrapping key. Persist its profile before
+                // GCM rewrapping so either interrupted write remains recoverable.
+                await this.storage.set('vault-keys', {
+                    ...vaultKeys,
+                    keyDerivation: LEGACY_ENCRYPTION_KDF,
+                });
+                legacyProfile = true;
+            }
+            authenticated = true;
+            if (legacyProfile && this.hasWebCrypto()) {
+                const storedVault = await this.storage.get('vault');
+                if (typeof storedVault === 'string' &&
+                    !storedVault.trim().startsWith('{')) {
+                    // A failed earlier rewrap can leave the authenticated profile plus
+                    // CBC. Retry that write without changing the account wrapping key.
+                    await this.vaultPersistence.setEncryptedVault(decryptedVault, sessionPasswordKey);
+                }
+            }
+            // If session data missing or corrupted, recreate from vault
+            if (!this.sessionMnemonic) {
+                await this.recreateSessionFromVault(sessionPasswordKey);
+            }
+            // Re-initialize syscoin transaction handler if it was cleared on lock.
+            // `lockWallet()` intentionally replaces it with a plain object to drop signer references,
+            // so we must restore the real class instance on unlock.
+            if (!this.syscoinTransaction ||
+                typeof this.syscoinTransaction.getRecommendedFee !== 'function') {
+                this.syscoinTransaction = this.createSyscoinTransactions();
+            }
+            // NOTE: Active account management is now handled by vault state/Redux
+            // No need to explicitly set active account after unlock - it's managed externally
+            const vault = this.getVault();
+            if (vault.activeAccount?.id !== undefined && vault.activeAccount?.type) {
+                // Check if the active account actually exists in the accounts map
+                const accountType = vault.activeAccount.type;
+                const accountId = vault.activeAccount.id;
+                const accountExists = vault.accounts?.[accountType]?.[accountId];
+                if (!accountExists) {
+                    console.log(`[KeyringManager] Active account ${accountType}:${accountId} not found in accounts map. This may indicate a migration from old vault format.`);
+                    // Signal that accounts need to be created after migration
+                    return {
+                        canLogin: true,
+                        needsAccountCreation: true,
+                    };
+                }
+                console.log(`[KeyringManager] Active account ${vault.activeAccount.id} available after unlock`);
+            }
+            return {
+                canLogin: true,
+            };
+        }
+        catch (error) {
+            if (!authenticated && error instanceof storage_core_1.VaultAuthenticationError) {
+                return { canLogin: false };
+            }
+            if (authenticated) {
+                // lockWallet clears secret buffers synchronously; hardware cleanup
+                // is best effort and must not hide the original operational error.
+                void this.lockWallet().catch(() => undefined);
+            }
+            throw error;
+        }
+    }
+    isWatchOnlyAccount(a) {
+        if (a.isLedgerWallet || a.isTrezorWallet)
+            return false;
+        if (!a.xprv || a.xprv === '') {
+            if (a.xpub === a.address)
+                return true; // single-address imported
+            if (this.isXpubLike(a.xpub) || this.isDescriptor(a.xpub))
+                return true; // xpub/descriptor watch-only
+        }
+        return false;
+    }
+    privateRecordSession() {
+        const password = this.sessionPassword;
+        const mnemonic = this.sessionMnemonic;
+        const revision = this.privateRecordSessionRevision;
+        const assertCurrent = () => {
+            if (!password ||
+                !mnemonic ||
+                password.isCleared() ||
+                mnemonic.isCleared() ||
+                this.sessionPassword !== password ||
+                this.sessionMnemonic !== mnemonic ||
+                this.privateRecordSessionRevision !== revision) {
+                throw new Error('Private record session changed');
+            }
+        };
+        assertCurrent();
+        const root = this.getDecryptedMnemonic().normalize('NFKD');
+        if (!root || root.length > 4096)
+            throw new Error('Invalid private record root');
+        return { secret: new TextEncoder().encode(root), assertCurrent };
+    }
+    /** Stable local profile identifier; never an account address or a key. */
+    async getPrivateRecordProfileId() {
+        const session = this.privateRecordSession();
+        try {
+            const profile = await (0, private_records_1.privateRecordProfileId)(session.secret, session.assertCurrent);
+            session.assertCurrent();
+            return profile;
+        }
+        finally {
+            session.secret.fill(0);
+        }
+    }
+    /** Encrypt caller-owned bytes; persistence and encrypted backup belong to the caller. */
+    async encryptPrivateRecord(params) {
+        const session = this.privateRecordSession();
+        try {
+            const envelope = await (0, private_records_1.encryptPrivateRecordBytes)(session.secret, params, session.assertCurrent);
+            session.assertCurrent();
+            return envelope;
+        }
+        finally {
+            session.secret.fill(0);
+        }
+    }
+    async decryptPrivateRecord(params) {
+        const session = this.privateRecordSession();
+        let plaintext;
+        try {
+            plaintext = await (0, private_records_1.decryptPrivateRecordBytes)(session.secret, params, session.assertCurrent);
+            session.assertCurrent();
+            return plaintext;
+        }
+        catch (error) {
+            plaintext?.fill(0);
+            throw error;
+        }
+        finally {
+            session.secret.fill(0);
+        }
+    }
+    async importTrezorAccount(label) {
+        const vault = this.getVault();
+        const currency = vault.activeNetwork.currency;
+        if (!currency) {
+            throw new Error('Active network currency is not defined');
+        }
+        // Use getNextAccountId to filter out placeholder accounts
+        const nextIndex = this.getNextAccountId(vault.accounts[types_1.KeyringAccountType.Trezor]);
+        const importedAccount = await this._createTrezorAccount(currency, vault.activeNetwork.slip44, nextIndex);
+        importedAccount.label = label ? label : `Trezor ${importedAccount.id + 1}`;
+        // NOTE: Account creation should be dispatched to Redux store, not updated here
+        // The calling code should handle the Redux dispatch
+        // Return the created account for Pali to add to store
+        return importedAccount;
+    }
+    async importLedgerAccount(label) {
+        try {
+            const vault = this.getVault();
+            const currency = vault.activeNetwork.currency;
+            if (!currency) {
+                throw new Error('Active network currency is not defined');
+            }
+            // Use getNextAccountId to filter out placeholder accounts
+            const nextIndex = this.getNextAccountId(vault.accounts[types_1.KeyringAccountType.Ledger]);
+            const importedAccount = await this._createLedgerAccount(currency, vault.activeNetwork.slip44, nextIndex);
+            importedAccount.label = label
+                ? label
+                : `Ledger ${importedAccount.id + 1}`;
+            // NOTE: Account creation should be dispatched to Redux store, not updated here
+            // The calling code should handle the Redux dispatch
+            // Return the created account for Pali to add to store
+            return importedAccount;
+        }
+        catch (error) {
+            console.log({ error });
+            throw error;
+        }
+    }
+    async importAccount(privKey, label, options) {
+        // Check if wallet is unlocked
+        if (!this.isUnlocked()) {
+            throw new Error('Wallet must be unlocked to import accounts');
+        }
+        const importedAccount = await this._getPrivateKeyAccountInfos(privKey, label, options);
+        // NOTE: Account creation should be dispatched to Redux store, not updated here
+        // The calling code should handle the Redux dispatch
+        // Return the created account for Pali to add to store
+        return importedAccount;
+    }
+    // Import a WIF on UTXO networks and force legacy P2PKH address/type.
+    // Keeps it as a single-address Imported account, storing the address in both xpub and address.
+    async importWatchOnly(identifier, label) {
+        // Validate via Blockbook and create a watch-only Imported account
+        const vault = this.getVault();
+        const { accounts, activeNetwork } = vault;
+        if (!identifier || typeof identifier !== 'string') {
+            throw new Error('Identifier is required');
+        }
+        const isXpub = this.isXpubLike(identifier);
+        const isDesc = this.isDescriptor(identifier);
+        const isAddress = !isXpub && !isDesc;
+        // Compute address field
+        let addressToStore = identifier;
+        if (isDesc) {
+            // Keep the descriptor as the history reference, never as a recipient.
+            // Backend-provided address metadata must not select the deposit address.
+            addressToStore = (0, watch_descriptor_1.deriveDescriptorAddress)(identifier, activeNetwork);
+        }
+        else if (isXpub) {
+            // Minimal approach: treat any extended pubkey as BIP84 by converting to zpub/vpub
+            const { types } = (0, sysweb3_network_1.getNetworkConfig)(activeNetwork.slip44, activeNetwork.currency || 'Syscoin');
+            const target = activeNetwork.slip44 === 1
+                ? types.zPubType.testnet.vpub
+                : types.zPubType.mainnet.zpub;
+            const bip84Key = (0, derivation_paths_1.convertExtendedKeyVersion)(identifier, target);
+            addressToStore = await this.getAddress(bip84Key, false, {
+                forceIndex0: true,
+            });
+        }
+        // Validate duplicates across all account buckets, including passkey smart accounts.
+        if (this.accountAddressExists(accounts, addressToStore) ||
+            ((isXpub || isDesc) &&
+                Object.values(accounts || {}).some((bucket) => Object.values(bucket || {}).some((account) => account?.xpub === identifier)))) {
+            throw new Error('Account already exists on your Wallet.');
+        }
+        // Confirm with Blockbook
+        const options = 'details=basic';
+        // Validate against Blockbook directly to capture precise error details (e.g., checksum mismatch)
+        const baseUrl = activeNetwork.url.replace(/\/$/, '');
+        const path = isXpub || isDesc ? '/api/v2/xpub/' : '/api/v2/address/';
+        const url = `${baseUrl}${path}${encodeURIComponent(identifier)}?${options}`;
+        let res = null;
+        try {
+            const response = await fetch(url);
+            if (!response.ok) {
+                let errorText = response.statusText || 'Request failed';
+                try {
+                    const bodyText = await response.text();
+                    if (bodyText) {
+                        try {
+                            const json = JSON.parse(bodyText);
+                            if (json && json.error) {
+                                errorText = json.error;
+                            }
+                            else {
+                                errorText = bodyText;
+                            }
+                        }
+                        catch {
+                            errorText = bodyText;
+                        }
+                    }
+                }
+                catch (parseError) {
+                    // ignore body parse error; fall back to statusText
+                }
+                throw new Error(errorText);
+            }
+            res = await response.json();
+        }
+        catch (e) {
+            throw new Error(e?.message || 'Identifier validation failed');
+        }
+        if (!res) {
+            throw new Error('Identifier not found on the active network');
+        }
+        const id = this.getNextAccountId(accounts[types_1.KeyringAccountType.Imported]);
+        const defaultLabel = label || `Watch-only ${id + 1}`;
+        const balances = { syscoin: 0, ethereum: 0 };
+        const watchOnlyAccount = {
+            ...initial_state_1.initialActiveImportedAccountState,
+            address: addressToStore,
+            label: defaultLabel,
+            id,
+            balances,
+            isImported: true,
+            xprv: '',
+            xpub: isAddress ? addressToStore : identifier,
+            assets: {
+                syscoin: [],
+                ethereum: [],
+            },
+        };
+        return watchOnlyAccount;
+    }
+    validateZprv(zprv, targetNetwork) {
+        // Use the active network if targetNetwork is not provided
+        const networkToValidateAgainst = targetNetwork || this.getVault().activeNetwork;
+        if (!networkToValidateAgainst) {
+            throw new Error('No network available for validation');
+        }
+        try {
+            // Check if it looks like an extended key based on known prefixes
+            const knownExtendedKeyPrefixes = [
+                'xprv',
+                'xpub',
+                'yprv',
+                'ypub',
+                'zprv',
+                'zpub',
+                'tprv',
+                'tpub',
+                'uprv',
+                'upub',
+                'vprv',
+                'vpub',
+            ];
+            const prefix = zprv.substring(0, 4);
+            const looksLikeExtendedKey = knownExtendedKeyPrefixes.includes(prefix);
+            // Only check prefix validity if it looks like an extended key
+            if (looksLikeExtendedKey) {
+                const validBip84Prefixes = ['zprv', 'vprv']; // zprv for mainnet, vprv for testnet
+                if (!validBip84Prefixes.includes(prefix)) {
+                    throw new Error(`Invalid key prefix '${prefix}'. Only BIP84 keys (zprv/vprv) are supported for UTXO imports. BIP44 keys (xprv/tprv) are not supported.`);
+                }
+            }
+            else {
+                // Not an extended key format
+                throw new Error('Not an extended private key');
+            }
+            const bip32 = (0, bip32_1.BIP32Factory)(secp256k1_1.default);
+            const decoded = bs58check_1.default.decode(zprv);
+            if (decoded.length !== 78) {
+                throw new Error('Invalid length for a BIP-32 key');
+            }
+            // Get network configuration for the target network
+            const { networks, types } = (0, sysweb3_network_1.getNetworkConfig)(networkToValidateAgainst.slip44, networkToValidateAgainst.currency || 'Bitcoin');
+            // For BIP84 (zprv/zpub), we need to use the correct magic bytes from zPubType
+            // Determine key type: zprv = mainnet key, vprv = testnet key
+            const keyIsTestnet = prefix === 'vprv';
+            // Determine target network type: testnet networks typically have slip44 1
+            const targetIsTestnet = networkToValidateAgainst.slip44 === 1;
+            // Cross-network validation: reject if key type doesn't match target network
+            if (keyIsTestnet && !targetIsTestnet) {
+                throw new Error(`Extended private key is not compatible with ${networkToValidateAgainst.label}. ` +
+                    `This appears to be a testnet key (${prefix}) but the target network is mainnet.`);
+            }
+            if (!keyIsTestnet && targetIsTestnet) {
+                throw new Error(`Extended private key is not compatible with ${networkToValidateAgainst.label}. ` +
+                    `This appears to be a mainnet key (${prefix}) but the target network is testnet.`);
+            }
+            const pubTypes = keyIsTestnet
+                ? types.zPubType.testnet
+                : types.zPubType.mainnet;
+            const baseNetwork = keyIsTestnet ? networks.testnet : networks.mainnet;
+            const network = {
+                ...baseNetwork,
+                bip32: {
+                    public: parseInt(pubTypes.vpub || pubTypes.zpub, 16),
+                    private: parseInt(pubTypes.vprv || pubTypes.zprv, 16),
+                },
+            };
+            // Validate that the key prefix matches the expected network format
+            // This ensures the key was generated for a compatible network
+            const expectedPrefixes = ['zprv', 'vprv', 'xprv', 'yprv']; // Accept various BIP32/84 formats
+            if (!expectedPrefixes.includes(prefix)) {
+                throw new Error(`Invalid extended private key prefix: ${prefix}. Expected one of: ${expectedPrefixes.join(', ')}`);
+            }
+            // Strict network matching - only allow keys that match the target network
+            let node;
+            try {
+                node = bip32.fromBase58(zprv, network);
+            }
+            catch (e) {
+                throw new Error(`Extended private key is not compatible with ${networkToValidateAgainst.label}. Please use a key generated for this specific network.`);
+            }
+            if (!node.privateKey) {
+                throw new Error('Private key not found in extended private key');
+            }
+            if (!secp256k1_1.default.isPrivate(node.privateKey)) {
+                throw new Error('Invalid private key for secp256k1 curve');
+            }
+            return {
+                isValid: true,
+                node,
+                network,
+                message: 'The extended private key is valid for this network.',
+            };
+        }
+        catch (error) {
+            return { isValid: false, message: error.message };
+        }
+    }
+    validateWif(wif, targetNetwork) {
+        // Use the active network if targetNetwork is not provided
+        const networkToValidateAgainst = targetNetwork || this.getVault().activeNetwork;
+        if (!networkToValidateAgainst) {
+            throw new Error('No network available for validation');
+        }
+        try {
+            // Get bitcoinjs network for the target network (Syscoin/BTC etc.)
+            const { networks } = (0, sysweb3_network_1.getNetworkConfig)(networkToValidateAgainst.slip44, networkToValidateAgainst.currency || 'Bitcoin');
+            const isTestnet = networkToValidateAgainst.slip44 === 1;
+            const bitcoinNetwork = isTestnet ? networks.testnet : networks.mainnet;
+            // Try to parse the WIF for the given network
+            const keyPair = syscoinjs.utils.bitcoinjs.ECPair.fromWIF(wif, bitcoinNetwork);
+            if (!keyPair || !keyPair.privateKey)
+                throw new Error('Invalid WIF private key');
+            // Derive an address based on network capability
+            // Try different address types to ensure the key can derive addresses
+            let address;
+            try {
+                // Try P2TR (Taproot) first if bech32 is supported
+                if (bitcoinNetwork.bech32) {
+                    try {
+                        address = bjs.payments.p2wpkh({
+                            pubkey: keyPair.publicKey,
+                            network: bitcoinNetwork,
+                        }).address;
+                    }
+                    catch (e) {
+                        // P2TR might not be supported, try P2WPKH
+                    }
+                }
+                if (!address) {
+                    address = bjs.payments.p2pkh({
+                        pubkey: keyPair.publicKey,
+                        network: bitcoinNetwork,
+                    }).address;
+                }
+            }
+            catch (e) {
+                // ignore and handle below
+            }
+            if (!address)
+                throw new Error('Failed to derive address from WIF');
+            return { isValid: true };
+        }
+        catch (error) {
+            return { isValid: false, message: error.message };
+        }
+    }
+    writeUtf8Diagnostic(hasUtf8Error) {
+        try {
+            void Promise.resolve(this.storage.set('utf8Error', { hasUtf8Error })).catch(() => undefined);
+        }
+        catch {
+            // This diagnostic must not interrupt authentication or become an
+            // unhandled rejection when an asynchronous storage client is offline.
+        }
+    }
+    validateAndHandleErrorByMessage(message) {
+        const utf8ErrorMessage = 'Malformed UTF-8 data';
+        if (message.includes(utf8ErrorMessage) ||
+            message.toLowerCase().includes(utf8ErrorMessage.toLowerCase())) {
+            this.writeUtf8Diagnostic(true);
+        }
+    }
+    async pbkdf2WebCryptoHex(params) {
+        const subtle = globalThis.crypto.subtle;
+        const enc = new TextEncoder();
+        const passBytes = enc.encode(params.password);
+        const saltBytes = this.hexToBytes(params.saltHex);
+        const keyMaterial = await subtle.importKey('raw', passBytes, { name: 'PBKDF2' }, false, ['deriveBits']);
+        const bits = await subtle.deriveBits({
+            name: 'PBKDF2',
+            salt: saltBytes,
+            iterations: params.iterations,
+            hash: params.hash,
+        }, keyMaterial, params.lengthBytes * 8);
+        return this.bytesToHex(bits);
+    }
+    async encryptSHA512Async(password, salt) {
+        if (this.hasWebCrypto()) {
+            // Match CryptoJS PBKDF2 output format: hex string
+            return await this.pbkdf2WebCryptoHex({
+                password,
+                saltHex: salt,
+                iterations: this.getEncIterations(),
+                lengthBytes: 32, // 256-bit
+                hash: 'SHA-512',
+            });
+        }
+        throw new Error('WebCrypto is required for vault key derivation');
+    }
+    async deriveLegacySessionKey(password, salt) {
+        if (this.hasWebCrypto()) {
+            return this.pbkdf2WebCryptoHex({
+                password,
+                saltHex: salt,
+                iterations: 20000,
+                lengthBytes: 32,
+                hash: 'SHA-512',
+            });
+        }
+        // Read compatibility only; new vault writes still require WebCrypto.
+        return crypto_js_1.default.PBKDF2(password, crypto_js_1.default.enc.Hex.parse(salt), {
+            keySize: 256 / 32,
+            iterations: 20000,
+            hasher: crypto_js_1.default.algo.SHA512,
+        }).toString();
+    }
+    async deriveStoredSessionKey(password, vaultKeys) {
+        if (vaultKeys.keyDerivation === LEGACY_ENCRYPTION_KDF) {
+            return this.deriveLegacySessionKey(password, vaultKeys.salt);
+        }
+        if (vaultKeys.keyDerivation !== undefined) {
+            throw new Error('Unsupported vault key derivation profile');
+        }
+        return this.encryptSHA512Async(password, vaultKeys.salt);
+    }
+    async _createTrezorAccount(coin, slip44, index, label) {
+        const vault = this.getVault();
+        const { accounts } = vault;
+        // For EVM networks, Trezor expects 'eth' regardless of the network's currency
+        const trezorCoin = slip44 === 60 ? 'eth' : coin;
+        const { descriptor, balance: _balance } = await this.requireTrezorSigner().getAccountInfo({
+            coin: trezorCoin,
+            slip44,
+            index,
+        });
+        const xpub = descriptor;
+        const balance = _balance;
+        let ethPubKey = '';
+        const isEVM = (0, derivation_paths_1.isEvmCoin)(coin, slip44);
+        // For EVM networks, we need to get the actual address from Trezor
+        let address;
+        if (isEVM) {
+            // For EVM, the descriptor from getAccountInfo is the address
+            address = xpub;
+            // Get the public key for EVM
+            const response = await this.requireTrezorSigner().getPublicKey({
+                coin: trezorCoin,
+                slip44,
+                index: +index,
+            });
+            ethPubKey = response.publicKey;
+        }
+        else {
+            // For UTXO, use the xpub to derive the address
+            // Always use first receive address (index 0) for imported account display
+            address = await this.getAddress(xpub, false, { forceIndex0: true });
+        }
+        if (this.accountAddressExists(accounts, address, isEVM))
+            throw new Error('Account already exists on your Wallet.');
+        if (!xpub || !address)
+            throw new Error('Something wrong happened. Please, try again or report it');
+        // Use getNextAccountId to properly handle placeholder accounts
+        const id = this.getNextAccountId(accounts[types_1.KeyringAccountType.Trezor]);
+        // Convert balance from satoshis to SYS safely
+        // Using string manipulation to avoid precision loss
+        let syscoinBalance = 0;
+        if (!isEVM && balance) {
+            const balanceStr = balance.toString();
+            // Handle conversion without division to preserve precision
+            if (balanceStr.length > 8) {
+                // Has whole SYS part
+                const wholePart = balanceStr.slice(0, -8);
+                const decimalPart = balanceStr.slice(-8);
+                syscoinBalance = parseFloat(`${wholePart}.${decimalPart}`);
+            }
+            else {
+                // Less than 1 SYS
+                const paddedBalance = balanceStr.padStart(8, '0');
+                syscoinBalance = parseFloat(`0.${paddedBalance}`);
+            }
+        }
+        const trezorAccount = {
+            ...this.initialTrezorAccountState,
+            balances: {
+                syscoin: isEVM ? 0 : syscoinBalance,
+                ethereum: 0,
+            },
+            address,
+            label: label ? label : `Trezor ${id + 1}`,
+            id,
+            xprv: '',
+            xpub: isEVM ? ethPubKey : xpub,
+            assets: {
+                syscoin: [],
+                ethereum: [],
+            },
+        };
+        return trezorAccount;
+    }
+    async _createLedgerAccount(coin, slip44, index, label) {
+        const vault = this.getVault();
+        const { accounts } = vault;
+        let xpub;
+        let address = '';
+        if ((0, derivation_paths_1.isEvmCoin)(coin, slip44)) {
+            const { address: ethAddress, publicKey } = await this.requireLedgerSigner().evm.getEvmAddressAndPubKey({
+                accountIndex: index,
+            });
+            address = ethAddress;
+            xpub = publicKey;
+        }
+        else {
+            const ledgerXpub = await this.requireLedgerSigner().utxo.getXpub({
+                index: index,
+                coin,
+                slip44,
+            });
+            // Convert device-returned extended key to BIP84 zpub/vpub for storage/backend usage
+            const { types } = (0, sysweb3_network_1.getNetworkConfig)(slip44, coin);
+            const bip84Target = slip44 === 1
+                ? types.zPubType.testnet.vpub
+                : types.zPubType.mainnet.zpub;
+            xpub = (0, derivation_paths_1.convertExtendedKeyVersion)(ledgerXpub, bip84Target);
+            // Always use first receive address (index 0) for imported account display
+            address = await this.getAddress(xpub, false, { forceIndex0: true });
+        }
+        if (this.accountAddressExists(accounts, address, (0, derivation_paths_1.isEvmCoin)(coin, slip44)))
+            throw new Error('Account already exists on your Wallet.');
+        if (!xpub || !address)
+            throw new Error('Something wrong happened. Please, try again or report it');
+        // Use getNextAccountId to properly handle placeholder accounts
+        const id = this.getNextAccountId(accounts[types_1.KeyringAccountType.Ledger]);
+        const currentBalances = { syscoin: 0, ethereum: 0 };
+        const ledgerAccount = {
+            ...this.initialLedgerAccountState,
+            balances: currentBalances,
+            address,
+            label: label ? label : `Ledger ${id + 1}`,
+            id,
+            xprv: '',
+            xpub,
+            assets: {
+                syscoin: [],
+                ethereum: [],
+            },
+        };
+        return ledgerAccount;
+    }
+    // Common helper method for UTXO account creation
+    async createUTXOAccountAtIndex(accountId, label) {
+        try {
+            // Create fresh signer just for this account creation operation
+            const freshHDSigner = this.createOnDemandUTXOSigner(accountId);
+            const sysAccount = await this.getFormattedBackendAccount({
+                signer: freshHDSigner,
+            });
+            const encryptedXprv = this.getEncryptedXprv(freshHDSigner);
+            // Generate network-aware label if none provided
+            const vault = this.getVault();
+            const network = vault.activeNetwork;
+            const defaultLabel = this.generateNetworkAwareLabel(accountId, network);
+            return {
+                ...this.getInitialAccountData({
+                    label: label || defaultLabel,
+                    signer: freshHDSigner,
+                    sysAccount,
+                    xprv: encryptedXprv,
+                }),
+                balances: { syscoin: 0, ethereum: 0 },
+            };
+        }
+        catch (error) {
+            console.log('ERROR createUTXOAccountAtIndex', {
+                error,
+            });
+            this.validateAndHandleErrorByMessage(error.message);
+            throw error;
+        }
+    }
+    async addNewAccountToSyscoinChain(label) {
+        try {
+            // Get next available account ID
+            const vault = this.getVault();
+            const accounts = vault.accounts[types_1.KeyringAccountType.HDAccount];
+            const nextId = this.getNextAccountId(accounts);
+            return await this.createUTXOAccountAtIndex(nextId, label);
+        }
+        catch (error) {
+            console.log('ERROR addNewAccountToSyscoinChain', {
+                error,
+            });
+            this.validateAndHandleErrorByMessage(error.message);
+            throw error;
+        }
+    }
+    async addNewAccountToEth(label) {
+        try {
+            // Get next available account ID
+            const vault = this.getVault();
+            const accounts = vault.accounts[types_1.KeyringAccountType.HDAccount];
+            const nextId = this.getNextAccountId(accounts);
+            // EVM accounts should use generic labels since they work across all EVM networks
+            const defaultLabel = `Account ${nextId + 1}`;
+            const newAccount = await this.setDerivedWeb3Accounts(nextId, label || defaultLabel);
+            return newAccount;
+        }
+        catch (error) {
+            console.log('ERROR addNewAccountToEth', {
+                error,
+            });
+            this.validateAndHandleErrorByMessage(error.message);
+            throw error;
+        }
+    }
+    // Helper method to get next available account ID - fills gaps when accounts are deleted
+    getNextAccountId(accounts) {
+        const existingIds = Object.values(accounts)
+            .filter((account) => {
+            // Only count accounts that have been properly initialized
+            // Placeholder accounts have empty addresses/xprv/xpub
+            return account && account.address && account.xpub;
+        })
+            .map((account) => account.id)
+            .filter((id) => !isNaN(id))
+            .sort((a, b) => a - b); // Sort to find gaps efficiently
+        if (existingIds.length === 0) {
+            return 0;
+        }
+        // Find the first gap in the sequence
+        for (let i = 0; i < existingIds.length; i++) {
+            if (existingIds[i] !== i) {
+                // Found a gap at position i
+                return i;
+            }
+        }
+        // No gaps found, return next sequential ID
+        return existingIds.length;
+    }
+    async recreateSessionFromVault(saltedHashPassword) {
+        try {
+            // v4 vault is encrypted with the derived session password key (PBKDF2 output)
+            // `saltedHashPassword` is the derived session password key passed by caller.
+            const { mnemonic } = await this.vaultPersistence.getDecryptedVault(saltedHashPassword);
+            if (!mnemonic) {
+                throw new Error('Mnemonic not found in vault');
+            }
+            // Encrypt session data with sessionPassword hash for consistency
+            // This allows keyring manager to decrypt with this.sessionPassword
+            this.privateRecordSessionRevision++;
+            this.sessionPassword = new SecureBuffer(saltedHashPassword);
+            // Encrypt the mnemonic with session password for consistency with the rest of the code
+            const encryptedMnemonic = crypto_js_1.default.AES.encrypt(mnemonic, saltedHashPassword).toString();
+            this.sessionMnemonic = new SecureBuffer(encryptedMnemonic);
+            console.log('[KeyringManager] Session data recreated from vault');
+        }
+        catch (error) {
+            console.error('ERROR recreateSessionFromVault', { error });
+            throw error;
+        }
+    }
+    async _getPrivateKeyAccountInfos(privKey, label, options) {
+        const vault = this.getVault();
+        const { accounts } = vault;
+        let importedAccountValue = null;
+        const balances = {
+            syscoin: 0,
+            ethereum: 0,
+        };
+        // Try to validate as extended private key first
+        const networkToUse = vault.activeNetwork;
+        const zprvValidation = this.validateZprv(privKey, networkToUse);
+        // Check if we're on an EVM network (slip44 = 60) or UTXO network
+        const isEvmNetwork = networkToUse.slip44 === 60;
+        if (zprvValidation.isValid) {
+            // This is a valid UTXO extended private key
+            if (isEvmNetwork) {
+                throw new Error('Cannot import UTXO private key on EVM network. Please switch to a UTXO network (Bitcoin/Syscoin) first.');
+            }
+            const { node, network } = zprvValidation;
+            if (!node || !network) {
+                throw new Error('Failed to validate extended private key');
+            }
+            // Always use index 0 for consistency
+            const nodeChild = node.derivePath(`0/0`);
+            if (!nodeChild) {
+                throw new Error('Failed to derive child node');
+            }
+            // Choose address type based on options or default to p2wpkh
+            let addrObj;
+            if (options?.utxoAddressType === 'p2pkh') {
+                addrObj = bjs.payments.p2pkh({
+                    pubkey: nodeChild.publicKey,
+                    network,
+                });
+            }
+            else if (options?.utxoAddressType === 'p2tr') {
+                // For taproot, use x-only public key (32 bytes instead of 33)
+                const xOnly = nodeChild.publicKey.length === 33
+                    ? nodeChild.publicKey.slice(1, 33)
+                    : nodeChild.publicKey;
+                addrObj = bjs.payments.p2tr({
+                    internalPubkey: xOnly,
+                    network,
+                });
+            }
+            else {
+                // Default to SegWit (p2wpkh)
+                addrObj = bjs.payments.p2wpkh({
+                    pubkey: nodeChild.publicKey,
+                    network,
+                });
+            }
+            const { address } = addrObj;
+            if (!address) {
+                throw new Error('Failed to generate address');
+            }
+            importedAccountValue = {
+                address,
+                // IMPORTANT: Store BIP84 extended *public* key (zpub/vpub), not device-style xpub/tpub.
+                // Blockbook derives different address branches depending on version bytes.
+                // Using zpub/vpub ensures UTXO discovery and `input.path` match BIP84 (m/84'/slip44'/...),
+                // which is required for HD signing.
+                publicKey: (() => {
+                    try {
+                        const { types } = (0, sysweb3_network_1.getNetworkConfig)(networkToUse.slip44, networkToUse.currency || 'Bitcoin');
+                        const target = networkToUse.slip44 === 1
+                            ? types.zPubType.testnet.vpub
+                            : types.zPubType.mainnet.zpub;
+                        return (0, derivation_paths_1.convertExtendedKeyVersion)(node.neutered().toBase58(), target);
+                    }
+                    catch (_e) {
+                        // Fall back to the default neutered key if conversion fails.
+                        return node.neutered().toBase58();
+                    }
+                })(),
+                privateKey: privKey,
+            };
+            balances.syscoin = 0;
+        }
+        else {
+            // If not a valid zprv/vprv, on UTXO networks try WIF
+            const isEvmNetwork = networkToUse.slip44 === 60;
+            let handledAsUtxo = false;
+            if (!isEvmNetwork) {
+                const wifValidation = this.validateWif(privKey, networkToUse);
+                if (wifValidation.isValid) {
+                    // Create address from WIF and treat as single-address imported account
+                    const { networks } = (0, sysweb3_network_1.getNetworkConfig)(networkToUse.slip44, networkToUse.currency || 'Bitcoin');
+                    const isTestnet = networkToUse.slip44 === 1;
+                    const bitcoinNetwork = isTestnet
+                        ? networks.testnet
+                        : networks.mainnet;
+                    const keyPair = syscoinjs.utils.bitcoinjs.ECPair.fromWIF(privKey, bitcoinNetwork);
+                    // Choose address type based on options or default behavior
+                    let addrObj;
+                    if (options?.utxoAddressType === 'p2pkh') {
+                        addrObj = bjs.payments.p2pkh({
+                            pubkey: keyPair.publicKey,
+                            network: bitcoinNetwork,
+                        });
+                    }
+                    else if (options?.utxoAddressType === 'p2tr') {
+                        // For taproot, use x-only public key (32 bytes instead of 33)
+                        const xOnly = keyPair.publicKey.length === 33
+                            ? keyPair.publicKey.slice(1, 33)
+                            : keyPair.publicKey;
+                        addrObj = bjs.payments.p2tr({
+                            internalPubkey: xOnly,
+                            network: bitcoinNetwork,
+                        });
+                    }
+                    else {
+                        // Default to SegWit (p2wpkh)
+                        addrObj = bjs.payments.p2wpkh({
+                            pubkey: keyPair.publicKey,
+                            network: bitcoinNetwork,
+                        });
+                    }
+                    const address = addrObj.address;
+                    if (!address) {
+                        throw new Error('Failed to generate address from WIF');
+                    }
+                    importedAccountValue = {
+                        address,
+                        // For single-address WIF accounts, store xpub as the address marker
+                        publicKey: address,
+                        privateKey: privKey,
+                    };
+                    // Set UTXO balance bucket
+                    balances.syscoin = 0;
+                    handledAsUtxo = true;
+                    // Proceed to account creation below
+                }
+                else if (!isEvmNetwork && wifValidation.message) {
+                    // Provide useful feedback on UTXO network if WIF was attempted and failed
+                    // Continue to EVM handling only if actually EVM network
+                }
+            }
+            // Check if the validation failed due to network mismatch
+            if (zprvValidation.message &&
+                zprvValidation.message.includes('Network mismatch')) {
+                throw new Error(zprvValidation.message);
+            }
+            // Check if the validation failed due to invalid key prefix (only for known extended key formats)
+            if (zprvValidation.message &&
+                zprvValidation.message.includes('Invalid key prefix')) {
+                throw new Error(zprvValidation.message);
+            }
+            // Check if it failed parsing as an extended key
+            if (zprvValidation.message &&
+                zprvValidation.message.includes('Failed to parse extended private key')) {
+                throw new Error(zprvValidation.message);
+            }
+            // Check if it looks like an extended key that failed validation
+            const knownExtendedKeyPrefixes = [
+                'xprv',
+                'xpub',
+                'yprv',
+                'ypub',
+                'zprv',
+                'zpub',
+                'tprv',
+                'tpub',
+                'uprv',
+                'upub',
+                'vprv',
+                'vpub',
+            ];
+            const prefix = privKey.substring(0, 4);
+            const looksLikeExtendedKey = knownExtendedKeyPrefixes.includes(prefix);
+            if (looksLikeExtendedKey) {
+                // This looks like a UTXO extended key, but it failed validation
+                // Don't try to import it as an EVM key
+                if (isEvmNetwork) {
+                    throw new Error('Cannot import UTXO private key on EVM network. Please switch to a UTXO network (Bitcoin/Syscoin) first.');
+                }
+                // For UTXO networks, throw the original validation error
+                throw new Error(zprvValidation.message || 'Invalid extended private key');
+            }
+            // If it's not an extended key and not a valid WIF, treat it as an Ethereum private key
+            // But first check if we're on an EVM network
+            if (!isEvmNetwork && !handledAsUtxo) {
+                throw new Error('Cannot import EVM private key on UTXO network. Please switch to an EVM network first.');
+            }
+            if (!handledAsUtxo) {
+                const hexPrivateKey = privKey.slice(0, 2) === '0x' ? privKey : `0x${privKey}`;
+                // Validate it's a valid hex string (32 bytes = 64 hex chars)
+                if (!/^0x[0-9a-fA-F]{64}$/.test(hexPrivateKey) &&
+                    !/^[0-9a-fA-F]{64}$/.test(privKey)) {
+                    throw new Error('Invalid private key format. Expected 32-byte hex string or extended private key.');
+                }
+                importedAccountValue =
+                    this.ethereumTransaction.importAccount(hexPrivateKey);
+                balances.ethereum = 0;
+            }
+        }
+        if (!importedAccountValue) {
+            throw new Error('Invalid private key format. Expected WIF, extended private key, or 32-byte hex.');
+        }
+        const { address, publicKey, privateKey } = importedAccountValue;
+        // Validate duplicates across all account buckets, including passkey smart accounts.
+        if (this.accountAddressExists(accounts, address, isEvmNetwork))
+            throw new Error('Account already exists, try again with another Private Key.');
+        const id = this.getNextAccountId(accounts[types_1.KeyringAccountType.Imported]);
+        const defaultLabel = label || `Imported ${id + 1}`;
+        return {
+            ...initial_state_1.initialActiveImportedAccountState,
+            address,
+            label: defaultLabel,
+            id,
+            balances,
+            isImported: true,
+            xprv: this.withSecureData((sessionPwd) => {
+                return crypto_js_1.default.AES.encrypt(privateKey, sessionPwd).toString();
+            }),
+            xpub: publicKey,
+            assets: {
+                syscoin: [],
+                ethereum: [],
+            },
+        };
+    }
+    // NEW: On-demand signer creation methods
+    /**
+     * Common method to decrypt mnemonic from session
+     * Eliminates code duplication across multiple methods
+     */
+    getDecryptedMnemonic() {
+        if (!this.sessionMnemonic || !this.sessionPassword) {
+            throw new Error('Session information not available');
+        }
+        const mnemonic = this.withSecureData((sessionPwd, sessionMnemonic) => {
+            const decrypted = crypto_js_1.default.AES.decrypt(sessionMnemonic, sessionPwd).toString(crypto_js_1.default.enc.Utf8);
+            if (!decrypted) {
+                throw new Error('Failed to decrypt mnemonic');
+            }
+            return decrypted;
+        });
+        return mnemonic;
+    }
+    /**
+     * Creates network RPC config from current active network without making RPC calls
+     * Common utility for all on-demand signer creation
+     */
+    createNetworkRpcConfig() {
+        const network = this.getVault().activeNetwork;
+        return {
+            formattedNetwork: network,
+            networkConfig: (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency),
+        };
+    }
+    /**
+     * Common signer creation logic - takes decrypted mnemonic/zprv and creates fresh signer
+     * OPTIMIZED: No RPC call needed - uses network config directly
+     */
+    createFreshUTXOSigner(mnemonicOrZprv, accountId) {
+        // Create signer using network config directly (no RPC call)
+        const rpcConfig = this.createNetworkRpcConfig();
+        // Type assertion to match getSyscoinSigners expected interface
+        const { hd } = (0, signers_1.getSyscoinSigners)({
+            mnemonic: mnemonicOrZprv,
+            rpc: rpcConfig,
+        });
+        // Create account at the specified index and set it as active
+        // Note: createAccountAtIndex is synchronous despite TypeScript types
+        hd.createAccountAtIndex(accountId, 84);
+        // Verify the account was created correctly
+        if (!hd.Signer.accounts.has(accountId)) {
+            throw new Error(`Failed to create account at index ${accountId}`);
+        }
+        // Verify the correct account is active
+        if (hd.Signer.accountIndex !== accountId) {
+            throw new Error(`Account index mismatch: expected ${accountId}, got ${hd.Signer.accountIndex}`);
+        }
+        return hd;
+    }
+    /**
+     * Creates a fresh UTXO signer for HD accounts derived from the main seed
+     * OPTIMIZED: No RPC call needed - uses network config directly
+     */
+    createOnDemandUTXOSigner(accountId) {
+        // Use common method to avoid code duplication
+        const mnemonic = this.getDecryptedMnemonic();
+        return this.createFreshUTXOSigner(mnemonic, accountId);
+    }
+    // NEW: Helper methods for HD signer management
+    isZprv(key) {
+        const zprvPrefixes = ['zprv', 'tprv', 'vprv', 'xprv'];
+        return zprvPrefixes.some((prefix) => key.startsWith(prefix));
+    }
+    // Helper methods for secure buffer operations
+    getSessionPasswordString() {
+        if (!this.sessionPassword || this.sessionPassword.isCleared()) {
+            throw new Error('Session password not available');
+        }
+        // WARNING: This exposes sensitive data as a string
+        // Use only for CryptoJS operations that require string input
+        return this.sessionPassword.toString();
+    }
+    getSessionMnemonicString() {
+        if (!this.sessionMnemonic || this.sessionMnemonic.isCleared()) {
+            throw new Error('Session mnemonic not available');
+        }
+        // WARNING: This exposes sensitive data as a string
+        // Use only for CryptoJS operations that require string input
+        return this.sessionMnemonic.toString();
+    }
+    // Secure method to perform cryptographic operations without exposing strings
+    withSecureData(operation) {
+        if (!this.sessionPassword || !this.sessionMnemonic) {
+            throw new Error('Session data not available');
+        }
+        // Perform operation with minimal exposure
+        const result = operation(this.getSessionPasswordString(), this.getSessionMnemonicString());
+        // Clear any temporary variables if needed
+        return result;
+    }
+    generateNetworkAwareLabel(accountId, network) {
+        // Generate concise network-specific labels using actual network config
+        const { label, chainId, kind, currency } = network;
+        // Create a shortened network identifier based on actual network configurations
+        let networkPrefix = '';
+        if (kind === sysweb3_network_1.INetworkType.Syscoin) {
+            // UTXO networks (slip44 = 57 for mainnet, 1 for testnet)
+            if (chainId === 57) {
+                networkPrefix = 'SYS'; // Syscoin UTXO Mainnet
+            }
+            else if (chainId === 5700) {
+                networkPrefix = 'SYS-T'; // Syscoin UTXO Testnet (slip44=1)
+            }
+            else {
+                // Other UTXO networks - use currency shortcut (e.g., "btc" -> "BTC")
+                if (currency) {
+                    networkPrefix = currency.toUpperCase();
+                }
+                else {
+                    // Fallback to first word from label if no currency
+                    const firstWord = label.split(' ')[0];
+                    networkPrefix =
+                        firstWord.length > 6 ? firstWord.substring(0, 6) : firstWord;
+                }
+            }
+        }
+        else {
+            // EVM networks (all use slip44=60)
+            if (chainId === 1) {
+                networkPrefix = 'ETH'; // Ethereum Mainnet
+            }
+            else if (chainId === 11155111) {
+                networkPrefix = 'ETH-T'; // Ethereum Sepolia Testnet
+            }
+            else if (chainId === 137) {
+                networkPrefix = 'POLY'; // Polygon Mainnet
+            }
+            else if (chainId === 80001) {
+                networkPrefix = 'POLY-T'; // Polygon Mumbai Testnet
+            }
+            else if (chainId === 57) {
+                networkPrefix = 'NEVM'; // Syscoin NEVM Mainnet
+            }
+            else if (chainId === 5700) {
+                networkPrefix = 'NEVM-T'; // Syscoin NEVM Testnet
+            }
+            else if (chainId === 570) {
+                networkPrefix = 'ROLLUX'; // Rollux Mainnet
+            }
+            else if (chainId === 57000) {
+                networkPrefix = 'ROLLUX-T'; // Rollux Testnet
+            }
+            else {
+                // Other EVM networks - use currency shortcut if available
+                if (currency) {
+                    // Check if it's a testnet network
+                    if (label.toLowerCase().includes('testnet') ||
+                        label.toLowerCase().includes('test')) {
+                        networkPrefix = `${currency.toUpperCase()}-T`;
+                    }
+                    else {
+                        networkPrefix = currency.toUpperCase();
+                    }
+                }
+                else {
+                    // Fallback to extracting meaningful prefix from label
+                    const firstWord = label.split(' ')[0];
+                    if (firstWord.toLowerCase().includes('testnet') ||
+                        firstWord.toLowerCase().includes('test')) {
+                        const baseWord = label.split(' ')[0];
+                        networkPrefix = `${baseWord.substring(0, 4).toUpperCase()}-T`;
+                    }
+                    else {
+                        networkPrefix =
+                            firstWord.length > 6
+                                ? firstWord.substring(0, 6).toUpperCase()
+                                : firstWord.toUpperCase();
+                    }
+                }
+            }
+        }
+        return `${networkPrefix} ${accountId + 1}`;
+    }
+    /**
+     * Clean up all resources
+     */
+    async destroy() {
+        await this.lockWallet();
+        // Clear any remaining references
+        this.ethereumTransaction = {};
+        this.syscoinTransaction = {};
+    }
+}
+exports.KeyringCore = KeyringCore;
+//# sourceMappingURL=keyring-core.js.map