@sidhujag/sysweb3-keyring 1.0.626 → 1.0.628

package/cjs/keyring-manager.js

@@ -32,2456 +32,42 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KeyringManager = void 0;
-const secp256k1_1 = __importDefault(require("@bitcoinerlab/secp256k1"));
 const sysweb3 = __importStar(require("@sidhujag/sysweb3-core"));
-const sysweb3_network_1 = require("@sidhujag/sysweb3-network");
-const bip32_1 = require("bip32");
-const bs58check_1 = __importDefault(require("bs58check"));
-const crypto_1 = __importDefault(require("crypto"));
-const crypto_js_1 = __importDefault(require("crypto-js"));
-const mapValues_1 = __importDefault(require("lodash/mapValues"));
-const omit_1 = __importDefault(require("lodash/omit"));
-const syscoinjs = __importStar(require("syscoinjs-lib"));
-const BIP84 = __importStar(require("syscoinjs-lib/bip84-replacement"));
-// Reference embedded bitcoinjs from syscoinjs-lib
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const bjs = syscoinjs.utils.bitcoinjs;
-const LEGACY_ENCRYPTION_KDF = 'pbkdf2-sha512-20000';
-const SLH_DSA_DERIVATION_VERSION = 1;
-// Preserve Pali v1 SLH derivation: first 32 bytes of the account-scoped HMAC.
-// Pali expands this setup secret into the 48-byte SLH skSeed/skPrf/pkSeed tuple.
-const SLH_DSA_SETUP_SECRET_HEX_LENGTH = 64;
-const SLH_DSA_PARAMETER_SET = 'SLH-DSA-SHA2-128-24';
-const ethers_v6_1 = require("./ethers-v6");
 const hardware_wallet_manager_singleton_1 = require("./hardware-wallet-manager-singleton");
-const initial_state_1 = require("./initial-state");
+const keyring_core_1 = require("./keyring-core");
 const ledger_1 = require("./ledger");
-const private_records_1 = require("./private-records");
-const signers_1 = require("./signers");
 const storage_1 = require("./storage");
-const transactions_1 = require("./transactions");
-const evm_local_signer_1 = require("./transactions/evm-local-signer");
+const hardware_psbt_1 = require("./transactions/hardware-psbt");
 const trezor_1 = require("./trezor");
-const types_1 = require("./types");
-const blockbook_cache_1 = require("./utils/blockbook-cache");
-const derivation_paths_1 = require("./utils/derivation-paths");
-const psbt_account_scope_1 = require("./utils/psbt-account-scope");
-const watch_descriptor_1 = require("./utils/watch-descriptor");
-// Dynamic ETH HD path generation - will be computed as needed
-/**
- * Secure Buffer implementation for sensitive data
- * Provides explicit memory clearing capability
- */
-class SecureBuffer {
-    constructor(data) {
-        this._isCleared = false;
-        if (typeof data === 'string') {
-            this.buffer = Buffer.from(data, 'utf8');
-        }
-        else {
-            this.buffer = Buffer.from(data);
-        }
-    }
-    get() {
-        if (this._isCleared || !this.buffer) {
-            throw new Error('SecureBuffer has been cleared');
-        }
-        return Buffer.from(this.buffer); // Return copy
-    }
-    toString() {
-        if (this._isCleared || !this.buffer) {
-            throw new Error('SecureBuffer has been cleared');
-        }
-        return this.buffer.toString('utf8');
-    }
-    clear() {
-        if (!this._isCleared && this.buffer) {
-            // Zeroing must not depend on a working platform random source.
-            this.buffer.fill(0);
-            this.buffer = null;
-            this._isCleared = true;
-        }
-    }
-    isCleared() {
-        return this._isCleared;
-    }
-}
-class KeyringManager {
-    /**
-     * @param sharedHardwareWalletManager Optional shared HardwareWalletManager instance.
-     *                                     If not provided, the singleton instance will be used.
-     *                                     This allows multiple KeyringManagers to share the same
-     *                                     hardware wallet connections, preventing "device already open" errors.
-     */
+const legacyAuthority = Object.freeze({});
+const legacyVaultPersistence = { getDecryptedVault: storage_1.getDecryptedVault, setEncryptedVault: storage_1.setEncryptedVault };
+/** Existing browser entry. Native/software hosts must use the software entry. */
+class KeyringManager extends keyring_core_1.KeyringCore {
     constructor(sharedHardwareWalletManager) {
-        // Store getter function for accessing Redux state
-        this.getVaultState = null;
-        // Method to inject store getter from Pali side
-        this.setVaultStateGetter = (getter) => {
-            this.getVaultState = getter;
-        };
-        // Helper method to get current vault state
-        this.getVault = () => {
-            if (!this.getVaultState) {
-                throw new Error('Vault state getter not configured. Call setVaultStateGetter() first.');
-            }
-            const vault = this.getVaultState();
-            // DEFENSIVE CHECK: Ensure vault state is properly structured
-            if (!vault) {
-                throw new Error('Vault state is undefined. Ensure Redux store is properly initialized with vault state.');
-            }
-            if (!vault.activeNetwork) {
-                throw new Error('Vault state is missing activeNetwork. Ensure vault state is properly initialized before keyring operations.');
-            }
-            if (!vault.activeAccount) {
-                throw new Error('Vault state is missing activeAccount. Ensure vault state is properly initialized before keyring operations.');
-            }
-            return vault;
-        };
-        // Helper to get active chain from vault state (replaces this.activeChain)
-        this.getActiveChain = () => {
-            return this.getVault().activeNetwork.kind;
-        };
-        this.accountAddressExists = (accounts, address, caseInsensitive = false) => {
-            const expectedAddress = caseInsensitive ? address.toLowerCase() : address;
-            return Object.values(accounts || {}).some((accountsByType) => Object.values(accountsByType || {}).some((account) => {
-                if (!account?.address) {
-                    return false;
-                }
-                const accountAddress = caseInsensitive
-                    ? account.address.toLowerCase()
-                    : account.address;
-                return accountAddress === expectedAddress;
-            }));
-        };
-        // Secure session data - using Buffers that can be explicitly cleared
-        this.sessionPassword = null;
-        this.sessionMnemonic = null; // can be a mnemonic or a zprv, can be changed to a zprv when using an imported wallet
-        this.privateRecordSessionRevision = 0;
-        // ===================================== PUBLIC METHODS - KEYRING MANAGER FOR HD - SYS ALL ===================================== //
-        this.setStorage = (client) => this.storage.setClient(client);
-        this.validateAccountType = (account) => {
-            return account.isImported === true
-                ? types_1.KeyringAccountType.Imported
-                : types_1.KeyringAccountType.HDAccount;
-        };
-        this.isUnlocked = () => !!this.sessionPassword && !this.sessionPassword.isCleared();
-        this.lockWallet = async () => {
-            this.privateRecordSessionRevision++;
-            // Clear secure session data
-            if (this.sessionPassword) {
-                this.sessionPassword.clear();
-                this.sessionPassword = null;
-            }
-            if (this.sessionMnemonic) {
-                this.sessionMnemonic.clear();
-                this.sessionMnemonic = null;
-            }
-            // Clear transaction handlers that may hold HD signers
-            if (this.syscoinTransaction) {
-                // Replace with empty object to clear references
-                this.syscoinTransaction = {};
-            }
-            // NOTE: We intentionally don't clear ethereumTransaction here because
-            // polling needs the web3Provider even when the wallet is locked.
-            // Clean up hardware wallet connections (await to ensure HID is released)
-            if (this.ledgerSigner) {
-                try {
-                    await this.ledgerSigner.destroy();
-                }
-                catch (_) {
-                    // ignore
-                }
-            }
-            if (this.trezorSigner) {
-                try {
-                    await this.trezorSigner.destroy();
-                }
-                catch (_) {
-                    // ignore
-                }
-            }
-        };
-        // Direct secure transfer of session data to another keyring
-        this.transferSessionTo = (targetKeyring) => {
-            if (!this.isUnlocked()) {
-                throw new Error('Source keyring must be unlocked to transfer session');
-            }
-            // Cast to access the receiveSessionOwnership method
-            const targetKeyringImpl = targetKeyring;
-            // Transfer ownership of our buffers to the target
-            if (!this.sessionPassword || !this.sessionMnemonic) {
-                throw new Error('Session data is missing during transfer');
-            }
-            this.privateRecordSessionRevision++;
-            targetKeyringImpl.receiveSessionOwnership(this.sessionPassword, this.sessionMnemonic);
-            // Null out our references (do NOT clear buffers - target owns them now)
-            this.sessionPassword = null;
-            this.sessionMnemonic = null;
-        };
-        // Private method for zero-copy transfer - takes ownership of buffers
-        this.receiveSessionOwnership = (sessionPassword, sessionMnemonic) => {
-            this.privateRecordSessionRevision++;
-            // Clear any existing data first
-            if (this.sessionPassword) {
-                this.sessionPassword.clear();
-            }
-            if (this.sessionMnemonic) {
-                this.sessionMnemonic.clear();
-            }
-            // Take ownership of the actual SecureBuffer objects
-            // No copying - these are the original objects
-            this.sessionPassword = sessionPassword;
-            this.sessionMnemonic = sessionMnemonic;
-        };
-        this.addNewAccount = async (label) => {
-            // Check if wallet is unlocked
-            if (!this.isUnlocked()) {
-                throw new Error('Wallet must be unlocked to add new accounts');
-            }
-            // addNewAccount should only create accounts from the main seed
-            // For importing accounts (including zprvs), use importAccount
-            if (this.getActiveChain() === sysweb3_network_1.INetworkType.Syscoin) {
-                return await this.addNewAccountToSyscoinChain(label);
-            }
-            else {
-                // EVM chainType
-                return await this.addNewAccountToEth(label);
-            }
-        };
-        this.createSmartAccount = async ({ address, deriveAccount, label, metadata, }) => {
-            const vault = this.getVault();
-            const { accounts } = vault;
-            const smartAccounts = accounts[types_1.KeyringAccountType.SmartAccount] || {};
-            const nextId = this.getNextAccountId(smartAccounts);
-            const derived = deriveAccount
-                ? await deriveAccount(nextId)
-                : { address, metadata };
-            if (!derived.address) {
-                throw new Error('Smart account address is required');
-            }
-            if (this.accountAddressExists(accounts, derived.address, true)) {
-                throw new Error('Account already exists on your Wallet.');
-            }
-            return {
-                address: derived.address,
-                balances: {
-                    [sysweb3_network_1.INetworkType.Syscoin]: 0,
-                    [sysweb3_network_1.INetworkType.Ethereum]: 0,
-                },
-                id: nextId,
-                isImported: false,
-                isLedgerWallet: false,
-                isSmartAccount: true,
-                isTrezorWallet: false,
-                label: label || `Smart Account ${nextId + 1}`,
-                smartAccount: derived.metadata,
-                xprv: '',
-                xpub: derived.address,
-            };
-        };
-        this.getNewChangeAddress = async () => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[activeAccount.id];
-            if (!account) {
-                throw new Error('Active account not found');
-            }
-            const { xpub, isImported, address } = account;
-            // For imported single-address accounts, always return the single address
-            const looksLikeSingleAddress = isImported &&
-                xpub === address &&
-                !this.isDescriptor(xpub) &&
-                !this.isXpubLike(xpub);
-            if (looksLikeSingleAddress)
-                return address;
-            return await this.getAddress(xpub, true); // Don't skip increment - get next unused
-        };
-        this.getChangeAddress = async (id) => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[id];
-            if (!account) {
-                throw new Error(`Account with id ${id} not found`);
-            }
-            const { xpub, isImported, address } = account;
-            if (isImported &&
-                xpub === address &&
-                !this.isDescriptor(xpub) &&
-                !this.isXpubLike(xpub))
-                return address;
-            return await this.getAddress(xpub, true);
-        };
-        this.getPubkey = async (id, isChangeAddress) => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[id];
-            if (!account) {
-                throw new Error(`Account with id ${id} not found`);
-            }
-            const { xpub, isImported, address } = account;
-            // Guard: single-address imported are watch-only
-            if (isImported && xpub === address) {
-                throw new Error('Public key not available for single-address imported accounts');
-            }
-            // Guard: descriptor/xpub watch-only (no xprv and not hardware)
-            if (this.isWatchOnlyAccount(account)) {
-                throw new Error('Public key not available for watch-only accounts');
-            }
-            return await this.getCurrentAddressPubkey(xpub, isChangeAddress);
-        };
-        this.getBip32Path = async (id, isChangeAddress) => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[id];
-            if (!account) {
-                throw new Error(`Account with id ${id} not found`);
-            }
-            const { xpub, isImported, address } = account;
-            // Guard: single-address imported are watch-only
-            if (isImported && xpub === address) {
-                throw new Error('BIP32 path not available for single-address imported accounts');
-            }
-            // Guard: descriptor/xpub watch-only (no xprv and not hardware)
-            if (this.isWatchOnlyAccount(account)) {
-                throw new Error('BIP32 path not available for watch-only accounts');
-            }
-            return await this.getCurrentAddressBip32Path(xpub, isChangeAddress);
-        };
-        this.updateReceivingAddress = async () => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[activeAccount.id];
-            if (!account) {
-                throw new Error('Active account not found');
-            }
-            const { xpub, isImported, address } = account;
-            if (isImported &&
-                xpub === address &&
-                !this.isDescriptor(xpub) &&
-                !this.isXpubLike(xpub))
-                return address;
-            const nextAddress = await this.getAddress(xpub, false);
-            // NOTE: Address updates should be dispatched to Redux store, not updated here
-            // The calling code should handle the Redux dispatch
-            return nextAddress;
-        };
-        this.getAccountById = (id, accountType) => {
-            const vault = this.getVault();
-            const accounts = vault.accounts[accountType];
-            const account = accounts[id];
-            if (!account) {
-                throw new Error('Account not found');
-            }
-            return (0, omit_1.default)(account, 'xprv');
-        };
-        this.getPrivateKeyByAccountId = async (id, accountType, pwd) => {
-            try {
-                // Validate password using vault salt (same pattern as getSeed)
-                if (!this.sessionPassword) {
-                    throw new Error('Unlock wallet first');
-                }
-                // Get vault salt for password validation
-                const vaultKeys = await this.storage.get('vault-keys');
-                if (!vaultKeys || !vaultKeys.salt) {
-                    throw new Error('Vault keys not found');
-                }
-                const genPwd = await this.deriveStoredSessionKey(pwd, vaultKeys);
-                if (this.getSessionPasswordString() !== genPwd) {
-                    throw new Error('Invalid password');
-                }
-                const vault = this.getVault();
-                const account = vault.accounts[accountType][id];
-                if (!account) {
-                    throw new Error('Account not found');
-                }
-                // Decrypt the stored private key using secure method
-                const decryptedPrivateKey = this.withSecureData((sessionPwd) => {
-                    const decrypted = crypto_js_1.default.AES.decrypt(account.xprv, sessionPwd).toString(crypto_js_1.default.enc.Utf8);
-                    if (!decrypted) {
-                        throw new Error('Failed to decrypt private key. Invalid password or corrupted data.');
-                    }
-                    return decrypted;
-                });
-                // NOTE: Returning decrypted private key as string is necessary for compatibility
-                // Callers should handle this sensitive data carefully
-                return decryptedPrivateKey;
-            }
-            catch (error) {
-                this.validateAndHandleErrorByMessage(error.message);
-                throw error;
-            }
-        };
-        this.getActiveAccount = () => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const activeAccountId = activeAccount.id;
-            const activeAccountType = activeAccount.type;
-            return {
-                activeAccount: (0, omit_1.default)(accounts[activeAccountType][activeAccountId], 'xprv'),
-                activeAccountType,
-            };
-        };
-        this.isDescriptor = (s) => /^(addr|pkh|wpkh|sh|wsh|tr|combo|multi|sortedmulti)\s*\(/i.test(s || '');
-        this.isXpubLike = (s) => /^(xpub|tpub|zpub|vpub)/i.test(s || '');
-        this.getEncryptedXprv = (hd) => {
-            return this.withSecureData((sessionPwd) => {
-                return crypto_js_1.default.AES.encrypt(this.getSysActivePrivateKey(hd), sessionPwd).toString();
-            });
-        };
-        this.getSeed = async (pwd) => {
-            if (!this.sessionPassword) {
-                throw new Error('Unlock wallet first');
-            }
-            // Get vault salt for password validation (consistent with getPrivateKeyByAccountId)
-            const vaultKeys = await this.storage.get('vault-keys');
-            if (!vaultKeys || !vaultKeys.salt) {
-                throw new Error('Vault keys not found');
-            }
-            const genPwd = await this.deriveStoredSessionKey(pwd, vaultKeys);
-            if (this.getSessionPasswordString() !== genPwd) {
-                throw new Error('Invalid password');
-            }
-            // v4 vault is encrypted with the derived session password key (PBKDF2 output)
-            let { mnemonic } = await (0, storage_1.getDecryptedVault)(genPwd);
-            if (!mnemonic) {
-                throw new Error('Mnemonic not found in vault or is empty');
-            }
-            // Try to detect if mnemonic is encrypted or plain text
-            const isLikelyPlainMnemonic = mnemonic.includes(' ') &&
-                (mnemonic.split(' ').length === 12 || mnemonic.split(' ').length === 24);
-            if (!isLikelyPlainMnemonic) {
-                try {
-                    mnemonic = crypto_js_1.default.AES.decrypt(mnemonic, pwd).toString(crypto_js_1.default.enc.Utf8);
-                }
-                catch (decryptError) {
-                    // If decryption fails, assume mnemonic is already decrypted
-                    console.warn('Mnemonic decryption failed in getSeed, using as-is:', decryptError.message);
-                }
-            }
-            if (!mnemonic) {
-                throw new Error('Failed to decrypt mnemonic or mnemonic is empty after decryption');
-            }
-            return mnemonic;
-        };
-        this.deriveSLHDSASetupSecretForAccount = async ({ accountIndex, }) => {
-            if (!this.sessionPassword) {
-                throw new Error('Unlock wallet first');
-            }
-            const mnemonic = this.getDecryptedMnemonic();
-            const normalizedMnemonic = mnemonic.normalize('NFKD');
-            const seed = crypto_js_1.default.PBKDF2(normalizedMnemonic, `mnemonic`.normalize('NFKD'), {
-                hasher: crypto_js_1.default.algo.SHA512,
-                iterations: 2048,
-                keySize: 512 / 32,
-            });
-            const derivationLabel = `PALI/${SLH_DSA_PARAMETER_SET}/v${SLH_DSA_DERIVATION_VERSION}/account/${accountIndex}`;
-            const digest = crypto_js_1.default.HmacSHA512(derivationLabel, crypto_js_1.default.enc.Hex.parse(seed.toString(crypto_js_1.default.enc.Hex)));
-            return {
-                derivationLabel,
-                setupSecretHex: digest
-                    .toString(crypto_js_1.default.enc.Hex)
-                    .slice(0, SLH_DSA_SETUP_SECRET_HEX_LENGTH),
-            };
-        };
-        this.encryptSLHDSASessionState = (plainText) => {
-            return this.withSecureData((sessionPwd) => crypto_js_1.default.AES.encrypt(plainText, sessionPwd).toString());
-        };
-        this.decryptSLHDSASessionState = (cipherText) => {
-            return this.withSecureData((sessionPwd) => {
-                const plainText = crypto_js_1.default.AES.decrypt(cipherText, sessionPwd).toString(crypto_js_1.default.enc.Utf8);
-                if (!plainText) {
-                    throw new Error('Failed to decrypt SLH-DSA session state');
-                }
-                return plainText;
-            });
-        };
-        this.setSignerNetwork = async (network) => {
-            // With multi-keyring architecture, each keyring is dedicated to specific slip44
-            if (sysweb3_network_1.INetworkType.Ethereum !== network.kind &&
-                sysweb3_network_1.INetworkType.Syscoin !== network.kind) {
-                throw new Error('Unsupported chain');
-            }
-            // Validate network/chain type compatibility
-            if (network.kind === sysweb3_network_1.INetworkType.Ethereum &&
-                this.getActiveChain() === sysweb3_network_1.INetworkType.Syscoin) {
-                throw new Error('Cannot use Ethereum chain type with Syscoin network');
-            }
-            if (network.kind === sysweb3_network_1.INetworkType.Syscoin &&
-                this.getActiveChain() === sysweb3_network_1.INetworkType.Ethereum) {
-                throw new Error('Cannot use Syscoin chain type with Ethereum network');
-            }
-            // CRITICAL: Prevent UTXO-to-UTXO network switching within same keyring
-            // Each UTXO network should have its own KeyringManager instance based on slip44
-            const vault = this.getVault();
-            if (this.getActiveChain() === sysweb3_network_1.INetworkType.Syscoin && vault.activeNetwork) {
-                const currentSlip44 = vault.activeNetwork.slip44;
-                const newSlip44 = network.slip44;
-                if (currentSlip44 !== newSlip44) {
-                    throw new Error(`Cannot switch between different UTXO networks within the same keyring. ` +
-                        `Current network uses slip44=${currentSlip44}, target network uses slip44=${newSlip44}. ` +
-                        `Each UTXO network requires a separate KeyringManager instance.`);
-                }
-            }
-            try {
-                // With multi-keyring architecture:
-                // - UTXO: Each keyring is dedicated to one network (slip44), so this is only called during initialization
-                // - EVM: All EVM networks share slip44=60, so network can change within the same keyring
-                if (network.kind === sysweb3_network_1.INetworkType.Syscoin) {
-                    // For UTXO networks: validate that active account exists (accounts should be created via addNewAccount/initialize)
-                    const accountId = vault.activeAccount.id || 0;
-                    const accountType = vault.activeAccount.type || types_1.KeyringAccountType.HDAccount;
-                    const accounts = vault.accounts[accountType];
-                    if (!accounts[accountId] || !accounts[accountId].xpub) {
-                        throw new Error(`Active account ${accountType}:${accountId} does not exist. Create accounts using addNewAccount() or initializeWalletSecurely() first.`);
-                    }
-                    // No additional setup needed - on-demand signers will be created when needed
-                }
-                else if (network.kind === sysweb3_network_1.INetworkType.Ethereum) {
-                    // For EVM networks: we primarily need a correct provider for the active network.
-                    // Active account validation can be temporarily inconsistent during network switching
-                    // (e.g., placeholder activeAccount like Trezor:0 before accounts hydrate), and provider
-                    // setup does not depend on it. So treat missing active account as a warning, not a hard error.
-                    const accountId = vault.activeAccount.id || 0;
-                    const accountType = vault.activeAccount.type || types_1.KeyringAccountType.HDAccount;
-                    const accounts = vault.accounts[accountType];
-                    if (!accounts?.[accountId]) {
-                        console.warn(`[KeyringManager] Active account ${accountType}:${accountId} not found while setting EVM network; continuing to set provider`);
-                    }
-                    // Set up EVM provider for network switching
-                    await this.setSignerEVM(network);
-                }
-                return {
-                    success: true,
-                };
-            }
-            catch (err) {
-                console.log('ERROR setSignerNetwork', {
-                    err,
-                });
-                this.validateAndHandleErrorByMessage(err.message);
-                //Rollback to previous values
-                console.error('Set Signer Network failed with', err);
-                return { success: false };
-            }
-        };
-        this.forgetMainWallet = async (pwd) => {
-            const vaultKeys = await this.storage.get('vault-keys');
-            if (!vaultKeys || !vaultKeys.salt) {
-                throw new Error('Vault keys not found');
-            }
-            const genPwd = await this.deriveStoredSessionKey(pwd, vaultKeys);
-            if (!this.sessionPassword) {
-                throw new Error('Unlock wallet first');
-            }
-            else if (this.getSessionPasswordString() !== genPwd) {
-                throw new Error('Invalid password');
-            }
-            await this.clearTemporaryLocalKeys();
-        };
-        this.importWeb3Account = (mnemonicOrPrivKey) => {
-            // Check if it's a hex string (Ethereum private key)
-            if ((0, ethers_v6_1.isHexString)(mnemonicOrPrivKey)) {
-                return (0, evm_local_signer_1.privateKeyToAccount)(mnemonicOrPrivKey);
-            }
-            // Check if it's a zprv/tprv (Syscoin private key)
-            const zprvPrefixes = ['zprv', 'tprv', 'vprv', 'xprv'];
-            if (zprvPrefixes.some((prefix) => mnemonicOrPrivKey.startsWith(prefix))) {
-                throw new Error('Syscoin extended private keys (zprv/tprv) should be imported using importAccount, not importWeb3Account');
-            }
-            // Otherwise, assume it's a mnemonic
-            return (0, evm_local_signer_1.deriveEvmAccountFromMnemonic)(mnemonicOrPrivKey, (0, derivation_paths_1.getAddressDerivationPath)('eth', 60, 0, false, 0));
-        };
-        this.getAccountXpub = () => {
-            const vault = this.getVault();
-            const { activeAccount } = vault;
-            const account = vault.accounts[activeAccount.type]?.[activeAccount.id];
-            if (!account) {
-                throw new Error('Active account not found');
-            }
-            return account.xpub;
-        };
-        this.isSeedValid = (seedPhrase) => BIP84.validateMnemonic(seedPhrase);
-        this.createNewSeed = (wordCount) => {
-            // Map BIP39 word counts to entropy strength
-            const wordCountToStrength = {
-                12: 128,
-                15: 160,
-                18: 192,
-                21: 224,
-                24: 256,
-            };
-            const strength = wordCount ? wordCountToStrength[wordCount] : 128;
-            return strength
-                ? BIP84.generateMnemonic(strength)
-                : BIP84.generateMnemonic();
-        };
-        this.getUTXOState = () => {
-            const vault = this.getVault();
-            if (vault.activeNetwork.kind !== sysweb3_network_1.INetworkType.Syscoin) {
-                throw new Error('Cannot get state in a ethereum network');
-            }
-            const utxOAccounts = (0, mapValues_1.default)(vault.accounts.HDAccount, (value) => (0, omit_1.default)(value, 'xprv'));
-            return {
-                ...vault,
-                accounts: {
-                    [types_1.KeyringAccountType.HDAccount]: utxOAccounts,
-                    [types_1.KeyringAccountType.Imported]: {},
-                    [types_1.KeyringAccountType.Trezor]: {},
-                    [types_1.KeyringAccountType.Ledger]: {},
-                },
-            };
-        };
-        this.getActiveUTXOAccountState = () => {
-            const vault = this.getVault();
-            const { activeAccount } = vault;
-            return {
-                ...vault.accounts.HDAccount[activeAccount.id],
-                xprv: undefined,
-            };
-        };
-        this.getNetwork = () => this.getVault().activeNetwork;
-        this.createEthAccount = (privateKey) => (0, evm_local_signer_1.privateKeyToAccount)(privateKey);
-        // Helper to get current account data from backend
-        this.fetchCurrentAccountData = async (xpub, isChangeAddress) => {
-            const vault = this.getVault();
-            const { activeNetwork } = vault;
-            // Use read-only signer for backend calls - works for all account types including hardware wallets
-            const { main } = this.getReadOnlySigner();
-            const options = 'tokens=used&details=tokens';
-            // In-flight deduplicated: concurrent callers within a send flow
-            // (fee estimation, PSBT creation, signing) share a single request
-            const { tokens } = await (0, blockbook_cache_1.fetchBackendAccountCached)(main.blockbookURL, xpub, options);
-            const { receivingIndex, changeIndex } = this.setLatestIndexesFromXPubTokens(tokens);
-            // Get network configuration for BIP84 using network-provided pub type macros
-            const networkConfig = (0, sysweb3_network_1.getNetworkConfig)(activeNetwork.slip44, activeNetwork.currency);
-            const pubTypes = networkConfig?.types?.zPubType;
-            if (!pubTypes) {
-                throw new Error('Missing zPubType in network configuration');
-            }
-            const networks = networkConfig.networks;
-            const currentAccount = new BIP84.fromZPub(xpub, pubTypes, networks);
-            const addressIndex = isChangeAddress ? changeIndex : receivingIndex;
-            return {
-                currentAccount,
-                addressIndex,
-                main,
-            };
-        };
-        this.getAddress = async (xpub, isChangeAddress, options) => {
-            if (this.isDescriptor(xpub)) {
-                // The BIP84 history scanner below cannot choose a descriptor's next
-                // unused index. Import can derive index zero locally, but rotation must
-                // not reinterpret a descriptor as a BIP84 extended key.
-                if (!options?.forceIndex0) {
-                    throw new Error('Address rotation is not supported for watch-only descriptors');
-                }
-                return (0, watch_descriptor_1.deriveDescriptorAddress)(xpub, this.getVault().activeNetwork, {
-                    change: isChangeAddress,
-                });
-            }
-            const { currentAccount, addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
-            const effectiveIndex = options?.forceIndex0 ? 0 : addressIndex;
-            const address = currentAccount.getAddress(effectiveIndex, isChangeAddress, 84);
-            return address;
-        };
-        this.getCurrentAddressPubkey = async (xpub, isChangeAddress) => {
-            const { currentAccount, addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
-            // BIP84 returns the public key as a hex string directly
-            return currentAccount.getPublicKey(addressIndex, isChangeAddress);
-        };
-        this.getCurrentAddressBip32Path = async (xpub, isChangeAddress) => {
-            const vault = this.getVault();
-            const { activeAccount, activeNetwork } = vault;
-            const { addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
-            // Use the utility function to generate the proper derivation path
-            const coinShortcut = activeNetwork.currency.toLowerCase(); // e.g., 'sys', 'btc'
-            const path = (0, derivation_paths_1.getAddressDerivationPath)(coinShortcut, activeNetwork.slip44, activeAccount.id, isChangeAddress, addressIndex);
-            return path;
-        };
-        this.logout = () => {
-            this.lockWallet();
-        };
-        /**
-         * PRIVATE METHODS
-         */
-        // ===================================== AUXILIARY METHOD - FOR TRANSACTIONS CLASSES ===================================== //
-        this.getDecryptedPrivateKey = (targetAccount) => {
-            try {
-                const vault = this.getVault();
-                const { accounts } = vault;
-                const activeAccount = targetAccount || vault.activeAccount;
-                const activeAccountId = activeAccount.id;
-                const activeAccountType = activeAccount.type;
-                const isLedger = activeAccountType === types_1.KeyringAccountType.Ledger;
-                const isTrezor = activeAccountType === types_1.KeyringAccountType.Trezor;
-                const isHardwareWallet = isTrezor || isLedger;
-                if (!this.sessionPassword)
-                    throw new Error('Wallet is locked cant proceed with transaction');
-                const activeAccountData = accounts[activeAccountType][activeAccountId];
-                if (!activeAccountData) {
-                    throw new Error(`Active account (${activeAccountType}:${activeAccountId}) not found. Account switching may be in progress.`);
-                }
-                const { xprv, address } = activeAccountData;
-                if (isHardwareWallet) {
-                    return {
-                        address,
-                        decryptedPrivateKey: '',
-                    };
-                }
-                if (!xprv) {
-                    throw new Error(`Private key not found for account ${activeAccountType}:${activeAccountId}. Account may not be fully initialized.`);
-                }
-                let decryptedPrivateKey;
-                try {
-                    decryptedPrivateKey = this.withSecureData((sessionPwd) => {
-                        return crypto_js_1.default.AES.decrypt(xprv, sessionPwd).toString(crypto_js_1.default.enc.Utf8);
-                    });
-                }
-                catch (decryptError) {
-                    throw new Error(`Failed to decrypt private key for account ${activeAccountType}:${activeAccountId}. The wallet may be locked or corrupted.`);
-                }
-                if (!decryptedPrivateKey) {
-                    throw new Error(`Decrypted private key is empty for account ${activeAccountType}:${activeAccountId}. Invalid password or corrupted data.`);
-                }
-                // For EVM accounts, validate that the derived address matches the stored address
-                // This helps catch account switching race conditions early
-                if (this.getActiveChain() === sysweb3_network_1.INetworkType.Ethereum) {
-                    try {
-                        const derivedAccount = (0, evm_local_signer_1.privateKeyToAccount)(decryptedPrivateKey);
-                        if (derivedAccount.address.toLowerCase() !== address.toLowerCase()) {
-                            throw new Error(`Address mismatch for account ${activeAccountType}:${activeAccountId}. Expected ${address} but derived ${derivedAccount.address}. Account switching may be in progress.`);
-                        }
-                    }
-                    catch (addressError) {
-                        throw new Error(`Failed to validate EVM address for account ${activeAccountType}:${activeAccountId}: ${addressError.message}`);
-                    }
-                }
-                return {
-                    address,
-                    decryptedPrivateKey,
-                };
-            }
-            catch (error) {
-                const vaultForLogging = this.getVault();
-                const isTestEnv = typeof process !== 'undefined' && process?.env?.NODE_ENV === 'test';
-                if (!isTestEnv) {
-                    console.error('ERROR getDecryptedPrivateKey', {
-                        error: error.message,
-                        activeChain: this.getActiveChain(),
-                        vault: {
-                            activeAccountId: vaultForLogging?.activeAccount?.id,
-                            activeAccountType: vaultForLogging?.activeAccount?.type,
-                        },
-                    });
-                }
-                this.validateAndHandleErrorByMessage(error.message);
-                throw error;
-            }
-        };
-        this.capturePsbtSigningContext = () => {
-            const session = this.sessionPassword;
-            const vault = this.getVault();
-            const selected = { ...vault.activeAccount };
-            const account = vault.accounts[selected.type]?.[selected.id];
-            const identity = { address: account?.address, xpub: account?.xpub };
-            const network = { ...vault.activeNetwork };
-            const assertCurrent = () => {
-                const current = this.getVault();
-                const currentAccount = current.accounts[selected.type]?.[selected.id];
-                if (!session ||
-                    session.isCleared() ||
-                    this.sessionPassword !== session ||
-                    current.activeAccount.id !== selected.id ||
-                    current.activeAccount.type !== selected.type ||
-                    currentAccount?.address !== identity.address ||
-                    currentAccount?.xpub !== identity.xpub ||
-                    current.activeNetwork.kind !== network.kind ||
-                    current.activeNetwork.chainId !== network.chainId ||
-                    current.activeNetwork.slip44 !== network.slip44 ||
-                    current.activeNetwork.url !== network.url) {
-                    throw new Error('Wallet signing context changed');
-                }
-            };
-            assertCurrent();
-            return assertCurrent;
-        };
-        this.getSigner = () => {
-            if (!this.sessionPassword) {
-                throw new Error('Wallet is locked cant proceed with transaction');
-            }
-            if (this.getActiveChain() !== sysweb3_network_1.INetworkType.Syscoin) {
-                throw new Error('Switch to UTXO chain');
-            }
-            const vault = this.getVault();
-            const { activeAccount } = vault;
-            const accountId = activeAccount.id;
-            const accountType = activeAccount.type;
-            const assertCurrent = this.capturePsbtSigningContext();
-            // Determine signer type: HD or WIF single-address
-            let signerForUse;
-            if (accountType === types_1.KeyringAccountType.HDAccount) {
-                signerForUse = this.createOnDemandUTXOSigner(accountId);
-            }
-            else if (accountType === types_1.KeyringAccountType.Imported) {
-                // Decrypt stored key material
-                const decrypted = this.withSecureData((sessionPwd) => {
-                    const account = vault.accounts[types_1.KeyringAccountType.Imported][accountId];
-                    const res = crypto_js_1.default.AES.decrypt(account.xprv, sessionPwd).toString(crypto_js_1.default.enc.Utf8);
-                    if (!res)
-                        throw new Error('Failed to decrypt imported account key');
-                    return res;
-                });
-                if (this.isZprv(decrypted)) {
-                    signerForUse = this.createFreshUTXOSigner(decrypted, accountId);
-                }
-                else {
-                    // Treat as WIF single-address signer wrapper exposing sign(psbt)
-                    const network = vault.activeNetwork;
-                    const { networks } = (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency);
-                    const isTestnet = network.slip44 === 1;
-                    const bitcoinjsNetwork = isTestnet
-                        ? networks.testnet
-                        : networks.mainnet;
-                    signerForUse = {
-                        sign: async (psbt) => {
-                            return await syscoinjs.utils.signWithWIF(psbt, decrypted, bitcoinjsNetwork);
-                        },
-                    };
-                }
-            }
-            else {
-                throw new Error(`Unsupported account type for UTXO signing: ${accountType}`);
-            }
-            const scope = {
-                account: vault.accounts[accountType][accountId],
-                accountId,
-                accountType,
-                network: vault.activeNetwork,
-            };
-            if (typeof signerForUse.getRootNode === 'function') {
-                const getRootNode = signerForUse.getRootNode.bind(signerForUse);
-                const guardPath = (0, psbt_account_scope_1.createPsbtDerivationGuard)(scope);
-                signerForUse.getRootNode = () => {
-                    const root = getRootNode();
-                    const scopedRoot = Object.create(root);
-                    scopedRoot.derivePath = (path) => {
-                        guardPath(path);
-                        return root.derivePath(path);
-                    };
-                    return scopedRoot;
-                };
-            }
-            const sign = signerForUse.sign.bind(signerForUse);
-            signerForUse.sign = async (psbt) => {
-                assertCurrent();
-                (0, psbt_account_scope_1.assertPsbtAccountScope)(psbt, scope);
-                const result = await sign(psbt);
-                assertCurrent();
-                return result;
-            };
-            // Create syscoinjs instance with current network (no need to attach signer for signing flow)
-            const network = vault.activeNetwork;
-            const networkConfig = (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency);
-            const isTestnet = network.slip44 === 1;
-            const bitcoinjsNetwork = isTestnet
-                ? networkConfig?.networks?.testnet
-                : networkConfig?.networks?.mainnet;
-            const syscoinMainSigner = new syscoinjs.SyscoinJSLib(null, network.url, bitcoinjsNetwork);
-            return {
-                hd: signerForUse,
-                main: syscoinMainSigner,
-            };
-        };
-        // Read-only version that works when wallet is locked
-        this.getReadOnlySigner = () => {
-            if (this.getActiveChain() !== sysweb3_network_1.INetworkType.Syscoin) {
-                throw new Error('Switch to UTXO chain');
-            }
-            // Create syscoinjs instance without HD signer for read-only operations
-            const vault = this.getVault();
-            const network = vault.activeNetwork;
-            const networkConfig = (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency);
-            const isTestnet = network.slip44 === 1;
-            const bitcoinjsNetwork = isTestnet
-                ? networkConfig?.networks?.testnet
-                : networkConfig?.networks?.mainnet;
-            const syscoinMainSigner = new syscoinjs.SyscoinJSLib(null, // No HD signer needed for read-only operations
-            network.url, bitcoinjsNetwork);
-            return {
-                main: syscoinMainSigner,
-            };
-        };
-        this.getAccountsState = () => {
-            const vault = this.getVault();
-            const { accounts, activeAccount, activeNetwork } = vault;
-            return {
-                activeAccountId: activeAccount.id,
-                accounts,
-                activeAccountType: activeAccount.type,
-                activeNetwork,
-            };
-        };
-        /**
-         *
-         * @param password
-         * @param salt
-         * @returns derived key: hex string
-         */
-        this.encryptSHA512 = (password, salt) => {
-            // Session/encryption key derivation (used to encrypt/decrypt xprv in-memory and persisted state).
-            // PBKDF2 with SHA-512, 20,000 iterations (prod default), 256-bit output.
-            // NOTE: Tests override iterations to keep CI fast.
-            const isTestEnv = typeof process !== 'undefined' && process?.env?.NODE_ENV === 'test';
-            const iterations = Number.parseInt(process?.env?.SYSWEB3_PBKDF2_ENC_ITERS || '', 10) ||
-                (isTestEnv ? 1000 : 20000);
-            const key = crypto_js_1.default.PBKDF2(password, crypto_js_1.default.enc.Hex.parse(salt), {
-                keySize: 256 / 32, // 256 bits
-                iterations,
-                hasher: crypto_js_1.default.algo.SHA512,
-            });
-            return key.toString();
-        };
-        this.hasWebCrypto = () => {
-            // MV3 service worker & extension pages: globalThis.crypto.subtle exists.
-            // Jest tests mock global.crypto without subtle -> fallback to CryptoJS.
-            return !!globalThis?.crypto?.subtle;
-        };
-        this.hexToBytes = (hex) => {
-            const clean = (hex || '').trim();
-            if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length % 2 !== 0) {
-                throw new Error('Invalid hex string');
-            }
-            const out = new Uint8Array(clean.length / 2);
-            for (let i = 0; i < out.length; i++) {
-                out[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
-            }
-            return out;
-        };
-        this.bytesToHex = (bytes) => {
-            const u8 = new Uint8Array(bytes);
-            let hex = '';
-            for (let i = 0; i < u8.length; i++) {
-                hex += u8[i].toString(16).padStart(2, '0');
-            }
-            return hex;
-        };
-        this.getEncIterations = () => {
-            const isTestEnv = typeof process !== 'undefined' && process?.env?.NODE_ENV === 'test';
-            return (Number.parseInt(process?.env?.SYSWEB3_PBKDF2_ENC_ITERS || '', 10) ||
-                (isTestEnv ? 1000 : 900000));
-        };
-        this.getSysActivePrivateKey = (hd) => {
-            if (hd === null)
-                throw new Error('No HD Signer');
-            const accountIndex = hd.Signer.accountIndex;
-            // Verify the account exists now
-            if (!hd.Signer.accounts.has(accountIndex)) {
-                throw new Error(`Account at index ${accountIndex} could not be created`);
-            }
-            return hd.Signer.accounts.get(accountIndex).getAccountPrivateKey();
-        };
-        this.getInitialAccountData = ({ label, signer, sysAccount, xprv, }) => {
-            const { address, xpub } = sysAccount;
-            return {
-                id: signer.Signer.accountIndex,
-                label: label || `Account ${signer.Signer.accountIndex + 1}`,
-                xpub,
-                xprv,
-                address,
-                isTrezorWallet: false,
-                isLedgerWallet: false,
-                isImported: false,
-            };
-        };
-        this.getFormattedBackendAccount = async ({ signer, }) => {
-            // MUCH SIMPLER: Just use the signer directly - no BIP84 needed!
-            // Get address directly from the signer (always correct for current network)
-            const address = signer.createAddress(0, false, 84);
-            const xpub = signer.getAccountXpub();
-            return {
-                address,
-                xpub,
-            };
-        };
-        this.setLatestIndexesFromXPubTokens = function (tokens) {
-            let changeIndexInternal = -1, receivingIndexInternal = -1;
-            if (tokens) {
-                tokens.forEach((token) => {
-                    if (!token.transfers || !token.path) {
-                        return {
-                            changeIndex: changeIndexInternal + 1,
-                            receivingIndex: receivingIndexInternal + 1,
-                        };
-                    }
-                    const transfers = parseInt(token.transfers, 10);
-                    if (token.path && transfers > 0) {
-                        const splitPath = token.path.split('/');
-                        if (splitPath.length >= 6) {
-                            const change = parseInt(splitPath[4], 10);
-                            const index = parseInt(splitPath[5], 10);
-                            if (change === 1) {
-                                if (index > changeIndexInternal) {
-                                    changeIndexInternal = index;
-                                }
-                            }
-                            else if (index > receivingIndexInternal) {
-                                receivingIndexInternal = index;
-                            }
-                        }
-                    }
-                });
-            }
-            return {
-                changeIndex: changeIndexInternal + 1,
-                receivingIndex: receivingIndexInternal + 1,
-            };
-        };
-        this.getBasicWeb3AccountInfo = (id, label) => {
-            return {
-                id,
-                isTrezorWallet: false,
-                isLedgerWallet: false,
-                label: label ? label : `Account ${id + 1}`,
-            };
-        };
-        this.setDerivedWeb3Accounts = async (id, label) => {
-            try {
-                // For account creation, derive from mnemonic (since account doesn't exist yet)
-                const mnemonic = this.getDecryptedMnemonic();
-                const derivationPath = (0, derivation_paths_1.getAddressDerivationPath)('eth', 60, 0, false, id);
-                const derivedAccount = (0, evm_local_signer_1.deriveEvmAccountFromMnemonic)(mnemonic, derivationPath);
-                const basicAccountInfo = this.getBasicWeb3AccountInfo(id, label);
-                const createdAccount = {
-                    address: derivedAccount.address,
-                    xpub: derivedAccount.publicKey,
-                    xprv: this.withSecureData((sessionPwd) => {
-                        return crypto_js_1.default.AES.encrypt(derivedAccount.privateKey, sessionPwd).toString();
-                    }),
-                    isImported: false,
-                    ...basicAccountInfo,
-                    balances: { syscoin: 0, ethereum: 0 },
-                };
-                // NOTE: Account creation should be dispatched to Redux store, not stored here
-                // Return the account data for Pali to add to store
-                return createdAccount;
-            }
-            catch (error) {
-                console.log('ERROR setDerivedWeb3Accounts', {
-                    error,
-                });
-                this.validateAndHandleErrorByMessage(error.message);
-                throw error;
-            }
-        };
-        this.setSignerEVM = async (network) => {
-            const abortController = new AbortController();
-            try {
-                // With multi-keyring architecture, this is only called on EVM keyrings
-                this.ethereumTransaction.setWeb3Provider(network);
-                abortController.abort();
-            }
-            catch (error) {
-                abortController.abort();
-                throw new Error(`SetSignerEVM: Failed with ${error}`);
-            }
-        };
-        this.clearTemporaryLocalKeys = async () => {
-            // Clear the vault completely.
-            // For v4, the vault is encrypted with a derived key, so the safest wipe is to delete the stored blob.
-            await this.storage.deleteItem('vault');
-            // Remove vault-keys from storage so no vault exists at all
-            await this.storage.deleteItem('vault-keys');
-            console.log('[KeyringManager] Temporary local keys cleared');
-            this.logout();
-        };
-        // NEW: Separate session initialization from account creation
-        this.initializeSession = async (seedPhrase, password) => {
-            // Validate inputs first
-            if (!BIP84.validateMnemonic(seedPhrase)) {
-                throw new Error('Invalid Seed');
-            }
-            const [vault, vaultKeys] = await Promise.all([
-                this.storage.get('vault'),
-                this.storage.get('vault-keys'),
-            ]);
-            const hasVault = vault !== undefined && vault !== null;
-            const hasVaultKeys = vaultKeys !== undefined && vaultKeys !== null;
-            const livePassword = this.sessionPassword;
-            const liveMnemonic = this.sessionMnemonic;
-            // Only an already-unlocked, matching session may repeat initialization.
-            // Restoring any existing wallet must use unlock(), never rewrite its vault.
-            if (livePassword &&
-                liveMnemonic &&
-                !livePassword.isCleared() &&
-                !liveMnemonic.isCleared()) {
-                if (!hasVault || !hasVaultKeys || !vaultKeys.salt) {
-                    throw new Error('Cannot initialize a new vault over existing wallet storage');
-                }
-                const sessionPasswordSaltedHash = await this.deriveStoredSessionKey(password, vaultKeys);
-                if (livePassword === this.sessionPassword &&
-                    liveMnemonic === this.sessionMnemonic &&
-                    sessionPasswordSaltedHash === this.getSessionPasswordString()) {
-                    // Same password - check if it's the same mnemonic to ensure full idempotency
-                    let currentMnemonic;
-                    try {
-                        currentMnemonic = this.withSecureData((sessionPwd, sessionMnemonic) => {
-                            return crypto_js_1.default.AES.decrypt(sessionMnemonic, sessionPwd).toString(crypto_js_1.default.enc.Utf8);
-                        });
-                    }
-                    catch (error) {
-                        // If we can't decrypt, fall through to error
-                    }
-                    if (currentMnemonic === seedPhrase) {
-                        const storedVault = await (0, storage_1.getDecryptedVault)(sessionPasswordSaltedHash);
-                        if (livePassword === this.sessionPassword &&
-                            liveMnemonic === this.sessionMnemonic &&
-                            !livePassword.isCleared() &&
-                            !liveMnemonic.isCleared() &&
-                            storedVault?.mnemonic === seedPhrase) {
-                            // This is a read-only identity check, not a second vault write.
-                            return;
-                        }
-                    }
-                }
-                // Different password or mnemonic - this is not a simple re-initialization
-                throw new Error('Wallet already initialized with different parameters. Unlock the existing wallet or explicitly remove it before starting setup.');
-            }
-            if (hasVault || hasVaultKeys) {
-                throw new Error('Cannot initialize a new vault over existing wallet storage');
-            }
-            const salt = crypto_1.default.randomBytes(16).toString('hex');
-            // v4 stores only the salt on disk. A genuinely fresh initialization always
-            // commits its own salt and ciphertext together under the vault mutex.
-            const sessionPasswordSaltedHash = await this.deriveStoredSessionKey(password, { salt });
-            // Encrypt and store vault (mnemonic storage) - now uses single vault for all networks
-            await (0, storage_1.setEncryptedVault)({
-                mnemonic: seedPhrase, // Store plain mnemonic - setEncryptedVault will encrypt the entire vault
-            }, 
-            // v4 vault is encrypted with the derived session password key (PBKDF2 output)
-            sessionPasswordSaltedHash, { salt });
-            await this.recreateSessionFromVault(sessionPasswordSaltedHash);
-        };
-        // NEW: Create first account without signer setup
-        this.createFirstAccount = async (label) => {
-            if (!this.sessionPassword || !this.sessionMnemonic) {
-                throw new Error('Session must be initialized first. Call initializeSession.');
-            }
-            const vault = this.getVault();
-            const network = vault.activeNetwork;
-            if (network.kind === sysweb3_network_1.INetworkType.Syscoin) {
-                // UTXO accounts get network-aware labels since each network has separate keyrings
-                const defaultLabel = label || this.generateNetworkAwareLabel(0, network);
-                // Create UTXO account using on-demand signer
-                const freshHDSigner = this.createOnDemandUTXOSigner(0);
-                const sysAccount = await this.getFormattedBackendAccount({
-                    signer: freshHDSigner,
-                });
-                const encryptedXprv = this.getEncryptedXprv(freshHDSigner);
-                return {
-                    ...this.getInitialAccountData({
-                        label: defaultLabel,
-                        signer: freshHDSigner,
-                        sysAccount,
-                        xprv: encryptedXprv,
-                    }),
-                    balances: { syscoin: 0, ethereum: 0 },
-                };
-            }
-            else {
-                // EVM accounts get generic labels since they work across all EVM networks
-                const defaultLabel = label || 'Account 1';
-                return await this.setDerivedWeb3Accounts(0, defaultLabel);
-            }
-        };
-        this.initializeWalletSecurely = async (seedPhrase, password) => {
-            // Use new separated approach
-            await this.initializeSession(seedPhrase, password);
-            return await this.createFirstAccount();
-        };
-        this.storage = sysweb3.sysweb3Di.getStateStorageDb();
-        // Don't initialize secure buffers in constructor - they're created on unlock
-        this.writeUtf8Diagnostic(false);
-        // NOTE: activeChain is now derived from vault state, not stored locally
-        // NOTE: No more persistent signers - use getSigner() for fresh on-demand signers
-        this.utf8Error = false;
-        // sessionMnemonic is initialized as null - created on unlock
-        this.initialTrezorAccountState = initial_state_1.initialActiveTrezorAccountState;
-        this.initialLedgerAccountState = initial_state_1.initialActiveLedgerAccountState;
-        // Use provided shared manager or get singleton instance
+        const storage = sysweb3.sysweb3Di.getStateStorageDb();
         const hardwareManager = sharedHardwareWalletManager ||
             hardware_wallet_manager_singleton_1.HardwareWalletManagerSingleton.getInstance();
-        this.trezorSigner = new trezor_1.TrezorKeyring();
-        this.ledgerSigner = new ledger_1.LedgerKeyring(hardwareManager);
-        // this.syscoinTransaction = SyscoinTransactions();
-        this.syscoinTransaction = new transactions_1.SyscoinTransactions(this.getSigner, this.getReadOnlySigner, this.getAccountsState, this.getAddress, this.ledgerSigner, this.trezorSigner, this.capturePsbtSigningContext);
-        this.ethereumTransaction = new transactions_1.EthereumTransactions(this.getNetwork, this.getDecryptedPrivateKey, this.getAccountsState, this.ledgerSigner, this.trezorSigner, this.capturePsbtSigningContext);
-    }
-    // Static factory method for creating a fully initialized KeyringManager with slip44 support
-    static async createInitialized(seed, password, vaultStateGetter) {
-        const keyringManager = new KeyringManager();
-        // Set the vault state getter
-        keyringManager.setVaultStateGetter(vaultStateGetter);
-        // Use the new secure initialization method (eliminates temporary plaintext storage)
-        await keyringManager.initializeWalletSecurely(seed, password);
-        // NOTE: Active account management is now handled by vault state/Redux
-        // No need to explicitly set active account - it's managed externally
-        return keyringManager;
-    }
-    // Convenience method for complete setup after construction
-    async initialize(seed, password, network) {
-        // Set the network if provided (this is crucial for proper address derivation)
-        if (network) {
-            await this.setSignerNetwork(network);
-        }
-        // Use the new secure initialization method (eliminates temporary plaintext storage)
-        const account = await this.initializeWalletSecurely(seed, password);
-        // NOTE: Active account management is now handled by vault state/Redux
-        // No need to explicitly set active account - it's managed externally
-        return account;
-    }
-    /**
-     * Returns canLogin:false only when the first vault authentication fails.
-     * Storage, platform and session restoration failures reject so callers do
-     * not charge a failed password attempt for an operational error.
-     */
-    async unlock(password) {
-        let authenticated = false;
-        try {
-            const vaultKeys = await this.storage.get('vault-keys');
-            if (!vaultKeys) {
-                throw new Error('Vault keys not found. Reload the wallet and try again.');
-            }
-            // v4: Validate password by deriving the session key once and decrypting the vault with it.
-            // This avoids an extra KDF pass just for a stored verifier.
-            const { salt } = vaultKeys;
-            // Derive session encryption key (in-memory only) used to encrypt/decrypt xprv fields
-            // IMPORTANT: This MUST NOT be the same value as the stored verifier above.
-            let sessionPasswordKey = await this.deriveStoredSessionKey(password, vaultKeys);
-            // Handle migration from old vault format with currentSessionSalt
-            if (vaultKeys.currentSessionSalt) {
-                console.log('[KeyringManager] Detected old vault format, handling session migration...');
-                // The old format used currentSessionSalt for session data encryption
-                // We need to use it temporarily to decrypt the mnemonic correctly
-                const oldSessionPassword = this.encryptSHA512(password, vaultKeys.currentSessionSalt);
-                // v3 CBC vaults use the raw password; migrated GCM vaults use the
-                // derived key. Selecting by stored format also permits a safe retry
-                // if the vault write succeeded but the metadata write was interrupted.
-                const { mnemonic } = await (0, storage_1.getDecryptedVault)(sessionPasswordKey, password);
-                authenticated = true;
-                const isValidSecret = (value) => {
-                    if (typeof value !== 'string' || !value)
-                        return false;
-                    if (this.isSeedValid(value))
-                        return true;
-                    // Imported extended private keys can also be stored as the secret.
-                    if (!/^(xprv|yprv|zprv|tprv|uprv|vprv)/.test(value))
-                        return false;
-                    try {
-                        const decoded = bs58check_1.default.decode(value);
-                        return (decoded.length === 78 &&
-                            decoded[45] === 0 &&
-                            secp256k1_1.default.isPrivate(decoded.subarray(46)));
-                    }
-                    catch {
-                        return false;
-                    }
-                };
-                let decryptedMnemonic = mnemonic;
-                if (!isValidSecret(decryptedMnemonic) && typeof mnemonic === 'string') {
-                    for (const legacyKey of [password, oldSessionPassword]) {
-                        try {
-                            const candidate = crypto_js_1.default.AES.decrypt(mnemonic, legacyKey).toString(crypto_js_1.default.enc.Utf8);
-                            if (isValidSecret(candidate)) {
-                                decryptedMnemonic = candidate;
-                                break;
-                            }
-                        }
-                        catch (error) {
-                            if (error?.message !== 'Malformed UTF-8 data')
-                                throw error;
-                        }
-                    }
-                }
-                if (!isValidSecret(decryptedMnemonic)) {
-                    throw new Error('Legacy vault secret could not be recovered. Existing vault preserved.');
-                }
-                // Do not change either stored record until a valid secret is recovered.
-                await (0, storage_1.setEncryptedVault)({ mnemonic: decryptedMnemonic }, sessionPasswordKey);
-                console.log('[KeyringManager] Vault mnemonic format normalized');
-                // Remove currentSessionSalt from vault-keys (v4 keeps only the salt on disk)
-                const migratedVaultKeys = {
-                    salt: vaultKeys.salt,
-                };
-                await this.storage.set('vault-keys', migratedVaultKeys);
-                console.log('[KeyringManager] Old vault format migration completed');
-            }
-            // v4 vault is encrypted with the derived session password key (PBKDF2 output).
-            // If the password is wrong, this will throw and we return canLogin:false below.
-            let decryptedVault;
-            let legacyProfile = vaultKeys.keyDerivation === LEGACY_ENCRYPTION_KDF;
-            try {
-                decryptedVault = await (0, storage_1.getDecryptedVault)(sessionPasswordKey);
-            }
-            catch (error) {
-                // Only the historical CBC fallback used the 20k key without metadata.
-                // Never try it for GCM, malformed records, or platform/storage failures.
-                const rawVault = error instanceof storage_1.VaultAuthenticationError &&
-                    !vaultKeys.keyDerivation &&
-                    !vaultKeys.currentSessionSalt
-                    ? await this.storage.get('vault')
-                    : undefined;
-                if (typeof rawVault !== 'string' || rawVault.trim().startsWith('{')) {
-                    throw error;
-                }
-                const legacyKey = await this.deriveLegacySessionKey(password, salt);
-                decryptedVault = await (0, storage_1.getDecryptedVault)(legacyKey);
-                authenticated = true;
-                sessionPasswordKey = legacyKey;
-                // Keep the historical account wrapping key. Persist its profile before
-                // GCM rewrapping so either interrupted write remains recoverable.
-                await this.storage.set('vault-keys', {
-                    ...vaultKeys,
-                    keyDerivation: LEGACY_ENCRYPTION_KDF,
-                });
-                legacyProfile = true;
-            }
-            authenticated = true;
-            if (legacyProfile && this.hasWebCrypto()) {
-                const storedVault = await this.storage.get('vault');
-                if (typeof storedVault === 'string' &&
-                    !storedVault.trim().startsWith('{')) {
-                    // A failed earlier rewrap can leave the authenticated profile plus
-                    // CBC. Retry that write without changing the account wrapping key.
-                    await (0, storage_1.setEncryptedVault)(decryptedVault, sessionPasswordKey);
-                }
-            }
-            // If session data missing or corrupted, recreate from vault
-            if (!this.sessionMnemonic) {
-                await this.recreateSessionFromVault(sessionPasswordKey);
-            }
-            // Re-initialize syscoin transaction handler if it was cleared on lock.
-            // `lockWallet()` intentionally replaces it with a plain object to drop signer references,
-            // so we must restore the real class instance on unlock.
-            if (!this.syscoinTransaction ||
-                typeof this.syscoinTransaction.getRecommendedFee !== 'function') {
-                this.syscoinTransaction = new transactions_1.SyscoinTransactions(this.getSigner, this.getReadOnlySigner, this.getAccountsState, this.getAddress, this.ledgerSigner, this.trezorSigner, this.capturePsbtSigningContext);
-            }
-            // NOTE: Active account management is now handled by vault state/Redux
-            // No need to explicitly set active account after unlock - it's managed externally
-            const vault = this.getVault();
-            if (vault.activeAccount?.id !== undefined && vault.activeAccount?.type) {
-                // Check if the active account actually exists in the accounts map
-                const accountType = vault.activeAccount.type;
-                const accountId = vault.activeAccount.id;
-                const accountExists = vault.accounts?.[accountType]?.[accountId];
-                if (!accountExists) {
-                    console.log(`[KeyringManager] Active account ${accountType}:${accountId} not found in accounts map. This may indicate a migration from old vault format.`);
-                    // Signal that accounts need to be created after migration
-                    return {
-                        canLogin: true,
-                        needsAccountCreation: true,
-                    };
-                }
-                console.log(`[KeyringManager] Active account ${vault.activeAccount.id} available after unlock`);
-            }
-            return {
-                canLogin: true,
-            };
-        }
-        catch (error) {
-            if (!authenticated && error instanceof storage_1.VaultAuthenticationError) {
-                return { canLogin: false };
-            }
-            if (authenticated) {
-                // lockWallet clears secret buffers synchronously; hardware cleanup
-                // is best effort and must not hide the original operational error.
-                void this.lockWallet().catch(() => undefined);
-            }
-            throw error;
-        }
-    }
-    isWatchOnlyAccount(a) {
-        if (a.isLedgerWallet || a.isTrezorWallet)
-            return false;
-        if (!a.xprv || a.xprv === '') {
-            if (a.xpub === a.address)
-                return true; // single-address imported
-            if (this.isXpubLike(a.xpub) || this.isDescriptor(a.xpub))
-                return true; // xpub/descriptor watch-only
-        }
-        return false;
-    }
-    privateRecordSession() {
-        const password = this.sessionPassword;
-        const mnemonic = this.sessionMnemonic;
-        const revision = this.privateRecordSessionRevision;
-        const assertCurrent = () => {
-            if (!password ||
-                !mnemonic ||
-                password.isCleared() ||
-                mnemonic.isCleared() ||
-                this.sessionPassword !== password ||
-                this.sessionMnemonic !== mnemonic ||
-                this.privateRecordSessionRevision !== revision) {
-                throw new Error('Private record session changed');
-            }
-        };
-        assertCurrent();
-        const root = this.getDecryptedMnemonic().normalize('NFKD');
-        if (!root || root.length > 4096)
-            throw new Error('Invalid private record root');
-        return { secret: new TextEncoder().encode(root), assertCurrent };
-    }
-    /** Stable local profile identifier; never an account address or a key. */
-    async getPrivateRecordProfileId() {
-        const session = this.privateRecordSession();
-        try {
-            const profile = await (0, private_records_1.privateRecordProfileId)(session.secret, session.assertCurrent);
-            session.assertCurrent();
-            return profile;
-        }
-        finally {
-            session.secret.fill(0);
-        }
-    }
-    /** Encrypt caller-owned bytes; persistence and encrypted backup belong to the caller. */
-    async encryptPrivateRecord(params) {
-        const session = this.privateRecordSession();
-        try {
-            const envelope = await (0, private_records_1.encryptPrivateRecordBytes)(session.secret, params, session.assertCurrent);
-            session.assertCurrent();
-            return envelope;
-        }
-        finally {
-            session.secret.fill(0);
-        }
-    }
-    async decryptPrivateRecord(params) {
-        const session = this.privateRecordSession();
-        let plaintext;
-        try {
-            plaintext = await (0, private_records_1.decryptPrivateRecordBytes)(session.secret, params, session.assertCurrent);
-            session.assertCurrent();
-            return plaintext;
-        }
-        catch (error) {
-            plaintext?.fill(0);
-            throw error;
-        }
-        finally {
-            session.secret.fill(0);
-        }
-    }
-    async importTrezorAccount(label) {
-        const vault = this.getVault();
-        const currency = vault.activeNetwork.currency;
-        if (!currency) {
-            throw new Error('Active network currency is not defined');
-        }
-        // Use getNextAccountId to filter out placeholder accounts
-        const nextIndex = this.getNextAccountId(vault.accounts[types_1.KeyringAccountType.Trezor]);
-        const importedAccount = await this._createTrezorAccount(currency, vault.activeNetwork.slip44, nextIndex);
-        importedAccount.label = label ? label : `Trezor ${importedAccount.id + 1}`;
-        // NOTE: Account creation should be dispatched to Redux store, not updated here
-        // The calling code should handle the Redux dispatch
-        // Return the created account for Pali to add to store
-        return importedAccount;
-    }
-    async importLedgerAccount(label) {
-        try {
-            const vault = this.getVault();
-            const currency = vault.activeNetwork.currency;
-            if (!currency) {
-                throw new Error('Active network currency is not defined');
-            }
-            // Use getNextAccountId to filter out placeholder accounts
-            const nextIndex = this.getNextAccountId(vault.accounts[types_1.KeyringAccountType.Ledger]);
-            const importedAccount = await this._createLedgerAccount(currency, vault.activeNetwork.slip44, nextIndex);
-            importedAccount.label = label
-                ? label
-                : `Ledger ${importedAccount.id + 1}`;
-            // NOTE: Account creation should be dispatched to Redux store, not updated here
-            // The calling code should handle the Redux dispatch
-            // Return the created account for Pali to add to store
-            return importedAccount;
-        }
-        catch (error) {
-            console.log({ error });
-            throw error;
-        }
-    }
-    async importAccount(privKey, label, options) {
-        // Check if wallet is unlocked
-        if (!this.isUnlocked()) {
-            throw new Error('Wallet must be unlocked to import accounts');
-        }
-        const importedAccount = await this._getPrivateKeyAccountInfos(privKey, label, options);
-        // NOTE: Account creation should be dispatched to Redux store, not updated here
-        // The calling code should handle the Redux dispatch
-        // Return the created account for Pali to add to store
-        return importedAccount;
-    }
-    // Import a WIF on UTXO networks and force legacy P2PKH address/type.
-    // Keeps it as a single-address Imported account, storing the address in both xpub and address.
-    async importWatchOnly(identifier, label) {
-        // Validate via Blockbook and create a watch-only Imported account
-        const vault = this.getVault();
-        const { accounts, activeNetwork } = vault;
-        if (!identifier || typeof identifier !== 'string') {
-            throw new Error('Identifier is required');
-        }
-        const isXpub = this.isXpubLike(identifier);
-        const isDesc = this.isDescriptor(identifier);
-        const isAddress = !isXpub && !isDesc;
-        // Compute address field
-        let addressToStore = identifier;
-        if (isDesc) {
-            // Keep the descriptor as the history reference, never as a recipient.
-            // Backend-provided address metadata must not select the deposit address.
-            addressToStore = (0, watch_descriptor_1.deriveDescriptorAddress)(identifier, activeNetwork);
-        }
-        else if (isXpub) {
-            // Minimal approach: treat any extended pubkey as BIP84 by converting to zpub/vpub
-            const { types } = (0, sysweb3_network_1.getNetworkConfig)(activeNetwork.slip44, activeNetwork.currency || 'Syscoin');
-            const target = activeNetwork.slip44 === 1
-                ? types.zPubType.testnet.vpub
-                : types.zPubType.mainnet.zpub;
-            const bip84Key = (0, derivation_paths_1.convertExtendedKeyVersion)(identifier, target);
-            addressToStore = await this.getAddress(bip84Key, false, {
-                forceIndex0: true,
-            });
-        }
-        // Validate duplicates across all account buckets, including passkey smart accounts.
-        if (this.accountAddressExists(accounts, addressToStore) ||
-            ((isXpub || isDesc) &&
-                Object.values(accounts || {}).some((bucket) => Object.values(bucket || {}).some((account) => account?.xpub === identifier)))) {
-            throw new Error('Account already exists on your Wallet.');
-        }
-        // Confirm with Blockbook
-        const options = 'details=basic';
-        // Validate against Blockbook directly to capture precise error details (e.g., checksum mismatch)
-        const baseUrl = activeNetwork.url.replace(/\/$/, '');
-        const path = isXpub || isDesc ? '/api/v2/xpub/' : '/api/v2/address/';
-        const url = `${baseUrl}${path}${encodeURIComponent(identifier)}?${options}`;
-        let res = null;
-        try {
-            const response = await fetch(url);
-            if (!response.ok) {
-                let errorText = response.statusText || 'Request failed';
-                try {
-                    const bodyText = await response.text();
-                    if (bodyText) {
-                        try {
-                            const json = JSON.parse(bodyText);
-                            if (json && json.error) {
-                                errorText = json.error;
-                            }
-                            else {
-                                errorText = bodyText;
-                            }
-                        }
-                        catch {
-                            errorText = bodyText;
-                        }
-                    }
-                }
-                catch (parseError) {
-                    // ignore body parse error; fall back to statusText
-                }
-                throw new Error(errorText);
-            }
-            res = await response.json();
-        }
-        catch (e) {
-            throw new Error(e?.message || 'Identifier validation failed');
-        }
-        if (!res) {
-            throw new Error('Identifier not found on the active network');
-        }
-        const id = this.getNextAccountId(accounts[types_1.KeyringAccountType.Imported]);
-        const defaultLabel = label || `Watch-only ${id + 1}`;
-        const balances = { syscoin: 0, ethereum: 0 };
-        const watchOnlyAccount = {
-            ...initial_state_1.initialActiveImportedAccountState,
-            address: addressToStore,
-            label: defaultLabel,
-            id,
-            balances,
-            isImported: true,
-            xprv: '',
-            xpub: isAddress ? addressToStore : identifier,
-            assets: {
-                syscoin: [],
-                ethereum: [],
+        const trezorSigner = new trezor_1.TrezorKeyring();
+        const ledgerSigner = new ledger_1.LedgerKeyring(hardwareManager);
+        super({
+            authority: legacyAuthority,
+            storage,
+            vaultPersistence: legacyVaultPersistence,
+            ledgerSigner,
+            trezorSigner,
+            syscoinHardwareSigners: {
+                ledger: (0, hardware_psbt_1.createLedgerPsbtSigner)(ledgerSigner),
+                trezor: (0, hardware_psbt_1.createTrezorPsbtSigner)(trezorSigner),
             },
-        };
-        return watchOnlyAccount;
-    }
-    validateZprv(zprv, targetNetwork) {
-        // Use the active network if targetNetwork is not provided
-        const networkToValidateAgainst = targetNetwork || this.getVault().activeNetwork;
-        if (!networkToValidateAgainst) {
-            throw new Error('No network available for validation');
-        }
-        try {
-            // Check if it looks like an extended key based on known prefixes
-            const knownExtendedKeyPrefixes = [
-                'xprv',
-                'xpub',
-                'yprv',
-                'ypub',
-                'zprv',
-                'zpub',
-                'tprv',
-                'tpub',
-                'uprv',
-                'upub',
-                'vprv',
-                'vpub',
-            ];
-            const prefix = zprv.substring(0, 4);
-            const looksLikeExtendedKey = knownExtendedKeyPrefixes.includes(prefix);
-            // Only check prefix validity if it looks like an extended key
-            if (looksLikeExtendedKey) {
-                const validBip84Prefixes = ['zprv', 'vprv']; // zprv for mainnet, vprv for testnet
-                if (!validBip84Prefixes.includes(prefix)) {
-                    throw new Error(`Invalid key prefix '${prefix}'. Only BIP84 keys (zprv/vprv) are supported for UTXO imports. BIP44 keys (xprv/tprv) are not supported.`);
-                }
-            }
-            else {
-                // Not an extended key format
-                throw new Error('Not an extended private key');
-            }
-            const bip32 = (0, bip32_1.BIP32Factory)(secp256k1_1.default);
-            const decoded = bs58check_1.default.decode(zprv);
-            if (decoded.length !== 78) {
-                throw new Error('Invalid length for a BIP-32 key');
-            }
-            // Get network configuration for the target network
-            const { networks, types } = (0, sysweb3_network_1.getNetworkConfig)(networkToValidateAgainst.slip44, networkToValidateAgainst.currency || 'Bitcoin');
-            // For BIP84 (zprv/zpub), we need to use the correct magic bytes from zPubType
-            // Determine key type: zprv = mainnet key, vprv = testnet key
-            const keyIsTestnet = prefix === 'vprv';
-            // Determine target network type: testnet networks typically have slip44 1
-            const targetIsTestnet = networkToValidateAgainst.slip44 === 1;
-            // Cross-network validation: reject if key type doesn't match target network
-            if (keyIsTestnet && !targetIsTestnet) {
-                throw new Error(`Extended private key is not compatible with ${networkToValidateAgainst.label}. ` +
-                    `This appears to be a testnet key (${prefix}) but the target network is mainnet.`);
-            }
-            if (!keyIsTestnet && targetIsTestnet) {
-                throw new Error(`Extended private key is not compatible with ${networkToValidateAgainst.label}. ` +
-                    `This appears to be a mainnet key (${prefix}) but the target network is testnet.`);
-            }
-            const pubTypes = keyIsTestnet
-                ? types.zPubType.testnet
-                : types.zPubType.mainnet;
-            const baseNetwork = keyIsTestnet ? networks.testnet : networks.mainnet;
-            const network = {
-                ...baseNetwork,
-                bip32: {
-                    public: parseInt(pubTypes.vpub || pubTypes.zpub, 16),
-                    private: parseInt(pubTypes.vprv || pubTypes.zprv, 16),
-                },
-            };
-            // Validate that the key prefix matches the expected network format
-            // This ensures the key was generated for a compatible network
-            const expectedPrefixes = ['zprv', 'vprv', 'xprv', 'yprv']; // Accept various BIP32/84 formats
-            if (!expectedPrefixes.includes(prefix)) {
-                throw new Error(`Invalid extended private key prefix: ${prefix}. Expected one of: ${expectedPrefixes.join(', ')}`);
-            }
-            // Strict network matching - only allow keys that match the target network
-            let node;
-            try {
-                node = bip32.fromBase58(zprv, network);
-            }
-            catch (e) {
-                throw new Error(`Extended private key is not compatible with ${networkToValidateAgainst.label}. Please use a key generated for this specific network.`);
-            }
-            if (!node.privateKey) {
-                throw new Error('Private key not found in extended private key');
-            }
-            if (!secp256k1_1.default.isPrivate(node.privateKey)) {
-                throw new Error('Invalid private key for secp256k1 curve');
-            }
-            return {
-                isValid: true,
-                node,
-                network,
-                message: 'The extended private key is valid for this network.',
-            };
-        }
-        catch (error) {
-            return { isValid: false, message: error.message };
-        }
-    }
-    validateWif(wif, targetNetwork) {
-        // Use the active network if targetNetwork is not provided
-        const networkToValidateAgainst = targetNetwork || this.getVault().activeNetwork;
-        if (!networkToValidateAgainst) {
-            throw new Error('No network available for validation');
-        }
-        try {
-            // Get bitcoinjs network for the target network (Syscoin/BTC etc.)
-            const { networks } = (0, sysweb3_network_1.getNetworkConfig)(networkToValidateAgainst.slip44, networkToValidateAgainst.currency || 'Bitcoin');
-            const isTestnet = networkToValidateAgainst.slip44 === 1;
-            const bitcoinNetwork = isTestnet ? networks.testnet : networks.mainnet;
-            // Try to parse the WIF for the given network
-            const keyPair = syscoinjs.utils.bitcoinjs.ECPair.fromWIF(wif, bitcoinNetwork);
-            if (!keyPair || !keyPair.privateKey)
-                throw new Error('Invalid WIF private key');
-            // Derive an address based on network capability
-            // Try different address types to ensure the key can derive addresses
-            let address;
-            try {
-                // Try P2TR (Taproot) first if bech32 is supported
-                if (bitcoinNetwork.bech32) {
-                    try {
-                        address = bjs.payments.p2wpkh({
-                            pubkey: keyPair.publicKey,
-                            network: bitcoinNetwork,
-                        }).address;
-                    }
-                    catch (e) {
-                        // P2TR might not be supported, try P2WPKH
-                    }
-                }
-                if (!address) {
-                    address = bjs.payments.p2pkh({
-                        pubkey: keyPair.publicKey,
-                        network: bitcoinNetwork,
-                    }).address;
-                }
-            }
-            catch (e) {
-                // ignore and handle below
-            }
-            if (!address)
-                throw new Error('Failed to derive address from WIF');
-            return { isValid: true };
-        }
-        catch (error) {
-            return { isValid: false, message: error.message };
-        }
-    }
-    writeUtf8Diagnostic(hasUtf8Error) {
-        try {
-            void Promise.resolve(this.storage.set('utf8Error', { hasUtf8Error })).catch(() => undefined);
-        }
-        catch {
-            // This diagnostic must not interrupt authentication or become an
-            // unhandled rejection when an asynchronous storage client is offline.
-        }
-    }
-    validateAndHandleErrorByMessage(message) {
-        const utf8ErrorMessage = 'Malformed UTF-8 data';
-        if (message.includes(utf8ErrorMessage) ||
-            message.toLowerCase().includes(utf8ErrorMessage.toLowerCase())) {
-            this.writeUtf8Diagnostic(true);
-        }
-    }
-    async pbkdf2WebCryptoHex(params) {
-        const subtle = globalThis.crypto.subtle;
-        const enc = new TextEncoder();
-        const passBytes = enc.encode(params.password);
-        const saltBytes = this.hexToBytes(params.saltHex);
-        const keyMaterial = await subtle.importKey('raw', passBytes, { name: 'PBKDF2' }, false, ['deriveBits']);
-        const bits = await subtle.deriveBits({
-            name: 'PBKDF2',
-            salt: saltBytes,
-            iterations: params.iterations,
-            hash: params.hash,
-        }, keyMaterial, params.lengthBytes * 8);
-        return this.bytesToHex(bits);
-    }
-    async encryptSHA512Async(password, salt) {
-        if (this.hasWebCrypto()) {
-            // Match CryptoJS PBKDF2 output format: hex string
-            return await this.pbkdf2WebCryptoHex({
-                password,
-                saltHex: salt,
-                iterations: this.getEncIterations(),
-                lengthBytes: 32, // 256-bit
-                hash: 'SHA-512',
-            });
-        }
-        throw new Error('WebCrypto is required for vault key derivation');
-    }
-    async deriveLegacySessionKey(password, salt) {
-        if (this.hasWebCrypto()) {
-            return this.pbkdf2WebCryptoHex({
-                password,
-                saltHex: salt,
-                iterations: 20000,
-                lengthBytes: 32,
-                hash: 'SHA-512',
-            });
-        }
-        // Read compatibility only; new vault writes still require WebCrypto.
-        return crypto_js_1.default.PBKDF2(password, crypto_js_1.default.enc.Hex.parse(salt), {
-            keySize: 256 / 32,
-            iterations: 20000,
-            hasher: crypto_js_1.default.algo.SHA512,
-        }).toString();
-    }
-    async deriveStoredSessionKey(password, vaultKeys) {
-        if (vaultKeys.keyDerivation === LEGACY_ENCRYPTION_KDF) {
-            return this.deriveLegacySessionKey(password, vaultKeys.salt);
-        }
-        if (vaultKeys.keyDerivation !== undefined) {
-            throw new Error('Unsupported vault key derivation profile');
-        }
-        return this.encryptSHA512Async(password, vaultKeys.salt);
-    }
-    async _createTrezorAccount(coin, slip44, index, label) {
-        const vault = this.getVault();
-        const { accounts } = vault;
-        // For EVM networks, Trezor expects 'eth' regardless of the network's currency
-        const trezorCoin = slip44 === 60 ? 'eth' : coin;
-        const { descriptor, balance: _balance } = await this.trezorSigner.getAccountInfo({
-            coin: trezorCoin,
-            slip44,
-            index,
         });
-        const xpub = descriptor;
-        const balance = _balance;
-        let ethPubKey = '';
-        const isEVM = (0, derivation_paths_1.isEvmCoin)(coin, slip44);
-        // For EVM networks, we need to get the actual address from Trezor
-        let address;
-        if (isEVM) {
-            // For EVM, the descriptor from getAccountInfo is the address
-            address = xpub;
-            // Get the public key for EVM
-            const response = await this.trezorSigner.getPublicKey({
-                coin: trezorCoin,
-                slip44,
-                index: +index,
-            });
-            ethPubKey = response.publicKey;
-        }
-        else {
-            // For UTXO, use the xpub to derive the address
-            // Always use first receive address (index 0) for imported account display
-            address = await this.getAddress(xpub, false, { forceIndex0: true });
-        }
-        if (this.accountAddressExists(accounts, address, isEVM))
-            throw new Error('Account already exists on your Wallet.');
-        if (!xpub || !address)
-            throw new Error('Something wrong happened. Please, try again or report it');
-        // Use getNextAccountId to properly handle placeholder accounts
-        const id = this.getNextAccountId(accounts[types_1.KeyringAccountType.Trezor]);
-        // Convert balance from satoshis to SYS safely
-        // Using string manipulation to avoid precision loss
-        let syscoinBalance = 0;
-        if (!isEVM && balance) {
-            const balanceStr = balance.toString();
-            // Handle conversion without division to preserve precision
-            if (balanceStr.length > 8) {
-                // Has whole SYS part
-                const wholePart = balanceStr.slice(0, -8);
-                const decimalPart = balanceStr.slice(-8);
-                syscoinBalance = parseFloat(`${wholePart}.${decimalPart}`);
-            }
-            else {
-                // Less than 1 SYS
-                const paddedBalance = balanceStr.padStart(8, '0');
-                syscoinBalance = parseFloat(`0.${paddedBalance}`);
-            }
-        }
-        const trezorAccount = {
-            ...this.initialTrezorAccountState,
-            balances: {
-                syscoin: isEVM ? 0 : syscoinBalance,
-                ethereum: 0,
-            },
-            address,
-            label: label ? label : `Trezor ${id + 1}`,
-            id,
-            xprv: '',
-            xpub: isEVM ? ethPubKey : xpub,
-            assets: {
-                syscoin: [],
-                ethereum: [],
-            },
-        };
-        return trezorAccount;
-    }
-    async _createLedgerAccount(coin, slip44, index, label) {
-        const vault = this.getVault();
-        const { accounts } = vault;
-        let xpub;
-        let address = '';
-        if ((0, derivation_paths_1.isEvmCoin)(coin, slip44)) {
-            const { address: ethAddress, publicKey } = await this.ledgerSigner.evm.getEvmAddressAndPubKey({
-                accountIndex: index,
-            });
-            address = ethAddress;
-            xpub = publicKey;
-        }
-        else {
-            const ledgerXpub = await this.ledgerSigner.utxo.getXpub({
-                index: index,
-                coin,
-                slip44,
-            });
-            // Convert device-returned extended key to BIP84 zpub/vpub for storage/backend usage
-            const { types } = (0, sysweb3_network_1.getNetworkConfig)(slip44, coin);
-            const bip84Target = slip44 === 1
-                ? types.zPubType.testnet.vpub
-                : types.zPubType.mainnet.zpub;
-            xpub = (0, derivation_paths_1.convertExtendedKeyVersion)(ledgerXpub, bip84Target);
-            // Always use first receive address (index 0) for imported account display
-            address = await this.getAddress(xpub, false, { forceIndex0: true });
-        }
-        if (this.accountAddressExists(accounts, address, (0, derivation_paths_1.isEvmCoin)(coin, slip44)))
-            throw new Error('Account already exists on your Wallet.');
-        if (!xpub || !address)
-            throw new Error('Something wrong happened. Please, try again or report it');
-        // Use getNextAccountId to properly handle placeholder accounts
-        const id = this.getNextAccountId(accounts[types_1.KeyringAccountType.Ledger]);
-        const currentBalances = { syscoin: 0, ethereum: 0 };
-        const ledgerAccount = {
-            ...this.initialLedgerAccountState,
-            balances: currentBalances,
-            address,
-            label: label ? label : `Ledger ${id + 1}`,
-            id,
-            xprv: '',
-            xpub,
-            assets: {
-                syscoin: [],
-                ethereum: [],
-            },
-        };
-        return ledgerAccount;
-    }
-    // Common helper method for UTXO account creation
-    async createUTXOAccountAtIndex(accountId, label) {
-        try {
-            // Create fresh signer just for this account creation operation
-            const freshHDSigner = this.createOnDemandUTXOSigner(accountId);
-            const sysAccount = await this.getFormattedBackendAccount({
-                signer: freshHDSigner,
-            });
-            const encryptedXprv = this.getEncryptedXprv(freshHDSigner);
-            // Generate network-aware label if none provided
-            const vault = this.getVault();
-            const network = vault.activeNetwork;
-            const defaultLabel = this.generateNetworkAwareLabel(accountId, network);
-            return {
-                ...this.getInitialAccountData({
-                    label: label || defaultLabel,
-                    signer: freshHDSigner,
-                    sysAccount,
-                    xprv: encryptedXprv,
-                }),
-                balances: { syscoin: 0, ethereum: 0 },
-            };
-        }
-        catch (error) {
-            console.log('ERROR createUTXOAccountAtIndex', {
-                error,
-            });
-            this.validateAndHandleErrorByMessage(error.message);
-            throw error;
-        }
-    }
-    async addNewAccountToSyscoinChain(label) {
-        try {
-            // Get next available account ID
-            const vault = this.getVault();
-            const accounts = vault.accounts[types_1.KeyringAccountType.HDAccount];
-            const nextId = this.getNextAccountId(accounts);
-            return await this.createUTXOAccountAtIndex(nextId, label);
-        }
-        catch (error) {
-            console.log('ERROR addNewAccountToSyscoinChain', {
-                error,
-            });
-            this.validateAndHandleErrorByMessage(error.message);
-            throw error;
-        }
-    }
-    async addNewAccountToEth(label) {
-        try {
-            // Get next available account ID
-            const vault = this.getVault();
-            const accounts = vault.accounts[types_1.KeyringAccountType.HDAccount];
-            const nextId = this.getNextAccountId(accounts);
-            // EVM accounts should use generic labels since they work across all EVM networks
-            const defaultLabel = `Account ${nextId + 1}`;
-            const newAccount = await this.setDerivedWeb3Accounts(nextId, label || defaultLabel);
-            return newAccount;
-        }
-        catch (error) {
-            console.log('ERROR addNewAccountToEth', {
-                error,
-            });
-            this.validateAndHandleErrorByMessage(error.message);
-            throw error;
-        }
-    }
-    // Helper method to get next available account ID - fills gaps when accounts are deleted
-    getNextAccountId(accounts) {
-        const existingIds = Object.values(accounts)
-            .filter((account) => {
-            // Only count accounts that have been properly initialized
-            // Placeholder accounts have empty addresses/xprv/xpub
-            return account && account.address && account.xpub;
-        })
-            .map((account) => account.id)
-            .filter((id) => !isNaN(id))
-            .sort((a, b) => a - b); // Sort to find gaps efficiently
-        if (existingIds.length === 0) {
-            return 0;
-        }
-        // Find the first gap in the sequence
-        for (let i = 0; i < existingIds.length; i++) {
-            if (existingIds[i] !== i) {
-                // Found a gap at position i
-                return i;
-            }
-        }
-        // No gaps found, return next sequential ID
-        return existingIds.length;
-    }
-    async recreateSessionFromVault(saltedHashPassword) {
-        try {
-            // v4 vault is encrypted with the derived session password key (PBKDF2 output)
-            // `saltedHashPassword` is the derived session password key passed by caller.
-            const { mnemonic } = await (0, storage_1.getDecryptedVault)(saltedHashPassword);
-            if (!mnemonic) {
-                throw new Error('Mnemonic not found in vault');
-            }
-            // Encrypt session data with sessionPassword hash for consistency
-            // This allows keyring manager to decrypt with this.sessionPassword
-            this.privateRecordSessionRevision++;
-            this.sessionPassword = new SecureBuffer(saltedHashPassword);
-            // Encrypt the mnemonic with session password for consistency with the rest of the code
-            const encryptedMnemonic = crypto_js_1.default.AES.encrypt(mnemonic, saltedHashPassword).toString();
-            this.sessionMnemonic = new SecureBuffer(encryptedMnemonic);
-            console.log('[KeyringManager] Session data recreated from vault');
-        }
-        catch (error) {
-            console.error('ERROR recreateSessionFromVault', { error });
-            throw error;
-        }
-    }
-    async _getPrivateKeyAccountInfos(privKey, label, options) {
-        const vault = this.getVault();
-        const { accounts } = vault;
-        let importedAccountValue = null;
-        const balances = {
-            syscoin: 0,
-            ethereum: 0,
-        };
-        // Try to validate as extended private key first
-        const networkToUse = vault.activeNetwork;
-        const zprvValidation = this.validateZprv(privKey, networkToUse);
-        // Check if we're on an EVM network (slip44 = 60) or UTXO network
-        const isEvmNetwork = networkToUse.slip44 === 60;
-        if (zprvValidation.isValid) {
-            // This is a valid UTXO extended private key
-            if (isEvmNetwork) {
-                throw new Error('Cannot import UTXO private key on EVM network. Please switch to a UTXO network (Bitcoin/Syscoin) first.');
-            }
-            const { node, network } = zprvValidation;
-            if (!node || !network) {
-                throw new Error('Failed to validate extended private key');
-            }
-            // Always use index 0 for consistency
-            const nodeChild = node.derivePath(`0/0`);
-            if (!nodeChild) {
-                throw new Error('Failed to derive child node');
-            }
-            // Choose address type based on options or default to p2wpkh
-            let addrObj;
-            if (options?.utxoAddressType === 'p2pkh') {
-                addrObj = bjs.payments.p2pkh({
-                    pubkey: nodeChild.publicKey,
-                    network,
-                });
-            }
-            else if (options?.utxoAddressType === 'p2tr') {
-                // For taproot, use x-only public key (32 bytes instead of 33)
-                const xOnly = nodeChild.publicKey.length === 33
-                    ? nodeChild.publicKey.slice(1, 33)
-                    : nodeChild.publicKey;
-                addrObj = bjs.payments.p2tr({
-                    internalPubkey: xOnly,
-                    network,
-                });
-            }
-            else {
-                // Default to SegWit (p2wpkh)
-                addrObj = bjs.payments.p2wpkh({
-                    pubkey: nodeChild.publicKey,
-                    network,
-                });
-            }
-            const { address } = addrObj;
-            if (!address) {
-                throw new Error('Failed to generate address');
-            }
-            importedAccountValue = {
-                address,
-                // IMPORTANT: Store BIP84 extended *public* key (zpub/vpub), not device-style xpub/tpub.
-                // Blockbook derives different address branches depending on version bytes.
-                // Using zpub/vpub ensures UTXO discovery and `input.path` match BIP84 (m/84'/slip44'/...),
-                // which is required for HD signing.
-                publicKey: (() => {
-                    try {
-                        const { types } = (0, sysweb3_network_1.getNetworkConfig)(networkToUse.slip44, networkToUse.currency || 'Bitcoin');
-                        const target = networkToUse.slip44 === 1
-                            ? types.zPubType.testnet.vpub
-                            : types.zPubType.mainnet.zpub;
-                        return (0, derivation_paths_1.convertExtendedKeyVersion)(node.neutered().toBase58(), target);
-                    }
-                    catch (_e) {
-                        // Fall back to the default neutered key if conversion fails.
-                        return node.neutered().toBase58();
-                    }
-                })(),
-                privateKey: privKey,
-            };
-            balances.syscoin = 0;
-        }
-        else {
-            // If not a valid zprv/vprv, on UTXO networks try WIF
-            const isEvmNetwork = networkToUse.slip44 === 60;
-            let handledAsUtxo = false;
-            if (!isEvmNetwork) {
-                const wifValidation = this.validateWif(privKey, networkToUse);
-                if (wifValidation.isValid) {
-                    // Create address from WIF and treat as single-address imported account
-                    const { networks } = (0, sysweb3_network_1.getNetworkConfig)(networkToUse.slip44, networkToUse.currency || 'Bitcoin');
-                    const isTestnet = networkToUse.slip44 === 1;
-                    const bitcoinNetwork = isTestnet
-                        ? networks.testnet
-                        : networks.mainnet;
-                    const keyPair = syscoinjs.utils.bitcoinjs.ECPair.fromWIF(privKey, bitcoinNetwork);
-                    // Choose address type based on options or default behavior
-                    let addrObj;
-                    if (options?.utxoAddressType === 'p2pkh') {
-                        addrObj = bjs.payments.p2pkh({
-                            pubkey: keyPair.publicKey,
-                            network: bitcoinNetwork,
-                        });
-                    }
-                    else if (options?.utxoAddressType === 'p2tr') {
-                        // For taproot, use x-only public key (32 bytes instead of 33)
-                        const xOnly = keyPair.publicKey.length === 33
-                            ? keyPair.publicKey.slice(1, 33)
-                            : keyPair.publicKey;
-                        addrObj = bjs.payments.p2tr({
-                            internalPubkey: xOnly,
-                            network: bitcoinNetwork,
-                        });
-                    }
-                    else {
-                        // Default to SegWit (p2wpkh)
-                        addrObj = bjs.payments.p2wpkh({
-                            pubkey: keyPair.publicKey,
-                            network: bitcoinNetwork,
-                        });
-                    }
-                    const address = addrObj.address;
-                    if (!address) {
-                        throw new Error('Failed to generate address from WIF');
-                    }
-                    importedAccountValue = {
-                        address,
-                        // For single-address WIF accounts, store xpub as the address marker
-                        publicKey: address,
-                        privateKey: privKey,
-                    };
-                    // Set UTXO balance bucket
-                    balances.syscoin = 0;
-                    handledAsUtxo = true;
-                    // Proceed to account creation below
-                }
-                else if (!isEvmNetwork && wifValidation.message) {
-                    // Provide useful feedback on UTXO network if WIF was attempted and failed
-                    // Continue to EVM handling only if actually EVM network
-                }
-            }
-            // Check if the validation failed due to network mismatch
-            if (zprvValidation.message &&
-                zprvValidation.message.includes('Network mismatch')) {
-                throw new Error(zprvValidation.message);
-            }
-            // Check if the validation failed due to invalid key prefix (only for known extended key formats)
-            if (zprvValidation.message &&
-                zprvValidation.message.includes('Invalid key prefix')) {
-                throw new Error(zprvValidation.message);
-            }
-            // Check if it failed parsing as an extended key
-            if (zprvValidation.message &&
-                zprvValidation.message.includes('Failed to parse extended private key')) {
-                throw new Error(zprvValidation.message);
-            }
-            // Check if it looks like an extended key that failed validation
-            const knownExtendedKeyPrefixes = [
-                'xprv',
-                'xpub',
-                'yprv',
-                'ypub',
-                'zprv',
-                'zpub',
-                'tprv',
-                'tpub',
-                'uprv',
-                'upub',
-                'vprv',
-                'vpub',
-            ];
-            const prefix = privKey.substring(0, 4);
-            const looksLikeExtendedKey = knownExtendedKeyPrefixes.includes(prefix);
-            if (looksLikeExtendedKey) {
-                // This looks like a UTXO extended key, but it failed validation
-                // Don't try to import it as an EVM key
-                if (isEvmNetwork) {
-                    throw new Error('Cannot import UTXO private key on EVM network. Please switch to a UTXO network (Bitcoin/Syscoin) first.');
-                }
-                // For UTXO networks, throw the original validation error
-                throw new Error(zprvValidation.message || 'Invalid extended private key');
-            }
-            // If it's not an extended key and not a valid WIF, treat it as an Ethereum private key
-            // But first check if we're on an EVM network
-            if (!isEvmNetwork && !handledAsUtxo) {
-                throw new Error('Cannot import EVM private key on UTXO network. Please switch to an EVM network first.');
-            }
-            if (!handledAsUtxo) {
-                const hexPrivateKey = privKey.slice(0, 2) === '0x' ? privKey : `0x${privKey}`;
-                // Validate it's a valid hex string (32 bytes = 64 hex chars)
-                if (!/^0x[0-9a-fA-F]{64}$/.test(hexPrivateKey) &&
-                    !/^[0-9a-fA-F]{64}$/.test(privKey)) {
-                    throw new Error('Invalid private key format. Expected 32-byte hex string or extended private key.');
-                }
-                importedAccountValue =
-                    this.ethereumTransaction.importAccount(hexPrivateKey);
-                balances.ethereum = 0;
-            }
-        }
-        if (!importedAccountValue) {
-            throw new Error('Invalid private key format. Expected WIF, extended private key, or 32-byte hex.');
-        }
-        const { address, publicKey, privateKey } = importedAccountValue;
-        // Validate duplicates across all account buckets, including passkey smart accounts.
-        if (this.accountAddressExists(accounts, address, isEvmNetwork))
-            throw new Error('Account already exists, try again with another Private Key.');
-        const id = this.getNextAccountId(accounts[types_1.KeyringAccountType.Imported]);
-        const defaultLabel = label || `Imported ${id + 1}`;
-        return {
-            ...initial_state_1.initialActiveImportedAccountState,
-            address,
-            label: defaultLabel,
-            id,
-            balances,
-            isImported: true,
-            xprv: this.withSecureData((sessionPwd) => {
-                return crypto_js_1.default.AES.encrypt(privateKey, sessionPwd).toString();
-            }),
-            xpub: publicKey,
-            assets: {
-                syscoin: [],
-                ethereum: [],
-            },
-        };
     }
-    // NEW: On-demand signer creation methods
-    /**
-     * Common method to decrypt mnemonic from session
-     * Eliminates code duplication across multiple methods
-     */
-    getDecryptedMnemonic() {
-        if (!this.sessionMnemonic || !this.sessionPassword) {
-            throw new Error('Session information not available');
-        }
-        const mnemonic = this.withSecureData((sessionPwd, sessionMnemonic) => {
-            const decrypted = crypto_js_1.default.AES.decrypt(sessionMnemonic, sessionPwd).toString(crypto_js_1.default.enc.Utf8);
-            if (!decrypted) {
-                throw new Error('Failed to decrypt mnemonic');
-            }
-            return decrypted;
-        });
-        return mnemonic;
-    }
-    /**
-     * Creates network RPC config from current active network without making RPC calls
-     * Common utility for all on-demand signer creation
-     */
-    createNetworkRpcConfig() {
-        const network = this.getVault().activeNetwork;
-        return {
-            formattedNetwork: network,
-            networkConfig: (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency),
-        };
-    }
-    /**
-     * Common signer creation logic - takes decrypted mnemonic/zprv and creates fresh signer
-     * OPTIMIZED: No RPC call needed - uses network config directly
-     */
-    createFreshUTXOSigner(mnemonicOrZprv, accountId) {
-        // Create signer using network config directly (no RPC call)
-        const rpcConfig = this.createNetworkRpcConfig();
-        // Type assertion to match getSyscoinSigners expected interface
-        const { hd } = (0, signers_1.getSyscoinSigners)({
-            mnemonic: mnemonicOrZprv,
-            rpc: rpcConfig,
-        });
-        // Create account at the specified index and set it as active
-        // Note: createAccountAtIndex is synchronous despite TypeScript types
-        hd.createAccountAtIndex(accountId, 84);
-        // Verify the account was created correctly
-        if (!hd.Signer.accounts.has(accountId)) {
-            throw new Error(`Failed to create account at index ${accountId}`);
-        }
-        // Verify the correct account is active
-        if (hd.Signer.accountIndex !== accountId) {
-            throw new Error(`Account index mismatch: expected ${accountId}, got ${hd.Signer.accountIndex}`);
-        }
-        return hd;
-    }
-    /**
-     * Creates a fresh UTXO signer for HD accounts derived from the main seed
-     * OPTIMIZED: No RPC call needed - uses network config directly
-     */
-    createOnDemandUTXOSigner(accountId) {
-        // Use common method to avoid code duplication
-        const mnemonic = this.getDecryptedMnemonic();
-        return this.createFreshUTXOSigner(mnemonic, accountId);
-    }
-    // NEW: Helper methods for HD signer management
-    isZprv(key) {
-        const zprvPrefixes = ['zprv', 'tprv', 'vprv', 'xprv'];
-        return zprvPrefixes.some((prefix) => key.startsWith(prefix));
-    }
-    // Helper methods for secure buffer operations
-    getSessionPasswordString() {
-        if (!this.sessionPassword || this.sessionPassword.isCleared()) {
-            throw new Error('Session password not available');
-        }
-        // WARNING: This exposes sensitive data as a string
-        // Use only for CryptoJS operations that require string input
-        return this.sessionPassword.toString();
-    }
-    getSessionMnemonicString() {
-        if (!this.sessionMnemonic || this.sessionMnemonic.isCleared()) {
-            throw new Error('Session mnemonic not available');
-        }
-        // WARNING: This exposes sensitive data as a string
-        // Use only for CryptoJS operations that require string input
-        return this.sessionMnemonic.toString();
-    }
-    // Secure method to perform cryptographic operations without exposing strings
-    withSecureData(operation) {
-        if (!this.sessionPassword || !this.sessionMnemonic) {
-            throw new Error('Session data not available');
-        }
-        // Perform operation with minimal exposure
-        const result = operation(this.getSessionPasswordString(), this.getSessionMnemonicString());
-        // Clear any temporary variables if needed
-        return result;
-    }
-    generateNetworkAwareLabel(accountId, network) {
-        // Generate concise network-specific labels using actual network config
-        const { label, chainId, kind, currency } = network;
-        // Create a shortened network identifier based on actual network configurations
-        let networkPrefix = '';
-        if (kind === sysweb3_network_1.INetworkType.Syscoin) {
-            // UTXO networks (slip44 = 57 for mainnet, 1 for testnet)
-            if (chainId === 57) {
-                networkPrefix = 'SYS'; // Syscoin UTXO Mainnet
-            }
-            else if (chainId === 5700) {
-                networkPrefix = 'SYS-T'; // Syscoin UTXO Testnet (slip44=1)
-            }
-            else {
-                // Other UTXO networks - use currency shortcut (e.g., "btc" -> "BTC")
-                if (currency) {
-                    networkPrefix = currency.toUpperCase();
-                }
-                else {
-                    // Fallback to first word from label if no currency
-                    const firstWord = label.split(' ')[0];
-                    networkPrefix =
-                        firstWord.length > 6 ? firstWord.substring(0, 6) : firstWord;
-                }
-            }
-        }
-        else {
-            // EVM networks (all use slip44=60)
-            if (chainId === 1) {
-                networkPrefix = 'ETH'; // Ethereum Mainnet
-            }
-            else if (chainId === 11155111) {
-                networkPrefix = 'ETH-T'; // Ethereum Sepolia Testnet
-            }
-            else if (chainId === 137) {
-                networkPrefix = 'POLY'; // Polygon Mainnet
-            }
-            else if (chainId === 80001) {
-                networkPrefix = 'POLY-T'; // Polygon Mumbai Testnet
-            }
-            else if (chainId === 57) {
-                networkPrefix = 'NEVM'; // Syscoin NEVM Mainnet
-            }
-            else if (chainId === 5700) {
-                networkPrefix = 'NEVM-T'; // Syscoin NEVM Testnet
-            }
-            else if (chainId === 570) {
-                networkPrefix = 'ROLLUX'; // Rollux Mainnet
-            }
-            else if (chainId === 57000) {
-                networkPrefix = 'ROLLUX-T'; // Rollux Testnet
-            }
-            else {
-                // Other EVM networks - use currency shortcut if available
-                if (currency) {
-                    // Check if it's a testnet network
-                    if (label.toLowerCase().includes('testnet') ||
-                        label.toLowerCase().includes('test')) {
-                        networkPrefix = `${currency.toUpperCase()}-T`;
-                    }
-                    else {
-                        networkPrefix = currency.toUpperCase();
-                    }
-                }
-                else {
-                    // Fallback to extracting meaningful prefix from label
-                    const firstWord = label.split(' ')[0];
-                    if (firstWord.toLowerCase().includes('testnet') ||
-                        firstWord.toLowerCase().includes('test')) {
-                        const baseWord = label.split(' ')[0];
-                        networkPrefix = `${baseWord.substring(0, 4).toUpperCase()}-T`;
-                    }
-                    else {
-                        networkPrefix =
-                            firstWord.length > 6
-                                ? firstWord.substring(0, 6).toUpperCase()
-                                : firstWord.toUpperCase();
-                    }
-                }
-            }
-        }
-        return `${networkPrefix} ${accountId + 1}`;
-    }
-    /**
-     * Clean up all resources
-     */
-    async destroy() {
-        await this.lockWallet();
-        // Clear any remaining references
-        this.ethereumTransaction = {};
-        this.syscoinTransaction = {};
+    static async createInitialized(seed, password, vaultStateGetter) {
+        const keyring = new KeyringManager();
+        keyring.setVaultStateGetter(vaultStateGetter);
+        await keyring.initializeWalletSecurely(seed, password);
+        return keyring;
     }
 }
 exports.KeyringManager = KeyringManager;