@sidhujag/sysweb3-keyring 1.0.628 → 2.1.0

package/types/hardware-wallet-manager.d.ts

@@ -1,5 +1,5 @@
-import Transport from '@ledgerhq/hw-transport';
 import { EventEmitter } from 'events';
+import type { LedgerHost } from './ledger/host-types';
 export declare enum HardwareWalletType {
     LEDGER = "ledger",
     TREZOR = "trezor"
@@ -31,25 +31,22 @@ export interface HardwareWalletStatus {
  * Hardware Wallet Manager with connection pooling, status monitoring, and error recovery
  */
 export declare class HardwareWalletManager extends EventEmitter {
+    private readonly ledgerHost?;
     private connectionPool;
     private statusMonitorInterval;
-    private readonly CONNECTION_TIMEOUT;
+    private unsubscribeTrezor?;
+    private lifecycleGeneration;
+    private trezorInitialization?;
+    private destruction?;
+    private ledgerInitialization?;
     private readonly IDLE_TIMEOUT;
     private readonly STATUS_CHECK_INTERVAL;
     private readonly retryConfig;
-    constructor();
-    /**
-     * Get or create a Ledger connection with retry logic
-     */
-    getLedgerConnection(): Promise<Transport>;
-    /**
-     * Create Ledger connection with exponential backoff retry
-     */
-    private createLedgerConnectionWithRetry;
-    /**
-     * Create Ledger transport with timeout
-     */
-    private createLedgerTransport;
+    constructor(ledgerHost?: LedgerHost | undefined);
+    private observeTrezor;
+    /** Raw transports are deliberately unavailable through the semantic host boundary. */
+    getLedgerConnection(): Promise<never>;
+    private initializeLedger;
     /**
      * Initialize Trezor with retry logic
      */
@@ -94,10 +91,6 @@ export declare class HardwareWalletManager extends EventEmitter {
      * Calculate exponential backoff delay
      */
     private calculateBackoffDelay;
-    /**
-     * Create a timeout promise
-     */
-    private createTimeoutPromise;
     /**
      * Delay helper
      */

package/types/keyring-core.d.ts

@@ -1,10 +1,15 @@
 import { INetwork, INetworkType } from '@sidhujag/sysweb3-network';
 import { IDecryptPrivateRecordParams, IEncryptedPrivateRecord, IEncryptPrivateRecordParams } from './private-records';
 import { SyscoinHDSigner } from './signers';
+import { Bip84HdPublicRequest, Bip84HdPublicResult } from './software-utxo-account';
+import { Bip84Guard } from './transactions/bip84-native-plan';
+import { PreparedBip84SigningRequest, SignedBip84NativeTransaction } from './transactions/prepared-bip84';
 import { type ISyscoinHardwareSigners } from './transactions/syscoin-core';
 import { IKeyringAccountState, ICreateSmartAccountParams, ISyscoinTransactions, KeyringAccountType, IEthereumTransactions } from './types';
 import type { LedgerKeyring } from './ledger';
+import type { EncryptedEvmHdRuntimeAccount, EvmHdRuntimeAccountOptions, EvmHdRuntimeAccountRequest } from './software-hd-account';
 import type { VaultPersistence, VaultStoragePort } from './storage-core';
+import type { PreparedEvmSigningOptions, PreparedSoftwareEvmSigningRequest, SignedPreparedEvmTransaction } from './transactions/prepared-evm';
 import type { TrezorKeyring } from './trezor';
 /** Explicit asynchronous host storage; no browser or global DI fallback. */
 export interface KeyringStoragePort extends VaultStoragePort {
@@ -71,6 +76,7 @@ export declare class KeyringCore<TLedger extends KeyringLedgerSigner | undefined
     private sessionPassword;
     private sessionMnemonic;
     private privateRecordSessionRevision;
+    private bip84Operation;
     constructor(dependencies: KeyringCoreDependencies<TLedger, TTrezor>);
     private createSyscoinTransactions;
     private requireLedgerSigner;
@@ -185,6 +191,14 @@ export declare class KeyringCore<TLedger extends KeyringLedgerSigner | undefined
      */
     private getDecryptedPrivateKey;
     private capturePsbtSigningContext;
+    /** Fixed-profile public UTXO derivation; private material remains operation-local. */
+    protected deriveSoftwareBip84HdPublicAccount(input: Bip84HdPublicRequest, options: Bip84Guard): Promise<Bip84HdPublicResult>;
+    /** Fixed selected-account native signing. No storage, discovery or broadcast. */
+    protected signPreparedSoftwareBip84Transaction(input: PreparedBip84SigningRequest, options: Bip84Guard): Promise<SignedBip84NativeTransaction>;
+    /** Fixed-path derivation for an authenticated software host; no persistence. */
+    protected deriveSoftwareEvmHdRuntimeAccount(input: EvmHdRuntimeAccountRequest, options: EvmHdRuntimeAccountOptions): Promise<EncryptedEvmHdRuntimeAccount>;
+    /** The software facade owns this public capability; no device fallback. */
+    protected signPreparedSoftwareEvmTransaction(input: PreparedSoftwareEvmSigningRequest, options: PreparedEvmSigningOptions): SignedPreparedEvmTransaction;
     private getSigner;
     private getReadOnlySigner;
     private writeUtf8Diagnostic;

package/types/keyring-manager.d.ts

@@ -3,9 +3,10 @@ import { KeyringCore } from './keyring-core';
 import { LedgerKeyring } from './ledger';
 import { TrezorKeyring } from './trezor';
 import type { IKeyringManager } from './types';
+import type { LedgerHost } from './ledger/host-types';
 export type { ISysAccount } from './keyring-core';
 /** Existing browser entry. Native/software hosts must use the software entry. */
 export declare class KeyringManager extends KeyringCore<LedgerKeyring, TrezorKeyring> implements IKeyringManager {
-    constructor(sharedHardwareWalletManager?: HardwareWalletManager);
+    constructor(sharedHardwareWalletManager?: HardwareWalletManager, ledgerHost?: LedgerHost);
     static createInitialized(seed: string, password: string, vaultStateGetter: () => any): Promise<KeyringManager>;
 }

package/types/ledger/bitcoin_client/lib/appClient.d.ts

@@ -1,6 +1,9 @@
-import Transport from '@ledgerhq/hw-transport';
 import { WalletPolicy } from './policy';
 import { PsbtV2 } from './psbtv2';
+/** The Bitcoin protocol needs APDU exchange only, not a vendor transport class. */
+export interface BitcoinAppTransport {
+    send(cla: number, ins: number, p1: number, p2: number, data?: Buffer, acceptedStatusCodes?: number[]): Promise<Buffer>;
+}
 /**
  * This class represents a partial signature produced by the app during signing.
  * It always contains the `signature` and the corresponding `pubkey` whose private key
@@ -18,8 +21,8 @@ export declare class PartialSignature {
  * https://github.com/LedgerHQ/app-bitcoin-new/blob/master/doc/bitcoin.md
  */
 export declare class AppClient {
-    readonly transport: Transport;
-    constructor(transport: Transport);
+    readonly transport: BitcoinAppTransport;
+    constructor(transport: BitcoinAppTransport);
     private makeRequest;
     /**
      * Returns an object containing the currently running app's name, version and the device status flags.

package/types/ledger/dmk-evm.d.ts

@@ -0,0 +1,8 @@
+import { type ContextModule } from '@ledgerhq/context-module';
+import { type LedgerEvmHost, type LedgerEvmConfig } from './host-types';
+import type { LedgerDmkSession } from './dmk-session';
+export type { LedgerBlindSigningIntent, LedgerEvmConfig } from './host-types';
+/** No remote metadata, transaction checks, or signing telemetry by default. */
+export declare const offlineLedgerContext: ContextModule;
+/** EVM facade preserves existing SDK signature formats and performs no broadcast. */
+export declare function createLedgerEvmAdapter(session: LedgerDmkSession, config?: LedgerEvmConfig): LedgerEvmHost;

package/types/ledger/dmk-session.d.ts

@@ -0,0 +1,60 @@
+import { type LedgerOperationOptions } from './host-types';
+import type { DeviceManagementKit } from '@ledgerhq/device-management-kit';
+import type { Observable } from 'rxjs';
+type Action<Output> = {
+    observable: Observable<{
+        status: 'not-started' | 'stopped';
+    } | {
+        status: 'pending';
+        intermediateValue: {
+            requiredUserInteraction: string;
+            step?: string;
+        };
+    } | {
+        status: 'completed';
+        output: Output;
+    } | {
+        status: 'error';
+        error: unknown;
+    }>;
+    cancel(): void;
+};
+export interface LedgerDmkOperation {
+    readonly dmk: DeviceManagementKit;
+    readonly sessionId: string;
+    readonly generation: number;
+    readonly signal: AbortSignal;
+    assertCurrent(): void;
+    runAction<Output>(createAction: () => Action<Output>): Promise<Output>;
+}
+/** One owner and one semantic operation at a time, across EVM and UTXO apps. */
+export declare class LedgerDmkSession {
+    readonly dmk: DeviceManagementKit;
+    private generation;
+    private sessionId;
+    private queue;
+    private activeCancel;
+    private activeAbort;
+    private closing;
+    private stateSubscription;
+    private connectionAttempt;
+    private connectionAbort;
+    private readonly invalidationListeners;
+    constructor(dmk: DeviceManagementKit);
+    getStatus(): {
+        connected: boolean;
+    };
+    onInvalidated(listener: () => void): () => void;
+    private invalidate;
+    /** Device selection belongs to the visible host, never to a dapp request. */
+    connect(request?: {
+        useGrantedDevices?: boolean;
+    }, options?: LedgerOperationOptions): Promise<void>;
+    private connectDevice;
+    /** Cancel revokes the result and closes I/O; it cannot undo on-device approval. */
+    disconnect(): Promise<void>;
+    runExclusive<Output>(operation: (session: LedgerDmkOperation) => Promise<Output>, options?: LedgerOperationOptions): Promise<Output>;
+    runAction<Output>(createAction: (session: LedgerDmkOperation) => Action<Output>, options?: LedgerOperationOptions): Promise<Output>;
+    private awaitAction;
+}
+export {};

package/types/ledger/dmk-utxo.d.ts

@@ -0,0 +1,26 @@
+import { DeviceExchangeError, type ApduResponse, type Command, type InternalApi } from '@ledgerhq/device-management-kit';
+import { type BitcoinAppTransport } from './bitcoin_client/lib/appClient';
+import { LedgerDmkSession } from './dmk-session';
+import { type LedgerUtxoAccount, type LedgerUtxoHost } from './host-types';
+export declare class LedgerProtocolError extends DeviceExchangeError<number> {
+    readonly statusCode: number;
+    readonly code: string;
+    constructor(statusCode: number);
+}
+/** Preserves the existing Bitcoin/Syscoin APDU contract, including 0xe000. */
+export declare class LedgerBitcoinCommand implements Command<Buffer, void, number> {
+    private readonly cla;
+    private readonly ins;
+    private readonly p1;
+    private readonly p2;
+    private readonly data;
+    private readonly acceptedStatusCodes;
+    readonly name = "PaliBitcoinProtocol";
+    constructor(cla: number, ins: number, p1: number, p2: number, data?: Uint8Array, acceptedStatusCodes?: number[]);
+    getApdu(): import("@ledgerhq/device-management-kit").Apdu;
+    parseResponse(response: ApduResponse): import("@ledgerhq/device-management-kit").CommandResult<Buffer<ArrayBufferLike>, number>;
+}
+/** Must be used inside a single DeviceAction; public dmk.sendCommand would requeue. */
+export declare function createBitcoinAppTransport(internalApi: InternalApi, assertCurrent: () => void): BitcoinAppTransport;
+export declare function ledgerUtxoApp(request: LedgerUtxoAccount): string;
+export declare function createLedgerUtxoAdapter(session: LedgerDmkSession): LedgerUtxoHost;

package/types/ledger/host-types.d.ts

@@ -0,0 +1,131 @@
+/** Serializable Ledger requests. This module must remain free of device SDK imports. */
+export interface LedgerProgress {
+    status: 'not-started' | 'pending' | 'stopped' | 'completed' | 'error';
+    requiredUserInteraction?: string;
+    step?: string;
+}
+export interface LedgerOperationOptions {
+    signal?: AbortSignal;
+    onProgress?: (progress: LedgerProgress) => void;
+}
+export interface LedgerUtxoAccount {
+    currency: string;
+    slip44: number;
+    accountIndex: number;
+}
+export interface LedgerPartialSignature {
+    inputIndex: number;
+    pubkeyHex: string;
+    signatureHex: string;
+    tapleafHashHex?: string;
+}
+export interface LedgerTypedData {
+    domain: Record<string, unknown>;
+    types: Record<string, {
+        name: string;
+        type: string;
+    }[]>;
+    primaryType: string;
+    message: Record<string, unknown>;
+}
+export type LedgerBlindSigningIntent = Readonly<{
+    kind: 'transaction';
+    accountIndex: number;
+    derivationPath: string;
+    expectedAddress: string;
+    unsignedTxHex: string;
+    chainId: string;
+    digest: string;
+} | {
+    kind: 'typed-data';
+    accountIndex: number;
+    derivationPath: string;
+    expectedAddress: string;
+    version: 'V3' | 'V4';
+    data: LedgerTypedData;
+    digest: string;
+}>;
+/** Trusted host policy, never a field accepted from a dapp request. */
+export interface LedgerEvmConfig {
+    /**
+     * The public DSK may fall back to blind signing. The host must disclose that
+     * limitation and approve this exact intent each time. No callback means deny.
+     */
+    confirmBlindSigning?: (intent: LedgerBlindSigningIntent, signal: AbortSignal) => boolean | Promise<boolean>;
+}
+export interface LedgerEvmHost {
+    getAddress(request: {
+        accountIndex: number;
+        checkOnDevice?: boolean;
+        chainId?: number;
+    }, options?: LedgerOperationOptions): Promise<{
+        address: string;
+        publicKey: string;
+    }>;
+    signTransaction(request: {
+        accountIndex: number;
+        unsignedTxHex: string;
+        expectedAddress: string;
+    }, options?: LedgerOperationOptions): Promise<{
+        r: string;
+        s: string;
+        v: string;
+    }>;
+    signPersonalMessage(request: {
+        accountIndex: number;
+        messageHex: string;
+        expectedAddress: string;
+    }, options?: LedgerOperationOptions): Promise<string>;
+    signTypedData(request: {
+        accountIndex: number;
+        version: 'V3' | 'V4';
+        data: LedgerTypedData;
+        expectedAddress: string;
+    }, options?: LedgerOperationOptions): Promise<string>;
+}
+export interface LedgerUtxoHost {
+    getXpub(request: LedgerUtxoAccount & {
+        checkOnDevice?: boolean;
+    }, options?: LedgerOperationOptions): Promise<string>;
+    getAddress(request: LedgerUtxoAccount & {
+        checkOnDevice?: boolean;
+    }, options?: LedgerOperationOptions): Promise<string>;
+    getAccount(request: LedgerUtxoAccount & {
+        checkOnDevice?: boolean;
+    }, options?: LedgerOperationOptions): Promise<{
+        xpub: string;
+        fingerprint: string;
+        address: string;
+    }>;
+    signMessage(request: LedgerUtxoAccount & {
+        message: string;
+        addressIndex?: number;
+        change?: boolean;
+        accountXpub: string;
+    }, options?: LedgerOperationOptions): Promise<string>;
+    signPsbt(request: LedgerUtxoAccount & {
+        psbtBase64: string;
+        accountXpub: string;
+    }, options?: LedgerOperationOptions): Promise<{
+        fingerprint: string;
+        signatures: LedgerPartialSignature[];
+    }>;
+}
+/** The wallet authority injects this port; an absent host never opens a device. */
+export interface LedgerHost {
+    connect(request?: {
+        useGrantedDevices?: boolean;
+    }, options?: LedgerOperationOptions): Promise<void>;
+    disconnect(): Promise<void>;
+    getStatus(): {
+        connected: boolean;
+    };
+    readonly evm: LedgerEvmHost;
+    readonly utxo: LedgerUtxoHost;
+}
+export declare function ledgerHostError(code: string, message: string): Error & {
+    code: string;
+};
+export declare const ledgerCancelledError: () => Error & {
+    code: string;
+};

package/types/ledger/index.d.ts

@@ -1,62 +1,25 @@
-import Transport from '@ledgerhq/hw-transport';
-import SysUtxoClient from './bitcoin_client';
-import type { Psbt } from 'bitcoinjs-lib';
-import { IEvmMethods, IUTXOMethods } from './types';
-import LedgerEthClient from '@ledgerhq/hw-app-eth';
-import { HardwareWalletManager } from '../hardware-wallet-manager';
+import { ConnectionStatus, HardwareWalletType } from '../hardware-wallet-manager';
+import type { HardwareWalletManager } from '../hardware-wallet-manager';
+import type { LedgerHost, LedgerUtxoHost } from './host-types';
+import type { IEvmMethods, IUTXOMethods } from './types';
+/** Small authority-side facade. Device SDKs belong exclusively in ledger-host. */
 export declare class LedgerKeyring {
-    ledgerEVMClient: LedgerEthClient;
-    ledgerUtxoClient: SysUtxoClient;
-    private hdPath;
-    evm: IEvmMethods;
-    utxo: IUTXOMethods;
-    transport: Transport | null;
-    private hardwareWalletManager;
-    private walletHmacCache;
-    /**
-     * @param sharedHardwareWalletManager Optional shared HardwareWalletManager instance.
-     *                                     If provided, this will be used instead of creating
-     *                                     a new instance. This allows multiple KeyringManagers
-     *                                     to share the same Ledger connection.
-     */
-    constructor(sharedHardwareWalletManager?: HardwareWalletManager);
-    /**
-     * Ensure Ledger is connected with automatic retry
-     * Note: This is automatically called by all operations through executeWithRetry
-     * External callers don't need to call this directly
-     */
-    ensureConnection(): Promise<void>;
-    private getUtxoAddress;
+    private readonly sharedHardwareWalletManager?;
+    private readonly host?;
+    readonly evm: IEvmMethods;
+    readonly utxo: IUTXOMethods;
+    private generation;
+    constructor(sharedHardwareWalletManager?: HardwareWalletManager | undefined, host?: LedgerHost | undefined);
+    private requireHost;
+    private run;
+    ensureConnection: () => Promise<void>;
     verifyUtxoAddress: (accountIndex: number, currency: string, slip44: number) => Promise<string>;
-    private getXpub;
-    /**
-     * Sign a UTXO message - public method used by transaction classes
-     */
-    signUtxoMessage: (path: string, message: string) => Promise<string>;
-    private signEVMTransaction;
-    private signPersonalMessage;
-    private sanitizeData;
-    private transformTypedData;
-    private getEvmAddressAndPubKey;
-    private signTypedData;
-    private getMasterFingerprint;
-    private buildWalletCacheKey;
-    private getOrRegisterHmac;
-    private setHdPath;
-    /**
-     * Convert PSBT to Ledger format with retry logic
-     */
-    convertToLedgerFormat(psbt: Psbt, accountXpub: string, accountId: number, currency: string, slip44: number): Promise<Psbt>;
-    /**
-     * Execute operation with automatic retry
-     */
-    private executeWithRetry;
-    /**
-     * Get hardware wallet status
-     */
-    getStatus(): import("../hardware-wallet-manager").HardwareWalletStatus | undefined;
-    /**
-     * Clean up resources
-     */
+    signUtxoMessage: (request: Parameters<LedgerUtxoHost["signMessage"]>[0]) => Promise<string>;
+    signPsbt: (request: Parameters<LedgerUtxoHost["signPsbt"]>[0]) => ReturnType<LedgerUtxoHost["signPsbt"]>;
+    getStatus(): {
+        type: HardwareWalletType;
+        connected: boolean;
+        status: ConnectionStatus;
+    };
     destroy(): Promise<void>;
 }

package/types/ledger/prepare-psbt.d.ts

@@ -0,0 +1,3 @@
+import type { Psbt } from 'bitcoinjs-lib';
+/** Enrich public PSBT metadata only. Callers must also enforce account scope. */
+export declare function prepareLedgerPsbt(psbt: Psbt, accountXpub: string, accountId: number, currency: string, slip44: number, fingerprint: string): Psbt;

package/types/ledger/types.d.ts

@@ -30,6 +30,7 @@ export interface IEvmMethods {
     signEVMTransaction: ({ rawTx, accountIndex, }: {
         accountIndex: number;
         rawTx: string;
+        expectedAddress: string;
     }) => Promise<{
         r: string;
         s: string;
@@ -38,10 +39,12 @@ export interface IEvmMethods {
     signPersonalMessage: ({ message, accountIndex, }: {
         accountIndex: number;
         message: string;
+        expectedAddress: string;
     }) => Promise<string>;
     signTypedData: ({ version, data, accountIndex, }: {
         accountIndex: number;
         data: any;
+        expectedAddress: string;
         version: SignTypedDataVersion;
     }) => Promise<string>;
 }

package/types/ledger-host.d.ts

@@ -0,0 +1,7 @@
+import type { LedgerHost, LedgerEvmConfig } from './ledger/host-types';
+export interface LedgerDmkHostConfig extends LedgerEvmConfig {
+    /** Platform-owned DMK, allowing a future host to register its own transports. */
+    dmk?: object;
+}
+export declare function createLedgerDmkHost(config?: LedgerDmkHostConfig): LedgerHost;
+export type { LedgerEvmConfig, LedgerBlindSigningIntent, LedgerHost, LedgerEvmHost, LedgerUtxoHost, LedgerUtxoAccount, LedgerPartialSignature, LedgerTypedData, LedgerOperationOptions, LedgerProgress, } from './ledger/host-types';

package/types/public-bip84.d.ts

@@ -0,0 +1,39 @@
+export type Bip84PublicNetwork = 'bitcoin' | 'syscoin';
+export type Bip84PublicAccountRequest = Readonly<{
+    network: Bip84PublicNetwork;
+    accountKey: string;
+}>;
+export type Bip84PublicAccount = Readonly<{
+    network: Bip84PublicNetwork;
+    policy: 'bip84-p2wpkh';
+    canonicalKey: string;
+    accountIndex: number;
+}>;
+export type Bip84PublicAddressRequest = Bip84PublicAccountRequest & Readonly<{
+    branch: 0 | 1;
+    index: number;
+}>;
+export type Bip84PublicAddress = Readonly<{
+    account: Bip84PublicAccount;
+    branch: 0 | 1;
+    index: number;
+    address: string;
+    scriptPubKey: string;
+}>;
+export declare class PublicBip84Error extends Error {
+    readonly code: 'INVALID_INPUT' | 'INVALID_ACCOUNT' | 'INVALID_DERIVATION';
+    constructor(code: 'INVALID_INPUT' | 'INVALID_ACCOUNT' | 'INVALID_DERIVATION');
+}
+/**
+ * Validate one public account and normalize xpub/zpub aliases. The chosen
+ * network and BIP84 policy are explicit; ancestry/purpose is not attested.
+ * No keyring, storage, provider, randomness or wallet signing is involved.
+ * BIP32Factory runs its upstream deterministic ECC self-tests at module load.
+ */
+export declare function parseBip84PublicAccount(request: Bip84PublicAccountRequest): Bip84PublicAccount;
+/**
+ * Derive only /0/index or /1/index from a validated mainnet account key.
+ * One bounded input and two child derivations; no discovery, cache or range
+ * iteration. Callers own scan limits and privacy consent. Returned data is public.
+ */
+export declare function deriveBip84PublicAddress(request: Bip84PublicAddressRequest): Bip84PublicAddress;

package/types/software-hd-account.d.ts

@@ -0,0 +1,16 @@
+import type { IKeyringAccountState } from './types';
+/** Fixed Ethereum BIP44 address index; not an arbitrary derivation path. */
+export interface EvmHdRuntimeAccountRequest {
+    readonly index: number;
+}
+/** Trusted host guard must return undefined synchronously. */
+export interface EvmHdRuntimeAccountOptions {
+    assertCurrent: () => void;
+}
+/**
+ * Internal runtime record, matching createFirstAccount/addNewAccount. Contains a
+ * password-encrypted xprv; never publish it or persist it as a public catalogue.
+ * No plaintext private key, mnemonic, or password is returned.
+ */
+export type EncryptedEvmHdRuntimeAccount = IKeyringAccountState;
+export declare function snapshotEvmHdIndex(value: EvmHdRuntimeAccountRequest): number;

package/types/software-utxo-account.d.ts

@@ -0,0 +1,13 @@
+import { Bip84PublicAccount, Bip84PublicAddress } from './public-bip84';
+import { Bip84NetworkBinding } from './transactions/bip84-native-plan';
+export type Bip84HdPublicRequest = Readonly<{
+    network: Bip84NetworkBinding;
+    accountIndex: number;
+}>;
+export type Bip84HdPublicResult = Readonly<{
+    type: 'HDAccount';
+    accountIndex: number;
+    account: Bip84PublicAccount;
+    receive: Bip84PublicAddress;
+}>;
+export declare function snapshotBip84HdPublicRequest(value: unknown): Bip84HdPublicRequest;

package/types/software.d.ts

@@ -1,6 +1,11 @@
 /** Software-only entry: explicit host storage, no browser/device initialization. */
 import { KeyringCore } from './keyring-core';
 import type { KeyringStoragePort } from './keyring-core';
+import type { EncryptedEvmHdRuntimeAccount, EvmHdRuntimeAccountOptions, EvmHdRuntimeAccountRequest } from './software-hd-account';
+import type { Bip84HdPublicRequest, Bip84HdPublicResult } from './software-utxo-account';
+import type { Bip84Guard } from './transactions/bip84-native-plan';
+import type { PreparedBip84SigningRequest, SignedBip84NativeTransaction } from './transactions/prepared-bip84';
+import type { PreparedEvmSigningOptions, PreparedSoftwareEvmSigningRequest, SignedPreparedEvmTransaction } from './transactions/prepared-evm';
 declare const softwareHostBrand: unique symbol;
 /** Opaque handle minted by createSoftwareKeyringHost; no injectable persistence. */
 export interface SoftwareKeyringHost {
@@ -10,6 +15,22 @@ export interface SoftwareKeyringHost {
 export declare const createSoftwareKeyringHost: (storage: KeyringStoragePort) => SoftwareKeyringHost;
 export declare class SoftwareKeyring extends KeyringCore<undefined, undefined> {
     constructor(host: SoftwareKeyringHost);
+    /**
+     * Derive a fixed-path Ethereum HD runtime account without network or storage
+     * writes. The returned password-encrypted xprv is internal runtime state,
+     * never a public account/catalogue DTO. The host owns index allocation.
+     */
+    deriveEvmHdRuntimeAccount(request: EvmHdRuntimeAccountRequest, options: EvmHdRuntimeAccountOptions): Promise<EncryptedEvmHdRuntimeAccount>;
+    /** Derive public BIP84 account data from the live seed; no storage or discovery. */
+    deriveBip84HdPublicAccount(request: Bip84HdPublicRequest, options: Bip84Guard): Promise<Bip84HdPublicResult>;
+    /** Sign the selected HD account's exact prepared native transaction offline. */
+    signPreparedBip84Transaction(request: PreparedBip84SigningRequest, options: Bip84Guard): Promise<SignedBip84NativeTransaction>;
+    /**
+     * Sign exactly the prepared envelope without RPC, fee/nonce discovery or
+     * broadcasting. The host must journal the result before submitting it.
+     * A later lock cannot revoke already returned signed bytes.
+     */
+    signPreparedEvmTransaction(request: PreparedSoftwareEvmSigningRequest, options: PreparedEvmSigningOptions): SignedPreparedEvmTransaction;
     /** Software authorities cannot rebind their backing store after creation. */
     setStorage: (client: any) => never;
     /** Sessions may move only through the core's same-authority transfer path. */
@@ -21,3 +42,8 @@ export { INetworkType } from '@sidhujag/sysweb3-network';
 export type { INetwork } from '@sidhujag/sysweb3-network';
 export type { KeyringStoragePort } from './keyring-core';
 export type { IKeyringAccountState } from './types';
+export type { PreparedEvmTransaction, PreparedEvmSigningOptions, PreparedSoftwareEvmSigningRequest, SignedPreparedEvmTransaction, } from './transactions/prepared-evm';
+export type { EncryptedEvmHdRuntimeAccount, EvmHdRuntimeAccountOptions, EvmHdRuntimeAccountRequest, } from './software-hd-account';
+export type { Bip84HdPublicRequest, Bip84HdPublicResult, } from './software-utxo-account';
+export type { Bip84Guard } from './transactions/bip84-native-plan';
+export type { PreparedBip84SigningRequest, SignedBip84NativeTransaction, } from './transactions/prepared-bip84';