@sidhujag/sysweb3-keyring 2.1.2 → 2.1.3

package/cjs/keyring-core.js

@@ -32,9 +32,21 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
+var _KeyringCore_instances, _KeyringCore_deviceUnlockRetired, _KeyringCore_sessionOwnership, _KeyringCore_createDeviceUnlockControls, _KeyringCore_acceptSessionFrom, _KeyringCore_assertSessionOwner, _KeyringCore_captureSessionGuard, _KeyringCore_replaceSessionBuffers, _KeyringCore_finishUnlock, _KeyringCore_installVaultSession, _KeyringCore_recreateSessionFromVault;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KeyringCore = void 0;
 const secp256k1_1 = __importDefault(require("@bitcoinerlab/secp256k1"));
@@ -56,6 +68,7 @@ const SLH_DSA_DERIVATION_VERSION = 1;
 // Pali expands this setup secret into the 48-byte SLH skSeed/skPrf/pkSeed tuple.
 const SLH_DSA_SETUP_SECRET_HEX_LENGTH = 64;
 const SLH_DSA_PARAMETER_SET = 'SLH-DSA-SHA2-128-24';
+const current_vault_refusal_1 = require("./current-vault-refusal");
 const ethers_v6_1 = require("./ethers-v6");
 const initial_state_1 = require("./initial-state");
 const private_records_1 = require("./private-records");
@@ -71,6 +84,28 @@ const blockbook_cache_1 = require("./utils/blockbook-cache");
 const derivation_paths_1 = require("./utils/derivation-paths");
 const psbt_account_scope_1 = require("./utils/psbt-account-scope");
 const watch_descriptor_1 = require("./utils/watch-descriptor");
+const currentVaultSalt = (keys) => {
+    const salt = keys && typeof keys === 'object' && Reflect.ownKeys(keys).length === 1
+        ? Object.getOwnPropertyDescriptor(keys, 'salt')?.value
+        : undefined;
+    return typeof salt === 'string' && /^[0-9a-f]{32}$/.test(salt)
+        ? salt
+        : undefined;
+};
+const readCurrentVaultPair = async (readPair) => {
+    const pair = await readPair();
+    if (pair === null)
+        return null;
+    const { vault, keys, pairFingerprint } = pair;
+    const salt = currentVaultSalt(keys);
+    if (typeof vault !== 'string' ||
+        salt === undefined ||
+        typeof pairFingerprint !== 'string' ||
+        !/^[0-9a-f]{64}$/.test(pairFingerprint)) {
+        throw new Error('Invalid device unlock vault pair');
+    }
+    return { vault, salt, pairFingerprint };
+};
 // Dynamic ETH HD path generation - will be computed as needed
 /**
  * Secure Buffer implementation for sensitive data
@@ -112,6 +147,7 @@ class SecureBuffer {
 }
 class KeyringCore {
     constructor(dependencies) {
+        _KeyringCore_instances.add(this);
         // Store getter function for accessing Redux state
         this.getVaultState = null;
         // Method to inject store getter from Pali side
@@ -156,6 +192,8 @@ class KeyringCore {
         this.sessionPassword = null;
         this.sessionMnemonic = null; // can be a mnemonic or a zprv, can be changed to a zprv when using an imported wallet
         this.privateRecordSessionRevision = 0;
+        _KeyringCore_deviceUnlockRetired.set(this, false);
+        _KeyringCore_sessionOwnership.set(this, void 0);
         this.createSyscoinTransactions = () => new syscoin_core_1.SyscoinTransactionsCore(this.getSigner, this.getReadOnlySigner, this.getAccountsState, this.getAddress, this.syscoinHardwareSigners, this.capturePsbtSigningContext);
         this.requireLedgerSigner = () => {
             if (!this.ledgerSigner)
@@ -191,6 +229,11 @@ class KeyringCore {
                 this.sessionMnemonic.clear();
                 this.sessionMnemonic = null;
             }
+            const ownership = __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f");
+            if (ownership && ownership.tracker.current === ownership.token) {
+                ownership.tracker.current = undefined;
+                ownership.tracker.epoch++;
+            }
             // Clear transaction handlers that may hold HD signers
             if (this.syscoinTransaction) {
                 // Replace with empty object to clear references
@@ -234,40 +277,15 @@ class KeyringCore {
             if (!this.sessionPassword || !this.sessionMnemonic) {
                 throw new Error('Session data is missing during transfer');
             }
+            __classPrivateFieldGet(targetKeyring, _KeyringCore_instances, "m", _KeyringCore_acceptSessionFrom).call(targetKeyring, this);
             this.privateRecordSessionRevision++;
-            targetKeyring.acceptSessionFrom(this);
+            __classPrivateFieldSet(this, _KeyringCore_deviceUnlockRetired, true, "f");
             // Null out our references (do NOT clear buffers - target owns them now)
             this.sessionPassword = null;
             this.sessionMnemonic = null;
         };
-        // The checked transfer path never dispatches through a public host receiver.
-        this.acceptSessionFrom = (source) => {
-            if (source.authority !== this.authority ||
-                source.storage !== this.storage ||
-                source.vaultPersistence !== this.vaultPersistence) {
-                throw new Error('Cannot transfer session between different wallet authorities');
-            }
-            if (!source.sessionPassword || !source.sessionMnemonic) {
-                throw new Error('Session data is missing during transfer');
-            }
-            this.replaceSessionBuffers(source.sessionPassword, source.sessionMnemonic);
-        };
         // Legacy trusted-host API. SoftwareKeyring disables direct buffer injection.
-        this.receiveSessionOwnership = (sessionPassword, sessionMnemonic) => this.replaceSessionBuffers(sessionPassword, sessionMnemonic);
-        this.replaceSessionBuffers = (sessionPassword, sessionMnemonic) => {
-            this.privateRecordSessionRevision++;
-            // Clear any existing data first
-            if (this.sessionPassword) {
-                this.sessionPassword.clear();
-            }
-            if (this.sessionMnemonic) {
-                this.sessionMnemonic.clear();
-            }
-            // Take ownership of the actual SecureBuffer objects
-            // No copying - these are the original objects
-            this.sessionPassword = sessionPassword;
-            this.sessionMnemonic = sessionMnemonic;
-        };
+        this.receiveSessionOwnership = (sessionPassword, sessionMnemonic) => __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_replaceSessionBuffers).call(this, sessionPassword, sessionMnemonic);
         this.addNewAccount = async (label) => {
             // Check if wallet is unlocked
             if (!this.isUnlocked()) {
@@ -1198,7 +1216,7 @@ class KeyringCore {
             }, 
             // v4 vault is encrypted with the derived session password key (PBKDF2 output)
             sessionPasswordSaltedHash, { salt });
-            await this.recreateSessionFromVault(sessionPasswordSaltedHash);
+            await __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_recreateSessionFromVault).call(this, sessionPasswordSaltedHash);
         };
         // NEW: Create first account without signer setup
         this.createFirstAccount = async (label) => {
@@ -1247,6 +1265,12 @@ class KeyringCore {
             throw new TypeError('Keyring core requires bound vault persistence');
         }
         this.authority = dependencies.authority;
+        if (dependencies.sessionOwner) {
+            __classPrivateFieldSet(this, _KeyringCore_sessionOwnership, {
+                tracker: dependencies.sessionOwner,
+                token: Symbol(),
+            }, "f");
+        }
         this.storage = dependencies.storage;
         this.vaultPersistence = dependencies.vaultPersistence;
         this.ledgerSigner = dependencies.ledgerSigner;
@@ -1258,6 +1282,15 @@ class KeyringCore {
         this.initialLedgerAccountState = initial_state_1.initialActiveLedgerAccountState;
         this.syscoinTransaction = this.createSyscoinTransactions();
         this.ethereumTransaction = new ethereum_1.EthereumTransactions(this.getNetwork, this.getDecryptedPrivateKey, this.getAccountsState, this.ledgerSigner, this.trezorSigner, this.capturePsbtSigningContext, dependencies.captureEvmSubmission);
+        if (dependencies.deviceUnlock) {
+            if (!__classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f"))
+                throw new TypeError('Device unlock requires a session owner');
+            const { port, receive } = dependencies.deviceUnlock;
+            const readVaultPair = this.storage.readDeviceUnlockVaultPair;
+            if (typeof readVaultPair !== 'function')
+                throw new TypeError('Device unlock requires an atomic vault pair reader');
+            receive(__classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_createDeviceUnlockControls).call(this, port, readVaultPair.bind(this.storage)));
+        }
     }
     // Convenience method for complete setup after construction
     async initialize(seed, password, network) {
@@ -1277,18 +1310,28 @@ class KeyringCore {
      * not charge a failed password attempt for an operational error.
      */
     async unlock(password) {
+        let assertCurrent = __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_captureSessionGuard).call(this);
         let authenticated = false;
         try {
+            assertCurrent?.();
             const vaultKeys = await this.storage.get('vault-keys');
+            assertCurrent?.();
             if (!vaultKeys) {
                 throw new Error('Vault keys not found. Reload the wallet and try again.');
             }
             // v4: Validate password by deriving the session key once and decrypting the vault with it.
             // This avoids an extra KDF pass just for a stored verifier.
             const { salt } = vaultKeys;
+            const readVaultPair = assertCurrent
+                ? this.storage.readDeviceUnlockVaultPair
+                : undefined;
+            const accountingSalt = readVaultPair
+                ? currentVaultSalt(vaultKeys)
+                : undefined;
             // Derive session encryption key (in-memory only) used to encrypt/decrypt xprv fields
             // IMPORTANT: This MUST NOT be the same value as the stored verifier above.
-            let sessionPasswordKey = await this.deriveStoredSessionKey(password, vaultKeys);
+            let sessionPasswordKey = await this.deriveStoredSessionKey(password, accountingSalt === undefined ? vaultKeys : { salt: accountingSalt });
+            assertCurrent?.();
             // Handle migration from old vault format with currentSessionSalt
             if (vaultKeys.currentSessionSalt) {
                 console.log('[KeyringManager] Detected old vault format, handling session migration...');
@@ -1299,6 +1342,7 @@ class KeyringCore {
                 // derived key. Selecting by stored format also permits a safe retry
                 // if the vault write succeeded but the metadata write was interrupted.
                 const { mnemonic } = await this.vaultPersistence.getDecryptedVault(sessionPasswordKey, password);
+                assertCurrent?.();
                 authenticated = true;
                 const isValidSecret = (value) => {
                     if (typeof value !== 'string' || !value)
@@ -1338,13 +1382,16 @@ class KeyringCore {
                     throw new Error('Legacy vault secret could not be recovered. Existing vault preserved.');
                 }
                 // Do not change either stored record until a valid secret is recovered.
-                await this.vaultPersistence.setEncryptedVault({ mnemonic: decryptedMnemonic }, sessionPasswordKey);
+                await this.vaultPersistence.setEncryptedVault({ mnemonic: decryptedMnemonic }, sessionPasswordKey, undefined, assertCurrent);
+                assertCurrent?.();
                 console.log('[KeyringManager] Vault mnemonic format normalized');
                 // Remove currentSessionSalt from vault-keys (v4 keeps only the salt on disk)
                 const migratedVaultKeys = {
                     salt: vaultKeys.salt,
                 };
+                assertCurrent?.();
                 await this.storage.set('vault-keys', migratedVaultKeys);
+                assertCurrent?.();
                 console.log('[KeyringManager] Old vault format migration completed');
             }
             // v4 vault is encrypted with the derived session password key (PBKDF2 output).
@@ -1355,6 +1402,25 @@ class KeyringCore {
                 decryptedVault = await this.vaultPersistence.getDecryptedVault(sessionPasswordKey);
             }
             catch (error) {
+                const matchesRefusedVault = accountingSalt === undefined
+                    ? undefined
+                    : current_vault_refusal_1.currentVaultRefusals.get(error);
+                if (matchesRefusedVault && readVaultPair) {
+                    const pair = await readCurrentVaultPair(readVaultPair.bind(this.storage)).catch((readError) => {
+                        // A storage rejection cannot attest to password authentication.
+                        if (readError instanceof storage_core_1.VaultAuthenticationError)
+                            throw new Error('Wallet unlock vault read failed');
+                        throw readError;
+                    });
+                    if (!pair ||
+                        !matchesRefusedVault(pair.vault) ||
+                        pair.salt !== accountingSalt)
+                        throw new Error('Wallet unlock vault changed');
+                    // This exact negative result has no session authority. Keep it
+                    // available for the host counter even if its owner just retired.
+                    return { canLogin: false };
+                }
+                assertCurrent?.();
                 // Only the historical CBC fallback used the 20k key without metadata.
                 // Never try it for GCM, malformed records, or platform/storage failures.
                 const rawVault = error instanceof storage_core_1.VaultAuthenticationError &&
@@ -1362,65 +1428,56 @@ class KeyringCore {
                     !vaultKeys.currentSessionSalt
                     ? await this.storage.get('vault')
                     : undefined;
+                assertCurrent?.();
                 if (typeof rawVault !== 'string' || rawVault.trim().startsWith('{')) {
                     throw error;
                 }
                 const legacyKey = await this.deriveLegacySessionKey(password, salt);
+                assertCurrent?.();
                 decryptedVault = await this.vaultPersistence.getDecryptedVault(legacyKey);
+                assertCurrent?.();
                 authenticated = true;
                 sessionPasswordKey = legacyKey;
                 // Keep the historical account wrapping key. Persist its profile before
                 // GCM rewrapping so either interrupted write remains recoverable.
-                await this.storage.set('vault-keys', {
+                const migratedVaultKeys = {
                     ...vaultKeys,
                     keyDerivation: LEGACY_ENCRYPTION_KDF,
-                });
+                };
+                assertCurrent?.();
+                await this.storage.set('vault-keys', migratedVaultKeys);
+                assertCurrent?.();
                 legacyProfile = true;
             }
+            assertCurrent?.();
             authenticated = true;
             if (legacyProfile && this.hasWebCrypto()) {
                 const storedVault = await this.storage.get('vault');
+                assertCurrent?.();
                 if (typeof storedVault === 'string' &&
                     !storedVault.trim().startsWith('{')) {
                     // A failed earlier rewrap can leave the authenticated profile plus
                     // CBC. Retry that write without changing the account wrapping key.
-                    await this.vaultPersistence.setEncryptedVault(decryptedVault, sessionPasswordKey);
+                    await this.vaultPersistence.setEncryptedVault(decryptedVault, sessionPasswordKey, undefined, assertCurrent);
+                    assertCurrent?.();
                 }
             }
             // If session data missing or corrupted, recreate from vault
             if (!this.sessionMnemonic) {
-                await this.recreateSessionFromVault(sessionPasswordKey);
-            }
-            // Re-initialize syscoin transaction handler if it was cleared on lock.
-            // `lockWallet()` intentionally replaces it with a plain object to drop signer references,
-            // so we must restore the real class instance on unlock.
-            if (!this.syscoinTransaction ||
-                typeof this.syscoinTransaction.getRecommendedFee !== 'function') {
-                this.syscoinTransaction = this.createSyscoinTransactions();
-            }
-            // NOTE: Active account management is now handled by vault state/Redux
-            // No need to explicitly set active account after unlock - it's managed externally
-            const vault = this.getVault();
-            if (vault.activeAccount?.id !== undefined && vault.activeAccount?.type) {
-                // Check if the active account actually exists in the accounts map
-                const accountType = vault.activeAccount.type;
-                const accountId = vault.activeAccount.id;
-                const accountExists = vault.accounts?.[accountType]?.[accountId];
-                if (!accountExists) {
-                    console.log(`[KeyringManager] Active account ${accountType}:${accountId} not found in accounts map. This may indicate a migration from old vault format.`);
-                    // Signal that accounts need to be created after migration
-                    return {
-                        canLogin: true,
-                        needsAccountCreation: true,
-                    };
+                assertCurrent = await __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_recreateSessionFromVault).call(this, sessionPasswordKey, assertCurrent);
+                if (assertCurrent) {
+                    assertCurrent();
+                    console.log('[KeyringManager] Session data recreated from vault');
                 }
-                console.log(`[KeyringManager] Active account ${vault.activeAccount.id} available after unlock`);
             }
-            return {
-                canLogin: true,
-            };
+            assertCurrent?.();
+            const result = __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_finishUnlock).call(this);
+            assertCurrent?.();
+            return result;
         }
         catch (error) {
+            // A superseded attempt must not report authentication or clear its winner.
+            assertCurrent?.();
             if (!authenticated && error instanceof storage_core_1.VaultAuthenticationError) {
                 return { canLogin: false };
             }
@@ -2169,28 +2226,6 @@ class KeyringCore {
         // No gaps found, return next sequential ID
         return existingIds.length;
     }
-    async recreateSessionFromVault(saltedHashPassword) {
-        try {
-            // v4 vault is encrypted with the derived session password key (PBKDF2 output)
-            // `saltedHashPassword` is the derived session password key passed by caller.
-            const { mnemonic } = await this.vaultPersistence.getDecryptedVault(saltedHashPassword);
-            if (!mnemonic) {
-                throw new Error('Mnemonic not found in vault');
-            }
-            // Encrypt session data with sessionPassword hash for consistency
-            // This allows keyring manager to decrypt with this.sessionPassword
-            this.privateRecordSessionRevision++;
-            this.sessionPassword = new SecureBuffer(saltedHashPassword);
-            // Encrypt the mnemonic with session password for consistency with the rest of the code
-            const encryptedMnemonic = crypto_js_1.default.AES.encrypt(mnemonic, saltedHashPassword).toString();
-            this.sessionMnemonic = new SecureBuffer(encryptedMnemonic);
-            console.log('[KeyringManager] Session data recreated from vault');
-        }
-        catch (error) {
-            console.error('ERROR recreateSessionFromVault', { error });
-            throw error;
-        }
-    }
     async _getPrivateKeyAccountInfos(privKey, label, options) {
         const vault = this.getVault();
         const { accounts } = vault;
@@ -2595,6 +2630,9 @@ class KeyringCore {
      * Clean up all resources
      */
     async destroy() {
+        __classPrivateFieldSet(this, _KeyringCore_deviceUnlockRetired, true, "f");
+        if (__classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f"))
+            __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f").destroyed = true;
         await this.lockWallet();
         // Clear any remaining references
         this.ethereumTransaction = {};
@@ -2602,4 +2640,231 @@ class KeyringCore {
     }
 }
 exports.KeyringCore = KeyringCore;
+_KeyringCore_deviceUnlockRetired = new WeakMap(), _KeyringCore_sessionOwnership = new WeakMap(), _KeyringCore_instances = new WeakSet(), _KeyringCore_createDeviceUnlockControls = function _KeyringCore_createDeviceUnlockControls(port, readVaultPair) {
+    const readPair = () => readCurrentVaultPair(readVaultPair);
+    let pending = false;
+    const run = async (request, assertCurrent) => {
+        if (pending)
+            throw new Error('Device unlock operation is busy');
+        pending = true;
+        const assertOwnership = __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_captureSessionGuard).call(this, 'Device unlock session changed');
+        const issuing = request !== null;
+        const check = () => {
+            const result = assertCurrent();
+            if (result !== undefined) {
+                // Reject async guards and consume a possible rejected promise.
+                if (result &&
+                    (typeof result === 'object' || typeof result === 'function'))
+                    void Promise.resolve(result).catch(() => undefined);
+                throw new TypeError('Device unlock guard must return undefined synchronously');
+            }
+            if (__classPrivateFieldGet(this, _KeyringCore_deviceUnlockRetired, "f") ||
+                (!issuing && (this.sessionPassword || this.sessionMnemonic))) {
+                throw new Error('Device unlock session changed');
+            }
+            assertOwnership?.();
+        };
+        let key;
+        try {
+            check();
+            const pair = await readPair();
+            check();
+            if (!pair)
+                return false;
+            const checkPair = async (requireLiveOwner = true) => {
+                const current = await readPair();
+                if (requireLiveOwner)
+                    check();
+                if (current?.pairFingerprint !== pair.pairFingerprint ||
+                    current.vault !== pair.vault ||
+                    current.salt !== pair.salt) {
+                    throw new Error('Device unlock vault changed');
+                }
+            };
+            if (request) {
+                key = this.hexToBytes(await this.deriveStoredSessionKey(request.password, {
+                    salt: pair.salt,
+                }));
+            }
+            else {
+                const credential = await port.readCredential(pair.pairFingerprint);
+                key = credential?.key;
+                check();
+                if (credential?.pairFingerprint !== pair.pairFingerprint)
+                    return false;
+            }
+            check();
+            if (!(key instanceof Uint8Array) || key.length !== 32)
+                return false;
+            const keyHex = Buffer.from(key.buffer, key.byteOffset, key.byteLength).toString('hex');
+            let payload;
+            try {
+                payload = await (0, storage_core_1.decryptCurrentVault)(pair.vault, keyHex);
+            }
+            catch (error) {
+                if (!(error instanceof storage_core_1.VaultAuthenticationError))
+                    throw error;
+                // Preserve a definitive wrong-password result for host accounting
+                // even if enrollment was cancelled. The pair must still match and
+                // this branch never installs a session or writes a credential.
+                await checkPair(!issuing);
+                if (!issuing)
+                    check();
+                return false;
+            }
+            check();
+            const mnemonic = payload && typeof payload === 'object'
+                ? Object.getOwnPropertyDescriptor(payload, 'mnemonic')?.value
+                : undefined;
+            if (typeof mnemonic !== 'string' || !this.isSeedValid(mnemonic)) {
+                throw new Error('Invalid device unlock vault payload');
+            }
+            await checkPair();
+            check();
+            if (request) {
+                const result = await port.writeCredential(Object.freeze({ pairFingerprint: pair.pairFingerprint, key }), check);
+                if (result !== undefined)
+                    throw new Error('Device unlock credential write was not acknowledged');
+                await checkPair();
+                check();
+            }
+            else {
+                if (__classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_finishUnlock).call(this).needsAccountCreation)
+                    return false;
+                __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_installVaultSession).call(this, mnemonic, keyHex, check);
+            }
+            return true;
+        }
+        finally {
+            if (key instanceof Uint8Array)
+                key.fill(0);
+            pending = false;
+        }
+    };
+    return Object.freeze({
+        issue: (password, assertCurrent) => {
+            if (typeof password !== 'string' || !password)
+                return Promise.reject(new TypeError('Wallet password is required'));
+            return run({ password }, assertCurrent);
+        },
+        resume: (assertCurrent) => run(null, assertCurrent),
+    });
+}, _KeyringCore_acceptSessionFrom = function _KeyringCore_acceptSessionFrom(source) {
+    if (source.authority !== this.authority ||
+        source.storage !== this.storage ||
+        source.vaultPersistence !== this.vaultPersistence ||
+        __classPrivateFieldGet(source, _KeyringCore_sessionOwnership, "f")?.tracker !== __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f")?.tracker) {
+        throw new Error('Cannot transfer session between different wallet authorities');
+    }
+    if (!source.sessionPassword || !source.sessionMnemonic) {
+        throw new Error('Session data is missing during transfer');
+    }
+    __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_replaceSessionBuffers).call(this, source.sessionPassword, source.sessionMnemonic, __classPrivateFieldGet(source, _KeyringCore_sessionOwnership, "f")?.token);
+}, _KeyringCore_assertSessionOwner = function _KeyringCore_assertSessionOwner(sourceToken) {
+    const ownership = __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f");
+    if (!ownership)
+        return;
+    if (ownership.destroyed)
+        throw new Error('Wallet keyring was destroyed');
+    const owner = ownership.tracker.current;
+    if (sourceToken === undefined
+        ? owner !== undefined && owner !== ownership.token
+        : owner !== sourceToken) {
+        throw new Error('Wallet session is owned by another keyring');
+    }
+}, _KeyringCore_captureSessionGuard = function _KeyringCore_captureSessionGuard(message = 'Wallet unlock session changed') {
+    const ownership = __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f");
+    if (!ownership)
+        return undefined;
+    const revision = this.privateRecordSessionRevision;
+    const epoch = ownership.tracker.epoch;
+    return () => {
+        if (this.privateRecordSessionRevision !== revision)
+            throw new Error(message);
+        __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_assertSessionOwner).call(this);
+        if (ownership.tracker.epoch !== epoch)
+            throw new Error(message);
+    };
+}, _KeyringCore_replaceSessionBuffers = function _KeyringCore_replaceSessionBuffers(sessionPassword, sessionMnemonic, sourceToken) {
+    __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_assertSessionOwner).call(this, sourceToken);
+    this.privateRecordSessionRevision++;
+    // Clear any existing data first
+    if (this.sessionPassword) {
+        this.sessionPassword.clear();
+    }
+    if (this.sessionMnemonic) {
+        this.sessionMnemonic.clear();
+    }
+    // Take ownership of the actual SecureBuffer objects
+    // No copying - these are the original objects
+    this.sessionPassword = sessionPassword;
+    this.sessionMnemonic = sessionMnemonic;
+    const ownership = __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f");
+    if (ownership) {
+        ownership.tracker.current = ownership.token;
+        ownership.tracker.epoch++;
+    }
+}, _KeyringCore_finishUnlock = function _KeyringCore_finishUnlock() {
+    // Re-initialize syscoin transaction handler if it was cleared on lock.
+    // `lockWallet()` intentionally replaces it with a plain object to drop signer references,
+    // so we must restore the real class instance on unlock.
+    if (!this.syscoinTransaction ||
+        typeof this.syscoinTransaction.getRecommendedFee !== 'function') {
+        this.syscoinTransaction = this.createSyscoinTransactions();
+    }
+    // NOTE: Active account management is now handled by vault state/Redux
+    // No need to explicitly set active account after unlock - it's managed externally
+    const vault = this.getVault();
+    if (vault.activeAccount?.id !== undefined && vault.activeAccount?.type) {
+        // Check if the active account actually exists in the accounts map
+        const accountType = vault.activeAccount.type;
+        const accountId = vault.activeAccount.id;
+        const accountExists = vault.accounts?.[accountType]?.[accountId];
+        if (!accountExists) {
+            console.log(`[KeyringManager] Active account ${accountType}:${accountId} not found in accounts map. This may indicate a migration from old vault format.`);
+            // Signal that accounts need to be created after migration
+            return {
+                canLogin: true,
+                needsAccountCreation: true,
+            };
+        }
+        console.log(`[KeyringManager] Active account ${vault.activeAccount.id} available after unlock`);
+    }
+    return {
+        canLogin: true,
+    };
+}, _KeyringCore_installVaultSession = function _KeyringCore_installVaultSession(mnemonic, key, assertCurrent) {
+    const ciphertext = crypto_js_1.default.AES.encrypt(mnemonic, key).toString();
+    const password = new SecureBuffer(key);
+    const encryptedMnemonic = new SecureBuffer(ciphertext);
+    try {
+        assertCurrent?.();
+        __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_replaceSessionBuffers).call(this, password, encryptedMnemonic);
+    }
+    catch (error) {
+        password.clear();
+        encryptedMnemonic.clear();
+        throw error;
+    }
+}, _KeyringCore_recreateSessionFromVault = async function _KeyringCore_recreateSessionFromVault(saltedHashPassword, assertCurrent) {
+    try {
+        // v4 vault is encrypted with the derived session password key (PBKDF2 output)
+        // `saltedHashPassword` is the derived session password key passed by caller.
+        const { mnemonic } = await this.vaultPersistence.getDecryptedVault(saltedHashPassword);
+        assertCurrent?.();
+        if (!mnemonic) {
+            throw new Error('Mnemonic not found in vault');
+        }
+        __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_installVaultSession).call(this, mnemonic, saltedHashPassword, assertCurrent);
+        // Capture the installed revision before returning to the async caller.
+        if (assertCurrent)
+            return __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_captureSessionGuard).call(this);
+        console.log('[KeyringManager] Session data recreated from vault');
+        return undefined;
+    }
+    catch (error) {
+        console.error('ERROR recreateSessionFromVault', { error });
+        throw error;
+    }
+};
 //# sourceMappingURL=keyring-core.js.map