@sidhujag/sysweb3-keyring 2.1.2 → 2.1.4

package/cjs/keyring-core.js

@@ -32,9 +32,21 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
+var _KeyringCore_instances, _KeyringCore_deviceUnlockRetired, _KeyringCore_sessionOwnership, _KeyringCore_createDeviceUnlockControls, _KeyringCore_acceptSessionFrom, _KeyringCore_assertSessionOwner, _KeyringCore_captureSessionGuard, _KeyringCore_replaceSessionBuffers, _KeyringCore_finishUnlock, _KeyringCore_installVaultSession, _KeyringCore_recreateSessionFromVault;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KeyringCore = void 0;
 const secp256k1_1 = __importDefault(require("@bitcoinerlab/secp256k1"));
@@ -56,8 +68,10 @@ const SLH_DSA_DERIVATION_VERSION = 1;
 // Pali expands this setup secret into the 48-byte SLH skSeed/skPrf/pkSeed tuple.
 const SLH_DSA_SETUP_SECRET_HEX_LENGTH = 64;
 const SLH_DSA_PARAMETER_SET = 'SLH-DSA-SHA2-128-24';
+const current_vault_refusal_1 = require("./current-vault-refusal");
 const ethers_v6_1 = require("./ethers-v6");
 const initial_state_1 = require("./initial-state");
+const keyring_host_1 = require("./keyring-host");
 const private_records_1 = require("./private-records");
 const signers_1 = require("./signers");
 const software_hd_account_1 = require("./software-hd-account");
@@ -67,10 +81,32 @@ const evm_local_signer_1 = require("./transactions/evm-local-signer");
 const prepared_evm_1 = require("./transactions/prepared-evm");
 const syscoin_core_1 = require("./transactions/syscoin-core");
 const types_1 = require("./types");
-const blockbook_cache_1 = require("./utils/blockbook-cache");
 const derivation_paths_1 = require("./utils/derivation-paths");
+const owned_blockbook_account_1 = require("./utils/owned-blockbook-account");
 const psbt_account_scope_1 = require("./utils/psbt-account-scope");
 const watch_descriptor_1 = require("./utils/watch-descriptor");
+const currentVaultSalt = (keys) => {
+    const salt = keys && typeof keys === 'object' && Reflect.ownKeys(keys).length === 1
+        ? Object.getOwnPropertyDescriptor(keys, 'salt')?.value
+        : undefined;
+    return typeof salt === 'string' && /^[0-9a-f]{32}$/.test(salt)
+        ? salt
+        : undefined;
+};
+const readCurrentVaultPair = async (readPair) => {
+    const pair = await readPair();
+    if (pair === null)
+        return null;
+    const { vault, keys, pairFingerprint } = pair;
+    const salt = currentVaultSalt(keys);
+    if (typeof vault !== 'string' ||
+        salt === undefined ||
+        typeof pairFingerprint !== 'string' ||
+        !/^[0-9a-f]{64}$/.test(pairFingerprint)) {
+        throw new Error('Invalid device unlock vault pair');
+    }
+    return { vault, salt, pairFingerprint };
+};
 // Dynamic ETH HD path generation - will be computed as needed
 /**
  * Secure Buffer implementation for sensitive data
@@ -111,7 +147,8 @@ class SecureBuffer {
     }
 }
 class KeyringCore {
-    constructor(dependencies) {
+    constructor(binding, hardware) {
+        _KeyringCore_instances.add(this);
         // Store getter function for accessing Redux state
         this.getVaultState = null;
         // Method to inject store getter from Pali side
@@ -156,7 +193,9 @@ class KeyringCore {
         this.sessionPassword = null;
         this.sessionMnemonic = null; // can be a mnemonic or a zprv, can be changed to a zprv when using an imported wallet
         this.privateRecordSessionRevision = 0;
-        this.createSyscoinTransactions = () => new syscoin_core_1.SyscoinTransactionsCore(this.getSigner, this.getReadOnlySigner, this.getAccountsState, this.getAddress, this.syscoinHardwareSigners, this.capturePsbtSigningContext);
+        _KeyringCore_deviceUnlockRetired.set(this, false);
+        _KeyringCore_sessionOwnership.set(this, void 0);
+        this.createSyscoinTransactions = () => new syscoin_core_1.SyscoinTransactionsCore(this.getSigner, this.getReadOnlySigner, this.getAccountsState, this.syscoinHardwareSigners, this.capturePsbtSigningContext);
         this.requireLedgerSigner = () => {
             if (!this.ledgerSigner)
                 throw (0, syscoin_core_1.createHardwareSignerUnavailableError)('Ledger');
@@ -168,12 +207,6 @@ class KeyringCore {
             return this.trezorSigner;
         };
         // ===================================== PUBLIC METHODS - KEYRING MANAGER FOR HD - SYS ALL ===================================== //
-        this.setStorage = (client) => {
-            if (!this.storage.setClient) {
-                throw new Error('Storage replacement is unavailable in this host');
-            }
-            this.storage.setClient(client);
-        };
         this.validateAccountType = (account) => {
             return account.isImported === true
                 ? types_1.KeyringAccountType.Imported
@@ -191,6 +224,11 @@ class KeyringCore {
                 this.sessionMnemonic.clear();
                 this.sessionMnemonic = null;
             }
+            const ownership = __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f");
+            if (ownership.tracker.current === ownership.token) {
+                ownership.tracker.current = undefined;
+                ownership.tracker.epoch++;
+            }
             // Clear transaction handlers that may hold HD signers
             if (this.syscoinTransaction) {
                 // Replace with empty object to clear references
@@ -234,40 +272,13 @@ class KeyringCore {
             if (!this.sessionPassword || !this.sessionMnemonic) {
                 throw new Error('Session data is missing during transfer');
             }
+            __classPrivateFieldGet(targetKeyring, _KeyringCore_instances, "m", _KeyringCore_acceptSessionFrom).call(targetKeyring, this);
             this.privateRecordSessionRevision++;
-            targetKeyring.acceptSessionFrom(this);
+            __classPrivateFieldSet(this, _KeyringCore_deviceUnlockRetired, true, "f");
             // Null out our references (do NOT clear buffers - target owns them now)
             this.sessionPassword = null;
             this.sessionMnemonic = null;
         };
-        // The checked transfer path never dispatches through a public host receiver.
-        this.acceptSessionFrom = (source) => {
-            if (source.authority !== this.authority ||
-                source.storage !== this.storage ||
-                source.vaultPersistence !== this.vaultPersistence) {
-                throw new Error('Cannot transfer session between different wallet authorities');
-            }
-            if (!source.sessionPassword || !source.sessionMnemonic) {
-                throw new Error('Session data is missing during transfer');
-            }
-            this.replaceSessionBuffers(source.sessionPassword, source.sessionMnemonic);
-        };
-        // Legacy trusted-host API. SoftwareKeyring disables direct buffer injection.
-        this.receiveSessionOwnership = (sessionPassword, sessionMnemonic) => this.replaceSessionBuffers(sessionPassword, sessionMnemonic);
-        this.replaceSessionBuffers = (sessionPassword, sessionMnemonic) => {
-            this.privateRecordSessionRevision++;
-            // Clear any existing data first
-            if (this.sessionPassword) {
-                this.sessionPassword.clear();
-            }
-            if (this.sessionMnemonic) {
-                this.sessionMnemonic.clear();
-            }
-            // Take ownership of the actual SecureBuffer objects
-            // No copying - these are the original objects
-            this.sessionPassword = sessionPassword;
-            this.sessionMnemonic = sessionMnemonic;
-        };
         this.addNewAccount = async (label) => {
             // Check if wallet is unlocked
             if (!this.isUnlocked()) {
@@ -314,91 +325,41 @@ class KeyringCore {
                 xpub: derived.address,
             };
         };
-        this.getNewChangeAddress = async () => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[activeAccount.id];
-            if (!account) {
-                throw new Error('Active account not found');
-            }
-            const { xpub, isImported, address } = account;
-            // For imported single-address accounts, always return the single address
-            const looksLikeSingleAddress = isImported &&
-                xpub === address &&
-                !this.isDescriptor(xpub) &&
-                !this.isXpubLike(xpub);
-            if (looksLikeSingleAddress)
-                return address;
-            return await this.getAddress(xpub, true); // Don't skip increment - get next unused
-        };
-        this.getChangeAddress = async (id) => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[id];
-            if (!account) {
-                throw new Error(`Account with id ${id} not found`);
-            }
-            const { xpub, isImported, address } = account;
-            if (isImported &&
-                xpub === address &&
-                !this.isDescriptor(xpub) &&
-                !this.isXpubLike(xpub))
-                return address;
-            return await this.getAddress(xpub, true);
-        };
-        this.getPubkey = async (id, isChangeAddress) => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[id];
-            if (!account) {
-                throw new Error(`Account with id ${id} not found`);
-            }
-            const { xpub, isImported, address } = account;
-            // Guard: single-address imported are watch-only
-            if (isImported && xpub === address) {
-                throw new Error('Public key not available for single-address imported accounts');
-            }
-            // Guard: descriptor/xpub watch-only (no xprv and not hardware)
-            if (this.isWatchOnlyAccount(account)) {
-                throw new Error('Public key not available for watch-only accounts');
-            }
-            return await this.getCurrentAddressPubkey(xpub, isChangeAddress);
-        };
-        this.getBip32Path = async (id, isChangeAddress) => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[id];
-            if (!account) {
-                throw new Error(`Account with id ${id} not found`);
-            }
-            const { xpub, isImported, address } = account;
-            // Guard: single-address imported are watch-only
-            if (isImported && xpub === address) {
-                throw new Error('BIP32 path not available for single-address imported accounts');
-            }
-            // Guard: descriptor/xpub watch-only (no xprv and not hardware)
-            if (this.isWatchOnlyAccount(account)) {
-                throw new Error('BIP32 path not available for watch-only accounts');
-            }
-            return await this.getCurrentAddressBip32Path(xpub, isChangeAddress);
-        };
-        this.updateReceivingAddress = async () => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[activeAccount.id];
-            if (!account) {
-                throw new Error('Active account not found');
-            }
+        this.getActiveUtxoAddressAccount = (id, ownedRead) => {
+            const captured = (0, syscoin_core_1.captureOwnedSyscoinRead)(ownedRead, this.getAccountsState, this.capturePsbtSigningContext);
+            if (id !== captured.accountId)
+                throw new Error('UTXO account is not active');
+            const account = this.getVault().accounts[captured.accountType]?.[id];
+            captured.read.assertCurrent();
+            return { account, read: captured.read };
+        };
+        this.getNewChangeAddress = (ownedRead) => this.getChangeAddress(this.getVault().activeAccount.id, ownedRead);
+        this.getChangeAddress = async (id, ownedRead) => {
+            const { account, read } = this.getActiveUtxoAddressAccount(id, ownedRead);
+            return this.getAddressForUtxoAccount(account, true, read);
+        };
+        this.getPubkey = async (id, isChangeAddress, ownedRead) => {
+            const { account, read } = this.getActiveUtxoAddressAccount(id, ownedRead);
+            this.assertUtxoDerivationAvailable(account, 'Public key');
+            return this.getAddressPubkey(isChangeAddress, read);
+        };
+        this.getBip32Path = async (id, isChangeAddress, ownedRead) => {
+            const { account, read } = this.getActiveUtxoAddressAccount(id, ownedRead);
+            this.assertUtxoDerivationAvailable(account, 'BIP32 path');
+            return this.getAddressBip32Path(id, isChangeAddress, read);
+        };
+        this.updateReceivingAddress = async (ownedRead) => {
+            const { account, read } = this.getActiveUtxoAddressAccount(this.getVault().activeAccount.id, ownedRead);
+            return this.getAddressForUtxoAccount(account, false, read);
+        };
+        this.getAddressForUtxoAccount = (account, change, read) => {
             const { xpub, isImported, address } = account;
             if (isImported &&
                 xpub === address &&
                 !this.isDescriptor(xpub) &&
                 !this.isXpubLike(xpub))
-                return address;
-            const nextAddress = await this.getAddress(xpub, false);
-            // NOTE: Address updates should be dispatched to Redux store, not updated here
-            // The calling code should handle the Redux dispatch
-            return nextAddress;
+                return Promise.resolve(address);
+            return this.discoverUtxoAddress(change, read);
         };
         this.getAccountById = (id, accountType) => {
             const vault = this.getVault();
@@ -676,62 +637,56 @@ class KeyringCore {
         };
         this.getNetwork = () => this.getVault().activeNetwork;
         this.createEthAccount = (privateKey) => (0, evm_local_signer_1.privateKeyToAccount)(privateKey);
-        // Helper to get current account data from backend
-        this.fetchCurrentAccountData = async (xpub, isChangeAddress) => {
-            const vault = this.getVault();
-            const { activeNetwork } = vault;
-            // Use read-only signer for backend calls - works for all account types including hardware wallets
-            const { main } = this.getReadOnlySigner();
-            const options = 'tokens=used&details=tokens';
-            // In-flight deduplicated: concurrent callers within a send flow
-            // (fee estimation, PSBT creation, signing) share a single request
-            const { tokens } = await (0, blockbook_cache_1.fetchBackendAccountCached)(main.blockbookURL, xpub, options);
+        this.fetchCurrentAccountData = async (isChangeAddress, read) => {
+            read.assertCurrent();
+            const { tokens } = await (0, owned_blockbook_account_1.fetchOwnedBlockbookAccount)(read.network.url, read.xpub, read.transport);
+            read.assertCurrent();
             const { receivingIndex, changeIndex } = this.setLatestIndexesFromXPubTokens(tokens);
-            // Get network configuration for BIP84 using network-provided pub type macros
-            const networkConfig = (0, sysweb3_network_1.getNetworkConfig)(activeNetwork.slip44, activeNetwork.currency);
-            const pubTypes = networkConfig?.types?.zPubType;
-            if (!pubTypes) {
-                throw new Error('Missing zPubType in network configuration');
-            }
-            const networks = networkConfig.networks;
-            const currentAccount = new BIP84.fromZPub(xpub, pubTypes, networks);
-            const addressIndex = isChangeAddress ? changeIndex : receivingIndex;
             return {
-                currentAccount,
-                addressIndex,
-                main,
+                currentAccount: this.loadBip84AddressAccount(read.xpub, read.network),
+                addressIndex: isChangeAddress ? changeIndex : receivingIndex,
             };
         };
-        this.getAddress = async (xpub, isChangeAddress, options) => {
-            if (this.isDescriptor(xpub)) {
-                // The BIP84 history scanner below cannot choose a descriptor's next
-                // unused index. Import can derive index zero locally, but rotation must
-                // not reinterpret a descriptor as a BIP84 extended key.
-                if (!options?.forceIndex0) {
-                    throw new Error('Address rotation is not supported for watch-only descriptors');
-                }
-                return (0, watch_descriptor_1.deriveDescriptorAddress)(xpub, this.getVault().activeNetwork, {
-                    change: isChangeAddress,
-                });
-            }
-            const { currentAccount, addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
-            const effectiveIndex = options?.forceIndex0 ? 0 : addressIndex;
-            const address = currentAccount.getAddress(effectiveIndex, isChangeAddress, 84);
-            return address;
-        };
-        this.getCurrentAddressPubkey = async (xpub, isChangeAddress) => {
-            const { currentAccount, addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
-            // BIP84 returns the public key as a hex string directly
+        this.discoverUtxoAddress = async (isChangeAddress, read) => {
+            read.assertCurrent();
+            if (this.isDescriptor(read.xpub))
+                throw new Error('Address rotation is not supported for watch-only descriptors');
+            const { currentAccount, addressIndex } = await this.fetchCurrentAccountData(isChangeAddress, read);
+            read.assertCurrent();
+            return currentAccount.getAddress(addressIndex, isChangeAddress, 84);
+        };
+        this.getAddress = async (xpub, isChangeAddress, ownedRead) => {
+            const id = this.getVault().activeAccount.id;
+            const { account, read } = this.getActiveUtxoAddressAccount(id, ownedRead);
+            if (xpub !== read.xpub)
+                throw new Error('UTXO account is not active');
+            return this.getAddressForUtxoAccount(account, isChangeAddress, read);
+        };
+        this.getAddressPubkey = async (isChangeAddress, read) => {
+            const { currentAccount, addressIndex } = await this.fetchCurrentAccountData(isChangeAddress, read);
+            read.assertCurrent();
             return currentAccount.getPublicKey(addressIndex, isChangeAddress);
         };
-        this.getCurrentAddressBip32Path = async (xpub, isChangeAddress) => {
-            const vault = this.getVault();
-            const { activeAccount, activeNetwork } = vault;
-            const { addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
-            // Use the utility function to generate the proper derivation path
-            const coinShortcut = activeNetwork.currency.toLowerCase(); // e.g., 'sys', 'btc'
-            const path = (0, derivation_paths_1.getAddressDerivationPath)(coinShortcut, activeNetwork.slip44, activeAccount.id, isChangeAddress, addressIndex);
-            return path;
+        this.getCurrentAddressPubkey = async (xpub, isChangeAddress, ownedRead) => {
+            const id = this.getVault().activeAccount.id;
+            const { account, read } = this.getActiveUtxoAddressAccount(id, ownedRead);
+            if (xpub !== read.xpub)
+                throw new Error('UTXO account is not active');
+            this.assertUtxoDerivationAvailable(account, 'Public key');
+            return this.getAddressPubkey(isChangeAddress, read);
+        };
+        this.getAddressBip32Path = async (id, isChangeAddress, read) => {
+            const { addressIndex } = await this.fetchCurrentAccountData(isChangeAddress, read);
+            read.assertCurrent();
+            return (0, derivation_paths_1.getAddressDerivationPath)(read.network.currency.toLowerCase(), read.network.slip44, id, isChangeAddress, addressIndex);
+        };
+        this.getCurrentAddressBip32Path = async (xpub, isChangeAddress, ownedRead) => {
+            const id = this.getVault().activeAccount.id;
+            const { account, read } = this.getActiveUtxoAddressAccount(id, ownedRead);
+            if (xpub !== read.xpub)
+                throw new Error('UTXO account is not active');
+            this.assertUtxoDerivationAvailable(account, 'BIP32 path');
+            return this.getAddressBip32Path(id, isChangeAddress, read);
         };
         this.logout = () => {
             this.lockWallet();
@@ -817,8 +772,9 @@ class KeyringCore {
                 throw error;
             }
         };
-        this.capturePsbtSigningContext = () => {
+        this.capturePsbtSigningContext = (bindSessionRevision = true) => {
             const session = this.sessionPassword;
+            const revision = this.privateRecordSessionRevision;
             const vault = this.getVault();
             const selected = { ...vault.activeAccount };
             const account = vault.accounts[selected.type]?.[selected.id];
@@ -830,6 +786,8 @@ class KeyringCore {
                 if (!session ||
                     session.isCleared() ||
                     this.sessionPassword !== session ||
+                    (bindSessionRevision &&
+                        this.privateRecordSessionRevision !== revision) ||
                     current.activeAccount.id !== selected.id ||
                     current.activeAccount.type !== selected.type ||
                     currentAccount?.address !== identity.address ||
@@ -932,22 +890,32 @@ class KeyringCore {
             };
         };
         // Read-only version that works when wallet is locked
-        this.getReadOnlySigner = () => {
-            if (this.getActiveChain() !== sysweb3_network_1.INetworkType.Syscoin) {
+        this.getReadOnlySigner = (ownedRead) => {
+            ownedRead?.assertCurrent();
+            if ((ownedRead ? ownedRead.network.kind : this.getActiveChain()) !==
+                sysweb3_network_1.INetworkType.Syscoin) {
                 throw new Error('Switch to UTXO chain');
             }
             // Create syscoinjs instance without HD signer for read-only operations
-            const vault = this.getVault();
-            const network = vault.activeNetwork;
+            const network = ownedRead?.network ?? this.getVault().activeNetwork;
             const networkConfig = (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency);
             const isTestnet = network.slip44 === 1;
             const bitcoinjsNetwork = isTestnet
                 ? networkConfig?.networks?.testnet
                 : networkConfig?.networks?.mainnet;
+            if (ownedRead && !bitcoinjsNetwork)
+                throw new Error('Missing owned UTXO network configuration');
             const syscoinMainSigner = new syscoinjs.SyscoinJSLib(null, // No HD signer needed for read-only operations
-            network.url, bitcoinjsNetwork);
+            network.url, bitcoinjsNetwork, ...(ownedRead ? [ownedRead.transport] : []));
+            if (!ownedRead)
+                return { main: syscoinMainSigner };
             return {
                 main: syscoinMainSigner,
+                getOwnedAddress: (xpub, isChangeAddress) => {
+                    if (xpub !== ownedRead.xpub)
+                        throw new Error('UTXO account is not active');
+                    return this.discoverUtxoAddress(isChangeAddress, ownedRead);
+                },
             };
         };
         this.getAccountsState = () => {
@@ -1139,10 +1107,13 @@ class KeyringCore {
             if (!BIP84.validateMnemonic(seedPhrase)) {
                 throw new Error('Invalid Seed');
             }
+            const assertCurrent = __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_captureSessionGuard).call(this);
+            assertCurrent();
             const [vault, vaultKeys] = await Promise.all([
                 this.storage.get('vault'),
                 this.storage.get('vault-keys'),
             ]);
+            assertCurrent();
             const hasVault = vault !== undefined && vault !== null;
             const hasVaultKeys = vaultKeys !== undefined && vaultKeys !== null;
             const livePassword = this.sessionPassword;
@@ -1157,6 +1128,7 @@ class KeyringCore {
                     throw new Error('Cannot initialize a new vault over existing wallet storage');
                 }
                 const sessionPasswordSaltedHash = await this.deriveStoredSessionKey(password, vaultKeys);
+                assertCurrent();
                 if (livePassword === this.sessionPassword &&
                     liveMnemonic === this.sessionMnemonic &&
                     sessionPasswordSaltedHash === this.getSessionPasswordString()) {
@@ -1172,6 +1144,7 @@ class KeyringCore {
                     }
                     if (currentMnemonic === seedPhrase) {
                         const storedVault = await this.vaultPersistence.getDecryptedVault(sessionPasswordSaltedHash);
+                        assertCurrent();
                         if (livePassword === this.sessionPassword &&
                             liveMnemonic === this.sessionMnemonic &&
                             !livePassword.isCleared() &&
@@ -1197,8 +1170,10 @@ class KeyringCore {
                 mnemonic: seedPhrase, // Store plain mnemonic - setEncryptedVault will encrypt the entire vault
             }, 
             // v4 vault is encrypted with the derived session password key (PBKDF2 output)
-            sessionPasswordSaltedHash, { salt });
-            await this.recreateSessionFromVault(sessionPasswordSaltedHash);
+            sessionPasswordSaltedHash, { salt }, assertCurrent);
+            assertCurrent();
+            const assertInstalled = await __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_recreateSessionFromVault).call(this, sessionPasswordSaltedHash, assertCurrent);
+            assertInstalled();
         };
         // NEW: Create first account without signer setup
         this.createFirstAccount = async (label) => {
@@ -1237,27 +1212,30 @@ class KeyringCore {
             await this.initializeSession(seedPhrase, password);
             return await this.createFirstAccount();
         };
-        if (!dependencies ||
-            typeof dependencies.authority !== 'object' ||
-            dependencies.authority === null) {
-            throw new TypeError('Keyring core requires an explicit wallet authority');
-        }
-        if (typeof dependencies.vaultPersistence?.getDecryptedVault !== 'function' ||
-            typeof dependencies.vaultPersistence?.setEncryptedVault !== 'function') {
-            throw new TypeError('Keyring core requires bound vault persistence');
-        }
+        const dependencies = (0, keyring_host_1.takeKeyringHostBinding)(binding);
         this.authority = dependencies.authority;
+        __classPrivateFieldSet(this, _KeyringCore_sessionOwnership, {
+            tracker: dependencies.sessionOwner,
+            token: Symbol(),
+        }, "f");
         this.storage = dependencies.storage;
         this.vaultPersistence = dependencies.vaultPersistence;
-        this.ledgerSigner = dependencies.ledgerSigner;
-        this.trezorSigner = dependencies.trezorSigner;
-        this.syscoinHardwareSigners = { ...dependencies.syscoinHardwareSigners };
+        this.ledgerSigner = hardware.ledgerSigner;
+        this.trezorSigner = hardware.trezorSigner;
+        this.syscoinHardwareSigners = { ...hardware.syscoinHardwareSigners };
         this.writeUtf8Diagnostic(false);
         this.utf8Error = false;
         this.initialTrezorAccountState = initial_state_1.initialActiveTrezorAccountState;
         this.initialLedgerAccountState = initial_state_1.initialActiveLedgerAccountState;
         this.syscoinTransaction = this.createSyscoinTransactions();
         this.ethereumTransaction = new ethereum_1.EthereumTransactions(this.getNetwork, this.getDecryptedPrivateKey, this.getAccountsState, this.ledgerSigner, this.trezorSigner, this.capturePsbtSigningContext, dependencies.captureEvmSubmission);
+        if (dependencies.deviceUnlock) {
+            const { port, receive } = dependencies.deviceUnlock;
+            const readVaultPair = this.storage.readDeviceUnlockVaultPair;
+            if (typeof readVaultPair !== 'function')
+                throw new TypeError('Device unlock requires an atomic vault pair reader');
+            receive(__classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_createDeviceUnlockControls).call(this, port, readVaultPair.bind(this.storage)));
+        }
     }
     // Convenience method for complete setup after construction
     async initialize(seed, password, network) {
@@ -1277,18 +1255,31 @@ class KeyringCore {
      * not charge a failed password attempt for an operational error.
      */
     async unlock(password) {
+        let assertCurrent = __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_captureSessionGuard).call(this);
         let authenticated = false;
         try {
+            assertCurrent();
             const vaultKeys = await this.storage.get('vault-keys');
             if (!vaultKeys) {
+                assertCurrent();
                 throw new Error('Vault keys not found. Reload the wallet and try again.');
             }
             // v4: Validate password by deriving the session key once and decrypting the vault with it.
             // This avoids an extra KDF pass just for a stored verifier.
             const { salt } = vaultKeys;
+            const readVaultPair = this.storage.readDeviceUnlockVaultPair;
+            const accountingSalt = readVaultPair
+                ? currentVaultSalt(vaultKeys)
+                : undefined;
+            // Permit only an authenticated negative verdict for the same atomic
+            // pair after cancellation. Legacy migration and positive results stay guarded.
+            if (accountingSalt === undefined)
+                assertCurrent();
             // Derive session encryption key (in-memory only) used to encrypt/decrypt xprv fields
             // IMPORTANT: This MUST NOT be the same value as the stored verifier above.
-            let sessionPasswordKey = await this.deriveStoredSessionKey(password, vaultKeys);
+            let sessionPasswordKey = await this.deriveStoredSessionKey(password, accountingSalt === undefined ? vaultKeys : { salt: accountingSalt });
+            if (accountingSalt === undefined)
+                assertCurrent();
             // Handle migration from old vault format with currentSessionSalt
             if (vaultKeys.currentSessionSalt) {
                 console.log('[KeyringManager] Detected old vault format, handling session migration...');
@@ -1299,6 +1290,7 @@ class KeyringCore {
                 // derived key. Selecting by stored format also permits a safe retry
                 // if the vault write succeeded but the metadata write was interrupted.
                 const { mnemonic } = await this.vaultPersistence.getDecryptedVault(sessionPasswordKey, password);
+                assertCurrent();
                 authenticated = true;
                 const isValidSecret = (value) => {
                     if (typeof value !== 'string' || !value)
@@ -1338,13 +1330,16 @@ class KeyringCore {
                     throw new Error('Legacy vault secret could not be recovered. Existing vault preserved.');
                 }
                 // Do not change either stored record until a valid secret is recovered.
-                await this.vaultPersistence.setEncryptedVault({ mnemonic: decryptedMnemonic }, sessionPasswordKey);
+                await this.vaultPersistence.setEncryptedVault({ mnemonic: decryptedMnemonic }, sessionPasswordKey, undefined, assertCurrent);
+                assertCurrent();
                 console.log('[KeyringManager] Vault mnemonic format normalized');
                 // Remove currentSessionSalt from vault-keys (v4 keeps only the salt on disk)
                 const migratedVaultKeys = {
                     salt: vaultKeys.salt,
                 };
+                assertCurrent();
                 await this.storage.set('vault-keys', migratedVaultKeys);
+                assertCurrent();
                 console.log('[KeyringManager] Old vault format migration completed');
             }
             // v4 vault is encrypted with the derived session password key (PBKDF2 output).
@@ -1355,6 +1350,25 @@ class KeyringCore {
                 decryptedVault = await this.vaultPersistence.getDecryptedVault(sessionPasswordKey);
             }
             catch (error) {
+                const matchesRefusedVault = accountingSalt === undefined
+                    ? undefined
+                    : current_vault_refusal_1.currentVaultRefusals.get(error);
+                if (matchesRefusedVault && readVaultPair) {
+                    const pair = await readCurrentVaultPair(readVaultPair.bind(this.storage)).catch((readError) => {
+                        // A storage rejection cannot attest to password authentication.
+                        if (readError instanceof storage_core_1.VaultAuthenticationError)
+                            throw new Error('Wallet unlock vault read failed');
+                        throw readError;
+                    });
+                    if (!pair ||
+                        !matchesRefusedVault(pair.vault) ||
+                        pair.salt !== accountingSalt)
+                        throw new Error('Wallet unlock vault changed');
+                    // This exact negative result has no session authority. Keep it
+                    // available for the host counter even if its owner just retired.
+                    return { canLogin: false };
+                }
+                assertCurrent();
                 // Only the historical CBC fallback used the 20k key without metadata.
                 // Never try it for GCM, malformed records, or platform/storage failures.
                 const rawVault = error instanceof storage_core_1.VaultAuthenticationError &&
@@ -1362,65 +1376,54 @@ class KeyringCore {
                     !vaultKeys.currentSessionSalt
                     ? await this.storage.get('vault')
                     : undefined;
+                assertCurrent();
                 if (typeof rawVault !== 'string' || rawVault.trim().startsWith('{')) {
                     throw error;
                 }
                 const legacyKey = await this.deriveLegacySessionKey(password, salt);
+                assertCurrent();
                 decryptedVault = await this.vaultPersistence.getDecryptedVault(legacyKey);
+                assertCurrent();
                 authenticated = true;
                 sessionPasswordKey = legacyKey;
                 // Keep the historical account wrapping key. Persist its profile before
                 // GCM rewrapping so either interrupted write remains recoverable.
-                await this.storage.set('vault-keys', {
+                const migratedVaultKeys = {
                     ...vaultKeys,
                     keyDerivation: LEGACY_ENCRYPTION_KDF,
-                });
+                };
+                assertCurrent();
+                await this.storage.set('vault-keys', migratedVaultKeys);
+                assertCurrent();
                 legacyProfile = true;
             }
+            assertCurrent();
             authenticated = true;
             if (legacyProfile && this.hasWebCrypto()) {
                 const storedVault = await this.storage.get('vault');
+                assertCurrent();
                 if (typeof storedVault === 'string' &&
                     !storedVault.trim().startsWith('{')) {
                     // A failed earlier rewrap can leave the authenticated profile plus
                     // CBC. Retry that write without changing the account wrapping key.
-                    await this.vaultPersistence.setEncryptedVault(decryptedVault, sessionPasswordKey);
+                    await this.vaultPersistence.setEncryptedVault(decryptedVault, sessionPasswordKey, undefined, assertCurrent);
+                    assertCurrent();
                 }
             }
             // If session data missing or corrupted, recreate from vault
             if (!this.sessionMnemonic) {
-                await this.recreateSessionFromVault(sessionPasswordKey);
-            }
-            // Re-initialize syscoin transaction handler if it was cleared on lock.
-            // `lockWallet()` intentionally replaces it with a plain object to drop signer references,
-            // so we must restore the real class instance on unlock.
-            if (!this.syscoinTransaction ||
-                typeof this.syscoinTransaction.getRecommendedFee !== 'function') {
-                this.syscoinTransaction = this.createSyscoinTransactions();
-            }
-            // NOTE: Active account management is now handled by vault state/Redux
-            // No need to explicitly set active account after unlock - it's managed externally
-            const vault = this.getVault();
-            if (vault.activeAccount?.id !== undefined && vault.activeAccount?.type) {
-                // Check if the active account actually exists in the accounts map
-                const accountType = vault.activeAccount.type;
-                const accountId = vault.activeAccount.id;
-                const accountExists = vault.accounts?.[accountType]?.[accountId];
-                if (!accountExists) {
-                    console.log(`[KeyringManager] Active account ${accountType}:${accountId} not found in accounts map. This may indicate a migration from old vault format.`);
-                    // Signal that accounts need to be created after migration
-                    return {
-                        canLogin: true,
-                        needsAccountCreation: true,
-                    };
-                }
-                console.log(`[KeyringManager] Active account ${vault.activeAccount.id} available after unlock`);
+                assertCurrent = await __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_recreateSessionFromVault).call(this, sessionPasswordKey, assertCurrent);
+                assertCurrent();
+                console.log('[KeyringManager] Session data recreated from vault');
             }
-            return {
-                canLogin: true,
-            };
+            assertCurrent();
+            const result = __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_finishUnlock).call(this);
+            assertCurrent();
+            return result;
         }
         catch (error) {
+            // A superseded attempt must not report authentication or clear its winner.
+            assertCurrent();
             if (!authenticated && error instanceof storage_core_1.VaultAuthenticationError) {
                 return { canLogin: false };
             }
@@ -1432,6 +1435,12 @@ class KeyringCore {
             throw error;
         }
     }
+    assertUtxoDerivationAvailable(account, field) {
+        if (account.isImported && account.xpub === account.address)
+            throw new Error(`${field} not available for single-address imported accounts`);
+        if (this.isWatchOnlyAccount(account))
+            throw new Error(`${field} not available for watch-only accounts`);
+    }
     isWatchOnlyAccount(a) {
         if (a.isLedgerWallet || a.isTrezorWallet)
             return false;
@@ -1542,6 +1551,17 @@ class KeyringCore {
             throw error;
         }
     }
+    loadBip84AddressAccount(xpub, network) {
+        const { types, networks } = (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency);
+        if (!types?.zPubType)
+            throw new Error('Missing zPubType in network configuration');
+        return new BIP84.fromZPub(xpub, types.zPubType, networks);
+    }
+    deriveFirstUtxoAddress(xpub, network) {
+        if (this.isDescriptor(xpub))
+            return (0, watch_descriptor_1.deriveDescriptorAddress)(xpub, network);
+        return this.loadBip84AddressAccount(xpub, network).getAddress(0, false, 84);
+    }
     async importAccount(privKey, label, options) {
         // Check if wallet is unlocked
         if (!this.isUnlocked()) {
@@ -1579,9 +1599,7 @@ class KeyringCore {
                 ? types.zPubType.testnet.vpub
                 : types.zPubType.mainnet.zpub;
             const bip84Key = (0, derivation_paths_1.convertExtendedKeyVersion)(identifier, target);
-            addressToStore = await this.getAddress(bip84Key, false, {
-                forceIndex0: true,
-            });
+            addressToStore = this.deriveFirstUtxoAddress(bip84Key, activeNetwork);
         }
         // Validate duplicates across all account buckets, including passkey smart accounts.
         if (this.accountAddressExists(accounts, addressToStore) ||
@@ -1882,7 +1900,7 @@ class KeyringCore {
         if ((0, ethers_v6_1.getAddress)(key.address) !== request.account.expectedAddress)
             throw new Error('Prepared EVM signer address mismatch');
         assertCurrent();
-        const signed = (0, prepared_evm_1.signPreparedEvmEnvelope)(request.transaction, key.decryptedPrivateKey);
+        const { signed } = (0, prepared_evm_1.signPreparedEvmEnvelope)(request.transaction, key.decryptedPrivateKey);
         hostGuard();
         assertCurrent();
         return signed;
@@ -1986,7 +2004,7 @@ class KeyringCore {
         else {
             // For UTXO, use the xpub to derive the address
             // Always use first receive address (index 0) for imported account display
-            address = await this.getAddress(xpub, false, { forceIndex0: true });
+            address = this.deriveFirstUtxoAddress(xpub, vault.activeNetwork);
         }
         if (this.accountAddressExists(accounts, address, isEVM))
             throw new Error('Account already exists on your Wallet.');
@@ -2055,7 +2073,7 @@ class KeyringCore {
                 : types.zPubType.mainnet.zpub;
             xpub = (0, derivation_paths_1.convertExtendedKeyVersion)(ledgerXpub, bip84Target);
             // Always use first receive address (index 0) for imported account display
-            address = await this.getAddress(xpub, false, { forceIndex0: true });
+            address = this.deriveFirstUtxoAddress(xpub, vault.activeNetwork);
         }
         if (this.accountAddressExists(accounts, address, (0, derivation_paths_1.isEvmCoin)(coin, slip44)))
             throw new Error('Account already exists on your Wallet.');
@@ -2169,28 +2187,6 @@ class KeyringCore {
         // No gaps found, return next sequential ID
         return existingIds.length;
     }
-    async recreateSessionFromVault(saltedHashPassword) {
-        try {
-            // v4 vault is encrypted with the derived session password key (PBKDF2 output)
-            // `saltedHashPassword` is the derived session password key passed by caller.
-            const { mnemonic } = await this.vaultPersistence.getDecryptedVault(saltedHashPassword);
-            if (!mnemonic) {
-                throw new Error('Mnemonic not found in vault');
-            }
-            // Encrypt session data with sessionPassword hash for consistency
-            // This allows keyring manager to decrypt with this.sessionPassword
-            this.privateRecordSessionRevision++;
-            this.sessionPassword = new SecureBuffer(saltedHashPassword);
-            // Encrypt the mnemonic with session password for consistency with the rest of the code
-            const encryptedMnemonic = crypto_js_1.default.AES.encrypt(mnemonic, saltedHashPassword).toString();
-            this.sessionMnemonic = new SecureBuffer(encryptedMnemonic);
-            console.log('[KeyringManager] Session data recreated from vault');
-        }
-        catch (error) {
-            console.error('ERROR recreateSessionFromVault', { error });
-            throw error;
-        }
-    }
     async _getPrivateKeyAccountInfos(privKey, label, options) {
         const vault = this.getVault();
         const { accounts } = vault;
@@ -2595,6 +2591,8 @@ class KeyringCore {
      * Clean up all resources
      */
     async destroy() {
+        __classPrivateFieldSet(this, _KeyringCore_deviceUnlockRetired, true, "f");
+        __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f").destroyed = true;
         await this.lockWallet();
         // Clear any remaining references
         this.ethereumTransaction = {};
@@ -2602,4 +2600,222 @@ class KeyringCore {
     }
 }
 exports.KeyringCore = KeyringCore;
+_KeyringCore_deviceUnlockRetired = new WeakMap(), _KeyringCore_sessionOwnership = new WeakMap(), _KeyringCore_instances = new WeakSet(), _KeyringCore_createDeviceUnlockControls = function _KeyringCore_createDeviceUnlockControls(port, readVaultPair) {
+    const readPair = () => readCurrentVaultPair(readVaultPair);
+    let pending = false;
+    const run = async (request, assertCurrent) => {
+        if (pending)
+            throw new Error('Device unlock operation is busy');
+        pending = true;
+        const assertOwnership = __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_captureSessionGuard).call(this, 'Device unlock session changed');
+        const issuing = request !== null;
+        const check = () => {
+            const result = assertCurrent();
+            if (result !== undefined) {
+                // Reject async guards and consume a possible rejected promise.
+                if (result &&
+                    (typeof result === 'object' || typeof result === 'function'))
+                    void Promise.resolve(result).catch(() => undefined);
+                throw new TypeError('Device unlock guard must return undefined synchronously');
+            }
+            if (__classPrivateFieldGet(this, _KeyringCore_deviceUnlockRetired, "f") ||
+                (!issuing && (this.sessionPassword || this.sessionMnemonic))) {
+                throw new Error('Device unlock session changed');
+            }
+            assertOwnership();
+        };
+        let key;
+        try {
+            check();
+            const pair = await readPair();
+            check();
+            if (!pair)
+                return false;
+            const checkPair = async (requireLiveOwner = true) => {
+                const current = await readPair();
+                if (requireLiveOwner)
+                    check();
+                if (current?.pairFingerprint !== pair.pairFingerprint ||
+                    current.vault !== pair.vault ||
+                    current.salt !== pair.salt) {
+                    throw new Error('Device unlock vault changed');
+                }
+            };
+            if (request) {
+                key = this.hexToBytes(await this.deriveStoredSessionKey(request.password, {
+                    salt: pair.salt,
+                }));
+            }
+            else {
+                const credential = await port.readCredential(pair.pairFingerprint);
+                key = credential?.key;
+                check();
+                if (credential?.pairFingerprint !== pair.pairFingerprint)
+                    return false;
+            }
+            check();
+            if (!(key instanceof Uint8Array) || key.length !== 32)
+                return false;
+            const keyHex = Buffer.from(key.buffer, key.byteOffset, key.byteLength).toString('hex');
+            let payload;
+            try {
+                payload = await (0, storage_core_1.decryptCurrentVault)(pair.vault, keyHex);
+            }
+            catch (error) {
+                if (!(error instanceof storage_core_1.VaultAuthenticationError))
+                    throw error;
+                // Preserve a definitive wrong-password result for host accounting
+                // even if enrollment was cancelled. The pair must still match and
+                // this branch never installs a session or writes a credential.
+                await checkPair(!issuing);
+                if (!issuing)
+                    check();
+                return false;
+            }
+            check();
+            const mnemonic = payload && typeof payload === 'object'
+                ? Object.getOwnPropertyDescriptor(payload, 'mnemonic')?.value
+                : undefined;
+            if (typeof mnemonic !== 'string' || !this.isSeedValid(mnemonic)) {
+                throw new Error('Invalid device unlock vault payload');
+            }
+            await checkPair();
+            check();
+            if (request) {
+                const result = await port.writeCredential(Object.freeze({ pairFingerprint: pair.pairFingerprint, key }), check);
+                if (result !== undefined)
+                    throw new Error('Device unlock credential write was not acknowledged');
+                await checkPair();
+                check();
+            }
+            else {
+                if (__classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_finishUnlock).call(this).needsAccountCreation)
+                    return false;
+                __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_installVaultSession).call(this, mnemonic, keyHex, check);
+            }
+            return true;
+        }
+        finally {
+            if (key instanceof Uint8Array)
+                key.fill(0);
+            pending = false;
+        }
+    };
+    return Object.freeze({
+        issue: (password, assertCurrent) => {
+            if (typeof password !== 'string' || !password)
+                return Promise.reject(new TypeError('Wallet password is required'));
+            return run({ password }, assertCurrent);
+        },
+        resume: (assertCurrent) => run(null, assertCurrent),
+    });
+}, _KeyringCore_acceptSessionFrom = function _KeyringCore_acceptSessionFrom(source) {
+    if (source.authority !== this.authority ||
+        source.storage !== this.storage ||
+        source.vaultPersistence !== this.vaultPersistence ||
+        __classPrivateFieldGet(source, _KeyringCore_sessionOwnership, "f").tracker !== __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f").tracker) {
+        throw new Error('Cannot transfer session between different wallet authorities');
+    }
+    if (!source.sessionPassword || !source.sessionMnemonic) {
+        throw new Error('Session data is missing during transfer');
+    }
+    __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_replaceSessionBuffers).call(this, source.sessionPassword, source.sessionMnemonic, __classPrivateFieldGet(source, _KeyringCore_sessionOwnership, "f").token);
+}, _KeyringCore_assertSessionOwner = function _KeyringCore_assertSessionOwner(sourceToken) {
+    const ownership = __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f");
+    if (ownership.destroyed)
+        throw new Error('Wallet keyring was destroyed');
+    const owner = ownership.tracker.current;
+    if (sourceToken === undefined
+        ? owner !== undefined && owner !== ownership.token
+        : owner !== sourceToken) {
+        throw new Error('Wallet session is owned by another keyring');
+    }
+}, _KeyringCore_captureSessionGuard = function _KeyringCore_captureSessionGuard(message = 'Wallet unlock session changed') {
+    const ownership = __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f");
+    const revision = this.privateRecordSessionRevision;
+    const epoch = ownership.tracker.epoch;
+    return () => {
+        if (this.privateRecordSessionRevision !== revision)
+            throw new Error(message);
+        __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_assertSessionOwner).call(this);
+        if (ownership.tracker.epoch !== epoch)
+            throw new Error(message);
+    };
+}, _KeyringCore_replaceSessionBuffers = function _KeyringCore_replaceSessionBuffers(sessionPassword, sessionMnemonic, sourceToken) {
+    __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_assertSessionOwner).call(this, sourceToken);
+    this.privateRecordSessionRevision++;
+    // Clear any existing data first
+    if (this.sessionPassword) {
+        this.sessionPassword.clear();
+    }
+    if (this.sessionMnemonic) {
+        this.sessionMnemonic.clear();
+    }
+    // Take ownership of the actual SecureBuffer objects
+    // No copying - these are the original objects
+    this.sessionPassword = sessionPassword;
+    this.sessionMnemonic = sessionMnemonic;
+    const ownership = __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f");
+    ownership.tracker.current = ownership.token;
+    ownership.tracker.epoch++;
+}, _KeyringCore_finishUnlock = function _KeyringCore_finishUnlock() {
+    // Re-initialize syscoin transaction handler if it was cleared on lock.
+    // `lockWallet()` intentionally replaces it with a plain object to drop signer references,
+    // so we must restore the real class instance on unlock.
+    if (!this.syscoinTransaction ||
+        typeof this.syscoinTransaction.getRecommendedFee !== 'function') {
+        this.syscoinTransaction = this.createSyscoinTransactions();
+    }
+    // NOTE: Active account management is now handled by vault state/Redux
+    // No need to explicitly set active account after unlock - it's managed externally
+    const vault = this.getVault();
+    if (vault.activeAccount?.id !== undefined && vault.activeAccount?.type) {
+        // Check if the active account actually exists in the accounts map
+        const accountType = vault.activeAccount.type;
+        const accountId = vault.activeAccount.id;
+        const accountExists = vault.accounts?.[accountType]?.[accountId];
+        if (!accountExists) {
+            console.log(`[KeyringManager] Active account ${accountType}:${accountId} not found in accounts map. This may indicate a migration from old vault format.`);
+            // Signal that accounts need to be created after migration
+            return {
+                canLogin: true,
+                needsAccountCreation: true,
+            };
+        }
+        console.log(`[KeyringManager] Active account ${vault.activeAccount.id} available after unlock`);
+    }
+    return {
+        canLogin: true,
+    };
+}, _KeyringCore_installVaultSession = function _KeyringCore_installVaultSession(mnemonic, key, assertCurrent) {
+    const ciphertext = crypto_js_1.default.AES.encrypt(mnemonic, key).toString();
+    const password = new SecureBuffer(key);
+    const encryptedMnemonic = new SecureBuffer(ciphertext);
+    try {
+        assertCurrent?.();
+        __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_replaceSessionBuffers).call(this, password, encryptedMnemonic);
+    }
+    catch (error) {
+        password.clear();
+        encryptedMnemonic.clear();
+        throw error;
+    }
+}, _KeyringCore_recreateSessionFromVault = async function _KeyringCore_recreateSessionFromVault(saltedHashPassword, assertCurrent) {
+    try {
+        // v4 vault is encrypted with the derived session password key (PBKDF2 output)
+        // `saltedHashPassword` is the derived session password key passed by caller.
+        const { mnemonic } = await this.vaultPersistence.getDecryptedVault(saltedHashPassword);
+        assertCurrent();
+        if (!mnemonic) {
+            throw new Error('Mnemonic not found in vault');
+        }
+        __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_installVaultSession).call(this, mnemonic, saltedHashPassword, assertCurrent);
+        // Capture the installed revision before returning to the async caller.
+        return __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_captureSessionGuard).call(this);
+    }
+    catch (error) {
+        console.error('ERROR recreateSessionFromVault', { error });
+        throw error;
+    }
+};
 //# sourceMappingURL=keyring-core.js.map