@sidhujag/sysweb3-keyring 2.1.3 → 2.1.4

package/cjs/keyring-core.js

@@ -71,6 +71,7 @@ const SLH_DSA_PARAMETER_SET = 'SLH-DSA-SHA2-128-24';
 const current_vault_refusal_1 = require("./current-vault-refusal");
 const ethers_v6_1 = require("./ethers-v6");
 const initial_state_1 = require("./initial-state");
+const keyring_host_1 = require("./keyring-host");
 const private_records_1 = require("./private-records");
 const signers_1 = require("./signers");
 const software_hd_account_1 = require("./software-hd-account");
@@ -80,8 +81,8 @@ const evm_local_signer_1 = require("./transactions/evm-local-signer");
 const prepared_evm_1 = require("./transactions/prepared-evm");
 const syscoin_core_1 = require("./transactions/syscoin-core");
 const types_1 = require("./types");
-const blockbook_cache_1 = require("./utils/blockbook-cache");
 const derivation_paths_1 = require("./utils/derivation-paths");
+const owned_blockbook_account_1 = require("./utils/owned-blockbook-account");
 const psbt_account_scope_1 = require("./utils/psbt-account-scope");
 const watch_descriptor_1 = require("./utils/watch-descriptor");
 const currentVaultSalt = (keys) => {
@@ -146,7 +147,7 @@ class SecureBuffer {
     }
 }
 class KeyringCore {
-    constructor(dependencies) {
+    constructor(binding, hardware) {
         _KeyringCore_instances.add(this);
         // Store getter function for accessing Redux state
         this.getVaultState = null;
@@ -194,7 +195,7 @@ class KeyringCore {
         this.privateRecordSessionRevision = 0;
         _KeyringCore_deviceUnlockRetired.set(this, false);
         _KeyringCore_sessionOwnership.set(this, void 0);
-        this.createSyscoinTransactions = () => new syscoin_core_1.SyscoinTransactionsCore(this.getSigner, this.getReadOnlySigner, this.getAccountsState, this.getAddress, this.syscoinHardwareSigners, this.capturePsbtSigningContext);
+        this.createSyscoinTransactions = () => new syscoin_core_1.SyscoinTransactionsCore(this.getSigner, this.getReadOnlySigner, this.getAccountsState, this.syscoinHardwareSigners, this.capturePsbtSigningContext);
         this.requireLedgerSigner = () => {
             if (!this.ledgerSigner)
                 throw (0, syscoin_core_1.createHardwareSignerUnavailableError)('Ledger');
@@ -206,12 +207,6 @@ class KeyringCore {
             return this.trezorSigner;
         };
         // ===================================== PUBLIC METHODS - KEYRING MANAGER FOR HD - SYS ALL ===================================== //
-        this.setStorage = (client) => {
-            if (!this.storage.setClient) {
-                throw new Error('Storage replacement is unavailable in this host');
-            }
-            this.storage.setClient(client);
-        };
         this.validateAccountType = (account) => {
             return account.isImported === true
                 ? types_1.KeyringAccountType.Imported
@@ -230,7 +225,7 @@ class KeyringCore {
                 this.sessionMnemonic = null;
             }
             const ownership = __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f");
-            if (ownership && ownership.tracker.current === ownership.token) {
+            if (ownership.tracker.current === ownership.token) {
                 ownership.tracker.current = undefined;
                 ownership.tracker.epoch++;
             }
@@ -284,8 +279,6 @@ class KeyringCore {
             this.sessionPassword = null;
             this.sessionMnemonic = null;
         };
-        // Legacy trusted-host API. SoftwareKeyring disables direct buffer injection.
-        this.receiveSessionOwnership = (sessionPassword, sessionMnemonic) => __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_replaceSessionBuffers).call(this, sessionPassword, sessionMnemonic);
         this.addNewAccount = async (label) => {
             // Check if wallet is unlocked
             if (!this.isUnlocked()) {
@@ -332,91 +325,41 @@ class KeyringCore {
                 xpub: derived.address,
             };
         };
-        this.getNewChangeAddress = async () => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[activeAccount.id];
-            if (!account) {
-                throw new Error('Active account not found');
-            }
-            const { xpub, isImported, address } = account;
-            // For imported single-address accounts, always return the single address
-            const looksLikeSingleAddress = isImported &&
-                xpub === address &&
-                !this.isDescriptor(xpub) &&
-                !this.isXpubLike(xpub);
-            if (looksLikeSingleAddress)
-                return address;
-            return await this.getAddress(xpub, true); // Don't skip increment - get next unused
-        };
-        this.getChangeAddress = async (id) => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[id];
-            if (!account) {
-                throw new Error(`Account with id ${id} not found`);
-            }
-            const { xpub, isImported, address } = account;
-            if (isImported &&
-                xpub === address &&
-                !this.isDescriptor(xpub) &&
-                !this.isXpubLike(xpub))
-                return address;
-            return await this.getAddress(xpub, true);
-        };
-        this.getPubkey = async (id, isChangeAddress) => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[id];
-            if (!account) {
-                throw new Error(`Account with id ${id} not found`);
-            }
-            const { xpub, isImported, address } = account;
-            // Guard: single-address imported are watch-only
-            if (isImported && xpub === address) {
-                throw new Error('Public key not available for single-address imported accounts');
-            }
-            // Guard: descriptor/xpub watch-only (no xprv and not hardware)
-            if (this.isWatchOnlyAccount(account)) {
-                throw new Error('Public key not available for watch-only accounts');
-            }
-            return await this.getCurrentAddressPubkey(xpub, isChangeAddress);
-        };
-        this.getBip32Path = async (id, isChangeAddress) => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[id];
-            if (!account) {
-                throw new Error(`Account with id ${id} not found`);
-            }
-            const { xpub, isImported, address } = account;
-            // Guard: single-address imported are watch-only
-            if (isImported && xpub === address) {
-                throw new Error('BIP32 path not available for single-address imported accounts');
-            }
-            // Guard: descriptor/xpub watch-only (no xprv and not hardware)
-            if (this.isWatchOnlyAccount(account)) {
-                throw new Error('BIP32 path not available for watch-only accounts');
-            }
-            return await this.getCurrentAddressBip32Path(xpub, isChangeAddress);
-        };
-        this.updateReceivingAddress = async () => {
-            const vault = this.getVault();
-            const { accounts, activeAccount } = vault;
-            const account = accounts[activeAccount.type]?.[activeAccount.id];
-            if (!account) {
-                throw new Error('Active account not found');
-            }
+        this.getActiveUtxoAddressAccount = (id, ownedRead) => {
+            const captured = (0, syscoin_core_1.captureOwnedSyscoinRead)(ownedRead, this.getAccountsState, this.capturePsbtSigningContext);
+            if (id !== captured.accountId)
+                throw new Error('UTXO account is not active');
+            const account = this.getVault().accounts[captured.accountType]?.[id];
+            captured.read.assertCurrent();
+            return { account, read: captured.read };
+        };
+        this.getNewChangeAddress = (ownedRead) => this.getChangeAddress(this.getVault().activeAccount.id, ownedRead);
+        this.getChangeAddress = async (id, ownedRead) => {
+            const { account, read } = this.getActiveUtxoAddressAccount(id, ownedRead);
+            return this.getAddressForUtxoAccount(account, true, read);
+        };
+        this.getPubkey = async (id, isChangeAddress, ownedRead) => {
+            const { account, read } = this.getActiveUtxoAddressAccount(id, ownedRead);
+            this.assertUtxoDerivationAvailable(account, 'Public key');
+            return this.getAddressPubkey(isChangeAddress, read);
+        };
+        this.getBip32Path = async (id, isChangeAddress, ownedRead) => {
+            const { account, read } = this.getActiveUtxoAddressAccount(id, ownedRead);
+            this.assertUtxoDerivationAvailable(account, 'BIP32 path');
+            return this.getAddressBip32Path(id, isChangeAddress, read);
+        };
+        this.updateReceivingAddress = async (ownedRead) => {
+            const { account, read } = this.getActiveUtxoAddressAccount(this.getVault().activeAccount.id, ownedRead);
+            return this.getAddressForUtxoAccount(account, false, read);
+        };
+        this.getAddressForUtxoAccount = (account, change, read) => {
             const { xpub, isImported, address } = account;
             if (isImported &&
                 xpub === address &&
                 !this.isDescriptor(xpub) &&
                 !this.isXpubLike(xpub))
-                return address;
-            const nextAddress = await this.getAddress(xpub, false);
-            // NOTE: Address updates should be dispatched to Redux store, not updated here
-            // The calling code should handle the Redux dispatch
-            return nextAddress;
+                return Promise.resolve(address);
+            return this.discoverUtxoAddress(change, read);
         };
         this.getAccountById = (id, accountType) => {
             const vault = this.getVault();
@@ -694,62 +637,56 @@ class KeyringCore {
         };
         this.getNetwork = () => this.getVault().activeNetwork;
         this.createEthAccount = (privateKey) => (0, evm_local_signer_1.privateKeyToAccount)(privateKey);
-        // Helper to get current account data from backend
-        this.fetchCurrentAccountData = async (xpub, isChangeAddress) => {
-            const vault = this.getVault();
-            const { activeNetwork } = vault;
-            // Use read-only signer for backend calls - works for all account types including hardware wallets
-            const { main } = this.getReadOnlySigner();
-            const options = 'tokens=used&details=tokens';
-            // In-flight deduplicated: concurrent callers within a send flow
-            // (fee estimation, PSBT creation, signing) share a single request
-            const { tokens } = await (0, blockbook_cache_1.fetchBackendAccountCached)(main.blockbookURL, xpub, options);
+        this.fetchCurrentAccountData = async (isChangeAddress, read) => {
+            read.assertCurrent();
+            const { tokens } = await (0, owned_blockbook_account_1.fetchOwnedBlockbookAccount)(read.network.url, read.xpub, read.transport);
+            read.assertCurrent();
             const { receivingIndex, changeIndex } = this.setLatestIndexesFromXPubTokens(tokens);
-            // Get network configuration for BIP84 using network-provided pub type macros
-            const networkConfig = (0, sysweb3_network_1.getNetworkConfig)(activeNetwork.slip44, activeNetwork.currency);
-            const pubTypes = networkConfig?.types?.zPubType;
-            if (!pubTypes) {
-                throw new Error('Missing zPubType in network configuration');
-            }
-            const networks = networkConfig.networks;
-            const currentAccount = new BIP84.fromZPub(xpub, pubTypes, networks);
-            const addressIndex = isChangeAddress ? changeIndex : receivingIndex;
             return {
-                currentAccount,
-                addressIndex,
-                main,
+                currentAccount: this.loadBip84AddressAccount(read.xpub, read.network),
+                addressIndex: isChangeAddress ? changeIndex : receivingIndex,
             };
         };
-        this.getAddress = async (xpub, isChangeAddress, options) => {
-            if (this.isDescriptor(xpub)) {
-                // The BIP84 history scanner below cannot choose a descriptor's next
-                // unused index. Import can derive index zero locally, but rotation must
-                // not reinterpret a descriptor as a BIP84 extended key.
-                if (!options?.forceIndex0) {
-                    throw new Error('Address rotation is not supported for watch-only descriptors');
-                }
-                return (0, watch_descriptor_1.deriveDescriptorAddress)(xpub, this.getVault().activeNetwork, {
-                    change: isChangeAddress,
-                });
-            }
-            const { currentAccount, addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
-            const effectiveIndex = options?.forceIndex0 ? 0 : addressIndex;
-            const address = currentAccount.getAddress(effectiveIndex, isChangeAddress, 84);
-            return address;
-        };
-        this.getCurrentAddressPubkey = async (xpub, isChangeAddress) => {
-            const { currentAccount, addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
-            // BIP84 returns the public key as a hex string directly
+        this.discoverUtxoAddress = async (isChangeAddress, read) => {
+            read.assertCurrent();
+            if (this.isDescriptor(read.xpub))
+                throw new Error('Address rotation is not supported for watch-only descriptors');
+            const { currentAccount, addressIndex } = await this.fetchCurrentAccountData(isChangeAddress, read);
+            read.assertCurrent();
+            return currentAccount.getAddress(addressIndex, isChangeAddress, 84);
+        };
+        this.getAddress = async (xpub, isChangeAddress, ownedRead) => {
+            const id = this.getVault().activeAccount.id;
+            const { account, read } = this.getActiveUtxoAddressAccount(id, ownedRead);
+            if (xpub !== read.xpub)
+                throw new Error('UTXO account is not active');
+            return this.getAddressForUtxoAccount(account, isChangeAddress, read);
+        };
+        this.getAddressPubkey = async (isChangeAddress, read) => {
+            const { currentAccount, addressIndex } = await this.fetchCurrentAccountData(isChangeAddress, read);
+            read.assertCurrent();
             return currentAccount.getPublicKey(addressIndex, isChangeAddress);
         };
-        this.getCurrentAddressBip32Path = async (xpub, isChangeAddress) => {
-            const vault = this.getVault();
-            const { activeAccount, activeNetwork } = vault;
-            const { addressIndex } = await this.fetchCurrentAccountData(xpub, isChangeAddress);
-            // Use the utility function to generate the proper derivation path
-            const coinShortcut = activeNetwork.currency.toLowerCase(); // e.g., 'sys', 'btc'
-            const path = (0, derivation_paths_1.getAddressDerivationPath)(coinShortcut, activeNetwork.slip44, activeAccount.id, isChangeAddress, addressIndex);
-            return path;
+        this.getCurrentAddressPubkey = async (xpub, isChangeAddress, ownedRead) => {
+            const id = this.getVault().activeAccount.id;
+            const { account, read } = this.getActiveUtxoAddressAccount(id, ownedRead);
+            if (xpub !== read.xpub)
+                throw new Error('UTXO account is not active');
+            this.assertUtxoDerivationAvailable(account, 'Public key');
+            return this.getAddressPubkey(isChangeAddress, read);
+        };
+        this.getAddressBip32Path = async (id, isChangeAddress, read) => {
+            const { addressIndex } = await this.fetchCurrentAccountData(isChangeAddress, read);
+            read.assertCurrent();
+            return (0, derivation_paths_1.getAddressDerivationPath)(read.network.currency.toLowerCase(), read.network.slip44, id, isChangeAddress, addressIndex);
+        };
+        this.getCurrentAddressBip32Path = async (xpub, isChangeAddress, ownedRead) => {
+            const id = this.getVault().activeAccount.id;
+            const { account, read } = this.getActiveUtxoAddressAccount(id, ownedRead);
+            if (xpub !== read.xpub)
+                throw new Error('UTXO account is not active');
+            this.assertUtxoDerivationAvailable(account, 'BIP32 path');
+            return this.getAddressBip32Path(id, isChangeAddress, read);
         };
         this.logout = () => {
             this.lockWallet();
@@ -835,8 +772,9 @@ class KeyringCore {
                 throw error;
             }
         };
-        this.capturePsbtSigningContext = () => {
+        this.capturePsbtSigningContext = (bindSessionRevision = true) => {
             const session = this.sessionPassword;
+            const revision = this.privateRecordSessionRevision;
             const vault = this.getVault();
             const selected = { ...vault.activeAccount };
             const account = vault.accounts[selected.type]?.[selected.id];
@@ -848,6 +786,8 @@ class KeyringCore {
                 if (!session ||
                     session.isCleared() ||
                     this.sessionPassword !== session ||
+                    (bindSessionRevision &&
+                        this.privateRecordSessionRevision !== revision) ||
                     current.activeAccount.id !== selected.id ||
                     current.activeAccount.type !== selected.type ||
                     currentAccount?.address !== identity.address ||
@@ -950,22 +890,32 @@ class KeyringCore {
             };
         };
         // Read-only version that works when wallet is locked
-        this.getReadOnlySigner = () => {
-            if (this.getActiveChain() !== sysweb3_network_1.INetworkType.Syscoin) {
+        this.getReadOnlySigner = (ownedRead) => {
+            ownedRead?.assertCurrent();
+            if ((ownedRead ? ownedRead.network.kind : this.getActiveChain()) !==
+                sysweb3_network_1.INetworkType.Syscoin) {
                 throw new Error('Switch to UTXO chain');
             }
             // Create syscoinjs instance without HD signer for read-only operations
-            const vault = this.getVault();
-            const network = vault.activeNetwork;
+            const network = ownedRead?.network ?? this.getVault().activeNetwork;
             const networkConfig = (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency);
             const isTestnet = network.slip44 === 1;
             const bitcoinjsNetwork = isTestnet
                 ? networkConfig?.networks?.testnet
                 : networkConfig?.networks?.mainnet;
+            if (ownedRead && !bitcoinjsNetwork)
+                throw new Error('Missing owned UTXO network configuration');
             const syscoinMainSigner = new syscoinjs.SyscoinJSLib(null, // No HD signer needed for read-only operations
-            network.url, bitcoinjsNetwork);
+            network.url, bitcoinjsNetwork, ...(ownedRead ? [ownedRead.transport] : []));
+            if (!ownedRead)
+                return { main: syscoinMainSigner };
             return {
                 main: syscoinMainSigner,
+                getOwnedAddress: (xpub, isChangeAddress) => {
+                    if (xpub !== ownedRead.xpub)
+                        throw new Error('UTXO account is not active');
+                    return this.discoverUtxoAddress(isChangeAddress, ownedRead);
+                },
             };
         };
         this.getAccountsState = () => {
@@ -1157,10 +1107,13 @@ class KeyringCore {
             if (!BIP84.validateMnemonic(seedPhrase)) {
                 throw new Error('Invalid Seed');
             }
+            const assertCurrent = __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_captureSessionGuard).call(this);
+            assertCurrent();
             const [vault, vaultKeys] = await Promise.all([
                 this.storage.get('vault'),
                 this.storage.get('vault-keys'),
             ]);
+            assertCurrent();
             const hasVault = vault !== undefined && vault !== null;
             const hasVaultKeys = vaultKeys !== undefined && vaultKeys !== null;
             const livePassword = this.sessionPassword;
@@ -1175,6 +1128,7 @@ class KeyringCore {
                     throw new Error('Cannot initialize a new vault over existing wallet storage');
                 }
                 const sessionPasswordSaltedHash = await this.deriveStoredSessionKey(password, vaultKeys);
+                assertCurrent();
                 if (livePassword === this.sessionPassword &&
                     liveMnemonic === this.sessionMnemonic &&
                     sessionPasswordSaltedHash === this.getSessionPasswordString()) {
@@ -1190,6 +1144,7 @@ class KeyringCore {
                     }
                     if (currentMnemonic === seedPhrase) {
                         const storedVault = await this.vaultPersistence.getDecryptedVault(sessionPasswordSaltedHash);
+                        assertCurrent();
                         if (livePassword === this.sessionPassword &&
                             liveMnemonic === this.sessionMnemonic &&
                             !livePassword.isCleared() &&
@@ -1215,8 +1170,10 @@ class KeyringCore {
                 mnemonic: seedPhrase, // Store plain mnemonic - setEncryptedVault will encrypt the entire vault
             }, 
             // v4 vault is encrypted with the derived session password key (PBKDF2 output)
-            sessionPasswordSaltedHash, { salt });
-            await __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_recreateSessionFromVault).call(this, sessionPasswordSaltedHash);
+            sessionPasswordSaltedHash, { salt }, assertCurrent);
+            assertCurrent();
+            const assertInstalled = await __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_recreateSessionFromVault).call(this, sessionPasswordSaltedHash, assertCurrent);
+            assertInstalled();
         };
         // NEW: Create first account without signer setup
         this.createFirstAccount = async (label) => {
@@ -1255,27 +1212,17 @@ class KeyringCore {
             await this.initializeSession(seedPhrase, password);
             return await this.createFirstAccount();
         };
-        if (!dependencies ||
-            typeof dependencies.authority !== 'object' ||
-            dependencies.authority === null) {
-            throw new TypeError('Keyring core requires an explicit wallet authority');
-        }
-        if (typeof dependencies.vaultPersistence?.getDecryptedVault !== 'function' ||
-            typeof dependencies.vaultPersistence?.setEncryptedVault !== 'function') {
-            throw new TypeError('Keyring core requires bound vault persistence');
-        }
+        const dependencies = (0, keyring_host_1.takeKeyringHostBinding)(binding);
         this.authority = dependencies.authority;
-        if (dependencies.sessionOwner) {
-            __classPrivateFieldSet(this, _KeyringCore_sessionOwnership, {
-                tracker: dependencies.sessionOwner,
-                token: Symbol(),
-            }, "f");
-        }
+        __classPrivateFieldSet(this, _KeyringCore_sessionOwnership, {
+            tracker: dependencies.sessionOwner,
+            token: Symbol(),
+        }, "f");
         this.storage = dependencies.storage;
         this.vaultPersistence = dependencies.vaultPersistence;
-        this.ledgerSigner = dependencies.ledgerSigner;
-        this.trezorSigner = dependencies.trezorSigner;
-        this.syscoinHardwareSigners = { ...dependencies.syscoinHardwareSigners };
+        this.ledgerSigner = hardware.ledgerSigner;
+        this.trezorSigner = hardware.trezorSigner;
+        this.syscoinHardwareSigners = { ...hardware.syscoinHardwareSigners };
         this.writeUtf8Diagnostic(false);
         this.utf8Error = false;
         this.initialTrezorAccountState = initial_state_1.initialActiveTrezorAccountState;
@@ -1283,8 +1230,6 @@ class KeyringCore {
         this.syscoinTransaction = this.createSyscoinTransactions();
         this.ethereumTransaction = new ethereum_1.EthereumTransactions(this.getNetwork, this.getDecryptedPrivateKey, this.getAccountsState, this.ledgerSigner, this.trezorSigner, this.capturePsbtSigningContext, dependencies.captureEvmSubmission);
         if (dependencies.deviceUnlock) {
-            if (!__classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f"))
-                throw new TypeError('Device unlock requires a session owner');
             const { port, receive } = dependencies.deviceUnlock;
             const readVaultPair = this.storage.readDeviceUnlockVaultPair;
             if (typeof readVaultPair !== 'function')
@@ -1313,25 +1258,28 @@ class KeyringCore {
         let assertCurrent = __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_captureSessionGuard).call(this);
         let authenticated = false;
         try {
-            assertCurrent?.();
+            assertCurrent();
             const vaultKeys = await this.storage.get('vault-keys');
-            assertCurrent?.();
             if (!vaultKeys) {
+                assertCurrent();
                 throw new Error('Vault keys not found. Reload the wallet and try again.');
             }
             // v4: Validate password by deriving the session key once and decrypting the vault with it.
             // This avoids an extra KDF pass just for a stored verifier.
             const { salt } = vaultKeys;
-            const readVaultPair = assertCurrent
-                ? this.storage.readDeviceUnlockVaultPair
-                : undefined;
+            const readVaultPair = this.storage.readDeviceUnlockVaultPair;
             const accountingSalt = readVaultPair
                 ? currentVaultSalt(vaultKeys)
                 : undefined;
+            // Permit only an authenticated negative verdict for the same atomic
+            // pair after cancellation. Legacy migration and positive results stay guarded.
+            if (accountingSalt === undefined)
+                assertCurrent();
             // Derive session encryption key (in-memory only) used to encrypt/decrypt xprv fields
             // IMPORTANT: This MUST NOT be the same value as the stored verifier above.
             let sessionPasswordKey = await this.deriveStoredSessionKey(password, accountingSalt === undefined ? vaultKeys : { salt: accountingSalt });
-            assertCurrent?.();
+            if (accountingSalt === undefined)
+                assertCurrent();
             // Handle migration from old vault format with currentSessionSalt
             if (vaultKeys.currentSessionSalt) {
                 console.log('[KeyringManager] Detected old vault format, handling session migration...');
@@ -1342,7 +1290,7 @@ class KeyringCore {
                 // derived key. Selecting by stored format also permits a safe retry
                 // if the vault write succeeded but the metadata write was interrupted.
                 const { mnemonic } = await this.vaultPersistence.getDecryptedVault(sessionPasswordKey, password);
-                assertCurrent?.();
+                assertCurrent();
                 authenticated = true;
                 const isValidSecret = (value) => {
                     if (typeof value !== 'string' || !value)
@@ -1383,15 +1331,15 @@ class KeyringCore {
                 }
                 // Do not change either stored record until a valid secret is recovered.
                 await this.vaultPersistence.setEncryptedVault({ mnemonic: decryptedMnemonic }, sessionPasswordKey, undefined, assertCurrent);
-                assertCurrent?.();
+                assertCurrent();
                 console.log('[KeyringManager] Vault mnemonic format normalized');
                 // Remove currentSessionSalt from vault-keys (v4 keeps only the salt on disk)
                 const migratedVaultKeys = {
                     salt: vaultKeys.salt,
                 };
-                assertCurrent?.();
+                assertCurrent();
                 await this.storage.set('vault-keys', migratedVaultKeys);
-                assertCurrent?.();
+                assertCurrent();
                 console.log('[KeyringManager] Old vault format migration completed');
             }
             // v4 vault is encrypted with the derived session password key (PBKDF2 output).
@@ -1420,7 +1368,7 @@ class KeyringCore {
                     // available for the host counter even if its owner just retired.
                     return { canLogin: false };
                 }
-                assertCurrent?.();
+                assertCurrent();
                 // Only the historical CBC fallback used the 20k key without metadata.
                 // Never try it for GCM, malformed records, or platform/storage failures.
                 const rawVault = error instanceof storage_core_1.VaultAuthenticationError &&
@@ -1428,14 +1376,14 @@ class KeyringCore {
                     !vaultKeys.currentSessionSalt
                     ? await this.storage.get('vault')
                     : undefined;
-                assertCurrent?.();
+                assertCurrent();
                 if (typeof rawVault !== 'string' || rawVault.trim().startsWith('{')) {
                     throw error;
                 }
                 const legacyKey = await this.deriveLegacySessionKey(password, salt);
-                assertCurrent?.();
+                assertCurrent();
                 decryptedVault = await this.vaultPersistence.getDecryptedVault(legacyKey);
-                assertCurrent?.();
+                assertCurrent();
                 authenticated = true;
                 sessionPasswordKey = legacyKey;
                 // Keep the historical account wrapping key. Persist its profile before
@@ -1444,40 +1392,38 @@ class KeyringCore {
                     ...vaultKeys,
                     keyDerivation: LEGACY_ENCRYPTION_KDF,
                 };
-                assertCurrent?.();
+                assertCurrent();
                 await this.storage.set('vault-keys', migratedVaultKeys);
-                assertCurrent?.();
+                assertCurrent();
                 legacyProfile = true;
             }
-            assertCurrent?.();
+            assertCurrent();
             authenticated = true;
             if (legacyProfile && this.hasWebCrypto()) {
                 const storedVault = await this.storage.get('vault');
-                assertCurrent?.();
+                assertCurrent();
                 if (typeof storedVault === 'string' &&
                     !storedVault.trim().startsWith('{')) {
                     // A failed earlier rewrap can leave the authenticated profile plus
                     // CBC. Retry that write without changing the account wrapping key.
                     await this.vaultPersistence.setEncryptedVault(decryptedVault, sessionPasswordKey, undefined, assertCurrent);
-                    assertCurrent?.();
+                    assertCurrent();
                 }
             }
             // If session data missing or corrupted, recreate from vault
             if (!this.sessionMnemonic) {
                 assertCurrent = await __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_recreateSessionFromVault).call(this, sessionPasswordKey, assertCurrent);
-                if (assertCurrent) {
-                    assertCurrent();
-                    console.log('[KeyringManager] Session data recreated from vault');
-                }
+                assertCurrent();
+                console.log('[KeyringManager] Session data recreated from vault');
             }
-            assertCurrent?.();
+            assertCurrent();
             const result = __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_finishUnlock).call(this);
-            assertCurrent?.();
+            assertCurrent();
             return result;
         }
         catch (error) {
             // A superseded attempt must not report authentication or clear its winner.
-            assertCurrent?.();
+            assertCurrent();
             if (!authenticated && error instanceof storage_core_1.VaultAuthenticationError) {
                 return { canLogin: false };
             }
@@ -1489,6 +1435,12 @@ class KeyringCore {
             throw error;
         }
     }
+    assertUtxoDerivationAvailable(account, field) {
+        if (account.isImported && account.xpub === account.address)
+            throw new Error(`${field} not available for single-address imported accounts`);
+        if (this.isWatchOnlyAccount(account))
+            throw new Error(`${field} not available for watch-only accounts`);
+    }
     isWatchOnlyAccount(a) {
         if (a.isLedgerWallet || a.isTrezorWallet)
             return false;
@@ -1599,6 +1551,17 @@ class KeyringCore {
             throw error;
         }
     }
+    loadBip84AddressAccount(xpub, network) {
+        const { types, networks } = (0, sysweb3_network_1.getNetworkConfig)(network.slip44, network.currency);
+        if (!types?.zPubType)
+            throw new Error('Missing zPubType in network configuration');
+        return new BIP84.fromZPub(xpub, types.zPubType, networks);
+    }
+    deriveFirstUtxoAddress(xpub, network) {
+        if (this.isDescriptor(xpub))
+            return (0, watch_descriptor_1.deriveDescriptorAddress)(xpub, network);
+        return this.loadBip84AddressAccount(xpub, network).getAddress(0, false, 84);
+    }
     async importAccount(privKey, label, options) {
         // Check if wallet is unlocked
         if (!this.isUnlocked()) {
@@ -1636,9 +1599,7 @@ class KeyringCore {
                 ? types.zPubType.testnet.vpub
                 : types.zPubType.mainnet.zpub;
             const bip84Key = (0, derivation_paths_1.convertExtendedKeyVersion)(identifier, target);
-            addressToStore = await this.getAddress(bip84Key, false, {
-                forceIndex0: true,
-            });
+            addressToStore = this.deriveFirstUtxoAddress(bip84Key, activeNetwork);
         }
         // Validate duplicates across all account buckets, including passkey smart accounts.
         if (this.accountAddressExists(accounts, addressToStore) ||
@@ -1939,7 +1900,7 @@ class KeyringCore {
         if ((0, ethers_v6_1.getAddress)(key.address) !== request.account.expectedAddress)
             throw new Error('Prepared EVM signer address mismatch');
         assertCurrent();
-        const signed = (0, prepared_evm_1.signPreparedEvmEnvelope)(request.transaction, key.decryptedPrivateKey);
+        const { signed } = (0, prepared_evm_1.signPreparedEvmEnvelope)(request.transaction, key.decryptedPrivateKey);
         hostGuard();
         assertCurrent();
         return signed;
@@ -2043,7 +2004,7 @@ class KeyringCore {
         else {
             // For UTXO, use the xpub to derive the address
             // Always use first receive address (index 0) for imported account display
-            address = await this.getAddress(xpub, false, { forceIndex0: true });
+            address = this.deriveFirstUtxoAddress(xpub, vault.activeNetwork);
         }
         if (this.accountAddressExists(accounts, address, isEVM))
             throw new Error('Account already exists on your Wallet.');
@@ -2112,7 +2073,7 @@ class KeyringCore {
                 : types.zPubType.mainnet.zpub;
             xpub = (0, derivation_paths_1.convertExtendedKeyVersion)(ledgerXpub, bip84Target);
             // Always use first receive address (index 0) for imported account display
-            address = await this.getAddress(xpub, false, { forceIndex0: true });
+            address = this.deriveFirstUtxoAddress(xpub, vault.activeNetwork);
         }
         if (this.accountAddressExists(accounts, address, (0, derivation_paths_1.isEvmCoin)(coin, slip44)))
             throw new Error('Account already exists on your Wallet.');
@@ -2631,8 +2592,7 @@ class KeyringCore {
      */
     async destroy() {
         __classPrivateFieldSet(this, _KeyringCore_deviceUnlockRetired, true, "f");
-        if (__classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f"))
-            __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f").destroyed = true;
+        __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f").destroyed = true;
         await this.lockWallet();
         // Clear any remaining references
         this.ethereumTransaction = {};
@@ -2662,7 +2622,7 @@ _KeyringCore_deviceUnlockRetired = new WeakMap(), _KeyringCore_sessionOwnership
                 (!issuing && (this.sessionPassword || this.sessionMnemonic))) {
                 throw new Error('Device unlock session changed');
             }
-            assertOwnership?.();
+            assertOwnership();
         };
         let key;
         try {
@@ -2753,17 +2713,15 @@ _KeyringCore_deviceUnlockRetired = new WeakMap(), _KeyringCore_sessionOwnership
     if (source.authority !== this.authority ||
         source.storage !== this.storage ||
         source.vaultPersistence !== this.vaultPersistence ||
-        __classPrivateFieldGet(source, _KeyringCore_sessionOwnership, "f")?.tracker !== __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f")?.tracker) {
+        __classPrivateFieldGet(source, _KeyringCore_sessionOwnership, "f").tracker !== __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f").tracker) {
         throw new Error('Cannot transfer session between different wallet authorities');
     }
     if (!source.sessionPassword || !source.sessionMnemonic) {
         throw new Error('Session data is missing during transfer');
     }
-    __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_replaceSessionBuffers).call(this, source.sessionPassword, source.sessionMnemonic, __classPrivateFieldGet(source, _KeyringCore_sessionOwnership, "f")?.token);
+    __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_replaceSessionBuffers).call(this, source.sessionPassword, source.sessionMnemonic, __classPrivateFieldGet(source, _KeyringCore_sessionOwnership, "f").token);
 }, _KeyringCore_assertSessionOwner = function _KeyringCore_assertSessionOwner(sourceToken) {
     const ownership = __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f");
-    if (!ownership)
-        return;
     if (ownership.destroyed)
         throw new Error('Wallet keyring was destroyed');
     const owner = ownership.tracker.current;
@@ -2774,8 +2732,6 @@ _KeyringCore_deviceUnlockRetired = new WeakMap(), _KeyringCore_sessionOwnership
     }
 }, _KeyringCore_captureSessionGuard = function _KeyringCore_captureSessionGuard(message = 'Wallet unlock session changed') {
     const ownership = __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f");
-    if (!ownership)
-        return undefined;
     const revision = this.privateRecordSessionRevision;
     const epoch = ownership.tracker.epoch;
     return () => {
@@ -2800,10 +2756,8 @@ _KeyringCore_deviceUnlockRetired = new WeakMap(), _KeyringCore_sessionOwnership
     this.sessionPassword = sessionPassword;
     this.sessionMnemonic = sessionMnemonic;
     const ownership = __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f");
-    if (ownership) {
-        ownership.tracker.current = ownership.token;
-        ownership.tracker.epoch++;
-    }
+    ownership.tracker.current = ownership.token;
+    ownership.tracker.epoch++;
 }, _KeyringCore_finishUnlock = function _KeyringCore_finishUnlock() {
     // Re-initialize syscoin transaction handler if it was cleared on lock.
     // `lockWallet()` intentionally replaces it with a plain object to drop signer references,
@@ -2851,16 +2805,13 @@ _KeyringCore_deviceUnlockRetired = new WeakMap(), _KeyringCore_sessionOwnership
         // v4 vault is encrypted with the derived session password key (PBKDF2 output)
         // `saltedHashPassword` is the derived session password key passed by caller.
         const { mnemonic } = await this.vaultPersistence.getDecryptedVault(saltedHashPassword);
-        assertCurrent?.();
+        assertCurrent();
         if (!mnemonic) {
             throw new Error('Mnemonic not found in vault');
         }
         __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_installVaultSession).call(this, mnemonic, saltedHashPassword, assertCurrent);
         // Capture the installed revision before returning to the async caller.
-        if (assertCurrent)
-            return __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_captureSessionGuard).call(this);
-        console.log('[KeyringManager] Session data recreated from vault');
-        return undefined;
+        return __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_captureSessionGuard).call(this);
     }
     catch (error) {
         console.error('ERROR recreateSessionFromVault', { error });