@sidhujag/sysweb3-keyring 2.1.3 → 2.1.4

package/cjs/transactions/syscoin-core.js

@@ -34,22 +34,21 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SyscoinTransactionsCore = exports.createHardwareSignerUnavailableError = void 0;
-const sysweb3_utils_1 = require("@sidhujag/sysweb3-utils");
+exports.readPublicSyscoinFee = readPublicSyscoinFee;
+exports.captureOwnedSyscoinRead = captureOwnedSyscoinRead;
+const sysweb3_network_1 = require("@sidhujag/sysweb3-network");
 const syscoinjs = __importStar(require("syscoinjs-lib"));
 // import { BIP_84, ONE_HUNDRED_MILLION, SYSCOIN_BASIC_FEE } from 'utils';
 const ethers_v6_1 = require("../ethers-v6");
 const types_1 = require("../types");
-const blockbook_cache_1 = require("../utils/blockbook-cache");
 const excluded_utxos_1 = require("../utils/excluded-utxos");
+const owned_blockbook_account_1 = require("../utils/owned-blockbook-account");
 const psbt_1 = require("../utils/psbt");
 const psbt_account_scope_1 = require("../utils/psbt-account-scope");
 const createHardwareSignerUnavailableError = (hardware) => Object.assign(new Error(`${hardware} signer is unavailable in this host`), {
     code: 'HARDWARE_SIGNER_UNAVAILABLE',
 });
 exports.createHardwareSignerUnavailableError = createHardwareSignerUnavailableError;
-// Recommended fee changes slowly; cache per explorer to avoid hammering
-// Blockbook while the user edits amounts on the send screen
-const FEE_CACHE_TTL_MS = 60000;
 const sweepError = (code, message) => ({
     error: true,
     code,
@@ -69,8 +68,90 @@ const sweepAtomicValue = (value) => {
         throw sweepError('INVALID_NATIVE_SWEEP_UTXOS', 'Invalid native sweep atomic value.');
     return new syscoinjs.utils.BN(text);
 };
+function captureBlockbookRead(options, assertContext) {
+    if (!options)
+        throw new Error('Missing owned UTXO read');
+    const { fetch, signal, assertCurrent: assertHost } = options;
+    if (typeof fetch !== 'function' ||
+        typeof assertHost !== 'function' ||
+        typeof signal?.aborted !== 'boolean')
+        throw new Error('Invalid owned UTXO read');
+    const assertCurrent = () => {
+        if (signal.aborted)
+            throw new Error('Wallet UTXO preparation context changed');
+        const result = assertHost();
+        if (result !== undefined) {
+            if (result &&
+                (typeof result === 'object' || typeof result === 'function'))
+                void Promise.resolve(result).catch(() => undefined);
+            throw new Error('Owned UTXO read requires a synchronous guard');
+        }
+        assertContext();
+        if (signal.aborted)
+            throw new Error('Wallet UTXO preparation context changed');
+    };
+    assertCurrent();
+    const transport = Object.freeze({
+        signal,
+        async fetch(input, init) {
+            assertCurrent();
+            const response = await fetch(input, init);
+            assertCurrent();
+            return response;
+        },
+    });
+    return { assertCurrent, transport };
+}
+async function readOwnedFee(explorerUrl, { assertCurrent, transport }) {
+    assertCurrent();
+    const fee = await syscoinjs.utils.fetchEstimateFee(explorerUrl, 1, undefined, transport);
+    assertCurrent();
+    return fee / 1024;
+}
+/** Public network fee estimate. It has no wallet, account or signing access. */
+async function readPublicSyscoinFee(explorerUrl, owner) {
+    return readOwnedFee(explorerUrl, captureBlockbookRead(owner, () => undefined));
+}
+/** Bind both transaction preparation and address reads to the active wallet. */
+function captureOwnedSyscoinRead(options, getState, captureSigningContext) {
+    if (!options)
+        throw new Error('Missing owned UTXO read');
+    const assertSession = captureSigningContext(true);
+    const { activeNetwork, activeAccountId, activeAccountType, accounts } = getState();
+    if (activeNetwork.kind !== sysweb3_network_1.INetworkType.Syscoin)
+        throw new Error('Switch to UTXO chain');
+    const selected = accounts[activeAccountType]?.[activeAccountId];
+    if (!selected)
+        throw new Error('Active account not found');
+    const account = Object.freeze({
+        address: selected.address,
+        xpub: selected.xpub,
+    });
+    const network = Object.freeze({ ...activeNetwork });
+    const read = captureBlockbookRead(options, () => {
+        assertSession();
+        const current = getState();
+        const selected = current.accounts[current.activeAccountType]?.[current.activeAccountId];
+        if (current.activeAccountId !== activeAccountId ||
+            current.activeAccountType !== activeAccountType ||
+            selected?.address !== account.address ||
+            selected?.xpub !== account.xpub ||
+            current.activeNetwork.kind !== network.kind ||
+            current.activeNetwork.chainId !== network.chainId ||
+            current.activeNetwork.slip44 !== network.slip44 ||
+            current.activeNetwork.currency !== network.currency ||
+            current.activeNetwork.url !== network.url)
+            throw new Error('Wallet UTXO preparation context changed');
+    });
+    return {
+        account,
+        accountId: activeAccountId,
+        accountType: activeAccountType,
+        read: Object.freeze({ ...read, network, xpub: account.xpub }),
+    };
+}
 class SyscoinTransactionsCore {
-    constructor(getSyscoinSigner, getReadOnlySigner, getState, getAddress, hardwareSigners = {}, captureSigningContext) {
+    constructor(getSyscoinSigner, getReadOnlySigner, getState, hardwareSigners, captureSigningContext) {
         this.getTransactionPSBT = async ({ txOptions, outputs, changeAddress, feeRateBN, xpub, fundingUtxos, }, main) => {
             try {
                 // Use syscoinjs-lib directly for transaction creation
@@ -108,26 +189,17 @@ class SyscoinTransactionsCore {
                 return main.decodeRawTransaction(psbtObj);
             }
         };
-        this.feeCache = new Map();
-        this.getRecommendedFee = async (explorerUrl) => {
-            const cached = this.feeCache.get(explorerUrl);
-            if (cached && Date.now() - cached.timestamp < FEE_CACHE_TTL_MS) {
-                return cached.fee;
-            }
-            const fee = (await syscoinjs.utils.fetchEstimateFee(explorerUrl, 1)) / 1024;
-            this.feeCache.set(explorerUrl, { fee, timestamp: Date.now() });
-            return fee;
-        };
-        this.txUtilsFunctions = () => {
-            const { getRawTransaction } = (0, sysweb3_utils_1.txUtils)();
-            return {
-                getRawTransaction,
-            };
+        this.getRecommendedFee = async (explorerUrl, ownedRead) => {
+            const { read } = this.captureOwnedRead(ownedRead);
+            if (explorerUrl !== read.network.url)
+                throw new Error('Owned UTXO read endpoint changed');
+            return readOwnedFee(explorerUrl, read);
         };
         // Internal method for signing with the HD signer
         this.signPSBTWithSigner = async ({ psbt, signer, }) => await signer.sign(psbt);
-        this.createNativeSweepPSBT = async ({ txOptions, changeAddress, receivingAddress, feeRateBN, source, excluded, }, main) => {
-            const raw = await syscoinjs.utils.fetchBackendUTXOS(main.blockbookURL, source);
+        this.createNativeSweepPSBT = async ({ txOptions, changeAddress, receivingAddress, feeRateBN, source, excluded, }, main, read) => {
+            const raw = await syscoinjs.utils.fetchBackendUTXOS(main.blockbookURL, source, undefined, read.transport);
+            read.assertCurrent();
             const rows = excluded.size
                 ? (0, excluded_utxos_1.filterExcludedUtxos)(raw, excluded).utxos
                 : Array.isArray(raw)
@@ -195,16 +267,10 @@ class SyscoinTransactionsCore {
             };
         };
         // Create unsigned PSBT for any transaction type
-        this.createUnsignedPSBT = async ({ txOptions = {}, isMax = false, nativeSweep = false, amount, receivingAddress, feeRateBN, token = null, excludedOutpoints = [], }) => {
+        this.createUnsignedPSBT = async ({ txOptions = {}, isMax = false, nativeSweep = false, amount, receivingAddress, feeRateBN, token = null, }, owned) => {
             // Ensure RBF is enabled by default if not explicitly set
             const finalTxOptions = { rbf: true, ...txOptions };
-            const { activeAccountId, accounts, activeAccountType } = this.getState();
-            // Use read-only signer since we're just creating an unsigned PSBT
-            const { main } = this.getReadOnlySigner();
-            const account = accounts[activeAccountType]?.[activeAccountId];
-            if (!account) {
-                throw new Error('Active account not found');
-            }
+            const { account, accountType: activeAccountType, excluded, main, read, } = owned;
             const xpub = account.xpub;
             const isSingleAddressImported = activeAccountType === types_1.KeyringAccountType.Imported &&
                 xpub === account.address;
@@ -231,9 +297,9 @@ class SyscoinTransactionsCore {
             // If this is a single-address imported account (WIF import), use the account.address for both from and change
             const changeAddress = isSingleAddressImported
                 ? account.address
-                : await this.getAddress(xpub, true);
+                : await owned.getOwnedAddress(xpub, true);
+            read.assertCurrent();
             try {
-                const excluded = (0, excluded_utxos_1.excludedOutpointIds)(excludedOutpoints);
                 if (nativeSweep) {
                     return await this.createNativeSweepPSBT({
                         txOptions: finalTxOptions,
@@ -242,11 +308,12 @@ class SyscoinTransactionsCore {
                         feeRateBN,
                         source: sourceForUtxoLookup,
                         excluded,
-                    }, main);
+                    }, main, read);
                 }
                 const fundingUtxos = excluded.size
-                    ? (0, excluded_utxos_1.filterExcludedUtxos)(await syscoinjs.utils.fetchBackendUTXOS(main.blockbookURL, sourceForUtxoLookup), excluded)
+                    ? (0, excluded_utxos_1.filterExcludedUtxos)(await syscoinjs.utils.fetchBackendUTXOS(main.blockbookURL, sourceForUtxoLookup, undefined, read.transport), excluded)
                     : undefined;
+                read.assertCurrent();
                 if (token && token.guid) {
                     // Token transaction: use assetAllocationSend
                     // Create a Map for the asset allocation
@@ -306,43 +373,24 @@ class SyscoinTransactionsCore {
             }
         };
         // Sign PSBT with appropriate method - separated for better error handling
-        this.signPSBTWithMethod = async (psbt, isTrezor, isLedger = false) => {
-            const { activeNetwork, activeAccountId, activeAccountType, accounts } = this.getState();
+        this.signPSBTWithMethod = async (psbt, ownedRead) => {
+            const { assertCurrent, network: activeNetwork, transport } = ownedRead;
+            assertCurrent();
+            const { activeAccountId, activeAccountType, accounts } = this.getState();
             const account = accounts[activeAccountType]?.[activeAccountId];
             if (!account)
                 throw new Error('Active account not found');
             // Device choice belongs to the selected account, never to PSBT/caller flags.
-            isTrezor =
-                activeAccountType === types_1.KeyringAccountType.Trezor ||
-                    account.isTrezorWallet === true;
-            isLedger =
-                activeAccountType === types_1.KeyringAccountType.Ledger ||
-                    account.isLedgerWallet === true;
-            const assertSession = this.captureSigningContext?.() || (() => undefined);
-            // The adapter gets a detached, immutable public context. It must not be
-            // able to mutate the wallet state or the baseline used by assertCurrent.
+            const isTrezor = activeAccountType === types_1.KeyringAccountType.Trezor ||
+                account.isTrezorWallet === true;
+            const isLedger = activeAccountType === types_1.KeyringAccountType.Ledger ||
+                account.isLedgerWallet === true;
             const scope = Object.freeze({
                 account: Object.freeze({ address: account.address, xpub: account.xpub }),
                 accountId: activeAccountId,
                 accountType: activeAccountType,
-                network: Object.freeze({ ...activeNetwork }),
+                network: activeNetwork,
             });
-            const assertCurrent = () => {
-                assertSession();
-                const current = this.getState();
-                const selected = current.accounts[current.activeAccountType]?.[current.activeAccountId];
-                if (current.activeAccountId !== activeAccountId ||
-                    current.activeAccountType !== activeAccountType ||
-                    selected?.address !== scope.account.address ||
-                    selected?.xpub !== scope.account.xpub ||
-                    current.activeNetwork.kind !== scope.network.kind ||
-                    current.activeNetwork.chainId !== scope.network.chainId ||
-                    current.activeNetwork.slip44 !== scope.network.slip44 ||
-                    current.activeNetwork.url !== scope.network.url) {
-                    throw new Error('Wallet signing context changed');
-                }
-            };
-            assertCurrent();
             const sign = isLedger
                 ? this.hardwareSigners.ledger
                 : isTrezor
@@ -353,17 +401,29 @@ class SyscoinTransactionsCore {
             if (isTrezor || isLedger)
                 (0, psbt_account_scope_1.assertPsbtAccountScope)(psbt, scope);
             if (isLedger || isTrezor) {
+                const assertHardwareCurrent = () => {
+                    try {
+                        assertCurrent();
+                    }
+                    catch {
+                        // The vendor retry loop already treats AbortError as terminal.
+                        throw Object.assign(new Error('Wallet signing context changed'), {
+                            name: 'AbortError',
+                        });
+                    }
+                };
                 const signed = await sign({
                     psbt,
                     account: Object.freeze({ id: account.id, xpub: account.xpub }),
                     network: scope.network,
                     scope,
-                    assertCurrent,
+                    assertCurrent: assertHardwareCurrent,
+                    signal: transport.signal,
                     ...(isLedger && {
-                        getRawTransaction: this.txUtilsFunctions().getRawTransaction,
+                        getRawTransaction: (txid) => syscoinjs.utils.fetchBackendRawTx(activeNetwork.url, txid, transport),
                     }),
                 });
-                assertCurrent();
+                assertHardwareCurrent();
                 return signed;
             }
             else {
@@ -373,99 +433,94 @@ class SyscoinTransactionsCore {
                 //
                 // We can recover by enriching PSBT inputs with a proprietary `path` field using
                 // Blockbook's xpub token list (address -> path mapping), which reliably includes paths.
-                try {
-                    const account = accounts[activeAccountType]?.[activeAccountId];
-                    const accountXpub = account?.xpub;
-                    const accountAddress = account?.address;
-                    const isSingleAddressImported = activeAccountType === types_1.KeyringAccountType.Imported &&
-                        Boolean(accountXpub) &&
-                        Boolean(accountAddress) &&
-                        accountXpub === accountAddress;
-                    const isImportedExtended = activeAccountType === types_1.KeyringAccountType.Imported &&
-                        Boolean(accountXpub) &&
-                        !isSingleAddressImported;
-                    // IMPORTANT: Imported extended keys (zprv/vprv) are typically *account-level* keys.
-                    // syscoinjs-lib signs using the imported key as the BIP32 root, so PSBT `path` must be
-                    // relative (change/index), not the full `m/84'/.../change/index`. If we keep full paths,
-                    // bip32.derivePath can throw, leaving no derivations and causing "Need derivation path".
-                    if (isImportedExtended) {
-                        const inputs = psbt?.data?.inputs || [];
-                        for (const input of inputs) {
-                            const unknowns = input?.unknownKeyVals || [];
-                            const pathKv = unknowns.find((kv) => kv?.key?.toString?.() === 'path');
-                            if (!pathKv?.value)
-                                continue;
-                            const fullPath = String(Buffer.from(pathKv.value).toString());
-                            const parts = fullPath.split('/').filter(Boolean);
-                            // Expected: m/84'/slip44'/account'/change/index
-                            if (parts.length >= 2) {
-                                const change = parts[parts.length - 2];
-                                const index = parts[parts.length - 1];
-                                const rel = `${change}/${index}`;
-                                pathKv.value = Buffer.from(rel);
-                            }
-                        }
-                    }
-                    const needsAnyPath = psbt?.data?.inputs?.some((input) => {
+                const account = accounts[activeAccountType]?.[activeAccountId];
+                const accountXpub = account?.xpub;
+                const accountAddress = account?.address;
+                const isSingleAddressImported = activeAccountType === types_1.KeyringAccountType.Imported &&
+                    Boolean(accountXpub) &&
+                    Boolean(accountAddress) &&
+                    accountXpub === accountAddress;
+                const isImportedExtended = activeAccountType === types_1.KeyringAccountType.Imported &&
+                    Boolean(accountXpub) &&
+                    !isSingleAddressImported;
+                // IMPORTANT: Imported extended keys (zprv/vprv) are typically *account-level* keys.
+                // syscoinjs-lib signs using the imported key as the BIP32 root, so PSBT `path` must be
+                // relative (change/index), not the full `m/84'/.../change/index`. If we keep full paths,
+                // bip32.derivePath can throw, leaving no derivations and causing "Need derivation path".
+                if (isImportedExtended) {
+                    const inputs = psbt?.data?.inputs || [];
+                    for (const input of inputs) {
                         const unknowns = input?.unknownKeyVals || [];
-                        return (!input.bip32Derivation?.length &&
-                            !input.tapBip32Derivation?.length &&
-                            !unknowns.some((kv) => kv?.key?.toString?.() === 'path'));
-                    });
-                    if (needsAnyPath &&
-                        accountXpub &&
-                        !isSingleAddressImported &&
-                        typeof psbt.addUnknownKeyValToInput === 'function') {
-                        // Fetch address->path mapping from Blockbook xpub endpoint
-                        // (in-flight deduplicated with the keyring's getAddress lookups)
-                        const blockbookUrl = activeNetwork.url;
-                        const res = await (0, blockbook_cache_1.fetchBackendAccountCached)(blockbookUrl, accountXpub, 'tokens=used&details=tokens');
-                        const tokens = Array.isArray(res?.tokens) ? res.tokens : [];
-                        const addrToPath = new Map();
-                        for (const t of tokens) {
-                            if (t?.name && t?.path) {
-                                addrToPath.set(String(t.name), String(t.path));
-                            }
-                        }
-                        const inputs = psbt?.data?.inputs || [];
-                        for (let i = 0; i < inputs.length; i++) {
-                            const input = inputs[i];
-                            const unknowns = input?.unknownKeyVals || [];
-                            const hasPath = unknowns.some((kv) => kv?.key?.toString?.() === 'path');
-                            if (hasPath)
-                                continue;
-                            const addrKv = unknowns.find((kv) => kv?.key?.toString?.() === 'address');
-                            const addr = addrKv?.value
-                                ? String(Buffer.from(addrKv.value).toString())
-                                : null;
-                            if (!addr)
-                                continue;
-                            const fullPath = addrToPath.get(addr);
-                            if (!fullPath)
-                                continue;
-                            // Imported extended keys are account-level (BIP84 account node), so we must provide a
-                            // path relative to that node (change/index), not the full m/84'/... path.
-                            const pathForSigner = isImportedExtended
-                                ? (() => {
-                                    const parts = String(fullPath).split('/').filter(Boolean);
-                                    // Expected: m/84'/slip44'/account'/change/index
-                                    if (parts.length >= 2) {
-                                        const change = parts[parts.length - 2];
-                                        const index = parts[parts.length - 1];
-                                        return `${change}/${index}`;
-                                    }
-                                    return fullPath;
-                                })()
-                                : fullPath;
-                            psbt.addUnknownKeyValToInput(i, {
-                                key: Buffer.from('path'),
-                                value: Buffer.from(pathForSigner),
-                            });
+                        const pathKv = unknowns.find((kv) => kv?.key?.toString?.() === 'path');
+                        if (!pathKv?.value)
+                            continue;
+                        const fullPath = String(Buffer.from(pathKv.value).toString());
+                        const parts = fullPath.split('/').filter(Boolean);
+                        // Expected: m/84'/slip44'/account'/change/index
+                        if (parts.length >= 2) {
+                            const change = parts[parts.length - 2];
+                            const index = parts[parts.length - 1];
+                            const rel = `${change}/${index}`;
+                            pathKv.value = Buffer.from(rel);
                         }
                     }
                 }
-                catch (_e) {
-                    // Best-effort enrichment; if it fails, fall back to default signing error path.
+                const needsAnyPath = psbt?.data?.inputs?.some((input) => {
+                    const unknowns = input?.unknownKeyVals || [];
+                    return (!input.bip32Derivation?.length &&
+                        !input.tapBip32Derivation?.length &&
+                        !unknowns.some((kv) => kv?.key?.toString?.() === 'path'));
+                });
+                if (needsAnyPath &&
+                    accountXpub &&
+                    !isSingleAddressImported &&
+                    typeof psbt.addUnknownKeyValToInput === 'function') {
+                    // Fetch address->path mapping from Blockbook xpub endpoint
+                    const blockbookUrl = activeNetwork.url;
+                    const res = await (0, owned_blockbook_account_1.fetchOwnedBlockbookAccount)(blockbookUrl, accountXpub, transport);
+                    assertCurrent();
+                    const tokens = Array.isArray(res?.tokens) ? res.tokens : [];
+                    const addrToPath = new Map();
+                    for (const t of tokens) {
+                        if (t?.name && t?.path) {
+                            addrToPath.set(String(t.name), String(t.path));
+                        }
+                    }
+                    const inputs = psbt?.data?.inputs || [];
+                    for (let i = 0; i < inputs.length; i++) {
+                        const input = inputs[i];
+                        const unknowns = input?.unknownKeyVals || [];
+                        const hasPath = unknowns.some((kv) => kv?.key?.toString?.() === 'path');
+                        if (hasPath)
+                            continue;
+                        const addrKv = unknowns.find((kv) => kv?.key?.toString?.() === 'address');
+                        const addr = addrKv?.value
+                            ? String(Buffer.from(addrKv.value).toString())
+                            : null;
+                        if (!addr)
+                            continue;
+                        const fullPath = addrToPath.get(addr);
+                        if (!fullPath)
+                            continue;
+                        // Imported extended keys are account-level (BIP84 account node), so we must provide a
+                        // path relative to that node (change/index), not the full m/84'/... path.
+                        const pathForSigner = isImportedExtended
+                            ? (() => {
+                                const parts = String(fullPath).split('/').filter(Boolean);
+                                // Expected: m/84'/slip44'/account'/change/index
+                                if (parts.length >= 2) {
+                                    const change = parts[parts.length - 2];
+                                    const index = parts[parts.length - 1];
+                                    return `${change}/${index}`;
+                                }
+                                return fullPath;
+                            })()
+                            : fullPath;
+                        psbt.addUnknownKeyValToInput(i, {
+                            key: Buffer.from('path'),
+                            value: Buffer.from(pathForSigner),
+                        });
+                    }
                 }
                 assertCurrent();
                 (0, psbt_account_scope_1.assertPsbtAccountScope)(psbt, scope);
@@ -479,23 +534,39 @@ class SyscoinTransactionsCore {
             }
         };
         // Create unsigned PSBT and estimate fee - NO SIGNING
-        this.getEstimateSysTransactionFee = async ({ txOptions = {}, isMax = false, nativeSweep = false, amount, receivingAddress, feeRate, token = null, excludedOutpoints = [], }) => {
+        this.getEstimateSysTransactionFee = async ({ txOptions = {}, isMax = false, nativeSweep = false, amount, receivingAddress, feeRate, token = null, excludedOutpoints = [], }, ownedRead) => {
             try {
                 if (nativeSweep !== false &&
                     (nativeSweep !== true || isMax !== true || token !== null))
                     throw sweepError('INVALID_NATIVE_SWEEP', 'Native sweep requires explicit MAX and a native transaction.');
                 // Ensure RBF is enabled by default if not explicitly set
                 const finalTxOptions = { rbf: true, ...txOptions };
-                // Use read-only signer since we're just estimating fees and creating unsigned PSBT
-                const { main } = this.getReadOnlySigner();
-                // Step 1: Determine fee rate
-                let actualFeeRate;
-                if (feeRate !== undefined) {
-                    actualFeeRate = feeRate;
-                }
-                else {
-                    actualFeeRate = await this.getRecommendedFee(main.blockbookURL);
+                const preparation = this.captureOwnedRead(ownedRead);
+                const { main, getOwnedAddress } = this.getReadOnlySigner(preparation.read);
+                if (typeof getOwnedAddress !== 'function' ||
+                    main.blockbookURL !== preparation.read.network.url)
+                    throw new Error('Owned UTXO read adapter is unavailable');
+                const owned = {
+                    ...preparation,
+                    main,
+                    getOwnedAddress,
+                    excluded: (0, excluded_utxos_1.excludedOutpointIds)(excludedOutpoints),
+                };
+                const selectedToken = token ? { ...token } : token;
+                const { assetWhiteList } = finalTxOptions;
+                if (assetWhiteList instanceof Map)
+                    finalTxOptions.assetWhiteList = new Map(assetWhiteList);
+                else if (assetWhiteList instanceof Set)
+                    finalTxOptions.assetWhiteList = new Set(assetWhiteList);
+                for (const key of ['memo', 'memoHeader', 'blobHash', 'blobData']) {
+                    const bytes = finalTxOptions[key];
+                    if (bytes instanceof Uint8Array)
+                        finalTxOptions[key] = Buffer.from(bytes);
                 }
+                const actualFeeRate = feeRate === undefined
+                    ? await readOwnedFee(main.blockbookURL, owned.read)
+                    : feeRate;
+                owned.read.assertCurrent();
                 // Convert fee rate to satoshis/byte and ensure minimum relay of 1 sat/vB
                 // Blockbook returns coins per kB; after division by 1024, some testnets
                 // can yield < 1 sat/vB (e.g., 0.9765625). Round up and clamp to 1 to
@@ -510,10 +581,10 @@ class SyscoinTransactionsCore {
                     amount,
                     receivingAddress,
                     feeRateBN,
-                    token,
-                    excludedOutpoints,
-                });
-                return {
+                    token: selectedToken,
+                }, owned);
+                owned.read.assertCurrent();
+                const quote = {
                     fee: result.fee / 1e8,
                     psbt: psbt_1.PsbtUtils.toPali(result.psbt), // Return UNSIGNED PSBT as JSON
                     ...(nativeSweep
@@ -523,6 +594,8 @@ class SyscoinTransactionsCore {
                         }
                         : {}),
                 };
+                owned.read.assertCurrent();
+                return quote;
             }
             catch (error) {
                 // Pass through structured errors from syscoinjs-lib
@@ -568,32 +641,10 @@ class SyscoinTransactionsCore {
             }
         };
         // Removed createAndSignSysTransaction - functionality merged into getEstimateSysTransactionFee
-        this.sendSignedTransaction = async (psbt) => {
-            try {
-                // Use read-only signer since we're just broadcasting an already-signed transaction
-                const { main } = this.getReadOnlySigner();
-                // Send the transaction
-                const result = await main.send(psbt);
-                // Extract the transaction ID
-                const txid = result.extractTransaction().getId();
-                return { txid };
-            }
-            catch (error) {
-                // Pass through structured errors
-                if (error.error && error.code) {
-                    throw error;
-                }
-                // Wrap other errors
-                throw {
-                    error: true,
-                    code: 'TRANSACTION_SEND_FAILED',
-                    message: error.message || 'Failed to send transaction',
-                    details: error,
-                };
-            }
-        };
-        this.signPSBT = async ({ psbt, isTrezor = false, isLedger = false, }) => {
-            const psbtObj = psbt_1.PsbtUtils.fromPali(psbt, this.getState().activeNetwork);
+        this.signPSBT = async ({ psbt }, ownedRead) => {
+            const { read } = this.captureOwnedRead(ownedRead);
+            const psbtObj = psbt_1.PsbtUtils.fromPali(psbt, read.network);
+            const unsigned = Buffer.from(psbtObj.data.globalMap.unsignedTx.toBuffer());
             // Scope validation temporarily removes other signers' hints. Preserve the
             // public metadata for the next cosigner, without exposing it to our signer.
             const cosignerMetadata = psbtObj.data.inputs.map((input, index) => ({
@@ -610,7 +661,10 @@ class SyscoinTransactionsCore {
                     value: Buffer.from(value.value),
                 }))[0],
             }));
-            const signedPsbt = await this.signPSBTWithMethod(psbtObj, isTrezor, isLedger);
+            const signedPsbt = await this.signPSBTWithMethod(psbtObj, read);
+            read.assertCurrent();
+            if (!unsigned.equals(signedPsbt.data.globalMap.unsignedTx.toBuffer()))
+                throw new Error('Signed PSBT differs from the prepared transaction');
             signedPsbt.data.inputs.forEach((input, index) => {
                 if (input.finalScriptSig || input.finalScriptWitness)
                     return;
@@ -631,21 +685,47 @@ class SyscoinTransactionsCore {
                     input.unknownKeyVals.push(metadata.path);
                 }
             });
-            return psbt_1.PsbtUtils.toPali(signedPsbt);
+            const result = psbt_1.PsbtUtils.toPali(signedPsbt);
+            read.assertCurrent();
+            return result;
         };
-        this.sendTransaction = async (psbt) => {
-            if (!psbt) {
-                throw new Error('Signed PSBT is required for broadcasting.');
+        this.sendTransaction = async (rawTransaction, authority) => {
+            let read;
+            let fetch;
+            let signal;
+            let prepare;
+            try {
+                if (!authority)
+                    throw new Error('Missing owned UTXO submission context');
+                const { assertCurrent } = authority;
+                ({ fetch, signal, prepare } = authority);
+                if (typeof prepare !== 'function')
+                    throw new Error('Missing UTXO submission admission');
+                ({ read } = this.captureOwnedRead({ assertCurrent, fetch, signal }));
             }
-            return await this.sendSignedTransaction(psbt_1.PsbtUtils.fromPali(psbt, this.getState().activeNetwork));
+            catch {
+                throw Object.assign(new Error('UTXO submission was not dispatched'), {
+                    code: 'UTXO_SUBMISSION_NOT_DISPATCHED',
+                    transactionNotBroadcast: true,
+                });
+            }
+            // SyscoinJS owns the admission, final synchronous guard and exact ACK.
+            // The POST uses the captured transport directly so a matching ACK can
+            // still be observed after a host context change without a signal abort.
+            const { result: txid } = await syscoinjs.utils.sendRawTransaction(read.network.url, rawTransaction, undefined, { assertCurrent: read.assertCurrent, fetch, prepare, signal });
+            return { txid };
         };
+        if (typeof captureSigningContext !== 'function')
+            throw new Error('Missing UTXO signing context');
         this.getSigner = getSyscoinSigner;
         this.getReadOnlySigner = getReadOnlySigner;
         this.getState = getState;
-        this.getAddress = getAddress;
         this.hardwareSigners = hardwareSigners;
         this.captureSigningContext = captureSigningContext;
     }
+    captureOwnedRead(options) {
+        return captureOwnedSyscoinRead(options, this.getState, this.captureSigningContext);
+    }
 }
 exports.SyscoinTransactionsCore = SyscoinTransactionsCore;
 //# sourceMappingURL=syscoin-core.js.map