Amends DESIGN-integrated-wallet.md §0 ("one account per profile in v1") with
a formal path to supporting external key imports (BIP39 seeds and raw WIFs)
alongside the primary HD purpose-subtree. Motivated by the user's 15-wallet
Deviant chipnet keystore now encrypted under the same master-password model
that Theseus is designed around.
Key discipline:
- SEPARATE storage file (wallet-imports.enc), same PBKDF2/AES-256-GCM crypto,
same master password, distinct KDF salt. Imports cannot compromise the
primary seed and vice versa; corruption of one file does not damage the
other.
- The imports schema mirrors Deviant's chipnet-keystore/1 shape (cashaddr /
label / category / source / path / seed / wif) so import is a 1:1 field
copy, not a translation.
- Every import stores the raw seed + BIP44 path (or the raw WIF) and derives
addresses DIRECTLY via HDKey.fromMasterSeed, bypassing the vault's
purposes/wallet HKDF subtree. This is essential: without the bypass,
pasting a mnemonic re-hashes the seed through HKDF and produces DIFFERENT
addresses than the source wallet (see memory
bchwallet-vault-root-derivation).
- No bcnr.importWallet() ever; imports are settings-page only.
- Sign modal grows an account picker with category chips; per-origin
"recently used" pre-selection with red-flag on category change.
Also introduces:
- bcnr.requestAccount({ account?, category? }) — backwards compatible
- bcnr.getAccounts({ category? })
- Stale-import detection (source-file cashaddr comparison on unlock)
- Sequencing: M.1 (generic import) → M.2 (import from Deviant keystore) →
M.3 (API extensions) → M.4 (stale detection). M.1 is load-bearing;
everything else composes.
Companion to Option A which shipped separately as the cross-repo fall-through
in Argus/src/lib/wallet.js.
