@babylonlabs-io/ts-sdk 0.34.0 → 0.36.0

package/dist/waitForTransactionReceiptSmartAware-D9ykVriz.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"waitForTransactionReceiptSmartAware-D9ykVriz.cjs","sources":["../src/tbv/core/utils/utxo/selectUtxos.ts","../src/tbv/core/utils/transaction/btcTxHash.ts","../src/tbv/core/utils/btc/scriptType.ts","../src/tbv/core/utils/btc/psbtInputFields.ts","../src/tbv/core/utils/eth/waitForTransactionReceiptSmartAware.ts"],"sourcesContent":["/**\n * UTXO selection utilities for peg-in transactions.\n * Follows btc-staking-ts methodology with iterative fee calculation.\n */\n\nimport { script as bitcoinScript } from \"bitcoinjs-lib\";\nimport { Buffer } from \"buffer\";\n\nimport {\n  BTC_DUST_SAT,\n  DUST_THRESHOLD,\n  MAX_NON_LEGACY_OUTPUT_SIZE,\n  P2TR_INPUT_SIZE,\n  rateBasedTxBufferFee,\n  TX_BUFFER_SIZE_OVERHEAD,\n} from \"../fee/constants\";\n\n/**\n * Unspent Transaction Output (UTXO) for funding peg-in transactions.\n */\nexport interface UTXO {\n  /**\n   * Transaction ID of the UTXO (64-char hex without 0x prefix).\n   */\n  txid: string;\n\n  /**\n   * Output index within the transaction.\n   */\n  vout: number;\n\n  /**\n   * Value in satoshis.\n   */\n  value: number;\n\n  /**\n   * Script public key hex.\n   */\n  scriptPubKey: string;\n}\n\nexport interface UTXOSelectionResult {\n  selectedUTXOs: UTXO[];\n  totalValue: bigint;\n  fee: bigint;\n  changeAmount: bigint;\n}\n\n/**\n * Assert that no two UTXOs share the same txid:vout outpoint.\n * Duplicates from a buggy or compromised UTXO source would produce\n * an invalid Bitcoin transaction that double-spends the same outpoint.\n */\nfunction assertNoDuplicateUtxos(utxos: UTXO[]): void {\n  const seen = new Set<string>();\n  for (const utxo of utxos) {\n    const key = `${utxo.txid.toLowerCase()}:${utxo.vout}`;\n    if (seen.has(key)) {\n      throw new Error(\n        `Duplicate UTXO detected: ${utxo.txid}:${utxo.vout}. ` +\n          `This indicates a data integrity issue with the UTXO source.`,\n      );\n    }\n    seen.add(key);\n  }\n}\n\n/**\n * Selects UTXOs to fund a peg-in transaction with iterative fee calculation.\n *\n * This function implements the btc-staking-ts approach:\n * 1. Filter UTXOs for script validity (no minimum value filter)\n * 2. Sort by value (largest first) to minimize number of inputs\n * 3. Iteratively add UTXOs and recalculate fee until we have enough\n *\n * The fee recalculation is critical because:\n * - Each UTXO added increases transaction size → increases fee\n * - More fee needed might require another UTXO\n * - Change output detection affects fee (adds output size if needed)\n *\n * @param availableUTXOs - All available UTXOs from wallet\n * @param peginAmount - Amount to peg in (satoshis)\n * @param feeRate - Fee rate (sat/vbyte)\n * @param numOutputs - Number of outputs in the unfunded transaction (HTLC + CPFP anchor, before change)\n * @returns Selected UTXOs, total value, calculated fee, and change amount\n * @throws Error if insufficient funds or no valid UTXOs\n */\nexport function selectUtxosForPegin(\n  availableUTXOs: UTXO[],\n  peginAmount: bigint,\n  feeRate: number,\n  numOutputs: number,\n): UTXOSelectionResult {\n  if (!Number.isInteger(numOutputs) || numOutputs < 1) {\n    throw new Error(\n      `Invalid numOutputs: expected a positive integer, got ${numOutputs}`,\n    );\n  }\n\n  if (availableUTXOs.length === 0) {\n    throw new Error(\"Insufficient funds: no UTXOs available\");\n  }\n\n  assertNoDuplicateUtxos(availableUTXOs);\n\n  // Filter for script validity ONLY (matching btc-staking-ts approach)\n  // No minimum value filter - we accept any UTXO with valid script\n  const validUTXOs = availableUTXOs.filter((utxo) => {\n    const script = Buffer.from(utxo.scriptPubKey, \"hex\");\n    const decompiledScript = bitcoinScript.decompile(script);\n    return !!decompiledScript;\n  });\n\n  if (validUTXOs.length === 0) {\n    throw new Error(\n      \"Insufficient funds: no valid UTXOs available (all have invalid scripts)\",\n    );\n  }\n\n  // Sort by value: HIGHEST to LOWEST (use big UTXOs first)\n  // Use spread to avoid mutating the original array\n  const sortedUTXOs = [...validUTXOs].sort((a, b) => b.value - a.value);\n\n  const selectedUTXOs: UTXO[] = [];\n  let accumulatedValue = 0n;\n  let estimatedFee = 0n;\n\n  // Iteratively select UTXOs and recalculate fee\n  for (const utxo of sortedUTXOs) {\n    selectedUTXOs.push(utxo);\n    accumulatedValue += BigInt(utxo.value);\n\n    // Recalculate fee based on CURRENT number of inputs\n    const inputSize = selectedUTXOs.length * P2TR_INPUT_SIZE;\n    const outputSize = numOutputs * MAX_NON_LEGACY_OUTPUT_SIZE;\n    const baseTxSize = inputSize + outputSize + TX_BUFFER_SIZE_OVERHEAD;\n\n    // Calculate base fee with buffer\n    estimatedFee =\n      BigInt(Math.ceil(baseTxSize * feeRate)) +\n      BigInt(rateBasedTxBufferFee(feeRate));\n\n    // Check if there will be change left after pegin amount and fee\n    const changeAmount = accumulatedValue - peginAmount - estimatedFee;\n\n    // If change is above dust, add fee for change output\n    if (changeAmount > DUST_THRESHOLD) {\n      const changeOutputFee = BigInt(\n        Math.ceil(MAX_NON_LEGACY_OUTPUT_SIZE * feeRate),\n      );\n      estimatedFee += changeOutputFee;\n    }\n\n    // Check if we have enough to cover pegin amount + fees\n    if (accumulatedValue >= peginAmount + estimatedFee) {\n      // Success! We have enough funds\n      const finalChangeAmount = accumulatedValue - peginAmount - estimatedFee;\n\n      return {\n        selectedUTXOs,\n        totalValue: accumulatedValue,\n        fee: estimatedFee,\n        changeAmount: finalChangeAmount,\n      };\n    }\n  }\n\n  // If we get here, we don't have enough funds\n  throw new Error(\n    `Insufficient funds: need ${peginAmount + estimatedFee} sats (${peginAmount} pegin + ${estimatedFee} fee), have ${accumulatedValue} sats`,\n  );\n}\n\n/**\n * Checks if change amount is above dust threshold.\n *\n * @param changeAmount - Change amount in satoshis\n * @returns true if change should be added as output, false if it should go to miners\n */\nexport function shouldAddChangeOutput(changeAmount: bigint): boolean {\n  return changeAmount > DUST_THRESHOLD;\n}\n\n/**\n * Gets the dust threshold value.\n *\n * @returns Dust threshold in satoshis\n */\nexport function getDustThreshold(): number {\n  return BTC_DUST_SAT;\n}\n","/**\n * Bitcoin Transaction Hash Utilities\n *\n * Provides utilities for calculating Bitcoin transaction hashes in a way that matches\n * the contract's BtcUtils.hashBtcTx() implementation.\n */\n\nimport { Transaction } from \"bitcoinjs-lib\";\nimport type { Hex } from \"viem\";\n\n/**\n * Calculate Bitcoin transaction hash\n *\n * This matches the contract's BtcUtils.hashBtcTx() implementation:\n * 1. Double SHA256 the transaction bytes\n * 2. Reverse the byte order (Bitcoin convention)\n *\n * The resulting hash is used as the unique vault identifier in the BTCVaultRegistry contract.\n *\n * @param txHex - Transaction hex (with or without 0x prefix)\n * @returns The transaction hash as Hex (with 0x prefix)\n */\nexport function calculateBtcTxHash(txHex: string): Hex {\n  // Remove 0x prefix if present\n  const cleanHex = txHex.startsWith(\"0x\") ? txHex.slice(2) : txHex;\n\n  // Use bitcoinjs-lib to calculate transaction ID (already does double SHA256 + reverse)\n  const tx = Transaction.fromHex(cleanHex);\n  const txid = tx.getId();\n\n  // Return with 0x prefix to match Ethereum hex format\n  return `0x${txid}` as Hex;\n}\n","/**\n * Bitcoin Script Type Detection\n *\n * Utilities to detect Bitcoin script types for proper PSBT input construction.\n *\n * @module utils/btc/scriptType\n */\n\n/**\n * Bitcoin script types.\n */\nexport enum BitcoinScriptType {\n  P2PKH = \"P2PKH\",\n  P2SH = \"P2SH\",\n  P2WPKH = \"P2WPKH\",\n  P2WSH = \"P2WSH\",\n  P2TR = \"P2TR\",\n  UNKNOWN = \"UNKNOWN\",\n}\n\n/**\n * Detect the type of a Bitcoin script.\n *\n * @param scriptPubKey - The script public key buffer\n * @returns The detected script type\n *\n * @example\n * ```typescript\n * const scriptType = getScriptType(Buffer.from(scriptPubKeyHex, 'hex'));\n * if (scriptType === BitcoinScriptType.P2TR) {\n *   // Handle Taproot input\n * }\n * ```\n */\nexport function getScriptType(scriptPubKey: Buffer): BitcoinScriptType {\n  const length = scriptPubKey.length;\n\n  // P2PKH: OP_DUP OP_HASH160 <20 bytes> OP_EQUALVERIFY OP_CHECKSIG (25 bytes)\n  if (\n    length === 25 &&\n    scriptPubKey[0] === 0x76 && // OP_DUP\n    scriptPubKey[1] === 0xa9 && // OP_HASH160\n    scriptPubKey[2] === 0x14 && // Push 20 bytes\n    scriptPubKey[23] === 0x88 && // OP_EQUALVERIFY\n    scriptPubKey[24] === 0xac // OP_CHECKSIG\n  ) {\n    return BitcoinScriptType.P2PKH;\n  }\n\n  // P2SH: OP_HASH160 <20 bytes> OP_EQUAL (23 bytes)\n  if (\n    length === 23 &&\n    scriptPubKey[0] === 0xa9 && // OP_HASH160\n    scriptPubKey[1] === 0x14 && // Push 20 bytes\n    scriptPubKey[22] === 0x87 // OP_EQUAL\n  ) {\n    return BitcoinScriptType.P2SH;\n  }\n\n  // P2WPKH: OP_0 <20 bytes> (22 bytes)\n  if (\n    length === 22 &&\n    scriptPubKey[0] === 0x00 && // OP_0\n    scriptPubKey[1] === 0x14 // Push 20 bytes\n  ) {\n    return BitcoinScriptType.P2WPKH;\n  }\n\n  // P2WSH: OP_0 <32 bytes> (34 bytes)\n  if (\n    length === 34 &&\n    scriptPubKey[0] === 0x00 && // OP_0\n    scriptPubKey[1] === 0x20 // Push 32 bytes\n  ) {\n    return BitcoinScriptType.P2WSH;\n  }\n\n  // P2TR (Taproot): OP_1 <32 bytes> (34 bytes)\n  if (\n    length === 34 &&\n    scriptPubKey[0] === 0x51 && // OP_1\n    scriptPubKey[1] === 0x20 // Push 32 bytes\n  ) {\n    return BitcoinScriptType.P2TR;\n  }\n\n  return BitcoinScriptType.UNKNOWN;\n}\n\n","/**\n * PSBT Input Field Construction\n *\n * Constructs the correct PSBT input fields for a given UTXO based on its script type.\n *\n * @module utils/btc/psbtInputFields\n */\n\nimport { Buffer } from \"buffer\";\n\nimport { BitcoinScriptType, getScriptType } from \"./scriptType\";\n\n/**\n * PSBT input fields for supported script types (P2TR, P2WPKH, P2WSH).\n */\nexport interface PsbtInputFields {\n  witnessUtxo?: {\n    script: Buffer;\n    value: number;\n  };\n  witnessScript?: Buffer;\n  tapInternalKey?: Buffer;\n}\n\n/**\n * UTXO information for PSBT construction.\n *\n * Only supports Taproot (P2TR) and native SegWit (P2WPKH, P2WSH) script types.\n */\nexport interface UtxoForPsbt {\n  /** Transaction ID of the UTXO */\n  txid: string;\n  /** Output index (vout) of the UTXO */\n  vout: number;\n  /** Value of the UTXO in satoshis */\n  value: number;\n  /** ScriptPubKey of the UTXO (hex string) */\n  scriptPubKey: string;\n  /** Witness script (required for P2WSH) */\n  witnessScript?: string;\n}\n\n/**\n * Get PSBT input fields for a given UTXO based on its script type.\n *\n * Only supports Taproot (P2TR) and native SegWit (P2WPKH, P2WSH) script types.\n *\n * @param utxo - The unspent transaction output to process\n * @param publicKeyNoCoord - The x-only public key (32 bytes) for Taproot signing\n * @returns PSBT input fields object containing the necessary data\n * @throws Error if required input data is missing or unsupported script type\n */\nexport function getPsbtInputFields(\n  utxo: UtxoForPsbt,\n  publicKeyNoCoord?: Buffer,\n): PsbtInputFields {\n  const scriptPubKey = Buffer.from(utxo.scriptPubKey, \"hex\");\n  const type = getScriptType(scriptPubKey);\n\n  switch (type) {\n    case BitcoinScriptType.P2WPKH: {\n      return {\n        witnessUtxo: {\n          script: scriptPubKey,\n          value: utxo.value,\n        },\n      };\n    }\n\n    case BitcoinScriptType.P2WSH: {\n      if (!utxo.witnessScript) {\n        throw new Error(\"Missing witnessScript for P2WSH input\");\n      }\n      return {\n        witnessUtxo: {\n          script: scriptPubKey,\n          value: utxo.value,\n        },\n        witnessScript: Buffer.from(utxo.witnessScript, \"hex\"),\n      };\n    }\n\n    case BitcoinScriptType.P2TR: {\n      if (publicKeyNoCoord && publicKeyNoCoord.length !== 32) {\n        throw new Error(\n          `Invalid tapInternalKey length: expected 32 bytes, got ${publicKeyNoCoord.length}`,\n        );\n      }\n      return {\n        witnessUtxo: {\n          script: scriptPubKey,\n          value: utxo.value,\n        },\n        // tapInternalKey is needed for Taproot signing\n        ...(publicKeyNoCoord && { tapInternalKey: publicKeyNoCoord }),\n      };\n    }\n\n    default:\n      throw new Error(`Unsupported script type: ${type}`);\n  }\n}\n\n","/**\n * Smart-account-aware wrapper around viem's `waitForTransactionReceipt`.\n *\n * Externally Owned Accounts (EOAs) — wallets controlled by a single private\n * key, e.g. MetaMask or a hardware wallet. `eth_sendTransaction` returns a real\n * Ethereum tx hash, which viem can poll directly. This wrapper detects an EOA\n * via `eth_getCode` returning empty bytecode and delegates unchanged.\n *\n * Smart-contract accounts (e.g. Safe multisigs) — the wallet address is a\n * deployed contract that decides whether to accept a transaction. WalletConnect's\n * `eth_sendTransaction` returns a `safeTxHash` (an EIP-712 hash of the\n * *proposal*) rather than a real tx hash, and the proposal is held in Safe's\n * off-chain Transaction Service until quorum signs and executes it. We poll\n * that service for the proposal until execution, then wait for receipt on the\n * real Ethereum tx hash exposed in the service's response.\n *\n * @module utils/eth\n */\n\nimport type {\n  Address,\n  Hash,\n  PublicClient,\n  TransactionReceipt,\n} from \"viem\";\n\n/**\n * Chains where the Safe Transaction Service is supported by this utility.\n * Extend the map as more Safe-enabled chains are needed.\n */\nconst SAFE_TX_SERVICE_BASE_URLS: Record<number, string> = {\n  1: \"https://safe-transaction-mainnet.safe.global\",\n  11155111: \"https://safe-transaction-sepolia.safe.global\",\n};\n\nconst DEFAULT_SAFE_POLL_INTERVAL_MS = 5_000;\nconst DEFAULT_SAFE_POLL_TIMEOUT_MS = 4 * 60 * 60 * 1_000;\nconst SAFE_TX_SERVICE_FETCH_TIMEOUT_MS = 10_000;\n\nexport interface WaitForTransactionReceiptSmartAwareParams {\n  publicClient: PublicClient;\n  walletAddress: Address;\n  hash: Hash;\n  confirmations?: number;\n  /**\n   * Forwarded to viem on the EOA (externally owned account) path.\n   * Ignored on the smart-account path — see safePollTimeoutMs.\n   */\n  timeout?: number;\n  /** Total budget for waiting on Safe quorum + execution. Default 4h. */\n  safePollTimeoutMs?: number;\n  /** Poll cadence against the Safe Transaction Service. Default 5s. */\n  safePollIntervalMs?: number;\n}\n\nexport async function waitForTransactionReceiptSmartAware(\n  params: WaitForTransactionReceiptSmartAwareParams,\n): Promise<TransactionReceipt> {\n  const {\n    publicClient,\n    walletAddress,\n    hash,\n    confirmations,\n    timeout,\n    safePollTimeoutMs = DEFAULT_SAFE_POLL_TIMEOUT_MS,\n    safePollIntervalMs = DEFAULT_SAFE_POLL_INTERVAL_MS,\n  } = params;\n\n  const code = await publicClient.getCode({ address: walletAddress });\n  const isSmartAccount = code !== undefined && code !== \"0x\";\n\n  if (!isSmartAccount) {\n    return publicClient.waitForTransactionReceipt({\n      hash,\n      confirmations,\n      timeout,\n    });\n  }\n\n  const chainId = await publicClient.getChainId();\n  const realTxHash = await pollSafeTransactionServiceUntilExecuted({\n    chainId,\n    safeTxHash: hash,\n    pollIntervalMs: safePollIntervalMs,\n    timeoutMs: safePollTimeoutMs,\n  });\n\n  return publicClient.waitForTransactionReceipt({\n    hash: realTxHash,\n    confirmations,\n  });\n}\n\ninterface SafeMultisigTransaction {\n  isExecuted: boolean;\n  isSuccessful: boolean | null;\n  transactionHash: Hash | null;\n}\n\nasync function pollSafeTransactionServiceUntilExecuted({\n  chainId,\n  safeTxHash,\n  pollIntervalMs,\n  timeoutMs,\n}: {\n  chainId: number;\n  safeTxHash: Hash;\n  pollIntervalMs: number;\n  timeoutMs: number;\n}): Promise<Hash> {\n  const baseUrl = SAFE_TX_SERVICE_BASE_URLS[chainId];\n  if (!baseUrl) {\n    throw new Error(\n      `Safe Transaction Service not configured for chainId ${chainId}. ` +\n        `Connected wallet appears to be a smart-contract account, but this ` +\n        `chain is not in the supported list. Either connect an EOA or extend ` +\n        `SAFE_TX_SERVICE_BASE_URLS in waitForTransactionReceiptSmartAware.ts.`,\n    );\n  }\n\n  const url = `${baseUrl}/api/v1/multisig-transactions/${safeTxHash}/`;\n  const deadline = Date.now() + timeoutMs;\n\n  while (Date.now() < deadline) {\n    const controller = new AbortController();\n    const fetchTimeoutId = setTimeout(\n      () => controller.abort(),\n      SAFE_TX_SERVICE_FETCH_TIMEOUT_MS,\n    );\n\n    let response: Response;\n    try {\n      response = await fetch(url, { signal: controller.signal });\n    } catch (err) {\n      // Transient failure (AbortError on per-request timeout, DNS hiccup,\n      // connection reset, etc.). Log and continue to the next poll iteration\n      // instead of consuming the entire safePollTimeoutMs budget on one blip.\n      // The outer `while (Date.now() < deadline)` is what enforces the overall\n      // budget; this catch deliberately preserves it.\n      console.warn(\n        `Safe Transaction Service request failed (will retry in ${pollIntervalMs}ms): ` +\n          (err instanceof Error ? err.message : String(err)),\n      );\n      await sleep(pollIntervalMs);\n      continue;\n    } finally {\n      clearTimeout(fetchTimeoutId);\n    }\n\n    if (response.ok) {\n      const data = (await response.json()) as SafeMultisigTransaction;\n      if (data.isExecuted) {\n        if (data.isSuccessful === false) {\n          throw new Error(\n            `Safe transaction ${safeTxHash} was executed on chain but reverted. ` +\n              `Check the Safe queue UI for details.`,\n          );\n        }\n        if (data.transactionHash) {\n          return data.transactionHash;\n        }\n      }\n    } else if (response.status === 404) {\n      // Proposal not yet indexed — keep polling silently.\n    } else if (response.status >= 500) {\n      // Transient server error — same treatment as a hung connection: log and retry.\n      console.warn(\n        `Safe Transaction Service returned ${response.status} for ${safeTxHash}; retrying in ${pollIntervalMs}ms.`,\n      );\n    } else {\n      // Other 4xx (403, 410, etc.) is likely permanent — surface immediately.\n      throw new Error(\n        `Safe Transaction Service returned ${response.status} for ${safeTxHash}.`,\n      );\n    }\n\n    await sleep(pollIntervalMs);\n  }\n\n  throw new Error(\n    `Timed out after ${timeoutMs}ms waiting for Safe transaction ${safeTxHash} ` +\n      `to reach quorum and execute. The proposal is still pending in the Safe ` +\n      `queue — co-signers must sign and execute it before the dApp can proceed.`,\n  );\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => {\n    setTimeout(resolve, ms);\n  });\n}\n"],"names":["assertNoDuplicateUtxos","utxos","seen","utxo","key","selectUtxosForPegin","availableUTXOs","peginAmount","feeRate","numOutputs","validUTXOs","script","Buffer","bitcoinScript","sortedUTXOs","b","selectedUTXOs","accumulatedValue","estimatedFee","inputSize","P2TR_INPUT_SIZE","outputSize","MAX_NON_LEGACY_OUTPUT_SIZE","baseTxSize","TX_BUFFER_SIZE_OVERHEAD","rateBasedTxBufferFee","DUST_THRESHOLD","changeOutputFee","finalChangeAmount","shouldAddChangeOutput","changeAmount","getDustThreshold","BTC_DUST_SAT","calculateBtcTxHash","txHex","cleanHex","Transaction","BitcoinScriptType","getScriptType","scriptPubKey","length","getPsbtInputFields","publicKeyNoCoord","type","SAFE_TX_SERVICE_BASE_URLS","DEFAULT_SAFE_POLL_INTERVAL_MS","DEFAULT_SAFE_POLL_TIMEOUT_MS","SAFE_TX_SERVICE_FETCH_TIMEOUT_MS","waitForTransactionReceiptSmartAware","params","publicClient","walletAddress","hash","confirmations","timeout","safePollTimeoutMs","safePollIntervalMs","code","chainId","realTxHash","pollSafeTransactionServiceUntilExecuted","safeTxHash","pollIntervalMs","timeoutMs","baseUrl","url","deadline","controller","fetchTimeoutId","response","err","sleep","data","ms","resolve"],"mappings":"mHAsDA,SAASA,EAAuBC,EAAqB,CACnD,MAAMC,MAAW,IACjB,UAAWC,KAAQF,EAAO,CACxB,MAAMG,EAAM,GAAGD,EAAK,KAAK,aAAa,IAAIA,EAAK,IAAI,GACnD,GAAID,EAAK,IAAIE,CAAG,EACd,MAAM,IAAI,MACR,4BAA4BD,EAAK,IAAI,IAAIA,EAAK,IAAI,+DAAA,EAItDD,EAAK,IAAIE,CAAG,CACd,CACF,CAsBO,SAASC,EACdC,EACAC,EACAC,EACAC,EACqB,CACrB,GAAI,CAAC,OAAO,UAAUA,CAAU,GAAKA,EAAa,EAChD,MAAM,IAAI,MACR,wDAAwDA,CAAU,EAAA,EAItE,GAAIH,EAAe,SAAW,EAC5B,MAAM,IAAI,MAAM,wCAAwC,EAG1DN,EAAuBM,CAAc,EAIrC,MAAMI,EAAaJ,EAAe,OAAQH,GAAS,CACjD,MAAMQ,EAASC,EAAAA,OAAO,KAAKT,EAAK,aAAc,KAAK,EAEnD,MAAO,CAAC,CADiBU,EAAAA,OAAc,UAAUF,CAAM,CAEzD,CAAC,EAED,GAAID,EAAW,SAAW,EACxB,MAAM,IAAI,MACR,yEAAA,EAMJ,MAAMI,EAAc,CAAC,GAAGJ,CAAU,EAAE,KAAK,CAAC,EAAGK,IAAMA,EAAE,MAAQ,EAAE,KAAK,EAE9DC,EAAwB,CAAA,EAC9B,IAAIC,EAAmB,GACnBC,EAAe,GAGnB,UAAWf,KAAQW,EAAa,CAC9BE,EAAc,KAAKb,CAAI,EACvBc,GAAoB,OAAOd,EAAK,KAAK,EAGrC,MAAMgB,EAAYH,EAAc,OAASI,EAAAA,gBACnCC,EAAaZ,EAAaa,EAAAA,2BAC1BC,EAAaJ,EAAYE,EAAaG,EAAAA,wBAW5C,GARAN,EACE,OAAO,KAAK,KAAKK,EAAaf,CAAO,CAAC,EACtC,OAAOiB,uBAAqBjB,CAAO,CAAC,EAGjBS,EAAmBV,EAAcW,EAGnCQ,EAAAA,eAAgB,CACjC,MAAMC,EAAkB,OACtB,KAAK,KAAKL,EAAAA,2BAA6Bd,CAAO,CAAA,EAEhDU,GAAgBS,CAClB,CAGA,GAAIV,GAAoBV,EAAcW,EAAc,CAElD,MAAMU,EAAoBX,EAAmBV,EAAcW,EAE3D,MAAO,CACL,cAAAF,EACA,WAAYC,EACZ,IAAKC,EACL,aAAcU,CAAA,CAElB,CACF,CAGA,MAAM,IAAI,MACR,4BAA4BrB,EAAcW,CAAY,UAAUX,CAAW,YAAYW,CAAY,eAAeD,CAAgB,OAAA,CAEtI,CAQO,SAASY,EAAsBC,EAA+B,CACnE,OAAOA,EAAeJ,EAAAA,cACxB,CAOO,SAASK,GAA2B,CACzC,OAAOC,EAAAA,YACT,CCzKO,SAASC,EAAmBC,EAAoB,CAErD,MAAMC,EAAWD,EAAM,WAAW,IAAI,EAAIA,EAAM,MAAM,CAAC,EAAIA,EAO3D,MAAO,KAJIE,EAAAA,YAAY,QAAQD,CAAQ,EACvB,MAAA,CAGA,EAClB,CCrBO,IAAKE,GAAAA,IACVA,EAAA,MAAQ,QACRA,EAAA,KAAO,OACPA,EAAA,OAAS,SACTA,EAAA,MAAQ,QACRA,EAAA,KAAO,OACPA,EAAA,QAAU,UANAA,IAAAA,GAAA,CAAA,CAAA,EAuBL,SAASC,EAAcC,EAAyC,CACrE,MAAMC,EAASD,EAAa,OAG5B,OACEC,IAAW,IACXD,EAAa,CAAC,IAAM,KACpBA,EAAa,CAAC,IAAM,KACpBA,EAAa,CAAC,IAAM,IACpBA,EAAa,EAAE,IAAM,KACrBA,EAAa,EAAE,IAAM,IAEd,QAKPC,IAAW,IACXD,EAAa,CAAC,IAAM,KACpBA,EAAa,CAAC,IAAM,IACpBA,EAAa,EAAE,IAAM,IAEd,OAKPC,IAAW,IACXD,EAAa,CAAC,IAAM,GACpBA,EAAa,CAAC,IAAM,GAEb,SAKPC,IAAW,IACXD,EAAa,CAAC,IAAM,GACpBA,EAAa,CAAC,IAAM,GAEb,QAKPC,IAAW,IACXD,EAAa,CAAC,IAAM,IACpBA,EAAa,CAAC,IAAM,GAEb,OAGF,SACT,CCnCO,SAASE,EACdtC,EACAuC,EACiB,CACjB,MAAMH,EAAe3B,EAAAA,OAAO,KAAKT,EAAK,aAAc,KAAK,EACnDwC,EAAOL,EAAcC,CAAY,EAEvC,OAAQI,EAAA,CACN,KAAKN,EAAkB,OACrB,MAAO,CACL,YAAa,CACX,OAAQE,EACR,MAAOpC,EAAK,KAAA,CACd,EAIJ,KAAKkC,EAAkB,MAAO,CAC5B,GAAI,CAAClC,EAAK,cACR,MAAM,IAAI,MAAM,uCAAuC,EAEzD,MAAO,CACL,YAAa,CACX,OAAQoC,EACR,MAAOpC,EAAK,KAAA,EAEd,cAAeS,EAAAA,OAAO,KAAKT,EAAK,cAAe,KAAK,CAAA,CAExD,CAEA,KAAKkC,EAAkB,KAAM,CAC3B,GAAIK,GAAoBA,EAAiB,SAAW,GAClD,MAAM,IAAI,MACR,yDAAyDA,EAAiB,MAAM,EAAA,EAGpF,MAAO,CACL,YAAa,CACX,OAAQH,EACR,MAAOpC,EAAK,KAAA,EAGd,GAAIuC,GAAoB,CAAE,eAAgBA,CAAA,CAAiB,CAE/D,CAEA,QACE,MAAM,IAAI,MAAM,4BAA4BC,CAAI,EAAE,CAAA,CAExD,CCvEA,MAAMC,EAAoD,CACxD,EAAG,+CACH,SAAU,8CACZ,EAEMC,EAAgC,IAChCC,EAA+B,MAAc,IAC7CC,EAAmC,IAkBzC,eAAsBC,EACpBC,EAC6B,CAC7B,KAAM,CACJ,aAAAC,EACA,cAAAC,EACA,KAAAC,EACA,cAAAC,EACA,QAAAC,EACA,kBAAAC,EAAoBT,EACpB,mBAAAU,EAAqBX,CAAA,EACnBI,EAEEQ,EAAO,MAAMP,EAAa,QAAQ,CAAE,QAASC,EAAe,EAGlE,GAAI,EAFmBM,IAAS,QAAaA,IAAS,MAGpD,OAAOP,EAAa,0BAA0B,CAC5C,KAAAE,EACA,cAAAC,EACA,QAAAC,CAAA,CACD,EAGH,MAAMI,EAAU,MAAMR,EAAa,WAAA,EAC7BS,EAAa,MAAMC,EAAwC,CAC/D,QAAAF,EACA,WAAYN,EACZ,eAAgBI,EAChB,UAAWD,CAAA,CACZ,EAED,OAAOL,EAAa,0BAA0B,CAC5C,KAAMS,EACN,cAAAN,CAAA,CACD,CACH,CAQA,eAAeO,EAAwC,CACrD,QAAAF,EACA,WAAAG,EACA,eAAAC,EACA,UAAAC,CACF,EAKkB,CAChB,MAAMC,EAAUpB,EAA0Bc,CAAO,EACjD,GAAI,CAACM,EACH,MAAM,IAAI,MACR,uDAAuDN,CAAO,8MAAA,EAOlE,MAAMO,EAAM,GAAGD,CAAO,iCAAiCH,CAAU,IAC3DK,EAAW,KAAK,IAAA,EAAQH,EAE9B,KAAO,KAAK,IAAA,EAAQG,GAAU,CAC5B,MAAMC,EAAa,IAAI,gBACjBC,EAAiB,WACrB,IAAMD,EAAW,MAAA,EACjBpB,CAAA,EAGF,IAAIsB,EACJ,GAAI,CACFA,EAAW,MAAM,MAAMJ,EAAK,CAAE,OAAQE,EAAW,OAAQ,CAC3D,OAASG,EAAK,CAMZ,QAAQ,KACN,0DAA0DR,CAAc,SACrEQ,aAAe,MAAQA,EAAI,QAAU,OAAOA,CAAG,EAAA,EAEpD,MAAMC,EAAMT,CAAc,EAC1B,QACF,QAAA,CACE,aAAaM,CAAc,CAC7B,CAEA,GAAIC,EAAS,GAAI,CACf,MAAMG,EAAQ,MAAMH,EAAS,KAAA,EAC7B,GAAIG,EAAK,WAAY,CACnB,GAAIA,EAAK,eAAiB,GACxB,MAAM,IAAI,MACR,oBAAoBX,CAAU,2EAAA,EAIlC,GAAIW,EAAK,gBACP,OAAOA,EAAK,eAEhB,CACF,SAAWH,EAAS,SAAW,IAE/B,GAAWA,EAAS,QAAU,IAE5B,QAAQ,KACN,qCAAqCA,EAAS,MAAM,QAAQR,CAAU,iBAAiBC,CAAc,KAAA,MAIvG,OAAM,IAAI,MACR,qCAAqCO,EAAS,MAAM,QAAQR,CAAU,GAAA,EAI1E,MAAMU,EAAMT,CAAc,CAC5B,CAEA,MAAM,IAAI,MACR,mBAAmBC,CAAS,mCAAmCF,CAAU,kJAAA,CAI7E,CAEA,SAASU,EAAME,EAA2B,CACxC,OAAO,IAAI,QAASC,GAAY,CAC9B,WAAWA,EAASD,CAAE,CACxB,CAAC,CACH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@babylonlabs-io/ts-sdk",
-  "version": "0.34.0",
+  "version": "0.36.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -97,7 +97,6 @@
   "description": "TypeScript SDK for Babylon protocol integrations",
   "dependencies": {
     "@noble/hashes": "2.0.1",
-    "@scure/bip39": "2.0.1",
     "buffer": "6.0.3",
     "@babylonlabs-io/babylon-tbv-rust-wasm": "0.1.0"
   },

package/dist/PayoutManager-C9XHKZ5j.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PayoutManager-C9XHKZ5j.js","sources":["../src/tbv/core/services/htlc/index.ts","../src/tbv/core/managers/PayoutManager.ts"],"sourcesContent":["/**\n * HTLC Secret / Hashlock Utilities\n *\n * Pure functions for computing and validating SHA-256 hashlocks used in the\n * vault deposit protocol's HTLC (Hash Time Lock Contract).\n *\n * The SDK does NOT generate secrets — that is the caller's responsibility.\n * Today callers use `crypto.getRandomValues(32)`; when the `deriveContextHash`\n * wallet API ships, callers will use `wallet.deriveContextHash(\"babylon-vault\", ctx)`.\n * These utilities work identically regardless of how the secret was produced.\n *\n * On-chain contract validation (BTCVaultRegistry.activateVaultWithSecret):\n *   if (sha256(abi.encodePacked(s)) != hashlock) revert InvalidSecret();\n *\n * @module htlc\n */\n\nimport { sha256 } from \"@noble/hashes/sha2.js\";\nimport type { Hex } from \"viem\";\n\n/** Expected hex length for a 0x-prefixed bytes32 value. */\nconst HEX_BYTES32_LENGTH = 66; // \"0x\" + 64 hex chars\n\n/**\n * Decode a 0x-prefixed hex string to bytes, with strict validation.\n * @throws if the input is not a valid 0x-prefixed hex string\n */\nfunction hexToBytes(hex: Hex): Uint8Array {\n  if (!hex.startsWith(\"0x\") && !hex.startsWith(\"0X\")) {\n    throw new Error(\"Expected 0x-prefixed hex string\");\n  }\n  const clean = hex.slice(2);\n  if (clean.length % 2 !== 0) {\n    throw new Error(`Hex string has odd length: ${clean.length}`);\n  }\n  if (!/^[0-9a-fA-F]*$/.test(clean)) {\n    throw new Error(\"Hex string contains non-hex characters\");\n  }\n  const bytes = new Uint8Array(clean.length / 2);\n  for (let i = 0; i < bytes.length; i++) {\n    bytes[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);\n  }\n  return bytes;\n}\n\n/**\n * Encode a Uint8Array as a 0x-prefixed lowercase hex string.\n */\nfunction bytesToHex(bytes: Uint8Array): Hex {\n  return `0x${Array.from(bytes)\n    .map((b) => b.toString(16).padStart(2, \"0\"))\n    .join(\"\")}`;\n}\n\n/**\n * Validate that a value is a 0x-prefixed bytes32 (exactly 32 bytes).\n * @throws if the value is not exactly 32 bytes\n */\nfunction assertBytes32(value: Hex, label: string): void {\n  if (value.length !== HEX_BYTES32_LENGTH) {\n    throw new Error(\n      `${label} must be exactly 32 bytes (${HEX_BYTES32_LENGTH} hex chars with 0x prefix), got ${value.length}`,\n    );\n  }\n}\n\n/**\n * Compute the SHA-256 hashlock from a secret preimage.\n *\n * Matches the on-chain validation: `sha256(abi.encodePacked(s))` where `s` is a `bytes32`.\n * `abi.encodePacked(bytes32)` is just the raw 32 bytes — no ABI padding.\n *\n * @param secret - 0x-prefixed bytes32 secret (66 hex chars)\n * @returns 0x-prefixed bytes32 SHA-256 hash\n * @throws if secret is not exactly 32 bytes\n */\nexport function computeHashlock(secret: Hex): Hex {\n  assertBytes32(secret, \"Secret\");\n  const secretBytes = hexToBytes(secret);\n  const hash = sha256(secretBytes);\n  return bytesToHex(hash);\n}\n\n/**\n * Validate that a secret's SHA-256 hash matches the expected hashlock.\n *\n * Use this for client-side pre-validation before sending the activation\n * transaction to avoid wasting gas on a contract revert.\n *\n * @param secret - 0x-prefixed bytes32 secret (66 hex chars)\n * @param hashlock - 0x-prefixed bytes32 expected hashlock from the vault\n * @returns true if SHA-256(secret) matches the hashlock\n * @throws if secret or hashlock is not exactly 32 bytes\n */\nexport function validateSecretAgainstHashlock(\n  secret: Hex,\n  hashlock: Hex,\n): boolean {\n  assertBytes32(secret, \"Secret\");\n  assertBytes32(hashlock, \"Hashlock\");\n  // Validate hashlock is valid hex (secret is validated inside computeHashlock)\n  hexToBytes(hashlock);\n\n  const computed = computeHashlock(secret);\n  return computed.toLowerCase() === hashlock.toLowerCase();\n}\n","/**\n * Payout Manager\n *\n * High-level manager that orchestrates the payout signing flow by coordinating\n * SDK primitives ({@link buildPayoutPsbt}, {@link extractPayoutSignature})\n * with a user-provided Bitcoin wallet.\n *\n * The Payout transaction references the Assert transaction (input 1).\n *\n * @see {@link PeginManager} - For Steps 1–4 of the peg-in flow\n * @see {@link buildPayoutPsbt} - Lower-level primitive for custom implementations\n * @see {@link extractPayoutSignature} - Extract signatures from signed PSBTs\n *\n * @module managers/PayoutManager\n */\n\nimport type {\n  BitcoinWallet,\n  SignPsbtOptions,\n} from \"../../../shared/wallets\";\nimport { createTaprootScriptPathSignOptions } from \"../utils/signing\";\nimport {\n  assertPayoutOutputMatchesRegistered,\n  buildPayoutPsbt,\n  extractPayoutSignature,\n  validateWalletPubkey,\n  type Network,\n} from \"../primitives\";\n\n/**\n * Configuration for the PayoutManager.\n */\nexport interface PayoutManagerConfig {\n  /**\n   * Bitcoin network to use for transactions.\n   */\n  network: Network;\n\n  /**\n   * Bitcoin wallet for signing payout transactions.\n   */\n  btcWallet: BitcoinWallet;\n}\n\n/**\n * Base parameters shared by both payout transaction types.\n */\ninterface SignPayoutBaseParams {\n  /**\n   * Peg-in transaction hex.\n   * The original transaction that created the vault output being spent.\n   */\n  peginTxHex: string;\n\n  /**\n   * Vault provider's BTC public key (x-only, 64-char hex).\n   */\n  vaultProviderBtcPubkey: string;\n\n  /**\n   * Vault keeper BTC public keys (x-only, 64-char hex).\n   */\n  vaultKeeperBtcPubkeys: string[];\n\n  /**\n   * Universal challenger BTC public keys (x-only, 64-char hex).\n   */\n  universalChallengerBtcPubkeys: string[];\n\n  /**\n   * CSV timelock in blocks for the PegIn output.\n   */\n  timelockPegin: number;\n\n  /**\n   * Depositor's BTC public key (x-only, 64-char hex). This MUST be the\n   * key registered on-chain for the vault — typically read from\n   * `BTCVaultRegistry.getBtcVaultBasicInfo(...).depositorBtcPubKey`.\n   *\n   * Required: omitting it would degrade `validateWalletPubkey` to a\n   * self-comparison, allowing the wrong wallet to produce a signature\n   * over a script tree that doesn't match the on-chain UTXO.\n   */\n  depositorBtcPubkey: string;\n\n  /**\n   * The on-chain registered depositor payout scriptPubKey (hex, with or without 0x prefix).\n   * Used to validate that the VP-provided payout transaction actually pays to the\n   * correct depositor payout address before signing.\n   */\n  registeredPayoutScriptPubKey: string;\n}\n\n/**\n * Parameters for signing a Payout transaction.\n *\n * Payout is used in the challenge path after Assert, when the claimer proves validity.\n * Input 1 references the Assert transaction.\n */\nexport interface SignPayoutParams extends SignPayoutBaseParams {\n  /**\n   * Payout transaction hex (unsigned).\n   * This is the transaction from the vault provider that needs depositor signature.\n   */\n  payoutTxHex: string;\n\n  /**\n   * Assert transaction hex.\n   * Payout input 1 references Assert output 0.\n   */\n  assertTxHex: string;\n}\n\n/**\n * Result of signing a payout transaction.\n */\nexport interface PayoutSignatureResult {\n  /**\n   * 64-byte Schnorr signature (128 hex characters).\n   */\n  signature: string;\n\n  /**\n   * Depositor's BTC public key used for signing.\n   */\n  depositorBtcPubkey: string;\n}\n\n/**\n * High-level manager for payout transaction signing.\n *\n * @remarks\n * After registering your peg-in on Ethereum (Step 3), the vault provider prepares\n * claim/payout transaction pairs. You must sign each payout transaction using this\n * manager and submit the signatures to the vault provider's RPC API.\n *\n * **What happens internally:**\n * 1. Validates your wallet's public key matches the vault's depositor\n * 2. Builds an unsigned PSBT with taproot script path spend info\n * 3. Signs input 0 (the vault UTXO) with your wallet\n * 4. Extracts the 64-byte Schnorr signature\n *\n * **Note:** The payout transaction has 2 inputs. PayoutManager only signs input 0\n * (from the peg-in tx). Input 1 (from the assert tx) is signed by the vault provider.\n *\n * @see {@link PeginManager} - For the complete peg-in flow context\n * @see {@link buildPayoutPsbt} - Lower-level primitive used internally\n * @see {@link extractPayoutSignature} - Signature extraction primitive\n */\nexport class PayoutManager {\n  private readonly config: PayoutManagerConfig;\n\n  /**\n   * Creates a new PayoutManager instance.\n   *\n   * @param config - Manager configuration including wallet\n   */\n  constructor(config: PayoutManagerConfig) {\n    this.config = config;\n  }\n\n  /**\n   * Signs a Payout transaction and extracts the Schnorr signature.\n   *\n   * Flow:\n   * 1. Vault provider submits Claim transaction\n   * 2. Claimer submits Assert transaction to prove validity\n   * 3. Payout can be executed (references Assert tx)\n   *\n   * This method orchestrates the following steps:\n   * 1. Get wallet's public key and convert to x-only format\n   * 2. Validate wallet pubkey matches on-chain depositor pubkey (if provided)\n   * 3. Build unsigned PSBT using primitives\n   * 4. Sign PSBT via btcWallet.signPsbt()\n   * 5. Extract 64-byte Schnorr signature using primitives\n   *\n   * The returned signature can be submitted to the vault provider API.\n   *\n   * @param params - Payout signing parameters\n   * @returns Signature result with 64-byte Schnorr signature and depositor pubkey\n   * @throws Error if wallet pubkey doesn't match depositor pubkey\n   * @throws Error if wallet operations fail or signature extraction fails\n   */\n  async signPayoutTransaction(\n    params: SignPayoutParams,\n  ): Promise<PayoutSignatureResult> {\n    // Validate payout TX outputs pay to the registered depositor payout address\n    this.validatePayoutOutputs(\n      params.payoutTxHex,\n      params.registeredPayoutScriptPubKey,\n    );\n\n    // Validate wallet pubkey matches depositor and get both formats\n    const walletPubkeyRaw = await this.config.btcWallet.getPublicKeyHex();\n    const { depositorPubkey } = validateWalletPubkey(\n      walletPubkeyRaw,\n      params.depositorBtcPubkey,\n    );\n\n    // Build unsigned PSBT for Payout (uses Assert tx)\n    const payoutPsbt = await buildPayoutPsbt({\n      payoutTxHex: params.payoutTxHex,\n      peginTxHex: params.peginTxHex,\n      assertTxHex: params.assertTxHex,\n      depositorBtcPubkey: depositorPubkey,\n      vaultProviderBtcPubkey: params.vaultProviderBtcPubkey,\n      vaultKeeperBtcPubkeys: params.vaultKeeperBtcPubkeys,\n      universalChallengerBtcPubkeys: params.universalChallengerBtcPubkeys,\n      timelockPegin: params.timelockPegin,\n      network: this.config.network,\n    });\n\n    // Sign PSBT via wallet (Taproot script-path spend, input 0 only)\n    const signedPsbtHex = await this.config.btcWallet.signPsbt(\n      payoutPsbt.psbtHex,\n      createTaprootScriptPathSignOptions(walletPubkeyRaw, 1),\n    );\n\n    // Extract Schnorr signature\n    const signature = extractPayoutSignature(signedPsbtHex, depositorPubkey);\n\n    return {\n      signature,\n      depositorBtcPubkey: depositorPubkey,\n    };\n  }\n\n  /**\n   * Gets the configured Bitcoin network.\n   *\n   * @returns The Bitcoin network (mainnet, testnet, signet, regtest)\n   */\n  getNetwork(): Network {\n    return this.config.network;\n  }\n\n  /**\n   * Checks if the wallet supports batch signing (signPsbts).\n   *\n   * @returns true if batch signing is supported\n   */\n  supportsBatchSigning(): boolean {\n    return typeof this.config.btcWallet.signPsbts === \"function\";\n  }\n\n  /**\n   * Batch signs multiple payout transactions (1 per claimer).\n   * This allows signing all transactions with a single wallet interaction.\n   *\n   * @param transactions - Array of payout params to sign\n   * @returns Array of signature results matching input order\n   * @throws Error if wallet doesn't support batch signing\n   * @throws Error if any signing operation fails\n   */\n  async signPayoutTransactionsBatch(\n    transactions: SignPayoutParams[],\n  ): Promise<\n    Array<{\n      payoutSignature: string;\n      depositorBtcPubkey: string;\n    }>\n  > {\n    if (!this.supportsBatchSigning()) {\n      throw new Error(\n        \"Wallet does not support batch signing (signPsbts method not available)\",\n      );\n    }\n\n    // Get wallet pubkey once\n    const walletPubkeyRaw = await this.config.btcWallet.getPublicKeyHex();\n\n    // Build all PSBTs (1 per claimer)\n    const psbtsToSign: string[] = [];\n    const signOptions: SignPsbtOptions[] = [];\n    const depositorPubkeys: string[] = [];\n\n    for (const tx of transactions) {\n      // Validate payout TX outputs pay to the registered depositor payout address\n      this.validatePayoutOutputs(\n        tx.payoutTxHex,\n        tx.registeredPayoutScriptPubKey,\n      );\n\n      // Validate wallet pubkey matches depositor\n      const { depositorPubkey } = validateWalletPubkey(\n        walletPubkeyRaw,\n        tx.depositorBtcPubkey,\n      );\n      depositorPubkeys.push(depositorPubkey);\n\n      // Build Payout PSBT\n      const payoutPsbt = await buildPayoutPsbt({\n        payoutTxHex: tx.payoutTxHex,\n        peginTxHex: tx.peginTxHex,\n        assertTxHex: tx.assertTxHex,\n        depositorBtcPubkey: depositorPubkey,\n        vaultProviderBtcPubkey: tx.vaultProviderBtcPubkey,\n        vaultKeeperBtcPubkeys: tx.vaultKeeperBtcPubkeys,\n        universalChallengerBtcPubkeys: tx.universalChallengerBtcPubkeys,\n        timelockPegin: tx.timelockPegin,\n        network: this.config.network,\n      });\n      psbtsToSign.push(payoutPsbt.psbtHex);\n      signOptions.push(createTaprootScriptPathSignOptions(walletPubkeyRaw, 1));\n    }\n\n    // Batch sign all PSBTs with single wallet interaction\n    const signedPsbts = await this.config.btcWallet.signPsbts!(\n      psbtsToSign,\n      signOptions,\n    );\n\n    // Validate that wallet returned the expected number of signed PSBTs\n    if (signedPsbts.length !== transactions.length) {\n      throw new Error(\n        `Expected ${transactions.length} signed PSBTs but received ${signedPsbts.length}`,\n      );\n    }\n\n    // Extract signatures from signed PSBTs\n    const results: Array<{\n      payoutSignature: string;\n      depositorBtcPubkey: string;\n    }> = [];\n\n    for (let i = 0; i < transactions.length; i++) {\n      const depositorPubkey = depositorPubkeys[i];\n      const payoutSignature = extractPayoutSignature(\n        signedPsbts[i],\n        depositorPubkey,\n      );\n\n      results.push({\n        payoutSignature,\n        depositorBtcPubkey: depositorPubkey,\n      });\n    }\n\n    return results;\n  }\n\n  /**\n   * Validates that the payout transaction's largest output pays to the\n   * registered depositor payout address (scriptPubKey).\n   *\n   * This prevents two attack vectors from a malicious vault provider:\n   * 1. Substituting a completely different payout address\n   * 2. Including a dust output to the correct address while routing\n   *    the actual funds to an attacker-controlled address\n   *\n   * @param payoutTxHex - Raw payout transaction hex\n   * @param registeredPayoutScriptPubKey - On-chain registered scriptPubKey (hex, with or without 0x prefix)\n   * @throws Error if scriptPubKey is invalid hex\n   * @throws Error if the largest output does not pay to the registered address\n   */\n  private validatePayoutOutputs(\n    payoutTxHex: string,\n    registeredPayoutScriptPubKey: string,\n  ): void {\n    assertPayoutOutputMatchesRegistered(\n      payoutTxHex,\n      registeredPayoutScriptPubKey,\n    );\n  }\n}\n"],"names":["HEX_BYTES32_LENGTH","hexToBytes","hex","clean","bytes","i","bytesToHex","b","assertBytes32","value","label","computeHashlock","secret","secretBytes","hash","sha256","validateSecretAgainstHashlock","hashlock","PayoutManager","config","__publicField","params","walletPubkeyRaw","depositorPubkey","validateWalletPubkey","payoutPsbt","buildPayoutPsbt","signedPsbtHex","createTaprootScriptPathSignOptions","extractPayoutSignature","transactions","psbtsToSign","signOptions","depositorPubkeys","tx","signedPsbts","results","payoutSignature","payoutTxHex","registeredPayoutScriptPubKey","assertPayoutOutputMatchesRegistered"],"mappings":";;;;;;;;AAqBA,MAAMA,IAAqB;AAM3B,SAASC,EAAWC,GAAsB;AACxC,MAAI,CAACA,EAAI,WAAW,IAAI,KAAK,CAACA,EAAI,WAAW,IAAI;AAC/C,UAAM,IAAI,MAAM,iCAAiC;AAEnD,QAAMC,IAAQD,EAAI,MAAM,CAAC;AACzB,MAAIC,EAAM,SAAS,MAAM;AACvB,UAAM,IAAI,MAAM,8BAA8BA,EAAM,MAAM,EAAE;AAE9D,MAAI,CAAC,iBAAiB,KAAKA,CAAK;AAC9B,UAAM,IAAI,MAAM,wCAAwC;AAE1D,QAAMC,IAAQ,IAAI,WAAWD,EAAM,SAAS,CAAC;AAC7C,WAASE,IAAI,GAAGA,IAAID,EAAM,QAAQC;AAChC,IAAAD,EAAMC,CAAC,IAAI,SAASF,EAAM,MAAME,IAAI,GAAGA,IAAI,IAAI,CAAC,GAAG,EAAE;AAEvD,SAAOD;AACT;AAKA,SAASE,EAAWF,GAAwB;AAC1C,SAAO,KAAK,MAAM,KAAKA,CAAK,EACzB,IAAI,CAACG,MAAMA,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE,CAAC;AACb;AAMA,SAASC,EAAcC,GAAYC,GAAqB;AACtD,MAAID,EAAM,WAAWT;AACnB,UAAM,IAAI;AAAA,MACR,GAAGU,CAAK,8BAA8BV,CAAkB,mCAAmCS,EAAM,MAAM;AAAA,IAAA;AAG7G;AAYO,SAASE,EAAgBC,GAAkB;AAChD,EAAAJ,EAAcI,GAAQ,QAAQ;AAC9B,QAAMC,IAAcZ,EAAWW,CAAM,GAC/BE,IAAOC,EAAOF,CAAW;AAC/B,SAAOP,EAAWQ,CAAI;AACxB;AAaO,SAASE,EACdJ,GACAK,GACS;AACT,SAAAT,EAAcI,GAAQ,QAAQ,GAC9BJ,EAAcS,GAAU,UAAU,GAElChB,EAAWgB,CAAQ,GAEFN,EAAgBC,CAAM,EACvB,kBAAkBK,EAAS,YAAA;AAC7C;AC4CO,MAAMC,EAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQzB,YAAYC,GAA6B;AAPxB,IAAAC,EAAA;AAQf,SAAK,SAASD;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,MAAM,sBACJE,GACgC;AAEhC,SAAK;AAAA,MACHA,EAAO;AAAA,MACPA,EAAO;AAAA,IAAA;AAIT,UAAMC,IAAkB,MAAM,KAAK,OAAO,UAAU,gBAAA,GAC9C,EAAE,iBAAAC,MAAoBC;AAAA,MAC1BF;AAAA,MACAD,EAAO;AAAA,IAAA,GAIHI,IAAa,MAAMC,EAAgB;AAAA,MACvC,aAAaL,EAAO;AAAA,MACpB,YAAYA,EAAO;AAAA,MACnB,aAAaA,EAAO;AAAA,MACpB,oBAAoBE;AAAA,MACpB,wBAAwBF,EAAO;AAAA,MAC/B,uBAAuBA,EAAO;AAAA,MAC9B,+BAA+BA,EAAO;AAAA,MACtC,eAAeA,EAAO;AAAA,MACtB,SAAS,KAAK,OAAO;AAAA,IAAA,CACtB,GAGKM,IAAgB,MAAM,KAAK,OAAO,UAAU;AAAA,MAChDF,EAAW;AAAA,MACXG,EAAmCN,GAAiB,CAAC;AAAA,IAAA;AAMvD,WAAO;AAAA,MACL,WAHgBO,EAAuBF,GAAeJ,CAAe;AAAA,MAIrE,oBAAoBA;AAAA,IAAA;AAAA,EAExB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAsB;AACpB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,uBAAgC;AAC9B,WAAO,OAAO,KAAK,OAAO,UAAU,aAAc;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,4BACJO,GAMA;AACA,QAAI,CAAC,KAAK;AACR,YAAM,IAAI;AAAA,QACR;AAAA,MAAA;AAKJ,UAAMR,IAAkB,MAAM,KAAK,OAAO,UAAU,gBAAA,GAG9CS,IAAwB,CAAA,GACxBC,IAAiC,CAAA,GACjCC,IAA6B,CAAA;AAEnC,eAAWC,KAAMJ,GAAc;AAE7B,WAAK;AAAA,QACHI,EAAG;AAAA,QACHA,EAAG;AAAA,MAAA;AAIL,YAAM,EAAE,iBAAAX,MAAoBC;AAAA,QAC1BF;AAAA,QACAY,EAAG;AAAA,MAAA;AAEL,MAAAD,EAAiB,KAAKV,CAAe;AAGrC,YAAME,IAAa,MAAMC,EAAgB;AAAA,QACvC,aAAaQ,EAAG;AAAA,QAChB,YAAYA,EAAG;AAAA,QACf,aAAaA,EAAG;AAAA,QAChB,oBAAoBX;AAAA,QACpB,wBAAwBW,EAAG;AAAA,QAC3B,uBAAuBA,EAAG;AAAA,QAC1B,+BAA+BA,EAAG;AAAA,QAClC,eAAeA,EAAG;AAAA,QAClB,SAAS,KAAK,OAAO;AAAA,MAAA,CACtB;AACD,MAAAH,EAAY,KAAKN,EAAW,OAAO,GACnCO,EAAY,KAAKJ,EAAmCN,GAAiB,CAAC,CAAC;AAAA,IACzE;AAGA,UAAMa,IAAc,MAAM,KAAK,OAAO,UAAU;AAAA,MAC9CJ;AAAA,MACAC;AAAA,IAAA;AAIF,QAAIG,EAAY,WAAWL,EAAa;AACtC,YAAM,IAAI;AAAA,QACR,YAAYA,EAAa,MAAM,8BAA8BK,EAAY,MAAM;AAAA,MAAA;AAKnF,UAAMC,IAGD,CAAA;AAEL,aAAS/B,IAAI,GAAGA,IAAIyB,EAAa,QAAQzB,KAAK;AAC5C,YAAMkB,IAAkBU,EAAiB5B,CAAC,GACpCgC,IAAkBR;AAAA,QACtBM,EAAY9B,CAAC;AAAA,QACbkB;AAAA,MAAA;AAGF,MAAAa,EAAQ,KAAK;AAAA,QACX,iBAAAC;AAAA,QACA,oBAAoBd;AAAA,MAAA,CACrB;AAAA,IACH;AAEA,WAAOa;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBQ,sBACNE,GACAC,GACM;AACN,IAAAC;AAAA,MACEF;AAAA,MACAC;AAAA,IAAA;AAAA,EAEJ;AACF;"}

package/dist/PayoutManager-DDnNB0mj.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"PayoutManager-DDnNB0mj.cjs","sources":["../src/tbv/core/services/htlc/index.ts","../src/tbv/core/managers/PayoutManager.ts"],"sourcesContent":["/**\n * HTLC Secret / Hashlock Utilities\n *\n * Pure functions for computing and validating SHA-256 hashlocks used in the\n * vault deposit protocol's HTLC (Hash Time Lock Contract).\n *\n * The SDK does NOT generate secrets — that is the caller's responsibility.\n * Today callers use `crypto.getRandomValues(32)`; when the `deriveContextHash`\n * wallet API ships, callers will use `wallet.deriveContextHash(\"babylon-vault\", ctx)`.\n * These utilities work identically regardless of how the secret was produced.\n *\n * On-chain contract validation (BTCVaultRegistry.activateVaultWithSecret):\n *   if (sha256(abi.encodePacked(s)) != hashlock) revert InvalidSecret();\n *\n * @module htlc\n */\n\nimport { sha256 } from \"@noble/hashes/sha2.js\";\nimport type { Hex } from \"viem\";\n\n/** Expected hex length for a 0x-prefixed bytes32 value. */\nconst HEX_BYTES32_LENGTH = 66; // \"0x\" + 64 hex chars\n\n/**\n * Decode a 0x-prefixed hex string to bytes, with strict validation.\n * @throws if the input is not a valid 0x-prefixed hex string\n */\nfunction hexToBytes(hex: Hex): Uint8Array {\n  if (!hex.startsWith(\"0x\") && !hex.startsWith(\"0X\")) {\n    throw new Error(\"Expected 0x-prefixed hex string\");\n  }\n  const clean = hex.slice(2);\n  if (clean.length % 2 !== 0) {\n    throw new Error(`Hex string has odd length: ${clean.length}`);\n  }\n  if (!/^[0-9a-fA-F]*$/.test(clean)) {\n    throw new Error(\"Hex string contains non-hex characters\");\n  }\n  const bytes = new Uint8Array(clean.length / 2);\n  for (let i = 0; i < bytes.length; i++) {\n    bytes[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);\n  }\n  return bytes;\n}\n\n/**\n * Encode a Uint8Array as a 0x-prefixed lowercase hex string.\n */\nfunction bytesToHex(bytes: Uint8Array): Hex {\n  return `0x${Array.from(bytes)\n    .map((b) => b.toString(16).padStart(2, \"0\"))\n    .join(\"\")}`;\n}\n\n/**\n * Validate that a value is a 0x-prefixed bytes32 (exactly 32 bytes).\n * @throws if the value is not exactly 32 bytes\n */\nfunction assertBytes32(value: Hex, label: string): void {\n  if (value.length !== HEX_BYTES32_LENGTH) {\n    throw new Error(\n      `${label} must be exactly 32 bytes (${HEX_BYTES32_LENGTH} hex chars with 0x prefix), got ${value.length}`,\n    );\n  }\n}\n\n/**\n * Compute the SHA-256 hashlock from a secret preimage.\n *\n * Matches the on-chain validation: `sha256(abi.encodePacked(s))` where `s` is a `bytes32`.\n * `abi.encodePacked(bytes32)` is just the raw 32 bytes — no ABI padding.\n *\n * @param secret - 0x-prefixed bytes32 secret (66 hex chars)\n * @returns 0x-prefixed bytes32 SHA-256 hash\n * @throws if secret is not exactly 32 bytes\n */\nexport function computeHashlock(secret: Hex): Hex {\n  assertBytes32(secret, \"Secret\");\n  const secretBytes = hexToBytes(secret);\n  const hash = sha256(secretBytes);\n  return bytesToHex(hash);\n}\n\n/**\n * Validate that a secret's SHA-256 hash matches the expected hashlock.\n *\n * Use this for client-side pre-validation before sending the activation\n * transaction to avoid wasting gas on a contract revert.\n *\n * @param secret - 0x-prefixed bytes32 secret (66 hex chars)\n * @param hashlock - 0x-prefixed bytes32 expected hashlock from the vault\n * @returns true if SHA-256(secret) matches the hashlock\n * @throws if secret or hashlock is not exactly 32 bytes\n */\nexport function validateSecretAgainstHashlock(\n  secret: Hex,\n  hashlock: Hex,\n): boolean {\n  assertBytes32(secret, \"Secret\");\n  assertBytes32(hashlock, \"Hashlock\");\n  // Validate hashlock is valid hex (secret is validated inside computeHashlock)\n  hexToBytes(hashlock);\n\n  const computed = computeHashlock(secret);\n  return computed.toLowerCase() === hashlock.toLowerCase();\n}\n","/**\n * Payout Manager\n *\n * High-level manager that orchestrates the payout signing flow by coordinating\n * SDK primitives ({@link buildPayoutPsbt}, {@link extractPayoutSignature})\n * with a user-provided Bitcoin wallet.\n *\n * The Payout transaction references the Assert transaction (input 1).\n *\n * @see {@link PeginManager} - For Steps 1–4 of the peg-in flow\n * @see {@link buildPayoutPsbt} - Lower-level primitive for custom implementations\n * @see {@link extractPayoutSignature} - Extract signatures from signed PSBTs\n *\n * @module managers/PayoutManager\n */\n\nimport type {\n  BitcoinWallet,\n  SignPsbtOptions,\n} from \"../../../shared/wallets\";\nimport { createTaprootScriptPathSignOptions } from \"../utils/signing\";\nimport {\n  assertPayoutOutputMatchesRegistered,\n  buildPayoutPsbt,\n  extractPayoutSignature,\n  validateWalletPubkey,\n  type Network,\n} from \"../primitives\";\n\n/**\n * Configuration for the PayoutManager.\n */\nexport interface PayoutManagerConfig {\n  /**\n   * Bitcoin network to use for transactions.\n   */\n  network: Network;\n\n  /**\n   * Bitcoin wallet for signing payout transactions.\n   */\n  btcWallet: BitcoinWallet;\n}\n\n/**\n * Base parameters shared by both payout transaction types.\n */\ninterface SignPayoutBaseParams {\n  /**\n   * Peg-in transaction hex.\n   * The original transaction that created the vault output being spent.\n   */\n  peginTxHex: string;\n\n  /**\n   * Vault provider's BTC public key (x-only, 64-char hex).\n   */\n  vaultProviderBtcPubkey: string;\n\n  /**\n   * Vault keeper BTC public keys (x-only, 64-char hex).\n   */\n  vaultKeeperBtcPubkeys: string[];\n\n  /**\n   * Universal challenger BTC public keys (x-only, 64-char hex).\n   */\n  universalChallengerBtcPubkeys: string[];\n\n  /**\n   * CSV timelock in blocks for the PegIn output.\n   */\n  timelockPegin: number;\n\n  /**\n   * Depositor's BTC public key (x-only, 64-char hex). This MUST be the\n   * key registered on-chain for the vault — typically read from\n   * `BTCVaultRegistry.getBtcVaultBasicInfo(...).depositorBtcPubKey`.\n   *\n   * Required: omitting it would degrade `validateWalletPubkey` to a\n   * self-comparison, allowing the wrong wallet to produce a signature\n   * over a script tree that doesn't match the on-chain UTXO.\n   */\n  depositorBtcPubkey: string;\n\n  /**\n   * The on-chain registered depositor payout scriptPubKey (hex, with or without 0x prefix).\n   * Used to validate that the VP-provided payout transaction actually pays to the\n   * correct depositor payout address before signing.\n   */\n  registeredPayoutScriptPubKey: string;\n}\n\n/**\n * Parameters for signing a Payout transaction.\n *\n * Payout is used in the challenge path after Assert, when the claimer proves validity.\n * Input 1 references the Assert transaction.\n */\nexport interface SignPayoutParams extends SignPayoutBaseParams {\n  /**\n   * Payout transaction hex (unsigned).\n   * This is the transaction from the vault provider that needs depositor signature.\n   */\n  payoutTxHex: string;\n\n  /**\n   * Assert transaction hex.\n   * Payout input 1 references Assert output 0.\n   */\n  assertTxHex: string;\n}\n\n/**\n * Result of signing a payout transaction.\n */\nexport interface PayoutSignatureResult {\n  /**\n   * 64-byte Schnorr signature (128 hex characters).\n   */\n  signature: string;\n\n  /**\n   * Depositor's BTC public key used for signing.\n   */\n  depositorBtcPubkey: string;\n}\n\n/**\n * High-level manager for payout transaction signing.\n *\n * @remarks\n * After registering your peg-in on Ethereum (Step 3), the vault provider prepares\n * claim/payout transaction pairs. You must sign each payout transaction using this\n * manager and submit the signatures to the vault provider's RPC API.\n *\n * **What happens internally:**\n * 1. Validates your wallet's public key matches the vault's depositor\n * 2. Builds an unsigned PSBT with taproot script path spend info\n * 3. Signs input 0 (the vault UTXO) with your wallet\n * 4. Extracts the 64-byte Schnorr signature\n *\n * **Note:** The payout transaction has 2 inputs. PayoutManager only signs input 0\n * (from the peg-in tx). Input 1 (from the assert tx) is signed by the vault provider.\n *\n * @see {@link PeginManager} - For the complete peg-in flow context\n * @see {@link buildPayoutPsbt} - Lower-level primitive used internally\n * @see {@link extractPayoutSignature} - Signature extraction primitive\n */\nexport class PayoutManager {\n  private readonly config: PayoutManagerConfig;\n\n  /**\n   * Creates a new PayoutManager instance.\n   *\n   * @param config - Manager configuration including wallet\n   */\n  constructor(config: PayoutManagerConfig) {\n    this.config = config;\n  }\n\n  /**\n   * Signs a Payout transaction and extracts the Schnorr signature.\n   *\n   * Flow:\n   * 1. Vault provider submits Claim transaction\n   * 2. Claimer submits Assert transaction to prove validity\n   * 3. Payout can be executed (references Assert tx)\n   *\n   * This method orchestrates the following steps:\n   * 1. Get wallet's public key and convert to x-only format\n   * 2. Validate wallet pubkey matches on-chain depositor pubkey (if provided)\n   * 3. Build unsigned PSBT using primitives\n   * 4. Sign PSBT via btcWallet.signPsbt()\n   * 5. Extract 64-byte Schnorr signature using primitives\n   *\n   * The returned signature can be submitted to the vault provider API.\n   *\n   * @param params - Payout signing parameters\n   * @returns Signature result with 64-byte Schnorr signature and depositor pubkey\n   * @throws Error if wallet pubkey doesn't match depositor pubkey\n   * @throws Error if wallet operations fail or signature extraction fails\n   */\n  async signPayoutTransaction(\n    params: SignPayoutParams,\n  ): Promise<PayoutSignatureResult> {\n    // Validate payout TX outputs pay to the registered depositor payout address\n    this.validatePayoutOutputs(\n      params.payoutTxHex,\n      params.registeredPayoutScriptPubKey,\n    );\n\n    // Validate wallet pubkey matches depositor and get both formats\n    const walletPubkeyRaw = await this.config.btcWallet.getPublicKeyHex();\n    const { depositorPubkey } = validateWalletPubkey(\n      walletPubkeyRaw,\n      params.depositorBtcPubkey,\n    );\n\n    // Build unsigned PSBT for Payout (uses Assert tx)\n    const payoutPsbt = await buildPayoutPsbt({\n      payoutTxHex: params.payoutTxHex,\n      peginTxHex: params.peginTxHex,\n      assertTxHex: params.assertTxHex,\n      depositorBtcPubkey: depositorPubkey,\n      vaultProviderBtcPubkey: params.vaultProviderBtcPubkey,\n      vaultKeeperBtcPubkeys: params.vaultKeeperBtcPubkeys,\n      universalChallengerBtcPubkeys: params.universalChallengerBtcPubkeys,\n      timelockPegin: params.timelockPegin,\n      network: this.config.network,\n    });\n\n    // Sign PSBT via wallet (Taproot script-path spend, input 0 only)\n    const signedPsbtHex = await this.config.btcWallet.signPsbt(\n      payoutPsbt.psbtHex,\n      createTaprootScriptPathSignOptions(walletPubkeyRaw, 1),\n    );\n\n    // Extract Schnorr signature\n    const signature = extractPayoutSignature(signedPsbtHex, depositorPubkey);\n\n    return {\n      signature,\n      depositorBtcPubkey: depositorPubkey,\n    };\n  }\n\n  /**\n   * Gets the configured Bitcoin network.\n   *\n   * @returns The Bitcoin network (mainnet, testnet, signet, regtest)\n   */\n  getNetwork(): Network {\n    return this.config.network;\n  }\n\n  /**\n   * Checks if the wallet supports batch signing (signPsbts).\n   *\n   * @returns true if batch signing is supported\n   */\n  supportsBatchSigning(): boolean {\n    return typeof this.config.btcWallet.signPsbts === \"function\";\n  }\n\n  /**\n   * Batch signs multiple payout transactions (1 per claimer).\n   * This allows signing all transactions with a single wallet interaction.\n   *\n   * @param transactions - Array of payout params to sign\n   * @returns Array of signature results matching input order\n   * @throws Error if wallet doesn't support batch signing\n   * @throws Error if any signing operation fails\n   */\n  async signPayoutTransactionsBatch(\n    transactions: SignPayoutParams[],\n  ): Promise<\n    Array<{\n      payoutSignature: string;\n      depositorBtcPubkey: string;\n    }>\n  > {\n    if (!this.supportsBatchSigning()) {\n      throw new Error(\n        \"Wallet does not support batch signing (signPsbts method not available)\",\n      );\n    }\n\n    // Get wallet pubkey once\n    const walletPubkeyRaw = await this.config.btcWallet.getPublicKeyHex();\n\n    // Build all PSBTs (1 per claimer)\n    const psbtsToSign: string[] = [];\n    const signOptions: SignPsbtOptions[] = [];\n    const depositorPubkeys: string[] = [];\n\n    for (const tx of transactions) {\n      // Validate payout TX outputs pay to the registered depositor payout address\n      this.validatePayoutOutputs(\n        tx.payoutTxHex,\n        tx.registeredPayoutScriptPubKey,\n      );\n\n      // Validate wallet pubkey matches depositor\n      const { depositorPubkey } = validateWalletPubkey(\n        walletPubkeyRaw,\n        tx.depositorBtcPubkey,\n      );\n      depositorPubkeys.push(depositorPubkey);\n\n      // Build Payout PSBT\n      const payoutPsbt = await buildPayoutPsbt({\n        payoutTxHex: tx.payoutTxHex,\n        peginTxHex: tx.peginTxHex,\n        assertTxHex: tx.assertTxHex,\n        depositorBtcPubkey: depositorPubkey,\n        vaultProviderBtcPubkey: tx.vaultProviderBtcPubkey,\n        vaultKeeperBtcPubkeys: tx.vaultKeeperBtcPubkeys,\n        universalChallengerBtcPubkeys: tx.universalChallengerBtcPubkeys,\n        timelockPegin: tx.timelockPegin,\n        network: this.config.network,\n      });\n      psbtsToSign.push(payoutPsbt.psbtHex);\n      signOptions.push(createTaprootScriptPathSignOptions(walletPubkeyRaw, 1));\n    }\n\n    // Batch sign all PSBTs with single wallet interaction\n    const signedPsbts = await this.config.btcWallet.signPsbts!(\n      psbtsToSign,\n      signOptions,\n    );\n\n    // Validate that wallet returned the expected number of signed PSBTs\n    if (signedPsbts.length !== transactions.length) {\n      throw new Error(\n        `Expected ${transactions.length} signed PSBTs but received ${signedPsbts.length}`,\n      );\n    }\n\n    // Extract signatures from signed PSBTs\n    const results: Array<{\n      payoutSignature: string;\n      depositorBtcPubkey: string;\n    }> = [];\n\n    for (let i = 0; i < transactions.length; i++) {\n      const depositorPubkey = depositorPubkeys[i];\n      const payoutSignature = extractPayoutSignature(\n        signedPsbts[i],\n        depositorPubkey,\n      );\n\n      results.push({\n        payoutSignature,\n        depositorBtcPubkey: depositorPubkey,\n      });\n    }\n\n    return results;\n  }\n\n  /**\n   * Validates that the payout transaction's largest output pays to the\n   * registered depositor payout address (scriptPubKey).\n   *\n   * This prevents two attack vectors from a malicious vault provider:\n   * 1. Substituting a completely different payout address\n   * 2. Including a dust output to the correct address while routing\n   *    the actual funds to an attacker-controlled address\n   *\n   * @param payoutTxHex - Raw payout transaction hex\n   * @param registeredPayoutScriptPubKey - On-chain registered scriptPubKey (hex, with or without 0x prefix)\n   * @throws Error if scriptPubKey is invalid hex\n   * @throws Error if the largest output does not pay to the registered address\n   */\n  private validatePayoutOutputs(\n    payoutTxHex: string,\n    registeredPayoutScriptPubKey: string,\n  ): void {\n    assertPayoutOutputMatchesRegistered(\n      payoutTxHex,\n      registeredPayoutScriptPubKey,\n    );\n  }\n}\n"],"names":["HEX_BYTES32_LENGTH","hexToBytes","hex","clean","bytes","i","bytesToHex","b","assertBytes32","value","label","computeHashlock","secret","secretBytes","hash","sha256","validateSecretAgainstHashlock","hashlock","PayoutManager","config","__publicField","params","walletPubkeyRaw","depositorPubkey","validateWalletPubkey","payoutPsbt","buildPayoutPsbt","signedPsbtHex","createTaprootScriptPathSignOptions","extractPayoutSignature","transactions","psbtsToSign","signOptions","depositorPubkeys","tx","signedPsbts","results","payoutSignature","payoutTxHex","registeredPayoutScriptPubKey","assertPayoutOutputMatchesRegistered"],"mappings":"0XAqBMA,EAAqB,GAM3B,SAASC,EAAWC,EAAsB,CACxC,GAAI,CAACA,EAAI,WAAW,IAAI,GAAK,CAACA,EAAI,WAAW,IAAI,EAC/C,MAAM,IAAI,MAAM,iCAAiC,EAEnD,MAAMC,EAAQD,EAAI,MAAM,CAAC,EACzB,GAAIC,EAAM,OAAS,IAAM,EACvB,MAAM,IAAI,MAAM,8BAA8BA,EAAM,MAAM,EAAE,EAE9D,GAAI,CAAC,iBAAiB,KAAKA,CAAK,EAC9B,MAAM,IAAI,MAAM,wCAAwC,EAE1D,MAAMC,EAAQ,IAAI,WAAWD,EAAM,OAAS,CAAC,EAC7C,QAASE,EAAI,EAAGA,EAAID,EAAM,OAAQC,IAChCD,EAAMC,CAAC,EAAI,SAASF,EAAM,MAAME,EAAI,EAAGA,EAAI,EAAI,CAAC,EAAG,EAAE,EAEvD,OAAOD,CACT,CAKA,SAASE,EAAWF,EAAwB,CAC1C,MAAO,KAAK,MAAM,KAAKA,CAAK,EACzB,IAAKG,GAAMA,EAAE,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,CAAC,EAC1C,KAAK,EAAE,CAAC,EACb,CAMA,SAASC,EAAcC,EAAYC,EAAqB,CACtD,GAAID,EAAM,SAAWT,EACnB,MAAM,IAAI,MACR,GAAGU,CAAK,8BAA8BV,CAAkB,mCAAmCS,EAAM,MAAM,EAAA,CAG7G,CAYO,SAASE,EAAgBC,EAAkB,CAChDJ,EAAcI,EAAQ,QAAQ,EAC9B,MAAMC,EAAcZ,EAAWW,CAAM,EAC/BE,EAAOC,EAAAA,OAAOF,CAAW,EAC/B,OAAOP,EAAWQ,CAAI,CACxB,CAaO,SAASE,EACdJ,EACAK,EACS,CACT,OAAAT,EAAcI,EAAQ,QAAQ,EAC9BJ,EAAcS,EAAU,UAAU,EAElChB,EAAWgB,CAAQ,EAEFN,EAAgBC,CAAM,EACvB,gBAAkBK,EAAS,YAAA,CAC7C,CC4CO,MAAMC,CAAc,CAQzB,YAAYC,EAA6B,CAPxBC,EAAA,eAQf,KAAK,OAASD,CAChB,CAwBA,MAAM,sBACJE,EACgC,CAEhC,KAAK,sBACHA,EAAO,YACPA,EAAO,4BAAA,EAIT,MAAMC,EAAkB,MAAM,KAAK,OAAO,UAAU,gBAAA,EAC9C,CAAE,gBAAAC,GAAoBC,EAAAA,qBAC1BF,EACAD,EAAO,kBAAA,EAIHI,EAAa,MAAMC,kBAAgB,CACvC,YAAaL,EAAO,YACpB,WAAYA,EAAO,WACnB,YAAaA,EAAO,YACpB,mBAAoBE,EACpB,uBAAwBF,EAAO,uBAC/B,sBAAuBA,EAAO,sBAC9B,8BAA+BA,EAAO,8BACtC,cAAeA,EAAO,cACtB,QAAS,KAAK,OAAO,OAAA,CACtB,EAGKM,EAAgB,MAAM,KAAK,OAAO,UAAU,SAChDF,EAAW,QACXG,EAAAA,mCAAmCN,EAAiB,CAAC,CAAA,EAMvD,MAAO,CACL,UAHgBO,EAAAA,uBAAuBF,EAAeJ,CAAe,EAIrE,mBAAoBA,CAAA,CAExB,CAOA,YAAsB,CACpB,OAAO,KAAK,OAAO,OACrB,CAOA,sBAAgC,CAC9B,OAAO,OAAO,KAAK,OAAO,UAAU,WAAc,UACpD,CAWA,MAAM,4BACJO,EAMA,CACA,GAAI,CAAC,KAAK,uBACR,MAAM,IAAI,MACR,wEAAA,EAKJ,MAAMR,EAAkB,MAAM,KAAK,OAAO,UAAU,gBAAA,EAG9CS,EAAwB,CAAA,EACxBC,EAAiC,CAAA,EACjCC,EAA6B,CAAA,EAEnC,UAAWC,KAAMJ,EAAc,CAE7B,KAAK,sBACHI,EAAG,YACHA,EAAG,4BAAA,EAIL,KAAM,CAAE,gBAAAX,GAAoBC,EAAAA,qBAC1BF,EACAY,EAAG,kBAAA,EAELD,EAAiB,KAAKV,CAAe,EAGrC,MAAME,EAAa,MAAMC,kBAAgB,CACvC,YAAaQ,EAAG,YAChB,WAAYA,EAAG,WACf,YAAaA,EAAG,YAChB,mBAAoBX,EACpB,uBAAwBW,EAAG,uBAC3B,sBAAuBA,EAAG,sBAC1B,8BAA+BA,EAAG,8BAClC,cAAeA,EAAG,cAClB,QAAS,KAAK,OAAO,OAAA,CACtB,EACDH,EAAY,KAAKN,EAAW,OAAO,EACnCO,EAAY,KAAKJ,EAAAA,mCAAmCN,EAAiB,CAAC,CAAC,CACzE,CAGA,MAAMa,EAAc,MAAM,KAAK,OAAO,UAAU,UAC9CJ,EACAC,CAAA,EAIF,GAAIG,EAAY,SAAWL,EAAa,OACtC,MAAM,IAAI,MACR,YAAYA,EAAa,MAAM,8BAA8BK,EAAY,MAAM,EAAA,EAKnF,MAAMC,EAGD,CAAA,EAEL,QAAS/B,EAAI,EAAGA,EAAIyB,EAAa,OAAQzB,IAAK,CAC5C,MAAMkB,EAAkBU,EAAiB5B,CAAC,EACpCgC,EAAkBR,EAAAA,uBACtBM,EAAY9B,CAAC,EACbkB,CAAA,EAGFa,EAAQ,KAAK,CACX,gBAAAC,EACA,mBAAoBd,CAAA,CACrB,CACH,CAEA,OAAOa,CACT,CAgBQ,sBACNE,EACAC,EACM,CACNC,EAAAA,oCACEF,EACAC,CAAA,CAEJ,CACF"}