@babylonlabs-io/ts-sdk 0.72.1 → 0.73.0

package/dist/primeVpAuth-BI63kgdd.js

@@ -1,1171 +0,0 @@
-var ce = Object.defineProperty;
-var le = (r, e, t) => e in r ? ce(r, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : r[e] = t;
-var h = (r, e, t) => le(r, typeof e != "symbol" ? e + "" : e, t);
-import { B as v } from "./BTCVaultRegistry.abi-CJwWI2EO.js";
-import { A as _, P as g } from "./ProtocolParams.abi-C0TSRaHV.js";
-import { k as ue, v as O, o as de, j as he, l as pe } from "./mempoolApi-_CoQH5vH.js";
-import { s as A, S as ge, h as me, p as Z } from "./bitcoin-C-TuHb-v.js";
-import { V as fe } from "./index-LgmJhdEN.js";
-import { a as ye } from "./json-rpc-client-DuUARJvV.js";
-import * as q from "@bitcoin-js/tiny-secp256k1-asmjs";
-import { X as C, H as b, C as ee } from "./validation-OSC0xTHB.js";
-import { s as be } from "./sha2-BYVxyZzX.js";
-async function At(r, e) {
-  const [t, n] = await r.multicall({
-    contracts: [
-      {
-        address: e,
-        abi: v,
-        functionName: "protocolParams"
-      },
-      {
-        address: e,
-        abi: v,
-        functionName: "applicationRegistry"
-      }
-    ],
-    allowFailure: !1
-  });
-  return {
-    protocolParams: t,
-    applicationRegistry: n
-  };
-}
-function K(r, e, t) {
-  if (r !== e)
-    throw new Error(
-      `${t}: multicall returned ${r} results for ${e} calls, so the results are not roster-aligned; refusing to use them`
-    );
-}
-function Ae(r, e) {
-  return {
-    vaultProvider: r[0],
-    vaultKeepers: r.slice(1, 1 + e),
-    universalChallengers: r.slice(1 + e)
-  };
-}
-class _t {
-  constructor(e, t) {
-    this.publicClient = e, this.contracts = t;
-  }
-  /**
-   * One multicall, `allowFailure: false`, so every key in the set is read at
-   * the same block. A rotation landing between two separate `eth_call`s would
-   * otherwise produce a mixed-epoch key set and a lock no counterparty agrees
-   * with.
-   */
-  async readAll(e, t, n, i, s) {
-    const a = await this.publicClient.multicall({
-      contracts: e,
-      allowFailure: !1,
-      blockNumber: s
-    });
-    return K(
-      a.length,
-      1 + t + n,
-      i
-    ), Ae(a, t);
-  }
-  async getCurrentOperationKeys(e, t) {
-    const n = [
-      {
-        address: this.contracts.btcVaultRegistry,
-        abi: v,
-        functionName: "getCurrentOperationBtcKey",
-        args: [e.vaultProviderEthAddress]
-      },
-      ...e.vaultKeepers.map((i) => ({
-        address: this.contracts.applicationRegistry,
-        abi: _,
-        functionName: "getCurrentOperationBtcKey",
-        args: [e.applicationEntryPoint, i.ethAddress]
-      })),
-      ...e.universalChallengers.map((i) => ({
-        address: this.contracts.protocolParams,
-        abi: g,
-        functionName: "getCurrentOperationBtcKey",
-        args: [i.ethAddress]
-      }))
-    ];
-    return this.readAll(
-      n,
-      e.vaultKeepers.length,
-      e.universalChallengers.length,
-      "getCurrentOperationKeys",
-      t
-    );
-  }
-  async getOperationKeysAtEpochs(e, t) {
-    const n = [
-      // The VP takes the plain `AtEpoch` variant: it has no membership
-      // version, so its genesis (the registration key at version 0) is
-      // unambiguous and the contract resolves it internally.
-      {
-        address: this.contracts.btcVaultRegistry,
-        abi: v,
-        functionName: "getOperationBtcKeyAtEpoch",
-        args: [e.vaultProviderEthAddress, t.vpKeyEpoch]
-      },
-      // Keepers and challengers take `...OrGenesis` with their roster key
-      // passed explicitly, because the correct genesis for them is their key
-      // in *this vault's frozen membership version*. An operator dropped from
-      // the current roster, or listed under a different key in an older
-      // version, would otherwise resolve against the wrong genesis.
-      ...e.vaultKeepers.map((i) => ({
-        address: this.contracts.applicationRegistry,
-        abi: _,
-        functionName: "getOperationBtcKeyAtEpochOrGenesis",
-        args: [
-          e.applicationEntryPoint,
-          i.ethAddress,
-          t.appKeeperKeyEpoch,
-          i.btcPubKey
-        ]
-      })),
-      ...e.universalChallengers.map((i) => ({
-        address: this.contracts.protocolParams,
-        abi: g,
-        functionName: "getOperationBtcKeyAtEpochOrGenesis",
-        args: [i.ethAddress, t.ucKeyEpoch, i.btcPubKey]
-      }))
-    ];
-    return this.readAll(
-      n,
-      e.vaultKeepers.length,
-      e.universalChallengers.length,
-      "getOperationKeysAtEpochs"
-    );
-  }
-  async getPayoutScriptsAtEpochs(e, t) {
-    const n = await this.publicClient.multicall({
-      contracts: [
-        {
-          address: this.contracts.btcVaultRegistry,
-          abi: v,
-          functionName: "getPayoutScriptAtEpoch",
-          args: [e.vaultProviderEthAddress, t.vpKeyEpoch]
-        },
-        ...e.vaultKeepers.map((i) => ({
-          address: this.contracts.applicationRegistry,
-          abi: _,
-          functionName: "getPayoutScriptAtEpoch",
-          args: [
-            e.applicationEntryPoint,
-            i.ethAddress,
-            t.appKeeperKeyEpoch
-          ]
-        }))
-      ],
-      allowFailure: !1
-    });
-    return K(
-      n.length,
-      1 + e.vaultKeepers.length,
-      "getPayoutScriptsAtEpochs"
-    ), {
-      vaultProvider: n[0],
-      vaultKeepers: [...n.slice(1)]
-    };
-  }
-}
-const H = 65535;
-function P(r) {
-  return {
-    timelockAssert: r.timelockAssert,
-    timelockChallengeAssert: r.timelockChallengeAssert,
-    securityCouncilKeys: [...r.securityCouncilKeys],
-    councilQuorum: r.councilQuorum,
-    feeRate: r.feeRate,
-    babeTotalInstances: r.babeTotalInstances,
-    babeInstancesToFinalize: r.babeInstancesToFinalize,
-    minVpCommissionBps: r.minVpCommissionBps,
-    tRefund: r.tRefund,
-    tStale: r.tStale,
-    minPeginFeeRate: r.minPeginFeeRate,
-    proverCircuitVersion: r.proverCircuitVersion,
-    minPrepeginDepth: r.minPrepeginDepth
-  };
-}
-function L(r) {
-  return {
-    minimumPegInAmount: r.minimumPegInAmount,
-    maxPegInAmount: r.maxPegInAmount,
-    pegInAckTimeout: r.pegInAckTimeout,
-    pegInActivationTimeout: r.pegInActivationTimeout,
-    maxHtlcOutputCount: r.maxHtlcOutputCount,
-    expiredPegInGraceBlocks: r.expiredPegInGraceBlocks
-  };
-}
-function U(r) {
-  if (r > BigInt(H))
-    throw new Error(
-      `timelockAssert value ${r} exceeds uint16 max (${H})`
-    );
-  return Number(r);
-}
-class wt {
-  constructor(e, t) {
-    this.publicClient = e, this.contractAddress = t;
-  }
-  async getTBVProtocolParams() {
-    const e = await this.publicClient.readContract({
-      address: this.contractAddress,
-      abi: g,
-      functionName: "getTBVProtocolParams"
-    }), t = L(e);
-    return ue(t), t;
-  }
-  async getLatestOffchainParams() {
-    const e = await this.publicClient.readContract({
-      address: this.contractAddress,
-      abi: g,
-      functionName: "getLatestOffchainParams"
-    }), t = P(e);
-    return O(t), t;
-  }
-  async getOffchainParamsByVersion(e) {
-    const t = await this.publicClient.readContract({
-      address: this.contractAddress,
-      abi: g,
-      functionName: "getOffchainParamsByVersion",
-      args: [e]
-    }), n = P(t);
-    return O(n), n;
-  }
-  async getLatestOffchainParamsVersion() {
-    const e = await this.publicClient.readContract({
-      address: this.contractAddress,
-      abi: g,
-      functionName: "latestOffchainParamsVersion"
-    }), t = Number(e);
-    return de(t), t;
-  }
-  async getTimelockPeginByVersion(e) {
-    const t = await this.getOffchainParamsByVersion(e);
-    return U(t.timelockAssert);
-  }
-  /**
-   * Returned as `bigint` with no `Number` narrowing: the registry compares it
-   * against `block.number`, so callers must do the same arithmetic the
-   * contract does. `0` is the documented "disabled" case and is returned as
-   * `0n`. A missing getter or a non-bigint payload throws — never coerced to
-   * `0`, which would fail open and skip the observation window.
-   *
-   * @throws If the deployment does not expose `peginActivationDelay()`, or
-   *   the decoded payload is not a `bigint`.
-   */
-  async getPeginActivationDelay() {
-    const e = await this.publicClient.readContract({
-      address: this.contractAddress,
-      abi: g,
-      functionName: "peginActivationDelay"
-    });
-    if (typeof e != "bigint")
-      throw new Error(
-        `Invalid peginActivationDelay from contract: must be a bigint, got ${typeof e}`
-      );
-    return e;
-  }
-  /**
-   * Read TBV protocol params, latest offchain params, and the latest version
-   * label atomically via multicall. The version is paired with the params so
-   * that a governance update between separate reads cannot let JS build BTC
-   * scripts with version N params while the contract registers the vault
-   * under version N+1.
-   *
-   * That guarantee holds only within this multicall. A caller that also reads
-   * participant keys — every fresh peg-in build does — must pass the same
-   * `blockNumber` here and to those reads, or the two describe different
-   * blocks and the pairing above buys nothing across the seam.
-   */
-  async getPegInConfiguration(e) {
-    const t = await this.publicClient.multicall({
-      blockNumber: e,
-      contracts: [
-        {
-          address: this.contractAddress,
-          abi: g,
-          functionName: "getTBVProtocolParams"
-        },
-        {
-          address: this.contractAddress,
-          abi: g,
-          functionName: "getLatestOffchainParams"
-        },
-        {
-          address: this.contractAddress,
-          abi: g,
-          functionName: "latestOffchainParamsVersion"
-        },
-        {
-          address: this.contractAddress,
-          abi: g,
-          functionName: "activeVaultCoreVersion"
-        }
-      ],
-      allowFailure: !1
-    }), n = L(t[0]), i = P(t[1]), s = Number(t[2]), a = Number(t[3]), o = {
-      minimumPegInAmount: n.minimumPegInAmount,
-      maxPegInAmount: n.maxPegInAmount,
-      pegInAckTimeout: n.pegInAckTimeout,
-      pegInActivationTimeout: n.pegInActivationTimeout,
-      maxHtlcOutputCount: n.maxHtlcOutputCount,
-      expiredPegInGraceBlocks: n.expiredPegInGraceBlocks,
-      timelockPegin: U(i.timelockAssert),
-      timelockRefund: i.tRefund,
-      minVpCommissionBps: i.minVpCommissionBps,
-      offchainParams: i,
-      offchainParamsVersion: s,
-      activeVaultCoreVersion: a
-    };
-    return he(o), o;
-  }
-  /**
-   * Fetch every historical offchain params version in a single multicall.
-   * Iterates 1..latestVersion and calls `getOffchainParamsByVersion` for each.
-   * Versions whose payload fails validation are skipped (not included in the
-   * returned map) so a single bad historical version doesn't block the
-   * lookup of the rest.
-   *
-   * @param onSkippedVersion - optional observer invoked once per skipped
-   *   version. Use to log/telemeter without coupling the SDK to a logger.
-   */
-  async fetchAllOffchainParams(e) {
-    const t = await this.getLatestOffchainParamsVersion();
-    if (t === 0)
-      return { byVersion: /* @__PURE__ */ new Map(), latestVersion: 0 };
-    const n = Array.from({ length: t }, (o, u) => u + 1), i = n.map((o) => ({
-      address: this.contractAddress,
-      abi: g,
-      functionName: "getOffchainParamsByVersion",
-      args: [o]
-    })), s = await this.publicClient.multicall({
-      contracts: i,
-      allowFailure: !1
-    }), a = /* @__PURE__ */ new Map();
-    for (let o = 0; o < n.length; o++) {
-      const u = P(s[o]);
-      try {
-        O(u), a.set(n[o], u);
-      } catch (d) {
-        e == null || e(
-          n[o],
-          d instanceof Error ? d : new Error(String(d))
-        );
-      }
-    }
-    return { byVersion: a, latestVersion: t };
-  }
-}
-function k(r) {
-  return r.map((e) => ({
-    ethAddress: e.ethAddress,
-    btcPubKey: e.btcPubKey
-  }));
-}
-class xt {
-  constructor(e, t) {
-    this.publicClient = e, this.contractAddress = t;
-  }
-  async getVaultKeepersByVersion(e, t, n) {
-    const i = await this.publicClient.readContract({
-      address: this.contractAddress,
-      abi: _,
-      functionName: "getVaultKeepersByVersion",
-      args: [e, t],
-      blockNumber: n
-    });
-    return k(i);
-  }
-  async getCurrentVaultKeepers(e) {
-    const t = await this.publicClient.readContract({
-      address: this.contractAddress,
-      abi: _,
-      functionName: "getCurrentVaultKeepers",
-      args: [e]
-    });
-    return k(t);
-  }
-  async getCurrentVaultKeepersVersion(e, t) {
-    return await this.publicClient.readContract({
-      address: this.contractAddress,
-      abi: _,
-      functionName: "getCurrentVaultKeepersVersion",
-      args: [e],
-      blockNumber: t
-    });
-  }
-}
-class vt {
-  constructor(e, t) {
-    this.publicClient = e, this.contractAddress = t;
-  }
-  async getUniversalChallengersByVersion(e, t) {
-    const n = await this.publicClient.readContract({
-      address: this.contractAddress,
-      abi: g,
-      functionName: "getUniversalChallengersByVersion",
-      args: [e],
-      blockNumber: t
-    });
-    return k(n);
-  }
-  async getCurrentUniversalChallengers() {
-    const e = await this.publicClient.readContract({
-      address: this.contractAddress,
-      abi: g,
-      functionName: "getCurrentUniversalChallengers"
-    });
-    return k(e);
-  }
-  async getLatestUniversalChallengersVersion(e) {
-    return await this.publicClient.readContract({
-      address: this.contractAddress,
-      abi: g,
-      functionName: "latestUniversalChallengersVersion",
-      blockNumber: e
-    });
-  }
-}
-var _e = /* @__PURE__ */ ((r) => (r[r.PENDING = 0] = "PENDING", r[r.VERIFIED = 1] = "VERIFIED", r[r.ACTIVE = 2] = "ACTIVE", r[r.REDEEMED = 3] = "REDEEMED", r[r.EXPIRED = 4] = "EXPIRED", r))(_e || {});
-function S(r, e) {
-  const t = (r & 7) << 5, n = typeof e == "bigint" ? e : BigInt(e);
-  if (n < 0n) throw new Error("cborHead: negative argument");
-  if (n < 24n) return new Uint8Array([t | Number(n)]);
-  if (n < 0x100n) return new Uint8Array([t | 24, Number(n)]);
-  if (n < 0x10000n) {
-    const s = Number(n);
-    return new Uint8Array([t | 25, s >>> 8 & 255, s & 255]);
-  }
-  if (n < 0x100000000n) {
-    const s = Number(n);
-    return new Uint8Array([
-      t | 26,
-      s >>> 24 & 255,
-      s >>> 16 & 255,
-      s >>> 8 & 255,
-      s & 255
-    ]);
-  }
-  const i = new Uint8Array(9);
-  i[0] = t | 27;
-  for (let s = 7; s >= 0; s--)
-    i[1 + s] = Number(n >> BigInt((7 - s) * 8)) & 255;
-  return i;
-}
-function te(...r) {
-  const e = r.reduce((i, s) => i + s.length, 0), t = new Uint8Array(e);
-  let n = 0;
-  for (const i of r)
-    t.set(i, n), n += i.length;
-  return t;
-}
-function D(r) {
-  const t = [S(4, r.length)];
-  for (const n of r)
-    t.push(S(0, n));
-  return te(...t);
-}
-function we(r, e, t) {
-  if (!Number.isSafeInteger(t) || t < 0)
-    throw new Error(
-      `encodeServerIdentityPayload: expires_at must be a non-negative safe integer, got ${t}`
-    );
-  const n = S(4, 3), i = D(r), s = D(e), a = S(0, t);
-  return te(n, i, s, a);
-}
-const xe = new TextEncoder().encode(
-  "btc-auth.server-identity.v1"
-), ve = 2 * 3600;
-class m extends Error {
-  constructor(e, t) {
-    super(e), this.reason = t, this.name = "ServerIdentityError";
-  }
-}
-function E(r) {
-  const e = new Uint8Array(r.length / 2);
-  for (let t = 0; t < e.length; t++)
-    e[t] = parseInt(r.slice(t * 2, t * 2 + 2), 16);
-  return e;
-}
-function Pe(r) {
-  const { proof: e, pinnedServerPubkey: t, now: n } = r, i = r.maxLifetimeSecs ?? ve, s = A(t).toLowerCase();
-  if (s.length !== C || !b.test(s))
-    throw new m(
-      `pinnedServerPubkey must be 32-byte hex; got ${s.length} chars`,
-      "invalid_pubkey_encoding"
-    );
-  const a = A(e.server_pubkey).toLowerCase();
-  if (a.length !== C || !b.test(a))
-    throw new m(
-      `server_pubkey must be 32-byte hex; got ${a.length} chars`,
-      "invalid_pubkey_encoding"
-    );
-  if (a !== s)
-    throw new m(
-      `server_pubkey does not match pinned value: expected ${s}, got ${a}`,
-      "pinned_pubkey_mismatch"
-    );
-  if (!Number.isSafeInteger(e.expires_at))
-    throw new m(
-      `expires_at must be a finite integer; got ${JSON.stringify(e.expires_at)}`,
-      "invalid_expires_at"
-    );
-  if (!Number.isSafeInteger(n))
-    throw new m(
-      `now must be a finite integer; got ${JSON.stringify(n)}`,
-      "invalid_expires_at"
-    );
-  if (e.expires_at <= n)
-    throw new m(
-      `server identity proof expired at ${e.expires_at}, now ${n}`,
-      "expired"
-    );
-  if (!Number.isSafeInteger(i) || i <= 0)
-    throw new m(
-      `maxLifetimeSecs must be a positive safe integer; got ${JSON.stringify(i)}`,
-      "invalid_max_lifetime"
-    );
-  if (e.expires_at - n > i)
-    throw new m(
-      `server identity proof expires too far in the future: expires_at=${e.expires_at}, now=${n}, max lifetime=${i}s`,
-      "expires_too_far"
-    );
-  const o = A(e.ephemeral_pubkey).toLowerCase();
-  if (o.length !== ee || !b.test(o))
-    throw new m(
-      `ephemeral_pubkey must be 33-byte compressed hex; got ${o.length} chars`,
-      "invalid_ephemeral_pubkey"
-    );
-  const u = o.slice(0, 2);
-  if (u !== "02" && u !== "03")
-    throw new m(
-      `ephemeral_pubkey must be compressed (prefix 02/03); got ${u}`,
-      "invalid_ephemeral_pubkey"
-    );
-  const d = E(o);
-  if (!q.isPoint(d))
-    throw new m(
-      "ephemeral_pubkey is not a valid secp256k1 point",
-      "invalid_ephemeral_pubkey"
-    );
-  const p = A(e.signature).toLowerCase();
-  if (p.length !== ge || !b.test(p))
-    throw new m(
-      `signature must be 64-byte Schnorr hex; got ${p.length} chars`,
-      "invalid_signature_encoding"
-    );
-  const y = we(
-    xe,
-    E(o),
-    e.expires_at
-  );
-  if (!pe(
-    y,
-    E(a),
-    E(p)
-  ))
-    throw new m(
-      "BIP-322 signature verification failed — ephemeral key is not attested by pinned server pubkey",
-      "signature_verification_failed"
-    );
-}
-const Ee = /* @__PURE__ */ new Set([
-  "vaultProvider_submitDepositorWotsKey",
-  "vaultProvider_submitDepositorPresignatures",
-  "vaultProvider_requestDepositorPresignTransactions"
-]), Ce = /* @__PURE__ */ new Set([
-  "vaultProvider_requestDepositorClaimerArtifacts"
-]), ke = 6e4, V = "auth_createDepositorToken", $ = "auth_createDepositorTokenGrpc";
-function re(r, e) {
-  return new ye({
-    baseUrl: r,
-    timeout: ke,
-    headers: e,
-    retryableFor: (t) => t === V || t === $
-  });
-}
-const Se = 0, Te = 1, R = 2, Ie = 3, Oe = 4, Re = 5, Ne = 6, Be = 7, X = 24, Ve = 28, $e = 20, Me = 21, Ge = 22, F = 256;
-class f extends Error {
-  constructor(e) {
-    super(`CBOR decode: ${e}`), this.name = "CborDecodeError";
-  }
-}
-class ne {
-  constructor(e) {
-    h(this, "buf");
-    /** Current read offset. Public so callers can slice encoded sub-ranges. */
-    h(this, "pos", 0);
-    this.buf = e;
-  }
-  nextByte() {
-    if (this.pos >= this.buf.length)
-      throw new f("unexpected end of input");
-    return this.buf[this.pos++];
-  }
-  /**
-   * Read an initial byte and its argument. Rejects indefinite-length
-   * and reserved additional-info encodings. Arguments wider than
-   * {@link Number.MAX_SAFE_INTEGER} are rejected — none of the token's
-   * lengths, tags, or timestamps approach that bound.
-   */
-  readHead() {
-    const e = this.nextByte(), t = e >> 5, n = e & 31;
-    if (n < X)
-      return { major: t, arg: n };
-    if (n >= Ve)
-      throw new f(
-        `unsupported additional info ${n} (indefinite-length or reserved)`
-      );
-    const i = 1 << n - X;
-    let s = 0n;
-    for (let a = 0; a < i; a++)
-      s = s << 8n | BigInt(this.nextByte());
-    if (s > BigInt(Number.MAX_SAFE_INTEGER))
-      throw new f(`argument ${s} exceeds safe integer range`);
-    return { major: t, arg: Number(s) };
-  }
-  /** Read `length` raw bytes as a sub-array view into the backing buffer. */
-  readBytes(e) {
-    if (this.pos + e > this.buf.length)
-      throw new f("length overruns end of input");
-    const t = this.buf.subarray(this.pos, this.pos + e);
-    return this.pos += e, t;
-  }
-  /**
-   * Read a byte string (major type 2), returning its content bytes.
-   * Throws if the next item is not a byte string.
-   */
-  readByteString() {
-    const e = this.readHead();
-    if (e.major !== R)
-      throw new f(
-        `expected byte string (major ${R}), got major ${e.major}`
-      );
-    return this.readBytes(e.arg);
-  }
-  /**
-   * Read the next complete data item as a decoded {@link CborValue}.
-   *
-   * `depth` tracks the current nesting level so a deeply-nested blob is
-   * rejected with a {@link CborDecodeError} rather than overflowing the
-   * native call stack (see {@link MAX_NESTING_DEPTH}).
-   */
-  readValue(e = 0) {
-    if (e > F)
-      throw new f(
-        `nesting exceeds maximum depth ${F}`
-      );
-    const t = this.readHead();
-    switch (t.major) {
-      case Se:
-        return t.arg;
-      case Te:
-        return -1 - t.arg;
-      case R:
-        return this.readBytes(t.arg);
-      case Ie:
-        return new TextDecoder("utf-8", { fatal: !0 }).decode(
-          this.readBytes(t.arg)
-        );
-      case Oe: {
-        const n = [];
-        for (let i = 0; i < t.arg; i++)
-          n.push(this.readValue(e + 1));
-        return n;
-      }
-      case Re: {
-        const n = /* @__PURE__ */ new Map();
-        for (let i = 0; i < t.arg; i++) {
-          const s = this.readValue(e + 1), a = this.readValue(e + 1);
-          n.set(s, a);
-        }
-        return n;
-      }
-      case Ne:
-        return { tag: t.arg, value: this.readValue(e + 1) };
-      case Be:
-        if (t.arg === $e) return !1;
-        if (t.arg === Me) return !0;
-        if (t.arg === Ge) return null;
-        throw new f(
-          `unsupported simple/float value ${t.arg}`
-        );
-      default:
-        throw new f(`unsupported major type ${t.major}`);
-    }
-  }
-}
-function se(r) {
-  const e = new ne(r), t = e.readValue();
-  if (e.pos !== r.length)
-    throw new f("trailing bytes after top-level item");
-  return t;
-}
-const Ke = "vaultd-jsonrpc", He = "vaultd-grpc", J = 18, M = 4, j = -47, Le = 1, W = 64, Ue = 128, De = 96, Xe = 64, Fe = 1, Je = 2, je = 3, We = 4, Ye = 5, ze = 6, Qe = 7, Y = new TextEncoder().encode("Signature1");
-class c extends Error {
-  constructor(e, t) {
-    super(e), this.reason = t, this.name = "CwtVerificationError";
-  }
-}
-function Ze(r) {
-  const e = z(
-    r.expectedIssuerXOnlyPubkey,
-    "expectedIssuerXOnlyPubkey"
-  ), t = z(
-    r.expectedAudienceXOnlyPubkey,
-    "expectedAudienceXOnlyPubkey"
-  ), n = nt(r.ephemeralPubkeyHex), i = it(r.token), s = new ne(i), a = s.readHead();
-  if (a.major !== 6 || a.arg !== J)
-    throw new c(
-      `token is not a COSE Sign1 tagged value (tag ${J})`,
-      "invalid_token_structure"
-    );
-  const o = s.readHead();
-  if (o.major !== 4 || o.arg !== M)
-    throw new c(
-      `COSE Sign1 must be a ${M}-element array`,
-      "invalid_token_structure"
-    );
-  const u = s.pos, d = s.readByteString(), p = i.subarray(u, s.pos);
-  s.readValue();
-  const y = s.pos, w = s.readByteString(), T = i.subarray(y, s.pos), I = s.readByteString();
-  if (I.length !== W)
-    throw new c(
-      `COSE signature must be ${W} bytes, got ${I.length}`,
-      "invalid_token_structure"
-    );
-  if (s.pos !== i.length)
-    throw new c(
-      "COSE Sign1 token has trailing bytes after the signature",
-      "invalid_token_structure"
-    );
-  const G = qe(d);
-  if (G !== j)
-    throw new c(
-      `unexpected COSE algorithm ${G} (expected ES256K ${j})`,
-      "unexpected_algorithm"
-    );
-  const ae = et(p, T), oe = be(ae);
-  if (!q.verify(oe, n, I, !0))
-    throw new c(
-      "COSE signature does not verify against the server's ephemeral key",
-      "signature_verification_failed"
-    );
-  const l = tt(w), x = l.audience.toLowerCase();
-  if (x.length !== C || !b.test(x))
-    throw new c(
-      "token `aud` is not a 32-byte x-only pubkey hex",
-      "invalid_claims"
-    );
-  if (l.issuedAt > l.expiresAt)
-    throw new c(
-      `token iat (${l.issuedAt}) is after exp (${l.expiresAt})`,
-      "invalid_claims"
-    );
-  if (l.issuer.toLowerCase() !== e)
-    throw new c(
-      `token issuer does not match pinned server pubkey: expected ${e}, got ${l.issuer.toLowerCase()}`,
-      "issuer_mismatch"
-    );
-  if (l.subject !== r.expectedSubject)
-    throw new c(
-      `token subject mismatch: expected ${r.expectedSubject}, got ${l.subject}`,
-      "subject_mismatch"
-    );
-  if (x !== t)
-    throw new c(
-      `token audience does not match depositor pubkey: expected ${t}, got ${x}`,
-      "audience_mismatch"
-    );
-  if (l.expiresAt <= r.now)
-    throw new c(
-      `token expired: exp ${l.expiresAt} <= now ${r.now}`,
-      "token_expired"
-    );
-  if (r.responseExpiresAt !== l.expiresAt)
-    throw new c(
-      `response expires_at (${r.responseExpiresAt}) does not equal token exp (${l.expiresAt})`,
-      "expiry_mismatch"
-    );
-  if (r.serverIdentityExpiresAt < l.expiresAt)
-    throw new c(
-      `server identity expires (${r.serverIdentityExpiresAt}) before token exp (${l.expiresAt})`,
-      "server_identity_expires_before_token"
-    );
-  return {
-    issuer: l.issuer,
-    subject: l.subject,
-    audience: x,
-    expiresAt: l.expiresAt,
-    notBefore: l.notBefore,
-    issuedAt: l.issuedAt
-  };
-}
-function qe(r) {
-  if (r.length === 0)
-    throw new c(
-      "empty COSE protected header (no algorithm)",
-      "unexpected_algorithm"
-    );
-  const e = se(r);
-  if (!(e instanceof Map))
-    throw new c(
-      "COSE protected header is not a map",
-      "invalid_token_structure"
-    );
-  const t = e.get(Le);
-  if (typeof t != "number")
-    throw new c(
-      "COSE protected header missing integer algorithm label",
-      "unexpected_algorithm"
-    );
-  return t;
-}
-function et(r, e) {
-  return at(
-    Uint8Array.of(Ue | M),
-    Uint8Array.of(De | Y.length),
-    Y,
-    r,
-    Uint8Array.of(Xe),
-    e
-  );
-}
-function tt(r) {
-  const e = se(r);
-  if (!(e instanceof Map))
-    throw new c(
-      "CWT claims root is not a map",
-      "invalid_claims"
-    );
-  if (rt(e, Qe, "cti").length === 0)
-    throw new c("token cti is empty", "invalid_claims");
-  return {
-    issuer: N(e, Fe, "iss"),
-    subject: N(e, Je, "sub"),
-    audience: N(e, je, "aud"),
-    expiresAt: B(e, We, "exp"),
-    notBefore: B(e, Ye, "nbf"),
-    issuedAt: B(e, ze, "iat")
-  };
-}
-function N(r, e, t) {
-  const n = r.get(e);
-  if (typeof n != "string")
-    throw new c(
-      `token claim ${t} is missing or not a text string`,
-      "invalid_claims"
-    );
-  return n;
-}
-function rt(r, e, t) {
-  const n = r.get(e);
-  if (!(n instanceof Uint8Array))
-    throw new c(
-      `token claim ${t} is missing or not a byte string`,
-      "invalid_claims"
-    );
-  return n;
-}
-function B(r, e, t) {
-  const n = r.get(e);
-  if (typeof n != "number" || !Number.isSafeInteger(n) || n < 0)
-    throw new c(
-      `token claim ${t} is missing or not a non-negative integer timestamp`,
-      "invalid_claims"
-    );
-  return n;
-}
-function z(r, e) {
-  const t = A(r).toLowerCase();
-  if (t.length !== C || !b.test(t))
-    throw new c(
-      `${e} must be 32-byte x-only hex; got ${t.length} chars`,
-      "invalid_input"
-    );
-  return t;
-}
-function nt(r) {
-  const e = A(r).toLowerCase(), t = e.slice(0, 2);
-  if (e.length !== ee || !b.test(e) || t !== "02" && t !== "03")
-    throw new c(
-      "ephemeralPubkeyHex must be 33-byte compressed pubkey hex (prefix 02/03)",
-      "invalid_input"
-    );
-  return me(e);
-}
-const st = (() => {
-  const r = new Int16Array(128).fill(-1), e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-  for (let t = 0; t < e.length; t++)
-    r[e.charCodeAt(t)] = t;
-  return r;
-})();
-function it(r) {
-  const e = r.length, t = Math.floor(e / 4), n = e % 4;
-  if (n === 1)
-    throw new c(
-      "invalid base64url length",
-      "invalid_token_structure"
-    );
-  const i = t * 3 + (n === 0 ? 0 : n - 1), s = new Uint8Array(i), a = (d) => {
-    const p = d < 128 ? st[d] : -1;
-    if (p < 0)
-      throw new c(
-        "invalid base64url character",
-        "invalid_token_structure"
-      );
-    return p;
-  };
-  let o = 0, u = 0;
-  for (let d = 0; d < t; d++) {
-    const p = a(r.charCodeAt(o++)), y = a(r.charCodeAt(o++)), w = a(r.charCodeAt(o++)), T = a(r.charCodeAt(o++));
-    s[u++] = p << 2 | y >> 4, s[u++] = (y & 15) << 4 | w >> 2, s[u++] = (w & 3) << 6 | T;
-  }
-  if (n === 2) {
-    const d = a(r.charCodeAt(o++)), p = a(r.charCodeAt(o++));
-    s[u++] = d << 2 | p >> 4;
-  } else if (n === 3) {
-    const d = a(r.charCodeAt(o++)), p = a(r.charCodeAt(o++)), y = a(r.charCodeAt(o++));
-    s[u++] = d << 2 | p >> 4, s[u++] = (p & 15) << 4 | y >> 2;
-  }
-  return s;
-}
-function at(...r) {
-  const e = r.reduce((i, s) => i + s.length, 0), t = new Uint8Array(e);
-  let n = 0;
-  for (const i of r)
-    t.set(i, n), n += i.length;
-  return t;
-}
-const Q = 4102444800, ot = 30;
-class ct {
-  constructor(e) {
-    // `client` is the only mutable field — see `setClient`. The
-    // identity-bearing fields (peginTxid/authAnchorHex/pinnedServerPubkey)
-    // remain readonly and are checked against re-registration in the
-    // registry's `getOrCreate`.
-    h(this, "client");
-    h(this, "peginTxid");
-    h(this, "authAnchorHex");
-    h(this, "pinnedServerPubkey");
-    h(this, "expectedAudienceXOnlyPubkey");
-    h(this, "authGatedMethods");
-    h(this, "grpcGatedMethods");
-    h(this, "refreshSkewSecs");
-    h(this, "now");
-    /** Cached JSON-RPC-subject bearer (auth_createDepositorToken). */
-    h(this, "cachedJsonRpc", null);
-    h(this, "inFlightJsonRpc", null);
-    /** Cached gRPC-subject bearer (auth_createDepositorTokenGrpc). */
-    h(this, "cachedGrpc", null);
-    h(this, "inFlightGrpc", null);
-    this.client = e.client, this.peginTxid = e.peginTxid, this.authAnchorHex = e.authAnchorHex, this.pinnedServerPubkey = e.pinnedServerPubkey, this.expectedAudienceXOnlyPubkey = e.expectedAudienceXOnlyPubkey, this.authGatedMethods = e.authGatedMethods, this.grpcGatedMethods = e.grpcGatedMethods, this.refreshSkewSecs = e.refreshSkewSecs ?? ot, this.now = e.now ?? (() => Math.floor(Date.now() / 1e3));
-  }
-  /**
-   * Return a bearer token for `method`, or `null` if `method` is not
-   * auth-gated.
-   *
-   * Routes by subject: `authGatedMethods` → JSON-RPC bearer (issued via
-   * `auth_createDepositorToken`); `grpcGatedMethods` → gRPC bearer
-   * (`auth_createDepositorTokenGrpc`). Either path acquires lazily and
-   * single-flights concurrent callers; the two cache slots are
-   * independent.
-   *
-   * Both token-issuing methods are hard-exempted from the gate — if
-   * either were ever included in the gated sets (caller misconfiguration)
-   * the provider would recurse into `acquireSingleFlight` from inside the
-   * JSON-RPC header builder before `inFlight` is assigned, defeating the
-   * single-flight guard. Returning `null` here breaks that recursion
-   * deterministically.
-   */
-  async getToken(e) {
-    return e === V || e === $ ? null : this.grpcGatedMethods.has(e) ? this.getTokenForSubject("grpc") : this.authGatedMethods.has(e) ? this.getTokenForSubject("jsonrpc") : null;
-  }
-  /**
-   * Drop both cached tokens. Next `getToken` call re-acquires the slot
-   * that's actually needed. Called by `JsonRpcClient` on wire
-   * `auth_expired` responses; the client doesn't tell us which subject
-   * expired, so we evict both to stay correct under either.
-   *
-   * Worst case is one extra round-trip on the slot that was still fresh,
-   * which is cheaper than carrying a `Subject` argument through
-   * `BearerTokenProvider`.
-   */
-  invalidate() {
-    this.cachedJsonRpc = null, this.cachedGrpc = null;
-  }
-  async getTokenForSubject(e) {
-    const t = e === "grpc" ? this.cachedGrpc : this.cachedJsonRpc;
-    return t && this.now() + this.refreshSkewSecs < t.expiresAt ? t.token : (await this.acquireSingleFlight(e)).token;
-  }
-  /**
-   * Swap in a different transport for subsequent token-issuing calls.
-   * Used by the registry when a later caller registers the same
-   * `peginTxid` against a different `baseUrl` — the cached token
-   * (bound to identity, not transport) stays valid, but future
-   * refreshes hit the new URL. An in-flight acquire keeps using the
-   * old client (it captured the reference); next call uses the new.
-   */
-  setClient(e) {
-    this.client = e;
-  }
-  acquireSingleFlight(e) {
-    const t = e === "grpc" ? this.inFlightGrpc : this.inFlightJsonRpc;
-    if (t) return t;
-    const n = e === "grpc" ? $ : V, i = (async () => {
-      try {
-        const s = await this.client.call(n, {
-          pegin_txid: this.peginTxid,
-          auth_anchor: this.authAnchorHex
-        });
-        if (Pe({
-          proof: s.server_identity,
-          pinnedServerPubkey: this.pinnedServerPubkey,
-          now: this.now()
-        }), typeof s.token != "string" || s.token.length === 0)
-          throw new Error(
-            `VpTokenProvider: invalid token in acquire response (expected non-empty string, got ${typeof s.token})`
-          );
-        const a = this.now();
-        if (!Number.isSafeInteger(s.expires_at) || s.expires_at <= a || s.expires_at > Q)
-          throw new Error(
-            `VpTokenProvider: invalid expires_at in acquire response (got ${JSON.stringify(s.expires_at)}; must be a safe integer in (${a}, ${Q}])`
-          );
-        Ze({
-          token: s.token,
-          ephemeralPubkeyHex: s.server_identity.ephemeral_pubkey,
-          expectedIssuerXOnlyPubkey: this.pinnedServerPubkey,
-          expectedSubject: e === "grpc" ? He : Ke,
-          expectedAudienceXOnlyPubkey: this.expectedAudienceXOnlyPubkey,
-          responseExpiresAt: s.expires_at,
-          serverIdentityExpiresAt: s.server_identity.expires_at,
-          now: a
-        });
-        const o = {
-          token: s.token,
-          expiresAt: s.expires_at
-        };
-        return e === "grpc" ? this.cachedGrpc = o : this.cachedJsonRpc = o, o;
-      } finally {
-        e === "grpc" ? this.inFlightGrpc = null : this.inFlightJsonRpc = null;
-      }
-    })();
-    return e === "grpc" ? this.inFlightGrpc = i : this.inFlightJsonRpc = i, i;
-  }
-}
-class lt {
-  constructor() {
-    h(this, "entries", /* @__PURE__ */ new Map());
-  }
-  /**
-   * Return the cached `VpTokenProvider` for `peginTxid` if one exists
-   * with matching `authAnchorHex` and `pinnedServerPubkey`, otherwise
-   * construct and cache a fresh provider. A mismatch on either throws —
-   * silent overwrite would mask derivation drift or VP pubkey rotation.
-   */
-  getOrCreate(e) {
-    const t = this.entries.get(e.peginTxid);
-    if (t) {
-      if (t.authAnchorHex !== e.authAnchorHex)
-        throw new Error(
-          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to authAnchorHex ${t.authAnchorHex.slice(0, 8)}…; got ${e.authAnchorHex.slice(0, 8)}…`
-        );
-      if (t.pinnedServerPubkey !== e.pinnedServerPubkey)
-        throw new Error(
-          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to pinnedServerPubkey ${t.pinnedServerPubkey.slice(0, 8)}…; got ${e.pinnedServerPubkey.slice(0, 8)}…`
-        );
-      if (t.expectedAudienceXOnlyPubkey !== e.expectedAudienceXOnlyPubkey)
-        throw new Error(
-          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to expectedAudienceXOnlyPubkey ${t.expectedAudienceXOnlyPubkey.slice(0, 8)}…; got ${e.expectedAudienceXOnlyPubkey.slice(0, 8)}…`
-        );
-      return t.provider.setClient(e.client), t.provider;
-    }
-    const n = new ct({
-      client: e.client,
-      peginTxid: e.peginTxid,
-      authAnchorHex: e.authAnchorHex,
-      pinnedServerPubkey: e.pinnedServerPubkey,
-      expectedAudienceXOnlyPubkey: e.expectedAudienceXOnlyPubkey,
-      authGatedMethods: Ee,
-      grpcGatedMethods: Ce
-    });
-    return this.entries.set(e.peginTxid, {
-      provider: n,
-      authAnchorHex: e.authAnchorHex,
-      pinnedServerPubkey: e.pinnedServerPubkey,
-      expectedAudienceXOnlyPubkey: e.expectedAudienceXOnlyPubkey
-    }), n;
-  }
-  /** Return the cached provider, or `undefined` if none. */
-  peek(e) {
-    var t;
-    return (t = this.entries.get(e)) == null ? void 0 : t.provider;
-  }
-  /**
-   * Evict the entry for `peginTxid`. Idempotent. Called on terminal
-   * paths — activation success, user-cancel, or component unmount —
-   * so `authAnchorHex` doesn't outlive the deposit session.
-   */
-  release(e) {
-    this.entries.delete(e);
-  }
-  /**
-   * Wipe every cached entry. Test-only escape hatch — not exposed on
-   * the public {@link VpTokenRegistryPublic} singleton type.
-   *
-   * @internal
-   */
-  clear() {
-    this.entries.clear();
-  }
-  get size() {
-    return this.entries.size;
-  }
-}
-const ie = new lt();
-function Pt(r) {
-  var n;
-  const e = re(
-    r.baseUrl,
-    (n = r.options) == null ? void 0 : n.headers
-  ), t = ie.getOrCreate({
-    client: e,
-    peginTxid: r.peginTxid,
-    authAnchorHex: r.authAnchorHex,
-    pinnedServerPubkey: r.pinnedServerPubkey,
-    expectedAudienceXOnlyPubkey: Z(
-      r.depositorBtcPubkey
-    )
-  });
-  return new fe(r.baseUrl, {
-    ...r.options,
-    tokenProvider: t
-  });
-}
-function Et(r) {
-  ie.getOrCreate({
-    client: re(r.baseUrl, r.headers),
-    peginTxid: r.peginTxid,
-    authAnchorHex: r.authAnchorHex,
-    pinnedServerPubkey: r.pinnedServerPubkey,
-    expectedAudienceXOnlyPubkey: Z(
-      r.depositorBtcPubkey
-    )
-  });
-}
-export {
-  _e as O,
-  m as S,
-  lt as V,
-  ie as a,
-  _t as b,
-  Pt as c,
-  wt as d,
-  vt as e,
-  xt as f,
-  Et as p,
-  At as r,
-  Pe as v
-};
-//# sourceMappingURL=primeVpAuth-BI63kgdd.js.map