@babylonlabs-io/ts-sdk 0.74.0 → 0.74.1

package/dist/verifyScriptPathSchnorrSignature-D_epga4j.js

@@ -0,0 +1,1140 @@
+import { script as _, opcodes as E, payments as R, Transaction as b, crypto as H, Psbt as V } from "bitcoinjs-lib";
+import { computeMinClaimValue as Ee, peginP2aAnchorOutput as ye, computeMinPeginFee as _e, tapInternalPubkey as k, buildPeginTxFromPrePegin as ke, createPrePeginTransaction as Ie, validatePeginP2aAnchor as Ae, createPayoutConnector as Te, computePayoutFeeFloor as Oe, getAssertPayoutScriptInfo as Ve } from "./tbv/core/wasm/index.js";
+import { c as M, p as Le, d as Re } from "./fundPeginTransaction-CwhRbCQC.js";
+import { p as He, s as f, d as $e, m as Ke, T as y, h as x, u as U, j as Ne, S as F } from "./bitcoin-C-TuHb-v.js";
+import { s as Ue } from "./secp256k1-D-H9jmd7.js";
+import { Buffer as c } from "buffer";
+import { P as q, c as W, d as X, e as G, f as Be, g as z, h as Me, i as Fe, j as Y, k as D, l as Q, m as Z, n as j, o as J, M as ee, b as te, p as qe, A as me, B as We, V as Xe, N as oe } from "./constants-D5vORbQE.js";
+import * as Se from "@bitcoin-js/tiny-secp256k1-asmjs";
+import { X as ne } from "./validation-OSC0xTHB.js";
+function C(e) {
+  return He(e).toLowerCase();
+}
+function Yt(e, t, o) {
+  const n = /* @__PURE__ */ new Set();
+  n.add(C(e));
+  for (const i of t)
+    n.add(C(i));
+  return n.delete(C(o)), n.size;
+}
+function Ge(e) {
+  const t = C(e.claimerBtcPubkey), o = C(e.depositorBtcPubkey), n = e.vaultKeeperBtcPubkeys.map(C);
+  if (t === o) {
+    const r = n.filter((u) => u !== o);
+    if (r.length === 0)
+      throw new Error(
+        "Cannot derive localChallengers: vault keeper set is empty (or contains only the depositor)"
+      );
+    if (new Set(r).size !== r.length)
+      throw new Error(
+        "Cannot derive localChallengers: duplicate vaultKeeper key — signing context is misconfigured"
+      );
+    return r;
+  }
+  const s = [
+    .../* @__PURE__ */ new Set([C(e.vaultProviderBtcPubkey), ...n])
+  ].sort().filter((r) => r !== t);
+  if (s.length === 0)
+    throw new Error(
+      `Cannot derive localChallengers: no vault provider or vault keeper remains after excluding claimer ${t}`
+    );
+  return s;
+}
+const ze = 32, Ye = 65535, De = 2;
+function K(e, t) {
+  const o = f(e).toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(o))
+    throw new Error(`${t} must be a 32-byte x-only public key.`);
+  try {
+    Ue.Point.fromBytes(
+      c.concat([
+        c.from([De]),
+        c.from(o, "hex")
+      ])
+    );
+  } catch {
+    throw new Error(`${t} is not a secp256k1 x-coordinate.`);
+  }
+  return o;
+}
+function re(e, t) {
+  if (e.length === 0)
+    throw new Error(`${t} must not be empty.`);
+  const o = e.map((n, i) => K(n, `${t}[${i}]`)).sort();
+  if (new Set(o).size !== o.length)
+    throw new Error(`${t} must not contain duplicate keys.`);
+  return o;
+}
+function ie(e, t) {
+  const o = [];
+  return e.forEach((n, i) => {
+    o.push(
+      c.from(n, "hex"),
+      i === 0 ? E.OP_CHECKSIG : E.OP_CHECKSIGADD
+    );
+  }), o.push(
+    _.number.encode(e.length),
+    t ? E.OP_NUMEQUALVERIFY : E.OP_NUMEQUAL
+  ), o;
+}
+function Qe(e, t) {
+  var g;
+  Ke();
+  const o = K(
+    e.depositorPubkey,
+    "depositorPubkey"
+  ), n = K(
+    e.vaultProviderPubkey,
+    "vaultProviderPubkey"
+  ), i = re(
+    e.vaultKeeperPubkeys,
+    "vaultKeeperPubkeys"
+  ), s = re(
+    e.universalChallengerPubkeys,
+    "universalChallengerPubkeys"
+  ), r = f(t).toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(r))
+    throw new Error("hashlock must be 32 bytes.");
+  if (!Number.isInteger(e.timelockRefund) || e.timelockRefund < 1 || e.timelockRefund > Ye)
+    throw new Error("timelockRefund must be an integer from 1 to 65535.");
+  const u = _.compile([
+    E.OP_SIZE,
+    _.number.encode(ze),
+    E.OP_EQUALVERIFY,
+    E.OP_SHA256,
+    c.from(r, "hex"),
+    E.OP_EQUALVERIFY,
+    c.from(o, "hex"),
+    E.OP_CHECKSIGVERIFY,
+    c.from(n, "hex"),
+    E.OP_CHECKSIGVERIFY,
+    ...ie(i, !0),
+    ...ie(s, !1)
+  ]), h = _.compile([
+    c.from(o, "hex"),
+    E.OP_CHECKSIGVERIFY,
+    _.number.encode(e.timelockRefund),
+    E.OP_CHECKSEQUENCEVERIFY
+  ]), a = [
+    { output: u, version: y },
+    { output: h, version: y }
+  ], { hash: d, output: l, witness: P } = R.p2tr({
+    internalPubkey: c.from(k),
+    scriptTree: a,
+    redeem: {
+      output: u,
+      redeemVersion: y
+    }
+  }), p = P == null ? void 0 : P[P.length - 1], v = R.p2tr({
+    internalPubkey: c.from(k),
+    scriptTree: a,
+    redeem: {
+      output: h,
+      redeemVersion: y
+    }
+  }), w = (g = v.witness) == null ? void 0 : g[v.witness.length - 1];
+  if (!d || !l || !p || !w)
+    throw new Error("Failed to derive the expected Pre-PegIn HTLC output.");
+  return {
+    hashlockScript: u,
+    hashlockControlBlock: p,
+    refundScript: h,
+    refundControlBlock: w,
+    scriptPubKey: l,
+    tapMerkleRoot: d
+  };
+}
+async function Ze(e, t) {
+  const o = t.pegInAmounts.length;
+  if (t.hashlocks.length !== o)
+    throw new Error(
+      `Pre-PegIn has ${t.hashlocks.length} hashlock(s), expected ${o} (one per requested deposit).`
+    );
+  if (e.htlcValues.length !== o)
+    throw new Error(
+      `WASM Pre-PegIn returned ${e.htlcValues.length} HTLC value(s), expected ${o} (one per requested deposit).`
+    );
+  if (e.peginAmounts.length !== o || e.htlcScriptPubKeys.length !== o || e.htlcAddresses.length !== o)
+    throw new Error(
+      `WASM Pre-PegIn returned mismatched array lengths (htlcValues=${e.htlcValues.length}, peginAmounts=${e.peginAmounts.length}, htlcScriptPubKeys=${e.htlcScriptPubKeys.length}, htlcAddresses=${e.htlcAddresses.length}); expected ${o} each.`
+    );
+  if (e.depositorClaimValue <= 0n)
+    throw new Error(
+      `WASM Pre-PegIn returned non-positive depositorClaimValue ${e.depositorClaimValue}; expected > 0.`
+    );
+  const n = await Ee(
+    // Must price the same graph version the builder constructed.
+    t.vaultCoreVersion,
+    t.numLocalChallengers,
+    t.universalChallengerPubkeys.length,
+    t.councilQuorum,
+    t.councilSize,
+    t.feeRate
+  );
+  if (e.depositorClaimValue !== n)
+    throw new Error(
+      `WASM Pre-PegIn depositorClaimValue ${e.depositorClaimValue} does not match the independently computed minimum claim value ${n} (vaultCoreVersion=${t.vaultCoreVersion}, numLocalChallengers=${t.numLocalChallengers}, numUniversalChallengers=${t.universalChallengerPubkeys.length}, councilQuorum=${t.councilQuorum}, councilSize=${t.councilSize}, feeRate=${t.feeRate}).`
+    );
+  const i = await ye(t.vaultCoreVersion), s = (i == null ? void 0 : i.value) ?? 0n, r = await _e(
+    t.vaultCoreVersion,
+    t.vaultKeeperPubkeys.length,
+    t.universalChallengerPubkeys.length,
+    t.minPeginFeeRate
+  ), u = r + s, h = t.minPeginFeeRate * M;
+  for (let a = 0; a < o; a++) {
+    const d = t.pegInAmounts[a], l = e.peginAmounts[a], P = e.htlcValues[a];
+    if (l !== d)
+      throw new Error(
+        `WASM Pre-PegIn peginAmount[${a}] ${l} does not match the requested amount ${d}; refusing to build a tx whose recorded amount differs from the depositor's request.`
+      );
+    if (l <= 0n)
+      throw new Error(
+        `WASM Pre-PegIn peginAmount[${a}] is non-positive (${l}); expected > 0.`
+      );
+    if (P <= 0n)
+      throw new Error(
+        `WASM Pre-PegIn htlcValue[${a}] is non-positive (${P}); expected > 0.`
+      );
+    const p = P - l - e.depositorClaimValue;
+    if (p <= 0n)
+      throw new Error(
+        `WASM Pre-PegIn htlcValue[${a}] ${P} does not strictly cover peginAmount ${l} + depositorClaimValue ${e.depositorClaimValue} + a PegIn reserve (implied reserve ${p}).`
+      );
+    if (p > h)
+      throw new Error(
+        `WASM Pre-PegIn implied reserve for HTLC[${a}] (${p} sat) exceeds the plausibility cap ${h} sat (minPeginFeeRate=${t.minPeginFeeRate} × ${M} vbytes); htlcValue ${P} appears grossly inflated.`
+      );
+    if (p !== u)
+      throw new Error(
+        `WASM Pre-PegIn htlcValue[${a}] ${P} implies a PegIn fee+anchor reserve of ${p} sat, expected exactly ${u} sat (minPeginFee ${r} + p2aAnchor ${s} for vaultCoreVersion ${t.vaultCoreVersion}, vaultKeepers=${t.vaultKeeperPubkeys.length}, universalChallengers=${t.universalChallengerPubkeys.length}, minPeginFeeRate=${t.minPeginFeeRate}).`
+      );
+  }
+  return r;
+}
+class O extends Error {
+  constructor(t) {
+    super(t), this.name = "HtlcOutputMismatchError";
+  }
+}
+function je(e, t, o) {
+  if (e.length < t.length)
+    throw new O(
+      `Encoded Pre-PegIn tx has ${e.length} output(s), fewer than the ${t.length} HTLC output(s) the cross-check validated.`
+    );
+  for (let n = 0; n < t.length; n++) {
+    const i = BigInt(e[n].value);
+    if (i !== t[n])
+      throw new O(
+        `Encoded Pre-PegIn HTLC output[${n}] value ${i} does not match the cross-checked htlcValue ${t[n]}; the funded/signed tx would not pay the validated amount.`
+      );
+    const s = e[n].script.toString("hex").toLowerCase(), r = o[n].toLowerCase();
+    if (s !== r)
+      throw new O(
+        `Encoded Pre-PegIn HTLC output[${n}] scriptPubKey ${s} does not match the cross-checked htlcScriptPubKey ${r}.`
+      );
+  }
+}
+function Je(e, t, o, n, i, s, r) {
+  if (s !== q)
+    throw new Error(
+      `WASM Pre-PegIn transaction version ${s}; expected ${q}.`
+    );
+  if (r !== W)
+    throw new Error(
+      `WASM Pre-PegIn transaction locktime ${r}; expected ${W}.`
+    );
+  if (t.length < X)
+    throw new Error(
+      `WASM Pre-PegIn output layout has ${t.length} HTLC output(s); expected at least ${X}.`
+    );
+  const u = t.length, h = u + +(i !== void 0), a = Le(
+    t.length,
+    i !== void 0
+  );
+  if (e.length !== a)
+    throw new Error(
+      `WASM Pre-PegIn output layout has ${e.length} output(s); expected exactly ${a}.`
+    );
+  je(e, t, o);
+  for (let p = 0; p < t.length; p++) {
+    const v = Qe(
+      n,
+      n.hashlocks[p]
+    ).scriptPubKey;
+    if (!e[p].script.equals(v))
+      throw new O(
+        `Pre-PegIn HTLC output[${p}] does not match the independently derived scriptPubKey.`
+      );
+  }
+  if (i !== void 0) {
+    const p = e[u];
+    if (p.value !== G)
+      throw new Error(
+        `WASM Pre-PegIn auth output[${u}] value ${p.value} sat; expected exactly ${G} sat.`
+      );
+    const v = p.script.toString("hex").toLowerCase(), w = Be + i.toLowerCase();
+    if (v !== w)
+      throw new Error(
+        `WASM Pre-PegIn auth output[${u}] scriptPubKey ${v}; expected ${w}.`
+      );
+  }
+  const d = e[h];
+  if (d.value !== z)
+    throw new Error(
+      `WASM Pre-PegIn CPFP output[${h}] value ${d.value} sat; expected exactly ${z} sat.`
+    );
+  const l = d.script.toString("hex").toLowerCase(), P = f(
+    $e(n.depositorPubkey)
+  ).toLowerCase();
+  if (l !== P)
+    throw new Error(
+      `WASM Pre-PegIn CPFP output[${h}] scriptPubKey ${l}; expected depositor BIP-86 script ${P}.`
+    );
+}
+const et = 1;
+function tt(e) {
+  const t = f(e);
+  if (!/^[0-9a-fA-F]{64}$/.test(t))
+    throw new Error(
+      "Invalid depositor pubkey for the depositor-claim script: must be an x-only key of 64 hex characters (32 bytes)."
+    );
+  const o = _.compile([
+    c.from(x(t)),
+    E.OP_CHECKSIG
+  ]), n = c.from(k), i = { output: o, redeemVersion: y }, { output: s, witness: r } = R.p2tr({
+    internalPubkey: n,
+    scriptTree: { output: o },
+    redeem: i
+  });
+  if (!s)
+    throw new Error(
+      "Failed to derive the depositor-claim P2TR scriptPubKey for PegIn output validation"
+    );
+  const u = r == null ? void 0 : r[r.length - 1];
+  if (!u)
+    throw new Error(
+      "Failed to derive the depositor-claim tapleaf control block; refusing to build an unspendable input"
+    );
+  return { scriptPubKey: s, leafScript: o, controlBlock: u, internalKey: n };
+}
+function ot(e) {
+  return tt(e).scriptPubKey;
+}
+const se = 64, nt = /^[0-9a-fA-F]+$/;
+async function Dt(e) {
+  const t = xe(e.authAnchorHash), o = await Ie({
+    txGraphVersion: e.vaultCoreVersion,
+    depositorPubkey: e.depositorPubkey,
+    vaultProviderPubkey: e.vaultProviderPubkey,
+    vaultKeeperPubkeys: e.vaultKeeperPubkeys,
+    universalChallengerPubkeys: e.universalChallengerPubkeys,
+    hashlocks: [...e.hashlocks],
+    timelockRefund: e.timelockRefund,
+    pegInAmounts: [...e.pegInAmounts],
+    feeRate: e.feeRate,
+    minPeginFeeRate: e.minPeginFeeRate,
+    numLocalChallengers: e.numLocalChallengers,
+    councilQuorum: e.councilQuorum,
+    councilSize: e.councilSize,
+    network: e.network,
+    authAnchorHash: t
+  }), n = await Ze(o, e), i = Re(o.txHex);
+  Je(
+    i.outputs,
+    o.htlcValues,
+    o.htlcScriptPubKeys,
+    e,
+    t,
+    i.version,
+    i.locktime
+  );
+  const s = i.outputs.reduce(
+    (u, h) => u + BigInt(h.value),
+    0n
+  ), r = t !== void 0 ? o.htlcValues.length : null;
+  return {
+    psbtHex: o.txHex,
+    totalOutputValue: s,
+    htlcValues: o.htlcValues,
+    htlcScriptPubKeys: o.htlcScriptPubKeys,
+    htlcAddresses: o.htlcAddresses,
+    peginAmounts: o.peginAmounts,
+    depositorClaimValue: o.depositorClaimValue,
+    authAnchorVout: r,
+    minPeginFee: n
+  };
+}
+function xe(e) {
+  if (e === void 0) return;
+  const t = e.startsWith("0x") || e.startsWith("0X") ? e.slice(2) : e;
+  if (t.length !== se || !nt.test(t))
+    throw new Error(
+      `authAnchorHash must be 32-byte hex (${se} chars, no 0x prefix); got length ${t.length}`
+    );
+  return t.toLowerCase();
+}
+async function Qt(e) {
+  const t = await ke(
+    {
+      txGraphVersion: e.prePeginParams.vaultCoreVersion,
+      depositorPubkey: e.prePeginParams.depositorPubkey,
+      vaultProviderPubkey: e.prePeginParams.vaultProviderPubkey,
+      vaultKeeperPubkeys: e.prePeginParams.vaultKeeperPubkeys,
+      universalChallengerPubkeys: e.prePeginParams.universalChallengerPubkeys,
+      hashlocks: [...e.prePeginParams.hashlocks],
+      timelockRefund: e.prePeginParams.timelockRefund,
+      pegInAmounts: [...e.prePeginParams.pegInAmounts],
+      feeRate: e.prePeginParams.feeRate,
+      minPeginFeeRate: e.prePeginParams.minPeginFeeRate,
+      numLocalChallengers: e.prePeginParams.numLocalChallengers,
+      councilQuorum: e.prePeginParams.councilQuorum,
+      councilSize: e.prePeginParams.councilSize,
+      network: e.prePeginParams.network,
+      authAnchorHash: xe(
+        e.prePeginParams.authAnchorHash
+      )
+    },
+    e.timelockPegin,
+    e.fundedPrePeginTxHex,
+    e.htlcVout
+  );
+  return await it(t, e), {
+    txHex: t.txHex,
+    txid: t.txid,
+    vaultScriptPubKey: t.vaultScriptPubKey,
+    vaultValue: t.vaultValue
+  };
+}
+const rt = 2;
+async function it(e, t) {
+  const o = t.prePeginParams.vaultCoreVersion, n = o === 1 ? Me : o === 2 || o === 3 ? Fe : void 0;
+  if (n === void 0)
+    throw new Error(`Unsupported vaultCoreVersion ${o} for PegIn tx.`);
+  await Ae(o, e.txHex);
+  const i = await ye(o), s = rt + (i ? 1 : 0), r = b.fromHex(f(e.txHex));
+  if (r.version !== n)
+    throw new Error(
+      `PegIn tx version ${r.version} does not match vaultCoreVersion ${o}; expected ${n}.`
+    );
+  if (r.locktime !== Y)
+    throw new Error(
+      `PegIn tx locktime ${r.locktime} does not match the canonical locktime ${Y}.`
+    );
+  if (r.ins.length !== 1)
+    throw new Error(
+      `PegIn tx has ${r.ins.length} input(s), expected exactly 1 (the Pre-PegIn HTLC outpoint).`
+    );
+  const u = b.fromHex(
+    f(t.fundedPrePeginTxHex)
+  ).getId(), h = U(
+    new Uint8Array(r.ins[0].hash).slice().reverse()
+  );
+  if (h !== u)
+    throw new Error(
+      `PegIn input spends txid ${h}, expected the funded Pre-PegIn ${u}.`
+    );
+  if (r.ins[0].index !== t.htlcVout)
+    throw new Error(
+      `PegIn input spends Pre-PegIn output ${r.ins[0].index}, expected the requested HTLC vout ${t.htlcVout}.`
+    );
+  if (r.ins[0].sequence !== D)
+    throw new Error(
+      `PegIn input sequence ${r.ins[0].sequence} does not match the canonical sequence ${D}.`
+    );
+  if (r.ins[0].script.length !== 0)
+    throw new Error("PegIn input scriptSig must be empty.");
+  if (r.ins[0].witness.length !== 0)
+    throw new Error("PegIn input witness must be empty before signing.");
+  if (r.outs.length !== s)
+    throw new Error(
+      `PegIn tx has ${r.outs.length} output(s), expected exactly ${s} for vaultCoreVersion ${o} (vault + depositor claim${i ? " + P2A anchor" : ""}).`
+    );
+  const a = t.prePeginParams.pegInAmounts[t.htlcVout];
+  if (e.vaultValue !== a)
+    throw new Error(
+      `PegIn vault output value ${e.vaultValue} does not match the requested peg-in amount ${a} for HTLC ${t.htlcVout}; refusing to sign a vault that locks a different amount than requested.`
+    );
+  const d = r.outs[0];
+  if (BigInt(d.value) !== e.vaultValue)
+    throw new Error(
+      `Encoded PegIn vault output value ${d.value} does not match the WASM-reported vaultValue ${e.vaultValue}.`
+    );
+  const l = d.script.toString("hex"), P = f(
+    e.vaultScriptPubKey
+  ).toLowerCase();
+  if (l.toLowerCase() !== P)
+    throw new Error(
+      `Encoded PegIn vault output scriptPubKey ${l} does not match the WASM-reported vaultScriptPubKey ${e.vaultScriptPubKey}.`
+    );
+  const p = r.getId();
+  if (p !== f(e.txid).toLowerCase())
+    throw new Error(
+      `Encoded PegIn txid ${p} does not match the WASM-reported txid ${e.txid}.`
+    );
+  const v = await Ee(
+    o,
+    t.prePeginParams.numLocalChallengers,
+    t.prePeginParams.universalChallengerPubkeys.length,
+    t.prePeginParams.councilQuorum,
+    t.prePeginParams.councilSize,
+    t.prePeginParams.feeRate
+  ), w = r.outs[et];
+  if (BigInt(w.value) !== v)
+    throw new Error(
+      `Encoded PegIn depositor-claim output value ${w.value} does not match the independently computed claim value ${v} for vaultCoreVersion ${o}.`
+    );
+  const g = ot(
+    t.prePeginParams.depositorPubkey
+  );
+  if (!w.script.equals(g))
+    throw new Error(
+      `Encoded PegIn depositor-claim output scriptPubKey ${w.script.toString("hex")} does not pay to the depositor's claim script (expected ${g.toString("hex")}).`
+    );
+}
+async function st(e) {
+  const t = await Te(
+    {
+      txGraphVersion: e.vaultCoreVersion,
+      depositor: e.depositor,
+      vaultProvider: e.vaultProvider,
+      vaultKeepers: e.vaultKeepers,
+      universalChallengers: e.universalChallengers,
+      timelockPegin: e.timelockPegin
+    },
+    e.network
+  );
+  return {
+    payoutScript: t.payoutScript,
+    taprootScriptHash: t.taprootScriptHash,
+    scriptPubKey: t.scriptPubKey,
+    address: t.address,
+    payoutControlBlock: t.payoutControlBlock
+  };
+}
+const ue = 253, ut = 254, ct = 65535, at = 4294967295, lt = "TapLeaf", ht = "TapBranch", dt = "TapTweak", A = 33, T = 32, ce = 128, pt = 1, Pt = 254, ft = c.from([81, 32]);
+function gt(e) {
+  if (e < ue)
+    return c.from([e]);
+  if (e <= ct) {
+    const t = c.alloc(2);
+    return t.writeUInt16LE(e), c.concat([c.from([ue]), t]);
+  }
+  if (e <= at) {
+    const t = c.alloc(4);
+    return t.writeUInt32LE(e), c.concat([c.from([ut]), t]);
+  }
+  throw new Error(`Script too large to encode as CompactSize: ${e} bytes`);
+}
+function Ce(e, t) {
+  const o = c.concat([
+    c.from([e]),
+    gt(t.length),
+    c.from(t)
+  ]);
+  return H.taggedHash(lt, o);
+}
+function wt(e) {
+  const { leafVersion: t, script: o, controlBlock: n } = e, i = n.length - A;
+  if (i < 0 || i % T !== 0 || i / T > ce)
+    throw new Error(
+      `Malformed Taproot control block: length ${n.length} must be ${A} + 32*m with 0 <= m <= ${ce}`
+    );
+  const s = n[0] & Pt;
+  if (s !== t)
+    throw new Error(
+      `Taproot control block leaf version 0x${s.toString(16)} does not match the tapLeafScript leaf version 0x${t.toString(16)}`
+    );
+  const r = c.from(
+    n.subarray(1, A)
+  );
+  let u = Ce(t, o);
+  for (let l = A; l < n.length; l += T) {
+    const P = c.from(
+      n.subarray(l, l + T)
+    );
+    u = H.taggedHash(
+      ht,
+      c.compare(u, P) <= 0 ? c.concat([u, P]) : c.concat([P, u])
+    );
+  }
+  const h = H.taggedHash(
+    dt,
+    c.concat([r, u])
+  ), a = Se.xOnlyPointAddTweak(r, h);
+  if (a === null)
+    throw new Error(
+      "Taproot control block does not yield a valid output key (tweak is off-curve)"
+    );
+  const d = n[0] & pt;
+  if (a.parity !== d)
+    throw new Error(
+      `Taproot output key parity ${a.parity} contradicts the control block's parity bit ${d}`
+    );
+  return c.concat([
+    ft,
+    c.from(a.xOnlyPubkey)
+  ]);
+}
+const vt = 256, Et = 1500, ae = 256, le = 0xffffffffn, yt = 500, $t = 55, mt = 34;
+function St(e) {
+  if (typeof e.protocolFeeRate != "bigint" || e.protocolFeeRate <= 0n || e.protocolFeeRate > le)
+    throw new Error(
+      `protocolFeeRate must be in [1, ${le}] sat/vB, got ${e.protocolFeeRate}`
+    );
+  for (const [t, o, n, i] of [
+    [
+      "keepers",
+      e.numVaultKeepers,
+      vt,
+      "fee-floor model limit"
+    ],
+    [
+      "challengers",
+      e.numUniversalChallengers,
+      Et,
+      "protocol maximum"
+    ]
+  ])
+    if (!Number.isInteger(o) || o < 1 || o > n)
+      throw new Error(
+        `Participant count for ${t} (${o}) is outside the supported range [1, ${n}]${o > n ? ` (${i})` : ""}.`
+      );
+  if (!Number.isInteger(e.councilSize) || e.councilSize < 1 || e.councilSize > ae)
+    throw new Error(
+      `councilSize must be an integer in [1, ${ae}], got ${e.councilSize}`
+    );
+}
+async function xt(e, t) {
+  const { implicitFeeSats: o, out0Len: n, out1Len: i } = t, s = e.numVaultKeepers + e.numUniversalChallengers, r = BigInt(o), u = Math.max(0, n - mt), h = yt + $t * s + u, a = e.protocolFeeRate * BigInt(h);
+  if (r > a)
+    throw new Error(
+      `Payout implicit fee ${o} sats exceeds the safety cap of ${a} sats (${e.protocolFeeRate} sat/vB x ${h} vB for ${s} participants); refusing to sign payout.`
+    );
+  const d = await Oe(
+    e.vaultCoreVersion,
+    e.numVaultKeepers,
+    e.numUniversalChallengers,
+    e.numVaultKeepers,
+    e.councilSize,
+    n,
+    i,
+    e.protocolFeeRate
+  );
+  if (r < d)
+    throw new Error(
+      `Payout implicit fee ${o} sats is below the floor of ${d} sats (the smallest fee any known vault-provider build produces for this shape); refusing to sign payout.`
+    );
+}
+const Ct = 22, bt = 34, _t = 34, kt = 25, It = 23;
+function At(e) {
+  return e.length === Ct * 2 && e.startsWith("0014");
+}
+function Tt(e) {
+  return e.length === bt * 2 && e.startsWith("0020");
+}
+function Ot(e) {
+  return e.length === _t * 2 && e.startsWith("5120");
+}
+function Vt(e) {
+  return e.length === kt * 2 && e.startsWith("76a914") && e.endsWith("88ac");
+}
+function Lt(e) {
+  return e.length === It * 2 && e.startsWith("a914") && e.endsWith("87");
+}
+function he(e, t) {
+  const o = f(e).toLowerCase();
+  if (o.length === 0)
+    throw new Error(`${t} is empty`);
+  if (!/^[0-9a-f]+$/.test(o) || o.length % 2 !== 0)
+    throw new Error(`${t} is not valid hex`);
+  if (o.startsWith("6a"))
+    throw new Error(
+      `${t} is an OP_RETURN output, which is provably unspendable`
+    );
+  if (!Ot(o) && !At(o) && !Tt(o) && !Vt(o) && !Lt(o))
+    throw new Error(
+      `${t} is not a standard scriptPubKey (expected P2TR, P2WPKH, P2WSH, P2PKH, or P2SH; got ${o.length / 2} bytes: ${o})`
+    );
+}
+const de = 3;
+async function Zt(e) {
+  const t = {
+    vaultCoreVersion: e.vaultCoreVersion,
+    numVaultKeepers: e.vaultKeeperBtcPubkeys.length,
+    numUniversalChallengers: e.universalChallengerBtcPubkeys.length,
+    councilSize: e.councilMembers.length,
+    protocolFeeRate: e.protocolFeeRate
+  };
+  St(t);
+  const o = b.fromHex(f(e.payoutTxHex)), n = b.fromHex(f(e.peginTxHex)), i = b.fromHex(f(e.assertTxHex));
+  if (o.ins.length !== Q)
+    throw new Error(
+      `Payout transaction must have exactly ${Q} inputs, got ${o.ins.length}`
+    );
+  if (o.version !== Z)
+    throw new Error(
+      `Payout transaction version ${o.version} must be ${Z}; refusing to sign payout.`
+    );
+  if (o.locktime !== j)
+    throw new Error(
+      `Payout transaction locktime ${o.locktime} must be ${j}; refusing to sign payout.`
+    );
+  const s = pe(
+    o.ins[0],
+    0,
+    n,
+    "PegIn",
+    qe
+  );
+  if (o.ins[0].sequence !== e.timelockPegin)
+    throw new Error(
+      `Payout input 0 sequence ${o.ins[0].sequence} must equal the PegIn CSV timelock ${e.timelockPegin}; refusing to sign payout.`
+    );
+  const r = pe(
+    o.ins[1],
+    1,
+    i,
+    "Assert",
+    me
+  );
+  if (o.ins[1].sequence !== e.timelockAssert)
+    throw new Error(
+      `Payout input 1 sequence ${o.ins[1].sequence} must equal the Assert CSV timelock ${e.timelockAssert}; refusing to sign payout.`
+    );
+  const { out0Len: u, out1Len: h } = Kt(
+    o,
+    s.value,
+    e
+  ), a = s.value + r.value;
+  let d = 0;
+  for (const v of o.outs) d += v.value;
+  if (d > a)
+    throw new Error(
+      `Payout outputs (${d} sats) exceed inputs (${a} sats); invalid transaction.`
+    );
+  const l = a - d;
+  await xt(t, {
+    implicitFeeSats: l,
+    out0Len: u,
+    out1Len: h
+  });
+  const P = await st({
+    vaultCoreVersion: e.vaultCoreVersion,
+    depositor: e.depositorBtcPubkey,
+    vaultProvider: e.vaultProviderBtcPubkey,
+    vaultKeepers: e.vaultKeeperBtcPubkeys,
+    universalChallengers: e.universalChallengerBtcPubkeys,
+    timelockPegin: e.timelockPegin,
+    network: e.network
+  }), p = await Rt(e, r);
+  return {
+    psbtHex: Ht(
+      o,
+      s,
+      r,
+      P,
+      p
+    )
+  };
+}
+async function Rt(e, t) {
+  const { payoutScript: o, payoutControlBlock: n } = await Ve({
+    txGraphVersion: e.vaultCoreVersion,
+    claimer: f(e.claimerBtcPubkey).toLowerCase(),
+    localChallengers: Ge({
+      claimerBtcPubkey: e.claimerBtcPubkey,
+      depositorBtcPubkey: e.depositorBtcPubkey,
+      vaultProviderBtcPubkey: e.vaultProviderBtcPubkey,
+      vaultKeeperBtcPubkeys: e.vaultKeeperBtcPubkeys
+    }),
+    universalChallengers: e.universalChallengerBtcPubkeys.map(
+      (u) => f(u).toLowerCase()
+    ),
+    timelockAssert: e.timelockAssert,
+    councilMembers: e.councilMembers.map(
+      (u) => f(u).toLowerCase()
+    ),
+    councilQuorum: e.councilQuorum
+  }), i = x(o), s = x(n), r = wt({
+    leafVersion: y,
+    script: i,
+    controlBlock: s
+  });
+  if (!t.script.equals(r))
+    throw new Error(
+      `Rebuilt Assert:0 payout leaf does not spend the Assert output being referenced: leaf binds to ${r.toString("hex")}, Assert:${me} pays ${t.script.toString("hex")}; refusing to sign payout.`
+    );
+  return { script: i, controlBlock: s };
+}
+function pe(e, t, o, n, i) {
+  const s = U(
+    new Uint8Array(e.hash).slice().reverse()
+  ), r = o.getId();
+  if (s !== r || e.index !== i)
+    throw new Error(
+      `Input ${t} must spend ${n}:${i}. Expected ${r}:${i}, got ${s}:${e.index}`
+    );
+  const u = o.outs[e.index];
+  if (!u)
+    throw new Error(
+      `Previous output not found for input ${t} (txid: ${s}, index: ${e.index})`
+    );
+  return u;
+}
+function Ht(e, t, o, n, i) {
+  const s = new V();
+  s.setVersion(e.version), s.setLocktime(e.locktime);
+  const [r, u] = e.ins;
+  s.addInput({
+    hash: r.hash,
+    index: r.index,
+    sequence: r.sequence,
+    witnessUtxo: {
+      script: t.script,
+      value: t.value
+    },
+    tapLeafScript: [
+      {
+        leafVersion: y,
+        script: c.from(x(n.payoutScript)),
+        controlBlock: c.from(
+          x(n.payoutControlBlock)
+        )
+      }
+    ],
+    tapInternalKey: c.from(k)
+    // sighashType omitted - defaults to SIGHASH_DEFAULT (0x00) for Taproot
+  }), s.addInput({
+    hash: u.hash,
+    index: u.index,
+    sequence: u.sequence,
+    witnessUtxo: {
+      script: o.script,
+      value: o.value
+    },
+    tapLeafScript: [
+      {
+        leafVersion: y,
+        script: c.from(i.script),
+        controlBlock: c.from(i.controlBlock)
+      }
+    ],
+    tapInternalKey: c.from(k)
+  });
+  for (const h of e.outs)
+    s.addOutput({
+      script: h.script,
+      value: h.value
+    });
+  return s.toHex();
+}
+function Pe(e, t) {
+  const o = f(e).toLowerCase(), n = f(
+    $e(t)
+  ).toLowerCase();
+  return o === n ? [o] : [o, n];
+}
+function fe(e, t) {
+  return t.some((o) => e.equals(c.from(o, "hex")));
+}
+function Kt(e, t, o) {
+  const {
+    claimerBtcPubkey: n,
+    vaultProviderBtcPubkey: i,
+    depositorBtcPubkey: s,
+    vaultKeeperBtcPubkeys: r,
+    registeredPayoutScriptPubKey: u,
+    commissionBps: h,
+    vkClaimerPayoutScriptPubKeys: a,
+    vpCommissionScriptPubKey: d
+  } = o;
+  if (!Ne(u))
+    throw new Error("Invalid registeredPayoutScriptPubKey: not valid hex");
+  const l = f(n).toLowerCase(), P = f(i).toLowerCase(), p = f(s).toLowerCase(), v = r.map(
+    (S) => f(S).toLowerCase()
+  );
+  let w, g, $;
+  if (l === P)
+    w = "vp-claimer", g = Xe, $ = [f(u)];
+  else if (l === p)
+    w = "depositor-as-claimer", g = oe, $ = [f(u)];
+  else if (v.includes(l)) {
+    w = "vk-claimer", g = oe;
+    const S = a[l];
+    if (S === void 0)
+      throw new Error(
+        `No registered payout script resolved for vault keeper claimer ${l}`
+      );
+    he(
+      S,
+      `Vault keeper payout script for claimer ${l}`
+    ), $ = Pe(S, l);
+  } else
+    throw new Error(
+      `Unknown claimer pubkey ${l}: not VP, depositor, or a registered vault keeper`
+    );
+  if (e.outs.length !== g)
+    throw new Error(
+      `Payout transaction has ${e.outs.length} output(s), expected exactly ${g} for role ${w}.`
+    );
+  if (!fe(e.outs[0].script, $))
+    throw new Error(
+      `Payout transaction output 0 does not pay the expected scriptPubKey for role ${w}. Accepted: ${$.join(" or ")}; got ${e.outs[0].script.toString("hex")}`
+    );
+  const L = g - 1;
+  if (e.outs[L].value !== J)
+    throw new Error(
+      `Payout CPFP anchor (out ${L}) value ${e.outs[L].value} sats must equal ${J} sats`
+    );
+  if (w === "vp-claimer") {
+    he(
+      d,
+      "Vault provider commission payout script"
+    );
+    const S = Pe(
+      d,
+      P
+    );
+    if (!fe(e.outs[1].script, S))
+      throw new Error(
+        `Payout transaction output 1 does not pay the vault provider's commission scriptPubKey. Accepted: ${S.join(" or ")}; got ${e.outs[1].script.toString("hex")}`
+      );
+    if (!Number.isInteger(h) || h < 0 || h >= ee)
+      throw new Error(
+        `commissionBps must be an integer in [0, ${ee}), got ${h}`
+      );
+    const B = Math.floor(
+      t * h / We
+    );
+    if (e.outs[1].value > B)
+      throw new Error(
+        `Payout VP commission (out 1) value ${e.outs[1].value} sats exceeds cap ${B} sats (${h} bps of peginValue=${t})`
+      );
+  }
+  const I = e.outs[0].script.length;
+  if (I === 0 || I > te)
+    throw new Error(
+      `Payout receiver scriptPubKey length ${I} is outside the contract's registration cap [1, ${te}]; refusing to sign payout.`
+    );
+  const be = w === "vp-claimer" ? e.outs[1].script.length : void 0;
+  return { out0Len: I, out1Len: be };
+}
+function jt(e, t, o = 0) {
+  const n = V.fromHex(e);
+  if (o >= n.data.inputs.length)
+    throw new Error(
+      `Input index ${o} out of range (${n.data.inputs.length} inputs)`
+    );
+  const i = n.data.inputs[o];
+  if (i.tapScriptSig && i.tapScriptSig.length > 0) {
+    const s = x(t);
+    for (const r of i.tapScriptSig)
+      if (r.pubkey.equals(c.from(s)))
+        return ge(r.signature, o);
+    throw new Error(
+      `No signature found for depositor pubkey: ${t} at input ${o}`
+    );
+  }
+  if (i.finalScriptWitness && i.finalScriptWitness.length > 0) {
+    const s = Nt(i.finalScriptWitness);
+    if (s.length !== de)
+      throw new Error(
+        `Unexpected finalized witness stack size at input ${o}: expected ${de} items (signature, script, controlBlock), got ${s.length}`
+      );
+    return ge(s[0], o);
+  }
+  throw new Error(
+    `No tapScriptSig or finalScriptWitness found in signed PSBT at input ${o}`
+  );
+}
+function ge(e, t) {
+  if (e.length === 64)
+    return U(new Uint8Array(e));
+  throw e.length === 65 ? new Error(
+    `Unexpected sighash byte 0x${e[64].toString(16).padStart(2, "0")} at input ${t}. Expected implicit SIGHASH_DEFAULT as a 64-byte signature.`
+  ) : new Error(
+    `Unexpected signature length at input ${t}: ${e.length}`
+  );
+}
+function Nt(e) {
+  const t = [];
+  let o = 0;
+  const n = (r) => {
+    if (o + r > e.length)
+      throw new Error(
+        `Malformed witness data: need ${r} byte(s) at offset ${o}, only ${e.length - o} remaining`
+      );
+  }, i = () => {
+    n(1);
+    const r = e[o++];
+    if (r < 253) return r;
+    if (r === 253) {
+      n(2);
+      const u = (e[o] | e[o + 1] << 8) >>> 0;
+      return o += 2, u;
+    }
+    if (r === 254) {
+      n(4);
+      const u = (e[o] | e[o + 1] << 8 | e[o + 2] << 16 | e[o + 3] << 24) >>> 0;
+      return o += 4, u;
+    }
+    throw new Error(
+      `Malformed witness data: 8-byte varint (0xff) not supported at offset ${o - 1}`
+    );
+  }, s = i();
+  for (let r = 0; r < s; r++) {
+    const u = i();
+    n(u), t.push(c.from(e.subarray(o, o + u))), o += u;
+  }
+  if (o !== e.length)
+    throw new Error(
+      `Malformed witness data: ${e.length - o} trailing byte(s) after parsing ${s} item(s)`
+    );
+  return t;
+}
+class m extends Error {
+  constructor(t) {
+    super(
+      `Wallet returned a PSBT for a different transaction: ${t}`
+    ), this.name = "PsbtSubstitutionError";
+  }
+}
+function we(e, t) {
+  try {
+    return V.fromHex(t);
+  } catch (o) {
+    const n = o instanceof Error ? o.message : String(o);
+    throw new Error(`Failed to parse ${e} PSBT: ${n}`);
+  }
+}
+const Ut = 8;
+function N(e) {
+  return `${e.toString("hex").slice(0, Ut)}…`;
+}
+function ve(e) {
+  const t = c.from(e).reverse();
+  return N(t);
+}
+function Jt(e) {
+  const t = we("requested", e.requestedPsbtHex), o = we("returned", e.returnedPsbtHex);
+  if (t.version !== o.version)
+    throw new m(
+      `tx version differs (requested=${t.version}, returned=${o.version})`
+    );
+  if (t.locktime !== o.locktime)
+    throw new m(
+      `tx locktime differs (requested=${t.locktime}, returned=${o.locktime})`
+    );
+  if (t.txInputs.length !== o.txInputs.length)
+    throw new m(
+      `input count differs (requested=${t.txInputs.length}, returned=${o.txInputs.length})`
+    );
+  if (t.txOutputs.length !== o.txOutputs.length)
+    throw new m(
+      `output count differs (requested=${t.txOutputs.length}, returned=${o.txOutputs.length})`
+    );
+  for (let n = 0; n < t.txInputs.length; n++) {
+    const i = t.txInputs[n], s = o.txInputs[n];
+    if (!i.hash.equals(s.hash))
+      throw new m(
+        `input ${n} prevout txid differs (requested=${ve(i.hash)}, returned=${ve(s.hash)})`
+      );
+    if (i.index !== s.index)
+      throw new m(
+        `input ${n} prevout vout differs (requested=${i.index}, returned=${s.index})`
+      );
+    if (i.sequence !== s.sequence)
+      throw new m(
+        `input ${n} sequence differs (requested=${i.sequence}, returned=${s.sequence})`
+      );
+  }
+  for (let n = 0; n < t.txOutputs.length; n++) {
+    const i = t.txOutputs[n], s = o.txOutputs[n];
+    if (!i.script.equals(s.script))
+      throw new m(
+        `output ${n} scriptPubKey differs (requested=${N(i.script)}, returned=${N(s.script)})`
+      );
+    if (i.value !== s.value)
+      throw new m(
+        `output ${n} value differs (requested=${i.value}, returned=${s.value})`
+      );
+  }
+}
+function eo(e) {
+  const { requestedPsbtHex: t, signatureHex: o, signerXOnlyPubkeyHex: n, inputIndex: i } = e, s = f(o);
+  if (s.length !== F)
+    throw new Error(
+      `Schnorr signature for input ${i} must be ${F} hex chars (64 bytes), got ${s.length}.`
+    );
+  const r = f(n);
+  if (r.length !== ne)
+    throw new Error(
+      `Signer x-only pubkey for input ${i} must be ${ne} hex chars (32 bytes), got ${r.length}.`
+    );
+  const u = V.fromHex(t);
+  if (i < 0 || i >= u.data.inputs.length)
+    throw new Error(
+      `Input index ${i} out of range (${u.data.inputs.length} inputs).`
+    );
+  const h = [], a = [];
+  for (let g = 0; g < u.data.inputs.length; g++) {
+    const $ = u.data.inputs[g].witnessUtxo;
+    if (!$)
+      throw new Error(
+        `Cannot verify signature: input ${g} of the requested PSBT has no witnessUtxo (required to recompute the Taproot sighash).`
+      );
+    h.push($.script), a.push($.value);
+  }
+  const d = u.data.inputs[i].tapLeafScript;
+  if (!d || d.length !== 1)
+    throw new Error(
+      `Cannot verify signature: input ${i} of the requested PSBT must have exactly one tapLeafScript, got ${(d == null ? void 0 : d.length) ?? 0}.`
+    );
+  const l = d[0];
+  if (l.leafVersion !== y)
+    throw new Error(
+      `Cannot verify signature: input ${i} tapLeafScript has leaf version 0x${l.leafVersion.toString(16)}, expected 0x${y.toString(16)}.`
+    );
+  const P = Ce(l.leafVersion, l.script), p = new b();
+  p.version = u.version, p.locktime = u.locktime;
+  for (const g of u.txInputs)
+    p.addInput(g.hash, g.index, g.sequence);
+  for (const g of u.txOutputs)
+    p.addOutput(g.script, g.value);
+  const v = p.hashForWitnessV1(
+    i,
+    h,
+    a,
+    b.SIGHASH_DEFAULT,
+    P
+  );
+  if (!Se.verifySchnorr(
+    v,
+    x(r),
+    x(s)
+  ))
+    throw new Error(
+      `Schnorr signature for input ${i} (signer ${r}) does not verify against the expected Taproot script-path sighash. The wallet may have signed with the tweaked key, signed a different transaction, or returned an invalid signature.`
+    );
+}
+export {
+  O as H,
+  et as P,
+  Dt as a,
+  Qt as b,
+  Yt as c,
+  tt as d,
+  ot as e,
+  Zt as f,
+  jt as g,
+  m as h,
+  Jt as i,
+  eo as j,
+  st as k,
+  Qe as l,
+  Ce as m,
+  xe as n,
+  je as o,
+  Ge as p
+};
+//# sourceMappingURL=verifyScriptPathSchnorrSignature-D_epga4j.js.map