@babylonlabs-io/ts-sdk 2.0.2 → 3.0.1

package/dist/primeVpAuth-D0ZnsjRi.js

@@ -0,0 +1,805 @@
+var Q = Object.defineProperty;
+var Z = (t, e, r) => e in t ? Q(t, e, { enumerable: !0, configurable: !0, writable: !0, value: r }) : t[e] = r;
+var u = (t, e, r) => Z(t, typeof e != "symbol" ? e + "" : e, r);
+import { s as b, S as ee, h as re, p as J } from "./bitcoin-C-TuHb-v.js";
+import { V as te } from "./index-D2mybjXD.js";
+import { a as ne } from "./state-CFn1rT74.js";
+import * as V from "@bitcoin-js/tiny-secp256k1-asmjs";
+import { X as k, H as _, C as D } from "./validation-OSC0xTHB.js";
+import { v as ie } from "./bip322Verify-BXYrHBh8.js";
+import { s as se } from "./sha2-YqVHJiFj.js";
+function S(t, e) {
+  const r = (t & 7) << 5, n = typeof e == "bigint" ? e : BigInt(e);
+  if (n < 0n) throw new Error("cborHead: negative argument");
+  if (n < 24n) return new Uint8Array([r | Number(n)]);
+  if (n < 0x100n) return new Uint8Array([r | 24, Number(n)]);
+  if (n < 0x10000n) {
+    const i = Number(n);
+    return new Uint8Array([r | 25, i >>> 8 & 255, i & 255]);
+  }
+  if (n < 0x100000000n) {
+    const i = Number(n);
+    return new Uint8Array([
+      r | 26,
+      i >>> 24 & 255,
+      i >>> 16 & 255,
+      i >>> 8 & 255,
+      i & 255
+    ]);
+  }
+  const s = new Uint8Array(9);
+  s[0] = r | 27;
+  for (let i = 7; i >= 0; i--)
+    s[1 + i] = Number(n >> BigInt((7 - i) * 8)) & 255;
+  return s;
+}
+function j(...t) {
+  const e = t.reduce((s, i) => s + i.length, 0), r = new Uint8Array(e);
+  let n = 0;
+  for (const s of t)
+    r.set(s, n), n += s.length;
+  return r;
+}
+function I(t) {
+  const r = [S(4, t.length)];
+  for (const n of t)
+    r.push(S(0, n));
+  return j(...r);
+}
+function oe(t, e, r) {
+  if (!Number.isSafeInteger(r) || r < 0)
+    throw new Error(
+      `encodeServerIdentityPayload: expires_at must be a non-negative safe integer, got ${r}`
+    );
+  const n = S(4, 3), s = I(t), i = I(e), o = S(0, r);
+  return j(n, s, i, o);
+}
+const ae = new TextEncoder().encode(
+  "btc-auth.server-identity.v1"
+), ce = 2 * 3600;
+class p extends Error {
+  constructor(e, r) {
+    super(e), this.reason = r, this.name = "ServerIdentityError";
+  }
+}
+function v(t) {
+  const e = new Uint8Array(t.length / 2);
+  for (let r = 0; r < e.length; r++)
+    e[r] = parseInt(t.slice(r * 2, r * 2 + 2), 16);
+  return e;
+}
+function de(t) {
+  const { proof: e, pinnedServerPubkey: r, now: n } = t, s = t.maxLifetimeSecs ?? ce, i = b(r).toLowerCase();
+  if (i.length !== k || !_.test(i))
+    throw new p(
+      `pinnedServerPubkey must be 32-byte hex; got ${i.length} chars`,
+      "invalid_pubkey_encoding"
+    );
+  const o = b(e.server_pubkey).toLowerCase();
+  if (o.length !== k || !_.test(o))
+    throw new p(
+      `server_pubkey must be 32-byte hex; got ${o.length} chars`,
+      "invalid_pubkey_encoding"
+    );
+  if (o !== i)
+    throw new p(
+      `server_pubkey does not match pinned value: expected ${i}, got ${o}`,
+      "pinned_pubkey_mismatch"
+    );
+  if (!Number.isSafeInteger(e.expires_at))
+    throw new p(
+      `expires_at must be a finite integer; got ${JSON.stringify(e.expires_at)}`,
+      "invalid_expires_at"
+    );
+  if (!Number.isSafeInteger(n))
+    throw new p(
+      `now must be a finite integer; got ${JSON.stringify(n)}`,
+      "invalid_expires_at"
+    );
+  if (e.expires_at <= n)
+    throw new p(
+      `server identity proof expired at ${e.expires_at}, now ${n}`,
+      "expired"
+    );
+  if (!Number.isSafeInteger(s) || s <= 0)
+    throw new p(
+      `maxLifetimeSecs must be a positive safe integer; got ${JSON.stringify(s)}`,
+      "invalid_max_lifetime"
+    );
+  if (e.expires_at - n > s)
+    throw new p(
+      `server identity proof expires too far in the future: expires_at=${e.expires_at}, now=${n}, max lifetime=${s}s`,
+      "expires_too_far"
+    );
+  const c = b(e.ephemeral_pubkey).toLowerCase();
+  if (c.length !== D || !_.test(c))
+    throw new p(
+      `ephemeral_pubkey must be 33-byte compressed hex; got ${c.length} chars`,
+      "invalid_ephemeral_pubkey"
+    );
+  const y = c.slice(0, 2);
+  if (y !== "02" && y !== "03")
+    throw new p(
+      `ephemeral_pubkey must be compressed (prefix 02/03); got ${y}`,
+      "invalid_ephemeral_pubkey"
+    );
+  const l = v(c);
+  if (!V.isPoint(l))
+    throw new p(
+      "ephemeral_pubkey is not a valid secp256k1 point",
+      "invalid_ephemeral_pubkey"
+    );
+  const h = b(e.signature).toLowerCase();
+  if (h.length !== ee || !_.test(h))
+    throw new p(
+      `signature must be 64-byte Schnorr hex; got ${h.length} chars`,
+      "invalid_signature_encoding"
+    );
+  const f = oe(
+    ae,
+    v(c),
+    e.expires_at
+  );
+  if (!ie(
+    f,
+    v(o),
+    v(h)
+  ))
+    throw new p(
+      "BIP-322 signature verification failed — ephemeral key is not attested by pinned server pubkey",
+      "signature_verification_failed"
+    );
+}
+const ue = /* @__PURE__ */ new Set([
+  "vaultProvider_submitDepositorWotsKey",
+  "vaultProvider_submitDepositorPresignatures",
+  "vaultProvider_requestDepositorPresignTransactions"
+]), he = /* @__PURE__ */ new Set([
+  "vaultProvider_requestDepositorClaimerArtifacts"
+]), pe = 6e4, C = "auth_createDepositorToken", R = "auth_createDepositorTokenGrpc";
+function F(t, e) {
+  return new ne({
+    baseUrl: t,
+    timeout: pe,
+    headers: e,
+    retryableFor: (r) => r === C || r === R
+  });
+}
+const le = 0, ye = 1, m = 2, ge = 3, fe = 4, _e = 5, be = 6, we = 7, M = 24, xe = 28, ve = 20, ke = 21, Se = 22, N = 256;
+class g extends Error {
+  constructor(e) {
+    super(`CBOR decode: ${e}`), this.name = "CborDecodeError";
+  }
+}
+class K {
+  constructor(e) {
+    u(this, "buf");
+    /** Current read offset. Public so callers can slice encoded sub-ranges. */
+    u(this, "pos", 0);
+    this.buf = e;
+  }
+  nextByte() {
+    if (this.pos >= this.buf.length)
+      throw new g("unexpected end of input");
+    return this.buf[this.pos++];
+  }
+  /**
+   * Read an initial byte and its argument. Rejects indefinite-length
+   * and reserved additional-info encodings. Arguments wider than
+   * {@link Number.MAX_SAFE_INTEGER} are rejected — none of the token's
+   * lengths, tags, or timestamps approach that bound.
+   */
+  readHead() {
+    const e = this.nextByte(), r = e >> 5, n = e & 31;
+    if (n < M)
+      return { major: r, arg: n };
+    if (n >= xe)
+      throw new g(
+        `unsupported additional info ${n} (indefinite-length or reserved)`
+      );
+    const s = 1 << n - M;
+    let i = 0n;
+    for (let o = 0; o < s; o++)
+      i = i << 8n | BigInt(this.nextByte());
+    if (i > BigInt(Number.MAX_SAFE_INTEGER))
+      throw new g(`argument ${i} exceeds safe integer range`);
+    return { major: r, arg: Number(i) };
+  }
+  /** Read `length` raw bytes as a sub-array view into the backing buffer. */
+  readBytes(e) {
+    if (this.pos + e > this.buf.length)
+      throw new g("length overruns end of input");
+    const r = this.buf.subarray(this.pos, this.pos + e);
+    return this.pos += e, r;
+  }
+  /**
+   * Read a byte string (major type 2), returning its content bytes.
+   * Throws if the next item is not a byte string.
+   */
+  readByteString() {
+    const e = this.readHead();
+    if (e.major !== m)
+      throw new g(
+        `expected byte string (major ${m}), got major ${e.major}`
+      );
+    return this.readBytes(e.arg);
+  }
+  /**
+   * Read the next complete data item as a decoded {@link CborValue}.
+   *
+   * `depth` tracks the current nesting level so a deeply-nested blob is
+   * rejected with a {@link CborDecodeError} rather than overflowing the
+   * native call stack (see {@link MAX_NESTING_DEPTH}).
+   */
+  readValue(e = 0) {
+    if (e > N)
+      throw new g(
+        `nesting exceeds maximum depth ${N}`
+      );
+    const r = this.readHead();
+    switch (r.major) {
+      case le:
+        return r.arg;
+      case ye:
+        return -1 - r.arg;
+      case m:
+        return this.readBytes(r.arg);
+      case ge:
+        return new TextDecoder("utf-8", { fatal: !0 }).decode(
+          this.readBytes(r.arg)
+        );
+      case fe: {
+        const n = [];
+        for (let s = 0; s < r.arg; s++)
+          n.push(this.readValue(e + 1));
+        return n;
+      }
+      case _e: {
+        const n = /* @__PURE__ */ new Map();
+        for (let s = 0; s < r.arg; s++) {
+          const i = this.readValue(e + 1), o = this.readValue(e + 1);
+          n.set(i, o);
+        }
+        return n;
+      }
+      case be:
+        return { tag: r.arg, value: this.readValue(e + 1) };
+      case we:
+        if (r.arg === ve) return !1;
+        if (r.arg === ke) return !0;
+        if (r.arg === Se) return null;
+        throw new g(
+          `unsupported simple/float value ${r.arg}`
+        );
+      default:
+        throw new g(`unsupported major type ${r.major}`);
+    }
+  }
+}
+function q(t) {
+  const e = new K(t), r = e.readValue();
+  if (e.pos !== t.length)
+    throw new g("trailing bytes after top-level item");
+  return r;
+}
+const Ae = "vaultd-jsonrpc", Pe = "vaultd-grpc", L = 18, O = 4, B = -47, me = 1, H = 64, Ee = 128, Te = 96, Ce = 64, Re = 1, Oe = 2, $e = 3, Ie = 4, Me = 5, Ne = 6, Le = 7, G = new TextEncoder().encode("Signature1");
+class a extends Error {
+  constructor(e, r) {
+    super(e), this.reason = r, this.name = "CwtVerificationError";
+  }
+}
+function Be(t) {
+  const e = X(
+    t.expectedIssuerXOnlyPubkey,
+    "expectedIssuerXOnlyPubkey"
+  ), r = X(
+    t.expectedAudienceXOnlyPubkey,
+    "expectedAudienceXOnlyPubkey"
+  ), n = Je(t.ephemeralPubkeyHex), s = De(t.token), i = new K(s), o = i.readHead();
+  if (o.major !== 6 || o.arg !== L)
+    throw new a(
+      `token is not a COSE Sign1 tagged value (tag ${L})`,
+      "invalid_token_structure"
+    );
+  const c = i.readHead();
+  if (c.major !== 4 || c.arg !== O)
+    throw new a(
+      `COSE Sign1 must be a ${O}-element array`,
+      "invalid_token_structure"
+    );
+  const y = i.pos, l = i.readByteString(), h = s.subarray(y, i.pos);
+  i.readValue();
+  const f = i.pos, w = i.readByteString(), A = s.subarray(f, i.pos), P = i.readByteString();
+  if (P.length !== H)
+    throw new a(
+      `COSE signature must be ${H} bytes, got ${P.length}`,
+      "invalid_token_structure"
+    );
+  if (i.pos !== s.length)
+    throw new a(
+      "COSE Sign1 token has trailing bytes after the signature",
+      "invalid_token_structure"
+    );
+  const $ = He(l);
+  if ($ !== B)
+    throw new a(
+      `unexpected COSE algorithm ${$} (expected ES256K ${B})`,
+      "unexpected_algorithm"
+    );
+  const Y = Ge(h, A), z = se(Y);
+  if (!V.verify(z, n, P, !0))
+    throw new a(
+      "COSE signature does not verify against the server's ephemeral key",
+      "signature_verification_failed"
+    );
+  const d = Xe(w), x = d.audience.toLowerCase();
+  if (x.length !== k || !_.test(x))
+    throw new a(
+      "token `aud` is not a 32-byte x-only pubkey hex",
+      "invalid_claims"
+    );
+  if (d.issuedAt > d.expiresAt)
+    throw new a(
+      `token iat (${d.issuedAt}) is after exp (${d.expiresAt})`,
+      "invalid_claims"
+    );
+  if (d.issuer.toLowerCase() !== e)
+    throw new a(
+      `token issuer does not match pinned server pubkey: expected ${e}, got ${d.issuer.toLowerCase()}`,
+      "issuer_mismatch"
+    );
+  if (d.subject !== t.expectedSubject)
+    throw new a(
+      `token subject mismatch: expected ${t.expectedSubject}, got ${d.subject}`,
+      "subject_mismatch"
+    );
+  if (x !== r)
+    throw new a(
+      `token audience does not match depositor pubkey: expected ${r}, got ${x}`,
+      "audience_mismatch"
+    );
+  if (d.expiresAt <= t.now)
+    throw new a(
+      `token expired: exp ${d.expiresAt} <= now ${t.now}`,
+      "token_expired"
+    );
+  if (t.responseExpiresAt !== d.expiresAt)
+    throw new a(
+      `response expires_at (${t.responseExpiresAt}) does not equal token exp (${d.expiresAt})`,
+      "expiry_mismatch"
+    );
+  if (t.serverIdentityExpiresAt < d.expiresAt)
+    throw new a(
+      `server identity expires (${t.serverIdentityExpiresAt}) before token exp (${d.expiresAt})`,
+      "server_identity_expires_before_token"
+    );
+  return {
+    issuer: d.issuer,
+    subject: d.subject,
+    audience: x,
+    expiresAt: d.expiresAt,
+    notBefore: d.notBefore,
+    issuedAt: d.issuedAt
+  };
+}
+function He(t) {
+  if (t.length === 0)
+    throw new a(
+      "empty COSE protected header (no algorithm)",
+      "unexpected_algorithm"
+    );
+  const e = q(t);
+  if (!(e instanceof Map))
+    throw new a(
+      "COSE protected header is not a map",
+      "invalid_token_structure"
+    );
+  const r = e.get(me);
+  if (typeof r != "number")
+    throw new a(
+      "COSE protected header missing integer algorithm label",
+      "unexpected_algorithm"
+    );
+  return r;
+}
+function Ge(t, e) {
+  return je(
+    Uint8Array.of(Ee | O),
+    Uint8Array.of(Te | G.length),
+    G,
+    t,
+    Uint8Array.of(Ce),
+    e
+  );
+}
+function Xe(t) {
+  const e = q(t);
+  if (!(e instanceof Map))
+    throw new a(
+      "CWT claims root is not a map",
+      "invalid_claims"
+    );
+  if (Ue(e, Le, "cti").length === 0)
+    throw new a("token cti is empty", "invalid_claims");
+  return {
+    issuer: E(e, Re, "iss"),
+    subject: E(e, Oe, "sub"),
+    audience: E(e, $e, "aud"),
+    expiresAt: T(e, Ie, "exp"),
+    notBefore: T(e, Me, "nbf"),
+    issuedAt: T(e, Ne, "iat")
+  };
+}
+function E(t, e, r) {
+  const n = t.get(e);
+  if (typeof n != "string")
+    throw new a(
+      `token claim ${r} is missing or not a text string`,
+      "invalid_claims"
+    );
+  return n;
+}
+function Ue(t, e, r) {
+  const n = t.get(e);
+  if (!(n instanceof Uint8Array))
+    throw new a(
+      `token claim ${r} is missing or not a byte string`,
+      "invalid_claims"
+    );
+  return n;
+}
+function T(t, e, r) {
+  const n = t.get(e);
+  if (typeof n != "number" || !Number.isSafeInteger(n) || n < 0)
+    throw new a(
+      `token claim ${r} is missing or not a non-negative integer timestamp`,
+      "invalid_claims"
+    );
+  return n;
+}
+function X(t, e) {
+  const r = b(t).toLowerCase();
+  if (r.length !== k || !_.test(r))
+    throw new a(
+      `${e} must be 32-byte x-only hex; got ${r.length} chars`,
+      "invalid_input"
+    );
+  return r;
+}
+function Je(t) {
+  const e = b(t).toLowerCase(), r = e.slice(0, 2);
+  if (e.length !== D || !_.test(e) || r !== "02" && r !== "03")
+    throw new a(
+      "ephemeralPubkeyHex must be 33-byte compressed pubkey hex (prefix 02/03)",
+      "invalid_input"
+    );
+  return re(e);
+}
+const Ve = (() => {
+  const t = new Int16Array(128).fill(-1), e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+  for (let r = 0; r < e.length; r++)
+    t[e.charCodeAt(r)] = r;
+  return t;
+})();
+function De(t) {
+  const e = t.length, r = Math.floor(e / 4), n = e % 4;
+  if (n === 1)
+    throw new a(
+      "invalid base64url length",
+      "invalid_token_structure"
+    );
+  const s = r * 3 + (n === 0 ? 0 : n - 1), i = new Uint8Array(s), o = (l) => {
+    const h = l < 128 ? Ve[l] : -1;
+    if (h < 0)
+      throw new a(
+        "invalid base64url character",
+        "invalid_token_structure"
+      );
+    return h;
+  };
+  let c = 0, y = 0;
+  for (let l = 0; l < r; l++) {
+    const h = o(t.charCodeAt(c++)), f = o(t.charCodeAt(c++)), w = o(t.charCodeAt(c++)), A = o(t.charCodeAt(c++));
+    i[y++] = h << 2 | f >> 4, i[y++] = (f & 15) << 4 | w >> 2, i[y++] = (w & 3) << 6 | A;
+  }
+  if (n === 2) {
+    const l = o(t.charCodeAt(c++)), h = o(t.charCodeAt(c++));
+    i[y++] = l << 2 | h >> 4;
+  } else if (n === 3) {
+    const l = o(t.charCodeAt(c++)), h = o(t.charCodeAt(c++)), f = o(t.charCodeAt(c++));
+    i[y++] = l << 2 | h >> 4, i[y++] = (h & 15) << 4 | f >> 2;
+  }
+  return i;
+}
+function je(...t) {
+  const e = t.reduce((s, i) => s + i.length, 0), r = new Uint8Array(e);
+  let n = 0;
+  for (const s of t)
+    r.set(s, n), n += s.length;
+  return r;
+}
+const U = 4102444800, Fe = 30;
+class Ke {
+  constructor(e) {
+    // Most identity-bearing fields remain readonly and are checked against
+    // re-registration in the registry's `getOrCreate`. The JSON-RPC pin is the
+    // one exception: RFC-006 explicitly permits it to move, but only to a value
+    // re-read through the caller's authoritative chain resolver.
+    u(this, "client");
+    u(this, "peginTxid");
+    u(this, "authAnchorHex");
+    u(this, "jsonRpcPinnedServerPubkey");
+    u(this, "grpcPinnedServerPubkey");
+    u(this, "refreshJsonRpcPinnedServerPubkey");
+    u(this, "expectedAudienceXOnlyPubkey");
+    u(this, "authGatedMethods");
+    u(this, "grpcGatedMethods");
+    u(this, "refreshSkewSecs");
+    u(this, "now");
+    /** Cached JSON-RPC-subject bearer (auth_createDepositorToken). */
+    u(this, "cachedJsonRpc", null);
+    u(this, "inFlightJsonRpc", null);
+    /** Cached gRPC-subject bearer (auth_createDepositorTokenGrpc). */
+    u(this, "cachedGrpc", null);
+    u(this, "inFlightGrpc", null);
+    this.client = e.client, this.peginTxid = e.peginTxid, this.authAnchorHex = e.authAnchorHex, this.jsonRpcPinnedServerPubkey = e.pinnedServerPubkey, this.grpcPinnedServerPubkey = e.grpcPinnedServerPubkey, this.refreshJsonRpcPinnedServerPubkey = e.refreshJsonRpcPinnedServerPubkey, this.expectedAudienceXOnlyPubkey = e.expectedAudienceXOnlyPubkey, this.authGatedMethods = e.authGatedMethods, this.grpcGatedMethods = e.grpcGatedMethods, this.refreshSkewSecs = e.refreshSkewSecs ?? Fe, this.now = e.now ?? (() => Math.floor(Date.now() / 1e3));
+  }
+  /**
+   * Return a bearer token for `method`, or `null` if `method` is not
+   * auth-gated.
+   *
+   * Routes by subject: `authGatedMethods` → JSON-RPC bearer (issued via
+   * `auth_createDepositorToken`); `grpcGatedMethods` → gRPC bearer
+   * (`auth_createDepositorTokenGrpc`). Either path acquires lazily and
+   * single-flights concurrent callers; the two cache slots are
+   * independent.
+   *
+   * Both token-issuing methods are hard-exempted from the gate — if
+   * either were ever included in the gated sets (caller misconfiguration)
+   * the provider would recurse into `acquireSingleFlight` from inside the
+   * JSON-RPC header builder before `inFlight` is assigned, defeating the
+   * single-flight guard. Returning `null` here breaks that recursion
+   * deterministically.
+   */
+  async getToken(e) {
+    return e === C || e === R ? null : this.grpcGatedMethods.has(e) ? this.getTokenForSubject("grpc") : this.authGatedMethods.has(e) ? this.getTokenForSubject("jsonrpc") : null;
+  }
+  /**
+   * Drop both cached tokens. Next `getToken` call re-acquires the slot
+   * that's actually needed. Called by `JsonRpcClient` on wire
+   * `auth_expired` responses; the client doesn't tell us which subject
+   * expired, so we evict both to stay correct under either.
+   *
+   * Worst case is one extra round-trip on the slot that was still fresh,
+   * which is cheaper than carrying a `Subject` argument through
+   * `BearerTokenProvider`.
+   */
+  invalidate() {
+    this.cachedJsonRpc = null, this.cachedGrpc = null;
+  }
+  async getTokenForSubject(e) {
+    const r = e === "grpc" ? this.cachedGrpc : this.cachedJsonRpc;
+    return r && this.now() + this.refreshSkewSecs < r.expiresAt ? r.token : (await this.acquireSingleFlight(e)).token;
+  }
+  /**
+   * Swap in a different transport for subsequent token-issuing calls.
+   * Used by the registry when a later caller registers the same
+   * `peginTxid` against a different `baseUrl` — the cached token
+   * (bound to identity, not transport) stays valid, but future
+   * refreshes hit the new URL. An in-flight acquire keeps using the
+   * old client (it captured the reference); next call uses the new.
+   */
+  setClient(e) {
+    this.client = e;
+  }
+  /** Current subject-specific pin, exposed for registry identity checks. */
+  getPinnedServerPubkey(e) {
+    return e === "grpc" ? this.grpcPinnedServerPubkey : this.jsonRpcPinnedServerPubkey;
+  }
+  acquireSingleFlight(e) {
+    const r = e === "grpc" ? this.inFlightGrpc : this.inFlightJsonRpc;
+    if (r) return r;
+    const n = e === "grpc" ? R : C, s = (async () => {
+      try {
+        const i = await this.acquireAndVerify(e, n, !0);
+        return e === "grpc" ? this.cachedGrpc = i : this.cachedJsonRpc = i, i;
+      } finally {
+        e === "grpc" ? this.inFlightGrpc = null : this.inFlightJsonRpc = null;
+      }
+    })();
+    return e === "grpc" ? this.inFlightGrpc = s : this.inFlightJsonRpc = s, s;
+  }
+  async acquireAndVerify(e, r, n) {
+    const s = await this.client.call(r, {
+      pegin_txid: this.peginTxid,
+      auth_anchor: this.authAnchorHex
+    }), i = this.getPinnedServerPubkey(e);
+    try {
+      if (de({
+        proof: s.server_identity,
+        pinnedServerPubkey: i,
+        now: this.now()
+      }), typeof s.token != "string" || s.token.length === 0)
+        throw new Error(
+          `VpTokenProvider: invalid token in acquire response (expected non-empty string, got ${typeof s.token})`
+        );
+      const o = this.now();
+      if (!Number.isSafeInteger(s.expires_at) || s.expires_at <= o || s.expires_at > U)
+        throw new Error(
+          `VpTokenProvider: invalid expires_at in acquire response (got ${JSON.stringify(s.expires_at)}; must be a safe integer in (${o}, ${U}])`
+        );
+      return Be({
+        token: s.token,
+        ephemeralPubkeyHex: s.server_identity.ephemeral_pubkey,
+        expectedIssuerXOnlyPubkey: i,
+        expectedSubject: e === "grpc" ? Pe : Ae,
+        expectedAudienceXOnlyPubkey: this.expectedAudienceXOnlyPubkey,
+        responseExpiresAt: s.expires_at,
+        serverIdentityExpiresAt: s.server_identity.expires_at,
+        now: o
+      }), {
+        token: s.token,
+        expiresAt: s.expires_at
+      };
+    } catch (o) {
+      if (n && e === "jsonrpc" && this.refreshJsonRpcPinnedServerPubkey && qe(o)) {
+        const c = await this.refreshJsonRpcPinnedServerPubkey();
+        if (c !== this.jsonRpcPinnedServerPubkey)
+          return this.jsonRpcPinnedServerPubkey = c, this.acquireAndVerify(e, r, !1);
+      }
+      throw o;
+    }
+  }
+}
+function qe(t) {
+  return t instanceof p && t.reason === "pinned_pubkey_mismatch" || t instanceof a && t.reason === "issuer_mismatch";
+}
+class We {
+  constructor() {
+    u(this, "entries", /* @__PURE__ */ new Map());
+  }
+  /**
+   * Return the cached `VpTokenProvider` for `peginTxid` if one exists
+   * with matching anchor, provider, audience, and subject-specific issuer
+   * bindings, otherwise construct and cache a fresh provider. A mismatch
+   * throws — silent overwrite would mask derivation drift or cross-provider
+   * cache reuse. A legitimate live JSON-RPC key rotation is handled inside
+   * `VpTokenProvider` through its chain-backed refresh callback.
+   */
+  getOrCreate(e) {
+    const r = this.entries.get(e.peginTxid);
+    if (r) {
+      if (r.authAnchorHex !== e.authAnchorHex)
+        throw new Error(
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to authAnchorHex ${r.authAnchorHex.slice(0, 8)}…; got ${e.authAnchorHex.slice(0, 8)}…`
+        );
+      if (r.providerAddress.toLowerCase() !== e.providerAddress.toLowerCase())
+        throw new Error(
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to providerAddress ${r.providerAddress}; got ${e.providerAddress}`
+        );
+      if (r.provider.getPinnedServerPubkey("jsonrpc") !== e.pinnedServerPubkey)
+        throw new Error(
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to JSON-RPC pinnedServerPubkey ${r.provider.getPinnedServerPubkey("jsonrpc").slice(0, 8)}…; got ${e.pinnedServerPubkey.slice(0, 8)}…`
+        );
+      if (r.provider.getPinnedServerPubkey("grpc") !== e.grpcPinnedServerPubkey)
+        throw new Error(
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to gRPC pinnedServerPubkey ${r.provider.getPinnedServerPubkey("grpc").slice(0, 8)}…; got ${e.grpcPinnedServerPubkey.slice(0, 8)}…`
+        );
+      if (r.grpcKeyEpoch !== e.grpcKeyEpoch)
+        throw new Error(
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to gRPC key epoch ${r.grpcKeyEpoch.toString()}; got ${e.grpcKeyEpoch.toString()}`
+        );
+      if (r.expectedAudienceXOnlyPubkey.toLowerCase() !== e.expectedAudienceXOnlyPubkey.toLowerCase())
+        throw new Error(
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to expectedAudienceXOnlyPubkey ${r.expectedAudienceXOnlyPubkey.slice(0, 8)}…; got ${e.expectedAudienceXOnlyPubkey.slice(0, 8)}…`
+        );
+      return r.provider.setClient(e.client), r.provider;
+    }
+    const n = new Ke({
+      client: e.client,
+      peginTxid: e.peginTxid,
+      authAnchorHex: e.authAnchorHex,
+      pinnedServerPubkey: e.pinnedServerPubkey,
+      grpcPinnedServerPubkey: e.grpcPinnedServerPubkey,
+      refreshJsonRpcPinnedServerPubkey: e.refreshJsonRpcPinnedServerPubkey,
+      expectedAudienceXOnlyPubkey: e.expectedAudienceXOnlyPubkey,
+      authGatedMethods: ue,
+      grpcGatedMethods: he
+    });
+    return this.entries.set(e.peginTxid, {
+      provider: n,
+      authAnchorHex: e.authAnchorHex,
+      providerAddress: e.providerAddress,
+      grpcKeyEpoch: e.grpcKeyEpoch,
+      expectedAudienceXOnlyPubkey: e.expectedAudienceXOnlyPubkey
+    }), n;
+  }
+  /**
+   * Return the cached provider only when its request-facing identity matches.
+   * A missing entry is a normal cold-cache result; a binding mismatch throws
+   * so callers cannot attach one provider's bearer to another provider or
+   * depositor request.
+   */
+  peek(e) {
+    const r = this.entries.get(e.peginTxid);
+    if (r) {
+      if (r.providerAddress.toLowerCase() !== e.providerAddress.toLowerCase())
+        throw new Error(
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to providerAddress ${r.providerAddress}; got ${e.providerAddress}`
+        );
+      if (r.expectedAudienceXOnlyPubkey.toLowerCase() !== e.expectedAudienceXOnlyPubkey.toLowerCase())
+        throw new Error(
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to expectedAudienceXOnlyPubkey ${r.expectedAudienceXOnlyPubkey.slice(0, 8)}…; got ${e.expectedAudienceXOnlyPubkey.slice(0, 8)}…`
+        );
+      return r.provider;
+    }
+  }
+  /**
+   * Evict the entry for `peginTxid`. Idempotent. Called on terminal
+   * paths — activation success, user-cancel, or component unmount —
+   * so `authAnchorHex` doesn't outlive the deposit session.
+   */
+  release(e) {
+    this.entries.delete(e);
+  }
+  /**
+   * Wipe every cached entry. Test-only escape hatch — not exposed on
+   * the public {@link VpTokenRegistryPublic} singleton type.
+   *
+   * @internal
+   */
+  clear() {
+    this.entries.clear();
+  }
+  get size() {
+    return this.entries.size;
+  }
+}
+const W = new We();
+function nr(t) {
+  var n;
+  const e = F(
+    t.baseUrl,
+    (n = t.options) == null ? void 0 : n.headers
+  ), r = W.getOrCreate({
+    client: e,
+    peginTxid: t.peginTxid,
+    authAnchorHex: t.authAnchorHex,
+    providerAddress: t.providerAddress,
+    pinnedServerPubkey: t.pinnedServerPubkey,
+    grpcPinnedServerPubkey: t.grpcPinnedServerPubkey,
+    grpcKeyEpoch: t.grpcKeyEpoch,
+    refreshJsonRpcPinnedServerPubkey: t.refreshJsonRpcPinnedServerPubkey,
+    expectedAudienceXOnlyPubkey: J(
+      t.depositorBtcPubkey
+    )
+  });
+  return new te(t.baseUrl, {
+    ...t.options,
+    tokenProvider: r
+  });
+}
+function ir(t) {
+  W.getOrCreate({
+    client: F(t.baseUrl, t.headers),
+    peginTxid: t.peginTxid,
+    authAnchorHex: t.authAnchorHex,
+    providerAddress: t.providerAddress,
+    pinnedServerPubkey: t.pinnedServerPubkey,
+    grpcPinnedServerPubkey: t.grpcPinnedServerPubkey,
+    grpcKeyEpoch: t.grpcKeyEpoch,
+    refreshJsonRpcPinnedServerPubkey: t.refreshJsonRpcPinnedServerPubkey,
+    expectedAudienceXOnlyPubkey: J(
+      t.depositorBtcPubkey
+    )
+  });
+}
+export {
+  p as S,
+  We as V,
+  W as a,
+  nr as c,
+  ir as p,
+  de as v
+};
+//# sourceMappingURL=primeVpAuth-D0ZnsjRi.js.map