@babylonlabs-io/ts-sdk 2.0.2 → 3.0.1

package/dist/primeVpAuth-PiUJksAq.js

@@ -1,745 +0,0 @@
-var Q = Object.defineProperty;
-var Z = (r, e, t) => e in r ? Q(r, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : r[e] = t;
-var d = (r, e, t) => Z(r, typeof e != "symbol" ? e + "" : e, t);
-import { s as x, S as ee, h as te, p as D } from "./bitcoin-C-TuHb-v.js";
-import { V as re } from "./index-Bnavi_r3.js";
-import { a as ne } from "./json-rpc-client-CQLbpuKK.js";
-import * as J from "@bitcoin-js/tiny-secp256k1-asmjs";
-import { X as A, H as f, C as V } from "./validation-OSC0xTHB.js";
-import { v as ie } from "./bip322Verify-BXYrHBh8.js";
-import { s as se } from "./sha2-YqVHJiFj.js";
-function S(r, e) {
-  const t = (r & 7) << 5, n = typeof e == "bigint" ? e : BigInt(e);
-  if (n < 0n) throw new Error("cborHead: negative argument");
-  if (n < 24n) return new Uint8Array([t | Number(n)]);
-  if (n < 0x100n) return new Uint8Array([t | 24, Number(n)]);
-  if (n < 0x10000n) {
-    const i = Number(n);
-    return new Uint8Array([t | 25, i >>> 8 & 255, i & 255]);
-  }
-  if (n < 0x100000000n) {
-    const i = Number(n);
-    return new Uint8Array([
-      t | 26,
-      i >>> 24 & 255,
-      i >>> 16 & 255,
-      i >>> 8 & 255,
-      i & 255
-    ]);
-  }
-  const s = new Uint8Array(9);
-  s[0] = t | 27;
-  for (let i = 7; i >= 0; i--)
-    s[1 + i] = Number(n >> BigInt((7 - i) * 8)) & 255;
-  return s;
-}
-function F(...r) {
-  const e = r.reduce((s, i) => s + i.length, 0), t = new Uint8Array(e);
-  let n = 0;
-  for (const s of r)
-    t.set(s, n), n += s.length;
-  return t;
-}
-function $(r) {
-  const t = [S(4, r.length)];
-  for (const n of r)
-    t.push(S(0, n));
-  return F(...t);
-}
-function oe(r, e, t) {
-  if (!Number.isSafeInteger(t) || t < 0)
-    throw new Error(
-      `encodeServerIdentityPayload: expires_at must be a non-negative safe integer, got ${t}`
-    );
-  const n = S(4, 3), s = $(r), i = $(e), o = S(0, t);
-  return F(n, s, i, o);
-}
-const ae = new TextEncoder().encode(
-  "btc-auth.server-identity.v1"
-), ce = 2 * 3600;
-class p extends Error {
-  constructor(e, t) {
-    super(e), this.reason = t, this.name = "ServerIdentityError";
-  }
-}
-function m(r) {
-  const e = new Uint8Array(r.length / 2);
-  for (let t = 0; t < e.length; t++)
-    e[t] = parseInt(r.slice(t * 2, t * 2 + 2), 16);
-  return e;
-}
-function ue(r) {
-  const { proof: e, pinnedServerPubkey: t, now: n } = r, s = r.maxLifetimeSecs ?? ce, i = x(t).toLowerCase();
-  if (i.length !== A || !f.test(i))
-    throw new p(
-      `pinnedServerPubkey must be 32-byte hex; got ${i.length} chars`,
-      "invalid_pubkey_encoding"
-    );
-  const o = x(e.server_pubkey).toLowerCase();
-  if (o.length !== A || !f.test(o))
-    throw new p(
-      `server_pubkey must be 32-byte hex; got ${o.length} chars`,
-      "invalid_pubkey_encoding"
-    );
-  if (o !== i)
-    throw new p(
-      `server_pubkey does not match pinned value: expected ${i}, got ${o}`,
-      "pinned_pubkey_mismatch"
-    );
-  if (!Number.isSafeInteger(e.expires_at))
-    throw new p(
-      `expires_at must be a finite integer; got ${JSON.stringify(e.expires_at)}`,
-      "invalid_expires_at"
-    );
-  if (!Number.isSafeInteger(n))
-    throw new p(
-      `now must be a finite integer; got ${JSON.stringify(n)}`,
-      "invalid_expires_at"
-    );
-  if (e.expires_at <= n)
-    throw new p(
-      `server identity proof expired at ${e.expires_at}, now ${n}`,
-      "expired"
-    );
-  if (!Number.isSafeInteger(s) || s <= 0)
-    throw new p(
-      `maxLifetimeSecs must be a positive safe integer; got ${JSON.stringify(s)}`,
-      "invalid_max_lifetime"
-    );
-  if (e.expires_at - n > s)
-    throw new p(
-      `server identity proof expires too far in the future: expires_at=${e.expires_at}, now=${n}, max lifetime=${s}s`,
-      "expires_too_far"
-    );
-  const c = x(e.ephemeral_pubkey).toLowerCase();
-  if (c.length !== V || !f.test(c))
-    throw new p(
-      `ephemeral_pubkey must be 33-byte compressed hex; got ${c.length} chars`,
-      "invalid_ephemeral_pubkey"
-    );
-  const y = c.slice(0, 2);
-  if (y !== "02" && y !== "03")
-    throw new p(
-      `ephemeral_pubkey must be compressed (prefix 02/03); got ${y}`,
-      "invalid_ephemeral_pubkey"
-    );
-  const l = m(c);
-  if (!J.isPoint(l))
-    throw new p(
-      "ephemeral_pubkey is not a valid secp256k1 point",
-      "invalid_ephemeral_pubkey"
-    );
-  const h = x(e.signature).toLowerCase();
-  if (h.length !== ee || !f.test(h))
-    throw new p(
-      `signature must be 64-byte Schnorr hex; got ${h.length} chars`,
-      "invalid_signature_encoding"
-    );
-  const _ = oe(
-    ae,
-    m(c),
-    e.expires_at
-  );
-  if (!ie(
-    _,
-    m(o),
-    m(h)
-  ))
-    throw new p(
-      "BIP-322 signature verification failed — ephemeral key is not attested by pinned server pubkey",
-      "signature_verification_failed"
-    );
-}
-const de = /* @__PURE__ */ new Set([
-  "vaultProvider_submitDepositorWotsKey",
-  "vaultProvider_submitDepositorPresignatures",
-  "vaultProvider_requestDepositorPresignTransactions"
-]), he = /* @__PURE__ */ new Set([
-  "vaultProvider_requestDepositorClaimerArtifacts"
-]), le = 6e4, P = "auth_createDepositorToken", O = "auth_createDepositorTokenGrpc";
-function j(r, e) {
-  return new ne({
-    baseUrl: r,
-    timeout: le,
-    headers: e,
-    retryableFor: (t) => t === P || t === O
-  });
-}
-const pe = 0, ye = 1, E = 2, ge = 3, _e = 4, fe = 5, xe = 6, we = 7, M = 24, be = 28, me = 20, Ae = 21, Se = 22, N = 256;
-class g extends Error {
-  constructor(e) {
-    super(`CBOR decode: ${e}`), this.name = "CborDecodeError";
-  }
-}
-class W {
-  constructor(e) {
-    d(this, "buf");
-    /** Current read offset. Public so callers can slice encoded sub-ranges. */
-    d(this, "pos", 0);
-    this.buf = e;
-  }
-  nextByte() {
-    if (this.pos >= this.buf.length)
-      throw new g("unexpected end of input");
-    return this.buf[this.pos++];
-  }
-  /**
-   * Read an initial byte and its argument. Rejects indefinite-length
-   * and reserved additional-info encodings. Arguments wider than
-   * {@link Number.MAX_SAFE_INTEGER} are rejected — none of the token's
-   * lengths, tags, or timestamps approach that bound.
-   */
-  readHead() {
-    const e = this.nextByte(), t = e >> 5, n = e & 31;
-    if (n < M)
-      return { major: t, arg: n };
-    if (n >= be)
-      throw new g(
-        `unsupported additional info ${n} (indefinite-length or reserved)`
-      );
-    const s = 1 << n - M;
-    let i = 0n;
-    for (let o = 0; o < s; o++)
-      i = i << 8n | BigInt(this.nextByte());
-    if (i > BigInt(Number.MAX_SAFE_INTEGER))
-      throw new g(`argument ${i} exceeds safe integer range`);
-    return { major: t, arg: Number(i) };
-  }
-  /** Read `length` raw bytes as a sub-array view into the backing buffer. */
-  readBytes(e) {
-    if (this.pos + e > this.buf.length)
-      throw new g("length overruns end of input");
-    const t = this.buf.subarray(this.pos, this.pos + e);
-    return this.pos += e, t;
-  }
-  /**
-   * Read a byte string (major type 2), returning its content bytes.
-   * Throws if the next item is not a byte string.
-   */
-  readByteString() {
-    const e = this.readHead();
-    if (e.major !== E)
-      throw new g(
-        `expected byte string (major ${E}), got major ${e.major}`
-      );
-    return this.readBytes(e.arg);
-  }
-  /**
-   * Read the next complete data item as a decoded {@link CborValue}.
-   *
-   * `depth` tracks the current nesting level so a deeply-nested blob is
-   * rejected with a {@link CborDecodeError} rather than overflowing the
-   * native call stack (see {@link MAX_NESTING_DEPTH}).
-   */
-  readValue(e = 0) {
-    if (e > N)
-      throw new g(
-        `nesting exceeds maximum depth ${N}`
-      );
-    const t = this.readHead();
-    switch (t.major) {
-      case pe:
-        return t.arg;
-      case ye:
-        return -1 - t.arg;
-      case E:
-        return this.readBytes(t.arg);
-      case ge:
-        return new TextDecoder("utf-8", { fatal: !0 }).decode(
-          this.readBytes(t.arg)
-        );
-      case _e: {
-        const n = [];
-        for (let s = 0; s < t.arg; s++)
-          n.push(this.readValue(e + 1));
-        return n;
-      }
-      case fe: {
-        const n = /* @__PURE__ */ new Map();
-        for (let s = 0; s < t.arg; s++) {
-          const i = this.readValue(e + 1), o = this.readValue(e + 1);
-          n.set(i, o);
-        }
-        return n;
-      }
-      case xe:
-        return { tag: t.arg, value: this.readValue(e + 1) };
-      case we:
-        if (t.arg === me) return !1;
-        if (t.arg === Ae) return !0;
-        if (t.arg === Se) return null;
-        throw new g(
-          `unsupported simple/float value ${t.arg}`
-        );
-      default:
-        throw new g(`unsupported major type ${t.major}`);
-    }
-  }
-}
-function K(r) {
-  const e = new W(r), t = e.readValue();
-  if (e.pos !== r.length)
-    throw new g("trailing bytes after top-level item");
-  return t;
-}
-const ke = "vaultd-jsonrpc", ve = "vaultd-grpc", B = 18, I = 4, H = -47, Ee = 1, G = 64, Te = 128, Ce = 96, Pe = 64, Oe = 1, Ie = 2, Re = 3, $e = 4, Me = 5, Ne = 6, Be = 7, L = new TextEncoder().encode("Signature1");
-class a extends Error {
-  constructor(e, t) {
-    super(e), this.reason = t, this.name = "CwtVerificationError";
-  }
-}
-function He(r) {
-  const e = U(
-    r.expectedIssuerXOnlyPubkey,
-    "expectedIssuerXOnlyPubkey"
-  ), t = U(
-    r.expectedAudienceXOnlyPubkey,
-    "expectedAudienceXOnlyPubkey"
-  ), n = De(r.ephemeralPubkeyHex), s = Ve(r.token), i = new W(s), o = i.readHead();
-  if (o.major !== 6 || o.arg !== B)
-    throw new a(
-      `token is not a COSE Sign1 tagged value (tag ${B})`,
-      "invalid_token_structure"
-    );
-  const c = i.readHead();
-  if (c.major !== 4 || c.arg !== I)
-    throw new a(
-      `COSE Sign1 must be a ${I}-element array`,
-      "invalid_token_structure"
-    );
-  const y = i.pos, l = i.readByteString(), h = s.subarray(y, i.pos);
-  i.readValue();
-  const _ = i.pos, w = i.readByteString(), k = s.subarray(_, i.pos), v = i.readByteString();
-  if (v.length !== G)
-    throw new a(
-      `COSE signature must be ${G} bytes, got ${v.length}`,
-      "invalid_token_structure"
-    );
-  if (i.pos !== s.length)
-    throw new a(
-      "COSE Sign1 token has trailing bytes after the signature",
-      "invalid_token_structure"
-    );
-  const R = Ge(l);
-  if (R !== H)
-    throw new a(
-      `unexpected COSE algorithm ${R} (expected ES256K ${H})`,
-      "unexpected_algorithm"
-    );
-  const q = Le(h, k), z = se(q);
-  if (!J.verify(z, n, v, !0))
-    throw new a(
-      "COSE signature does not verify against the server's ephemeral key",
-      "signature_verification_failed"
-    );
-  const u = Ue(w), b = u.audience.toLowerCase();
-  if (b.length !== A || !f.test(b))
-    throw new a(
-      "token `aud` is not a 32-byte x-only pubkey hex",
-      "invalid_claims"
-    );
-  if (u.issuedAt > u.expiresAt)
-    throw new a(
-      `token iat (${u.issuedAt}) is after exp (${u.expiresAt})`,
-      "invalid_claims"
-    );
-  if (u.issuer.toLowerCase() !== e)
-    throw new a(
-      `token issuer does not match pinned server pubkey: expected ${e}, got ${u.issuer.toLowerCase()}`,
-      "issuer_mismatch"
-    );
-  if (u.subject !== r.expectedSubject)
-    throw new a(
-      `token subject mismatch: expected ${r.expectedSubject}, got ${u.subject}`,
-      "subject_mismatch"
-    );
-  if (b !== t)
-    throw new a(
-      `token audience does not match depositor pubkey: expected ${t}, got ${b}`,
-      "audience_mismatch"
-    );
-  if (u.expiresAt <= r.now)
-    throw new a(
-      `token expired: exp ${u.expiresAt} <= now ${r.now}`,
-      "token_expired"
-    );
-  if (r.responseExpiresAt !== u.expiresAt)
-    throw new a(
-      `response expires_at (${r.responseExpiresAt}) does not equal token exp (${u.expiresAt})`,
-      "expiry_mismatch"
-    );
-  if (r.serverIdentityExpiresAt < u.expiresAt)
-    throw new a(
-      `server identity expires (${r.serverIdentityExpiresAt}) before token exp (${u.expiresAt})`,
-      "server_identity_expires_before_token"
-    );
-  return {
-    issuer: u.issuer,
-    subject: u.subject,
-    audience: b,
-    expiresAt: u.expiresAt,
-    notBefore: u.notBefore,
-    issuedAt: u.issuedAt
-  };
-}
-function Ge(r) {
-  if (r.length === 0)
-    throw new a(
-      "empty COSE protected header (no algorithm)",
-      "unexpected_algorithm"
-    );
-  const e = K(r);
-  if (!(e instanceof Map))
-    throw new a(
-      "COSE protected header is not a map",
-      "invalid_token_structure"
-    );
-  const t = e.get(Ee);
-  if (typeof t != "number")
-    throw new a(
-      "COSE protected header missing integer algorithm label",
-      "unexpected_algorithm"
-    );
-  return t;
-}
-function Le(r, e) {
-  return Fe(
-    Uint8Array.of(Te | I),
-    Uint8Array.of(Ce | L.length),
-    L,
-    r,
-    Uint8Array.of(Pe),
-    e
-  );
-}
-function Ue(r) {
-  const e = K(r);
-  if (!(e instanceof Map))
-    throw new a(
-      "CWT claims root is not a map",
-      "invalid_claims"
-    );
-  if (Xe(e, Be, "cti").length === 0)
-    throw new a("token cti is empty", "invalid_claims");
-  return {
-    issuer: T(e, Oe, "iss"),
-    subject: T(e, Ie, "sub"),
-    audience: T(e, Re, "aud"),
-    expiresAt: C(e, $e, "exp"),
-    notBefore: C(e, Me, "nbf"),
-    issuedAt: C(e, Ne, "iat")
-  };
-}
-function T(r, e, t) {
-  const n = r.get(e);
-  if (typeof n != "string")
-    throw new a(
-      `token claim ${t} is missing or not a text string`,
-      "invalid_claims"
-    );
-  return n;
-}
-function Xe(r, e, t) {
-  const n = r.get(e);
-  if (!(n instanceof Uint8Array))
-    throw new a(
-      `token claim ${t} is missing or not a byte string`,
-      "invalid_claims"
-    );
-  return n;
-}
-function C(r, e, t) {
-  const n = r.get(e);
-  if (typeof n != "number" || !Number.isSafeInteger(n) || n < 0)
-    throw new a(
-      `token claim ${t} is missing or not a non-negative integer timestamp`,
-      "invalid_claims"
-    );
-  return n;
-}
-function U(r, e) {
-  const t = x(r).toLowerCase();
-  if (t.length !== A || !f.test(t))
-    throw new a(
-      `${e} must be 32-byte x-only hex; got ${t.length} chars`,
-      "invalid_input"
-    );
-  return t;
-}
-function De(r) {
-  const e = x(r).toLowerCase(), t = e.slice(0, 2);
-  if (e.length !== V || !f.test(e) || t !== "02" && t !== "03")
-    throw new a(
-      "ephemeralPubkeyHex must be 33-byte compressed pubkey hex (prefix 02/03)",
-      "invalid_input"
-    );
-  return te(e);
-}
-const Je = (() => {
-  const r = new Int16Array(128).fill(-1), e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-  for (let t = 0; t < e.length; t++)
-    r[e.charCodeAt(t)] = t;
-  return r;
-})();
-function Ve(r) {
-  const e = r.length, t = Math.floor(e / 4), n = e % 4;
-  if (n === 1)
-    throw new a(
-      "invalid base64url length",
-      "invalid_token_structure"
-    );
-  const s = t * 3 + (n === 0 ? 0 : n - 1), i = new Uint8Array(s), o = (l) => {
-    const h = l < 128 ? Je[l] : -1;
-    if (h < 0)
-      throw new a(
-        "invalid base64url character",
-        "invalid_token_structure"
-      );
-    return h;
-  };
-  let c = 0, y = 0;
-  for (let l = 0; l < t; l++) {
-    const h = o(r.charCodeAt(c++)), _ = o(r.charCodeAt(c++)), w = o(r.charCodeAt(c++)), k = o(r.charCodeAt(c++));
-    i[y++] = h << 2 | _ >> 4, i[y++] = (_ & 15) << 4 | w >> 2, i[y++] = (w & 3) << 6 | k;
-  }
-  if (n === 2) {
-    const l = o(r.charCodeAt(c++)), h = o(r.charCodeAt(c++));
-    i[y++] = l << 2 | h >> 4;
-  } else if (n === 3) {
-    const l = o(r.charCodeAt(c++)), h = o(r.charCodeAt(c++)), _ = o(r.charCodeAt(c++));
-    i[y++] = l << 2 | h >> 4, i[y++] = (h & 15) << 4 | _ >> 2;
-  }
-  return i;
-}
-function Fe(...r) {
-  const e = r.reduce((s, i) => s + i.length, 0), t = new Uint8Array(e);
-  let n = 0;
-  for (const s of r)
-    t.set(s, n), n += s.length;
-  return t;
-}
-const X = 4102444800, je = 30;
-class We {
-  constructor(e) {
-    // `client` is the only mutable field — see `setClient`. The
-    // identity-bearing fields (peginTxid/authAnchorHex/pinnedServerPubkey)
-    // remain readonly and are checked against re-registration in the
-    // registry's `getOrCreate`.
-    d(this, "client");
-    d(this, "peginTxid");
-    d(this, "authAnchorHex");
-    d(this, "pinnedServerPubkey");
-    d(this, "expectedAudienceXOnlyPubkey");
-    d(this, "authGatedMethods");
-    d(this, "grpcGatedMethods");
-    d(this, "refreshSkewSecs");
-    d(this, "now");
-    /** Cached JSON-RPC-subject bearer (auth_createDepositorToken). */
-    d(this, "cachedJsonRpc", null);
-    d(this, "inFlightJsonRpc", null);
-    /** Cached gRPC-subject bearer (auth_createDepositorTokenGrpc). */
-    d(this, "cachedGrpc", null);
-    d(this, "inFlightGrpc", null);
-    this.client = e.client, this.peginTxid = e.peginTxid, this.authAnchorHex = e.authAnchorHex, this.pinnedServerPubkey = e.pinnedServerPubkey, this.expectedAudienceXOnlyPubkey = e.expectedAudienceXOnlyPubkey, this.authGatedMethods = e.authGatedMethods, this.grpcGatedMethods = e.grpcGatedMethods, this.refreshSkewSecs = e.refreshSkewSecs ?? je, this.now = e.now ?? (() => Math.floor(Date.now() / 1e3));
-  }
-  /**
-   * Return a bearer token for `method`, or `null` if `method` is not
-   * auth-gated.
-   *
-   * Routes by subject: `authGatedMethods` → JSON-RPC bearer (issued via
-   * `auth_createDepositorToken`); `grpcGatedMethods` → gRPC bearer
-   * (`auth_createDepositorTokenGrpc`). Either path acquires lazily and
-   * single-flights concurrent callers; the two cache slots are
-   * independent.
-   *
-   * Both token-issuing methods are hard-exempted from the gate — if
-   * either were ever included in the gated sets (caller misconfiguration)
-   * the provider would recurse into `acquireSingleFlight` from inside the
-   * JSON-RPC header builder before `inFlight` is assigned, defeating the
-   * single-flight guard. Returning `null` here breaks that recursion
-   * deterministically.
-   */
-  async getToken(e) {
-    return e === P || e === O ? null : this.grpcGatedMethods.has(e) ? this.getTokenForSubject("grpc") : this.authGatedMethods.has(e) ? this.getTokenForSubject("jsonrpc") : null;
-  }
-  /**
-   * Drop both cached tokens. Next `getToken` call re-acquires the slot
-   * that's actually needed. Called by `JsonRpcClient` on wire
-   * `auth_expired` responses; the client doesn't tell us which subject
-   * expired, so we evict both to stay correct under either.
-   *
-   * Worst case is one extra round-trip on the slot that was still fresh,
-   * which is cheaper than carrying a `Subject` argument through
-   * `BearerTokenProvider`.
-   */
-  invalidate() {
-    this.cachedJsonRpc = null, this.cachedGrpc = null;
-  }
-  async getTokenForSubject(e) {
-    const t = e === "grpc" ? this.cachedGrpc : this.cachedJsonRpc;
-    return t && this.now() + this.refreshSkewSecs < t.expiresAt ? t.token : (await this.acquireSingleFlight(e)).token;
-  }
-  /**
-   * Swap in a different transport for subsequent token-issuing calls.
-   * Used by the registry when a later caller registers the same
-   * `peginTxid` against a different `baseUrl` — the cached token
-   * (bound to identity, not transport) stays valid, but future
-   * refreshes hit the new URL. An in-flight acquire keeps using the
-   * old client (it captured the reference); next call uses the new.
-   */
-  setClient(e) {
-    this.client = e;
-  }
-  acquireSingleFlight(e) {
-    const t = e === "grpc" ? this.inFlightGrpc : this.inFlightJsonRpc;
-    if (t) return t;
-    const n = e === "grpc" ? O : P, s = (async () => {
-      try {
-        const i = await this.client.call(n, {
-          pegin_txid: this.peginTxid,
-          auth_anchor: this.authAnchorHex
-        });
-        if (ue({
-          proof: i.server_identity,
-          pinnedServerPubkey: this.pinnedServerPubkey,
-          now: this.now()
-        }), typeof i.token != "string" || i.token.length === 0)
-          throw new Error(
-            `VpTokenProvider: invalid token in acquire response (expected non-empty string, got ${typeof i.token})`
-          );
-        const o = this.now();
-        if (!Number.isSafeInteger(i.expires_at) || i.expires_at <= o || i.expires_at > X)
-          throw new Error(
-            `VpTokenProvider: invalid expires_at in acquire response (got ${JSON.stringify(i.expires_at)}; must be a safe integer in (${o}, ${X}])`
-          );
-        He({
-          token: i.token,
-          ephemeralPubkeyHex: i.server_identity.ephemeral_pubkey,
-          expectedIssuerXOnlyPubkey: this.pinnedServerPubkey,
-          expectedSubject: e === "grpc" ? ve : ke,
-          expectedAudienceXOnlyPubkey: this.expectedAudienceXOnlyPubkey,
-          responseExpiresAt: i.expires_at,
-          serverIdentityExpiresAt: i.server_identity.expires_at,
-          now: o
-        });
-        const c = {
-          token: i.token,
-          expiresAt: i.expires_at
-        };
-        return e === "grpc" ? this.cachedGrpc = c : this.cachedJsonRpc = c, c;
-      } finally {
-        e === "grpc" ? this.inFlightGrpc = null : this.inFlightJsonRpc = null;
-      }
-    })();
-    return e === "grpc" ? this.inFlightGrpc = s : this.inFlightJsonRpc = s, s;
-  }
-}
-class Ke {
-  constructor() {
-    d(this, "entries", /* @__PURE__ */ new Map());
-  }
-  /**
-   * Return the cached `VpTokenProvider` for `peginTxid` if one exists
-   * with matching `authAnchorHex` and `pinnedServerPubkey`, otherwise
-   * construct and cache a fresh provider. A mismatch on either throws —
-   * silent overwrite would mask derivation drift or VP pubkey rotation.
-   */
-  getOrCreate(e) {
-    const t = this.entries.get(e.peginTxid);
-    if (t) {
-      if (t.authAnchorHex !== e.authAnchorHex)
-        throw new Error(
-          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to authAnchorHex ${t.authAnchorHex.slice(0, 8)}…; got ${e.authAnchorHex.slice(0, 8)}…`
-        );
-      if (t.pinnedServerPubkey !== e.pinnedServerPubkey)
-        throw new Error(
-          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to pinnedServerPubkey ${t.pinnedServerPubkey.slice(0, 8)}…; got ${e.pinnedServerPubkey.slice(0, 8)}…`
-        );
-      if (t.expectedAudienceXOnlyPubkey !== e.expectedAudienceXOnlyPubkey)
-        throw new Error(
-          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to expectedAudienceXOnlyPubkey ${t.expectedAudienceXOnlyPubkey.slice(0, 8)}…; got ${e.expectedAudienceXOnlyPubkey.slice(0, 8)}…`
-        );
-      return t.provider.setClient(e.client), t.provider;
-    }
-    const n = new We({
-      client: e.client,
-      peginTxid: e.peginTxid,
-      authAnchorHex: e.authAnchorHex,
-      pinnedServerPubkey: e.pinnedServerPubkey,
-      expectedAudienceXOnlyPubkey: e.expectedAudienceXOnlyPubkey,
-      authGatedMethods: de,
-      grpcGatedMethods: he
-    });
-    return this.entries.set(e.peginTxid, {
-      provider: n,
-      authAnchorHex: e.authAnchorHex,
-      pinnedServerPubkey: e.pinnedServerPubkey,
-      expectedAudienceXOnlyPubkey: e.expectedAudienceXOnlyPubkey
-    }), n;
-  }
-  /** Return the cached provider, or `undefined` if none. */
-  peek(e) {
-    var t;
-    return (t = this.entries.get(e)) == null ? void 0 : t.provider;
-  }
-  /**
-   * Evict the entry for `peginTxid`. Idempotent. Called on terminal
-   * paths — activation success, user-cancel, or component unmount —
-   * so `authAnchorHex` doesn't outlive the deposit session.
-   */
-  release(e) {
-    this.entries.delete(e);
-  }
-  /**
-   * Wipe every cached entry. Test-only escape hatch — not exposed on
-   * the public {@link VpTokenRegistryPublic} singleton type.
-   *
-   * @internal
-   */
-  clear() {
-    this.entries.clear();
-  }
-  get size() {
-    return this.entries.size;
-  }
-}
-const Y = new Ke();
-function rt(r) {
-  var n;
-  const e = j(
-    r.baseUrl,
-    (n = r.options) == null ? void 0 : n.headers
-  ), t = Y.getOrCreate({
-    client: e,
-    peginTxid: r.peginTxid,
-    authAnchorHex: r.authAnchorHex,
-    pinnedServerPubkey: r.pinnedServerPubkey,
-    expectedAudienceXOnlyPubkey: D(
-      r.depositorBtcPubkey
-    )
-  });
-  return new re(r.baseUrl, {
-    ...r.options,
-    tokenProvider: t
-  });
-}
-function nt(r) {
-  Y.getOrCreate({
-    client: j(r.baseUrl, r.headers),
-    peginTxid: r.peginTxid,
-    authAnchorHex: r.authAnchorHex,
-    pinnedServerPubkey: r.pinnedServerPubkey,
-    expectedAudienceXOnlyPubkey: D(
-      r.depositorBtcPubkey
-    )
-  });
-}
-export {
-  p as S,
-  Ke as V,
-  Y as a,
-  rt as c,
-  nt as p,
-  ue as v
-};
-//# sourceMappingURL=primeVpAuth-PiUJksAq.js.map