@babylonlabs-io/ts-sdk 3.0.2 → 3.1.0

package/dist/{verifyScriptPathSchnorrSignature-BKZihCjk.cjs → verifyScriptPathSchnorrSignature-D2t1yACC.cjs}

@@ -1,2 +1,2 @@
-"use strict";const l=require("bitcoinjs-lib"),v=require("./tbv/core/wasm/index.cjs"),k=require("./fundPeginTransaction-54-Rwb2k.cjs"),c=require("./bitcoin-D-O2GjbC.cjs"),ae=require("./secp256k1-DDHQ1_za.cjs"),a=require("buffer"),h=require("./constants-BTZdyOuk.cjs"),le=require("@bitcoin-js/tiny-secp256k1-asmjs"),U=require("./validation-C6XTfZak.cjs");function Pe(e){const t=Object.create(null,{[Symbol.toStringTag]:{value:"Module"}});if(e){for(const r in e)if(r!=="default"){const o=Object.getOwnPropertyDescriptor(e,r);Object.defineProperty(t,r,o.get?o:{enumerable:!0,get:()=>e[r]})}}return t.default=e,Object.freeze(t)}const ee=Pe(le);function m(e){return c.processPublicKeyToXOnly(e).toLowerCase()}function pe(e,t,r){const o=new Set;o.add(m(e));for(const i of t)o.add(m(i));return o.delete(m(r)),o.size}function te(e){const t=m(e.claimerBtcPubkey),r=m(e.depositorBtcPubkey),o=e.vaultKeeperBtcPubkeys.map(m);if(t===r){const n=o.filter(u=>u!==r);if(n.length===0)throw new Error("Cannot derive localChallengers: vault keeper set is empty (or contains only the depositor)");if(new Set(n).size!==n.length)throw new Error("Cannot derive localChallengers: duplicate vaultKeeper key — signing context is misconfigured");return n}const s=[...new Set([m(e.vaultProviderBtcPubkey),...o])].sort().filter(n=>n!==t);if(s.length===0)throw new Error(`Cannot derive localChallengers: no vault provider or vault keeper remains after excluding claimer ${t}`);return s}const he=32,fe=65535,de=2;function I(e,t){const r=c.stripHexPrefix(e).toLowerCase();if(!/^[0-9a-f]{64}$/.test(r))throw new Error(`${t} must be a 32-byte x-only public key.`);try{ae.secp256k1.Point.fromBytes(a.Buffer.concat([a.Buffer.from([de]),a.Buffer.from(r,"hex")]))}catch{throw new Error(`${t} is not a secp256k1 x-coordinate.`)}return r}function O(e,t){if(e.length===0)throw new Error(`${t} must not be empty.`);const r=e.map((o,i)=>I(o,`${t}[${i}]`)).sort();if(new Set(r).size!==r.length)throw new Error(`${t} must not contain duplicate keys.`);return r}function R(e,t){const r=[];return e.forEach((o,i)=>{r.push(a.Buffer.from(o,"hex"),i===0?l.opcodes.OP_CHECKSIG:l.opcodes.OP_CHECKSIGADD)}),r.push(l.script.number.encode(e.length),t?l.opcodes.OP_NUMEQUALVERIFY:l.opcodes.OP_NUMEQUAL),r}function re(e,t){var w;c.assertEccInitialized();const r=I(e.depositorPubkey,"depositorPubkey"),o=I(e.vaultProviderPubkey,"vaultProviderPubkey"),i=O(e.vaultKeeperPubkeys,"vaultKeeperPubkeys"),s=O(e.universalChallengerPubkeys,"universalChallengerPubkeys"),n=c.stripHexPrefix(t).toLowerCase();if(!/^[0-9a-f]{64}$/.test(n))throw new Error("hashlock must be 32 bytes.");if(!Number.isInteger(e.timelockRefund)||e.timelockRefund<1||e.timelockRefund>fe)throw new Error("timelockRefund must be an integer from 1 to 65535.");const u=l.script.compile([l.opcodes.OP_SIZE,l.script.number.encode(he),l.opcodes.OP_EQUALVERIFY,l.opcodes.OP_SHA256,a.Buffer.from(n,"hex"),l.opcodes.OP_EQUALVERIFY,a.Buffer.from(r,"hex"),l.opcodes.OP_CHECKSIGVERIFY,a.Buffer.from(o,"hex"),l.opcodes.OP_CHECKSIGVERIFY,...R(i,!0),...R(s,!1)]),f=l.script.compile([a.Buffer.from(r,"hex"),l.opcodes.OP_CHECKSIGVERIFY,l.script.number.encode(e.timelockRefund),l.opcodes.OP_CHECKSEQUENCEVERIFY]),p=[{output:u,version:c.TAPSCRIPT_LEAF_VERSION},{output:f,version:c.TAPSCRIPT_LEAF_VERSION}],{hash:d,output:P,witness:E}=l.payments.p2tr({internalPubkey:a.Buffer.from(v.tapInternalPubkey),scriptTree:p,redeem:{output:u,redeemVersion:c.TAPSCRIPT_LEAF_VERSION}}),g=E==null?void 0:E[E.length-1],S=l.payments.p2tr({internalPubkey:a.Buffer.from(v.tapInternalPubkey),scriptTree:p,redeem:{output:f,redeemVersion:c.TAPSCRIPT_LEAF_VERSION}}),y=(w=S.witness)==null?void 0:w[S.witness.length-1];if(!d||!P||!g||!y)throw new Error("Failed to derive the expected Pre-PegIn HTLC output.");return{hashlockScript:u,hashlockControlBlock:g,refundScript:f,refundControlBlock:y,scriptPubKey:P,tapMerkleRoot:d}}function ge(e,t){c.assertEccInitialized();const r=I(e.depositorPubkey,"depositorPubkey"),o=I(e.vaultProviderPubkey,"vaultProviderPubkey"),i=O(e.vaultKeeperPubkeys,"vaultKeeperPubkeys"),s=O(e.universalChallengerPubkeys,"universalChallengerPubkeys"),n=l.script.compile([a.Buffer.from(r,"hex"),l.opcodes.OP_CHECKSIGVERIFY,a.Buffer.from(o,"hex"),l.opcodes.OP_CHECKSIGVERIFY,...R(i,!0),...R(s,!0),l.script.number.encode(t),l.opcodes.OP_CHECKSEQUENCEVERIFY]),{output:u}=l.payments.p2tr({internalPubkey:a.Buffer.from(v.tapInternalPubkey),scriptTree:{output:n,version:c.TAPSCRIPT_LEAF_VERSION}});if(!u)throw new Error("Failed to derive the expected PegIn payout output.");return u}async function Ee(e,t){const r=t.pegInAmounts.length;if(t.hashlocks.length!==r)throw new Error(`Pre-PegIn has ${t.hashlocks.length} hashlock(s), expected ${r} (one per requested deposit).`);if(e.htlcValues.length!==r)throw new Error(`WASM Pre-PegIn returned ${e.htlcValues.length} HTLC value(s), expected ${r} (one per requested deposit).`);if(e.peginAmounts.length!==r||e.htlcScriptPubKeys.length!==r||e.htlcAddresses.length!==r)throw new Error(`WASM Pre-PegIn returned mismatched array lengths (htlcValues=${e.htlcValues.length}, peginAmounts=${e.peginAmounts.length}, htlcScriptPubKeys=${e.htlcScriptPubKeys.length}, htlcAddresses=${e.htlcAddresses.length}); expected ${r} each.`);if(e.depositorClaimValue<=0n)throw new Error(`WASM Pre-PegIn returned non-positive depositorClaimValue ${e.depositorClaimValue}; expected > 0.`);const o=await v.computeMinClaimValue(t.vaultCoreVersion,t.numLocalChallengers,t.universalChallengerPubkeys.length,t.councilQuorum,t.councilSize,t.feeRate);if(e.depositorClaimValue!==o)throw new Error(`WASM Pre-PegIn depositorClaimValue ${e.depositorClaimValue} does not match the independently computed minimum claim value ${o} (vaultCoreVersion=${t.vaultCoreVersion}, numLocalChallengers=${t.numLocalChallengers}, numUniversalChallengers=${t.universalChallengerPubkeys.length}, councilQuorum=${t.councilQuorum}, councilSize=${t.councilSize}, feeRate=${t.feeRate}).`);const i=await v.peginP2aAnchorOutput(t.vaultCoreVersion),s=(i==null?void 0:i.value)??0n,n=await v.computeMinPeginFee(t.vaultCoreVersion,t.vaultKeeperPubkeys.length,t.universalChallengerPubkeys.length,t.minPeginFeeRate),u=n+s,f=t.minPeginFeeRate*k.MAX_REASONABLE_PEGIN_VBYTES;for(let p=0;p<r;p++){const d=t.pegInAmounts[p],P=e.peginAmounts[p],E=e.htlcValues[p];if(P!==d)throw new Error(`WASM Pre-PegIn peginAmount[${p}] ${P} does not match the requested amount ${d}; refusing to build a tx whose recorded amount differs from the depositor's request.`);if(P<=0n)throw new Error(`WASM Pre-PegIn peginAmount[${p}] is non-positive (${P}); expected > 0.`);if(E<=0n)throw new Error(`WASM Pre-PegIn htlcValue[${p}] is non-positive (${E}); expected > 0.`);const g=E-P-e.depositorClaimValue;if(g<=0n)throw new Error(`WASM Pre-PegIn htlcValue[${p}] ${E} does not strictly cover peginAmount ${P} + depositorClaimValue ${e.depositorClaimValue} + a PegIn reserve (implied reserve ${g}).`);if(g>f)throw new Error(`WASM Pre-PegIn implied reserve for HTLC[${p}] (${g} sat) exceeds the plausibility cap ${f} sat (minPeginFeeRate=${t.minPeginFeeRate} × ${k.MAX_REASONABLE_PEGIN_VBYTES} vbytes); htlcValue ${E} appears grossly inflated.`);if(g!==u)throw new Error(`WASM Pre-PegIn htlcValue[${p}] ${E} implies a PegIn fee+anchor reserve of ${g} sat, expected exactly ${u} sat (minPeginFee ${n} + p2aAnchor ${s} for vaultCoreVersion ${t.vaultCoreVersion}, vaultKeepers=${t.vaultKeeperPubkeys.length}, universalChallengers=${t.universalChallengerPubkeys.length}, minPeginFeeRate=${t.minPeginFeeRate}).`)}return n}class C extends Error{constructor(t){super(t),this.name="HtlcOutputMismatchError"}}function oe(e,t,r){if(e.length<t.length)throw new C(`Encoded Pre-PegIn tx has ${e.length} output(s), fewer than the ${t.length} HTLC output(s) the cross-check validated.`);for(let o=0;o<t.length;o++){const i=BigInt(e[o].value);if(i!==t[o])throw new C(`Encoded Pre-PegIn HTLC output[${o}] value ${i} does not match the cross-checked htlcValue ${t[o]}; the funded/signed tx would not pay the validated amount.`);const s=e[o].script.toString("hex").toLowerCase(),n=r[o].toLowerCase();if(s!==n)throw new C(`Encoded Pre-PegIn HTLC output[${o}] scriptPubKey ${s} does not match the cross-checked htlcScriptPubKey ${n}.`)}}function we(e,t,r,o,i,s,n){if(s!==h.PRE_PEGIN_TX_VERSION)throw new Error(`WASM Pre-PegIn transaction version ${s}; expected ${h.PRE_PEGIN_TX_VERSION}.`);if(n!==h.PRE_PEGIN_TX_LOCKTIME)throw new Error(`WASM Pre-PegIn transaction locktime ${n}; expected ${h.PRE_PEGIN_TX_LOCKTIME}.`);if(t.length<h.PRE_PEGIN_MIN_HTLC_OUTPUT_COUNT)throw new Error(`WASM Pre-PegIn output layout has ${t.length} HTLC output(s); expected at least ${h.PRE_PEGIN_MIN_HTLC_OUTPUT_COUNT}.`);const u=t.length,f=u+ +(i!==void 0),p=k.peginOutputCount(t.length,i!==void 0);if(e.length!==p)throw new Error(`WASM Pre-PegIn output layout has ${e.length} output(s); expected exactly ${p}.`);oe(e,t,r);for(let g=0;g<t.length;g++){const S=re(o,o.hashlocks[g]).scriptPubKey;if(!e[g].script.equals(S))throw new C(`Pre-PegIn HTLC output[${g}] does not match the independently derived scriptPubKey.`)}if(i!==void 0){const g=e[u];if(g.value!==h.PRE_PEGIN_AUTH_OUTPUT_VALUE_SATS)throw new Error(`WASM Pre-PegIn auth output[${u}] value ${g.value} sat; expected exactly ${h.PRE_PEGIN_AUTH_OUTPUT_VALUE_SATS} sat.`);const S=g.script.toString("hex").toLowerCase(),y=h.PRE_PEGIN_AUTH_SCRIPT_PREFIX+i.toLowerCase();if(S!==y)throw new Error(`WASM Pre-PegIn auth output[${u}] scriptPubKey ${S}; expected ${y}.`)}const d=e[f];if(d.value!==h.PRE_PEGIN_CPFP_VALUE_SATS)throw new Error(`WASM Pre-PegIn CPFP output[${f}] value ${d.value} sat; expected exactly ${h.PRE_PEGIN_CPFP_VALUE_SATS} sat.`);const P=d.script.toString("hex").toLowerCase(),E=c.stripHexPrefix(c.deriveBip86ScriptPubKeyHex(o.depositorPubkey)).toLowerCase();if(P!==E)throw new Error(`WASM Pre-PegIn CPFP output[${f}] scriptPubKey ${P}; expected depositor BIP-86 script ${E}.`)}const ne=1;function ie(e){const t=c.stripHexPrefix(e);if(!/^[0-9a-fA-F]{64}$/.test(t))throw new Error("Invalid depositor pubkey for the depositor-claim script: must be an x-only key of 64 hex characters (32 bytes).");const r=l.script.compile([a.Buffer.from(c.hexToUint8Array(t)),l.opcodes.OP_CHECKSIG]),o=a.Buffer.from(v.tapInternalPubkey),i={output:r,redeemVersion:c.TAPSCRIPT_LEAF_VERSION},{output:s,witness:n}=l.payments.p2tr({internalPubkey:o,scriptTree:{output:r},redeem:i});if(!s)throw new Error("Failed to derive the depositor-claim P2TR scriptPubKey for PegIn output validation");const u=n==null?void 0:n[n.length-1];if(!u)throw new Error("Failed to derive the depositor-claim tapleaf control block; refusing to build an unspendable input");return{scriptPubKey:s,leafScript:r,controlBlock:u,internalKey:o}}function se(e){return ie(e).scriptPubKey}const K=64,ye=/^[0-9a-fA-F]+$/,M=65535;async function ve(e){const t=H(e.authAnchorHash),r=await v.createPrePeginTransaction({txGraphVersion:e.vaultCoreVersion,depositorPubkey:e.depositorPubkey,vaultProviderPubkey:e.vaultProviderPubkey,vaultKeeperPubkeys:e.vaultKeeperPubkeys,universalChallengerPubkeys:e.universalChallengerPubkeys,hashlocks:[...e.hashlocks],timelockRefund:e.timelockRefund,pegInAmounts:[...e.pegInAmounts],feeRate:e.feeRate,minPeginFeeRate:e.minPeginFeeRate,numLocalChallengers:e.numLocalChallengers,councilQuorum:e.councilQuorum,councilSize:e.councilSize,network:e.network,authAnchorHash:t}),o=await Ee(r,e),i=k.parseUnfundedWasmTransaction(r.txHex);we(i.outputs,r.htlcValues,r.htlcScriptPubKeys,e,t,i.version,i.locktime);const s=i.outputs.reduce((u,f)=>u+BigInt(f.value),0n),n=t!==void 0?r.htlcValues.length:null;return{psbtHex:r.txHex,totalOutputValue:s,htlcValues:r.htlcValues,htlcScriptPubKeys:r.htlcScriptPubKeys,htlcAddresses:r.htlcAddresses,peginAmounts:r.peginAmounts,depositorClaimValue:r.depositorClaimValue,authAnchorVout:n,minPeginFee:o}}function H(e){if(e===void 0)return;const t=e.startsWith("0x")||e.startsWith("0X")?e.slice(2):e;if(t.length!==K||!ye.test(t))throw new Error(`authAnchorHash must be 32-byte hex (${K} chars, no 0x prefix); got length ${t.length}`);return t.toLowerCase()}async function Se(e){if(!Number.isInteger(e.timelockPegin)||e.timelockPegin<1||e.timelockPegin>M)throw new Error(`PegIn timelock ${e.timelockPegin} must be a whole number of blocks from 1 to ${M}.`);const t=await v.buildPeginTxFromPrePegin({txGraphVersion:e.prePeginParams.vaultCoreVersion,depositorPubkey:e.prePeginParams.depositorPubkey,vaultProviderPubkey:e.prePeginParams.vaultProviderPubkey,vaultKeeperPubkeys:e.prePeginParams.vaultKeeperPubkeys,universalChallengerPubkeys:e.prePeginParams.universalChallengerPubkeys,hashlocks:[...e.prePeginParams.hashlocks],timelockRefund:e.prePeginParams.timelockRefund,pegInAmounts:[...e.prePeginParams.pegInAmounts],feeRate:e.prePeginParams.feeRate,minPeginFeeRate:e.prePeginParams.minPeginFeeRate,numLocalChallengers:e.prePeginParams.numLocalChallengers,councilQuorum:e.prePeginParams.councilQuorum,councilSize:e.prePeginParams.councilSize,network:e.prePeginParams.network,authAnchorHash:H(e.prePeginParams.authAnchorHash)},e.timelockPegin,e.fundedPrePeginTxHex,e.htlcVout);return await _e(t,e),{txHex:t.txHex,txid:t.txid,vaultScriptPubKey:t.vaultScriptPubKey,vaultValue:t.vaultValue}}const xe=2;async function _e(e,t){const r=t.prePeginParams.vaultCoreVersion,o=r===1?h.PEGIN_TX_VERSION_CORE_1:r===2||r===3?h.PEGIN_TX_VERSION_CORE_2_AND_3:void 0;if(o===void 0)throw new Error(`Unsupported vaultCoreVersion ${r} for PegIn tx.`);await v.validatePeginP2aAnchor(r,e.txHex);const i=await v.peginP2aAnchorOutput(r),s=xe+(i?1:0),n=l.Transaction.fromHex(c.stripHexPrefix(e.txHex));if(n.version!==o)throw new Error(`PegIn tx version ${n.version} does not match vaultCoreVersion ${r}; expected ${o}.`);if(n.locktime!==h.PEGIN_TX_LOCKTIME)throw new Error(`PegIn tx locktime ${n.locktime} does not match the canonical locktime ${h.PEGIN_TX_LOCKTIME}.`);if(n.ins.length!==1)throw new Error(`PegIn tx has ${n.ins.length} input(s), expected exactly 1 (the Pre-PegIn HTLC outpoint).`);const u=l.Transaction.fromHex(c.stripHexPrefix(t.fundedPrePeginTxHex)).getId(),f=c.uint8ArrayToHex(new Uint8Array(n.ins[0].hash).slice().reverse());if(f!==u)throw new Error(`PegIn input spends txid ${f}, expected the funded Pre-PegIn ${u}.`);if(n.ins[0].index!==t.htlcVout)throw new Error(`PegIn input spends Pre-PegIn output ${n.ins[0].index}, expected the requested HTLC vout ${t.htlcVout}.`);if(n.ins[0].sequence!==h.PEGIN_INPUT_SEQUENCE)throw new Error(`PegIn input sequence ${n.ins[0].sequence} does not match the canonical sequence ${h.PEGIN_INPUT_SEQUENCE}.`);if(n.ins[0].script.length!==0)throw new Error("PegIn input scriptSig must be empty.");if(n.ins[0].witness.length!==0)throw new Error("PegIn input witness must be empty before signing.");if(n.outs.length!==s)throw new Error(`PegIn tx has ${n.outs.length} output(s), expected exactly ${s} for vaultCoreVersion ${r} (vault + depositor claim${i?" + P2A anchor":""}).`);const p=t.prePeginParams.pegInAmounts[t.htlcVout];if(e.vaultValue!==p)throw new Error(`PegIn vault output value ${e.vaultValue} does not match the requested peg-in amount ${p} for HTLC ${t.htlcVout}; refusing to sign a vault that locks a different amount than requested.`);const d=n.outs[0];if(BigInt(d.value)!==e.vaultValue)throw new Error(`Encoded PegIn vault output value ${d.value} does not match the WASM-reported vaultValue ${e.vaultValue}.`);const P=ge(t.prePeginParams,t.timelockPegin).toString("hex");if(c.stripHexPrefix(e.vaultScriptPubKey).toLowerCase()!==P)throw new Error(`WASM-reported PegIn vaultScriptPubKey ${e.vaultScriptPubKey} does not match the independently derived payout scriptPubKey ${P}.`);const E=d.script.toString("hex");if(E!==P)throw new Error(`Encoded PegIn vault output scriptPubKey ${E} does not match the independently derived payout scriptPubKey ${P}.`);const g=n.getId();if(g!==c.stripHexPrefix(e.txid).toLowerCase())throw new Error(`Encoded PegIn txid ${g} does not match the WASM-reported txid ${e.txid}.`);const S=await v.computeMinClaimValue(r,t.prePeginParams.numLocalChallengers,t.prePeginParams.universalChallengerPubkeys.length,t.prePeginParams.councilQuorum,t.prePeginParams.councilSize,t.prePeginParams.feeRate),y=n.outs[ne];if(BigInt(y.value)!==S)throw new Error(`Encoded PegIn depositor-claim output value ${y.value} does not match the independently computed claim value ${S} for vaultCoreVersion ${r}.`);const w=se(t.prePeginParams.depositorPubkey);if(!y.script.equals(w))throw new Error(`Encoded PegIn depositor-claim output scriptPubKey ${y.script.toString("hex")} does not pay to the depositor's claim script (expected ${w.toString("hex")}).`)}async function ue(e){const t=await v.createPayoutConnector({txGraphVersion:e.vaultCoreVersion,depositor:e.depositor,vaultProvider:e.vaultProvider,vaultKeepers:e.vaultKeepers,universalChallengers:e.universalChallengers,timelockPegin:e.timelockPegin},e.network);return{payoutScript:t.payoutScript,taprootScriptHash:t.taprootScriptHash,scriptPubKey:t.scriptPubKey,address:t.address,payoutControlBlock:t.payoutControlBlock}}const F=253,$e=254,me=65535,Ce=4294967295,Ie="TapLeaf",be="TapBranch",Te="TapTweak",T=33,A=32,q=128,Ae=1,ke=254,Oe=a.Buffer.from([81,32]);function Re(e){if(e<F)return a.Buffer.from([e]);if(e<=me){const t=a.Buffer.alloc(2);return t.writeUInt16LE(e),a.Buffer.concat([a.Buffer.from([F]),t])}if(e<=Ce){const t=a.Buffer.alloc(4);return t.writeUInt32LE(e),a.Buffer.concat([a.Buffer.from([$e]),t])}throw new Error(`Script too large to encode as CompactSize: ${e} bytes`)}function N(e,t){const r=a.Buffer.concat([a.Buffer.from([e]),Re(t.length),a.Buffer.from(t)]);return l.crypto.taggedHash(Ie,r)}function Le(e){const{leafVersion:t,script:r,controlBlock:o}=e,i=o.length-T;if(i<0||i%A!==0||i/A>q)throw new Error(`Malformed Taproot control block: length ${o.length} must be ${T} + 32*m with 0 <= m <= ${q}`);const s=o[0]&ke;if(s!==t)throw new Error(`Taproot control block leaf version 0x${s.toString(16)} does not match the tapLeafScript leaf version 0x${t.toString(16)}`);const n=a.Buffer.from(o.subarray(1,T));let u=N(t,r);for(let P=T;P<o.length;P+=A){const E=a.Buffer.from(o.subarray(P,P+A));u=l.crypto.taggedHash(be,a.Buffer.compare(u,E)<=0?a.Buffer.concat([u,E]):a.Buffer.concat([E,u]))}const f=l.crypto.taggedHash(Te,a.Buffer.concat([n,u])),p=ee.xOnlyPointAddTweak(n,f);if(p===null)throw new Error("Taproot control block does not yield a valid output key (tweak is off-curve)");const d=o[0]&Ae;if(p.parity!==d)throw new Error(`Taproot output key parity ${p.parity} contradicts the control block's parity bit ${d}`);return a.Buffer.concat([Oe,a.Buffer.from(p.xOnlyPubkey)])}const Ve=256,He=1500,X=256,G=0xffffffffn,Ne=500,Be=55,Ue=34;function Ke(e){if(typeof e.protocolFeeRate!="bigint"||e.protocolFeeRate<=0n||e.protocolFeeRate>G)throw new Error(`protocolFeeRate must be in [1, ${G}] sat/vB, got ${e.protocolFeeRate}`);for(const[t,r,o,i]of[["keepers",e.numVaultKeepers,Ve,"fee-floor model limit"],["challengers",e.numUniversalChallengers,He,"protocol maximum"]])if(!Number.isInteger(r)||r<1||r>o)throw new Error(`Participant count for ${t} (${r}) is outside the supported range [1, ${o}]${r>o?` (${i})`:""}.`);if(!Number.isInteger(e.councilSize)||e.councilSize<1||e.councilSize>X)throw new Error(`councilSize must be an integer in [1, ${X}], got ${e.councilSize}`)}async function Me(e,t){const{implicitFeeSats:r,out0Len:o,out1Len:i}=t,s=e.numVaultKeepers+e.numUniversalChallengers,n=BigInt(r),u=Math.max(0,o-Ue),f=Ne+Be*s+u,p=e.protocolFeeRate*BigInt(f);if(n>p)throw new Error(`Payout implicit fee ${r} sats exceeds the safety cap of ${p} sats (${e.protocolFeeRate} sat/vB x ${f} vB for ${s} participants); refusing to sign payout.`);const d=await v.computePayoutFeeFloor(e.vaultCoreVersion,e.numVaultKeepers,e.numUniversalChallengers,e.numVaultKeepers,e.councilSize,o,i,e.protocolFeeRate);if(n<d)throw new Error(`Payout implicit fee ${r} sats is below the floor of ${d} sats (the smallest fee any known vault-provider build produces for this shape); refusing to sign payout.`)}const Fe=22,qe=34,Xe=34,Ge=25,We=23;function Ye(e){return e.length===Fe*2&&e.startsWith("0014")}function ze(e){return e.length===qe*2&&e.startsWith("0020")}function De(e){return e.length===Xe*2&&e.startsWith("5120")}function Qe(e){return e.length===Ge*2&&e.startsWith("76a914")&&e.endsWith("88ac")}function Ze(e){return e.length===We*2&&e.startsWith("a914")&&e.endsWith("87")}function W(e,t){const r=c.stripHexPrefix(e).toLowerCase();if(r.length===0)throw new Error(`${t} is empty`);if(!/^[0-9a-f]+$/.test(r)||r.length%2!==0)throw new Error(`${t} is not valid hex`);if(r.startsWith("6a"))throw new Error(`${t} is an OP_RETURN output, which is provably unspendable`);if(!De(r)&&!Ye(r)&&!ze(r)&&!Qe(r)&&!Ze(r))throw new Error(`${t} is not a standard scriptPubKey (expected P2TR, P2WPKH, P2WSH, P2PKH, or P2SH; got ${r.length/2} bytes: ${r})`)}const Y=3;async function je(e){const t={vaultCoreVersion:e.vaultCoreVersion,numVaultKeepers:e.vaultKeeperBtcPubkeys.length,numUniversalChallengers:e.universalChallengerBtcPubkeys.length,councilSize:e.councilMembers.length,protocolFeeRate:e.protocolFeeRate};Ke(t);const r=l.Transaction.fromHex(c.stripHexPrefix(e.payoutTxHex)),o=l.Transaction.fromHex(c.stripHexPrefix(e.peginTxHex)),i=l.Transaction.fromHex(c.stripHexPrefix(e.assertTxHex));if(r.ins.length!==h.DEPOSITOR_PAYOUT_INPUT_COUNT)throw new Error(`Payout transaction must have exactly ${h.DEPOSITOR_PAYOUT_INPUT_COUNT} inputs, got ${r.ins.length}`);if(r.version!==h.PAYOUT_TX_VERSION)throw new Error(`Payout transaction version ${r.version} must be ${h.PAYOUT_TX_VERSION}; refusing to sign payout.`);if(r.locktime!==h.PAYOUT_TX_LOCKTIME)throw new Error(`Payout transaction locktime ${r.locktime} must be ${h.PAYOUT_TX_LOCKTIME}; refusing to sign payout.`);const s=z(r.ins[0],0,o,"PegIn",h.PEGIN_VAULT_OUTPUT_INDEX);if(r.ins[0].sequence!==e.timelockPegin)throw new Error(`Payout input 0 sequence ${r.ins[0].sequence} must equal the PegIn CSV timelock ${e.timelockPegin}; refusing to sign payout.`);const n=z(r.ins[1],1,i,"Assert",h.ASSERT_PAYOUT_OUTPUT_INDEX);if(r.ins[1].sequence!==e.timelockAssert)throw new Error(`Payout input 1 sequence ${r.ins[1].sequence} must equal the Assert CSV timelock ${e.timelockAssert}; refusing to sign payout.`);const{out0Len:u,out1Len:f}=tt(r,s.value,e),p=s.value+n.value;let d=0;for(const S of r.outs)d+=S.value;if(d>p)throw new Error(`Payout outputs (${d} sats) exceed inputs (${p} sats); invalid transaction.`);const P=p-d;await Me(t,{implicitFeeSats:P,out0Len:u,out1Len:f});const E=await ue({vaultCoreVersion:e.vaultCoreVersion,depositor:e.depositorBtcPubkey,vaultProvider:e.vaultProviderBtcPubkey,vaultKeepers:e.vaultKeeperBtcPubkeys,universalChallengers:e.universalChallengerBtcPubkeys,timelockPegin:e.timelockPegin,network:e.network}),g=await Je(e,n);return{psbtHex:et(r,s,n,E,g)}}async function Je(e,t){const{payoutScript:r,payoutControlBlock:o}=await v.getAssertPayoutScriptInfo({txGraphVersion:e.vaultCoreVersion,claimer:c.stripHexPrefix(e.claimerBtcPubkey).toLowerCase(),localChallengers:te({claimerBtcPubkey:e.claimerBtcPubkey,depositorBtcPubkey:e.depositorBtcPubkey,vaultProviderBtcPubkey:e.vaultProviderBtcPubkey,vaultKeeperBtcPubkeys:e.vaultKeeperBtcPubkeys}),universalChallengers:e.universalChallengerBtcPubkeys.map(u=>c.stripHexPrefix(u).toLowerCase()),timelockAssert:e.timelockAssert,councilMembers:e.councilMembers.map(u=>c.stripHexPrefix(u).toLowerCase()),councilQuorum:e.councilQuorum}),i=c.hexToUint8Array(r),s=c.hexToUint8Array(o),n=Le({leafVersion:c.TAPSCRIPT_LEAF_VERSION,script:i,controlBlock:s});if(!t.script.equals(n))throw new Error(`Rebuilt Assert:0 payout leaf does not spend the Assert output being referenced: leaf binds to ${n.toString("hex")}, Assert:${h.ASSERT_PAYOUT_OUTPUT_INDEX} pays ${t.script.toString("hex")}; refusing to sign payout.`);return{script:i,controlBlock:s}}function z(e,t,r,o,i){const s=c.uint8ArrayToHex(new Uint8Array(e.hash).slice().reverse()),n=r.getId();if(s!==n||e.index!==i)throw new Error(`Input ${t} must spend ${o}:${i}. Expected ${n}:${i}, got ${s}:${e.index}`);const u=r.outs[e.index];if(!u)throw new Error(`Previous output not found for input ${t} (txid: ${s}, index: ${e.index})`);return u}function et(e,t,r,o,i){const s=new l.Psbt;s.setVersion(e.version),s.setLocktime(e.locktime);const[n,u]=e.ins;s.addInput({hash:n.hash,index:n.index,sequence:n.sequence,witnessUtxo:{script:t.script,value:t.value},tapLeafScript:[{leafVersion:c.TAPSCRIPT_LEAF_VERSION,script:a.Buffer.from(c.hexToUint8Array(o.payoutScript)),controlBlock:a.Buffer.from(c.hexToUint8Array(o.payoutControlBlock))}],tapInternalKey:a.Buffer.from(v.tapInternalPubkey)}),s.addInput({hash:u.hash,index:u.index,sequence:u.sequence,witnessUtxo:{script:r.script,value:r.value},tapLeafScript:[{leafVersion:c.TAPSCRIPT_LEAF_VERSION,script:a.Buffer.from(i.script),controlBlock:a.Buffer.from(i.controlBlock)}],tapInternalKey:a.Buffer.from(v.tapInternalPubkey)});for(const f of e.outs)s.addOutput({script:f.script,value:f.value});return s.toHex()}function D(e,t){const r=c.stripHexPrefix(e).toLowerCase(),o=c.stripHexPrefix(c.deriveBip86ScriptPubKeyHex(t)).toLowerCase();return r===o?[r]:[r,o]}function Q(e,t){return t.some(r=>e.equals(a.Buffer.from(r,"hex")))}function tt(e,t,r){const{claimerBtcPubkey:o,vaultProviderBtcPubkey:i,depositorBtcPubkey:s,vaultKeeperBtcPubkeys:n,registeredPayoutScriptPubKey:u,commissionBps:f,vkClaimerPayoutScriptPubKeys:p,vpCommissionScriptPubKey:d}=r;if(!c.isValidHex(u))throw new Error("Invalid registeredPayoutScriptPubKey: not valid hex");const P=c.stripHexPrefix(o).toLowerCase(),E=c.stripHexPrefix(i).toLowerCase(),g=c.stripHexPrefix(s).toLowerCase(),S=n.map($=>c.stripHexPrefix($).toLowerCase());let y,w,_;if(P===E)y="vp-claimer",w=h.VP_CLAIMER_PAYOUT_OUTPUT_COUNT,_=[c.stripHexPrefix(u)];else if(P===g)y="depositor-as-claimer",w=h.NON_VP_CLAIMER_PAYOUT_OUTPUT_COUNT,_=[c.stripHexPrefix(u)];else if(S.includes(P)){y="vk-claimer",w=h.NON_VP_CLAIMER_PAYOUT_OUTPUT_COUNT;const $=p[P];if($===void 0)throw new Error(`No registered payout script resolved for vault keeper claimer ${P}`);W($,`Vault keeper payout script for claimer ${P}`),_=D($,P)}else throw new Error(`Unknown claimer pubkey ${P}: not VP, depositor, or a registered vault keeper`);if(e.outs.length!==w)throw new Error(`Payout transaction has ${e.outs.length} output(s), expected exactly ${w} for role ${y}.`);if(!Q(e.outs[0].script,_))throw new Error(`Payout transaction output 0 does not pay the expected scriptPubKey for role ${y}. Accepted: ${_.join(" or ")}; got ${e.outs[0].script.toString("hex")}`);const L=w-1;if(e.outs[L].value!==h.PAYOUT_ANCHOR_DUST_SATS)throw new Error(`Payout CPFP anchor (out ${L}) value ${e.outs[L].value} sats must equal ${h.PAYOUT_ANCHOR_DUST_SATS} sats`);if(y==="vp-claimer"){W(d,"Vault provider commission payout script");const $=D(d,E);if(!Q(e.outs[1].script,$))throw new Error(`Payout transaction output 1 does not pay the vault provider's commission scriptPubKey. Accepted: ${$.join(" or ")}; got ${e.outs[1].script.toString("hex")}`);if(!Number.isInteger(f)||f<0||f>=h.MAX_VP_COMMISSION_BPS_EXCLUSIVE)throw new Error(`commissionBps must be an integer in [0, ${h.MAX_VP_COMMISSION_BPS_EXCLUSIVE}), got ${f}`);const B=Math.floor(t*f/h.BPS_DENOMINATOR);if(e.outs[1].value>B)throw new Error(`Payout VP commission (out 1) value ${e.outs[1].value} sats exceeds cap ${B} sats (${f} bps of peginValue=${t})`)}const b=e.outs[0].script.length;if(b===0||b>h.MAX_PAYOUT_SCRIPT_LEN)throw new Error(`Payout receiver scriptPubKey length ${b} is outside the contract's registration cap [1, ${h.MAX_PAYOUT_SCRIPT_LEN}]; refusing to sign payout.`);const ce=y==="vp-claimer"?e.outs[1].script.length:void 0;return{out0Len:b,out1Len:ce}}function rt(e,t,r=0){const o=l.Psbt.fromHex(e);if(r>=o.data.inputs.length)throw new Error(`Input index ${r} out of range (${o.data.inputs.length} inputs)`);const i=o.data.inputs[r];if(i.tapScriptSig&&i.tapScriptSig.length>0){const s=c.hexToUint8Array(t);for(const n of i.tapScriptSig)if(n.pubkey.equals(a.Buffer.from(s)))return Z(n.signature,r);throw new Error(`No signature found for depositor pubkey: ${t} at input ${r}`)}if(i.finalScriptWitness&&i.finalScriptWitness.length>0){const s=ot(i.finalScriptWitness);if(s.length!==Y)throw new Error(`Unexpected finalized witness stack size at input ${r}: expected ${Y} items (signature, script, controlBlock), got ${s.length}`);return Z(s[0],r)}throw new Error(`No tapScriptSig or finalScriptWitness found in signed PSBT at input ${r}`)}function Z(e,t){if(e.length===64)return c.uint8ArrayToHex(new Uint8Array(e));throw e.length===65?new Error(`Unexpected sighash byte 0x${e[64].toString(16).padStart(2,"0")} at input ${t}. Expected implicit SIGHASH_DEFAULT as a 64-byte signature.`):new Error(`Unexpected signature length at input ${t}: ${e.length}`)}function ot(e){const t=[];let r=0;const o=n=>{if(r+n>e.length)throw new Error(`Malformed witness data: need ${n} byte(s) at offset ${r}, only ${e.length-r} remaining`)},i=()=>{o(1);const n=e[r++];if(n<253)return n;if(n===253){o(2);const u=(e[r]|e[r+1]<<8)>>>0;return r+=2,u}if(n===254){o(4);const u=(e[r]|e[r+1]<<8|e[r+2]<<16|e[r+3]<<24)>>>0;return r+=4,u}throw new Error(`Malformed witness data: 8-byte varint (0xff) not supported at offset ${r-1}`)},s=i();for(let n=0;n<s;n++){const u=i();o(u),t.push(a.Buffer.from(e.subarray(r,r+u))),r+=u}if(r!==e.length)throw new Error(`Malformed witness data: ${e.length-r} trailing byte(s) after parsing ${s} item(s)`);return t}class x extends Error{constructor(t){super(`Wallet returned a PSBT for a different transaction: ${t}`),this.name="PsbtSubstitutionError"}}function j(e,t){try{return l.Psbt.fromHex(t)}catch(r){const o=r instanceof Error?r.message:String(r);throw new Error(`Failed to parse ${e} PSBT: ${o}`)}}const nt=8;function V(e){return`${e.toString("hex").slice(0,nt)}…`}function J(e){const t=a.Buffer.from(e).reverse();return V(t)}function it(e){const t=j("requested",e.requestedPsbtHex),r=j("returned",e.returnedPsbtHex);if(t.version!==r.version)throw new x(`tx version differs (requested=${t.version}, returned=${r.version})`);if(t.locktime!==r.locktime)throw new x(`tx locktime differs (requested=${t.locktime}, returned=${r.locktime})`);if(t.txInputs.length!==r.txInputs.length)throw new x(`input count differs (requested=${t.txInputs.length}, returned=${r.txInputs.length})`);if(t.txOutputs.length!==r.txOutputs.length)throw new x(`output count differs (requested=${t.txOutputs.length}, returned=${r.txOutputs.length})`);for(let o=0;o<t.txInputs.length;o++){const i=t.txInputs[o],s=r.txInputs[o];if(!i.hash.equals(s.hash))throw new x(`input ${o} prevout txid differs (requested=${J(i.hash)}, returned=${J(s.hash)})`);if(i.index!==s.index)throw new x(`input ${o} prevout vout differs (requested=${i.index}, returned=${s.index})`);if(i.sequence!==s.sequence)throw new x(`input ${o} sequence differs (requested=${i.sequence}, returned=${s.sequence})`)}for(let o=0;o<t.txOutputs.length;o++){const i=t.txOutputs[o],s=r.txOutputs[o];if(!i.script.equals(s.script))throw new x(`output ${o} scriptPubKey differs (requested=${V(i.script)}, returned=${V(s.script)})`);if(i.value!==s.value)throw new x(`output ${o} value differs (requested=${i.value}, returned=${s.value})`)}}function st(e){const{requestedPsbtHex:t,signatureHex:r,signerXOnlyPubkeyHex:o,inputIndex:i}=e,s=c.stripHexPrefix(r);if(s.length!==c.SCHNORR_SIG_HEX_LEN)throw new Error(`Schnorr signature for input ${i} must be ${c.SCHNORR_SIG_HEX_LEN} hex chars (64 bytes), got ${s.length}.`);const n=c.stripHexPrefix(o);if(n.length!==U.X_ONLY_PUBKEY_HEX_LEN)throw new Error(`Signer x-only pubkey for input ${i} must be ${U.X_ONLY_PUBKEY_HEX_LEN} hex chars (32 bytes), got ${n.length}.`);const u=l.Psbt.fromHex(t);if(i<0||i>=u.data.inputs.length)throw new Error(`Input index ${i} out of range (${u.data.inputs.length} inputs).`);const f=[],p=[];for(let w=0;w<u.data.inputs.length;w++){const _=u.data.inputs[w].witnessUtxo;if(!_)throw new Error(`Cannot verify signature: input ${w} of the requested PSBT has no witnessUtxo (required to recompute the Taproot sighash).`);f.push(_.script),p.push(_.value)}const d=u.data.inputs[i].tapLeafScript;if(!d||d.length!==1)throw new Error(`Cannot verify signature: input ${i} of the requested PSBT must have exactly one tapLeafScript, got ${(d==null?void 0:d.length)??0}.`);const P=d[0];if(P.leafVersion!==c.TAPSCRIPT_LEAF_VERSION)throw new Error(`Cannot verify signature: input ${i} tapLeafScript has leaf version 0x${P.leafVersion.toString(16)}, expected 0x${c.TAPSCRIPT_LEAF_VERSION.toString(16)}.`);const E=N(P.leafVersion,P.script),g=new l.Transaction;g.version=u.version,g.locktime=u.locktime;for(const w of u.txInputs)g.addInput(w.hash,w.index,w.sequence);for(const w of u.txOutputs)g.addOutput(w.script,w.value);const S=g.hashForWitnessV1(i,f,p,l.Transaction.SIGHASH_DEFAULT,E);if(!ee.verifySchnorr(S,c.hexToUint8Array(n),c.hexToUint8Array(s)))throw new Error(`Schnorr signature for input ${i} (signer ${n}) does not verify against the expected Taproot script-path sighash. The wallet may have signed with the tweaked key, signed a different transaction, or returned an invalid signature.`)}exports.HtlcOutputMismatchError=C;exports.PEGIN_DEPOSITOR_CLAIM_VOUT=ne;exports.PsbtSubstitutionError=x;exports.assertEncodedHtlcOutputsMatch=oe;exports.assertPsbtUnsignedTxMatches=it;exports.assertScriptPathSchnorrSignature=st;exports.buildPayoutPsbt=je;exports.buildPeginTxFromFundedPrePegin=Se;exports.buildPrePeginPsbt=ve;exports.computeNumLocalChallengers=pe;exports.computeTapLeafHash=N;exports.createPayoutScript=ue;exports.deriveDepositorClaimDescriptor=ie;exports.deriveDepositorClaimScriptPubKey=se;exports.deriveExpectedPrePeginHtlc=re;exports.deriveLocalChallengers=te;exports.extractPayoutSignature=rt;exports.normalizeAuthAnchorHash=H;
-//# sourceMappingURL=verifyScriptPathSchnorrSignature-BKZihCjk.cjs.map
+"use strict";const l=require("bitcoinjs-lib"),v=require("./tbv/core/wasm/index.cjs"),k=require("./fundPeginTransaction-54-Rwb2k.cjs"),c=require("./bitcoin-D-O2GjbC.cjs"),Pe=require("./secp256k1-DDHQ1_za.cjs"),a=require("buffer"),h=require("./constants-BwCg5K6R.cjs"),pe=require("@bitcoin-js/tiny-secp256k1-asmjs"),U=require("./validation-C6XTfZak.cjs");function he(e){const t=Object.create(null,{[Symbol.toStringTag]:{value:"Module"}});if(e){for(const r in e)if(r!=="default"){const o=Object.getOwnPropertyDescriptor(e,r);Object.defineProperty(t,r,o.get?o:{enumerable:!0,get:()=>e[r]})}}return t.default=e,Object.freeze(t)}const ee=he(pe);function m(e){return c.processPublicKeyToXOnly(e).toLowerCase()}function de(e,t,r){const o=new Set;o.add(m(e));for(const i of t)o.add(m(i));return o.delete(m(r)),o.size}function te(e){const t=m(e.claimerBtcPubkey),r=m(e.depositorBtcPubkey),o=e.vaultKeeperBtcPubkeys.map(m);if(t===r){const n=o.filter(u=>u!==r);if(n.length===0)throw new Error("Cannot derive localChallengers: vault keeper set is empty (or contains only the depositor)");if(new Set(n).size!==n.length)throw new Error("Cannot derive localChallengers: duplicate vaultKeeper key — signing context is misconfigured");return n}const s=[...new Set([m(e.vaultProviderBtcPubkey),...o])].sort().filter(n=>n!==t);if(s.length===0)throw new Error(`Cannot derive localChallengers: no vault provider or vault keeper remains after excluding claimer ${t}`);return s}const fe=32,ge=65535,Ee=2;function I(e,t){const r=c.stripHexPrefix(e).toLowerCase();if(!/^[0-9a-f]{64}$/.test(r))throw new Error(`${t} must be a 32-byte x-only public key.`);try{Pe.secp256k1.Point.fromBytes(a.Buffer.concat([a.Buffer.from([Ee]),a.Buffer.from(r,"hex")]))}catch{throw new Error(`${t} is not a secp256k1 x-coordinate.`)}return r}function O(e,t){if(e.length===0)throw new Error(`${t} must not be empty.`);const r=e.map((o,i)=>I(o,`${t}[${i}]`)).sort();if(new Set(r).size!==r.length)throw new Error(`${t} must not contain duplicate keys.`);return r}function R(e,t){const r=[];return e.forEach((o,i)=>{r.push(a.Buffer.from(o,"hex"),i===0?l.opcodes.OP_CHECKSIG:l.opcodes.OP_CHECKSIGADD)}),r.push(l.script.number.encode(e.length),t?l.opcodes.OP_NUMEQUALVERIFY:l.opcodes.OP_NUMEQUAL),r}function re(e,t){var w;c.assertEccInitialized();const r=I(e.depositorPubkey,"depositorPubkey"),o=I(e.vaultProviderPubkey,"vaultProviderPubkey"),i=O(e.vaultKeeperPubkeys,"vaultKeeperPubkeys"),s=O(e.universalChallengerPubkeys,"universalChallengerPubkeys"),n=c.stripHexPrefix(t).toLowerCase();if(!/^[0-9a-f]{64}$/.test(n))throw new Error("hashlock must be 32 bytes.");if(!Number.isInteger(e.timelockRefund)||e.timelockRefund<1||e.timelockRefund>ge)throw new Error("timelockRefund must be an integer from 1 to 65535.");const u=l.script.compile([l.opcodes.OP_SIZE,l.script.number.encode(fe),l.opcodes.OP_EQUALVERIFY,l.opcodes.OP_SHA256,a.Buffer.from(n,"hex"),l.opcodes.OP_EQUALVERIFY,a.Buffer.from(r,"hex"),l.opcodes.OP_CHECKSIGVERIFY,a.Buffer.from(o,"hex"),l.opcodes.OP_CHECKSIGVERIFY,...R(i,!0),...R(s,!1)]),d=l.script.compile([a.Buffer.from(r,"hex"),l.opcodes.OP_CHECKSIGVERIFY,l.script.number.encode(e.timelockRefund),l.opcodes.OP_CHECKSEQUENCEVERIFY]),p=[{output:u,version:c.TAPSCRIPT_LEAF_VERSION},{output:d,version:c.TAPSCRIPT_LEAF_VERSION}],{hash:f,output:P,witness:E}=l.payments.p2tr({internalPubkey:a.Buffer.from(v.tapInternalPubkey),scriptTree:p,redeem:{output:u,redeemVersion:c.TAPSCRIPT_LEAF_VERSION}}),g=E==null?void 0:E[E.length-1],S=l.payments.p2tr({internalPubkey:a.Buffer.from(v.tapInternalPubkey),scriptTree:p,redeem:{output:d,redeemVersion:c.TAPSCRIPT_LEAF_VERSION}}),y=(w=S.witness)==null?void 0:w[S.witness.length-1];if(!f||!P||!g||!y)throw new Error("Failed to derive the expected Pre-PegIn HTLC output.");return{hashlockScript:u,hashlockControlBlock:g,refundScript:d,refundControlBlock:y,scriptPubKey:P,tapMerkleRoot:f}}function we(e,t){c.assertEccInitialized();const r=I(e.depositorPubkey,"depositorPubkey"),o=I(e.vaultProviderPubkey,"vaultProviderPubkey"),i=O(e.vaultKeeperPubkeys,"vaultKeeperPubkeys"),s=O(e.universalChallengerPubkeys,"universalChallengerPubkeys"),n=l.script.compile([a.Buffer.from(r,"hex"),l.opcodes.OP_CHECKSIGVERIFY,a.Buffer.from(o,"hex"),l.opcodes.OP_CHECKSIGVERIFY,...R(i,!0),...R(s,!0),l.script.number.encode(t),l.opcodes.OP_CHECKSEQUENCEVERIFY]),{output:u}=l.payments.p2tr({internalPubkey:a.Buffer.from(v.tapInternalPubkey),scriptTree:{output:n,version:c.TAPSCRIPT_LEAF_VERSION}});if(!u)throw new Error("Failed to derive the expected PegIn payout output.");return u}async function ye(e,t){const r=t.pegInAmounts.length;if(t.hashlocks.length!==r)throw new Error(`Pre-PegIn has ${t.hashlocks.length} hashlock(s), expected ${r} (one per requested deposit).`);if(e.htlcValues.length!==r)throw new Error(`WASM Pre-PegIn returned ${e.htlcValues.length} HTLC value(s), expected ${r} (one per requested deposit).`);if(e.peginAmounts.length!==r||e.htlcScriptPubKeys.length!==r||e.htlcAddresses.length!==r)throw new Error(`WASM Pre-PegIn returned mismatched array lengths (htlcValues=${e.htlcValues.length}, peginAmounts=${e.peginAmounts.length}, htlcScriptPubKeys=${e.htlcScriptPubKeys.length}, htlcAddresses=${e.htlcAddresses.length}); expected ${r} each.`);if(e.depositorClaimValue<=0n)throw new Error(`WASM Pre-PegIn returned non-positive depositorClaimValue ${e.depositorClaimValue}; expected > 0.`);const o=await v.computeMinClaimValue(t.vaultCoreVersion,t.numLocalChallengers,t.universalChallengerPubkeys.length,t.councilQuorum,t.councilSize,t.feeRate);if(e.depositorClaimValue!==o)throw new Error(`WASM Pre-PegIn depositorClaimValue ${e.depositorClaimValue} does not match the independently computed minimum claim value ${o} (vaultCoreVersion=${t.vaultCoreVersion}, numLocalChallengers=${t.numLocalChallengers}, numUniversalChallengers=${t.universalChallengerPubkeys.length}, councilQuorum=${t.councilQuorum}, councilSize=${t.councilSize}, feeRate=${t.feeRate}).`);const i=await v.peginP2aAnchorOutput(t.vaultCoreVersion),s=(i==null?void 0:i.value)??0n,n=await v.computeMinPeginFee(t.vaultCoreVersion,t.vaultKeeperPubkeys.length,t.universalChallengerPubkeys.length,t.minPeginFeeRate),u=n+s,d=t.minPeginFeeRate*k.MAX_REASONABLE_PEGIN_VBYTES;for(let p=0;p<r;p++){const f=t.pegInAmounts[p],P=e.peginAmounts[p],E=e.htlcValues[p];if(P!==f)throw new Error(`WASM Pre-PegIn peginAmount[${p}] ${P} does not match the requested amount ${f}; refusing to build a tx whose recorded amount differs from the depositor's request.`);if(P<=0n)throw new Error(`WASM Pre-PegIn peginAmount[${p}] is non-positive (${P}); expected > 0.`);if(E<=0n)throw new Error(`WASM Pre-PegIn htlcValue[${p}] is non-positive (${E}); expected > 0.`);const g=E-P-e.depositorClaimValue;if(g<=0n)throw new Error(`WASM Pre-PegIn htlcValue[${p}] ${E} does not strictly cover peginAmount ${P} + depositorClaimValue ${e.depositorClaimValue} + a PegIn reserve (implied reserve ${g}).`);if(g>d)throw new Error(`WASM Pre-PegIn implied reserve for HTLC[${p}] (${g} sat) exceeds the plausibility cap ${d} sat (minPeginFeeRate=${t.minPeginFeeRate} × ${k.MAX_REASONABLE_PEGIN_VBYTES} vbytes); htlcValue ${E} appears grossly inflated.`);if(g!==u)throw new Error(`WASM Pre-PegIn htlcValue[${p}] ${E} implies a PegIn fee+anchor reserve of ${g} sat, expected exactly ${u} sat (minPeginFee ${n} + p2aAnchor ${s} for vaultCoreVersion ${t.vaultCoreVersion}, vaultKeepers=${t.vaultKeeperPubkeys.length}, universalChallengers=${t.universalChallengerPubkeys.length}, minPeginFeeRate=${t.minPeginFeeRate}).`)}return n}class C extends Error{constructor(t){super(t),this.name="HtlcOutputMismatchError"}}function oe(e,t,r){if(e.length<t.length)throw new C(`Encoded Pre-PegIn tx has ${e.length} output(s), fewer than the ${t.length} HTLC output(s) the cross-check validated.`);for(let o=0;o<t.length;o++){const i=BigInt(e[o].value);if(i!==t[o])throw new C(`Encoded Pre-PegIn HTLC output[${o}] value ${i} does not match the cross-checked htlcValue ${t[o]}; the funded/signed tx would not pay the validated amount.`);const s=e[o].script.toString("hex").toLowerCase(),n=r[o].toLowerCase();if(s!==n)throw new C(`Encoded Pre-PegIn HTLC output[${o}] scriptPubKey ${s} does not match the cross-checked htlcScriptPubKey ${n}.`)}}function ve(e,t,r,o,i,s,n){if(s!==h.PRE_PEGIN_TX_VERSION)throw new Error(`WASM Pre-PegIn transaction version ${s}; expected ${h.PRE_PEGIN_TX_VERSION}.`);if(n!==h.PRE_PEGIN_TX_LOCKTIME)throw new Error(`WASM Pre-PegIn transaction locktime ${n}; expected ${h.PRE_PEGIN_TX_LOCKTIME}.`);if(t.length<h.PRE_PEGIN_MIN_HTLC_OUTPUT_COUNT)throw new Error(`WASM Pre-PegIn output layout has ${t.length} HTLC output(s); expected at least ${h.PRE_PEGIN_MIN_HTLC_OUTPUT_COUNT}.`);const u=t.length,d=u+ +(i!==void 0),p=k.peginOutputCount(t.length,i!==void 0);if(e.length!==p)throw new Error(`WASM Pre-PegIn output layout has ${e.length} output(s); expected exactly ${p}.`);oe(e,t,r);for(let g=0;g<t.length;g++){const S=re(o,o.hashlocks[g]).scriptPubKey;if(!e[g].script.equals(S))throw new C(`Pre-PegIn HTLC output[${g}] does not match the independently derived scriptPubKey.`)}if(i!==void 0){const g=e[u];if(g.value!==h.PRE_PEGIN_AUTH_OUTPUT_VALUE_SATS)throw new Error(`WASM Pre-PegIn auth output[${u}] value ${g.value} sat; expected exactly ${h.PRE_PEGIN_AUTH_OUTPUT_VALUE_SATS} sat.`);const S=g.script.toString("hex").toLowerCase(),y=h.PRE_PEGIN_AUTH_SCRIPT_PREFIX+i.toLowerCase();if(S!==y)throw new Error(`WASM Pre-PegIn auth output[${u}] scriptPubKey ${S}; expected ${y}.`)}const f=e[d];if(f.value!==h.PRE_PEGIN_CPFP_VALUE_SATS)throw new Error(`WASM Pre-PegIn CPFP output[${d}] value ${f.value} sat; expected exactly ${h.PRE_PEGIN_CPFP_VALUE_SATS} sat.`);const P=f.script.toString("hex").toLowerCase(),E=c.stripHexPrefix(c.deriveBip86ScriptPubKeyHex(o.depositorPubkey)).toLowerCase();if(P!==E)throw new Error(`WASM Pre-PegIn CPFP output[${d}] scriptPubKey ${P}; expected depositor BIP-86 script ${E}.`)}const ne=1;function ie(e){const t=c.stripHexPrefix(e);if(!/^[0-9a-fA-F]{64}$/.test(t))throw new Error("Invalid depositor pubkey for the depositor-claim script: must be an x-only key of 64 hex characters (32 bytes).");const r=l.script.compile([a.Buffer.from(c.hexToUint8Array(t)),l.opcodes.OP_CHECKSIG]),o=a.Buffer.from(v.tapInternalPubkey),i={output:r,redeemVersion:c.TAPSCRIPT_LEAF_VERSION},{output:s,witness:n}=l.payments.p2tr({internalPubkey:o,scriptTree:{output:r},redeem:i});if(!s)throw new Error("Failed to derive the depositor-claim P2TR scriptPubKey for PegIn output validation");const u=n==null?void 0:n[n.length-1];if(!u)throw new Error("Failed to derive the depositor-claim tapleaf control block; refusing to build an unspendable input");return{scriptPubKey:s,leafScript:r,controlBlock:u,internalKey:o}}function se(e){return ie(e).scriptPubKey}const K=64,Se=/^[0-9a-fA-F]+$/,M=65535;async function xe(e){const t=H(e.authAnchorHash),r=await v.createPrePeginTransaction({txGraphVersion:e.vaultCoreVersion,depositorPubkey:e.depositorPubkey,vaultProviderPubkey:e.vaultProviderPubkey,vaultKeeperPubkeys:e.vaultKeeperPubkeys,universalChallengerPubkeys:e.universalChallengerPubkeys,hashlocks:[...e.hashlocks],timelockRefund:e.timelockRefund,pegInAmounts:[...e.pegInAmounts],feeRate:e.feeRate,minPeginFeeRate:e.minPeginFeeRate,numLocalChallengers:e.numLocalChallengers,councilQuorum:e.councilQuorum,councilSize:e.councilSize,network:e.network,authAnchorHash:t}),o=await ye(r,e),i=k.parseUnfundedWasmTransaction(r.txHex);ve(i.outputs,r.htlcValues,r.htlcScriptPubKeys,e,t,i.version,i.locktime);const s=i.outputs.reduce((u,d)=>u+BigInt(d.value),0n),n=t!==void 0?r.htlcValues.length:null;return{psbtHex:r.txHex,totalOutputValue:s,htlcValues:r.htlcValues,htlcScriptPubKeys:r.htlcScriptPubKeys,htlcAddresses:r.htlcAddresses,peginAmounts:r.peginAmounts,depositorClaimValue:r.depositorClaimValue,authAnchorVout:n,minPeginFee:o}}function H(e){if(e===void 0)return;const t=e.startsWith("0x")||e.startsWith("0X")?e.slice(2):e;if(t.length!==K||!Se.test(t))throw new Error(`authAnchorHash must be 32-byte hex (${K} chars, no 0x prefix); got length ${t.length}`);return t.toLowerCase()}async function _e(e){if(!Number.isInteger(e.timelockPegin)||e.timelockPegin<1||e.timelockPegin>M)throw new Error(`PegIn timelock ${e.timelockPegin} must be a whole number of blocks from 1 to ${M}.`);const t=await v.buildPeginTxFromPrePegin({txGraphVersion:e.prePeginParams.vaultCoreVersion,depositorPubkey:e.prePeginParams.depositorPubkey,vaultProviderPubkey:e.prePeginParams.vaultProviderPubkey,vaultKeeperPubkeys:e.prePeginParams.vaultKeeperPubkeys,universalChallengerPubkeys:e.prePeginParams.universalChallengerPubkeys,hashlocks:[...e.prePeginParams.hashlocks],timelockRefund:e.prePeginParams.timelockRefund,pegInAmounts:[...e.prePeginParams.pegInAmounts],feeRate:e.prePeginParams.feeRate,minPeginFeeRate:e.prePeginParams.minPeginFeeRate,numLocalChallengers:e.prePeginParams.numLocalChallengers,councilQuorum:e.prePeginParams.councilQuorum,councilSize:e.prePeginParams.councilSize,network:e.prePeginParams.network,authAnchorHash:H(e.prePeginParams.authAnchorHash)},e.timelockPegin,e.fundedPrePeginTxHex,e.htlcVout);return await me(t,e),{txHex:t.txHex,txid:t.txid,vaultScriptPubKey:t.vaultScriptPubKey,vaultValue:t.vaultValue}}const $e=2;async function me(e,t){const r=t.prePeginParams.vaultCoreVersion,o=r===1?h.PEGIN_TX_VERSION_CORE_1:r===2||r===3?h.PEGIN_TX_VERSION_CORE_2_AND_3:void 0;if(o===void 0)throw new Error(`Unsupported vaultCoreVersion ${r} for PegIn tx.`);await v.validatePeginP2aAnchor(r,e.txHex);const i=await v.peginP2aAnchorOutput(r),s=$e+(i?1:0),n=l.Transaction.fromHex(c.stripHexPrefix(e.txHex));if(n.version!==o)throw new Error(`PegIn tx version ${n.version} does not match vaultCoreVersion ${r}; expected ${o}.`);if(n.locktime!==h.PEGIN_TX_LOCKTIME)throw new Error(`PegIn tx locktime ${n.locktime} does not match the canonical locktime ${h.PEGIN_TX_LOCKTIME}.`);if(n.ins.length!==1)throw new Error(`PegIn tx has ${n.ins.length} input(s), expected exactly 1 (the Pre-PegIn HTLC outpoint).`);const u=l.Transaction.fromHex(c.stripHexPrefix(t.fundedPrePeginTxHex)).getId(),d=c.uint8ArrayToHex(new Uint8Array(n.ins[0].hash).slice().reverse());if(d!==u)throw new Error(`PegIn input spends txid ${d}, expected the funded Pre-PegIn ${u}.`);if(n.ins[0].index!==t.htlcVout)throw new Error(`PegIn input spends Pre-PegIn output ${n.ins[0].index}, expected the requested HTLC vout ${t.htlcVout}.`);if(n.ins[0].sequence!==h.PEGIN_INPUT_SEQUENCE)throw new Error(`PegIn input sequence ${n.ins[0].sequence} does not match the canonical sequence ${h.PEGIN_INPUT_SEQUENCE}.`);if(n.ins[0].script.length!==0)throw new Error("PegIn input scriptSig must be empty.");if(n.ins[0].witness.length!==0)throw new Error("PegIn input witness must be empty before signing.");if(n.outs.length!==s)throw new Error(`PegIn tx has ${n.outs.length} output(s), expected exactly ${s} for vaultCoreVersion ${r} (vault + depositor claim${i?" + P2A anchor":""}).`);const p=t.prePeginParams.pegInAmounts[t.htlcVout];if(e.vaultValue!==p)throw new Error(`PegIn vault output value ${e.vaultValue} does not match the requested peg-in amount ${p} for HTLC ${t.htlcVout}; refusing to sign a vault that locks a different amount than requested.`);const f=n.outs[0];if(BigInt(f.value)!==e.vaultValue)throw new Error(`Encoded PegIn vault output value ${f.value} does not match the WASM-reported vaultValue ${e.vaultValue}.`);const P=we(t.prePeginParams,t.timelockPegin).toString("hex");if(c.stripHexPrefix(e.vaultScriptPubKey).toLowerCase()!==P)throw new Error(`WASM-reported PegIn vaultScriptPubKey ${e.vaultScriptPubKey} does not match the independently derived payout scriptPubKey ${P}.`);const E=f.script.toString("hex");if(E!==P)throw new Error(`Encoded PegIn vault output scriptPubKey ${E} does not match the independently derived payout scriptPubKey ${P}.`);const g=n.getId();if(g!==c.stripHexPrefix(e.txid).toLowerCase())throw new Error(`Encoded PegIn txid ${g} does not match the WASM-reported txid ${e.txid}.`);const S=await v.computeMinClaimValue(r,t.prePeginParams.numLocalChallengers,t.prePeginParams.universalChallengerPubkeys.length,t.prePeginParams.councilQuorum,t.prePeginParams.councilSize,t.prePeginParams.feeRate),y=n.outs[ne];if(BigInt(y.value)!==S)throw new Error(`Encoded PegIn depositor-claim output value ${y.value} does not match the independently computed claim value ${S} for vaultCoreVersion ${r}.`);const w=se(t.prePeginParams.depositorPubkey);if(!y.script.equals(w))throw new Error(`Encoded PegIn depositor-claim output scriptPubKey ${y.script.toString("hex")} does not pay to the depositor's claim script (expected ${w.toString("hex")}).`)}async function ue(e){const t=await v.createPayoutConnector({txGraphVersion:e.vaultCoreVersion,depositor:e.depositor,vaultProvider:e.vaultProvider,vaultKeepers:e.vaultKeepers,universalChallengers:e.universalChallengers,timelockPegin:e.timelockPegin},e.network);return{payoutScript:t.payoutScript,taprootScriptHash:t.taprootScriptHash,scriptPubKey:t.scriptPubKey,address:t.address,payoutControlBlock:t.payoutControlBlock}}const F=253,Ce=254,Ie=65535,be=4294967295,Te="TapLeaf",Ae="TapBranch",ke="TapTweak",T=33,A=32,q=128,Oe=1,Re=254,Le=a.Buffer.from([81,32]);function Ve(e){if(e<F)return a.Buffer.from([e]);if(e<=Ie){const t=a.Buffer.alloc(2);return t.writeUInt16LE(e),a.Buffer.concat([a.Buffer.from([F]),t])}if(e<=be){const t=a.Buffer.alloc(4);return t.writeUInt32LE(e),a.Buffer.concat([a.Buffer.from([Ce]),t])}throw new Error(`Script too large to encode as CompactSize: ${e} bytes`)}function N(e,t){const r=a.Buffer.concat([a.Buffer.from([e]),Ve(t.length),a.Buffer.from(t)]);return l.crypto.taggedHash(Te,r)}function He(e){const{leafVersion:t,script:r,controlBlock:o}=e,i=o.length-T;if(i<0||i%A!==0||i/A>q)throw new Error(`Malformed Taproot control block: length ${o.length} must be ${T} + 32*m with 0 <= m <= ${q}`);const s=o[0]&Re;if(s!==t)throw new Error(`Taproot control block leaf version 0x${s.toString(16)} does not match the tapLeafScript leaf version 0x${t.toString(16)}`);const n=a.Buffer.from(o.subarray(1,T));let u=N(t,r);for(let P=T;P<o.length;P+=A){const E=a.Buffer.from(o.subarray(P,P+A));u=l.crypto.taggedHash(Ae,a.Buffer.compare(u,E)<=0?a.Buffer.concat([u,E]):a.Buffer.concat([E,u]))}const d=l.crypto.taggedHash(ke,a.Buffer.concat([n,u])),p=ee.xOnlyPointAddTweak(n,d);if(p===null)throw new Error("Taproot control block does not yield a valid output key (tweak is off-curve)");const f=o[0]&Oe;if(p.parity!==f)throw new Error(`Taproot output key parity ${p.parity} contradicts the control block's parity bit ${f}`);return a.Buffer.concat([Le,a.Buffer.from(p.xOnlyPubkey)])}const Ne=256,Be=1500,X=256,G=0xffffffffn,Ue=500,Ke=55,Me=34;function ce(e){if(typeof e.protocolFeeRate!="bigint"||e.protocolFeeRate<=0n||e.protocolFeeRate>G)throw new Error(`protocolFeeRate must be in [1, ${G}] sat/vB, got ${e.protocolFeeRate}`);for(const[t,r,o,i]of[["keepers",e.numVaultKeepers,Ne,"fee-floor model limit"],["challengers",e.numUniversalChallengers,Be,"protocol maximum"]])if(!Number.isInteger(r)||r<1||r>o)throw new Error(`Participant count for ${t} (${r}) is outside the supported range [1, ${o}]${r>o?` (${i})`:""}.`);if(!Number.isInteger(e.councilSize)||e.councilSize<1||e.councilSize>X)throw new Error(`councilSize must be an integer in [1, ${X}], got ${e.councilSize}`)}async function ae(e,t){const{implicitFeeSats:r,out0Len:o,out1Len:i}=t,s=e.numVaultKeepers+e.numUniversalChallengers,n=BigInt(r),u=Math.max(0,o-Me),d=Ue+Ke*s+u,p=e.protocolFeeRate*BigInt(d);if(n>p)throw new Error(`Payout implicit fee ${r} sats exceeds the safety cap of ${p} sats (${e.protocolFeeRate} sat/vB x ${d} vB for ${s} participants); refusing to sign payout.`);const f=await v.computePayoutFeeFloor(e.vaultCoreVersion,e.numVaultKeepers,e.numUniversalChallengers,e.numVaultKeepers,e.councilSize,o,i,e.protocolFeeRate);if(n<f)throw new Error(`Payout implicit fee ${r} sats is below the floor of ${f} sats (the smallest fee any known vault-provider build produces for this shape); refusing to sign payout.`)}const Fe=22,qe=34,Xe=34,Ge=25,We=23;function Ye(e){return e.length===Fe*2&&e.startsWith("0014")}function De(e){return e.length===qe*2&&e.startsWith("0020")}function ze(e){return e.length===Xe*2&&e.startsWith("5120")}function Qe(e){return e.length===Ge*2&&e.startsWith("76a914")&&e.endsWith("88ac")}function Ze(e){return e.length===We*2&&e.startsWith("a914")&&e.endsWith("87")}function W(e,t){const r=c.stripHexPrefix(e).toLowerCase();if(r.length===0)throw new Error(`${t} is empty`);if(!/^[0-9a-f]+$/.test(r)||r.length%2!==0)throw new Error(`${t} is not valid hex`);if(r.startsWith("6a"))throw new Error(`${t} is an OP_RETURN output, which is provably unspendable`);if(!ze(r)&&!Ye(r)&&!De(r)&&!Qe(r)&&!Ze(r))throw new Error(`${t} is not a standard scriptPubKey (expected P2TR, P2WPKH, P2WSH, P2PKH, or P2SH; got ${r.length/2} bytes: ${r})`)}const Y=3;async function je(e){const t={vaultCoreVersion:e.vaultCoreVersion,numVaultKeepers:e.vaultKeeperBtcPubkeys.length,numUniversalChallengers:e.universalChallengerBtcPubkeys.length,councilSize:e.councilMembers.length,protocolFeeRate:e.protocolFeeRate};ce(t);const r=l.Transaction.fromHex(c.stripHexPrefix(e.payoutTxHex)),o=l.Transaction.fromHex(c.stripHexPrefix(e.peginTxHex)),i=l.Transaction.fromHex(c.stripHexPrefix(e.assertTxHex));if(r.ins.length!==h.DEPOSITOR_PAYOUT_INPUT_COUNT)throw new Error(`Payout transaction must have exactly ${h.DEPOSITOR_PAYOUT_INPUT_COUNT} inputs, got ${r.ins.length}`);if(r.version!==h.PAYOUT_TX_VERSION)throw new Error(`Payout transaction version ${r.version} must be ${h.PAYOUT_TX_VERSION}; refusing to sign payout.`);if(r.locktime!==h.PAYOUT_TX_LOCKTIME)throw new Error(`Payout transaction locktime ${r.locktime} must be ${h.PAYOUT_TX_LOCKTIME}; refusing to sign payout.`);const s=D(r.ins[0],0,o,"PegIn",h.PEGIN_VAULT_OUTPUT_INDEX);if(r.ins[0].sequence!==e.timelockPegin)throw new Error(`Payout input 0 sequence ${r.ins[0].sequence} must equal the PegIn CSV timelock ${e.timelockPegin}; refusing to sign payout.`);const n=D(r.ins[1],1,i,"Assert",h.ASSERT_PAYOUT_OUTPUT_INDEX);if(r.ins[1].sequence!==e.timelockAssert)throw new Error(`Payout input 1 sequence ${r.ins[1].sequence} must equal the Assert CSV timelock ${e.timelockAssert}; refusing to sign payout.`);const{out0Len:u,out1Len:d}=tt(r,s.value,e),p=s.value+n.value;let f=0;for(const S of r.outs)f+=S.value;if(f>p)throw new Error(`Payout outputs (${f} sats) exceed inputs (${p} sats); invalid transaction.`);const P=p-f;await ae(t,{implicitFeeSats:P,out0Len:u,out1Len:d});const E=await ue({vaultCoreVersion:e.vaultCoreVersion,depositor:e.depositorBtcPubkey,vaultProvider:e.vaultProviderBtcPubkey,vaultKeepers:e.vaultKeeperBtcPubkeys,universalChallengers:e.universalChallengerBtcPubkeys,timelockPegin:e.timelockPegin,network:e.network}),g=await Je(e,n);return{psbtHex:et(r,s,n,E,g)}}async function Je(e,t){const{payoutScript:r,payoutControlBlock:o}=await v.getAssertPayoutScriptInfo({txGraphVersion:e.vaultCoreVersion,claimer:c.stripHexPrefix(e.claimerBtcPubkey).toLowerCase(),localChallengers:te({claimerBtcPubkey:e.claimerBtcPubkey,depositorBtcPubkey:e.depositorBtcPubkey,vaultProviderBtcPubkey:e.vaultProviderBtcPubkey,vaultKeeperBtcPubkeys:e.vaultKeeperBtcPubkeys}),universalChallengers:e.universalChallengerBtcPubkeys.map(u=>c.stripHexPrefix(u).toLowerCase()),timelockAssert:e.timelockAssert,councilMembers:e.councilMembers.map(u=>c.stripHexPrefix(u).toLowerCase()),councilQuorum:e.councilQuorum}),i=c.hexToUint8Array(r),s=c.hexToUint8Array(o),n=He({leafVersion:c.TAPSCRIPT_LEAF_VERSION,script:i,controlBlock:s});if(!t.script.equals(n))throw new Error(`Rebuilt Assert:0 payout leaf does not spend the Assert output being referenced: leaf binds to ${n.toString("hex")}, Assert:${h.ASSERT_PAYOUT_OUTPUT_INDEX} pays ${t.script.toString("hex")}; refusing to sign payout.`);return{script:i,controlBlock:s}}function D(e,t,r,o,i){const s=c.uint8ArrayToHex(new Uint8Array(e.hash).slice().reverse()),n=r.getId();if(s!==n||e.index!==i)throw new Error(`Input ${t} must spend ${o}:${i}. Expected ${n}:${i}, got ${s}:${e.index}`);const u=r.outs[e.index];if(!u)throw new Error(`Previous output not found for input ${t} (txid: ${s}, index: ${e.index})`);return u}function et(e,t,r,o,i){const s=new l.Psbt;s.setVersion(e.version),s.setLocktime(e.locktime);const[n,u]=e.ins;s.addInput({hash:n.hash,index:n.index,sequence:n.sequence,witnessUtxo:{script:t.script,value:t.value},tapLeafScript:[{leafVersion:c.TAPSCRIPT_LEAF_VERSION,script:a.Buffer.from(c.hexToUint8Array(o.payoutScript)),controlBlock:a.Buffer.from(c.hexToUint8Array(o.payoutControlBlock))}],tapInternalKey:a.Buffer.from(v.tapInternalPubkey)}),s.addInput({hash:u.hash,index:u.index,sequence:u.sequence,witnessUtxo:{script:r.script,value:r.value},tapLeafScript:[{leafVersion:c.TAPSCRIPT_LEAF_VERSION,script:a.Buffer.from(i.script),controlBlock:a.Buffer.from(i.controlBlock)}],tapInternalKey:a.Buffer.from(v.tapInternalPubkey)});for(const d of e.outs)s.addOutput({script:d.script,value:d.value});return s.toHex()}function z(e,t){const r=c.stripHexPrefix(e).toLowerCase(),o=c.stripHexPrefix(c.deriveBip86ScriptPubKeyHex(t)).toLowerCase();return r===o?[r]:[r,o]}function Q(e,t){return t.some(r=>e.equals(a.Buffer.from(r,"hex")))}function tt(e,t,r){const{claimerBtcPubkey:o,vaultProviderBtcPubkey:i,depositorBtcPubkey:s,vaultKeeperBtcPubkeys:n,registeredPayoutScriptPubKey:u,commissionBps:d,vkClaimerPayoutScriptPubKeys:p,vpCommissionScriptPubKey:f}=r;if(!c.isValidHex(u))throw new Error("Invalid registeredPayoutScriptPubKey: not valid hex");const P=c.stripHexPrefix(o).toLowerCase(),E=c.stripHexPrefix(i).toLowerCase(),g=c.stripHexPrefix(s).toLowerCase(),S=n.map($=>c.stripHexPrefix($).toLowerCase());let y,w,_;if(P===E)y="vp-claimer",w=h.VP_CLAIMER_PAYOUT_OUTPUT_COUNT,_=[c.stripHexPrefix(u)];else if(P===g)y="depositor-as-claimer",w=h.NON_VP_CLAIMER_PAYOUT_OUTPUT_COUNT,_=[c.stripHexPrefix(u)];else if(S.includes(P)){y="vk-claimer",w=h.NON_VP_CLAIMER_PAYOUT_OUTPUT_COUNT;const $=p[P];if($===void 0)throw new Error(`No registered payout script resolved for vault keeper claimer ${P}`);W($,`Vault keeper payout script for claimer ${P}`),_=z($,P)}else throw new Error(`Unknown claimer pubkey ${P}: not VP, depositor, or a registered vault keeper`);if(e.outs.length!==w)throw new Error(`Payout transaction has ${e.outs.length} output(s), expected exactly ${w} for role ${y}.`);if(!Q(e.outs[0].script,_))throw new Error(`Payout transaction output 0 does not pay the expected scriptPubKey for role ${y}. Accepted: ${_.join(" or ")}; got ${e.outs[0].script.toString("hex")}`);const L=w-1;if(e.outs[L].value!==h.PAYOUT_ANCHOR_DUST_SATS)throw new Error(`Payout CPFP anchor (out ${L}) value ${e.outs[L].value} sats must equal ${h.PAYOUT_ANCHOR_DUST_SATS} sats`);if(y==="vp-claimer"){W(f,"Vault provider commission payout script");const $=z(f,E);if(!Q(e.outs[1].script,$))throw new Error(`Payout transaction output 1 does not pay the vault provider's commission scriptPubKey. Accepted: ${$.join(" or ")}; got ${e.outs[1].script.toString("hex")}`);if(!Number.isInteger(d)||d<0||d>=h.MAX_VP_COMMISSION_BPS_EXCLUSIVE)throw new Error(`commissionBps must be an integer in [0, ${h.MAX_VP_COMMISSION_BPS_EXCLUSIVE}), got ${d}`);const B=Math.floor(t*d/h.BPS_DENOMINATOR);if(e.outs[1].value>B)throw new Error(`Payout VP commission (out 1) value ${e.outs[1].value} sats exceeds cap ${B} sats (${d} bps of peginValue=${t})`)}const b=e.outs[0].script.length;if(b===0||b>h.MAX_PAYOUT_SCRIPT_LEN)throw new Error(`Payout receiver scriptPubKey length ${b} is outside the contract's registration cap [1, ${h.MAX_PAYOUT_SCRIPT_LEN}]; refusing to sign payout.`);const le=y==="vp-claimer"?e.outs[1].script.length:void 0;return{out0Len:b,out1Len:le}}function rt(e,t,r=0){const o=l.Psbt.fromHex(e);if(r>=o.data.inputs.length)throw new Error(`Input index ${r} out of range (${o.data.inputs.length} inputs)`);const i=o.data.inputs[r];if(i.tapScriptSig&&i.tapScriptSig.length>0){const s=c.hexToUint8Array(t);for(const n of i.tapScriptSig)if(n.pubkey.equals(a.Buffer.from(s)))return Z(n.signature,r);throw new Error(`No signature found for depositor pubkey: ${t} at input ${r}`)}if(i.finalScriptWitness&&i.finalScriptWitness.length>0){const s=ot(i.finalScriptWitness);if(s.length!==Y)throw new Error(`Unexpected finalized witness stack size at input ${r}: expected ${Y} items (signature, script, controlBlock), got ${s.length}`);return Z(s[0],r)}throw new Error(`No tapScriptSig or finalScriptWitness found in signed PSBT at input ${r}`)}function Z(e,t){if(e.length===64)return c.uint8ArrayToHex(new Uint8Array(e));throw e.length===65?new Error(`Unexpected sighash byte 0x${e[64].toString(16).padStart(2,"0")} at input ${t}. Expected implicit SIGHASH_DEFAULT as a 64-byte signature.`):new Error(`Unexpected signature length at input ${t}: ${e.length}`)}function ot(e){const t=[];let r=0;const o=n=>{if(r+n>e.length)throw new Error(`Malformed witness data: need ${n} byte(s) at offset ${r}, only ${e.length-r} remaining`)},i=()=>{o(1);const n=e[r++];if(n<253)return n;if(n===253){o(2);const u=(e[r]|e[r+1]<<8)>>>0;return r+=2,u}if(n===254){o(4);const u=(e[r]|e[r+1]<<8|e[r+2]<<16|e[r+3]<<24)>>>0;return r+=4,u}throw new Error(`Malformed witness data: 8-byte varint (0xff) not supported at offset ${r-1}`)},s=i();for(let n=0;n<s;n++){const u=i();o(u),t.push(a.Buffer.from(e.subarray(r,r+u))),r+=u}if(r!==e.length)throw new Error(`Malformed witness data: ${e.length-r} trailing byte(s) after parsing ${s} item(s)`);return t}class x extends Error{constructor(t){super(`Wallet returned a PSBT for a different transaction: ${t}`),this.name="PsbtSubstitutionError"}}function j(e,t){try{return l.Psbt.fromHex(t)}catch(r){const o=r instanceof Error?r.message:String(r);throw new Error(`Failed to parse ${e} PSBT: ${o}`)}}const nt=8;function V(e){return`${e.toString("hex").slice(0,nt)}…`}function J(e){const t=a.Buffer.from(e).reverse();return V(t)}function it(e){const t=j("requested",e.requestedPsbtHex),r=j("returned",e.returnedPsbtHex);if(t.version!==r.version)throw new x(`tx version differs (requested=${t.version}, returned=${r.version})`);if(t.locktime!==r.locktime)throw new x(`tx locktime differs (requested=${t.locktime}, returned=${r.locktime})`);if(t.txInputs.length!==r.txInputs.length)throw new x(`input count differs (requested=${t.txInputs.length}, returned=${r.txInputs.length})`);if(t.txOutputs.length!==r.txOutputs.length)throw new x(`output count differs (requested=${t.txOutputs.length}, returned=${r.txOutputs.length})`);for(let o=0;o<t.txInputs.length;o++){const i=t.txInputs[o],s=r.txInputs[o];if(!i.hash.equals(s.hash))throw new x(`input ${o} prevout txid differs (requested=${J(i.hash)}, returned=${J(s.hash)})`);if(i.index!==s.index)throw new x(`input ${o} prevout vout differs (requested=${i.index}, returned=${s.index})`);if(i.sequence!==s.sequence)throw new x(`input ${o} sequence differs (requested=${i.sequence}, returned=${s.sequence})`)}for(let o=0;o<t.txOutputs.length;o++){const i=t.txOutputs[o],s=r.txOutputs[o];if(!i.script.equals(s.script))throw new x(`output ${o} scriptPubKey differs (requested=${V(i.script)}, returned=${V(s.script)})`);if(i.value!==s.value)throw new x(`output ${o} value differs (requested=${i.value}, returned=${s.value})`)}}function st(e){const{requestedPsbtHex:t,signatureHex:r,signerXOnlyPubkeyHex:o,inputIndex:i}=e,s=c.stripHexPrefix(r);if(s.length!==c.SCHNORR_SIG_HEX_LEN)throw new Error(`Schnorr signature for input ${i} must be ${c.SCHNORR_SIG_HEX_LEN} hex chars (64 bytes), got ${s.length}.`);const n=c.stripHexPrefix(o);if(n.length!==U.X_ONLY_PUBKEY_HEX_LEN)throw new Error(`Signer x-only pubkey for input ${i} must be ${U.X_ONLY_PUBKEY_HEX_LEN} hex chars (32 bytes), got ${n.length}.`);const u=l.Psbt.fromHex(t);if(i<0||i>=u.data.inputs.length)throw new Error(`Input index ${i} out of range (${u.data.inputs.length} inputs).`);const d=[],p=[];for(let w=0;w<u.data.inputs.length;w++){const _=u.data.inputs[w].witnessUtxo;if(!_)throw new Error(`Cannot verify signature: input ${w} of the requested PSBT has no witnessUtxo (required to recompute the Taproot sighash).`);d.push(_.script),p.push(_.value)}const f=u.data.inputs[i].tapLeafScript;if(!f||f.length!==1)throw new Error(`Cannot verify signature: input ${i} of the requested PSBT must have exactly one tapLeafScript, got ${(f==null?void 0:f.length)??0}.`);const P=f[0];if(P.leafVersion!==c.TAPSCRIPT_LEAF_VERSION)throw new Error(`Cannot verify signature: input ${i} tapLeafScript has leaf version 0x${P.leafVersion.toString(16)}, expected 0x${c.TAPSCRIPT_LEAF_VERSION.toString(16)}.`);const E=N(P.leafVersion,P.script),g=new l.Transaction;g.version=u.version,g.locktime=u.locktime;for(const w of u.txInputs)g.addInput(w.hash,w.index,w.sequence);for(const w of u.txOutputs)g.addOutput(w.script,w.value);const S=g.hashForWitnessV1(i,d,p,l.Transaction.SIGHASH_DEFAULT,E);if(!ee.verifySchnorr(S,c.hexToUint8Array(n),c.hexToUint8Array(s)))throw new Error(`Schnorr signature for input ${i} (signer ${n}) does not verify against the expected Taproot script-path sighash. The wallet may have signed with the tweaked key, signed a different transaction, or returned an invalid signature.`)}exports.HtlcOutputMismatchError=C;exports.PEGIN_DEPOSITOR_CLAIM_VOUT=ne;exports.PsbtSubstitutionError=x;exports.assertEncodedHtlcOutputsMatch=oe;exports.assertPayoutFeeBandDomain=ce;exports.assertPayoutFeeInBand=ae;exports.assertPsbtUnsignedTxMatches=it;exports.assertScriptPathSchnorrSignature=st;exports.buildPayoutPsbt=je;exports.buildPeginTxFromFundedPrePegin=_e;exports.buildPrePeginPsbt=xe;exports.computeNumLocalChallengers=de;exports.computeTapLeafHash=N;exports.createPayoutScript=ue;exports.deriveDepositorClaimDescriptor=ie;exports.deriveDepositorClaimScriptPubKey=se;exports.deriveExpectedPrePeginHtlc=re;exports.deriveLocalChallengers=te;exports.extractPayoutSignature=rt;exports.normalizeAuthAnchorHash=H;
+//# sourceMappingURL=verifyScriptPathSchnorrSignature-D2t1yACC.cjs.map