@babylonlabs-io/ts-sdk 6.2.0 → 6.3.0

package/dist/{primeVpAuth-B0noJdcy.js → primeVpAuth-P-KTmNKb.js}

@@ -1,26 +1,26 @@
 var Q = Object.defineProperty;
-var Z = (t, e, r) => e in t ? Q(t, e, { enumerable: !0, configurable: !0, writable: !0, value: r }) : t[e] = r;
-var u = (t, e, r) => Z(t, typeof e != "symbol" ? e + "" : e, r);
-import { s as b, S as ee, h as re, p as J } from "./bitcoin-C-TuHb-v.js";
-import { V as te } from "./index-B-9aXMxk.js";
+var Z = (r, e, t) => e in r ? Q(r, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : r[e] = t;
+var u = (r, e, t) => Z(r, typeof e != "symbol" ? e + "" : e, t);
+import { s as b, S as ee, h as te, p as J } from "./bitcoin-C-TuHb-v.js";
+import { V as re } from "./index-B-9aXMxk.js";
 import { a as ne } from "./state-CFn1rT74.js";
 import * as V from "@bitcoin-js/tiny-secp256k1-asmjs";
 import { X as k, H as _, C as D } from "./validation-OSC0xTHB.js";
 import { v as ie } from "./bip322Verify-BXYrHBh8.js";
 import { s as se } from "./sha2-YqVHJiFj.js";
-function S(t, e) {
-  const r = (t & 7) << 5, n = typeof e == "bigint" ? e : BigInt(e);
+function S(r, e) {
+  const t = (r & 7) << 5, n = typeof e == "bigint" ? e : BigInt(e);
   if (n < 0n) throw new Error("cborHead: negative argument");
-  if (n < 24n) return new Uint8Array([r | Number(n)]);
-  if (n < 0x100n) return new Uint8Array([r | 24, Number(n)]);
+  if (n < 24n) return new Uint8Array([t | Number(n)]);
+  if (n < 0x100n) return new Uint8Array([t | 24, Number(n)]);
   if (n < 0x10000n) {
     const i = Number(n);
-    return new Uint8Array([r | 25, i >>> 8 & 255, i & 255]);
+    return new Uint8Array([t | 25, i >>> 8 & 255, i & 255]);
   }
   if (n < 0x100000000n) {
     const i = Number(n);
     return new Uint8Array([
-      r | 26,
+      t | 26,
       i >>> 24 & 255,
       i >>> 16 & 255,
       i >>> 8 & 255,
@@ -28,124 +28,124 @@ function S(t, e) {
     ]);
   }
   const s = new Uint8Array(9);
-  s[0] = r | 27;
+  s[0] = t | 27;
   for (let i = 7; i >= 0; i--)
     s[1 + i] = Number(n >> BigInt((7 - i) * 8)) & 255;
   return s;
 }
-function j(...t) {
-  const e = t.reduce((s, i) => s + i.length, 0), r = new Uint8Array(e);
+function j(...r) {
+  const e = r.reduce((s, i) => s + i.length, 0), t = new Uint8Array(e);
   let n = 0;
-  for (const s of t)
-    r.set(s, n), n += s.length;
-  return r;
+  for (const s of r)
+    t.set(s, n), n += s.length;
+  return t;
 }
-function I(t) {
-  const r = [S(4, t.length)];
-  for (const n of t)
-    r.push(S(0, n));
-  return j(...r);
+function I(r) {
+  const t = [S(4, r.length)];
+  for (const n of r)
+    t.push(S(0, n));
+  return j(...t);
 }
-function oe(t, e, r) {
-  if (!Number.isSafeInteger(r) || r < 0)
+function oe(r, e, t) {
+  if (!Number.isSafeInteger(t) || t < 0)
     throw new Error(
-      `encodeServerIdentityPayload: expires_at must be a non-negative safe integer, got ${r}`
+      `encodeServerIdentityPayload: expires_at must be a non-negative safe integer, got ${t}`
     );
-  const n = S(4, 3), s = I(t), i = I(e), o = S(0, r);
+  const n = S(4, 3), s = I(r), i = I(e), o = S(0, t);
   return j(n, s, i, o);
 }
-const ae = new TextEncoder().encode(
+const ce = new TextEncoder().encode(
   "btc-auth.server-identity.v1"
-), ce = 2 * 3600;
-class p extends Error {
-  constructor(e, r) {
-    super(e), this.reason = r, this.name = "ServerIdentityError";
+), ae = 2 * 3600;
+class h extends Error {
+  constructor(e, t) {
+    super(e), this.reason = t, this.name = "ServerIdentityError";
   }
 }
-function v(t) {
-  const e = new Uint8Array(t.length / 2);
-  for (let r = 0; r < e.length; r++)
-    e[r] = parseInt(t.slice(r * 2, r * 2 + 2), 16);
+function v(r) {
+  const e = new Uint8Array(r.length / 2);
+  for (let t = 0; t < e.length; t++)
+    e[t] = parseInt(r.slice(t * 2, t * 2 + 2), 16);
   return e;
 }
-function de(t) {
-  const { proof: e, pinnedServerPubkey: r, now: n } = t, s = t.maxLifetimeSecs ?? ce, i = b(r).toLowerCase();
+function de(r) {
+  const { proof: e, pinnedServerPubkey: t, now: n } = r, s = r.maxLifetimeSecs ?? ae, i = b(t).toLowerCase();
   if (i.length !== k || !_.test(i))
-    throw new p(
+    throw new h(
       `pinnedServerPubkey must be 32-byte hex; got ${i.length} chars`,
       "invalid_pubkey_encoding"
     );
   const o = b(e.server_pubkey).toLowerCase();
   if (o.length !== k || !_.test(o))
-    throw new p(
+    throw new h(
       `server_pubkey must be 32-byte hex; got ${o.length} chars`,
       "invalid_pubkey_encoding"
     );
   if (o !== i)
-    throw new p(
+    throw new h(
       `server_pubkey does not match pinned value: expected ${i}, got ${o}`,
       "pinned_pubkey_mismatch"
     );
   if (!Number.isSafeInteger(e.expires_at))
-    throw new p(
+    throw new h(
       `expires_at must be a finite integer; got ${JSON.stringify(e.expires_at)}`,
       "invalid_expires_at"
     );
   if (!Number.isSafeInteger(n))
-    throw new p(
+    throw new h(
       `now must be a finite integer; got ${JSON.stringify(n)}`,
       "invalid_expires_at"
     );
   if (e.expires_at <= n)
-    throw new p(
+    throw new h(
       `server identity proof expired at ${e.expires_at}, now ${n}`,
       "expired"
     );
   if (!Number.isSafeInteger(s) || s <= 0)
-    throw new p(
+    throw new h(
       `maxLifetimeSecs must be a positive safe integer; got ${JSON.stringify(s)}`,
       "invalid_max_lifetime"
     );
   if (e.expires_at - n > s)
-    throw new p(
+    throw new h(
       `server identity proof expires too far in the future: expires_at=${e.expires_at}, now=${n}, max lifetime=${s}s`,
       "expires_too_far"
     );
-  const c = b(e.ephemeral_pubkey).toLowerCase();
-  if (c.length !== D || !_.test(c))
-    throw new p(
-      `ephemeral_pubkey must be 33-byte compressed hex; got ${c.length} chars`,
+  const a = b(e.ephemeral_pubkey).toLowerCase();
+  if (a.length !== D || !_.test(a))
+    throw new h(
+      `ephemeral_pubkey must be 33-byte compressed hex; got ${a.length} chars`,
       "invalid_ephemeral_pubkey"
     );
-  const y = c.slice(0, 2);
+  const y = a.slice(0, 2);
   if (y !== "02" && y !== "03")
-    throw new p(
+    throw new h(
       `ephemeral_pubkey must be compressed (prefix 02/03); got ${y}`,
       "invalid_ephemeral_pubkey"
     );
-  const l = v(c);
+  const l = v(a);
   if (!V.isPoint(l))
-    throw new p(
+    throw new h(
       "ephemeral_pubkey is not a valid secp256k1 point",
       "invalid_ephemeral_pubkey"
     );
-  const h = b(e.signature).toLowerCase();
-  if (h.length !== ee || !_.test(h))
-    throw new p(
-      `signature must be 64-byte Schnorr hex; got ${h.length} chars`,
+  const p = b(e.signature).toLowerCase();
+  if (p.length !== ee || !_.test(p))
+    throw new h(
+      `signature must be 64-byte Schnorr hex; got ${p.length} chars`,
       "invalid_signature_encoding"
     );
   const f = oe(
-    ae,
-    v(c),
+    ce,
+    v(a),
     e.expires_at
   );
   if (!ie(
     f,
     v(o),
-    v(h)
+    v(p)
   ))
-    throw new p(
+    throw new h(
       "BIP-322 signature verification failed — ephemeral key is not attested by pinned server pubkey",
       "signature_verification_failed"
     );
@@ -154,15 +154,15 @@ const ue = /* @__PURE__ */ new Set([
   "vaultProvider_submitDepositorWotsKey",
   "vaultProvider_submitDepositorPresignatures",
   "vaultProvider_requestDepositorPresignTransactions"
-]), he = /* @__PURE__ */ new Set([
+]), pe = /* @__PURE__ */ new Set([
   "vaultProvider_requestDepositorClaimerArtifacts"
-]), pe = 6e4, C = "auth_createDepositorToken", R = "auth_createDepositorTokenGrpc";
-function F(t, e) {
+]), he = 6e4, C = "auth_createDepositorToken", R = "auth_createDepositorTokenGrpc";
+function F(r, e) {
   return new ne({
-    baseUrl: t,
-    timeout: pe,
+    baseUrl: r,
+    timeout: he,
     headers: e,
-    retryableFor: (r) => r === C || r === R
+    retryableFor: (t) => t === C || t === R
   });
 }
 const le = 0, ye = 1, m = 2, ge = 3, fe = 4, _e = 5, be = 6, we = 7, M = 24, xe = 28, ve = 20, ke = 21, Se = 22, N = 256;
@@ -190,9 +190,9 @@ class K {
    * lengths, tags, or timestamps approach that bound.
    */
   readHead() {
-    const e = this.nextByte(), r = e >> 5, n = e & 31;
+    const e = this.nextByte(), t = e >> 5, n = e & 31;
     if (n < M)
-      return { major: r, arg: n };
+      return { major: t, arg: n };
     if (n >= xe)
       throw new g(
         `unsupported additional info ${n} (indefinite-length or reserved)`
@@ -203,14 +203,14 @@ class K {
       i = i << 8n | BigInt(this.nextByte());
     if (i > BigInt(Number.MAX_SAFE_INTEGER))
       throw new g(`argument ${i} exceeds safe integer range`);
-    return { major: r, arg: Number(i) };
+    return { major: t, arg: Number(i) };
   }
   /** Read `length` raw bytes as a sub-array view into the backing buffer. */
   readBytes(e) {
     if (this.pos + e > this.buf.length)
       throw new g("length overruns end of input");
-    const r = this.buf.subarray(this.pos, this.pos + e);
-    return this.pos += e, r;
+    const t = this.buf.subarray(this.pos, this.pos + e);
+    return this.pos += e, t;
   }
   /**
    * Read a byte string (major type 2), returning its content bytes.
@@ -236,141 +236,141 @@ class K {
       throw new g(
         `nesting exceeds maximum depth ${N}`
       );
-    const r = this.readHead();
-    switch (r.major) {
+    const t = this.readHead();
+    switch (t.major) {
       case le:
-        return r.arg;
+        return t.arg;
       case ye:
-        return -1 - r.arg;
+        return -1 - t.arg;
       case m:
-        return this.readBytes(r.arg);
+        return this.readBytes(t.arg);
       case ge:
         return new TextDecoder("utf-8", { fatal: !0 }).decode(
-          this.readBytes(r.arg)
+          this.readBytes(t.arg)
         );
       case fe: {
         const n = [];
-        for (let s = 0; s < r.arg; s++)
+        for (let s = 0; s < t.arg; s++)
           n.push(this.readValue(e + 1));
         return n;
       }
       case _e: {
         const n = /* @__PURE__ */ new Map();
-        for (let s = 0; s < r.arg; s++) {
+        for (let s = 0; s < t.arg; s++) {
           const i = this.readValue(e + 1), o = this.readValue(e + 1);
           n.set(i, o);
         }
         return n;
       }
       case be:
-        return { tag: r.arg, value: this.readValue(e + 1) };
+        return { tag: t.arg, value: this.readValue(e + 1) };
       case we:
-        if (r.arg === ve) return !1;
-        if (r.arg === ke) return !0;
-        if (r.arg === Se) return null;
+        if (t.arg === ve) return !1;
+        if (t.arg === ke) return !0;
+        if (t.arg === Se) return null;
         throw new g(
-          `unsupported simple/float value ${r.arg}`
+          `unsupported simple/float value ${t.arg}`
         );
       default:
-        throw new g(`unsupported major type ${r.major}`);
+        throw new g(`unsupported major type ${t.major}`);
     }
   }
 }
-function q(t) {
-  const e = new K(t), r = e.readValue();
-  if (e.pos !== t.length)
+function q(r) {
+  const e = new K(r), t = e.readValue();
+  if (e.pos !== r.length)
     throw new g("trailing bytes after top-level item");
-  return r;
+  return t;
 }
 const Ae = "vaultd-jsonrpc", Pe = "vaultd-grpc", L = 18, O = 4, B = -47, me = 1, H = 64, Ee = 128, Te = 96, Ce = 64, Re = 1, Oe = 2, $e = 3, Ie = 4, Me = 5, Ne = 6, Le = 7, G = new TextEncoder().encode("Signature1");
-class a extends Error {
-  constructor(e, r) {
-    super(e), this.reason = r, this.name = "CwtVerificationError";
+class c extends Error {
+  constructor(e, t) {
+    super(e), this.reason = t, this.name = "CwtVerificationError";
   }
 }
-function Be(t) {
+function Be(r) {
   const e = X(
-    t.expectedIssuerXOnlyPubkey,
+    r.expectedIssuerXOnlyPubkey,
     "expectedIssuerXOnlyPubkey"
-  ), r = X(
-    t.expectedAudienceXOnlyPubkey,
+  ), t = X(
+    r.expectedAudienceXOnlyPubkey,
     "expectedAudienceXOnlyPubkey"
-  ), n = Je(t.ephemeralPubkeyHex), s = De(t.token), i = new K(s), o = i.readHead();
+  ), n = Je(r.ephemeralPubkeyHex), s = De(r.token), i = new K(s), o = i.readHead();
   if (o.major !== 6 || o.arg !== L)
-    throw new a(
+    throw new c(
       `token is not a COSE Sign1 tagged value (tag ${L})`,
       "invalid_token_structure"
     );
-  const c = i.readHead();
-  if (c.major !== 4 || c.arg !== O)
-    throw new a(
+  const a = i.readHead();
+  if (a.major !== 4 || a.arg !== O)
+    throw new c(
       `COSE Sign1 must be a ${O}-element array`,
       "invalid_token_structure"
     );
-  const y = i.pos, l = i.readByteString(), h = s.subarray(y, i.pos);
+  const y = i.pos, l = i.readByteString(), p = s.subarray(y, i.pos);
   i.readValue();
   const f = i.pos, w = i.readByteString(), A = s.subarray(f, i.pos), P = i.readByteString();
   if (P.length !== H)
-    throw new a(
+    throw new c(
       `COSE signature must be ${H} bytes, got ${P.length}`,
       "invalid_token_structure"
     );
   if (i.pos !== s.length)
-    throw new a(
+    throw new c(
       "COSE Sign1 token has trailing bytes after the signature",
       "invalid_token_structure"
     );
   const $ = He(l);
   if ($ !== B)
-    throw new a(
+    throw new c(
       `unexpected COSE algorithm ${$} (expected ES256K ${B})`,
       "unexpected_algorithm"
     );
-  const Y = Ge(h, A), z = se(Y);
+  const Y = Ge(p, A), z = se(Y);
   if (!V.verify(z, n, P, !0))
-    throw new a(
+    throw new c(
       "COSE signature does not verify against the server's ephemeral key",
       "signature_verification_failed"
     );
   const d = Xe(w), x = d.audience.toLowerCase();
   if (x.length !== k || !_.test(x))
-    throw new a(
+    throw new c(
       "token `aud` is not a 32-byte x-only pubkey hex",
       "invalid_claims"
     );
   if (d.issuedAt > d.expiresAt)
-    throw new a(
+    throw new c(
       `token iat (${d.issuedAt}) is after exp (${d.expiresAt})`,
       "invalid_claims"
     );
   if (d.issuer.toLowerCase() !== e)
-    throw new a(
+    throw new c(
       `token issuer does not match pinned server pubkey: expected ${e}, got ${d.issuer.toLowerCase()}`,
       "issuer_mismatch"
     );
-  if (d.subject !== t.expectedSubject)
-    throw new a(
-      `token subject mismatch: expected ${t.expectedSubject}, got ${d.subject}`,
+  if (d.subject !== r.expectedSubject)
+    throw new c(
+      `token subject mismatch: expected ${r.expectedSubject}, got ${d.subject}`,
       "subject_mismatch"
     );
-  if (x !== r)
-    throw new a(
-      `token audience does not match depositor pubkey: expected ${r}, got ${x}`,
+  if (x !== t)
+    throw new c(
+      `token audience does not match depositor pubkey: expected ${t}, got ${x}`,
       "audience_mismatch"
     );
-  if (d.expiresAt <= t.now)
-    throw new a(
-      `token expired: exp ${d.expiresAt} <= now ${t.now}`,
+  if (d.expiresAt <= r.now)
+    throw new c(
+      `token expired: exp ${d.expiresAt} <= now ${r.now}`,
       "token_expired"
     );
-  if (t.responseExpiresAt !== d.expiresAt)
-    throw new a(
-      `response expires_at (${t.responseExpiresAt}) does not equal token exp (${d.expiresAt})`,
+  if (r.responseExpiresAt !== d.expiresAt)
+    throw new c(
+      `response expires_at (${r.responseExpiresAt}) does not equal token exp (${d.expiresAt})`,
       "expiry_mismatch"
     );
-  if (t.serverIdentityExpiresAt < d.expiresAt)
-    throw new a(
-      `server identity expires (${t.serverIdentityExpiresAt}) before token exp (${d.expiresAt})`,
+  if (r.serverIdentityExpiresAt < d.expiresAt)
+    throw new c(
+      `server identity expires (${r.serverIdentityExpiresAt}) before token exp (${d.expiresAt})`,
       "server_identity_expires_before_token"
     );
   return {
@@ -382,45 +382,45 @@ function Be(t) {
     issuedAt: d.issuedAt
   };
 }
-function He(t) {
-  if (t.length === 0)
-    throw new a(
+function He(r) {
+  if (r.length === 0)
+    throw new c(
       "empty COSE protected header (no algorithm)",
       "unexpected_algorithm"
     );
-  const e = q(t);
+  const e = q(r);
   if (!(e instanceof Map))
-    throw new a(
+    throw new c(
       "COSE protected header is not a map",
       "invalid_token_structure"
     );
-  const r = e.get(me);
-  if (typeof r != "number")
-    throw new a(
+  const t = e.get(me);
+  if (typeof t != "number")
+    throw new c(
       "COSE protected header missing integer algorithm label",
       "unexpected_algorithm"
     );
-  return r;
+  return t;
 }
-function Ge(t, e) {
+function Ge(r, e) {
   return je(
     Uint8Array.of(Ee | O),
     Uint8Array.of(Te | G.length),
     G,
-    t,
+    r,
     Uint8Array.of(Ce),
     e
   );
 }
-function Xe(t) {
-  const e = q(t);
+function Xe(r) {
+  const e = q(r);
   if (!(e instanceof Map))
-    throw new a(
+    throw new c(
       "CWT claims root is not a map",
       "invalid_claims"
     );
   if (Ue(e, Le, "cti").length === 0)
-    throw new a("token cti is empty", "invalid_claims");
+    throw new c("token cti is empty", "invalid_claims");
   return {
     issuer: E(e, Re, "iss"),
     subject: E(e, Oe, "sub"),
@@ -430,93 +430,93 @@ function Xe(t) {
     issuedAt: T(e, Ne, "iat")
   };
 }
-function E(t, e, r) {
-  const n = t.get(e);
+function E(r, e, t) {
+  const n = r.get(e);
   if (typeof n != "string")
-    throw new a(
-      `token claim ${r} is missing or not a text string`,
+    throw new c(
+      `token claim ${t} is missing or not a text string`,
       "invalid_claims"
     );
   return n;
 }
-function Ue(t, e, r) {
-  const n = t.get(e);
+function Ue(r, e, t) {
+  const n = r.get(e);
   if (!(n instanceof Uint8Array))
-    throw new a(
-      `token claim ${r} is missing or not a byte string`,
+    throw new c(
+      `token claim ${t} is missing or not a byte string`,
       "invalid_claims"
     );
   return n;
 }
-function T(t, e, r) {
-  const n = t.get(e);
+function T(r, e, t) {
+  const n = r.get(e);
   if (typeof n != "number" || !Number.isSafeInteger(n) || n < 0)
-    throw new a(
-      `token claim ${r} is missing or not a non-negative integer timestamp`,
+    throw new c(
+      `token claim ${t} is missing or not a non-negative integer timestamp`,
       "invalid_claims"
     );
   return n;
 }
-function X(t, e) {
-  const r = b(t).toLowerCase();
-  if (r.length !== k || !_.test(r))
-    throw new a(
-      `${e} must be 32-byte x-only hex; got ${r.length} chars`,
+function X(r, e) {
+  const t = b(r).toLowerCase();
+  if (t.length !== k || !_.test(t))
+    throw new c(
+      `${e} must be 32-byte x-only hex; got ${t.length} chars`,
       "invalid_input"
     );
-  return r;
+  return t;
 }
-function Je(t) {
-  const e = b(t).toLowerCase(), r = e.slice(0, 2);
-  if (e.length !== D || !_.test(e) || r !== "02" && r !== "03")
-    throw new a(
+function Je(r) {
+  const e = b(r).toLowerCase(), t = e.slice(0, 2);
+  if (e.length !== D || !_.test(e) || t !== "02" && t !== "03")
+    throw new c(
       "ephemeralPubkeyHex must be 33-byte compressed pubkey hex (prefix 02/03)",
       "invalid_input"
     );
-  return re(e);
+  return te(e);
 }
 const Ve = (() => {
-  const t = new Int16Array(128).fill(-1), e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-  for (let r = 0; r < e.length; r++)
-    t[e.charCodeAt(r)] = r;
-  return t;
+  const r = new Int16Array(128).fill(-1), e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+  for (let t = 0; t < e.length; t++)
+    r[e.charCodeAt(t)] = t;
+  return r;
 })();
-function De(t) {
-  const e = t.length, r = Math.floor(e / 4), n = e % 4;
+function De(r) {
+  const e = r.length, t = Math.floor(e / 4), n = e % 4;
   if (n === 1)
-    throw new a(
+    throw new c(
       "invalid base64url length",
       "invalid_token_structure"
     );
-  const s = r * 3 + (n === 0 ? 0 : n - 1), i = new Uint8Array(s), o = (l) => {
-    const h = l < 128 ? Ve[l] : -1;
-    if (h < 0)
-      throw new a(
+  const s = t * 3 + (n === 0 ? 0 : n - 1), i = new Uint8Array(s), o = (l) => {
+    const p = l < 128 ? Ve[l] : -1;
+    if (p < 0)
+      throw new c(
         "invalid base64url character",
         "invalid_token_structure"
       );
-    return h;
+    return p;
   };
-  let c = 0, y = 0;
-  for (let l = 0; l < r; l++) {
-    const h = o(t.charCodeAt(c++)), f = o(t.charCodeAt(c++)), w = o(t.charCodeAt(c++)), A = o(t.charCodeAt(c++));
-    i[y++] = h << 2 | f >> 4, i[y++] = (f & 15) << 4 | w >> 2, i[y++] = (w & 3) << 6 | A;
+  let a = 0, y = 0;
+  for (let l = 0; l < t; l++) {
+    const p = o(r.charCodeAt(a++)), f = o(r.charCodeAt(a++)), w = o(r.charCodeAt(a++)), A = o(r.charCodeAt(a++));
+    i[y++] = p << 2 | f >> 4, i[y++] = (f & 15) << 4 | w >> 2, i[y++] = (w & 3) << 6 | A;
   }
   if (n === 2) {
-    const l = o(t.charCodeAt(c++)), h = o(t.charCodeAt(c++));
-    i[y++] = l << 2 | h >> 4;
+    const l = o(r.charCodeAt(a++)), p = o(r.charCodeAt(a++));
+    i[y++] = l << 2 | p >> 4;
   } else if (n === 3) {
-    const l = o(t.charCodeAt(c++)), h = o(t.charCodeAt(c++)), f = o(t.charCodeAt(c++));
-    i[y++] = l << 2 | h >> 4, i[y++] = (h & 15) << 4 | f >> 2;
+    const l = o(r.charCodeAt(a++)), p = o(r.charCodeAt(a++)), f = o(r.charCodeAt(a++));
+    i[y++] = l << 2 | p >> 4, i[y++] = (p & 15) << 4 | f >> 2;
   }
   return i;
 }
-function je(...t) {
-  const e = t.reduce((s, i) => s + i.length, 0), r = new Uint8Array(e);
+function je(...r) {
+  const e = r.reduce((s, i) => s + i.length, 0), t = new Uint8Array(e);
   let n = 0;
-  for (const s of t)
-    r.set(s, n), n += s.length;
-  return r;
+  for (const s of r)
+    t.set(s, n), n += s.length;
+  return t;
 }
 const U = 4102444800, Fe = 30;
 class Ke {
@@ -564,6 +564,15 @@ class Ke {
   async getToken(e) {
     return e === C || e === R ? null : this.grpcGatedMethods.has(e) ? this.getTokenForSubject("grpc") : this.authGatedMethods.has(e) ? this.getTokenForSubject("jsonrpc") : null;
   }
+  /**
+   * Return the JSON-RPC-subject bearer (`auth_createDepositorToken`).
+   *
+   * For VP routes that are not JSON-RPC methods but accept this bearer,
+   * such as the HTTP depositor artifact downloads.
+   */
+  getJsonRpcToken() {
+    return this.getTokenForSubject("jsonrpc");
+  }
   /**
    * Drop both cached tokens. Next `getToken` call re-acquires the slot
    * that's actually needed. Called by `JsonRpcClient` on wire
@@ -578,8 +587,8 @@ class Ke {
     this.cachedJsonRpc = null, this.cachedGrpc = null;
   }
   async getTokenForSubject(e) {
-    const r = e === "grpc" ? this.cachedGrpc : this.cachedJsonRpc;
-    return r && this.now() + this.refreshSkewSecs < r.expiresAt ? r.token : (await this.acquireSingleFlight(e)).token;
+    const t = e === "grpc" ? this.cachedGrpc : this.cachedJsonRpc;
+    return t && this.now() + this.refreshSkewSecs < t.expiresAt ? t.token : (await this.acquireSingleFlight(e)).token;
   }
   /**
    * Swap in a different transport for subsequent token-issuing calls.
@@ -597,8 +606,8 @@ class Ke {
     return e === "grpc" ? this.grpcPinnedServerPubkey : this.jsonRpcPinnedServerPubkey;
   }
   acquireSingleFlight(e) {
-    const r = e === "grpc" ? this.inFlightGrpc : this.inFlightJsonRpc;
-    if (r) return r;
+    const t = e === "grpc" ? this.inFlightGrpc : this.inFlightJsonRpc;
+    if (t) return t;
     const n = e === "grpc" ? R : C, s = (async () => {
       try {
         const i = await this.acquireAndVerify(e, n, !0);
@@ -609,8 +618,8 @@ class Ke {
     })();
     return e === "grpc" ? this.inFlightGrpc = s : this.inFlightJsonRpc = s, s;
   }
-  async acquireAndVerify(e, r, n) {
-    const s = await this.client.call(r, {
+  async acquireAndVerify(e, t, n) {
+    const s = await this.client.call(t, {
       pegin_txid: this.peginTxid,
       auth_anchor: this.authAnchorHex
     }), i = this.getPinnedServerPubkey(e);
@@ -643,16 +652,16 @@ class Ke {
       };
     } catch (o) {
       if (n && e === "jsonrpc" && this.refreshJsonRpcPinnedServerPubkey && qe(o)) {
-        const c = await this.refreshJsonRpcPinnedServerPubkey();
-        if (c !== this.jsonRpcPinnedServerPubkey)
-          return this.jsonRpcPinnedServerPubkey = c, this.acquireAndVerify(e, r, !1);
+        const a = await this.refreshJsonRpcPinnedServerPubkey();
+        if (a !== this.jsonRpcPinnedServerPubkey)
+          return this.jsonRpcPinnedServerPubkey = a, this.acquireAndVerify(e, t, !1);
       }
       throw o;
     }
   }
 }
-function qe(t) {
-  return t instanceof p && t.reason === "pinned_pubkey_mismatch" || t instanceof a && t.reason === "issuer_mismatch";
+function qe(r) {
+  return r instanceof h && r.reason === "pinned_pubkey_mismatch" || r instanceof c && r.reason === "issuer_mismatch";
 }
 class We {
   constructor() {
@@ -667,33 +676,33 @@ class We {
    * `VpTokenProvider` through its chain-backed refresh callback.
    */
   getOrCreate(e) {
-    const r = this.entries.get(e.peginTxid);
-    if (r) {
-      if (r.authAnchorHex !== e.authAnchorHex)
+    const t = this.entries.get(e.peginTxid);
+    if (t) {
+      if (t.authAnchorHex !== e.authAnchorHex)
         throw new Error(
-          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to authAnchorHex ${r.authAnchorHex.slice(0, 8)}…; got ${e.authAnchorHex.slice(0, 8)}…`
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to authAnchorHex ${t.authAnchorHex.slice(0, 8)}…; got ${e.authAnchorHex.slice(0, 8)}…`
         );
-      if (r.providerAddress.toLowerCase() !== e.providerAddress.toLowerCase())
+      if (t.providerAddress.toLowerCase() !== e.providerAddress.toLowerCase())
         throw new Error(
-          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to providerAddress ${r.providerAddress}; got ${e.providerAddress}`
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to providerAddress ${t.providerAddress}; got ${e.providerAddress}`
         );
-      if (r.provider.getPinnedServerPubkey("jsonrpc") !== e.pinnedServerPubkey)
+      if (t.provider.getPinnedServerPubkey("jsonrpc") !== e.pinnedServerPubkey)
         throw new Error(
-          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to JSON-RPC pinnedServerPubkey ${r.provider.getPinnedServerPubkey("jsonrpc").slice(0, 8)}…; got ${e.pinnedServerPubkey.slice(0, 8)}…`
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to JSON-RPC pinnedServerPubkey ${t.provider.getPinnedServerPubkey("jsonrpc").slice(0, 8)}…; got ${e.pinnedServerPubkey.slice(0, 8)}…`
         );
-      if (r.provider.getPinnedServerPubkey("grpc") !== e.grpcPinnedServerPubkey)
+      if (t.provider.getPinnedServerPubkey("grpc") !== e.grpcPinnedServerPubkey)
         throw new Error(
-          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to gRPC pinnedServerPubkey ${r.provider.getPinnedServerPubkey("grpc").slice(0, 8)}…; got ${e.grpcPinnedServerPubkey.slice(0, 8)}…`
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to gRPC pinnedServerPubkey ${t.provider.getPinnedServerPubkey("grpc").slice(0, 8)}…; got ${e.grpcPinnedServerPubkey.slice(0, 8)}…`
         );
-      if (r.grpcKeyEpoch !== e.grpcKeyEpoch)
+      if (t.grpcKeyEpoch !== e.grpcKeyEpoch)
         throw new Error(
-          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to gRPC key epoch ${r.grpcKeyEpoch.toString()}; got ${e.grpcKeyEpoch.toString()}`
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to gRPC key epoch ${t.grpcKeyEpoch.toString()}; got ${e.grpcKeyEpoch.toString()}`
         );
-      if (r.expectedAudienceXOnlyPubkey.toLowerCase() !== e.expectedAudienceXOnlyPubkey.toLowerCase())
+      if (t.expectedAudienceXOnlyPubkey.toLowerCase() !== e.expectedAudienceXOnlyPubkey.toLowerCase())
         throw new Error(
-          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to expectedAudienceXOnlyPubkey ${r.expectedAudienceXOnlyPubkey.slice(0, 8)}…; got ${e.expectedAudienceXOnlyPubkey.slice(0, 8)}…`
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to expectedAudienceXOnlyPubkey ${t.expectedAudienceXOnlyPubkey.slice(0, 8)}…; got ${e.expectedAudienceXOnlyPubkey.slice(0, 8)}…`
         );
-      return r.provider.setClient(e.client), r.provider;
+      return t.provider.setClient(e.client), t.provider;
     }
     const n = new Ke({
       client: e.client,
@@ -704,7 +713,7 @@ class We {
       refreshJsonRpcPinnedServerPubkey: e.refreshJsonRpcPinnedServerPubkey,
       expectedAudienceXOnlyPubkey: e.expectedAudienceXOnlyPubkey,
       authGatedMethods: ue,
-      grpcGatedMethods: he
+      grpcGatedMethods: pe
     });
     return this.entries.set(e.peginTxid, {
       provider: n,
@@ -721,17 +730,17 @@ class We {
    * depositor request.
    */
   peek(e) {
-    const r = this.entries.get(e.peginTxid);
-    if (r) {
-      if (r.providerAddress.toLowerCase() !== e.providerAddress.toLowerCase())
+    const t = this.entries.get(e.peginTxid);
+    if (t) {
+      if (t.providerAddress.toLowerCase() !== e.providerAddress.toLowerCase())
         throw new Error(
-          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to providerAddress ${r.providerAddress}; got ${e.providerAddress}`
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to providerAddress ${t.providerAddress}; got ${e.providerAddress}`
         );
-      if (r.expectedAudienceXOnlyPubkey.toLowerCase() !== e.expectedAudienceXOnlyPubkey.toLowerCase())
+      if (t.expectedAudienceXOnlyPubkey.toLowerCase() !== e.expectedAudienceXOnlyPubkey.toLowerCase())
         throw new Error(
-          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to expectedAudienceXOnlyPubkey ${r.expectedAudienceXOnlyPubkey.slice(0, 8)}…; got ${e.expectedAudienceXOnlyPubkey.slice(0, 8)}…`
+          `VpTokenRegistry: peginTxid ${e.peginTxid} already bound to expectedAudienceXOnlyPubkey ${t.expectedAudienceXOnlyPubkey.slice(0, 8)}…; got ${e.expectedAudienceXOnlyPubkey.slice(0, 8)}…`
         );
-      return r.provider;
+      return t.provider;
     }
   }
   /**
@@ -758,50 +767,50 @@ class We {
   }
 }
 const W = new We();
-function nr(t) {
+function nt(r) {
   var n;
   const e = F(
-    t.baseUrl,
-    (n = t.options) == null ? void 0 : n.headers
-  ), r = W.getOrCreate({
+    r.baseUrl,
+    (n = r.options) == null ? void 0 : n.headers
+  ), t = W.getOrCreate({
     client: e,
-    peginTxid: t.peginTxid,
-    authAnchorHex: t.authAnchorHex,
-    providerAddress: t.providerAddress,
-    pinnedServerPubkey: t.pinnedServerPubkey,
-    grpcPinnedServerPubkey: t.grpcPinnedServerPubkey,
-    grpcKeyEpoch: t.grpcKeyEpoch,
-    refreshJsonRpcPinnedServerPubkey: t.refreshJsonRpcPinnedServerPubkey,
+    peginTxid: r.peginTxid,
+    authAnchorHex: r.authAnchorHex,
+    providerAddress: r.providerAddress,
+    pinnedServerPubkey: r.pinnedServerPubkey,
+    grpcPinnedServerPubkey: r.grpcPinnedServerPubkey,
+    grpcKeyEpoch: r.grpcKeyEpoch,
+    refreshJsonRpcPinnedServerPubkey: r.refreshJsonRpcPinnedServerPubkey,
     expectedAudienceXOnlyPubkey: J(
-      t.depositorBtcPubkey
+      r.depositorBtcPubkey
     )
   });
-  return new te(t.baseUrl, {
-    ...t.options,
-    tokenProvider: r
+  return new re(r.baseUrl, {
+    ...r.options,
+    tokenProvider: t
   });
 }
-function ir(t) {
+function it(r) {
   W.getOrCreate({
-    client: F(t.baseUrl, t.headers),
-    peginTxid: t.peginTxid,
-    authAnchorHex: t.authAnchorHex,
-    providerAddress: t.providerAddress,
-    pinnedServerPubkey: t.pinnedServerPubkey,
-    grpcPinnedServerPubkey: t.grpcPinnedServerPubkey,
-    grpcKeyEpoch: t.grpcKeyEpoch,
-    refreshJsonRpcPinnedServerPubkey: t.refreshJsonRpcPinnedServerPubkey,
+    client: F(r.baseUrl, r.headers),
+    peginTxid: r.peginTxid,
+    authAnchorHex: r.authAnchorHex,
+    providerAddress: r.providerAddress,
+    pinnedServerPubkey: r.pinnedServerPubkey,
+    grpcPinnedServerPubkey: r.grpcPinnedServerPubkey,
+    grpcKeyEpoch: r.grpcKeyEpoch,
+    refreshJsonRpcPinnedServerPubkey: r.refreshJsonRpcPinnedServerPubkey,
     expectedAudienceXOnlyPubkey: J(
-      t.depositorBtcPubkey
+      r.depositorBtcPubkey
     )
   });
 }
 export {
-  p as S,
+  h as S,
   We as V,
   W as a,
-  nr as c,
-  ir as p,
+  nt as c,
+  it as p,
   de as v
 };
-//# sourceMappingURL=primeVpAuth-B0noJdcy.js.map
+//# sourceMappingURL=primeVpAuth-P-KTmNKb.js.map