@chainvue/verus-sdk 0.6.0 → 0.6.2

package/dist/bundle.js

@@ -9233,7 +9233,7 @@ var require_ecpair = __commonJS({
     var curve = ecurve.getCurveByName("secp256k1");
     var secp256k1Ecurve = ecdsa.__curve;
     var fastcurve = require_fastcurve();
-    function ECPair3(d, Q, options) {
+    function ECPair4(d, Q, options) {
       if (options) {
         typeforce({
           compressed: types.maybe(types.Boolean),
@@ -9256,7 +9256,7 @@ var require_ecpair = __commonJS({
       this.compressed = options.compressed === void 0 ? true : options.compressed;
       this.network = options.network || NETWORKS.bitcoin;
     }
-    Object.defineProperty(ECPair3.prototype, "Q", {
+    Object.defineProperty(ECPair4.prototype, "Q", {
       get: function() {
         if (!this.__Q && this.d) {
           var qBuf = fastcurve.publicKeyCreate(this.d.toBuffer(32), false);
@@ -9270,22 +9270,22 @@ var require_ecpair = __commonJS({
         return this.__Q;
       }
     });
-    ECPair3.recoverFromSignature = function(hashBuffer, compactSigBuffer, network) {
+    ECPair4.recoverFromSignature = function(hashBuffer, compactSigBuffer, network) {
       var compactParsed = sig.parseCompact(compactSigBuffer);
       var der = compactParsed.signature.toDER();
       var recovery = compactParsed.i & 3;
       var nobleSig = secp256k1.Signature.fromDER(der).addRecoveryBit(recovery);
       var pubBytes = nobleSig.recoverPublicKey(hashBuffer).toRawBytes(true);
-      return ECPair3.fromPublicKeyBuffer(Buffer.from(pubBytes), network);
+      return ECPair4.fromPublicKeyBuffer(Buffer.from(pubBytes), network);
     };
-    ECPair3.fromPublicKeyBuffer = function(buffer, network) {
+    ECPair4.fromPublicKeyBuffer = function(buffer, network) {
       var Q = ecurve.Point.decodeFrom(secp256k1Ecurve, buffer);
-      return new ECPair3(null, Q, {
+      return new ECPair4(null, Q, {
         compressed: Q.compressed,
         network
       });
     };
-    ECPair3.fromWIF = function(string, network, skipVersionCheck) {
+    ECPair4.fromWIF = function(string, network, skipVersionCheck) {
       if (skipVersionCheck === void 0) {
         skipVersionCheck = false;
       }
@@ -9303,12 +9303,12 @@ var require_ecpair = __commonJS({
           throw new Error("Invalid network version");
       }
       var d = BigInteger.fromBuffer(decoded.privateKey);
-      return new ECPair3(d, null, {
+      return new ECPair4(d, null, {
         compressed: decoded.compressed,
         network
       });
     };
-    ECPair3.makeRandom = function(options) {
+    ECPair4.makeRandom = function(options) {
       options = options || {};
       var rng = options.rng || randomBytes3;
       var d;
@@ -9317,18 +9317,18 @@ var require_ecpair = __commonJS({
         typeforce(types.Buffer256bit, buffer);
         d = BigInteger.fromBuffer(buffer);
       } while (d.signum() <= 0 || d.compareTo(secp256k1Ecurve.n) >= 0);
-      return new ECPair3(d, null, options);
+      return new ECPair4(d, null, options);
     };
-    ECPair3.prototype.getAddress = function() {
+    ECPair4.prototype.getAddress = function() {
       return baddress.toBase58Check(bcrypto.hash160(this.getPublicKeyBuffer()), this.getNetwork().pubKeyHash);
     };
-    ECPair3.prototype.getNetwork = function() {
+    ECPair4.prototype.getNetwork = function() {
       return this.network;
     };
-    ECPair3.prototype.getPublicKeyBuffer = function() {
+    ECPair4.prototype.getPublicKeyBuffer = function() {
       return this.Q.getEncoded(this.compressed);
     };
-    ECPair3.prototype.sign = function(hash) {
+    ECPair4.prototype.sign = function(hash) {
       if (!this.d)
         throw new Error("Missing private key");
       var sig2 = fastcurve.sign(hash, this.d);
@@ -9336,26 +9336,26 @@ var require_ecpair = __commonJS({
         return sig2;
       return ecdsa.sign(hash, this.d);
     };
-    ECPair3.prototype.toWIF = function() {
+    ECPair4.prototype.toWIF = function() {
       if (!this.d)
         throw new Error("Missing private key");
       return wif.encode(this.network.wif, this.d.toBuffer(32), this.compressed);
     };
-    ECPair3.prototype.verify = function(hash, signature) {
+    ECPair4.prototype.verify = function(hash, signature) {
       var fastsig = fastcurve.verify(hash, signature, this.getPublicKeyBuffer());
       if (fastsig !== void 0)
         return fastsig;
       return ecdsa.verify(hash, signature, this.Q);
     };
-    ECPair3.fromPrivateKeyBuffer = function(buffer, network) {
+    ECPair4.fromPrivateKeyBuffer = function(buffer, network) {
       var keyutil = require_keyutil();
       return keyutil.privateKeyBufferToECPair(buffer, network);
     };
-    ECPair3.prototype.getPrivateKeyBuffer = function() {
+    ECPair4.prototype.getPrivateKeyBuffer = function() {
       var keyutil = require_keyutil();
       return keyutil.privateKeyBufferFromECPair(this);
     };
-    module2.exports = ECPair3;
+    module2.exports = ECPair4;
   }
 });
 
@@ -9367,16 +9367,16 @@ var require_keyutil = __commonJS({
     exports2.privateKeyBufferToECPair = privateKeyBufferToECPair;
     exports2.privateKeyBufferFromECPair = privateKeyBufferFromECPair;
     var BigInteger = require_lib();
-    var ECPair3 = require_ecpair();
+    var ECPair4 = require_ecpair();
     function privateKeyBufferToECPair(buffer, network) {
       if (!Buffer.isBuffer(buffer) || buffer.length !== 32) {
         throw new Error("invalid private key buffer");
       }
       var d = BigInteger.fromBuffer(buffer);
-      return new ECPair3(d, null, { network });
+      return new ECPair4(d, null, { network });
     }
     function privateKeyBufferFromECPair(ecPair) {
-      if (!(ecPair instanceof ECPair3)) {
+      if (!(ecPair instanceof ECPair4)) {
         throw new TypeError("invalid argument ecpair");
       }
       if (!ecPair.d)
@@ -10983,7 +10983,7 @@ var require_signature = __commonJS({
     var opcodes3 = require_bitcoin_ops();
     var script = require_script();
     var crypto2 = require_crypto();
-    var ECPair3 = require_ecpair();
+    var ECPair4 = require_ecpair();
     var Transaction4 = require_transaction();
     var ECSignature = require_ecsignature();
     var networks3 = require_networks();
@@ -11106,7 +11106,7 @@ var require_signature = __commonJS({
             if (matchedPublicKeyIndices[publicKeyIndex]) {
               continue;
             }
-            var publicKey = ECPair3.fromPublicKeyBuffer(publicKeyBuffer);
+            var publicKey = ECPair4.fromPublicKeyBuffer(publicKeyBuffer);
             if (publicKey.verify(signatureHash, signature)) {
               isSignatureValid = true;
               matchedPublicKeyIndices[publicKeyIndex] = true;
@@ -11835,7 +11835,7 @@ var require_transaction_builder = __commonJS({
       btemplates.types.SMART_TRANSACTION
     ];
     var P2SH = SIGNABLE.concat([btemplates.types.P2WPKH, btemplates.types.P2WSH]);
-    var ECPair3 = require_ecpair();
+    var ECPair4 = require_ecpair();
     var ECSignature = require_ecsignature();
     var Transaction4 = require_transaction();
     var SmartTransactionSignatures = require_smart_transaction_signatures();
@@ -11991,7 +11991,7 @@ var require_transaction_builder = __commonJS({
       network = network || networks3.bitcoin;
       var unmatched = input.signatures.concat();
       input.signatures = input.pubKeys.map(function(pubKey) {
-        var keyPair = ECPair3.fromPublicKeyBuffer(pubKey);
+        var keyPair = ECPair4.fromPublicKeyBuffer(pubKey);
         var match;
         unmatched.some(function(signature, i) {
           if (!signature)
@@ -12911,7 +12911,7 @@ var require_hdnode = __commonJS({
     var types = require_types();
     var NETWORKS = require_networks();
     var BigInteger = require_lib();
-    var ECPair3 = require_ecpair();
+    var ECPair4 = require_ecpair();
     var ecurve = require_lib2();
     var curve = ecurve.getCurveByName("secp256k1");
     var fastcurve = require_fastcurve();
@@ -12939,7 +12939,7 @@ var require_hdnode = __commonJS({
       var IL = I.slice(0, 32);
       var IR = I.slice(32);
       var pIL = BigInteger.fromBuffer(IL);
-      var keyPair = new ECPair3(pIL, null, {
+      var keyPair = new ECPair4(pIL, null, {
         network
       });
       return new HDNode(keyPair, IR);
@@ -12979,11 +12979,11 @@ var require_hdnode = __commonJS({
         if (buffer.readUInt8(45) !== 0)
           throw new Error("Invalid private key");
         var d = BigInteger.fromBuffer(buffer.slice(46, 78));
-        keyPair = new ECPair3(d, null, { network });
+        keyPair = new ECPair4(d, null, { network });
       } else {
         var Q = ecurve.Point.decodeFrom(curve, buffer.slice(45, 78));
         curve.validate(Q);
-        keyPair = new ECPair3(null, Q, { network });
+        keyPair = new ECPair4(null, Q, { network });
       }
       var hd = new HDNode(keyPair, chainCode);
       hd.depth = depth;
@@ -13007,7 +13007,7 @@ var require_hdnode = __commonJS({
       return this.keyPair.getPublicKeyBuffer();
     };
     HDNode.prototype.neutered = function() {
-      var neuteredKeyPair = new ECPair3(null, this.keyPair.Q, {
+      var neuteredKeyPair = new ECPair4(null, this.keyPair.Q, {
         network: this.keyPair.network
       });
       var neutered = new HDNode(neuteredKeyPair, this.chainCode);
@@ -13068,7 +13068,7 @@ var require_hdnode = __commonJS({
         if (ki.signum() === 0) {
           return this.derive(index + 1);
         }
-        derivedKeyPair = new ECPair3(ki, null, {
+        derivedKeyPair = new ECPair4(ki, null, {
           network: this.keyPair.network
         });
       } else {
@@ -13077,7 +13077,7 @@ var require_hdnode = __commonJS({
         if (curve.isInfinity(Ki)) {
           return this.derive(index + 1);
         }
-        derivedKeyPair = new ECPair3(null, Ki, {
+        derivedKeyPair = new ECPair4(null, Ki, {
           network: this.keyPair.network
         });
       }
@@ -13127,7 +13127,7 @@ var require_hdnode = __commonJS({
     };
     HDNode.prototype.cloneKeypair = function() {
       var k = this.keyPair;
-      var result = new ECPair3(k.d, k.d ? null : k.Q, {
+      var result = new ECPair4(k.d, k.d ? null : k.Q, {
         network: k.network,
         compressed: k.compressed
       });
@@ -13154,7 +13154,7 @@ var require_identity_signature = __commonJS({
     var sha256 = require_crypto().sha256;
     var createHash3 = require("create-hash");
     var ECSignature = require_ecsignature();
-    var ECPair3 = require_ecpair();
+    var ECPair4 = require_ecpair();
     var VERUS_DATA_SIGNATURE_PREFIX_STRING = "Verus signed data:\n";
     var bufferWriter = new bufferutils.BufferWriter(Buffer2.alloc(VERUS_DATA_SIGNATURE_PREFIX_STRING.length + 1));
     bufferWriter.writeVarSlice(Buffer2.from("Verus signed data:\n", "utf-8"));
@@ -13221,7 +13221,7 @@ var require_identity_signature = __commonJS({
           var compactSig;
           for (recid = 0; recid < 4; recid++) {
             compactSig = signature.toCompact(recid, true);
-            var recoveredKeyPair = ECPair3.recoverFromSignature(buffer, compactSig, this.network);
+            var recoveredKeyPair = ECPair4.recoverFromSignature(buffer, compactSig, this.network);
             if (recoveredKeyPair.getAddress() === signingAddress) {
               this.signatures.push(compactSig);
               return compactSig;
@@ -13237,7 +13237,7 @@ var require_identity_signature = __commonJS({
           for (var i = 0; i < this.signatures.length; i++) {
             try {
               var sig = ECSignature.parseCompact(this.signatures[i]);
-              var pubKeyPair = ECPair3.recoverFromSignature(hash, sig.signature.toCompact(sig.i, true), this.network);
+              var pubKeyPair = ECPair4.recoverFromSignature(hash, sig.signature.toCompact(sig.i, true), this.network);
               if (pubKeyPair.getAddress() === signingAddress) {
                 var verification = pubKeyPair.verify(hash, sig.signature);
                 results.push(verification);
@@ -32539,6 +32539,11 @@ function resolveExpiryHeight(expiryHeight) {
       `Invalid expiryHeight: must be a non-negative integer (got ${expiryHeight})`
     );
   }
+  if (expiryHeight >= 5e8) {
+    throw new TransactionBuildError(
+      `Invalid expiryHeight: must be below 500000000 (got ${expiryHeight}); this looks like a timestamp, not a block height`
+    );
+  }
   return expiryHeight;
 }
 function getNetwork(testnet = false) {
@@ -32657,13 +32662,13 @@ function decodeUtxo(utxo, systemId) {
   }
   return { ...utxo, currencyValues };
 }
-function estimateFee(numInputs, numOutputs, feePerKb = DEFAULT_FEE_PER_KB, hasSmartOutputs = false) {
+function estimateFee(numInputs, numOutputs, feePerKb = DEFAULT_FEE_PER_KB, hasSmartOutputs = false, extraBytes = 0) {
   const outputSize = hasSmartOutputs ? SMART_OUTPUT_SIZE : P2PKH_OUTPUT_SIZE;
-  const txSize = TX_OVERHEAD + numInputs * INPUT_SIZE + numOutputs * outputSize;
+  const txSize = TX_OVERHEAD + numInputs * INPUT_SIZE + numOutputs * outputSize + extraBytes;
   const fee = (BigInt(txSize) * feePerKb + 999n) / 1000n;
   return fee > MIN_FEE ? fee : MIN_FEE;
 }
-function selectUtxos(utxos, requiredNative, requiredCurrencies = /* @__PURE__ */ new Map(), numOutputs = 2, systemId = NETWORK_CONFIG.mainnet.chainId, feePerKb = DEFAULT_FEE_PER_KB, hasSmartOutputs = false) {
+function selectUtxos(utxos, requiredNative, requiredCurrencies = /* @__PURE__ */ new Map(), numOutputs = 2, systemId = NETWORK_CONFIG.mainnet.chainId, feePerKb = DEFAULT_FEE_PER_KB, hasSmartOutputs = false, extraOutputBytes = 0) {
   const seenOutpoints = /* @__PURE__ */ new Set();
   for (const u of utxos) {
     const outpoint = `${u.txid}:${u.outputIndex}`;
@@ -32712,18 +32717,32 @@ function selectUtxos(utxos, requiredNative, requiredCurrencies = /* @__PURE__ */
       }
     }
   }
-  const nativeOnly = decoded.filter((u) => !selected.includes(u)).sort((a, b) => b.satoshis > a.satoshis ? 1 : b.satoshis < a.satoshis ? -1 : 0);
-  let changeOutputCount = 0;
-  for (const [currency, needed] of remaining) {
-    if (currency !== systemId && needed < 0n) {
-      changeOutputCount++;
+  const carriesToken = (u) => {
+    for (const [currency, amount] of u.currencyValues) {
+      if (currency !== systemId && amount > 0n) return true;
     }
-  }
+    return false;
+  };
+  const nativeOnly = decoded.filter((u) => !selected.includes(u)).sort((a, b) => {
+    const at = carriesToken(a) ? 1 : 0;
+    const bt = carriesToken(b) ? 1 : 0;
+    if (at !== bt) return at - bt;
+    return b.satoshis > a.satoshis ? 1 : b.satoshis < a.satoshis ? -1 : 0;
+  });
+  const countCurrencyChanges = () => {
+    let n = 0;
+    for (const [currency, needed] of remaining) {
+      if (currency !== systemId && needed < 0n) n++;
+    }
+    return n;
+  };
+  let changeOutputCount = countCurrencyChanges();
   let fee = estimateFee(
     selected.length + 1,
     numOutputs + 1 + changeOutputCount,
     feePerKb,
-    hasSmartOutputs
+    hasSmartOutputs,
+    extraOutputBytes
   );
   while (remainingNative + fee > 0n) {
     const next = nativeOnly.shift();
@@ -32737,11 +32756,17 @@ function selectUtxos(utxos, requiredNative, requiredCurrencies = /* @__PURE__ */
     }
     selected.push(next);
     remainingNative -= next.satoshis;
+    for (const [currency, amount] of next.currencyValues) {
+      if (currency === systemId || amount <= 0n) continue;
+      remaining.set(currency, (remaining.get(currency) || 0n) - amount);
+    }
+    changeOutputCount = countCurrencyChanges();
     fee = estimateFee(
       selected.length,
       numOutputs + 1 + changeOutputCount,
       feePerKb,
-      hasSmartOutputs
+      hasSmartOutputs,
+      extraOutputBytes
     );
   }
   const totalNativeIn = selected.reduce((sum, u) => sum + u.satoshis, 0n);
@@ -32895,6 +32920,38 @@ var HASH160_BYTE_LENGTH = 20;
 var HASH256_BYTE_LENGTH = 32;
 var NULL_ID_HASH = Buffer.alloc(HASH160_BYTE_LENGTH, 0);
 var EVAL_IDENTITY_ADVANCEDRESERVATION = 10;
+function assertAddressVersion(address, expectedVersion, label) {
+  let version;
+  try {
+    version = (0, import_verus_typescript_primitives4.fromBase58Check)(address).version;
+  } catch {
+    throw new TransactionBuildError(`${label} is not a valid base58check address: ${JSON.stringify(address)}`);
+  }
+  if (version !== expectedVersion) {
+    const want = expectedVersion === I_ADDR_VERSION ? "an identity i-address" : "an R-address";
+    throw new TransactionBuildError(
+      `${label} must be ${want} (version ${expectedVersion}), got version ${version}: ${address}`
+    );
+  }
+}
+function validateMinSigs(minSigs, primaryCount) {
+  if (!Number.isInteger(minSigs) || minSigs < 1 || minSigs > primaryCount) {
+    throw new TransactionBuildError(
+      `minSigs must be an integer between 1 and the number of primary addresses (${primaryCount}), got ${minSigs}`
+    );
+  }
+}
+function validateUpdateAddressParams(params) {
+  params.primaryAddresses?.forEach(
+    (a, i) => assertAddressVersion(a, PUBKEY_HASH_PREFIX, `primaryAddresses[${i}]`)
+  );
+  if (params.revocationAuthority) {
+    assertAddressVersion(params.revocationAuthority, I_ADDR_VERSION, "revocationAuthority");
+  }
+  if (params.recoveryAuthority) {
+    assertAddressVersion(params.recoveryAuthority, I_ADDR_VERSION, "recoveryAuthority");
+  }
+}
 function generateSalt() {
   return (0, import_crypto2.randomBytes)(HASH256_BYTE_LENGTH);
 }
@@ -33052,6 +33109,12 @@ function calculateRegistrationFees(hasReferral, totalFee = DEFAULT_REGISTRATION_
   return { issuerFee, referralAmount, totalRequired };
 }
 function createIdentityObject(params) {
+  params.primaryAddresses.forEach(
+    (addr, i) => assertAddressVersion(addr, PUBKEY_HASH_PREFIX, `primaryAddresses[${i}]`)
+  );
+  assertAddressVersion(params.revocationAuthority, I_ADDR_VERSION, "revocationAuthority");
+  assertAddressVersion(params.recoveryAuthority, I_ADDR_VERSION, "recoveryAuthority");
+  validateMinSigs(params.minSigs ?? 1, params.primaryAddresses.length);
   const primaryKeys = params.primaryAddresses.map((addr) => import_verus_typescript_primitives2.KeyID.fromAddress(addr));
   const identity = new import_verus_typescript_primitives2.Identity({
     version: import_verus_typescript_primitives2.Identity.VERSION_CURRENT,
@@ -33109,7 +33172,17 @@ function buildRegistrationFeeOutput(parentCurrencyId, feeAmount, systemId, _cont
   return { script: script.toBuffer(), nativeValue: RESERVE_TRANSFER_FEE };
 }
 function buildTokenChangeOutput(changeAddress, currencyChanges) {
-  const destination = new import_verus_typescript_primitives2.TxDestination(import_verus_typescript_primitives2.KeyID.fromAddress(changeAddress));
+  const version = (0, import_verus_typescript_primitives4.fromBase58Check)(changeAddress).version;
+  let destination;
+  if (version === I_ADDR_VERSION) {
+    destination = new import_verus_typescript_primitives2.TxDestination(import_verus_typescript_primitives2.IdentityID.fromAddress(changeAddress));
+  } else if (version === PUBKEY_HASH_PREFIX) {
+    destination = new import_verus_typescript_primitives2.TxDestination(import_verus_typescript_primitives2.KeyID.fromAddress(changeAddress));
+  } else {
+    throw new TransactionBuildError(
+      `token change address must be an R-address or identity i-address, got version ${version}: ${changeAddress}`
+    );
+  }
   const valueMap = /* @__PURE__ */ new Map();
   for (const [currency, amount] of currencyChanges) {
     if (amount > 0n) {
@@ -33166,9 +33239,10 @@ function buildAndSignCommitment(params, network) {
   }
   const verusNetwork = getNetwork(network === "testnet");
   const networkConfig = NETWORK_CONFIG[network];
+  const controlAddress = import_utxo_lib3.ECPair.fromWIF(params.wif, verusNetwork).getAddress();
   const commitment = prepareNameCommitment(
     params.name,
-    params.changeAddress,
+    controlAddress,
     params.referral,
     params.parent,
     network
@@ -33197,7 +33271,11 @@ function buildAndSignCommitment(params, network) {
   }
   txb.addOutput(commitment.commitmentScript, 0);
   if (selection.nativeChange > 0n) {
-    txb.addOutput(params.changeAddress, toSafeNumber(selection.nativeChange));
+    if (params.changeAddress.startsWith("i")) {
+      txb.addOutput(identityPaymentScript(params.changeAddress), toSafeNumber(selection.nativeChange));
+    } else {
+      txb.addOutput(params.changeAddress, toSafeNumber(selection.nativeChange));
+    }
   }
   const unsignedTx = txb.buildIncomplete();
   const { signedTx, txid } = signTransactionSmart(
@@ -33268,6 +33346,12 @@ function _buildVrscRegistration(params, identityScript, reservationScript, ident
   const referralOutputs = [];
   if (hasReferral) {
     const chain = params.referralChain && params.referralChain.length > 0 ? params.referralChain : commitData.referral ? [commitData.referral] : [];
+    const referralLevels = params.referralLevels ?? DEFAULT_REFERRAL_LEVELS;
+    if (chain.length > referralLevels) {
+      throw new TransactionBuildError(
+        `referralChain has ${chain.length} entries but at most ${referralLevels} referral levels are allowed`
+      );
+    }
     for (const referrerAddr of chain) {
       referralOutputs.push({
         script: buildReferralPaymentScript(referrerAddr),
@@ -33277,7 +33361,7 @@ function _buildVrscRegistration(params, identityScript, reservationScript, ident
   }
   const totalFee = params.registrationFee ?? DEFAULT_REGISTRATION_FEE;
   const totalReferralPayments = referralOutputs.reduce((sum, o) => sum + o.value, 0n);
-  const requiredNative = totalFee;
+  const requiredNative = hasReferral ? fees.issuerFee : totalFee;
   const numOutputs = 2 + referralOutputs.length + 1;
   const selection = selectUtxos(
     params.utxos,
@@ -33313,11 +33397,15 @@ function _buildVrscRegistration(params, identityScript, reservationScript, ident
   }
   txb.addOutput(reservationScript, 0);
   if (selection.nativeChange > 0n) {
-    txb.addOutput(params.changeAddress, toSafeNumber(selection.nativeChange));
+    if (params.changeAddress.startsWith("i")) {
+      txb.addOutput(identityPaymentScript(params.changeAddress), toSafeNumber(selection.nativeChange));
+    } else {
+      txb.addOutput(params.changeAddress, toSafeNumber(selection.nativeChange));
+    }
   }
   const unsignedTx = txb.buildIncomplete();
   const allUtxos = [commitUtxo, ...selection.selected];
-  const expectedImplicitFee = commitUtxo.satoshis + totalFee - totalReferralPayments + selection.fee;
+  const expectedImplicitFee = commitUtxo.satoshis + requiredNative - totalReferralPayments + selection.fee;
   const assembledNativeFee = allUtxos.reduce((sum, u) => sum + u.satoshis, 0n) - unsignedTx.outs.reduce((sum, o) => sum + BigInt(o.value), 0n);
   if (assembledNativeFee !== expectedImplicitFee) {
     throw new TransactionBuildError(
@@ -33336,7 +33424,10 @@ function _buildVrscRegistration(params, identityScript, reservationScript, ident
     txid,
     fee: selection.fee,
     identityAddress,
-    registrationFee: totalFee - totalReferralPayments,
+    // The registrant's registration outlay: the discounted issuer fee when
+    // referred, the full fee otherwise. (Of this, referralPayments go to the
+    // referrers and the remainder is the implicit miner fee.)
+    registrationFee: requiredNative,
     referralPayments: referralOutputs.length,
     referralAmountEach: fees.referralAmount,
     inputsUsed: allUtxos.length,
@@ -33402,7 +33493,11 @@ function _buildSubIdRegistration(params, identity, identityScript, reservationSc
       );
       txb.addOutput(tokenChangeScript.script, toSafeNumber(selection.nativeChange));
     } else {
-      txb.addOutput(params.changeAddress, toSafeNumber(selection.nativeChange));
+      if (params.changeAddress.startsWith("i")) {
+        txb.addOutput(identityPaymentScript(params.changeAddress), toSafeNumber(selection.nativeChange));
+      } else {
+        txb.addOutput(params.changeAddress, toSafeNumber(selection.nativeChange));
+      }
     }
   }
   const unsignedTx = txb.buildIncomplete();
@@ -33438,12 +33533,29 @@ function buildAndSignIdentityUpdate(params, network, operation = "update", lockU
   const systemId = networkConfig.chainId;
   const identity = new import_verus_typescript_primitives2.Identity();
   identity.fromBuffer(Buffer.from(params.identityHex, "hex"));
+  let requiresPrimary = operation === "update" || operation === "lock" || operation === "unlock";
+  if (!requiresPrimary && (operation === "revoke" || operation === "recover")) {
+    const self = identity.getIdentityAddress();
+    const authority = operation === "revoke" ? identity.revocation_authority?.toAddress() : identity.recovery_authority?.toAddress();
+    requiresPrimary = authority === self;
+  }
+  if (requiresPrimary) {
+    const signerAddress = import_utxo_lib3.ECPair.fromWIF(params.wif, verusNetwork).getAddress();
+    const currentPrimaries = (identity.primary_addresses ?? []).map((k) => k.toAddress());
+    if (!currentPrimaries.includes(signerAddress)) {
+      throw new TransactionBuildError(
+        `the provided WIF (${signerAddress}) is not among the identity's primary addresses [${currentPrimaries.join(", ")}]; it cannot authorize a ${operation}.`
+      );
+    }
+  }
   switch (operation) {
     case "update": {
+      validateUpdateAddressParams(params);
       if (params.primaryAddresses) {
         identity.setPrimaryAddresses(params.primaryAddresses);
       }
       if (params.minSigs !== void 0) {
+        validateMinSigs(params.minSigs, identity.primary_addresses?.length ?? 0);
         identity.min_sigs = new import_bn.default(params.minSigs);
       }
       if (params.revocationAuthority) {
@@ -33465,7 +33577,16 @@ function buildAndSignIdentityUpdate(params, network, operation = "update", lockU
       if (params.contentMultimap) {
         const jsonObj = {};
         for (const [key, value] of Object.entries(params.contentMultimap)) {
-          jsonObj[key] = Array.isArray(value) ? value : [value];
+          assertAddressVersion(key, I_ADDR_VERSION, `contentMultimap key "${key}"`);
+          const items = Array.isArray(value) ? value : [value];
+          for (const item of items) {
+            if (!/^[0-9a-fA-F]*$/.test(item) || item.length % 2 !== 0) {
+              throw new TransactionBuildError(
+                `contentMultimap["${key}"] entries must be even-length hex strings (got ${JSON.stringify(item)})`
+              );
+            }
+          }
+          jsonObj[key] = items;
         }
         identity.content_multimap = import_verus_typescript_primitives2.ContentMultiMap.fromJson(jsonObj);
       }
@@ -33477,6 +33598,7 @@ function buildAndSignIdentityUpdate(params, network, operation = "update", lockU
       break;
     }
     case "recover": {
+      validateUpdateAddressParams(params);
       identity.unrevoke();
       identity.clearContentMultiMap();
       if (params.primaryAddresses) {
@@ -33499,7 +33621,13 @@ function buildAndSignIdentityUpdate(params, network, operation = "update", lockU
       break;
     }
     case "unlock": {
-      identity.unlock(new import_bn.default(0), new import_bn.default(resolveExpiryHeight(params.expiryHeight)));
+      const unlockExpiry = resolveExpiryHeight(params.expiryHeight);
+      if (unlockExpiry === 0) {
+        throw new TransactionBuildError(
+          "unlock requires a non-zero expiryHeight (currentBlockHeight + DEFAULT_EXPIRY_DELTA): the unlock delay is anchored to it, so 0 would bypass the timelock."
+        );
+      }
+      identity.unlock(new import_bn.default(0), new import_bn.default(unlockExpiry));
       break;
     }
   }
@@ -33516,7 +33644,11 @@ function buildAndSignIdentityUpdate(params, network, operation = "update", lockU
     1,
     systemId,
     void 0,
-    true
+    true,
+    // The identity output embeds the full serialized identity (a large
+    // contentMultimap can make it multi-KB); size the fee from its real bytes
+    // so a big update isn't fee-estimated below the relay minimum.
+    unfundedHex.length / 2
   );
   const txb = new import_utxo_lib3.TransactionBuilder(verusNetwork);
   txb.setVersion(4);
@@ -33535,12 +33667,21 @@ function buildAndSignIdentityUpdate(params, network, operation = "update", lockU
     txb.addOutput(out.script, out.value);
   }
   if (selection.nativeChange > 0n) {
-    txb.addOutput(params.changeAddress, toSafeNumber(selection.nativeChange));
+    if (params.changeAddress.startsWith("i")) {
+      txb.addOutput(identityPaymentScript(params.changeAddress), toSafeNumber(selection.nativeChange));
+    } else {
+      txb.addOutput(params.changeAddress, toSafeNumber(selection.nativeChange));
+    }
   }
   const fundedTx = txb.buildIncomplete();
   const fundedHex = fundedTx.toHex();
   const prevOutScripts = selection.selected.map((u) => Buffer.from(u.script, "hex"));
   const idUtxo = params.identityUtxo;
+  if (idUtxo.satoshis !== 0n) {
+    throw new TransactionBuildError(
+      `identityUtxo carries ${idUtxo.satoshis} native satoshis, which would be burned to miner fee (the recreated identity output is value 0). Spend that value separately before updating.`
+    );
+  }
   const completedHex = completeFundedIdentityUpdate(
     fundedHex,
     verusNetwork,
@@ -33627,10 +33768,10 @@ function parseAddress(address, addressType) {
     case "ETH": {
       type = import_verus_typescript_primitives5.DEST_ETH;
       const addr = address.startsWith("0x") ? address.substring(2) : address;
-      destinationBytes = Buffer.from(addr, "hex");
-      if (destinationBytes.length !== 20) {
-        throw new InvalidAddressError(address, "ETH destination must be 20 bytes of hex");
+      if (!/^[0-9a-fA-F]{40}$/.test(addr)) {
+        throw new InvalidAddressError(address, "ETH destination must be exactly 20 bytes (40 hex chars)");
       }
+      destinationBytes = Buffer.from(addr, "hex");
       break;
     }
     default:
@@ -33694,6 +33835,12 @@ function sendCurrency(params, network) {
         (requiredCurrencies.get(out.currency) || 0n) + out.satoshis
       );
     }
+    if (out.feeCurrency !== void 0 && out.feeCurrency !== systemId && out.feeSatoshis !== void 0) {
+      requiredCurrencies.set(
+        out.feeCurrency,
+        (requiredCurrencies.get(out.feeCurrency) || 0n) + out.feeSatoshis
+      );
+    }
   }
   const selection = selectUtxos(
     params.utxos,
@@ -33968,6 +34115,19 @@ var import_verus_typescript_primitives6 = __toESM(require_dist2());
 var import_bn3 = __toESM(require("bn.js"));
 var { completeFundedIdentityUpdate: completeFundedIdentityUpdate2 } = import_utxo_lib6.smarttxs;
 function defineCurrency(params, network) {
+  const wifCheck = validateWif(params.wif);
+  if (!wifCheck.valid) {
+    throw new InvalidWifError(wifCheck.error);
+  }
+  if (!params.identityHex) {
+    throw new TransactionBuildError("identityHex is required");
+  }
+  if (!params.utxos || params.utxos.length === 0) {
+    throw new TransactionBuildError("At least one funding UTXO is required");
+  }
+  if (!params.currencyDefScript) {
+    throw new TransactionBuildError("currencyDefScript is required");
+  }
   const verusNetwork = getNetwork(network === "testnet");
   const networkConfig = NETWORK_CONFIG[network];
   const systemId = networkConfig.chainId;
@@ -33988,7 +34148,8 @@ function defineCurrency(params, network) {
     2,
     systemId,
     void 0,
-    true
+    true,
+    identityOutputScript.length + currencyDefScript.length
   );
   const txb = new import_utxo_lib6.TransactionBuilder(verusNetwork);
   txb.setVersion(4);
@@ -34005,12 +34166,21 @@ function defineCurrency(params, network) {
   txb.addOutput(identityOutputScript, 0);
   txb.addOutput(currencyDefScript, toSafeNumber(currencyDefValue));
   if (selection.nativeChange > 0n) {
-    txb.addOutput(params.changeAddress, toSafeNumber(selection.nativeChange));
+    if (params.changeAddress.startsWith("i")) {
+      txb.addOutput(identityPaymentScript(params.changeAddress), toSafeNumber(selection.nativeChange));
+    } else {
+      txb.addOutput(params.changeAddress, toSafeNumber(selection.nativeChange));
+    }
   }
   const fundedTx = txb.buildIncomplete();
   const fundedHex = fundedTx.toHex();
   const prevOutScripts = selection.selected.map((u) => Buffer.from(u.script, "hex"));
   const idUtxo = params.identityUtxo;
+  if (idUtxo.satoshis !== 0n) {
+    throw new TransactionBuildError(
+      `identityUtxo carries ${idUtxo.satoshis} native satoshis, which would be burned to miner fee (the recreated identity output is value 0). Spend that value separately first.`
+    );
+  }
   const completedHex = completeFundedIdentityUpdate2(
     fundedHex,
     verusNetwork,