@chainvue/verus-sdk 0.8.0 → 0.10.0

package/dist/identity/index.js

@@ -38,25 +38,30 @@ exports.buildAndSignRegistration = buildAndSignRegistration;
 exports.buildAndSignIdentityUpdate = buildAndSignIdentityUpdate;
 const crypto_1 = require("crypto");
 const bn_js_1 = __importDefault(require("bn.js"));
-const verus_typescript_primitives_1 = require("verus-typescript-primitives");
-const verus_typescript_primitives_2 = require("verus-typescript-primitives");
-const verus_typescript_primitives_3 = require("verus-typescript-primitives");
-Object.defineProperty(exports, "nameAndParentAddrToIAddr", { enumerable: true, get: function () { return verus_typescript_primitives_3.nameAndParentAddrToIAddr; } });
-const utxo_lib_1 = require("@bitgo/utxo-lib");
+const boundary_js_1 = require("../fork/boundary.js");
+const boundary_js_2 = require("../fork/boundary.js");
+const boundary_js_3 = require("../fork/boundary.js");
+Object.defineProperty(exports, "nameAndParentAddrToIAddr", { enumerable: true, get: function () { return boundary_js_3.nameAndParentAddrToIAddr; } });
+const boundary_js_4 = require("../fork/boundary.js");
 const index_js_1 = require("../constants/index.js");
 const index_js_2 = require("../utils/index.js");
 const index_js_3 = require("../signing/index.js");
-const index_js_4 = require("../utxo/index.js");
+const assembler_js_1 = require("../assemble/assembler.js");
+const fundedIdentityUpdate_js_1 = require("../assemble/fundedIdentityUpdate.js");
 const brands_js_1 = require("../core/brands.js");
 const errors_js_1 = require("../errors.js");
-const index_js_5 = require("../keys/index.js");
-const { createUnfundedIdentityUpdate, completeFundedIdentityUpdate } = utxo_lib_1.smarttxs;
+const index_js_4 = require("../keys/index.js");
+const { createUnfundedIdentityUpdate } = boundary_js_4.smarttxs;
 const HASH160_BYTE_LENGTH = 20;
 const HASH256_BYTE_LENGTH = 32;
 /** Null identity hash (20 zero bytes) */
 const NULL_ID_HASH = Buffer.alloc(HASH160_BYTE_LENGTH, 0);
 /** Eval code for CAdvancedNameReservation (sub-ID) */
 const EVAL_IDENTITY_ADVANCEDRESERVATION = 10;
+/** Consensus maximum identity unlock delay (blocks) — CIdentity::MAX_UNLOCK_DELAY, ~22 years. */
+const MAX_UNLOCK_DELAY = 11563200;
+/** ~1 year of blocks (1 block/min); a lock delay above this needs an explicit opt-in. */
+const LOCK_DELAY_SANITY_BLOCKS = 525600;
 // ─── Script / Hash Builders ────────────────────────────────────────
 /**
  * Assert a base58check address has the expected version byte.
@@ -71,7 +76,7 @@ const EVAL_IDENTITY_ADVANCEDRESERVATION = 10;
 function assertAddressVersion(address, expectedVersion, label) {
     let version;
     try {
-        version = (0, verus_typescript_primitives_3.fromBase58Check)(address).version;
+        version = (0, boundary_js_3.fromBase58Check)(address).version;
     }
     catch {
         throw new errors_js_1.TransactionBuildError(`${label} is not a valid base58check address: ${JSON.stringify(address)}`);
@@ -89,7 +94,7 @@ function assertAddressVersion(address, expectedVersion, label) {
  * primary authority (currency define; update/lock/unlock check inline).
  */
 function assertWifIsPrimary(wif, identity, network) {
-    const signerAddress = utxo_lib_1.ECPair.fromWIF(wif, network).getAddress();
+    const signerAddress = boundary_js_4.ECPair.fromWIF(wif, network).getAddress();
     const currentPrimaries = (identity.primary_addresses ?? []).map((k) => k.toAddress());
     if (!currentPrimaries.includes(signerAddress)) {
         throw new errors_js_1.TransactionBuildError(`the provided WIF (${signerAddress}) is not among the identity's primary addresses ` +
@@ -146,9 +151,9 @@ function calculateCommitmentHash(serializedReservation) {
  * Serialize a CCommitmentHash
  */
 function serializeCommitmentHash(hash) {
-    const tokenOutput = new verus_typescript_primitives_1.TokenOutput({
+    const tokenOutput = new boundary_js_1.TokenOutput({
         version: new bn_js_1.default(0),
-        values: new verus_typescript_primitives_1.CurrencyValueMap(),
+        values: new boundary_js_1.CurrencyValueMap(),
     });
     const tokenBuf = tokenOutput.toBuffer();
     return Buffer.concat([tokenBuf, hash]);
@@ -157,43 +162,43 @@ function serializeCommitmentHash(hash) {
  * Build the commitment output script
  */
 function buildCommitmentScript(commitmentHashBuf, controlAddress) {
-    const controlDest = new verus_typescript_primitives_1.TxDestination(verus_typescript_primitives_1.KeyID.fromAddress(controlAddress));
-    const master = new verus_typescript_primitives_1.OptCCParams({
+    const controlDest = new boundary_js_1.TxDestination(boundary_js_1.KeyID.fromAddress(controlAddress));
+    const master = new boundary_js_1.OptCCParams({
         version: new bn_js_1.default(3),
-        eval_code: new bn_js_1.default(verus_typescript_primitives_2.EVALS.EVAL_NONE),
+        eval_code: new bn_js_1.default(boundary_js_2.EVALS.EVAL_NONE),
         m: new bn_js_1.default(1),
         n: new bn_js_1.default(1),
         destinations: [controlDest],
         vdata: [],
     });
-    const params = new verus_typescript_primitives_1.OptCCParams({
+    const params = new boundary_js_1.OptCCParams({
         version: new bn_js_1.default(3),
-        eval_code: new bn_js_1.default(verus_typescript_primitives_2.EVALS.EVAL_IDENTITY_COMMITMENT),
+        eval_code: new bn_js_1.default(boundary_js_2.EVALS.EVAL_IDENTITY_COMMITMENT),
         m: new bn_js_1.default(1),
         n: new bn_js_1.default(1),
         destinations: [controlDest],
         vdata: [commitmentHashBuf],
     });
-    const script = new verus_typescript_primitives_1.SmartTransactionScript(master, params);
+    const script = new boundary_js_1.SmartTransactionScript(master, params);
     return script.toBuffer();
 }
 /**
  * Build the name reservation output script
  */
 function buildReservationScript(newIdentityIAddress, serializedReservation, isAdvanced = false) {
-    const identityDest = new verus_typescript_primitives_1.TxDestination(verus_typescript_primitives_1.IdentityID.fromAddress(newIdentityIAddress));
+    const identityDest = new boundary_js_1.TxDestination(boundary_js_1.IdentityID.fromAddress(newIdentityIAddress));
     const evalCode = isAdvanced
         ? EVAL_IDENTITY_ADVANCEDRESERVATION
-        : verus_typescript_primitives_2.EVALS.EVAL_IDENTITY_RESERVATION;
-    const master = new verus_typescript_primitives_1.OptCCParams({
+        : boundary_js_2.EVALS.EVAL_IDENTITY_RESERVATION;
+    const master = new boundary_js_1.OptCCParams({
         version: new bn_js_1.default(3),
-        eval_code: new bn_js_1.default(verus_typescript_primitives_2.EVALS.EVAL_NONE),
+        eval_code: new bn_js_1.default(boundary_js_2.EVALS.EVAL_NONE),
         m: new bn_js_1.default(1),
         n: new bn_js_1.default(1),
         destinations: [identityDest],
         vdata: [],
     });
-    const params = new verus_typescript_primitives_1.OptCCParams({
+    const params = new boundary_js_1.OptCCParams({
         version: new bn_js_1.default(3),
         eval_code: new bn_js_1.default(evalCode),
         m: new bn_js_1.default(1),
@@ -201,14 +206,14 @@ function buildReservationScript(newIdentityIAddress, serializedReservation, isAd
         destinations: [identityDest],
         vdata: [serializedReservation],
     });
-    const script = new verus_typescript_primitives_1.SmartTransactionScript(master, params);
+    const script = new boundary_js_1.SmartTransactionScript(master, params);
     return script.toBuffer();
 }
 /**
  * Build an identity definition output script from an Identity object
  */
 function buildIdentityScript(identity) {
-    const identityScript = verus_typescript_primitives_1.IdentityScript.fromIdentity(identity);
+    const identityScript = boundary_js_1.IdentityScript.fromIdentity(identity);
     return identityScript.toBuffer();
 }
 /**
@@ -223,7 +228,7 @@ function deriveIdentityAddress(name, parentIAddress) {
     if (parentIAddress) {
         assertAddressVersion(parentIAddress, index_js_1.I_ADDR_VERSION, 'parent');
     }
-    return (0, verus_typescript_primitives_3.nameAndParentAddrToIAddr)(name, parentIAddress || undefined);
+    return (0, boundary_js_3.nameAndParentAddrToIAddr)(name, parentIAddress || undefined);
 }
 /**
  * Determine if a parent is the VRSC root system
@@ -251,6 +256,15 @@ salt = generateSalt()) {
     // registration and the commitment fee is wasted). Require an i-address.
     if (referralIAddress) {
         assertAddressVersion(referralIAddress, index_js_1.I_ADDR_VERSION, 'referral');
+        // A sub-ID commitment (non-VRSC parent) would bake the referral into the
+        // advanced reservation hash, but _buildSubIdRegistration emits NO referral
+        // payout — the registration would then mismatch its own committed hash and
+        // the daemon rejects it, wasting the commitment fee. Fail closed here rather
+        // than committing a referral this SDK cannot honor.
+        if (!isVRSCParent(parentIAddress, network)) {
+            throw new errors_js_1.TransactionBuildError('referrals are not supported for sub-ID (non-VRSC-parent) registrations in this SDK; ' +
+                'omit the referral for a sub-ID name commitment.');
+        }
     }
     const referralHash = referralIAddress
         ? (0, index_js_2.iAddressToHash)(referralIAddress)
@@ -309,26 +323,26 @@ function identityPaymentScript(iAddress) {
  * raw string here is exactly the hole that let a wrong-kind address through.
  */
 function buildReferralPaymentScript(iAddress) {
-    const identityDest = new verus_typescript_primitives_1.TxDestination(verus_typescript_primitives_1.IdentityID.fromAddress(iAddress));
+    const identityDest = new boundary_js_1.TxDestination(boundary_js_1.IdentityID.fromAddress(iAddress));
     // Master: EVAL_NONE outputs have empty master (no index destinations)
     // This matches the daemon's MakeMofNCCScript for EVAL_NONE condition objects
-    const master = new verus_typescript_primitives_1.OptCCParams({
+    const master = new boundary_js_1.OptCCParams({
         version: new bn_js_1.default(3),
-        eval_code: new bn_js_1.default(verus_typescript_primitives_2.EVALS.EVAL_NONE),
+        eval_code: new bn_js_1.default(boundary_js_2.EVALS.EVAL_NONE),
         m: new bn_js_1.default(0),
         n: new bn_js_1.default(0),
         destinations: [],
         vdata: [],
     });
-    const params = new verus_typescript_primitives_1.OptCCParams({
+    const params = new boundary_js_1.OptCCParams({
         version: new bn_js_1.default(3),
-        eval_code: new bn_js_1.default(verus_typescript_primitives_2.EVALS.EVAL_NONE),
+        eval_code: new bn_js_1.default(boundary_js_2.EVALS.EVAL_NONE),
         m: new bn_js_1.default(1),
         n: new bn_js_1.default(1),
         destinations: [identityDest],
         vdata: [],
     });
-    const script = new verus_typescript_primitives_1.SmartTransactionScript(master, params);
+    const script = new boundary_js_1.SmartTransactionScript(master, params);
     return script.toBuffer();
 }
 /**
@@ -351,17 +365,17 @@ function createIdentityObject(params) {
     // R-address primary or an i-address authority is now a compile error at the
     // call site, where the raw string is parsed.
     validateMinSigs(params.minSigs ?? 1, params.primaryAddresses.length);
-    const primaryKeys = params.primaryAddresses.map(addr => verus_typescript_primitives_1.KeyID.fromAddress(addr));
-    const identity = new verus_typescript_primitives_1.Identity({
-        version: verus_typescript_primitives_1.Identity.VERSION_CURRENT,
+    const primaryKeys = params.primaryAddresses.map(addr => boundary_js_1.KeyID.fromAddress(addr));
+    const identity = new boundary_js_1.Identity({
+        version: boundary_js_1.Identity.VERSION_CURRENT,
         flags: new bn_js_1.default(0),
         min_sigs: new bn_js_1.default(params.minSigs || 1),
         primary_addresses: primaryKeys,
-        parent: verus_typescript_primitives_1.IdentityID.fromAddress(params.parentIAddress),
-        system_id: verus_typescript_primitives_1.IdentityID.fromAddress(params.systemId),
+        parent: boundary_js_1.IdentityID.fromAddress(params.parentIAddress),
+        system_id: boundary_js_1.IdentityID.fromAddress(params.systemId),
         name: params.name,
-        revocation_authority: verus_typescript_primitives_1.IdentityID.fromAddress(params.revocationAuthority),
-        recovery_authority: verus_typescript_primitives_1.IdentityID.fromAddress(params.recoveryAuthority),
+        revocation_authority: boundary_js_1.IdentityID.fromAddress(params.revocationAuthority),
+        recovery_authority: boundary_js_1.IdentityID.fromAddress(params.recoveryAuthority),
         private_addresses: [],
         unlock_after: new bn_js_1.default(0),
     });
@@ -370,25 +384,61 @@ function createIdentityObject(params) {
 /**
  * Build the parent-currency registration-fee output for a sub-ID.
  *
- * The daemon pays this fee as a plain reserve output (EVAL_RESERVE_OUTPUT)
- * holding `feeAmount` of the parent currency AT the parent currency's own
- * i-address, carrying zero native value. Verified against `registeridentity`
- * on VRSCTEST and an accepted on-chain sub-ID registration: for a currency
- * with idregistrationfees=1.0 the fee output is exactly `{parent: 1.0}` at the
- * parent, 0 native, and the native cost that leaves the transaction is the
- * currency's idimportfees (the caller passes it as `nativeImportFee`).
+ * The fee-output STRUCTURE depends on the parent currency's proofprotocol,
+ * verified against accepted on-chain registrations on VRSCTEST:
+ *  - proofprotocol 2 (centralized / token, e.g. `ownora-nft`): a plain reserve
+ *    output (EVAL_RESERVE_OUTPUT) holding `feeAmount` of the parent AT the
+ *    parent's i-address, ZERO native.
+ *  - otherwise (e.g. proofprotocol 1 PBaaS/fractional, `fum`): a CReserveTransfer
+ *    (EVAL_RESERVE_TRANSFER) of `feeAmount` to the parent, carrying
+ *    RESERVE_TRANSFER_FEE (0.0002) native.
  *
- * A previous implementation built this as a CReserveTransfer to the
- * reserve-transfer eval address carrying 0.0002 native — a cross-currency
- * transfer, not a same-chain fee payment. That structure never matched the
- * daemon and was never accepted at broadcast.
+ * An offline SDK cannot read the parent's proofprotocol, so the caller passes it
+ * (`parentProofProtocol`). In both cases the native the transaction actually
+ * burns is the parent's idimportfees (`nativeImportFee`); the fee output's own
+ * native value is funded and cancels out in the conservation accounting.
  *
- * `systemId`/`_controlAddress` are retained for signature compatibility and
- * are unused: the fee is denominated in and paid to the parent currency.
+ * `_controlAddress` is retained for signature compatibility and is unused.
  */
-function buildRegistrationFeeOutput(parentCurrencyId, feeAmount, systemId, _controlAddress) {
-    void systemId;
-    return buildTokenChangeOutput((0, brands_js_1.parseIAddress)(parentCurrencyId, 'parentCurrencyId'), new Map([[parentCurrencyId, feeAmount]]));
+function buildRegistrationFeeOutput(parentCurrencyId, feeAmount, systemId, _controlAddress, parentProofProtocol = 2) {
+    if (parentProofProtocol === 2) {
+        return buildTokenChangeOutput((0, brands_js_1.parseIAddress)(parentCurrencyId, 'parentCurrencyId'), new Map([[parentCurrencyId, feeAmount]]));
+    }
+    return buildRegistrationFeeReserveTransfer(parentCurrencyId, feeAmount, systemId);
+}
+/**
+ * CReserveTransfer fee output for a sub-ID under a non-centralized (proofprotocol
+ * != 2) parent — the daemon's form for PBaaS/fractional currencies. Carries
+ * RESERVE_TRANSFER_FEE native.
+ */
+function buildRegistrationFeeReserveTransfer(parentCurrencyId, feeAmount, systemId) {
+    const destination = new boundary_js_1.TxDestination(boundary_js_1.KeyID.fromAddress(index_js_1.RESERVE_TRANSFER_EVAL_PKH));
+    const values = new boundary_js_1.CurrencyValueMap({
+        value_map: new Map([[parentCurrencyId, new bn_js_1.default(feeAmount.toString(10))]]),
+        multivalue: false,
+    });
+    const parentHash = (0, boundary_js_3.fromBase58Check)(parentCurrencyId).hash;
+    const transferDest = new boundary_js_1.TransferDestination({ type: boundary_js_1.DEST_ID, destination_bytes: Buffer.from(parentHash) });
+    const flags = boundary_js_1.RESERVE_TRANSFER_VALID.or(boundary_js_1.RESERVE_TRANSFER_BURN_CHANGE_PRICE);
+    const resTransfer = new boundary_js_1.ReserveTransfer({
+        values,
+        version: new bn_js_1.default(1),
+        flags,
+        fee_currency_id: systemId,
+        fee_amount: new bn_js_1.default(index_js_1.RESERVE_TRANSFER_FEE.toString(10)),
+        transfer_destination: transferDest,
+        dest_currency_id: parentCurrencyId,
+    });
+    const master = new boundary_js_1.OptCCParams({
+        version: new bn_js_1.default(3), eval_code: new bn_js_1.default(boundary_js_2.EVALS.EVAL_NONE), m: new bn_js_1.default(1), n: new bn_js_1.default(1),
+        destinations: [destination], vdata: [],
+    });
+    const params = new boundary_js_1.OptCCParams({
+        version: new bn_js_1.default(3), eval_code: new bn_js_1.default(boundary_js_2.EVALS.EVAL_RESERVE_TRANSFER), m: new bn_js_1.default(1), n: new bn_js_1.default(1),
+        destinations: [destination], vdata: [resTransfer.toBuffer()],
+    });
+    const script = new boundary_js_1.SmartTransactionScript(master, params);
+    return { script: script.toBuffer(), nativeValue: index_js_1.RESERVE_TRANSFER_FEE };
 }
 /**
  * Build a token change output (EVAL_RESERVE_OUTPUT)
@@ -400,10 +450,10 @@ function buildTokenChangeOutput(changeAddress, currencyChanges) {
     // R-addresses, and reject a P2SH address (not a valid reserve destination).
     let destination;
     if ((0, brands_js_1.isIAddress)(changeAddress)) {
-        destination = new verus_typescript_primitives_1.TxDestination(verus_typescript_primitives_1.IdentityID.fromAddress(changeAddress));
+        destination = new boundary_js_1.TxDestination(boundary_js_1.IdentityID.fromAddress(changeAddress));
     }
     else if ((0, brands_js_1.isRAddress)(changeAddress)) {
-        destination = new verus_typescript_primitives_1.TxDestination(verus_typescript_primitives_1.KeyID.fromAddress(changeAddress));
+        destination = new boundary_js_1.TxDestination(boundary_js_1.KeyID.fromAddress(changeAddress));
     }
     else {
         throw new errors_js_1.TransactionBuildError(`token change address must be an R-address or identity i-address, got: ${changeAddress}`);
@@ -414,28 +464,28 @@ function buildTokenChangeOutput(changeAddress, currencyChanges) {
             valueMap.set(currency, new bn_js_1.default(amount.toString(10)));
         }
     }
-    const values = new verus_typescript_primitives_1.CurrencyValueMap({
+    const values = new boundary_js_1.CurrencyValueMap({
         value_map: valueMap,
         multivalue: false,
     });
-    const tokenOutput = new verus_typescript_primitives_1.TokenOutput({ version: new bn_js_1.default(1), values });
-    const master = new verus_typescript_primitives_1.OptCCParams({
+    const tokenOutput = new boundary_js_1.TokenOutput({ version: new bn_js_1.default(1), values });
+    const master = new boundary_js_1.OptCCParams({
         version: new bn_js_1.default(3),
-        eval_code: new bn_js_1.default(verus_typescript_primitives_2.EVALS.EVAL_NONE),
+        eval_code: new bn_js_1.default(boundary_js_2.EVALS.EVAL_NONE),
         m: new bn_js_1.default(1),
         n: new bn_js_1.default(1),
         destinations: [destination],
         vdata: [],
     });
-    const params = new verus_typescript_primitives_1.OptCCParams({
+    const params = new boundary_js_1.OptCCParams({
         version: new bn_js_1.default(3),
-        eval_code: new bn_js_1.default(verus_typescript_primitives_2.EVALS.EVAL_RESERVE_OUTPUT),
+        eval_code: new bn_js_1.default(boundary_js_2.EVALS.EVAL_RESERVE_OUTPUT),
         m: new bn_js_1.default(1),
         n: new bn_js_1.default(1),
         destinations: [destination],
         vdata: [tokenOutput.toBuffer()],
     });
-    const script = new verus_typescript_primitives_1.SmartTransactionScript(master, params);
+    const script = new boundary_js_1.SmartTransactionScript(master, params);
     return { script: script.toBuffer(), nativeValue: 0n };
 }
 // ─── Validation ──────────────────────────────────────────────────
@@ -444,7 +494,7 @@ function validateIdentityWif(wif) {
     if (!wif || typeof wif !== 'string') {
         throw new errors_js_1.InvalidWifError('WIF is required');
     }
-    const check = (0, index_js_5.validateWif)(wif);
+    const check = (0, index_js_4.validateWif)(wif);
     if (!check.valid) {
         throw new errors_js_1.InvalidWifError(check.error);
     }
@@ -468,54 +518,30 @@ function buildAndSignCommitment(params, network) {
         throw new errors_js_1.TransactionBuildError('At least one UTXO is required');
     }
     const verusNetwork = (0, index_js_3.getNetwork)(network === 'testnet');
-    const networkConfig = index_js_1.NETWORK_CONFIG[network];
     // The commitment output is controlled by, and must be spent by, the key that
     // completes the registration in step 2 — which signs with this same WIF. Using
     // changeAddress as the control address broke that when changeAddress differed
     // from the WIF's address (unsignable commitment), or was an i-address
     // (KeyID.fromAddress laundered it to an uncontrollable key — permanently
     // unspendable, wasting the commitment fee). Derive it from the WIF instead.
-    const controlAddress = utxo_lib_1.ECPair.fromWIF(params.wif, verusNetwork).getAddress();
+    const controlAddress = boundary_js_4.ECPair.fromWIF(params.wif, verusNetwork).getAddress();
     const commitment = prepareNameCommitment(params.name, controlAddress, params.referral, params.parent, network, params.salt);
-    const utxos = params.utxos;
-    const selection = (0, index_js_4.selectUtxos)(utxos, 0n, new Map(), 1, networkConfig.chainId, undefined, true);
-    const txb = new utxo_lib_1.TransactionBuilder(verusNetwork);
-    txb.setVersion(4);
-    txb.setExpiryHeight((0, index_js_3.resolveExpiryHeight)(params.expiryHeight));
-    txb.setVersionGroupId(index_js_1.VERSION_GROUP_ID);
-    for (const utxo of selection.selected) {
-        txb.addInput(Buffer.from(utxo.txid, 'hex').reverse(), utxo.outputIndex, 0xffffffff, Buffer.from(utxo.script, 'hex'));
-    }
-    txb.addOutput(commitment.commitmentScript, 0);
-    // If native-only UTXOs can't cover the fee, selectUtxos falls back to a
-    // token-bearing UTXO and returns its token value as currencyChanges. Emit it
-    // as a reserve-output change (bundled with the native change) — otherwise
-    // that token value is silently forfeited to the miner.
-    const hasTokenChange = selection.currencyChanges.size > 0;
-    if (hasTokenChange || selection.nativeChange > 0n) {
-        if (hasTokenChange) {
-            const tokenChangeScript = buildTokenChangeOutput((0, brands_js_1.parseAddress)(params.changeAddress, 'changeAddress'), selection.currencyChanges);
-            txb.addOutput(tokenChangeScript.script, (0, index_js_2.toSafeNumber)(selection.nativeChange));
-        }
-        else if (params.changeAddress.startsWith('i')) {
-            // utxo-lib's addOutput only resolves base58 R-addresses; an i-address
-            // changeAddress needs the explicit P2ID script (matching sendCurrency), or
-            // it throws an untyped "no matching Script".
-            txb.addOutput(identityPaymentScript((0, brands_js_1.parseIAddress)(params.changeAddress, 'changeAddress')), (0, index_js_2.toSafeNumber)(selection.nativeChange));
-        }
-        else {
-            txb.addOutput(params.changeAddress, (0, index_js_2.toSafeNumber)(selection.nativeChange));
-        }
-    }
-    // No token is paid out here (the commitment output carries none), so every
-    // token in the selected inputs must return as change.
-    (0, index_js_4.assertTokenConservation)(selection.selected, new Map(), selection.currencyChanges, networkConfig.chainId, 'name commitment');
-    const unsignedTx = txb.buildIncomplete();
-    const { signedTx, txid } = (0, index_js_3.signTransactionSmart)(unsignedTx.toHex(), params.wif, selection.selected, verusNetwork);
+    // The commitment output carries no token and no native value; the assembler
+    // selects funding, emits change, and enforces conservation by construction.
+    const assembled = (0, assembler_js_1.assembleAndSign)({
+        network,
+        wif: params.wif,
+        expiryHeight: params.expiryHeight,
+        funding: params.utxos,
+        outputs: [{ script: commitment.commitmentScript, nativeSat: 0n }],
+        changeAddress: params.changeAddress,
+        fee: { policy: 'estimate' },
+        label: 'name commitment',
+    });
     return {
-        signedTx,
-        txid,
-        fee: selection.fee,
+        signedTx: assembled.signedTx,
+        txid: assembled.txid,
+        fee: assembled.fee,
         identityAddress: commitment.identityAddress,
         commitmentData: {
             name: params.name,
@@ -541,6 +567,17 @@ function buildAndSignRegistration(params, network) {
     const verusNetwork = (0, index_js_3.getNetwork)(network === 'testnet');
     const networkConfig = index_js_1.NETWORK_CONFIG[network];
     const systemId = networkConfig.chainId;
+    // Step 2 spends the name-commitment output, which is controlled by the key that
+    // created it in step 1. The fork signs the commitment input with whatever WIF it
+    // is handed, so a mismatched WIF produces a tx the daemon rejects at broadcast
+    // (and the commitment fee is wasted). Verify the WIF's hash is the commitment's
+    // control hash up front. (The 20-byte control hash is embedded in the CC script.)
+    const signerAddr = boundary_js_4.ECPair.fromWIF(params.wif, verusNetwork).getAddress();
+    const signerHash = (0, index_js_2.addressToScriptPubKey)(signerAddr).subarray(3, 23).toString('hex');
+    if (!params.commitmentUtxo.script.toLowerCase().includes(signerHash)) {
+        throw new errors_js_1.TransactionBuildError(`the provided WIF (${signerAddr}) does not control the name-commitment output; step 2 must be ` +
+            `signed by the same key that created the commitment in step 1.`);
+    }
     const commitData = params.commitmentData;
     const parentIAddress = commitData.parent || systemId;
     const isSubId = !isVRSCParent(commitData.parent || undefined, network);
@@ -558,11 +595,11 @@ function buildAndSignRegistration(params, network) {
     const identityScript = buildIdentityScript(identity);
     const reservationScript = buildReservationScript((0, brands_js_1.parseIAddress)(identityAddress, 'identityAddress'), Buffer.from(commitData.namereservationHex, 'hex'), isSubId);
     if (isSubId) {
-        return _buildSubIdRegistration(params, identity, identityScript, reservationScript, identityAddress, parentIAddress, systemId, verusNetwork);
+        return _buildSubIdRegistration(params, identityScript, reservationScript, identityAddress, parentIAddress, systemId, network);
     }
-    return _buildVrscRegistration(params, identityScript, reservationScript, identityAddress, parentIAddress, systemId, verusNetwork);
+    return _buildVrscRegistration(params, identityScript, reservationScript, identityAddress, parentIAddress, network);
 }
-function _buildVrscRegistration(params, identityScript, reservationScript, identityAddress, parentIAddress, systemId, network) {
+function _buildVrscRegistration(params, identityScript, reservationScript, identityAddress, parentIAddress, network) {
     const commitData = params.commitmentData;
     const hasReferral = !!commitData.referral;
     const fees = calculateRegistrationFees(hasReferral, params.registrationFee, params.referralLevels);
@@ -596,155 +633,119 @@ function _buildVrscRegistration(params, identityScript, reservationScript, ident
     // exactly (totalFee - issuerFee) every referred registration.
     const totalFee = params.registrationFee ?? index_js_1.DEFAULT_REGISTRATION_FEE;
     const totalReferralPayments = referralOutputs.reduce((sum, o) => sum + o.value, 0n);
-    const requiredNative = hasReferral ? fees.issuerFee : totalFee;
-    const numOutputs = 2 + referralOutputs.length + 1;
-    const selection = (0, index_js_4.selectUtxos)(params.utxos, requiredNative, new Map(), numOutputs, systemId, undefined, true);
-    const txb = new utxo_lib_1.TransactionBuilder(network);
-    txb.setVersion(4);
-    txb.setExpiryHeight((0, index_js_3.resolveExpiryHeight)(params.expiryHeight));
-    txb.setVersionGroupId(index_js_1.VERSION_GROUP_ID);
-    const commitUtxo = params.commitmentUtxo;
-    txb.addInput(Buffer.from(commitUtxo.txid, 'hex').reverse(), commitUtxo.outputIndex, 0xffffffff, Buffer.from(commitUtxo.script, 'hex'));
-    for (const utxo of selection.selected) {
-        txb.addInput(Buffer.from(utxo.txid, 'hex').reverse(), utxo.outputIndex, 0xffffffff, Buffer.from(utxo.script, 'hex'));
-    }
-    txb.addOutput(identityScript, 0);
-    for (const referralOut of referralOutputs) {
-        txb.addOutput(referralOut.script, (0, index_js_2.toSafeNumber)(referralOut.value));
-    }
-    txb.addOutput(reservationScript, 0);
-    // Registration needs ~80-100 native, so Phase-2 selection is especially
-    // likely to exhaust pure-native UTXOs and pull a token-bearing one; return
-    // its token value as reserve-output change instead of forfeiting it to the
-    // miner. (The commitment input carries no currency.)
-    const hasTokenChange = selection.currencyChanges.size > 0;
-    if (hasTokenChange || selection.nativeChange > 0n) {
-        if (hasTokenChange) {
-            const tokenChangeScript = buildTokenChangeOutput((0, brands_js_1.parseAddress)(params.changeAddress, 'changeAddress'), selection.currencyChanges);
-            txb.addOutput(tokenChangeScript.script, (0, index_js_2.toSafeNumber)(selection.nativeChange));
-        }
-        else if (params.changeAddress.startsWith('i')) {
-            // utxo-lib's addOutput only resolves base58 R-addresses; an i-address
-            // changeAddress needs the explicit P2ID script (matching sendCurrency), or
-            // it throws an untyped "no matching Script".
-            txb.addOutput(identityPaymentScript((0, brands_js_1.parseIAddress)(params.changeAddress, 'changeAddress')), (0, index_js_2.toSafeNumber)(selection.nativeChange));
-        }
-        else {
-            txb.addOutput(params.changeAddress, (0, index_js_2.toSafeNumber)(selection.nativeChange));
-        }
-    }
-    // Referral payouts are native; no token is paid out, so all token value in the
-    // selected inputs must return as change.
-    (0, index_js_4.assertTokenConservation)(selection.selected, new Map(), selection.currencyChanges, systemId, 'identity registration');
-    const unsignedTx = txb.buildIncomplete();
-    const allUtxos = [commitUtxo, ...selection.selected];
-    // The registration fee is burned as an IMPLICIT miner fee (identity and
-    // reservation outputs carry 0; referral payouts come out of the total) —
-    // this matches on-chain registrations, and the daemon exempts recognized
-    // identity definitions from its absurd-fee check (IS_HIGH_FEE). utxo-lib's
-    // client-side fee-rate cap (default 2500 sat/vbyte) must be told the
-    // intended absolute fee or build() throws "Transaction has absurd fees".
-    const expectedImplicitFee = commitUtxo.satoshis + requiredNative - totalReferralPayments + selection.fee;
-    // Independent value-conservation check on the assembled transaction: recompute
-    // the native fee straight from inputs and outputs and require it to equal the
-    // fee this path intends to pay. buildAndSign has the same guard; registration
-    // moves the largest amounts (the registration fee is burned as implicit fee),
-    // so a selection/accounting slip must fail loudly here instead of being paid
-    // to miners.
-    const assembledNativeFee = allUtxos.reduce((sum, u) => sum + u.satoshis, 0n) -
-        unsignedTx.outs.reduce((sum, o) => sum + BigInt(o.value), 0n);
-    if (assembledNativeFee !== expectedImplicitFee) {
-        throw new errors_js_1.TransactionBuildError(`identity registration value conservation failed: assembled native fee ${assembledNativeFee} sat ` +
-            `!= intended ${expectedImplicitFee} sat`);
-    }
-    const { signedTx, txid } = (0, index_js_3.signTransactionSmart)(unsignedTx.toHex(), params.wif, allUtxos, network, expectedImplicitFee);
+    // With a referral the registrant pays the discounted issuer fee, otherwise the
+    // full registration fee. Either way the referral payouts come OUT OF that
+    // outlay; the remainder is burned as the implicit miner fee.
+    const registrationOutlay = hasReferral ? fees.issuerFee : totalFee;
+    // The identity and reservation outputs carry 0 native; the referral payouts are
+    // the only value-bearing outputs. The rest of the outlay is a DECLARED burn, so
+    // the assembler funds it, sizes the fee cap for it, and enforces conservation.
+    const assembled = (0, assembler_js_1.assembleAndSign)({
+        network,
+        wif: params.wif,
+        expiryHeight: params.expiryHeight,
+        funding: params.utxos,
+        // The name-commitment output is spent as input 0 (it carries no currency).
+        leadingInputs: [params.commitmentUtxo],
+        outputs: [
+            { script: identityScript, nativeSat: 0n },
+            ...referralOutputs.map((o) => ({ script: o.script, nativeSat: o.value })),
+            { script: reservationScript, nativeSat: 0n },
+        ],
+        changeAddress: params.changeAddress,
+        // Legacy fee estimate: identity + referrals + reservation, plus the one extra
+        // change slot the original path counted on top of selectUtxos' own reserve.
+        feeOutputCount: 2 + referralOutputs.length + 1,
+        fee: {
+            policy: 'declared',
+            burnSat: registrationOutlay - totalReferralPayments,
+            reason: 'identity registration fee (burned as implicit miner fee)',
+        },
+        label: 'identity registration',
+    });
     return {
-        signedTx,
-        txid,
-        fee: selection.fee,
+        signedTx: assembled.signedTx,
+        txid: assembled.txid,
+        fee: assembled.fee,
         identityAddress,
         // The registrant's registration outlay: the discounted issuer fee when
         // referred, the full fee otherwise. (Of this, referralPayments go to the
         // referrers and the remainder is the implicit miner fee.)
-        registrationFee: requiredNative,
+        registrationFee: registrationOutlay,
         referralPayments: referralOutputs.length,
         referralAmountEach: fees.referralAmount,
-        inputsUsed: allUtxos.length,
-        nativeChange: selection.nativeChange,
+        inputsUsed: assembled.inputsUsed,
+        nativeChange: assembled.nativeChange,
     };
 }
-function _buildSubIdRegistration(params, identity, identityScript, reservationScript, identityAddress, parentIAddress, systemId, network) {
+function _buildSubIdRegistration(params, identityScript, reservationScript, identityAddress, parentIAddress, systemId, network) {
     const registrationFeeAmount = params.registrationFeeAmount;
     if (!registrationFeeAmount || registrationFeeAmount <= 0n) {
         throw new errors_js_1.TransactionBuildError('registrationFeeAmount is required for sub-ID registration. ' +
             'Specify the fee in parent currency satoshis.');
     }
-    const feeOutput = buildRegistrationFeeOutput(parentIAddress, registrationFeeAmount, systemId, params.changeAddress);
+    // The fee-output structure differs by the parent's proofprotocol (2 =
+    // reserve output, else reserve transfer), which the offline SDK cannot read —
+    // the caller must supply it (from `getcurrency <parent>.proofprotocol`).
+    if (params.parentProofProtocol === undefined) {
+        throw new errors_js_1.TransactionBuildError("parentProofProtocol is required for sub-ID registration: pass the parent currency's proofprotocol " +
+            '(from `getcurrency <parent>`) — 2 for a centralized/token currency, 1 for a PBaaS/fractional one.');
+    }
+    const feeOutput = buildRegistrationFeeOutput(parentIAddress, registrationFeeAmount, systemId, params.changeAddress, params.parentProofProtocol);
     const requiredCurrencies = new Map([
         [parentIAddress, registrationFeeAmount],
     ]);
-    const nativeImportFee = params.nativeImportFee || 0n;
-    const nativeTarget = feeOutput.nativeValue + nativeImportFee;
-    const numOutputs = 4;
-    const selection = (0, index_js_4.selectUtxos)(params.utxos, nativeTarget, requiredCurrencies, numOutputs, systemId, undefined, true, 
-    // The identity and reservation outputs embed the full serialized identity /
-    // advanced name reservation (a large contentMultimap can make them
-    // multi-KB); size the fee from their real bytes, matching the VRSC
-    // registration / update / define paths, so a big sub-ID isn't fee-estimated
-    // below the relay minimum and rejected.
-    identityScript.length + reservationScript.length + feeOutput.script.length);
-    // The parent-currency fee (requiredCurrencies) is paid to the fee output and
-    // any excess returns as token change; guard that no token value is dropped.
-    (0, index_js_4.assertTokenConservation)(selection.selected, requiredCurrencies, selection.currencyChanges, systemId, 'sub-ID registration');
-    const txb = new utxo_lib_1.TransactionBuilder(network);
-    txb.setVersion(4);
-    txb.setExpiryHeight((0, index_js_3.resolveExpiryHeight)(params.expiryHeight));
-    txb.setVersionGroupId(index_js_1.VERSION_GROUP_ID);
-    const commitUtxo = params.commitmentUtxo;
-    txb.addInput(Buffer.from(commitUtxo.txid, 'hex').reverse(), commitUtxo.outputIndex, 0xffffffff, Buffer.from(commitUtxo.script, 'hex'));
-    for (const utxo of selection.selected) {
-        txb.addInput(Buffer.from(utxo.txid, 'hex').reverse(), utxo.outputIndex, 0xffffffff, Buffer.from(utxo.script, 'hex'));
-    }
-    txb.addOutput(identityScript, 0);
-    txb.addOutput(feeOutput.script, (0, index_js_2.toSafeNumber)(feeOutput.nativeValue));
-    txb.addOutput(reservationScript, 0);
-    const hasTokenChange = selection.currencyChanges.size > 0;
-    if (hasTokenChange || selection.nativeChange > 0n) {
-        if (hasTokenChange) {
-            const tokenChangeScript = buildTokenChangeOutput((0, brands_js_1.parseAddress)(params.changeAddress, 'changeAddress'), selection.currencyChanges);
-            txb.addOutput(tokenChangeScript.script, (0, index_js_2.toSafeNumber)(selection.nativeChange));
-        }
-        else {
-            // utxo-lib's addOutput only resolves base58 R-addresses; an i-address
-            // changeAddress needs the explicit P2ID script (matching sendCurrency), or
-            // it throws an untyped "no matching Script".
-            if (params.changeAddress.startsWith('i')) {
-                txb.addOutput(identityPaymentScript((0, brands_js_1.parseIAddress)(params.changeAddress, 'changeAddress')), (0, index_js_2.toSafeNumber)(selection.nativeChange));
-            }
-            else {
-                txb.addOutput(params.changeAddress, (0, index_js_2.toSafeNumber)(selection.nativeChange));
-            }
-        }
-    }
-    const unsignedTx = txb.buildIncomplete();
-    const allUtxos = [commitUtxo, ...selection.selected];
-    // Native value conservation. The parent-currency registration fee is a token
-    // reserve-transfer (selection returns any excess as token change), so the
-    // NATIVE fee this path pays is the commitment input's value (folded to fee,
-    // like VRSC registration) + the native import fee + the miner fee. Verified
-    // live on VRSCTEST: a sub-ID under `ownora` (1.0 token fee) paid 0.02 native.
-    (0, index_js_3.assertNativeConservation)(allUtxos, unsignedTx.outs, commitUtxo.satoshis + nativeImportFee + selection.fee, 'sub-ID registration');
-    const { signedTx, txid } = (0, index_js_3.signTransactionSmart)(unsignedTx.toHex(), params.wif, allUtxos, network);
+    // The parent currency's idimportfees must leave the transaction as native fee;
+    // this SDK is offline and cannot read it, so the caller must pass it explicitly.
+    // Silently defaulting to 0 underfunds a currency that charges an import fee, and
+    // the daemon rejects the registration.
+    if (params.nativeImportFee === undefined) {
+        throw new errors_js_1.TransactionBuildError("nativeImportFee is required for sub-ID registration: pass the parent currency's idimportfees " +
+            '(from `getcurrency <parent>`), or 0n if it charges none.');
+    }
+    const nativeImportFee = params.nativeImportFee;
+    // The identity + reservation outputs carry 0 native but embed the full
+    // serialized identity / advanced name reservation (a large contentMultimap
+    // makes them multi-KB), so the fee is sized from their real bytes — matching
+    // the VRSC/update/define paths — instead of the fixed smart-output estimate.
+    // The fee output carries the parent-currency registration fee (a reserve output
+    // for pp2, a reserve transfer for pp1); the parent's idimportfees leaves as a
+    // DECLARED native burn. Verified live on VRSCTEST: a sub-ID under `ownora`
+    // (1.0 token fee) paid 0.02 native.
+    const assembled = (0, assembler_js_1.assembleAndSign)({
+        network,
+        wif: params.wif,
+        expiryHeight: params.expiryHeight,
+        funding: params.utxos,
+        // The name-commitment output is spent as input 0 (it carries no currency).
+        leadingInputs: [params.commitmentUtxo],
+        outputs: [
+            { script: identityScript, nativeSat: 0n },
+            { script: feeOutput.script, nativeSat: feeOutput.nativeValue, carries: requiredCurrencies },
+            { script: reservationScript, nativeSat: 0n },
+        ],
+        changeAddress: params.changeAddress,
+        // Legacy fee estimate: identity + fee + reservation, plus the one extra change
+        // slot the original path counted on top of selectUtxos' own reserve.
+        feeOutputCount: 4,
+        extraOutputBytes: identityScript.length + reservationScript.length + feeOutput.script.length,
+        fee: {
+            policy: 'declared',
+            burnSat: nativeImportFee,
+            reason: "parent currency's idimportfees (leaves as native import fee)",
+        },
+        label: 'sub-ID registration',
+    });
     return {
-        signedTx,
-        txid,
-        fee: selection.fee,
+        signedTx: assembled.signedTx,
+        txid: assembled.txid,
+        fee: assembled.fee,
         identityAddress,
         registrationFee: registrationFeeAmount,
         referralPayments: 0,
         referralAmountEach: 0n,
-        inputsUsed: allUtxos.length,
-        nativeChange: selection.nativeChange,
+        inputsUsed: assembled.inputsUsed,
+        nativeChange: assembled.nativeChange,
     };
 }
 /**
@@ -759,9 +760,7 @@ function buildAndSignIdentityUpdate(params, network, operation = 'update', lockU
         throw new errors_js_1.TransactionBuildError('At least one funding UTXO is required');
     }
     const verusNetwork = (0, index_js_3.getNetwork)(network === 'testnet');
-    const networkConfig = index_js_1.NETWORK_CONFIG[network];
-    const systemId = networkConfig.chainId;
-    const identity = new verus_typescript_primitives_1.Identity();
+    const identity = new boundary_js_1.Identity();
     identity.fromBuffer(Buffer.from(params.identityHex, 'hex'));
     // update/lock/unlock are authorized by the identity's primary key(s). The fork
     // signs CC inputs with whatever key it is given, so a WIF that does not control
@@ -783,12 +782,23 @@ function buildAndSignIdentityUpdate(params, network, operation = 'update', lockU
         requiresPrimary = authority === self;
     }
     if (requiresPrimary) {
-        const signerAddress = utxo_lib_1.ECPair.fromWIF(params.wif, verusNetwork).getAddress();
+        const signerAddress = boundary_js_4.ECPair.fromWIF(params.wif, verusNetwork).getAddress();
         const currentPrimaries = (identity.primary_addresses ?? []).map((k) => k.toAddress());
         if (!currentPrimaries.includes(signerAddress)) {
             throw new errors_js_1.TransactionBuildError(`the provided WIF (${signerAddress}) is not among the identity's primary addresses ` +
                 `[${currentPrimaries.join(', ')}]; it cannot authorize a ${operation}.`);
         }
+        // Spending the identity input under primary authority needs min_sigs
+        // signatures, but this SDK signs with a single WIF and the bundled fork
+        // cannot attach a second signature to a CryptoCondition input. Emitting a
+        // 1-of-N-signed tx for a min_sigs>1 identity yields a hex the daemon rejects
+        // at broadcast; fail closed instead.
+        const currentMinSigs = identity.min_sigs?.toNumber?.() ?? 1;
+        if (currentMinSigs > 1) {
+            throw new errors_js_1.TransactionBuildError(`this identity requires ${currentMinSigs} signatures (min_sigs > 1); the SDK signs with a single ` +
+                `WIF and the bundled fork cannot multi-sign a CryptoCondition input, so a valid ${operation} ` +
+                `transaction cannot be produced. Use the daemon for multisig identities.`);
+        }
     }
     switch (operation) {
         case 'update': {
@@ -807,13 +817,21 @@ function buildAndSignIdentityUpdate(params, network, operation = 'update', lockU
                 identity.setRecovery(params.recoveryAuthority);
             }
             if (params.contentMap) {
+                // The daemon REPLACES the whole contentmap when the field is provided
+                // (and the contentMultimap branch below already replaces via fromJson).
+                // Merging into the parsed on-chain map instead re-attested stale keys and
+                // gave no way to delete one. Clear first so the provided map is authoritative.
+                identity.content_map.clear();
                 for (const [key, value] of Object.entries(params.contentMap)) {
-                    // Buffer.from(_, 'hex') silently drops non-hex characters and
-                    // truncates odd-length input, so a malformed value would be committed
-                    // to the identity on-chain as wrong/empty bytes with no error. Reject
-                    // it instead.
-                    if (!/^[0-9a-fA-F]*$/.test(value) || value.length % 2 !== 0) {
-                        throw new errors_js_1.TransactionBuildError(`contentMap["${key}"] must be an even-length hex string (got ${JSON.stringify(value)})`);
+                    // Keys are vdxf i-addresses; the primitives run fromBase58Check(key),
+                    // which discards the version byte — guard it like the multimap branch.
+                    assertAddressVersion(key, index_js_1.I_ADDR_VERSION, `contentMap key "${key}"`);
+                    // Values serialize as a fixed uint256 (32 bytes). Buffer.from(_, 'hex')
+                    // silently drops non-hex and truncates, so a wrong-length value would be
+                    // committed on-chain as wrong bytes (or build a payload the daemon can't
+                    // deserialize). Require exactly 64 hex chars.
+                    if (!/^[0-9a-fA-F]{64}$/.test(value)) {
+                        throw new errors_js_1.TransactionBuildError(`contentMap["${key}"] must be a 32-byte (64-hex-char) value (got ${JSON.stringify(value)})`);
                     }
                     identity.content_map.set(key, Buffer.from(value, 'hex'));
                 }
@@ -835,7 +853,7 @@ function buildAndSignIdentityUpdate(params, network, operation = 'update', lockU
                     }
                     jsonObj[key] = items;
                 }
-                identity.content_multimap = verus_typescript_primitives_1.ContentMultiMap.fromJson(jsonObj);
+                identity.content_multimap = boundary_js_1.ContentMultiMap.fromJson(jsonObj);
             }
             break;
         }
@@ -851,6 +869,13 @@ function buildAndSignIdentityUpdate(params, network, operation = 'update', lockU
             if (params.primaryAddresses) {
                 identity.setPrimaryAddresses(params.primaryAddresses);
             }
+            // Recovery commonly replaces the primary set; allow lowering min_sigs so a
+            // 2-of-2 identity can be recovered to a single fresh key (otherwise the
+            // stale min_sigs would exceed the new primary count — see the guard below).
+            if (params.minSigs !== undefined) {
+                validateMinSigs(params.minSigs, identity.primary_addresses?.length ?? 0);
+                identity.min_sigs = new bn_js_1.default(params.minSigs);
+            }
             if (params.revocationAuthority) {
                 identity.setRevocation(params.revocationAuthority);
             }
@@ -860,11 +885,20 @@ function buildAndSignIdentityUpdate(params, network, operation = 'update', lockU
             break;
         }
         case 'lock': {
-            const unlockAfter = lockUnlockParams?.unlockAfter;
-            if (!unlockAfter) {
-                throw new errors_js_1.TransactionBuildError('unlockAfter (block height) is required for lock operation');
+            const delay = lockUnlockParams?.unlockDelayBlocks;
+            if (delay === undefined || !Number.isInteger(delay) || delay <= 0) {
+                throw new errors_js_1.TransactionBuildError('unlockDelayBlocks (a positive integer RELATIVE delay in blocks, not a block height) is required for lock');
+            }
+            if (delay > MAX_UNLOCK_DELAY) {
+                throw new errors_js_1.TransactionBuildError(`unlockDelayBlocks ${delay} exceeds the consensus maximum ${MAX_UNLOCK_DELAY} (~22 years)`);
             }
-            identity.lock(new bn_js_1.default(unlockAfter));
+            // A block height (millions) passed as a delay locks the identity for years.
+            // Require an explicit opt-in above ~1 year to catch that mistake.
+            if (delay > LOCK_DELAY_SANITY_BLOCKS && !lockUnlockParams?.sanityOverride) {
+                throw new errors_js_1.TransactionBuildError(`unlockDelayBlocks ${delay} is over ~1 year (${LOCK_DELAY_SANITY_BLOCKS} blocks) — this is a RELATIVE ` +
+                    `delay, not a block height; pass sanityOverride: true if that long a lock is intended.`);
+            }
+            identity.lock(new bn_js_1.default(delay));
             break;
         }
         case 'unlock': {
@@ -881,69 +915,43 @@ function buildAndSignIdentityUpdate(params, network, operation = 'update', lockU
             break;
         }
     }
+    // A valid identity always has min_sigs <= number of primary addresses. Shrinking
+    // the primary set (update/recover) without lowering minSigs would leave a stale
+    // min_sigs the daemon rejects — or, worse, a permanently unspendable identity.
+    const finalPrimaries = identity.primary_addresses?.length ?? 0;
+    const finalMinSigs = identity.min_sigs?.toNumber?.() ?? 1;
+    if (finalMinSigs > finalPrimaries) {
+        throw new errors_js_1.TransactionBuildError(`resulting identity has min_sigs ${finalMinSigs} but only ${finalPrimaries} primary address(es); ` +
+            `pass minSigs to lower it when reducing the primary set.`);
+    }
     const identityBuf = identity.toBuffer();
     const unfundedHex = createUnfundedIdentityUpdate(identityBuf.toString('hex'), verusNetwork, (0, index_js_3.resolveExpiryHeight)(params.expiryHeight));
-    const selection = (0, index_js_4.selectUtxos)(params.utxos, 0n, new Map(), 1, systemId, undefined, true, 
-    // The identity output embeds the full serialized identity (a large
-    // contentMultimap can make it multi-KB); size the fee from its real bytes
-    // so a big update isn't fee-estimated below the relay minimum.
-    unfundedHex.length / 2);
-    // Update spends only native fees and emits no token-change output, so a
-    // token-bearing funding UTXO would be silently dropped. Fail closed if one
-    // was selected (both maps empty ⇒ assert no token enters).
-    (0, index_js_4.assertTokenConservation)(selection.selected, new Map(), new Map(), systemId, 'identity update');
-    const txb = new utxo_lib_1.TransactionBuilder(verusNetwork);
-    txb.setVersion(4);
-    txb.setExpiryHeight((0, index_js_3.resolveExpiryHeight)(params.expiryHeight));
-    txb.setVersionGroupId(index_js_1.VERSION_GROUP_ID);
-    for (const utxo of selection.selected) {
-        txb.addInput(Buffer.from(utxo.txid, 'hex').reverse(), utxo.outputIndex, 0xffffffff, Buffer.from(utxo.script, 'hex'));
-    }
-    const unfundedTx = utxo_lib_1.Transaction.fromHex(unfundedHex, verusNetwork);
-    for (const out of unfundedTx.outs) {
-        txb.addOutput(out.script, out.value);
-    }
-    if (selection.nativeChange > 0n) {
-        // utxo-lib's addOutput only resolves base58 R-addresses; an i-address
-        // changeAddress needs the explicit P2ID script (matching sendCurrency), or
-        // it throws an untyped "no matching Script".
-        if (params.changeAddress.startsWith('i')) {
-            txb.addOutput(identityPaymentScript((0, brands_js_1.parseIAddress)(params.changeAddress, 'changeAddress')), (0, index_js_2.toSafeNumber)(selection.nativeChange));
-        }
-        else {
-            txb.addOutput(params.changeAddress, (0, index_js_2.toSafeNumber)(selection.nativeChange));
-        }
-    }
-    const fundedTx = txb.buildIncomplete();
-    const fundedHex = fundedTx.toHex();
-    const prevOutScripts = selection.selected.map(u => Buffer.from(u.script, 'hex'));
-    const idUtxo = params.identityUtxo;
-    // The identity input is spent and its definition output is recreated with
-    // value 0, so any native value riding on identityUtxo would be silently
-    // burned to miner fee. Identity outputs normally carry 0; fail closed if not.
-    if (idUtxo.satoshis !== 0n) {
-        throw new errors_js_1.TransactionBuildError(`identityUtxo carries ${idUtxo.satoshis} native satoshis, which would be burned to miner fee ` +
-            `(the recreated identity output is value 0). Spend that value separately before updating.`);
-    }
-    const completedHex = completeFundedIdentityUpdate(fundedHex, verusNetwork, prevOutScripts, {
-        hash: Buffer.from(idUtxo.txid, 'hex').reverse(),
-        index: idUtxo.outputIndex,
-        sequence: 0xffffffff,
-        script: Buffer.from(idUtxo.script, 'hex'),
+    const unfundedTx = boundary_js_4.Transaction.fromHex(unfundedHex, verusNetwork);
+    // Respend the identity UTXO and recreate its (value-0) definition output; the
+    // shared assembler funds it, emits native change, grafts on the identity input
+    // (re-signed last by the fork), and enforces native + token conservation.
+    const assembled = (0, fundedIdentityUpdate_js_1.assembleFundedIdentityUpdate)({
+        network,
+        wif: params.wif,
+        expiryHeight: params.expiryHeight,
+        funding: params.utxos,
+        identityUtxo: params.identityUtxo,
+        outputs: unfundedTx.outs.map((o) => ({ script: o.script, nativeSat: BigInt(o.value) })),
+        changeAddress: params.changeAddress,
+        // The identity output embeds the full serialized identity (a large
+        // contentMultimap can make it multi-KB); size the fee from the unfunded tx's
+        // real bytes so a big update isn't fee-estimated below the relay minimum.
+        extraOutputBytes: unfundedHex.length / 2,
+        label: `identity ${operation}`,
     });
-    const allUtxos = [...selection.selected, idUtxo];
-    // The identity input and its recreated output are both value 0, so the
-    // assembled native fee must equal selection.fee. Fail loudly on any slip.
-    (0, index_js_3.assertNativeConservation)(allUtxos, utxo_lib_1.Transaction.fromHex(completedHex, verusNetwork).outs, selection.fee, `identity ${operation}`);
-    const { signedTx, txid } = (0, index_js_3.signTransactionSmart)(completedHex, params.wif, allUtxos, verusNetwork);
     return {
-        signedTx,
-        txid,
-        fee: selection.fee,
+        signedTx: assembled.signedTx,
+        txid: assembled.txid,
+        fee: assembled.fee,
         identityAddress: identity.getIdentityAddress(),
         operation,
-        inputsUsed: allUtxos.length,
-        nativeChange: selection.nativeChange,
+        inputsUsed: assembled.inputsUsed,
+        nativeChange: assembled.nativeChange,
     };
 }
 //# sourceMappingURL=index.js.map