@did-btcr2/aggregation 0.1.0 → 0.3.0

package/dist/cjs/core/index.js

@@ -0,0 +1,2423 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/core/index.ts
+var core_exports = {};
+__export(core_exports, {
+  AGGREGATED_NONCE: () => AGGREGATED_NONCE,
+  AGGREGATION_MESSAGE_PREFIX: () => AGGREGATION_MESSAGE_PREFIX,
+  AGGREGATION_WIRE_VERSION: () => AGGREGATION_WIRE_VERSION,
+  AUTHORIZATION_REQUEST: () => AUTHORIZATION_REQUEST,
+  AggregationCohort: () => AggregationCohort,
+  AggregationCohortError: () => AggregationCohortError,
+  AggregationParticipantError: () => AggregationParticipantError,
+  AggregationServiceError: () => AggregationServiceError,
+  BaseMessage: () => BaseMessage,
+  BeaconSigningSession: () => BeaconSigningSession,
+  COHORT_ADVERT: () => COHORT_ADVERT,
+  COHORT_OPT_IN: () => COHORT_OPT_IN,
+  COHORT_OPT_IN_ACCEPT: () => COHORT_OPT_IN_ACCEPT,
+  COHORT_READY: () => COHORT_READY,
+  CONSOLE_LOGGER: () => CONSOLE_LOGGER,
+  DEFAULT_BROADCAST_LOOKBACK_MS: () => DEFAULT_BROADCAST_LOOKBACK_MS,
+  DEFAULT_CLOCK_SKEW_SEC: () => DEFAULT_CLOCK_SKEW_SEC,
+  DEFAULT_FUNDING_MODEL: () => DEFAULT_FUNDING_MODEL,
+  DEFAULT_NONCE_LEN_BYTES: () => DEFAULT_NONCE_LEN_BYTES,
+  DEFAULT_NOSTR_RELAYS: () => DEFAULT_NOSTR_RELAYS,
+  DEFAULT_RECOVERY_SEQUENCE: () => DEFAULT_RECOVERY_SEQUENCE,
+  DISTRIBUTE_AGGREGATED_DATA: () => DISTRIBUTE_AGGREGATED_DATA,
+  DidCommTransport: () => DidCommTransport,
+  FALLBACK_AUTHORIZATION_REQUEST: () => FALLBACK_AUTHORIZATION_REQUEST,
+  FALLBACK_SIGNATURE: () => FALLBACK_SIGNATURE,
+  HTTP_ENVELOPE_VERSION: () => HTTP_ENVELOPE_VERSION,
+  HTTP_ROUTE: () => HTTP_ROUTE,
+  HttpTransportError: () => HttpTransportError,
+  InMemoryBus: () => InMemoryBus,
+  InMemoryTransport: () => InMemoryTransport,
+  KNOWN_BEACON_TYPES: () => KNOWN_BEACON_TYPES,
+  KNOWN_FUNDING_MODELS: () => KNOWN_FUNDING_MODELS,
+  KeyPairAggregationSigner: () => KeyPairAggregationSigner,
+  MAX_RECOVERY_SEQUENCE: () => MAX_RECOVERY_SEQUENCE,
+  NONCE_CONTRIBUTION: () => NONCE_CONTRIBUTION,
+  NostrTransport: () => NostrTransport,
+  ParticipantCohortPhase: () => ParticipantCohortPhase,
+  REQUEST_AUTH_SCHEME: () => REQUEST_AUTH_SCHEME,
+  SIGNATURE_AUTHORIZATION: () => SIGNATURE_AUTHORIZATION,
+  SILENT_LOGGER: () => SILENT_LOGGER,
+  SSE_EVENT: () => SSE_EVENT,
+  SUBMIT_NONINCLUDED: () => SUBMIT_NONINCLUDED,
+  SUBMIT_UPDATE: () => SUBMIT_UPDATE,
+  ServiceCohortPhase: () => ServiceCohortPhase,
+  SigningSessionError: () => SigningSessionError,
+  SigningSessionPhase: () => SigningSessionPhase,
+  TAPROOT_LEAF_VERSION: () => TAPROOT_LEAF_VERSION,
+  TransportAdapterError: () => TransportAdapterError,
+  TransportError: () => TransportError,
+  TypedEventEmitter: () => TypedEventEmitter,
+  VALIDATION_ACK: () => VALIDATION_ACK,
+  buildFallbackLeaf: () => buildFallbackLeaf,
+  buildFallbackSpend: () => buildFallbackSpend,
+  buildRecoveryLeaves: () => buildRecoveryLeaves,
+  buildRecoveryScript: () => buildRecoveryScript,
+  buildRecoverySpend: () => buildRecoverySpend,
+  buildRequestAuth: () => buildRequestAuth,
+  createAggregatedNonceMessage: () => createAggregatedNonceMessage,
+  createAuthorizationRequestMessage: () => createAuthorizationRequestMessage,
+  createCohortAdvertMessage: () => createCohortAdvertMessage,
+  createCohortOptInAcceptMessage: () => createCohortOptInAcceptMessage,
+  createCohortOptInMessage: () => createCohortOptInMessage,
+  createCohortReadyMessage: () => createCohortReadyMessage,
+  createDistributeAggregatedDataMessage: () => createDistributeAggregatedDataMessage,
+  createFallbackAuthorizationRequestMessage: () => createFallbackAuthorizationRequestMessage,
+  createFallbackSignatureMessage: () => createFallbackSignatureMessage,
+  createNonceContributionMessage: () => createNonceContributionMessage,
+  createSignatureAuthorizationMessage: () => createSignatureAuthorizationMessage,
+  createSubmitNonIncludedMessage: () => createSubmitNonIncludedMessage,
+  createSubmitUpdateMessage: () => createSubmitUpdateMessage,
+  createValidationAckMessage: () => createValidationAckMessage,
+  fallbackSighash: () => fallbackSighash,
+  getBeaconStrategy: () => getBeaconStrategy,
+  isAggregatedNonceMessage: () => isAggregatedNonceMessage,
+  isAggregationMessageType: () => isAggregationMessageType,
+  isAuthorizationRequestMessage: () => isAuthorizationRequestMessage,
+  isCohortAdvertMessage: () => isCohortAdvertMessage,
+  isCohortOptInAcceptMessage: () => isCohortOptInAcceptMessage,
+  isCohortOptInMessage: () => isCohortOptInMessage,
+  isCohortReadyMessage: () => isCohortReadyMessage,
+  isDistributeAggregatedDataMessage: () => isDistributeAggregatedDataMessage,
+  isFallbackAuthorizationRequestMessage: () => isFallbackAuthorizationRequestMessage,
+  isFallbackSignatureMessage: () => isFallbackSignatureMessage,
+  isKeygenMessageType: () => isKeygenMessageType,
+  isNonceContributionMessage: () => isNonceContributionMessage,
+  isSignMessageType: () => isSignMessageType,
+  isSignatureAuthorizationMessage: () => isSignatureAuthorizationMessage,
+  isSubmitNonIncludedMessage: () => isSubmitNonIncludedMessage,
+  isSubmitUpdateMessage: () => isSubmitUpdateMessage,
+  isUpdateMessageType: () => isUpdateMessageType,
+  isValidationAckMessage: () => isValidationAckMessage,
+  normalizeForWire: () => normalizeForWire,
+  parseRequestAuth: () => parseRequestAuth,
+  registerBeaconStrategy: () => registerBeaconStrategy,
+  resolveFallbackThreshold: () => resolveFallbackThreshold,
+  reviveFromWire: () => reviveFromWire,
+  signEnvelope: () => signEnvelope,
+  tapLeafHash: () => tapLeafHash,
+  validateCohortConditions: () => validateCohortConditions,
+  verifyEnvelope: () => verifyEnvelope,
+  verifyRequestAuth: () => verifyRequestAuth
+});
+module.exports = __toCommonJS(core_exports);
+
+// src/core/errors.ts
+var import_common = require("@did-btcr2/common");
+var AggregationServiceError = class extends import_common.MethodError {
+  constructor(message, type = "AggregationServiceError", data) {
+    super(message, type, data);
+  }
+};
+var AggregationParticipantError = class extends import_common.MethodError {
+  constructor(message, type = "AggregationParticipantError", data) {
+    super(message, type, data);
+  }
+};
+var AggregationCohortError = class extends import_common.MethodError {
+  constructor(message, type = "AggregationCohortError", data) {
+    super(message, type, data);
+  }
+};
+var SigningSessionError = class extends import_common.MethodError {
+  constructor(message, type = "SigningSessionError", data) {
+    super(message, type, data);
+  }
+};
+
+// src/core/logger.ts
+var CONSOLE_LOGGER = {
+  debug: (msg, ...args) => console.debug(msg, ...args),
+  info: (msg, ...args) => console.info(msg, ...args),
+  warn: (msg, ...args) => console.warn(msg, ...args),
+  error: (msg, ...args) => console.error(msg, ...args)
+};
+var SILENT_LOGGER = {
+  debug: () => {
+  },
+  info: () => {
+  },
+  warn: () => {
+  },
+  error: () => {
+  }
+};
+
+// src/core/recovery-policy.ts
+var import_secp256k1 = require("@noble/curves/secp256k1.js");
+var import_utils = require("@noble/hashes/utils");
+var import_btc_signer = require("@scure/btc-signer");
+var import_musig2 = require("@scure/btc-signer/musig2");
+var DEFAULT_FUNDING_MODEL = "operator-funded";
+var DEFAULT_RECOVERY_SEQUENCE = 144;
+var MAX_RECOVERY_SEQUENCE = 65535;
+var TAPROOT_LEAF_VERSION = 192;
+function compactSize(n) {
+  if (n < 253) return new Uint8Array([n]);
+  if (n <= 65535) return new Uint8Array([253, n & 255, n >> 8 & 255]);
+  return new Uint8Array([254, n & 255, n >> 8 & 255, n >> 16 & 255, n >> 24 & 255]);
+}
+function tapLeafHash(script, leafVersion = TAPROOT_LEAF_VERSION) {
+  return import_secp256k1.schnorr.utils.taggedHash(
+    "TapLeaf",
+    (0, import_utils.concatBytes)(new Uint8Array([leafVersion]), compactSize(script.length), script)
+  );
+}
+function resolveFallbackThreshold(advertised, n) {
+  return advertised ?? Math.max(1, n - 1);
+}
+function assertFallbackParams({ cohortKeys, fallbackThreshold }) {
+  const n = cohortKeys.length;
+  if (n === 0) {
+    throw new AggregationCohortError(
+      "Cannot build fallback leaf: no cohort keys.",
+      "NO_COHORT_KEYS"
+    );
+  }
+  for (const key of cohortKeys) {
+    if (key.length !== 33) {
+      throw new AggregationCohortError(
+        `Cohort key must be a 33-byte compressed public key, got ${key.length} bytes.`,
+        "INVALID_COHORT_KEY",
+        { length: key.length }
+      );
+    }
+  }
+  if (!Number.isInteger(fallbackThreshold) || fallbackThreshold < 1 || fallbackThreshold > n) {
+    throw new AggregationCohortError(
+      `Fallback threshold must be an integer in [1, ${n}] (k-of-n), got ${fallbackThreshold}.`,
+      "INVALID_FALLBACK_THRESHOLD",
+      { fallbackThreshold, n }
+    );
+  }
+}
+function buildFallbackLeaf(params) {
+  assertFallbackParams(params);
+  const xOnlyKeys = (0, import_musig2.sortKeys)(params.cohortKeys).map((k) => k.slice(1));
+  return (0, import_btc_signer.p2tr_ms)(params.fallbackThreshold, xOnlyKeys).script;
+}
+function assertRecoveryParams({ recoveryKey, recoverySequence }) {
+  if (recoveryKey.length !== 32) {
+    throw new AggregationCohortError(
+      `Recovery key must be a 32-byte x-only public key, got ${recoveryKey.length} bytes.`,
+      "INVALID_RECOVERY_KEY"
+    );
+  }
+  if (!Number.isInteger(recoverySequence) || recoverySequence < 1 || recoverySequence > MAX_RECOVERY_SEQUENCE) {
+    throw new AggregationCohortError(
+      `Recovery sequence must be a block-based BIP-68 relative timelock in [1, ${MAX_RECOVERY_SEQUENCE}], got ${recoverySequence}.`,
+      "INVALID_RECOVERY_SEQUENCE"
+    );
+  }
+}
+function buildRecoveryScript(params) {
+  assertRecoveryParams(params);
+  return import_btc_signer.Script.encode([
+    params.recoverySequence,
+    "CHECKSEQUENCEVERIFY",
+    "DROP",
+    params.recoveryKey,
+    "CHECKSIG"
+  ]);
+}
+function buildRecoveryLeaves(fundingModel, params) {
+  switch (fundingModel) {
+    case "operator-funded":
+      return [
+        { script: buildFallbackLeaf(params) },
+        { script: buildRecoveryScript(params) }
+      ];
+    case "participant-funded":
+      throw new AggregationCohortError(
+        "Funding model 'participant-funded' is reserved and not yet implemented.",
+        "UNSUPPORTED_FUNDING_MODEL",
+        { fundingModel }
+      );
+    default:
+      throw new AggregationCohortError(
+        `Unknown funding model: ${fundingModel}.`,
+        "UNKNOWN_FUNDING_MODEL",
+        { fundingModel }
+      );
+  }
+}
+
+// src/core/conditions.ts
+var KNOWN_BEACON_TYPES = ["CASBeacon", "SMTBeacon"];
+var KNOWN_FUNDING_MODELS = ["operator-funded", "participant-funded"];
+function checkPair(problems, label, min, max) {
+  if (min !== void 0 && (!Number.isInteger(min) || min < 0)) {
+    problems.push(`min${label} must be an integer >= 0`);
+  }
+  if (max !== void 0 && (!Number.isInteger(max) || max < 0)) {
+    problems.push(`max${label} must be an integer >= 0`);
+  }
+  if (min !== void 0 && max !== void 0 && Number.isInteger(min) && Number.isInteger(max) && max < min) {
+    problems.push(`max${label} must be >= min${label}`);
+  }
+}
+function checkCost(problems, label, cost) {
+  if (cost === void 0) return;
+  if (typeof cost.amount !== "number" || !Number.isFinite(cost.amount) || cost.amount < 0) {
+    problems.push(`${label}.amount must be a finite number >= 0`);
+  }
+  if (typeof cost.unit !== "string" || cost.unit.length === 0) {
+    problems.push(`${label}.unit must be a non-empty string`);
+  }
+  if (cost.basis !== void 0 && cost.basis !== "per-did" && cost.basis !== "per-participant") {
+    problems.push(`${label}.basis must be 'per-did' or 'per-participant'`);
+  }
+}
+function validateCohortConditions(c) {
+  const problems = [];
+  if (!KNOWN_BEACON_TYPES.includes(c.beaconType)) {
+    problems.push(`beaconType must be one of ${KNOWN_BEACON_TYPES.join(", ")}`);
+  }
+  if (!Number.isInteger(c.minParticipants) || c.minParticipants < 1) {
+    problems.push("minParticipants must be an integer >= 1");
+  }
+  if (c.maxParticipants !== void 0) {
+    if (!Number.isInteger(c.maxParticipants) || c.maxParticipants < 1) {
+      problems.push("maxParticipants must be an integer >= 1");
+    } else if (Number.isInteger(c.minParticipants) && c.maxParticipants < c.minParticipants) {
+      problems.push("maxParticipants must be >= minParticipants");
+    }
+  }
+  checkPair(problems, "DidsPerParticipant", c.minDidsPerParticipant, c.maxDidsPerParticipant);
+  checkPair(problems, "SecondsBetweenAnnouncements", c.minSecondsBetweenAnnouncements, c.maxSecondsBetweenAnnouncements);
+  if (c.pendingUpdateTrigger !== void 0 && (!Number.isInteger(c.pendingUpdateTrigger) || c.pendingUpdateTrigger < 1)) {
+    problems.push("pendingUpdateTrigger must be an integer >= 1");
+  }
+  if (c.fallbackThreshold !== void 0) {
+    if (!Number.isInteger(c.fallbackThreshold) || c.fallbackThreshold < 1) {
+      problems.push("fallbackThreshold must be an integer >= 1");
+    } else if (c.maxParticipants !== void 0 && Number.isInteger(c.maxParticipants) && c.fallbackThreshold > c.maxParticipants) {
+      problems.push("fallbackThreshold must be <= maxParticipants");
+    }
+  }
+  checkCost(problems, "costOfEnrollment", c.costOfEnrollment);
+  checkCost(problems, "costPerAnnouncement", c.costPerAnnouncement);
+  if (typeof c.recoveryKey !== "string" || !/^[0-9a-fA-F]{64}$/.test(c.recoveryKey)) {
+    problems.push("recoveryKey must be a 64-character hex string (x-only public key)");
+  }
+  if (!Number.isInteger(c.recoverySequence) || c.recoverySequence < 1 || c.recoverySequence > MAX_RECOVERY_SEQUENCE) {
+    problems.push(`recoverySequence must be a block-based BIP-68 relative timelock in [1, ${MAX_RECOVERY_SEQUENCE}]`);
+  }
+  if (c.fundingModel !== void 0 && !KNOWN_FUNDING_MODELS.includes(c.fundingModel)) {
+    problems.push(`fundingModel must be one of ${KNOWN_FUNDING_MODELS.join(", ")}`);
+  }
+  return problems;
+}
+
+// src/core/phases.ts
+var ServiceCohortPhase = /* @__PURE__ */ ((ServiceCohortPhase2) => {
+  ServiceCohortPhase2["Created"] = "Created";
+  ServiceCohortPhase2["Advertised"] = "Advertised";
+  ServiceCohortPhase2["CohortSet"] = "CohortSet";
+  ServiceCohortPhase2["CollectingUpdates"] = "CollectingUpdates";
+  ServiceCohortPhase2["UpdatesCollected"] = "UpdatesCollected";
+  ServiceCohortPhase2["DataDistributed"] = "DataDistributed";
+  ServiceCohortPhase2["Validated"] = "Validated";
+  ServiceCohortPhase2["SigningStarted"] = "SigningStarted";
+  ServiceCohortPhase2["NoncesCollected"] = "NoncesCollected";
+  ServiceCohortPhase2["AwaitingPartialSigs"] = "AwaitingPartialSigs";
+  ServiceCohortPhase2["FallbackRequested"] = "FallbackRequested";
+  ServiceCohortPhase2["Complete"] = "Complete";
+  ServiceCohortPhase2["Failed"] = "Failed";
+  return ServiceCohortPhase2;
+})(ServiceCohortPhase || {});
+var ParticipantCohortPhase = /* @__PURE__ */ ((ParticipantCohortPhase2) => {
+  ParticipantCohortPhase2["Discovered"] = "Discovered";
+  ParticipantCohortPhase2["OptedIn"] = "OptedIn";
+  ParticipantCohortPhase2["CohortReady"] = "CohortReady";
+  ParticipantCohortPhase2["UpdateSubmitted"] = "UpdateSubmitted";
+  ParticipantCohortPhase2["NonIncluded"] = "NonIncluded";
+  ParticipantCohortPhase2["AwaitingValidation"] = "AwaitingValidation";
+  ParticipantCohortPhase2["ValidationSent"] = "ValidationSent";
+  ParticipantCohortPhase2["AwaitingSigning"] = "AwaitingSigning";
+  ParticipantCohortPhase2["NonceSent"] = "NonceSent";
+  ParticipantCohortPhase2["AwaitingPartialSig"] = "AwaitingPartialSig";
+  ParticipantCohortPhase2["AwaitingFallbackSig"] = "AwaitingFallbackSig";
+  ParticipantCohortPhase2["Complete"] = "Complete";
+  ParticipantCohortPhase2["Failed"] = "Failed";
+  return ParticipantCohortPhase2;
+})(ParticipantCohortPhase || {});
+var SigningSessionPhase = /* @__PURE__ */ ((SigningSessionPhase2) => {
+  SigningSessionPhase2["AwaitingNonceContributions"] = "AwaitingNonceContributions";
+  SigningSessionPhase2["NonceContributionsReceived"] = "NonceContributionsReceived";
+  SigningSessionPhase2["AwaitingPartialSignatures"] = "AwaitingPartialSignatures";
+  SigningSessionPhase2["PartialSignaturesReceived"] = "PartialSignaturesReceived";
+  SigningSessionPhase2["Complete"] = "Complete";
+  SigningSessionPhase2["Failed"] = "Failed";
+  return SigningSessionPhase2;
+})(SigningSessionPhase || {});
+
+// src/core/cohort.ts
+var import_bitcoin = require("@did-btcr2/bitcoin");
+var import_common2 = require("@did-btcr2/common");
+var import_smt = require("@did-btcr2/smt");
+var import_secp256k12 = require("@noble/curves/secp256k1.js");
+var import_utils2 = require("@noble/hashes/utils");
+var import_btc_signer2 = require("@scure/btc-signer");
+var import_musig22 = require("@scure/btc-signer/musig2");
+var AggregationCohort = class {
+  /** Unique identifier for the cohort. */
+  id;
+  /** DID of the Aggregation Service managing this cohort. */
+  serviceDid;
+  /** Minimum number of participants required to finalize the cohort. */
+  minParticipants;
+  /** Network on which the cohort operates (mainnet, mutinynet, etc.). */
+  network;
+  /** Type of beacon used in the cohort: 'CASBeacon' or 'SMTBeacon'. */
+  beaconType;
+  /** List of participant DIDs that have been accepted into the cohort. */
+  participants = [];
+  /**
+   * Mapping from participant DID to their compressed secp256k1 public key.
+   * Distinct from {@link cohortKeys} (which is sorted per BIP-327): this lets
+   * callers look up a participant's key without knowing their position in the
+   * sorted array. Populated by the service at `acceptParticipant` time.
+   */
+  participantKeys = /* @__PURE__ */ new Map();
+  /** Sorted list of cohort participants' compressed public keys. */
+  #cohortKeys = [];
+  /**
+   * BIP-341 TapTweak scalar: `taggedHash("TapTweak", internalPubkey || tapMerkleRoot)`.
+   * The beacon output is an internal key (the MuSig2 aggregate) plus a script
+   * tree (the recovery leaves), so the tweak commits to the tree's Merkle root.
+   * The MuSig2 signing session applies this as an x-only tweak; a value that does
+   * not match the root the funded address was derived from silently yields an
+   * invalid key-path signature.
+   */
+  tapTweak = new Uint8Array();
+  /** The n-of-n MuSig2 aggregate internal key, x-only (32 bytes), set by computeBeaconAddress(). */
+  internalKey = new Uint8Array();
+  /** BIP-341 Taproot Merkle root of the recovery script tree, set by computeBeaconAddress(). */
+  tapMerkleRoot = new Uint8Array();
+  /** Operator recovery key, x-only (32 bytes). Used to build the CSV recovery leaf. */
+  recoveryKey;
+  /** Relative-timelock (BIP-68 nSequence) before the recovery leaf is spendable. */
+  recoverySequence;
+  /** Funding model governing the recovery leaves (default 'operator-funded'). */
+  fundingModel;
+  /**
+   * Advertised k of the k-of-n fallback leaf, or undefined to default to n-1 at
+   * address computation. Read the resolved value via {@link effectiveFallbackThreshold}.
+   */
+  fallbackThreshold;
+  /** The Taproot beacon address: key path is the MuSig2 aggregate, script path is fallback + recovery. */
+  beaconAddress = "";
+  /** Pending DID updates submitted by participants, keyed by DID. */
+  pendingUpdates = /* @__PURE__ */ new Map();
+  /**
+   * Participant DIDs that explicitly declined to submit an update this round
+   * (cooperative non-inclusion). A decliner is absent from the CAS Announcement
+   * Map and carries a non-inclusion leaf in the SMT, yet still signs. Kept
+   * disjoint from {@link pendingUpdates} so CAS correctness holds by construction.
+   */
+  nonIncluded = /* @__PURE__ */ new Set();
+  /** CAS Beacon Announcement Map (DID to updateHash), set by buildCASAnnouncement(). */
+  casAnnouncement;
+  /** Per-participant SMT proofs, set by buildSMTTree(). */
+  smtProofs;
+  /** Signal bytes (32 bytes) for OP_RETURN: SHA-256 of CAS announcement OR SMT root. */
+  signalBytes;
+  /** Set of participant DIDs that have approved the aggregated data. */
+  validationAcks = /* @__PURE__ */ new Set();
+  /** Set of participant DIDs that have rejected the aggregated data. */
+  validationRejections = /* @__PURE__ */ new Set();
+  constructor({ id, minParticipants, serviceDid, network, beaconType, recoveryKey, recoverySequence, fundingModel, fallbackThreshold }) {
+    this.id = id || crypto.randomUUID();
+    this.minParticipants = minParticipants ?? 2;
+    this.serviceDid = serviceDid || "";
+    this.network = network;
+    this.beaconType = beaconType || "CASBeacon";
+    this.recoveryKey = recoveryKey;
+    this.recoverySequence = recoverySequence;
+    this.fundingModel = fundingModel ?? DEFAULT_FUNDING_MODEL;
+    this.fallbackThreshold = fallbackThreshold;
+  }
+  /** Sorted cohort keys (sorted on assignment per BIP-327). */
+  get cohortKeys() {
+    return this.#cohortKeys;
+  }
+  set cohortKeys(keys) {
+    this.#cohortKeys = (0, import_musig22.sortKeys)(keys);
+  }
+  /**
+   * The resolved k of the k-of-n fallback leaf: the advertised
+   * {@link fallbackThreshold}, or n-1 (floored at 1) when unadvertised, where n is
+   * the current cohort size. This is the value the beacon address commits to and
+   * the spend builders must reproduce. Returns 0 before any cohort keys are set.
+   */
+  get effectiveFallbackThreshold() {
+    if (this.#cohortKeys.length === 0) return 0;
+    return resolveFallbackThreshold(this.fallbackThreshold, this.#cohortKeys.length);
+  }
+  /**
+   * Computes the Taproot beacon address from the cohort keys and recovery params.
+   *
+   * The output's key path is the n-of-n MuSig2 aggregate of the cohort keys; its
+   * script path is the recovery tree (a CSV recovery leaf so a missing signer
+   * cannot permanently lock the UTXO). Sets `internalKey`, `tapMerkleRoot`, and
+   * the `tapTweak` the MuSig2 session must apply for the key-path spend.
+   *
+   * The tweak is derived from the Merkle root the address was built with (read
+   * back from the payment), never recomputed by hand, so the MuSig2 key-path
+   * signature is guaranteed to validate against the funded address.
+   */
+  computeBeaconAddress() {
+    if (this.#cohortKeys.length === 0) {
+      throw new AggregationCohortError(
+        "Cannot compute beacon address: no cohort keys.",
+        "NO_COHORT_KEYS",
+        { cohortId: this.id }
+      );
+    }
+    if (!this.recoveryKey || this.recoveryKey.length === 0 || this.recoverySequence === void 0) {
+      throw new AggregationCohortError(
+        "Cannot compute beacon address: missing recovery key or sequence.",
+        "NO_RECOVERY_PARAMS",
+        { cohortId: this.id }
+      );
+    }
+    const keyAggContext = (0, import_musig22.keyAggregate)(this.#cohortKeys);
+    const aggPubkey = (0, import_musig22.keyAggExport)(keyAggContext);
+    const leaves = buildRecoveryLeaves(this.fundingModel, {
+      recoveryKey: this.recoveryKey,
+      recoverySequence: this.recoverySequence,
+      cohortKeys: this.#cohortKeys,
+      fallbackThreshold: resolveFallbackThreshold(this.fallbackThreshold, this.#cohortKeys.length)
+    });
+    const payment = (0, import_btc_signer2.p2tr)(aggPubkey, leaves, (0, import_bitcoin.getNetwork)(this.network), true);
+    this.internalKey = aggPubkey;
+    this.tapMerkleRoot = payment.tapMerkleRoot;
+    this.tapTweak = import_secp256k12.schnorr.utils.taggedHash("TapTweak", (0, import_utils2.concatBytes)(aggPubkey, payment.tapMerkleRoot));
+    if (!payment.address) {
+      throw new AggregationCohortError(
+        "Failed to compute Taproot address",
+        "BEACON_ADDRESS_ERROR",
+        { cohortId: this.id }
+      );
+    }
+    this.beaconAddress = payment.address;
+    return payment.address;
+  }
+  /**
+   * Validates that the participant's key is in the cohort and the beacon address
+   * matches the locally-computed one. Used by participants to verify cohort ready
+   * messages from the service.
+   */
+  validateMembership(participantPkHex, cohortKeysHex, expectedBeaconAddress) {
+    if (!cohortKeysHex.includes(participantPkHex)) {
+      throw new AggregationCohortError(
+        `Participant key not found in cohort ${this.id}.`,
+        "COHORT_VALIDATION_ERROR",
+        { cohortId: this.id, participantPkHex }
+      );
+    }
+    this.cohortKeys = cohortKeysHex.map((k) => (0, import_utils2.hexToBytes)(k));
+    const computed = this.computeBeaconAddress();
+    if (computed !== expectedBeaconAddress) {
+      throw new AggregationCohortError(
+        `Computed beacon address ${computed} does not match expected ${expectedBeaconAddress}.`,
+        "BEACON_ADDRESS_MISMATCH",
+        { cohortId: this.id, computed, expected: expectedBeaconAddress }
+      );
+    }
+  }
+  /**
+   * Returns the position of a participant's public key in the sorted
+   * {@link cohortKeys} array, or -1 if the participant is not in the cohort.
+   * Required by MuSig2 partial-sig verification which indexes by signer position.
+   */
+  indexOfParticipant(did) {
+    const pk = this.participantKeys.get(did);
+    if (!pk) return -1;
+    return this.#cohortKeys.findIndex(
+      (k) => k.length === pk.length && k.every((b, i) => b === pk[i])
+    );
+  }
+  addUpdate(participantDid, signedUpdate) {
+    if (!this.participants.includes(participantDid)) {
+      throw new AggregationCohortError(
+        `Participant ${participantDid} is not in cohort ${this.id}.`,
+        "UNKNOWN_PARTICIPANT",
+        { cohortId: this.id, participantDid }
+      );
+    }
+    this.pendingUpdates.set(participantDid, signedUpdate);
+  }
+  /**
+   * Record that a participant declined to submit an update this round
+   * (cooperative non-inclusion). The member stays in the cohort and still signs.
+   */
+  addNonInclusion(participantDid) {
+    if (!this.participants.includes(participantDid)) {
+      throw new AggregationCohortError(
+        `Participant ${participantDid} is not in cohort ${this.id}.`,
+        "UNKNOWN_PARTICIPANT",
+        { cohortId: this.id, participantDid }
+      );
+    }
+    if (this.pendingUpdates.has(participantDid)) {
+      throw new AggregationCohortError(
+        `Participant ${participantDid} already submitted an update; cannot also decline.`,
+        "CONFLICTING_RESPONSE",
+        { cohortId: this.id, participantDid }
+      );
+    }
+    this.nonIncluded.add(participantDid);
+  }
+  hasAllUpdates() {
+    return this.pendingUpdates.size === this.participants.length;
+  }
+  /**
+   * True when every participant has responded for this round, either with an
+   * update or with an explicit non-inclusion. This is the aggregation gate when
+   * non-inclusion is in play; it generalizes {@link hasAllUpdates} the same way
+   * {@link hasAllValidationResponses} generalizes a unanimous ack.
+   */
+  hasAllResponses() {
+    return this.pendingUpdates.size + this.nonIncluded.size === this.participants.length;
+  }
+  /**
+   * Builds a CAS Announcement Map from collected updates.
+   * Maps each participant DID to base64url canonical hash of their signed update.
+   * Computes signal bytes as SHA-256 of canonicalized announcement.
+   *
+   * Members who declined (cooperative non-inclusion) are naturally absent from
+   * the map: the body iterates {@link pendingUpdates}, which never holds a
+   * decliner. Absence from the map is exactly the CAS non-inclusion signal.
+   */
+  buildCASAnnouncement() {
+    if (!this.hasAllResponses()) {
+      throw new AggregationCohortError(
+        "Cannot build CAS Announcement: not all participants have responded.",
+        "INCOMPLETE_RESPONSES",
+        { cohortId: this.id, updates: this.pendingUpdates.size, declined: this.nonIncluded.size, total: this.participants.length }
+      );
+    }
+    const announcement = {};
+    for (const [did, signedUpdate] of this.pendingUpdates) {
+      announcement[did] = (0, import_common2.canonicalHash)(signedUpdate);
+    }
+    this.casAnnouncement = announcement;
+    this.signalBytes = (0, import_common2.hash)((0, import_common2.canonicalize)(announcement));
+    return announcement;
+  }
+  /**
+   * Builds an SMT tree with one leaf per participant.
+   *
+   * A member who submitted an update gets an inclusion leaf
+   * (SHA-256(SHA-256(nonce) || SHA-256(update))); a member who declined gets a
+   * non-inclusion leaf (SHA-256(SHA-256(nonce)), the `signedUpdate` entry field
+   * omitted). The cohort mints each member's nonce and returns it inside that
+   * member's serialized proof, so a decliner can self-validate its own
+   * non-inclusion slot and the resolver can recompute the leaf. Stores
+   * per-participant proofs and the SMT root as signalBytes.
+   */
+  buildSMTTree() {
+    if (!this.hasAllResponses()) {
+      throw new AggregationCohortError(
+        "Cannot build SMT tree: not all participants have responded.",
+        "INCOMPLETE_RESPONSES",
+        { cohortId: this.id, updates: this.pendingUpdates.size, declined: this.nonIncluded.size, total: this.participants.length }
+      );
+    }
+    const tree = new import_smt.BTCR2MerkleTree();
+    const entries = [];
+    const encoder = new TextEncoder();
+    for (const did of this.participants) {
+      const nonce = (0, import_utils2.randomBytes)(32);
+      const signedUpdate = this.pendingUpdates.get(did);
+      if (signedUpdate) {
+        entries.push({ did, nonce, signedUpdate: encoder.encode((0, import_common2.canonicalize)(signedUpdate)) });
+      } else {
+        entries.push({ did, nonce });
+      }
+    }
+    tree.addEntries(entries);
+    tree.finalize();
+    this.signalBytes = tree.rootHash;
+    this.smtProofs = /* @__PURE__ */ new Map();
+    for (const did of this.participants) {
+      this.smtProofs.set(did, tree.proof(did));
+    }
+    return this.smtProofs;
+  }
+  addValidation(participantDid, approved) {
+    if (!this.participants.includes(participantDid)) {
+      throw new AggregationCohortError(
+        `Unknown participant ${participantDid} in cohort ${this.id}.`,
+        "UNKNOWN_PARTICIPANT",
+        { cohortId: this.id, participantDid }
+      );
+    }
+    if (approved) {
+      this.validationAcks.add(participantDid);
+    } else {
+      this.validationRejections.add(participantDid);
+    }
+  }
+  /**
+   * True when every participant has either approved or rejected the aggregated data.
+   */
+  hasAllValidationResponses() {
+    return this.validationAcks.size + this.validationRejections.size === this.participants.length;
+  }
+  /**
+   * True when all participants approved. Note: differs from {@link hasAllValidationResponses},
+   * this returns false if any participant rejected, even if all responses are in.
+   */
+  isFullyValidated() {
+    return this.validationRejections.size === 0 && this.validationAcks.size === this.participants.length;
+  }
+};
+
+// src/core/signing-session.ts
+var import_keypair = require("@did-btcr2/keypair");
+var import_btc_signer3 = require("@scure/btc-signer");
+var musig2 = __toESM(require("@scure/btc-signer/musig2"), 1);
+var BeaconSigningSession = class {
+  /** Unique identifier for this signing session. */
+  id;
+  /** The cohort this session signs for. */
+  cohort;
+  /** The Bitcoin transaction being signed. */
+  pendingTx;
+  /** Previous output scripts for Taproot sighash computation (BIP-341). */
+  prevOutScripts;
+  /** Previous output values for Taproot sighash computation. */
+  prevOutValues;
+  /** Map of participant publicKey-hex to public nonce contribution. */
+  nonceContributions = /* @__PURE__ */ new Map();
+  /** Aggregated MuSig2 nonce (66 bytes). */
+  aggregatedNonce;
+  /** Map of participant DID to partial signature. */
+  partialSignatures = /* @__PURE__ */ new Map();
+  /** Final 64-byte Schnorr signature. */
+  signature;
+  /** Current signing session phase. */
+  phase;
+  /**
+   * Participant's MuSig2 secret nonce, held only on the participant side
+   * between {@link generateNonceContribution} and {@link generatePartialSignature}.
+   * Private and cleared on every terminal path (success, failure, or teardown
+   * via {@link clearSecrets}) so a spent or abandoned nonce cannot be reused or
+   * serialized.
+   */
+  #secretNonce;
+  constructor({ id, cohort, pendingTx, prevOutScripts, prevOutValues }) {
+    this.id = id || crypto.randomUUID();
+    this.cohort = cohort;
+    this.pendingTx = pendingTx;
+    this.prevOutScripts = prevOutScripts || [];
+    this.prevOutValues = prevOutValues || [];
+    this.phase = "AwaitingNonceContributions" /* AwaitingNonceContributions */;
+  }
+  /**
+   * Computes the Taproot sighash (BIP-341) for the first input.
+   */
+  get sigHash() {
+    if (!this.prevOutScripts.length || !this.prevOutValues.length) {
+      throw new SigningSessionError(
+        "Cannot compute sighash: missing prevOutScripts or prevOutValues.",
+        "SIGHASH_ERROR"
+      );
+    }
+    return this.pendingTx.preimageWitnessV1(
+      0,
+      this.prevOutScripts,
+      import_btc_signer3.SigHash.DEFAULT,
+      this.prevOutValues
+    );
+  }
+  addNonceContribution(participantDid, nonceContribution) {
+    if (this.phase !== "AwaitingNonceContributions" /* AwaitingNonceContributions */) {
+      throw new SigningSessionError(
+        `Nonce contributions not expected. Current phase: ${this.phase}`,
+        "INVALID_PHASE",
+        { phase: this.phase }
+      );
+    }
+    if (!this.cohort.participants.includes(participantDid)) {
+      throw new SigningSessionError(
+        `Participant ${participantDid} is not a member of cohort ${this.cohort.id}.`,
+        "UNKNOWN_PARTICIPANT",
+        { cohortId: this.cohort.id, participantDid }
+      );
+    }
+    if (nonceContribution.length !== 66) {
+      throw new SigningSessionError(
+        `Invalid nonce contribution: expected 66 bytes, got ${nonceContribution.length}.`,
+        "INVALID_NONCE_LENGTH"
+      );
+    }
+    if (this.nonceContributions.has(participantDid)) {
+      throw new SigningSessionError(
+        `Duplicate nonce contribution from ${participantDid}.`,
+        "DUPLICATE_NONCE"
+      );
+    }
+    this.nonceContributions.set(participantDid, nonceContribution);
+    if (this.nonceContributions.size === this.cohort.participants.length) {
+      this.phase = "NonceContributionsReceived" /* NonceContributionsReceived */;
+    }
+  }
+  generateAggregatedNonce() {
+    if (this.phase !== "NonceContributionsReceived" /* NonceContributionsReceived */) {
+      throw new SigningSessionError(
+        `Cannot aggregate nonces: phase is ${this.phase}, expected NonceContributionsReceived.`,
+        "INVALID_PHASE"
+      );
+    }
+    this.aggregatedNonce = musig2.nonceAggregate([...this.nonceContributions.values()]);
+    this.phase = "AwaitingPartialSignatures" /* AwaitingPartialSignatures */;
+    return this.aggregatedNonce;
+  }
+  addPartialSignature(participantDid, partialSig) {
+    if (this.phase !== "AwaitingPartialSignatures" /* AwaitingPartialSignatures */) {
+      throw new SigningSessionError(
+        `Partial signatures not expected. Current phase: ${this.phase}`,
+        "INVALID_PHASE"
+      );
+    }
+    if (!this.cohort.participants.includes(participantDid)) {
+      throw new SigningSessionError(
+        `Participant ${participantDid} is not a member of cohort ${this.cohort.id}.`,
+        "UNKNOWN_PARTICIPANT",
+        { cohortId: this.cohort.id, participantDid }
+      );
+    }
+    if (this.partialSignatures.has(participantDid)) {
+      throw new SigningSessionError(
+        `Duplicate partial signature from ${participantDid}.`,
+        "DUPLICATE_PARTIAL_SIG"
+      );
+    }
+    this.partialSignatures.set(participantDid, partialSig);
+    if (this.partialSignatures.size === this.cohort.participants.length) {
+      this.phase = "PartialSignaturesReceived" /* PartialSignaturesReceived */;
+    }
+  }
+  generateFinalSignature() {
+    if (this.phase !== "PartialSignaturesReceived" /* PartialSignaturesReceived */) {
+      throw new SigningSessionError(
+        `Cannot generate final signature: phase is ${this.phase}.`,
+        "INVALID_PHASE"
+      );
+    }
+    if (!this.aggregatedNonce) {
+      throw new SigningSessionError("Aggregated nonce missing.", "MISSING_AGGREGATED_NONCE");
+    }
+    const session = new musig2.Session(
+      this.aggregatedNonce,
+      this.cohort.cohortKeys,
+      this.sigHash,
+      [this.cohort.tapTweak],
+      [true]
+    );
+    const pubNoncesByIndex = new Array(this.cohort.cohortKeys.length);
+    for (const [did, nonce] of this.nonceContributions) {
+      const idx = this.cohort.indexOfParticipant(did);
+      if (idx < 0) {
+        throw new SigningSessionError(
+          `Cannot verify nonce from ${did}: participant key missing from cohort.`,
+          "UNKNOWN_PARTICIPANT_KEY",
+          { participantDid: did }
+        );
+      }
+      pubNoncesByIndex[idx] = nonce;
+    }
+    for (const [did, partialSig] of this.partialSignatures) {
+      const idx = this.cohort.indexOfParticipant(did);
+      if (idx < 0) {
+        throw new SigningSessionError(
+          `Cannot verify partial signature from ${did}: participant key missing from cohort.`,
+          "UNKNOWN_PARTICIPANT_KEY",
+          { participantDid: did }
+        );
+      }
+      const ok = session.partialSigVerify(partialSig, pubNoncesByIndex, idx);
+      if (!ok) {
+        throw new SigningSessionError(
+          `Bad partial signature from ${did}.`,
+          "BAD_PARTIAL_SIG",
+          { participantDid: did, index: idx }
+        );
+      }
+    }
+    this.signature = session.partialSigAgg([...this.partialSignatures.values()]);
+    this.phase = "Complete" /* Complete */;
+    return this.signature;
+  }
+  /**
+   * Generates a fresh MuSig2 nonce contribution for the participant.
+   * Stores the secret nonce internally for use in `generatePartialSignature()`.
+   */
+  generateNonceContribution(participantPublicKey, participantSecretKey) {
+    const aggPublicKey = musig2.keyAggExport(musig2.keyAggregate(this.cohort.cohortKeys));
+    const nonces = musig2.nonceGen(participantPublicKey, participantSecretKey, aggPublicKey);
+    this.#secretNonce = nonces.secret;
+    return nonces.public;
+  }
+  /**
+   * Generates a partial signature using the participant's secret key + secret nonce.
+   * Requires the aggregated nonce to have been set first (via the service).
+   *
+   * Clears the stored secret nonce after use on every path (success or throw)
+   * via {@link clearSecrets}. JS cannot truly erase memory (GC may relocate
+   * buffers), but overwriting the bytes shortens the exposure window and
+   * prevents accidental reuse or serialization of a spent nonce - reuse of a
+   * MuSig2 nonce leaks the secret key.
+   */
+  generatePartialSignature(participantSecretKey) {
+    if (!this.aggregatedNonce) {
+      throw new SigningSessionError("Aggregated nonce not available.", "MISSING_AGGREGATED_NONCE");
+    }
+    if (!this.#secretNonce) {
+      throw new SigningSessionError("Secret nonce not available - generateNonceContribution() must be called first.", "MISSING_SECRET_NONCE");
+    }
+    const session = new musig2.Session(
+      this.aggregatedNonce,
+      this.cohort.cohortKeys,
+      this.sigHash,
+      [this.cohort.tapTweak],
+      [true]
+    );
+    try {
+      return session.sign(this.#secretNonce, participantSecretKey);
+    } finally {
+      this.clearSecrets();
+    }
+  }
+  /**
+   * Zeroize any retained secret nonce. Safe to call repeatedly and on any path
+   * (completion, failure, or teardown of an abandoned session). Callers that
+   * drop a session before it reaches a partial signature should invoke this so
+   * the secret nonce does not linger on the live object.
+   */
+  clearSecrets() {
+    if (this.#secretNonce) {
+      (0, import_keypair.wipe)(this.#secretNonce);
+      this.#secretNonce = void 0;
+    }
+  }
+  isComplete() {
+    return this.phase === "Complete" /* Complete */;
+  }
+  isFailed() {
+    return this.phase === "Failed" /* Failed */;
+  }
+};
+
+// src/core/signer.ts
+var import_keypair2 = require("@did-btcr2/keypair");
+var KeyPairAggregationSigner = class {
+  publicKey;
+  #keys;
+  /** @param {SchnorrKeyPair} keys The keypair whose secret backs this signer. */
+  constructor(keys) {
+    this.#keys = keys;
+    this.publicKey = keys.publicKey.compressed;
+  }
+  withSecret(fn) {
+    const secretKey = this.#keys.secretKey.bytes;
+    try {
+      return fn(secretKey);
+    } finally {
+      (0, import_keypair2.wipe)(secretKey);
+    }
+  }
+};
+
+// src/core/beacon-strategy.ts
+var import_common3 = require("@did-btcr2/common");
+var import_smt2 = require("@did-btcr2/smt");
+var CAS_STRATEGY = {
+  type: "CASBeacon",
+  buildAggregatedData(cohort) {
+    cohort.buildCASAnnouncement();
+  },
+  getDistributePayload(cohort) {
+    return { casAnnouncement: cohort.casAnnouncement };
+  },
+  validateParticipantView({ participantDid, included, expectedHash, body }) {
+    const casAnnouncement = body.casAnnouncement;
+    if (!casAnnouncement) return { matches: false };
+    if (!included) {
+      return { matches: !(participantDid in casAnnouncement), casAnnouncement };
+    }
+    return {
+      matches: casAnnouncement[participantDid] === expectedHash,
+      casAnnouncement
+    };
+  }
+};
+var SMT_STRATEGY = {
+  type: "SMTBeacon",
+  buildAggregatedData(cohort) {
+    cohort.buildSMTTree();
+  },
+  getDistributePayload(cohort, participantDid) {
+    const proof = cohort.smtProofs?.get(participantDid);
+    return { smtProof: proof };
+  },
+  validateParticipantView({ participantDid, included, submittedUpdate, body }) {
+    const smtProof = body.smtProof;
+    const index = (0, import_smt2.didToIndex)(participantDid);
+    if (!included) {
+      if (!smtProof?.nonce || smtProof?.updateId) return { matches: false, smtProof };
+      const candidateHash2 = (0, import_smt2.blockHash)((0, import_smt2.blockHash)((0, import_smt2.base64UrlToHash)(smtProof.nonce)));
+      return { matches: (0, import_smt2.verifySerializedProof)(smtProof, index, candidateHash2), smtProof };
+    }
+    if (!smtProof?.updateId || !smtProof?.nonce || !submittedUpdate) return { matches: false, smtProof };
+    const canonicalBytes = new TextEncoder().encode((0, import_common3.canonicalize)(submittedUpdate));
+    const expectedUpdateId = (0, import_smt2.hashToBase64Url)((0, import_smt2.blockHash)(canonicalBytes));
+    if (smtProof.updateId !== expectedUpdateId) {
+      return { matches: false, smtProof };
+    }
+    const candidateHash = (0, import_smt2.blockHash)((0, import_smt2.blockHash)((0, import_smt2.base64UrlToHash)(smtProof.nonce)), (0, import_smt2.base64UrlToHash)(smtProof.updateId));
+    return {
+      matches: (0, import_smt2.verifySerializedProof)(smtProof, index, candidateHash),
+      smtProof
+    };
+  }
+};
+var STRATEGIES = /* @__PURE__ */ new Map([
+  [CAS_STRATEGY.type, CAS_STRATEGY],
+  [SMT_STRATEGY.type, SMT_STRATEGY]
+]);
+function registerBeaconStrategy(strategy) {
+  STRATEGIES.set(strategy.type, strategy);
+}
+function getBeaconStrategy(type) {
+  return STRATEGIES.get(type);
+}
+
+// src/core/recovery-spend.ts
+var import_bitcoin2 = require("@did-btcr2/bitcoin");
+var import_secp256k13 = require("@noble/curves/secp256k1.js");
+var import_btc_signer4 = require("@scure/btc-signer");
+var import_musig23 = require("@scure/btc-signer/musig2");
+var DUST_LIMIT_SATS = 546n;
+function bytesEqual(a, b) {
+  return a.length === b.length && a.every((x, i) => x === b[i]);
+}
+function buildRecoverySpend(params) {
+  const {
+    cohortKeys,
+    recoverySecretKey,
+    recoveryKey,
+    recoverySequence,
+    fallbackThreshold,
+    fundingModel,
+    network,
+    utxo,
+    destinationAddress,
+    fee,
+    beaconAddress
+  } = params;
+  if (cohortKeys.length === 0) {
+    throw new AggregationCohortError(
+      "Cannot build recovery spend: no cohort keys.",
+      "NO_COHORT_KEYS"
+    );
+  }
+  const derivedPub = import_secp256k13.schnorr.getPublicKey(recoverySecretKey);
+  if (!bytesEqual(derivedPub, recoveryKey)) {
+    throw new AggregationCohortError(
+      "Recovery secret key does not correspond to the committed recovery key.",
+      "RECOVERY_KEY_MISMATCH"
+    );
+  }
+  const out = utxo.value - fee;
+  if (out <= 0n) {
+    throw new AggregationCohortError(
+      `Recovery fee ${fee} exceeds UTXO value ${utxo.value}.`,
+      "FEE_EXCEEDS_VALUE",
+      { fee: fee.toString(), value: utxo.value.toString() }
+    );
+  }
+  if (out < DUST_LIMIT_SATS) {
+    throw new AggregationCohortError(
+      `Recovered output ${out} is below the dust limit ${DUST_LIMIT_SATS}; the spend would not relay.`,
+      "DUST_OUTPUT",
+      { output: out.toString(), dustLimit: DUST_LIMIT_SATS.toString() }
+    );
+  }
+  const internalKey = (0, import_musig23.keyAggExport)((0, import_musig23.keyAggregate)((0, import_musig23.sortKeys)(cohortKeys)));
+  const leaves = buildRecoveryLeaves(fundingModel ?? DEFAULT_FUNDING_MODEL, {
+    recoveryKey,
+    recoverySequence,
+    cohortKeys,
+    fallbackThreshold: resolveFallbackThreshold(fallbackThreshold, cohortKeys.length)
+  });
+  const net = (0, import_bitcoin2.getNetwork)(network);
+  const payment = (0, import_btc_signer4.p2tr)(internalKey, leaves, net, true);
+  if (beaconAddress !== void 0 && payment.address !== beaconAddress) {
+    throw new AggregationCohortError(
+      `Reconstructed beacon address ${payment.address} does not match the cohort's funded address ${beaconAddress}.`,
+      "BEACON_ADDRESS_MISMATCH",
+      { reconstructed: payment.address, expected: beaconAddress }
+    );
+  }
+  const tx = new import_btc_signer4.Transaction({ version: 2, allowUnknownInputs: true });
+  tx.addInput({
+    txid: utxo.txid,
+    index: utxo.vout,
+    witnessUtxo: { script: payment.script, amount: utxo.value },
+    tapLeafScript: payment.tapLeafScript,
+    sequence: recoverySequence
+  });
+  tx.addOutputAddress(destinationAddress, out, net);
+  tx.signIdx(recoverySecretKey, 0);
+  tx.finalize();
+  return tx;
+}
+
+// src/core/fallback-spend.ts
+var import_bitcoin3 = require("@did-btcr2/bitcoin");
+var import_secp256k14 = require("@noble/curves/secp256k1.js");
+var import_btc_signer5 = require("@scure/btc-signer");
+var import_musig24 = require("@scure/btc-signer/musig2");
+function bytesEqual2(a, b) {
+  return a.length === b.length && a.every((x, i) => x === b[i]);
+}
+function fallbackSighash(tx, inputIndex, prevOutScript, prevOutValue, fallbackLeafScript) {
+  return tx.preimageWitnessV1(
+    inputIndex,
+    [prevOutScript],
+    import_btc_signer5.SigHash.DEFAULT,
+    [prevOutValue],
+    void 0,
+    fallbackLeafScript,
+    TAPROOT_LEAF_VERSION
+  );
+}
+function buildFallbackSpend(params) {
+  const {
+    pendingTx,
+    cohortKeys,
+    recoveryKey,
+    recoverySequence,
+    fundingModel,
+    network,
+    prevOutScript,
+    prevOutValue,
+    signatures
+  } = params;
+  const inputIndex = params.inputIndex ?? 0;
+  if (cohortKeys.length === 0) {
+    throw new AggregationCohortError(
+      "Cannot build fallback spend: no cohort keys.",
+      "NO_COHORT_KEYS"
+    );
+  }
+  const fallbackThreshold = resolveFallbackThreshold(params.fallbackThreshold, cohortKeys.length);
+  const internalKey = (0, import_musig24.keyAggExport)((0, import_musig24.keyAggregate)((0, import_musig24.sortKeys)(cohortKeys)));
+  const leaves = buildRecoveryLeaves(fundingModel ?? DEFAULT_FUNDING_MODEL, {
+    recoveryKey,
+    recoverySequence,
+    cohortKeys,
+    fallbackThreshold
+  });
+  const net = (0, import_bitcoin3.getNetwork)(network);
+  const payment = (0, import_btc_signer5.p2tr)(internalKey, leaves, net, true);
+  if (!bytesEqual2(payment.script, prevOutScript)) {
+    throw new AggregationCohortError(
+      "Reconstructed beacon output script does not match the spent prevout script.",
+      "PREVOUT_SCRIPT_MISMATCH"
+    );
+  }
+  const fallbackLeaf = buildFallbackLeaf({ cohortKeys, fallbackThreshold });
+  const leafEntry = payment.tapLeafScript?.find(([, scriptVer]) => {
+    const script = scriptVer.slice(0, scriptVer.length - 1);
+    return bytesEqual2(script, fallbackLeaf);
+  });
+  if (!leafEntry) {
+    throw new AggregationCohortError(
+      "Could not locate the fallback leaf in the reconstructed beacon output.",
+      "FALLBACK_LEAF_NOT_FOUND"
+    );
+  }
+  const cohortXOnly = (0, import_musig24.sortKeys)(cohortKeys).map((k) => k.slice(1));
+  const tx = pendingTx;
+  const sighash = fallbackSighash(tx, inputIndex, prevOutScript, prevOutValue, fallbackLeaf);
+  const leafHash = tapLeafHash(fallbackLeaf);
+  const accepted = /* @__PURE__ */ new Map();
+  for (const { pubKey, signature } of signatures) {
+    if (pubKey.length !== 32 || signature.length !== 64) continue;
+    const isCohortKey = cohortXOnly.some((k) => bytesEqual2(k, pubKey));
+    if (!isCohortKey) continue;
+    const hex = Array.from(pubKey, (b) => b.toString(16).padStart(2, "0")).join("");
+    if (accepted.has(hex)) continue;
+    let ok = false;
+    try {
+      ok = import_secp256k14.schnorr.verify(signature, sighash, pubKey);
+    } catch {
+      ok = false;
+    }
+    if (ok) accepted.set(hex, signature);
+  }
+  if (accepted.size < fallbackThreshold) {
+    throw new AggregationCohortError(
+      `Not enough valid fallback signatures: have ${accepted.size}, need ${fallbackThreshold}.`,
+      "NOT_ENOUGH_FALLBACK_SIGNATURES",
+      { have: accepted.size, need: fallbackThreshold }
+    );
+  }
+  const chosen = cohortXOnly.filter((k) => accepted.has(Array.from(k, (b) => b.toString(16).padStart(2, "0")).join(""))).slice(0, fallbackThreshold);
+  tx.updateInput(inputIndex, {
+    tapLeafScript: [leafEntry],
+    tapScriptSig: chosen.map((pubKey) => {
+      const hex = Array.from(pubKey, (b) => b.toString(16).padStart(2, "0")).join("");
+      return [{ pubKey, leafHash }, accepted.get(hex)];
+    })
+  });
+  tx.finalize();
+  return tx;
+}
+
+// src/core/typed-emitter.ts
+var TypedEventEmitter = class {
+  #listeners = /* @__PURE__ */ new Map();
+  /** Subscribe to an event. */
+  on(event, listener) {
+    let set = this.#listeners.get(event);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      this.#listeners.set(event, set);
+    }
+    set.add(listener);
+    return this;
+  }
+  /** Subscribe to an event, automatically unsubscribing after the first call. */
+  once(event, listener) {
+    const wrapped = ((...args) => {
+      this.off(event, wrapped);
+      listener(...args);
+    });
+    return this.on(event, wrapped);
+  }
+  /** Unsubscribe a specific listener. */
+  off(event, listener) {
+    this.#listeners.get(event)?.delete(listener);
+    return this;
+  }
+  /** Emit an event to all subscribed listeners. */
+  emit(event, ...args) {
+    const set = this.#listeners.get(event);
+    if (!set || set.size === 0) return false;
+    for (const listener of set) {
+      try {
+        listener(...args);
+      } catch (err) {
+        console.error(`Listener for event "${String(event)}" threw:`, err);
+      }
+    }
+    return true;
+  }
+  /** Remove all listeners (optionally for a specific event). */
+  removeAllListeners(event) {
+    if (event === void 0) {
+      this.#listeners.clear();
+    } else {
+      this.#listeners.delete(event);
+    }
+    return this;
+  }
+  /** Number of listeners for an event. */
+  listenerCount(event) {
+    return this.#listeners.get(event)?.size ?? 0;
+  }
+};
+
+// src/core/messages/base.ts
+var AGGREGATION_WIRE_VERSION = 1;
+var BaseMessage = class {
+  type;
+  version;
+  to;
+  from;
+  body;
+  constructor({ type, version, to, from, body }) {
+    this.type = type;
+    this.version = version ?? AGGREGATION_WIRE_VERSION;
+    this.to = to;
+    this.from = from;
+    this.body = body;
+  }
+  /**
+   * Converts a BaseMessage to a JSON object.
+   * @returns {Base} The JSON representation of the BaseMessage.
+   */
+  toJSON() {
+    return {
+      type: this.type,
+      version: this.version,
+      to: this.to,
+      from: this.from,
+      body: this.body
+    };
+  }
+};
+
+// src/core/messages/constants.ts
+var AGGREGATION_MESSAGE_PREFIX = "https://btcr2.dev/aggregation";
+var COHORT_ADVERT = `${AGGREGATION_MESSAGE_PREFIX}/keygen/cohort_advert`;
+var COHORT_OPT_IN = `${AGGREGATION_MESSAGE_PREFIX}/keygen/cohort_opt_in`;
+var COHORT_OPT_IN_ACCEPT = `${AGGREGATION_MESSAGE_PREFIX}/keygen/cohort_opt_in_accept`;
+var COHORT_READY = `${AGGREGATION_MESSAGE_PREFIX}/keygen/cohort_ready`;
+var SUBMIT_UPDATE = `${AGGREGATION_MESSAGE_PREFIX}/update/submit_update`;
+var SUBMIT_NONINCLUDED = `${AGGREGATION_MESSAGE_PREFIX}/update/submit_nonincluded`;
+var DISTRIBUTE_AGGREGATED_DATA = `${AGGREGATION_MESSAGE_PREFIX}/update/distribute_aggregated_data`;
+var VALIDATION_ACK = `${AGGREGATION_MESSAGE_PREFIX}/update/validation_ack`;
+var AUTHORIZATION_REQUEST = `${AGGREGATION_MESSAGE_PREFIX}/sign/authorization_request`;
+var NONCE_CONTRIBUTION = `${AGGREGATION_MESSAGE_PREFIX}/sign/nonce_contribution`;
+var AGGREGATED_NONCE = `${AGGREGATION_MESSAGE_PREFIX}/sign/aggregated_nonce`;
+var SIGNATURE_AUTHORIZATION = `${AGGREGATION_MESSAGE_PREFIX}/sign/signature_authorization`;
+var FALLBACK_AUTHORIZATION_REQUEST = `${AGGREGATION_MESSAGE_PREFIX}/sign/fallback_authorization_request`;
+var FALLBACK_SIGNATURE = `${AGGREGATION_MESSAGE_PREFIX}/sign/fallback_signature`;
+
+// src/core/messages/bodies.ts
+var hasStr = (b, k) => !!b && typeof b[k] === "string";
+var hasIntMin = (b, k, min) => {
+  const v = b ? b[k] : void 0;
+  return typeof v === "number" && Number.isInteger(v) && v >= min;
+};
+var optIntMin = (b, k, min) => {
+  const v = b ? b[k] : void 0;
+  return v === void 0 || typeof v === "number" && Number.isInteger(v) && v >= min;
+};
+var intInRange = (b, k, min, max) => {
+  const v = b ? b[k] : void 0;
+  return typeof v === "number" && Number.isInteger(v) && v >= min && v <= max;
+};
+var optStrOneOf = (b, k, allowed) => {
+  const v = b ? b[k] : void 0;
+  return v === void 0 || typeof v === "string" && allowed.includes(v);
+};
+var hasBool = (b, k) => !!b && typeof b[k] === "boolean";
+var hasBytes = (b, k) => !!b && b[k] instanceof Uint8Array;
+var hasBytesArray = (b, k) => {
+  const v = b ? b[k] : void 0;
+  return Array.isArray(v) && v.every((x) => x instanceof Uint8Array);
+};
+function isCohortAdvertMessage(m) {
+  return m.type === COHORT_ADVERT && hasStr(m.body, "cohortId") && hasIntMin(m.body, "minParticipants", 1) && optIntMin(m.body, "maxParticipants", 1) && hasStr(m.body, "beaconType") && hasStr(m.body, "network") && hasStr(m.body, "recoveryKey") && intInRange(m.body, "recoverySequence", 1, MAX_RECOVERY_SEQUENCE) && optStrOneOf(m.body, "fundingModel", KNOWN_FUNDING_MODELS) && optIntMin(m.body, "fallbackThreshold", 1) && hasBytes(m.body, "communicationPk");
+}
+function isCohortOptInMessage(m) {
+  return m.type === COHORT_OPT_IN && hasStr(m.body, "cohortId") && hasBytes(m.body, "participantPk") && hasBytes(m.body, "communicationPk");
+}
+function isCohortOptInAcceptMessage(m) {
+  return m.type === COHORT_OPT_IN_ACCEPT && hasStr(m.body, "cohortId");
+}
+function isCohortReadyMessage(m) {
+  return m.type === COHORT_READY && hasStr(m.body, "cohortId") && hasStr(m.body, "beaconAddress") && hasBytesArray(m.body, "cohortKeys");
+}
+function isSubmitUpdateMessage(m) {
+  return m.type === SUBMIT_UPDATE && hasStr(m.body, "cohortId") && !!m.body && typeof m.body.signedUpdate === "object";
+}
+function isSubmitNonIncludedMessage(m) {
+  return m.type === SUBMIT_NONINCLUDED && hasStr(m.body, "cohortId");
+}
+function isDistributeAggregatedDataMessage(m) {
+  return m.type === DISTRIBUTE_AGGREGATED_DATA && hasStr(m.body, "cohortId") && hasStr(m.body, "beaconType") && hasStr(m.body, "signalBytesHex");
+}
+function isValidationAckMessage(m) {
+  return m.type === VALIDATION_ACK && hasStr(m.body, "cohortId") && hasBool(m.body, "approved");
+}
+function isAuthorizationRequestMessage(m) {
+  return m.type === AUTHORIZATION_REQUEST && hasStr(m.body, "cohortId") && hasStr(m.body, "sessionId") && hasStr(m.body, "pendingTx") && hasStr(m.body, "prevOutScriptHex") && hasStr(m.body, "prevOutValue");
+}
+function isNonceContributionMessage(m) {
+  return m.type === NONCE_CONTRIBUTION && hasStr(m.body, "cohortId") && hasStr(m.body, "sessionId") && hasBytes(m.body, "nonceContribution");
+}
+function isAggregatedNonceMessage(m) {
+  return m.type === AGGREGATED_NONCE && hasStr(m.body, "cohortId") && hasStr(m.body, "sessionId") && hasBytes(m.body, "aggregatedNonce");
+}
+function isSignatureAuthorizationMessage(m) {
+  return m.type === SIGNATURE_AUTHORIZATION && hasStr(m.body, "cohortId") && hasStr(m.body, "sessionId") && hasBytes(m.body, "partialSignature");
+}
+function isFallbackAuthorizationRequestMessage(m) {
+  return m.type === FALLBACK_AUTHORIZATION_REQUEST && hasStr(m.body, "cohortId") && hasStr(m.body, "sessionId") && hasStr(m.body, "pendingTx") && hasStr(m.body, "prevOutScriptHex") && hasStr(m.body, "prevOutValue") && hasStr(m.body, "fallbackLeafScriptHex");
+}
+function isFallbackSignatureMessage(m) {
+  return m.type === FALLBACK_SIGNATURE && hasStr(m.body, "cohortId") && hasStr(m.body, "sessionId") && hasBytes(m.body, "signerPk") && hasBytes(m.body, "fallbackSignature");
+}
+
+// src/core/messages/factories.ts
+function createCohortAdvertMessage(fields) {
+  const { from, ...body } = fields;
+  return new BaseMessage({ type: COHORT_ADVERT, from, body });
+}
+function createCohortOptInMessage(fields) {
+  const { from, to, ...body } = fields;
+  return new BaseMessage({ type: COHORT_OPT_IN, from, to, body });
+}
+function createCohortOptInAcceptMessage(fields) {
+  const { from, to, ...body } = fields;
+  return new BaseMessage({ type: COHORT_OPT_IN_ACCEPT, from, to, body });
+}
+function createCohortReadyMessage(fields) {
+  const { from, to, ...body } = fields;
+  return new BaseMessage({ type: COHORT_READY, from, to, body });
+}
+function createSubmitUpdateMessage(fields) {
+  const { from, to, ...body } = fields;
+  return new BaseMessage({ type: SUBMIT_UPDATE, from, to, body });
+}
+function createSubmitNonIncludedMessage(fields) {
+  const { from, to, ...body } = fields;
+  return new BaseMessage({ type: SUBMIT_NONINCLUDED, from, to, body });
+}
+function createDistributeAggregatedDataMessage(fields) {
+  const { from, to, ...body } = fields;
+  return new BaseMessage({ type: DISTRIBUTE_AGGREGATED_DATA, from, to, body });
+}
+function createValidationAckMessage(fields) {
+  const { from, to, ...body } = fields;
+  return new BaseMessage({ type: VALIDATION_ACK, from, to, body });
+}
+function createAuthorizationRequestMessage(fields) {
+  const { from, to, ...body } = fields;
+  return new BaseMessage({ type: AUTHORIZATION_REQUEST, from, to, body });
+}
+function createNonceContributionMessage(fields) {
+  const { from, to, ...body } = fields;
+  return new BaseMessage({ type: NONCE_CONTRIBUTION, from, to, body });
+}
+function createAggregatedNonceMessage(fields) {
+  const { from, to, ...body } = fields;
+  return new BaseMessage({ type: AGGREGATED_NONCE, from, to, body });
+}
+function createSignatureAuthorizationMessage(fields) {
+  const { from, to, ...body } = fields;
+  return new BaseMessage({ type: SIGNATURE_AUTHORIZATION, from, to, body });
+}
+function createFallbackAuthorizationRequestMessage(fields) {
+  const { from, to, ...body } = fields;
+  return new BaseMessage({ type: FALLBACK_AUTHORIZATION_REQUEST, from, to, body });
+}
+function createFallbackSignatureMessage(fields) {
+  const { from, to, ...body } = fields;
+  return new BaseMessage({ type: FALLBACK_SIGNATURE, from, to, body });
+}
+
+// src/core/messages/guards.ts
+var KEYGEN_VALUES = /* @__PURE__ */ new Set([
+  COHORT_ADVERT,
+  COHORT_OPT_IN,
+  COHORT_OPT_IN_ACCEPT,
+  COHORT_READY
+]);
+var UPDATE_VALUES = /* @__PURE__ */ new Set([
+  SUBMIT_UPDATE,
+  SUBMIT_NONINCLUDED,
+  DISTRIBUTE_AGGREGATED_DATA,
+  VALIDATION_ACK
+]);
+var SIGN_VALUES = /* @__PURE__ */ new Set([
+  AUTHORIZATION_REQUEST,
+  NONCE_CONTRIBUTION,
+  AGGREGATED_NONCE,
+  SIGNATURE_AUTHORIZATION,
+  FALLBACK_AUTHORIZATION_REQUEST,
+  FALLBACK_SIGNATURE
+]);
+function isAggregationMessageType(type) {
+  return KEYGEN_VALUES.has(type) || UPDATE_VALUES.has(type) || SIGN_VALUES.has(type);
+}
+function isKeygenMessageType(type) {
+  return KEYGEN_VALUES.has(type);
+}
+function isUpdateMessageType(type) {
+  return UPDATE_VALUES.has(type);
+}
+function isSignMessageType(type) {
+  return SIGN_VALUES.has(type);
+}
+
+// src/core/transport/error.ts
+var import_common4 = require("@did-btcr2/common");
+var TransportError = class extends import_common4.MethodError {
+  constructor(message, type = "TransportError", data) {
+    super(message, type, data);
+  }
+};
+var TransportAdapterError = class extends import_common4.MethodError {
+  constructor(message, type = "TransportAdapterError", data) {
+    super(message, type, data);
+  }
+};
+
+// src/core/transport/in-memory.ts
+var import_utils3 = require("@noble/hashes/utils");
+var InMemoryBus = class {
+  #transports = /* @__PURE__ */ new Set();
+  /** Attach a transport to this bus. Called by the transport's constructor. */
+  register(transport) {
+    this.#transports.add(transport);
+  }
+  /** Detach a transport from this bus. */
+  unregister(transport) {
+    this.#transports.delete(transport);
+  }
+  /**
+   * Deliver a message. With no `recipient` the message is broadcast to every
+   * actor on the bus; otherwise it is routed to the single transport that owns
+   * the recipient DID.
+   */
+  async deliver(message, _sender, recipient) {
+    const type = message.type;
+    if (!type) return;
+    const replacer = (_k, v) => v instanceof Uint8Array ? { __bytes: (0, import_utils3.bytesToHex)(v) } : v;
+    const reviver = (_k, v) => v && typeof v === "object" && "__bytes" in v ? (0, import_utils3.hexToBytes)(v.__bytes) : v;
+    const raw = JSON.parse(JSON.stringify(message, replacer), reviver);
+    const serialized = { ...raw, ...raw.body ?? {} };
+    if (!recipient) {
+      for (const t of this.#transports) {
+        await t.dispatchBroadcast(type, serialized);
+      }
+      return;
+    }
+    for (const t of this.#transports) {
+      if (t.hasActor(recipient)) {
+        await t.dispatchDirected(recipient, type, serialized);
+        return;
+      }
+    }
+  }
+};
+var InMemoryTransport = class {
+  name = "in-memory";
+  bus;
+  #actors = /* @__PURE__ */ new Map();
+  #peers = /* @__PURE__ */ new Map();
+  /** @param bus Shared bus. Pass the same bus to connect multiple transports. */
+  constructor(bus = new InMemoryBus()) {
+    this.bus = bus;
+    this.bus.register(this);
+  }
+  start() {
+  }
+  registerActor(did, keys) {
+    this.#actors.set(did, { publicKey: keys.publicKey.compressed, handlers: /* @__PURE__ */ new Map() });
+  }
+  getActorPk(did) {
+    return this.#actors.get(did)?.publicKey;
+  }
+  /** True if `did` is registered on this transport. Used by the bus for routing. */
+  hasActor(did) {
+    return this.#actors.has(did);
+  }
+  registerPeer(did, communicationPk) {
+    this.#peers.set(did, communicationPk);
+  }
+  getPeerPk(did) {
+    return this.#peers.get(did);
+  }
+  registerMessageHandler(actorDid, messageType, handler) {
+    const actor = this.#actors.get(actorDid);
+    if (actor) actor.handlers.set(messageType, handler);
+  }
+  unregisterMessageHandler(actorDid, messageType) {
+    const actor = this.#actors.get(actorDid);
+    if (actor) actor.handlers.delete(messageType);
+  }
+  unregisterActor(did) {
+    const actor = this.#actors.get(did);
+    if (!actor) return;
+    actor.handlers.clear();
+    this.#actors.delete(did);
+    this.#peers.delete(did);
+  }
+  async sendMessage(message, sender, recipient) {
+    await this.bus.deliver(message, sender, recipient);
+  }
+  publishRepeating(message, sender, intervalMs, recipient) {
+    let stopped = false;
+    void this.sendMessage(message, sender, recipient).catch(() => {
+    });
+    const timer = setInterval(() => {
+      if (stopped) return;
+      void this.sendMessage(message, sender, recipient).catch(() => {
+      });
+    }, intervalMs);
+    return () => {
+      if (stopped) return;
+      stopped = true;
+      clearInterval(timer);
+    };
+  }
+  /** Deliver a broadcast message to every actor on this transport that handles `type`. */
+  async dispatchBroadcast(type, message) {
+    for (const actor of this.#actors.values()) {
+      const handler = actor.handlers.get(type);
+      if (handler) await handler(message);
+    }
+  }
+  /** Deliver a directed message to the recipient actor's handler for `type`. */
+  async dispatchDirected(recipientDid, type, message) {
+    const handler = this.#actors.get(recipientDid)?.handlers.get(type);
+    if (handler) await handler(message);
+  }
+};
+
+// src/core/transport/nostr.ts
+var import_keypair3 = require("@did-btcr2/keypair");
+var import_utils4 = require("@noble/hashes/utils");
+var import_nostr_tools = require("nostr-tools");
+var import_pool = require("nostr-tools/pool");
+var DEFAULT_NOSTR_RELAYS = [
+  "wss://relay.damus.io",
+  "wss://nos.lol",
+  "wss://relay.snort.social",
+  "wss://nostr-pub.wellorder.net"
+];
+var DEFAULT_BROADCAST_LOOKBACK_MS = 5 * 60 * 1e3;
+var NostrTransport = class _NostrTransport {
+  name = "nostr";
+  pool;
+  #relays;
+  #actors = /* @__PURE__ */ new Map();
+  #peerRegistry = /* @__PURE__ */ new Map();
+  #started = false;
+  #logger;
+  #broadcastLookbackMs;
+  constructor(config) {
+    this.#relays = config?.relays ?? DEFAULT_NOSTR_RELAYS;
+    this.#logger = config?.logger ?? CONSOLE_LOGGER;
+    this.#broadcastLookbackMs = config?.broadcastLookbackMs ?? DEFAULT_BROADCAST_LOOKBACK_MS;
+  }
+  /**
+   * Registers an actor (DID + keys) to send/receive messages with.
+   * Must be called before start() to ensure subscriptions are created for the actor.
+   * @param {string} did - The DID of the actor.
+   * @param {SchnorrKeyPair} keys - The Schnorr key pair for the actor.
+   * @throws {TransportAdapterError} If the actor is already registered or if the transport has already started.
+   * @example
+   * const transport = new NostrTransport();
+   * const keys = SchnorrKeyPair.generate();
+   * const did = DidBtcr2.create(keys.publicKey.compressed, { idType: 'KEY', network: 'mutinynet' });
+   * transport.registerActor(did, keys);
+   * transport.start();
+   */
+  registerActor(did, keys) {
+    const entry = { keys, handlers: /* @__PURE__ */ new Map(), subscriptions: [] };
+    this.#actors.set(did, entry);
+    if (this.#started && this.pool) {
+      this.#subscribeDirected(did, entry);
+    }
+  }
+  /**
+   * Detach an actor: drop its handlers, close its relay subscriptions, and remove its keys + peer
+   * mapping. Idempotent.
+   * @param {string} did - The DID of the actor to unregister.
+   * @returns {void}
+   * @throws {TransportAdapterError} If the transport is not started or if the pool is unavailable.
+   * @example
+   * transport.unregisterActor(did);
+   */
+  unregisterActor(did) {
+    const entry = this.#actors.get(did);
+    if (!entry) return;
+    for (const sub of entry.subscriptions) {
+      try {
+        sub.close();
+      } catch (err) {
+        this.#logger.debug(`Error closing subscription for ${did}:`, err);
+      }
+    }
+    entry.subscriptions.length = 0;
+    entry.handlers.clear();
+    this.#actors.delete(did);
+    this.#peerRegistry.delete(did);
+  }
+  /**
+   * Remove a single (actor, messageType) handler. Idempotent.
+   * @param {string} actorDid - The DID of the actor.
+   * @param {string} messageType - The type of message to unregister the handler for.
+   * @returns {void}
+   * @example
+   * transport.unregisterMessageHandler(actorDid, messageType);
+   */
+  unregisterMessageHandler(actorDid, messageType) {
+    const actor = this.#actors.get(actorDid);
+    if (!actor) return;
+    actor.handlers.delete(messageType);
+  }
+  /**
+   * Gets the public key for a registered actor by their DID.
+   * @param {string} did - The DID of the registered actor to get the public key for.
+   * @returns {Uint8Array | undefined} The compressed public key bytes for the actor's DID, or
+   * undefined if the DID is not registered.
+   */
+  getActorPk(did) {
+    return this.#actors.get(did)?.keys.publicKey.compressed;
+  }
+  /**
+   * Registers a peer's communication public key for encrypted messages.
+   * @param {string} did - The DID of the peer to register.
+   * @param {Uint8Array} communicationPk - The compressed secp256k1 public key bytes for the peer.
+   */
+  registerPeer(did, communicationPk) {
+    try {
+      new import_keypair3.CompressedSecp256k1PublicKey(communicationPk);
+    } catch {
+      throw new TransportAdapterError(
+        `Invalid communication public key for peer ${did}: expected a 33-byte compressed secp256k1 key.`,
+        "INVALID_PEER_KEY",
+        { adapter: this.name, did, keyLength: communicationPk.length }
+      );
+    }
+    this.#peerRegistry.set(did, communicationPk);
+  }
+  /**
+   * Gets the registered communication public key for a peer by their DID.
+   * @param {string} did - The DID of the peer to get the communication public key for.
+   * @returns {Uint8Array | undefined} The compressed secp256k1 public key bytes for the peer, or
+   * undefined if the peer is not registered.
+   */
+  getPeerPk(did) {
+    return this.#peerRegistry.get(did);
+  }
+  /**
+   * Registers a message handler function for a specific actor and message type. The handler will be called
+   * when a message of the specified type is received for the actor's DID. The transport must have been
+   * started for handlers to be invoked. If the transport is already started, the handler will be registered
+   * immediately; otherwise, it will be registered when the transport starts and the actor's subscription is created.
+   * @param {string} actorDid - The DID of the actor to register the message handler for.
+   * @param {string} messageType - The type of message to handle.
+   * @param {MessageHandler} handler - The function to handle incoming messages of the specified type.
+   * @throws {TransportAdapterError} If the actor DID is not registered or if the handler is invalid.
+   */
+  registerMessageHandler(actorDid, messageType, handler) {
+    const actor = this.#actors.get(actorDid);
+    if (!actor) {
+      throw new TransportAdapterError(
+        `Cannot register handler: actor ${actorDid} not registered. Call registerActor() first.`,
+        "UNKNOWN_ACTOR_ERROR",
+        { adapter: this.name, did: actorDid }
+      );
+    }
+    actor.handlers.set(messageType, handler);
+  }
+  /**
+   * Starts the transport by connecting to the configured Nostr relays and setting up subscriptions
+   * for all registered actors. This method must be called after registering actors via registerActor()
+   * and before sending or receiving messages. The transport will subscribe to broadcast events (kind 1)
+   * for cohort adverts and directed events (kinds 1 and 1059) for each registered actor based on their
+   * public keys. Incoming events are processed and dispatched to the appropriate handlers based on
+   * message type. If the transport is already started, this method has no effect.
+   * @returns {NostrTransport}
+   */
+  start() {
+    if (this.#started) return this;
+    this.#started = true;
+    this.pool = new import_pool.SimplePool();
+    const broadcastFilter = {
+      kinds: [1],
+      "#t": [COHORT_ADVERT]
+    };
+    if (this.#broadcastLookbackMs > 0) {
+      broadcastFilter.since = Math.floor((Date.now() - this.#broadcastLookbackMs) / 1e3);
+    }
+    this.pool.subscribeMany(this.#relays, broadcastFilter, {
+      onclose: (reasons) => this.#logger.debug("Nostr broadcast subscription closed", reasons),
+      onevent: this.#handleBroadcastEvent.bind(this)
+    });
+    for (const [did, entry] of this.#actors) {
+      this.#subscribeDirected(did, entry);
+    }
+    this.#logger.info(`NostrTransport started, listening on ${this.#relays.length} relay(s)`);
+    return this;
+  }
+  /**
+   * Sends a message by publishing a Nostr event to the configured relays. The message is serialized
+   * as JSON and included in the event content.
+   * @param {BaseMessage} message - The aggregation message to send. Must include a valid `type` property.
+   * @param {Did} sender - The DID of the registered actor sending the message. Must have been
+   * registered via registerActor().
+   * @param {Did} [to] - Optional recipient DID for directed messages. Required for encrypted message
+   * types. If provided, must have been registered via registerPeer().
+   * @returns {Promise<void>} Resolves when the message has been published to the relays. Note that
+   * publication is best-effort: the method will resolve as long as at least one relay accepts the
+   * event, even if others reject it.
+   */
+  async sendMessage(message, sender, to) {
+    const type = message.type;
+    if (!type) {
+      throw new TransportAdapterError(
+        "Message type is undefined",
+        "SEND_MESSAGE_ERROR",
+        { adapter: this.name, type }
+      );
+    }
+    const actor = this.#actors.get(sender);
+    if (!actor) {
+      throw new TransportAdapterError(
+        `Unknown sender: ${sender}. Call registerActor() before sending messages.`,
+        "UNKNOWN_ACTOR_ERROR",
+        { adapter: this.name, did: sender }
+      );
+    }
+    const senderKeys = actor.keys;
+    const tags = [
+      ["p", (0, import_utils4.bytesToHex)(senderKeys.publicKey.x)],
+      ["t", type]
+    ];
+    if (to) {
+      const recipientPkBytes = this.#peerRegistry.get(to);
+      if (recipientPkBytes) {
+        const recipientPk = new import_keypair3.CompressedSecp256k1PublicKey(recipientPkBytes);
+        tags.push(["p", (0, import_utils4.bytesToHex)(recipientPk.x)]);
+      }
+    }
+    if (isKeygenMessageType(type)) {
+      const event = (0, import_nostr_tools.finalizeEvent)({
+        kind: 1,
+        created_at: Math.floor(Date.now() / 1e3),
+        tags,
+        content: JSON.stringify(message, _NostrTransport.#jsonReplacer)
+      }, senderKeys.secretKey.bytes);
+      this.#logger.debug(`Publishing kind 1 [${type}]`);
+      await this.#publishToRelays(event);
+      return;
+    }
+    if (isUpdateMessageType(type) || isSignMessageType(type)) {
+      if (!to) {
+        throw new TransportAdapterError(
+          `Encrypted messages require a recipient DID, got undefined for type: ${type}`,
+          "SEND_MESSAGE_ERROR",
+          { adapter: this.name }
+        );
+      }
+      const recipientPkBytes = this.#peerRegistry.get(to);
+      if (!recipientPkBytes) {
+        throw new TransportAdapterError(
+          `Unknown peer DID: ${to}. Register peer via registerPeer() before sending encrypted messages.`,
+          "UNKNOWN_PEER_ERROR",
+          { adapter: this.name, did: to }
+        );
+      }
+      const recipientPk = new import_keypair3.CompressedSecp256k1PublicKey(recipientPkBytes);
+      const conversationKey = import_nostr_tools.nip44.v2.utils.getConversationKey(
+        senderKeys.secretKey.bytes,
+        (0, import_utils4.bytesToHex)(recipientPk.x)
+      );
+      const content = import_nostr_tools.nip44.v2.encrypt(JSON.stringify(message, _NostrTransport.#jsonReplacer), conversationKey);
+      const event = (0, import_nostr_tools.finalizeEvent)({
+        kind: 1059,
+        created_at: Math.floor(Date.now() / 1e3),
+        tags,
+        content
+      }, senderKeys.secretKey.bytes);
+      this.#logger.debug(`Publishing kind 1059 [${type}]`);
+      await this.#publishToRelays(event);
+      return;
+    }
+    this.#logger.warn(`Unsupported message type: ${type}`);
+  }
+  /**
+   * Publish the message once immediately and then re-publish on an interval
+   * until the returned stop function is invoked.
+   *
+   * Useful for broadcast messages (COHORT_ADVERT) on relays that don't
+   * backfill historical events to late subscribers: republishing gives late
+   * joiners a window to discover the message without requiring protocol
+   * changes. Relay rate-limit / publish failures inside the interval are
+   * caught and logged rather than propagated - the caller should stop the
+   * repeater once the protocol condition is satisfied.
+   */
+  publishRepeating(message, sender, intervalMs, recipient) {
+    let stopped = false;
+    void this.sendMessage(message, sender, recipient).catch((err) => {
+      this.#logger.debug("publishRepeating first send failed:", err);
+    });
+    const timer = setInterval(() => {
+      if (stopped) return;
+      void this.sendMessage(message, sender, recipient).catch((err) => {
+        this.#logger.debug("publishRepeating retry failed:", err);
+      });
+    }, intervalMs);
+    return () => {
+      if (stopped) return;
+      stopped = true;
+      clearInterval(timer);
+    };
+  }
+  /**
+   * Creates a directed subscription for the given actor, filtering for messages that match the
+   * actor's public key. Messages received on this subscription are dispatched to the actor's
+   * registered handlers based on message type.
+   * @param {string} did - The DID of the actor to create the subscription for.
+   * @param {ActorEntry} entry - The actor's registration entry containing keys and handlers.
+   * @returns {void}
+   * @throws {TransportAdapterError} If the transport is not started or if the pool is unavailable.
+   */
+  #subscribeDirected(did, entry) {
+    if (!this.pool) return;
+    const pkHex = (0, import_utils4.bytesToHex)(entry.keys.publicKey.x);
+    const sub = this.pool.subscribeMany(this.#relays, { kinds: [1, 1059], "#p": [pkHex] }, {
+      onclose: (reasons) => this.#logger.debug(`Nostr directed subscription closed for ${did}`, reasons),
+      onevent: this.#makeActorEventHandler(did)
+    });
+    entry.subscriptions.push(sub);
+  }
+  /**
+   * Creates an event handler function for a specific actor that processes incoming events, decrypts
+   * if necessary, and dispatches messages to the actor's registered handlers based on message type.
+   * @param {string} actorDid - The DID of the actor to create the event handler for.
+   * @returns {(event: Event) => Promise<void>} An asynchronous event handler function that
+   * processes incoming events for the specified actor.
+   */
+  #makeActorEventHandler(actorDid) {
+    return async (event) => {
+      const actor = this.#actors.get(actorDid);
+      if (!actor) return;
+      if (event.pubkey === (0, import_utils4.bytesToHex)(actor.keys.publicKey.x)) return;
+      let message;
+      try {
+        if (event.kind === 1) {
+          message = JSON.parse(event.content, _NostrTransport.#jsonReviver);
+        } else if (event.kind === 1059) {
+          const conversationKey = import_nostr_tools.nip44.v2.utils.getConversationKey(
+            actor.keys.secretKey.bytes,
+            event.pubkey
+          );
+          const plaintext = import_nostr_tools.nip44.v2.decrypt(event.content, conversationKey);
+          message = JSON.parse(plaintext, _NostrTransport.#jsonReviver);
+        } else {
+          return;
+        }
+      } catch (err) {
+        this.#logger.debug(`Failed to parse event ${event.id} for ${actorDid}:`, err);
+        return;
+      }
+      this.#dispatchMessage(message, actor);
+    };
+  }
+  /**
+   * Handles incoming broadcast events (kind 1) by parsing the event content, validating it as an
+   * aggregation message, and dispatching it to all registered actors that have handlers for the
+   * message type. This is used for COHORT_ADVERT messages that need to be received by all actors
+   * regardless of DID.
+   * @param {Event} event - The Nostr event to handle, expected to be a kind 1 broadcast containing
+   * a COHORT_ADVERT message. The event content is parsed and dispatched to all registered actors
+   * that have handlers for the
+   * @returns
+   */
+  async #handleBroadcastEvent(event) {
+    if (event.kind !== 1) return;
+    let message;
+    try {
+      message = JSON.parse(event.content, _NostrTransport.#jsonReviver);
+    } catch (err) {
+      this.#logger.debug(`Failed to parse broadcast event ${event.id}:`, err);
+      return;
+    }
+    if (message.body && typeof message.body === "object") {
+      message = { ...message, ...message.body };
+    }
+    const messageType = message.type;
+    if (!messageType || !isAggregationMessageType(messageType)) return;
+    for (const actor of this.#actors.values()) {
+      const handler = actor.handlers.get(messageType);
+      if (handler) await handler(message);
+    }
+  }
+  /**
+   * Dispatches a parsed message to the appropriate handler of a registered actor based on message type.
+   * The message is expected to have already been parsed from the Nostr event content and validated as
+   * an aggregation message. If the message has a body, its properties are merged into the top-level
+   * message object for easier handler access. The message is then dispatched to the handler registered
+   * for its type, if one exists.
+   * @param {Record<string, unknown>} message - The message object parsed from a Nostr event, expected to
+   * @param {ActorEntry} actor - The registered actor entry containing keys and handlers to dispatch the message to.
+   * @returns {void}
+   * @throws {TransportAdapterError} If the message type is unsupported or if no handler is registered
+   * for the message type.
+   */
+  #dispatchMessage(message, actor) {
+    if (message.body && typeof message.body === "object") {
+      message = { ...message, ...message.body };
+    }
+    const messageType = message.type;
+    if (!messageType || !isAggregationMessageType(messageType)) return;
+    const handler = actor.handlers.get(messageType);
+    if (handler) handler(message);
+  }
+  /**
+   * Publishes a Nostr event to the configured relays and handles the results. The method waits for all
+   * relay promises to settle and checks how many accepted or rejected the event. If all relays reject the event,
+   * an error is thrown. Otherwise, the method completes successfully even if some relays rejected the event,
+   * as long as at least one relay accepted it. Relay rejections are logged for debugging purposes.
+   * @param {Event} event - The Nostr event to publish to the configured relays. The event should already
+   * @returns {Promise<void>} A promise that resolves if the event was accepted by at least one relay, or rejects
+   * with a TransportAdapterError if all relays rejected the event.
+   * @throws {TransportAdapterError} If the pool is not initialized or if all relays reject the event.
+   */
+  async #publishToRelays(event) {
+    const relayPromises = this.pool?.publish(this.#relays, event);
+    if (!relayPromises?.length) return;
+    const results = await Promise.allSettled(relayPromises);
+    const accepted = results.filter((r) => r.status === "fulfilled").length;
+    const rejected = results.filter((r) => r.status === "rejected");
+    for (const r of rejected) {
+      this.#logger.debug(`Relay rejected event ${event.id}: ${r.reason}`);
+    }
+    if (accepted === 0) {
+      throw new TransportAdapterError(
+        `All ${results.length} relay(s) rejected event ${event.id}`,
+        "PUBLISH_ERROR",
+        { adapter: this.name, reasons: rejected.map((r) => String(r.reason)) }
+      );
+    }
+  }
+  /**
+   * Custom JSON replacer to handle serialization of Uint8Array values as hex strings in message
+   * content. This allows messages containing binary data (e.g. public keys, signatures) to be correctly
+   * serialized to JSON for Nostr event content. The replacer checks if a value is a Uint8Array and, if so,
+   * converts it to a hex string wrapped in an object with a __bytes property. The corresponding reviver
+   * can then convert this back to a Uint8Array when parsing the message content from the event.
+   * @param {string} _key - The key of the property being processed.
+   * @param {unknown} value - The value to check if the message type is valid.
+   * @returns {unknown} The transformed value for JSON serialization. If the value is a Uint8Array,
+   * it returns an object with a __bytes property containing the hex string. Otherwise, it returns
+   * the value unchanged.
+   */
+  static #jsonReplacer(_key, value) {
+    if (value instanceof Uint8Array) {
+      return { __bytes: (0, import_utils4.bytesToHex)(value) };
+    }
+    return value;
+  }
+  /**
+   * Custom JSON reviver to handle deserialization of hex strings back into Uint8Array values in message
+   * content. This complements the custom replacer used during serialization, allowing messages that contain
+   * binary data (e.g. public keys, signatures) to be correctly reconstructed when parsing JSON from
+   * Nostr event content. The reviver checks if a value is an object with a __bytes property and,
+   * if so, converts the hex string back into a Uint8Array. Otherwise, it returns the value unchanged.
+   * @param {string} _key - The key of the property being processed.
+   * @param {unknown} value - The value to check if it is an object containing a __bytes property for
+   * hex string conversion.
+   * @returns {unknown} The transformed value for JSON deserialization. If the value is an object
+   * with a __bytes property, it returns a Uint8Array. Otherwise, it returns the value unchanged.
+   */
+  static #jsonReviver(_key, value) {
+    if (value && typeof value === "object" && "__bytes" in value) {
+      return (0, import_utils4.hexToBytes)(value.__bytes);
+    }
+    return value;
+  }
+};
+
+// src/core/transport/didcomm.ts
+var import_common5 = require("@did-btcr2/common");
+var DidCommTransport = class {
+  name = "didcomm";
+  start() {
+    throw new import_common5.NotImplementedError("DidCommTransport not implemented. Use NostrTransport instead.");
+  }
+  registerActor(_did, _keys) {
+    throw new import_common5.NotImplementedError("DidCommTransport not implemented.");
+  }
+  getActorPk(_did) {
+    throw new import_common5.NotImplementedError("DidCommTransport not implemented.");
+  }
+  registerPeer(_did, _communicationPk) {
+    throw new import_common5.NotImplementedError("DidCommTransport not implemented.");
+  }
+  getPeerPk(_did) {
+    throw new import_common5.NotImplementedError("DidCommTransport not implemented.");
+  }
+  registerMessageHandler(_actorDid, _messageType, _handler) {
+    throw new import_common5.NotImplementedError("DidCommTransport not implemented.");
+  }
+  unregisterMessageHandler(_actorDid, _messageType) {
+    throw new import_common5.NotImplementedError("DidCommTransport not implemented.");
+  }
+  unregisterActor(_did) {
+    throw new import_common5.NotImplementedError("DidCommTransport not implemented.");
+  }
+  async sendMessage(_message, _sender, _recipient) {
+    throw new import_common5.NotImplementedError("DidCommTransport not implemented.");
+  }
+  publishRepeating(_message, _sender, _intervalMs, _recipient) {
+    throw new import_common5.NotImplementedError("DidCommTransport not implemented.");
+  }
+};
+
+// src/core/transport/http/envelope.ts
+var import_common6 = require("@did-btcr2/common");
+var import_utils5 = require("@noble/hashes/utils");
+
+// src/core/transport/http/errors.ts
+var HttpTransportError = class extends TransportAdapterError {
+  constructor(message, type = "HttpTransportError", data) {
+    super(message, type, { adapter: "http", ...data ?? {} });
+  }
+};
+
+// src/core/transport/http/protocol.ts
+var HTTP_ENVELOPE_VERSION = 1;
+var HTTP_ROUTE = {
+  ADVERTS: "/v1/adverts",
+  MESSAGES: "/v1/messages",
+  ACTOR_INBOX: "/v1/actors/{did}/inbox",
+  WELL_KNOWN: "/v1/.well-known/aggregation"
+};
+var SSE_EVENT = {
+  ADVERT: "advert",
+  MESSAGE: "message",
+  HEARTBEAT: "heartbeat"
+};
+var DEFAULT_CLOCK_SKEW_SEC = 60;
+var DEFAULT_NONCE_LEN_BYTES = 16;
+
+// src/core/transport/http/envelope.ts
+function signEnvelope(message, sender, opts = {}) {
+  const timestamp = opts.timestamp ?? Math.floor(Date.now() / 1e3);
+  const nonce = opts.nonce ?? (0, import_utils5.bytesToHex)((0, import_utils5.randomBytes)(DEFAULT_NONCE_LEN_BYTES));
+  const messageJson = normalizeForWire(normalizeMessage(message));
+  const unsigned = {
+    v: HTTP_ENVELOPE_VERSION,
+    from: sender.did,
+    ...opts.to !== void 0 ? { to: opts.to } : {},
+    timestamp,
+    nonce,
+    message: messageJson
+  };
+  const digest = (0, import_common6.canonicalHashBytes)(unsigned);
+  const sig = sender.keys.secretKey.sign(digest, { scheme: "schnorr" });
+  return { ...unsigned, sig: (0, import_utils5.bytesToHex)(sig) };
+}
+function verifyEnvelope(envelope, senderPk, opts = {}) {
+  if (envelope.v !== HTTP_ENVELOPE_VERSION) {
+    throw new HttpTransportError(
+      `Unsupported envelope version: ${envelope.v}`,
+      "ENVELOPE_VERSION_MISMATCH",
+      { version: envelope.v, expected: HTTP_ENVELOPE_VERSION }
+    );
+  }
+  if (opts.expectedFrom !== void 0 && envelope.from !== opts.expectedFrom) {
+    throw new HttpTransportError(
+      `Envelope from mismatch: expected ${opts.expectedFrom}, got ${envelope.from}`,
+      "ENVELOPE_FROM_MISMATCH",
+      { expected: opts.expectedFrom, got: envelope.from }
+    );
+  }
+  if ("expectedTo" in opts && envelope.to !== opts.expectedTo) {
+    throw new HttpTransportError(
+      `Envelope to mismatch: expected ${opts.expectedTo ?? "<broadcast>"}, got ${envelope.to ?? "<broadcast>"}`,
+      "ENVELOPE_TO_MISMATCH",
+      { expected: opts.expectedTo, got: envelope.to }
+    );
+  }
+  const skewSec = opts.clockSkewSec ?? DEFAULT_CLOCK_SKEW_SEC;
+  const nowMs = opts.now ? opts.now() : Date.now();
+  const nowSec = Math.floor(nowMs / 1e3);
+  const diff = Math.abs(nowSec - envelope.timestamp);
+  if (diff > skewSec) {
+    throw new HttpTransportError(
+      `Envelope timestamp out of skew: ${diff}s > ${skewSec}s`,
+      "ENVELOPE_TIMESTAMP_SKEW",
+      { diff, skewSec, timestamp: envelope.timestamp, now: nowSec }
+    );
+  }
+  let sigBytes;
+  try {
+    sigBytes = (0, import_utils5.hexToBytes)(envelope.sig);
+  } catch {
+    throw new HttpTransportError(
+      "Envelope signature is not valid hex",
+      "ENVELOPE_SIG_HEX"
+    );
+  }
+  if (sigBytes.length !== 64) {
+    throw new HttpTransportError(
+      `Invalid signature length: ${sigBytes.length} (expected 64)`,
+      "ENVELOPE_SIG_LENGTH",
+      { length: sigBytes.length }
+    );
+  }
+  const { sig: _sig, ...unsigned } = envelope;
+  const digest = (0, import_common6.canonicalHashBytes)(unsigned);
+  const ok = senderPk.verify(sigBytes, digest, { scheme: "schnorr" });
+  if (!ok) {
+    throw new HttpTransportError(
+      "Envelope signature verification failed",
+      "ENVELOPE_SIG_INVALID"
+    );
+  }
+}
+function normalizeMessage(message) {
+  const maybeToJSON = message.toJSON;
+  if (typeof maybeToJSON === "function") {
+    return maybeToJSON.call(message);
+  }
+  return message;
+}
+function normalizeForWire(value) {
+  if (value instanceof Uint8Array) {
+    return { __bytes: (0, import_utils5.bytesToHex)(value) };
+  }
+  if (Array.isArray(value)) {
+    return value.map((v) => normalizeForWire(v));
+  }
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = normalizeForWire(v);
+    }
+    return out;
+  }
+  return value;
+}
+function reviveFromWire(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const rec = value;
+    const keys = Object.keys(rec);
+    if (keys.length === 1 && keys[0] === "__bytes" && typeof rec.__bytes === "string") {
+      return (0, import_utils5.hexToBytes)(rec.__bytes);
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(rec)) out[k] = reviveFromWire(v);
+    return out;
+  }
+  if (Array.isArray(value)) {
+    return value.map((v) => reviveFromWire(v));
+  }
+  return value;
+}
+
+// src/core/transport/http/request-auth.ts
+var import_common7 = require("@did-btcr2/common");
+var import_utils6 = require("@noble/hashes/utils");
+var REQUEST_AUTH_SCHEME = "BTCR2-Sig";
+function buildRequestAuth(did, keys, path, opts = {}) {
+  const ts = opts.timestamp ?? Math.floor(Date.now() / 1e3);
+  const nonce = opts.nonce ?? (0, import_utils6.bytesToHex)((0, import_utils6.randomBytes)(DEFAULT_NONCE_LEN_BYTES));
+  const digest = (0, import_common7.canonicalHashBytes)({
+    v: HTTP_ENVELOPE_VERSION,
+    did,
+    ts,
+    nonce,
+    path
+  });
+  const sig = keys.secretKey.sign(digest, { scheme: "schnorr" });
+  return `${REQUEST_AUTH_SCHEME} v=${HTTP_ENVELOPE_VERSION},did=${did},ts=${ts},nonce=${nonce},sig=${(0, import_utils6.bytesToHex)(sig)}`;
+}
+function parseRequestAuth(headerValue) {
+  const prefix = `${REQUEST_AUTH_SCHEME} `;
+  if (!headerValue.startsWith(prefix)) {
+    throw new HttpTransportError(
+      `Unexpected auth scheme (want ${REQUEST_AUTH_SCHEME})`,
+      "REQUEST_AUTH_SCHEME"
+    );
+  }
+  const params = {};
+  for (const piece of headerValue.slice(prefix.length).split(",")) {
+    const eq = piece.indexOf("=");
+    if (eq === -1) continue;
+    const key = piece.slice(0, eq).trim();
+    const val = piece.slice(eq + 1).trim();
+    if (key.length > 0) params[key] = val;
+  }
+  const v = Number(params.v);
+  const ts = Number(params.ts);
+  if (!Number.isInteger(v) || !Number.isInteger(ts) || !params.did || !params.nonce || !params.sig) {
+    throw new HttpTransportError(
+      "Malformed auth header (missing or invalid field)",
+      "REQUEST_AUTH_MALFORMED",
+      { received: Object.keys(params) }
+    );
+  }
+  return { v, did: params.did, ts, nonce: params.nonce, sig: params.sig };
+}
+function verifyRequestAuth(headerValue, expectedPath, senderPk, opts = {}) {
+  const parsed = parseRequestAuth(headerValue);
+  if (parsed.v !== HTTP_ENVELOPE_VERSION) {
+    throw new HttpTransportError(
+      `Unsupported auth version: ${parsed.v}`,
+      "REQUEST_AUTH_VERSION_MISMATCH",
+      { version: parsed.v, expected: HTTP_ENVELOPE_VERSION }
+    );
+  }
+  const skewSec = opts.clockSkewSec ?? DEFAULT_CLOCK_SKEW_SEC;
+  const nowMs = opts.now ? opts.now() : Date.now();
+  const nowSec = Math.floor(nowMs / 1e3);
+  const diff = Math.abs(nowSec - parsed.ts);
+  if (diff > skewSec) {
+    throw new HttpTransportError(
+      `Auth timestamp out of skew: ${diff}s > ${skewSec}s`,
+      "REQUEST_AUTH_TIMESTAMP_SKEW",
+      { diff, skewSec }
+    );
+  }
+  let sigBytes;
+  try {
+    sigBytes = (0, import_utils6.hexToBytes)(parsed.sig);
+  } catch {
+    throw new HttpTransportError("Auth signature is not valid hex", "REQUEST_AUTH_SIG_HEX");
+  }
+  if (sigBytes.length !== 64) {
+    throw new HttpTransportError(
+      `Invalid auth signature length: ${sigBytes.length}`,
+      "REQUEST_AUTH_SIG_LENGTH",
+      { length: sigBytes.length }
+    );
+  }
+  const digest = (0, import_common7.canonicalHashBytes)({
+    v: parsed.v,
+    did: parsed.did,
+    ts: parsed.ts,
+    nonce: parsed.nonce,
+    path: expectedPath
+  });
+  const ok = senderPk.verify(sigBytes, digest, { scheme: "schnorr" });
+  if (!ok) {
+    throw new HttpTransportError("Auth signature verification failed", "REQUEST_AUTH_SIG_INVALID");
+  }
+  return parsed;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AGGREGATED_NONCE,
+  AGGREGATION_MESSAGE_PREFIX,
+  AGGREGATION_WIRE_VERSION,
+  AUTHORIZATION_REQUEST,
+  AggregationCohort,
+  AggregationCohortError,
+  AggregationParticipantError,
+  AggregationServiceError,
+  BaseMessage,
+  BeaconSigningSession,
+  COHORT_ADVERT,
+  COHORT_OPT_IN,
+  COHORT_OPT_IN_ACCEPT,
+  COHORT_READY,
+  CONSOLE_LOGGER,
+  DEFAULT_BROADCAST_LOOKBACK_MS,
+  DEFAULT_CLOCK_SKEW_SEC,
+  DEFAULT_FUNDING_MODEL,
+  DEFAULT_NONCE_LEN_BYTES,
+  DEFAULT_NOSTR_RELAYS,
+  DEFAULT_RECOVERY_SEQUENCE,
+  DISTRIBUTE_AGGREGATED_DATA,
+  DidCommTransport,
+  FALLBACK_AUTHORIZATION_REQUEST,
+  FALLBACK_SIGNATURE,
+  HTTP_ENVELOPE_VERSION,
+  HTTP_ROUTE,
+  HttpTransportError,
+  InMemoryBus,
+  InMemoryTransport,
+  KNOWN_BEACON_TYPES,
+  KNOWN_FUNDING_MODELS,
+  KeyPairAggregationSigner,
+  MAX_RECOVERY_SEQUENCE,
+  NONCE_CONTRIBUTION,
+  NostrTransport,
+  ParticipantCohortPhase,
+  REQUEST_AUTH_SCHEME,
+  SIGNATURE_AUTHORIZATION,
+  SILENT_LOGGER,
+  SSE_EVENT,
+  SUBMIT_NONINCLUDED,
+  SUBMIT_UPDATE,
+  ServiceCohortPhase,
+  SigningSessionError,
+  SigningSessionPhase,
+  TAPROOT_LEAF_VERSION,
+  TransportAdapterError,
+  TransportError,
+  TypedEventEmitter,
+  VALIDATION_ACK,
+  buildFallbackLeaf,
+  buildFallbackSpend,
+  buildRecoveryLeaves,
+  buildRecoveryScript,
+  buildRecoverySpend,
+  buildRequestAuth,
+  createAggregatedNonceMessage,
+  createAuthorizationRequestMessage,
+  createCohortAdvertMessage,
+  createCohortOptInAcceptMessage,
+  createCohortOptInMessage,
+  createCohortReadyMessage,
+  createDistributeAggregatedDataMessage,
+  createFallbackAuthorizationRequestMessage,
+  createFallbackSignatureMessage,
+  createNonceContributionMessage,
+  createSignatureAuthorizationMessage,
+  createSubmitNonIncludedMessage,
+  createSubmitUpdateMessage,
+  createValidationAckMessage,
+  fallbackSighash,
+  getBeaconStrategy,
+  isAggregatedNonceMessage,
+  isAggregationMessageType,
+  isAuthorizationRequestMessage,
+  isCohortAdvertMessage,
+  isCohortOptInAcceptMessage,
+  isCohortOptInMessage,
+  isCohortReadyMessage,
+  isDistributeAggregatedDataMessage,
+  isFallbackAuthorizationRequestMessage,
+  isFallbackSignatureMessage,
+  isKeygenMessageType,
+  isNonceContributionMessage,
+  isSignMessageType,
+  isSignatureAuthorizationMessage,
+  isSubmitNonIncludedMessage,
+  isSubmitUpdateMessage,
+  isUpdateMessageType,
+  isValidationAckMessage,
+  normalizeForWire,
+  parseRequestAuth,
+  registerBeaconStrategy,
+  resolveFallbackThreshold,
+  reviveFromWire,
+  signEnvelope,
+  tapLeafHash,
+  validateCohortConditions,
+  verifyEnvelope,
+  verifyRequestAuth
+});