@did-btcr2/method 0.29.0 → 0.32.0

package/dist/types/core/aggregation/transport/http/rate-limiter.d.ts

@@ -0,0 +1,41 @@
+export interface BucketState {
+    tokens: number;
+    lastRefillMs: number;
+}
+/**
+ * Pluggable storage backend for rate-limit state. The default
+ * {@link InMemoryRateLimitStore} is a plain Map; swap in Redis-backed or
+ * SQLite-backed implementations for multi-instance deployments.
+ */
+export interface RateLimitStore {
+    get(key: string): BucketState | undefined;
+    set(key: string, state: BucketState): void;
+}
+export declare class InMemoryRateLimitStore implements RateLimitStore {
+    #private;
+    get(key: string): BucketState | undefined;
+    set(key: string, state: BucketState): void;
+}
+export interface RateLimiterConfig {
+    /** Steady-state request rate per key (requests per second). Default 10. */
+    rps?: number;
+    /** Peak burst allowance (bucket capacity). Default 30. */
+    burst?: number;
+    /** Optional pluggable store. Defaults to an in-memory Map. */
+    store?: RateLimitStore;
+}
+/**
+ * Token-bucket rate limiter keyed by an opaque string (typically a verified
+ * sender DID). Tokens refill linearly at `rps` up to `burst`. Each `consume`
+ * call atomically debits one token or returns `false` to reject.
+ *
+ * The limiter is synchronous and deterministic given `nowMs` — tests can
+ * drive it with a fixed clock to exercise exact boundaries.
+ */
+export declare class RateLimiter {
+    #private;
+    constructor(config?: RateLimiterConfig);
+    /** Consume one token for `key`. Returns `true` if accepted, `false` if throttled. */
+    consume(key: string, nowMs: number): boolean;
+}
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/types/core/aggregation/transport/http/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../../../../src/core/aggregation/transport/http/rate-limiter.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IAC1C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAC5C;AAED,qBAAa,sBAAuB,YAAW,cAAc;;IAG3D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAIzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI;CAG3C;AAED,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,qBAAa,WAAW;;gBAKV,MAAM,GAAE,iBAAsB;IAM1C,qFAAqF;IACrF,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;CAkB7C"}

package/dist/types/core/aggregation/transport/http/request-auth.d.ts

@@ -0,0 +1,50 @@
+import type { CompressedSecp256k1PublicKey, SchnorrKeyPair } from '@did-btcr2/keypair';
+/**
+ * `Authorization`-header scheme used to authenticate SSE subscription
+ * requests. The header value takes the form
+ * `BTCR2-Sig v=<n>,did=<did>,ts=<unix>,nonce=<hex>,sig=<hex>`.
+ *
+ * Used only for GET endpoints (SSE inbox subscribe). POST endpoints carry a
+ * full {@link SignedEnvelope} in the request body instead.
+ */
+export declare const REQUEST_AUTH_SCHEME = "BTCR2-Sig";
+export interface ParsedRequestAuth {
+    /** Transport envelope format version. */
+    v: number;
+    /** Subscriber DID. */
+    did: string;
+    /** Unix-seconds timestamp. */
+    ts: number;
+    /** Hex-encoded anti-replay nonce. */
+    nonce: string;
+    /** Hex-encoded 64-byte BIP340 signature. */
+    sig: string;
+}
+export interface BuildRequestAuthOptions {
+    nonce?: string;
+    timestamp?: number;
+}
+/**
+ * Build an `Authorization` header value proving the caller controls the
+ * private key for `did`. Covers a specific request path so the signature
+ * can't be replayed against a different endpoint.
+ */
+export declare function buildRequestAuth(did: string, keys: SchnorrKeyPair, path: string, opts?: BuildRequestAuthOptions): string;
+/**
+ * Parse a `BTCR2-Sig` auth header value into its structured fields. Does NOT
+ * verify the signature — call {@link verifyRequestAuth} for that.
+ */
+export declare function parseRequestAuth(headerValue: string): ParsedRequestAuth;
+export interface VerifyRequestAuthOptions {
+    clockSkewSec?: number;
+    now?: () => number;
+}
+/**
+ * Parse + verify an auth header. Throws {@link HttpTransportError} on any
+ * failure; returns the parsed fields on success.
+ *
+ * `expectedPath` must match the path the signature commits to. `senderPk`
+ * must correspond to the DID the signer claims.
+ */
+export declare function verifyRequestAuth(headerValue: string, expectedPath: string, senderPk: CompressedSecp256k1PublicKey, opts?: VerifyRequestAuthOptions): ParsedRequestAuth;
+//# sourceMappingURL=request-auth.d.ts.map

package/dist/types/core/aggregation/transport/http/request-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-auth.d.ts","sourceRoot":"","sources":["../../../../../../src/core/aggregation/transport/http/request-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,4BAA4B,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAMvF;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAE/C,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,CAAC,EAAE,MAAM,CAAC;IACV,sBAAsB;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAG,MAAM,EACZ,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,uBAA4B,GACjC,MAAM,CAcR;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,CA4BvE;AAED,MAAM,WAAW,wBAAwB;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAG,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAM,4BAA4B,EAC1C,IAAI,GAAU,wBAA6B,GAC1C,iBAAiB,CAmDnB"}

package/dist/types/core/aggregation/transport/http/server.d.ts

@@ -0,0 +1,110 @@
+import type { SchnorrKeyPair } from '@did-btcr2/keypair';
+import type { Logger } from '../../logger.js';
+import type { BaseMessage } from '../../messages/base.js';
+import type { MessageHandler, Transport } from '../transport.js';
+import { NonceCache } from './nonce-cache.js';
+import { RateLimiter } from './rate-limiter.js';
+/** Framework-agnostic incoming-request shape. */
+export interface HttpRequestLike {
+    method: string;
+    /** Either a full URL or path+query; path extraction works with both. */
+    url: string;
+    /** Header names MUST be lowercased. */
+    headers: Record<string, string>;
+    /** Request body (already read). Undefined for GETs. */
+    body?: string;
+    /** Optional remote-address hint for per-IP policies (advert rate limits etc). */
+    remoteAddr?: string;
+}
+/** Framework-agnostic outgoing-response shape. */
+export interface HttpResponseLike {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+}
+/**
+ * Framework-agnostic SSE stream handle. Callers (Express/Hono/Fastify/Workers)
+ * adapt this to their response-writing primitives. All methods are synchronous
+ * from the transport's perspective; the adapter is free to buffer/batch.
+ */
+export interface SseStream {
+    /** Write a named event with data and optional id. */
+    writeEvent(event: string, data: string, id?: string): void;
+    /** Write a comment frame (keepalive; ignored by parsers). */
+    writeComment(comment: string): void;
+    /** Close the stream from the server side. */
+    close(): void;
+    /** Register a callback fired when the client disconnects (or we close). */
+    onClose(cb: () => void): void;
+}
+export type CorsPolicy = {
+    mode: 'permissive';
+} | {
+    mode: 'allowlist';
+    origins: string[];
+} | {
+    mode: 'same-origin';
+};
+export interface HttpServerTransportConfig {
+    logger?: Logger;
+    /** CORS policy. Defaults to `{ mode: 'permissive' }`. */
+    cors?: CorsPolicy;
+    /** Envelope / request-auth clock-skew tolerance, seconds. */
+    clockSkewSec?: number;
+    /** Per-recipient inbox buffer size. Default 100. */
+    inboxBufferSize?: number;
+    /** Advert cache TTL, milliseconds. Default 5 minutes. */
+    advertTtlMs?: number;
+    /** Custom rate limiter (pre-configured). If absent, uses defaults. */
+    rateLimiter?: RateLimiter;
+    /** Custom nonce cache (pre-configured). If absent, uses defaults. */
+    nonceCache?: NonceCache;
+    /** SSE heartbeat interval, milliseconds. Default 20000. Set 0 to disable. */
+    heartbeatIntervalMs?: number;
+    /** Clock injection point for tests. Returns unix milliseconds. */
+    now?: () => number;
+}
+/**
+ * Server-side HTTP transport. Sans-I/O — the caller mounts
+ * {@link handleRequest} and {@link handleSse} under their HTTP framework of
+ * choice; the transport owns only in-memory state (actors, inboxes, advert
+ * cache, replay / rate-limit policies).
+ *
+ * Implements the generic {@link Transport} interface so the aggregation
+ * runners can drive it exactly the same way they drive {@link NostrTransport}
+ * or {@link HttpClientTransport}.
+ */
+export declare class HttpServerTransport implements Transport {
+    #private;
+    readonly name = "http";
+    constructor(config?: HttpServerTransportConfig);
+    start(): void;
+    /**
+     * Detach the transport: close every open SSE subscription, clear the advert
+     * cache, and drop all actor / peer / inbox state. Intended for shutdown and
+     * for test teardown.
+     */
+    stop(): void;
+    registerActor(did: string, keys: SchnorrKeyPair): void;
+    unregisterActor(did: string): void;
+    getActorPk(did: string): Uint8Array | undefined;
+    registerPeer(did: string, communicationPk: Uint8Array): void;
+    getPeerPk(did: string): Uint8Array | undefined;
+    registerMessageHandler(actorDid: string, messageType: string, handler: MessageHandler): void;
+    unregisterMessageHandler(actorDid: string, messageType: string): void;
+    sendMessage(message: BaseMessage, sender: string, recipient?: string): Promise<void>;
+    publishRepeating(message: BaseMessage, sender: string, _intervalMs: number, _recipient?: string): () => void;
+    /**
+     * Handle a POST / GET request (non-SSE). The caller dispatches SSE paths to
+     * {@link handleSse} instead. Returns a fully formed response; the caller's
+     * adapter turns it into an HTTP write.
+     */
+    handleRequest(req: HttpRequestLike): Promise<HttpResponseLike>;
+    /**
+     * Open an SSE stream for a GET request. The caller is responsible for
+     * flushing writes and propagating the `onClose` callback when the HTTP
+     * connection ends.
+     */
+    handleSse(req: HttpRequestLike, stream: SseStream): void;
+}
+//# sourceMappingURL=server.d.ts.map

package/dist/types/core/aggregation/transport/http/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../src/core/aggregation/transport/http/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAIzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQ9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,iDAAiD;AACjD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,qDAAqD;IACrD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3D,6DAA6D;IAC7D,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,6CAA6C;IAC7C,KAAK,IAAI,IAAI,CAAC;IACd,2EAA2E;IAC3E,OAAO,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAE5B,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qEAAqE;IACrE,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,6EAA6E;IAC7E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAkCD;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,YAAW,SAAS;;IACnD,QAAQ,CAAC,IAAI,UAAU;gBAqBX,MAAM,GAAE,yBAA8B;IAgBlD,KAAK,IAAI,IAAI;IAKb;;;;OAIG;IACH,IAAI,IAAI,IAAI;IAWZ,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI;IAItD,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKlC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAI/C,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,GAAG,IAAI;IAa5D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAI9C,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI;IAY5F,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAI/D,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B1F,gBAAgB,CACd,OAAO,EAAK,WAAW,EACvB,MAAM,EAAM,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM,IAAI;IAwBb;;;;OAIG;IACG,aAAa,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAkBpE;;;;OAIG;IACH,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI;CA4QzD"}

package/dist/types/core/aggregation/transport/http/sse-stream.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Parsed Server-Sent Events record.
+ *
+ * Events without a `data` field are never yielded (per the SSE spec — only a
+ * blank line that follows at least one `data:` line dispatches an event).
+ */
+export interface SseEvent {
+    /** Optional event name (from `event:` field). Defaults to "message" if omitted. */
+    event?: string;
+    /** Accumulated data payload (multiple `data:` lines joined with `\n`). */
+    data: string;
+    /** Last-Event-ID value for reconnect resumption. */
+    id?: string;
+    /** Retry delay hint in milliseconds. */
+    retry?: number;
+}
+/**
+ * Parse an SSE stream into an async iterable of {@link SseEvent} records.
+ *
+ * The parser follows the HTML Living Standard ({@link https://html.spec.whatwg.org/multipage/server-sent-events.html})
+ * closely enough for our needs: LF and CRLF line terminators, multi-line
+ * `data` fields, `event` / `id` / `retry` fields, and `:`-prefixed comments.
+ * CR-only line terminators are not supported (every mainstream SSE
+ * implementation emits LF or CRLF).
+ *
+ * Pure, runtime-agnostic — works anywhere `ReadableStream<Uint8Array>` and
+ * `TextDecoder` exist (browsers and Node 22+).
+ *
+ * The caller owns stream lifecycle: cancellation should be effected via an
+ * `AbortController` on the producing `fetch`, which propagates as a read
+ * error and cleanly unwinds this generator's `finally`.
+ */
+export declare function parseSseStream(readable: ReadableStream<Uint8Array>): AsyncGenerator<SseEvent, void, void>;
+//# sourceMappingURL=sse-stream.d.ts.map

package/dist/types/core/aggregation/transport/http/sse-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-stream.d.ts","sourceRoot":"","sources":["../../../../../../src/core/aggregation/transport/http/sse-stream.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAuB,cAAc,CACnC,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,GACnC,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAqFtC"}

package/dist/types/core/aggregation/transport/http/sse-writer.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Format an SSE event frame. Pairs with {@link parseSseStream}.
+ *
+ * Multi-line `data` is split across multiple `data:` lines per the SSE spec —
+ * each embedded `\n` becomes its own line, and the parser rejoins them.
+ *
+ * The returned string includes a trailing blank line (the dispatch marker).
+ */
+export declare function formatSseEvent(event: string, data: string, id?: string): string;
+/** SSE comment frame (server keepalive). Lines starting with `:` are ignored by compliant parsers. */
+export declare function formatSseComment(comment: string): string;
+//# sourceMappingURL=sse-writer.d.ts.map

package/dist/types/core/aggregation/transport/http/sse-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-writer.d.ts","sourceRoot":"","sources":["../../../../../../src/core/aggregation/transport/http/sse-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ/E;AAED,sGAAsG;AACtG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGxD"}

package/dist/types/core/aggregation/transport/index.d.ts

@@ -3,4 +3,5 @@ export * from './error.js';
 export * from './factory.js';
 export * from './nostr.js';
 export * from './didcomm.js';
+export * from './http/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/core/aggregation/transport/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/aggregation/transport/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/aggregation/transport/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}

package/dist/types/core/aggregation/transport/transport.d.ts

@@ -3,7 +3,7 @@ import type { BaseMessage } from '../messages/base.js';
 export type SyncMessageHandler = (msg: any) => void;
 export type AsyncMessageHandler = (msg: any) => Promise<void>;
 export type MessageHandler = SyncMessageHandler | AsyncMessageHandler;
-export type TransportType = 'nostr' | 'didcomm';
+export type TransportType = 'nostr' | 'didcomm' | 'http';
 /**
  * Multi-actor message transport.
  *

package/dist/types/core/aggregation/transport/transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../../../../src/core/aggregation/transport/transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;AACpD,MAAM,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAC9D,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG,mBAAmB,CAAC;AAEtE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IAEb,sEAAsE;IACtE,KAAK,IAAI,IAAI,CAAC;IAEd,sEAAsE;IACtE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAEvD,uEAAuE;IACvE,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAEhD,4EAA4E;IAC5E,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,GAAG,IAAI,CAAC;IAE7D,yDAAyD;IACzD,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAE/C,6DAA6D;IAC7D,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAE7F,uEAAuE;IACvE,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtE;;;;OAIG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,6EAA6E;IAC7E,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErF;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,CACd,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,IAAI,CAAC;CACf"}
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../../../../src/core/aggregation/transport/transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;AACpD,MAAM,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAC9D,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG,mBAAmB,CAAC;AAEtE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IAEb,sEAAsE;IACtE,KAAK,IAAI,IAAI,CAAC;IAEd,sEAAsE;IACtE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAEvD,uEAAuE;IACvE,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAEhD,4EAA4E;IAC5E,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,GAAG,IAAI,CAAC;IAE7D,yDAAyD;IACzD,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAE/C,6DAA6D;IAC7D,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAE7F,uEAAuE;IACvE,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtE;;;;OAIG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,6EAA6E;IAC7E,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErF;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,CACd,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,IAAI,CAAC;CACf"}

package/dist/types/core/beacon/beacon.d.ts

@@ -1,11 +1,52 @@
 import type { AddressUtxo, BitcoinConnection, BTCNetwork } from '@did-btcr2/bitcoin';
 import type { KeyBytes } from '@did-btcr2/common';
 import type { SignedBTCR2Update } from '@did-btcr2/cryptosuite';
+import type { Signer } from '@did-btcr2/keypair';
 import { Transaction } from '@scure/btc-signer';
 import type { BeaconProcessResult } from '../resolver.js';
 import type { SidecarData } from '../types.js';
 import type { FeeEstimator } from './fee-estimator.js';
 import type { BeaconService, BeaconSignal } from './interfaces.js';
+/**
+ * Singleton beacon script kinds. Per the did:btcr2 spec, deterministic DID documents
+ * include three beacon services: P2PKH, P2WPKH, and P2TR (taproot key-path) — all
+ * derived from the genesis secp256k1 public key. The singleton broadcast path must
+ * support signing for all three.
+ */
+export type SingletonScriptKind = 'p2pkh' | 'p2wpkh' | 'p2tr';
+/**
+ * Conservative vsize estimate for a 1-input P2TR key-path → 1 P2TR change + 1 OP_RETURN(32) tx.
+ * Stripped 137 + witness ≈ 68 (marker + flag + stack-count + sig-len + 64 BIP-340 sig).
+ * Weight = 137*4 + 68 = 616, vsize ≈ 154, rounded to 160 for headroom.
+ */
+export declare const P2TR_BEACON_TX_VSIZE = 160;
+/**
+ * Conservative vsize estimate for a 1-input P2WPKH → 1 P2WPKH change + 1 OP_RETURN(32) tx.
+ * Stripped 125 + witness ≈ 110 (worst-case DER ECDSA sig 72 + sighash byte + 33 pubkey + framing).
+ * vsize = ceil((125*4 + 110) / 4) ≈ 153, rounded to 155.
+ */
+export declare const P2WPKH_BEACON_TX_VSIZE = 155;
+/**
+ * Conservative vsize estimate for a 1-input P2PKH → 1 P2PKH change + 1 OP_RETURN(32) tx.
+ * Legacy (non-segwit): scriptSig carries the full sig+pubkey (~108 bytes), no witness
+ * discount. Stripped ≈ 4 nVer + 1 vin-count + (32+4+1+108+4) input + 1 vout-count +
+ * 34 P2PKH-change + 43 OP_RETURN + 4 nLockTime ≈ 236 bytes. vsize = 236, rounded to 240.
+ */
+export declare const P2PKH_BEACON_TX_VSIZE = 240;
+/** Per-kind vsize lookup for singleton beacon fee estimation. */
+export declare const SINGLETON_BEACON_TX_VSIZE: Readonly<Record<SingletonScriptKind, number>>;
+/**
+ * Detect the singleton script kind of a Bitcoin address (P2PKH / P2WPKH / P2TR).
+ * The deterministic-DID document emits all three kinds; the broadcast path needs
+ * to know which is in use to construct the input and dispatch the signing primitive.
+ */
+export declare function detectSingletonScriptKind(bitcoinAddress: string, network: BTCNetwork): SingletonScriptKind;
+/**
+ * Derive the address that `pubkey` produces under the given script kind. Used to
+ * fail-fast when a caller wires a signer to a beacon address that the signer's
+ * pubkey cannot actually spend.
+ */
+export declare function deriveSingletonAddress(kind: SingletonScriptKind, pubkey: KeyBytes, network: BTCNetwork): string;
 /**
  * Options accepted by {@link Beacon.buildSignAndBroadcast} and related helpers.
  */
@@ -30,11 +71,24 @@ export interface BeaconTxPlan {
     utxo: AddressUtxo;
     /** The fee (sats) already deducted from the change output. */
     feeSats: bigint;
+    /**
+     * Singleton beacon script kind, when applicable. Drives the signing dispatch
+     * in {@link Beacon.signSinglePartyTx}. Aggregation plans set this to `'p2tr'`.
+     */
+    scriptKind: SingletonScriptKind;
 }
 /**
  * Build an OP_RETURN script carrying a 32-byte beacon signal.
  * Exported as a utility so callers building txs outside Beacon (e.g., the aggregation
  * `onProvideTxData` callback) can produce identical output.
+ *
+ * Uses the opcode *string* `'RETURN'` rather than the numeric `OP.RETURN`
+ * constant because scure's `Script.encode` interprets a number as a byte to
+ * push, not as the opcode. The string form emits the bare opcode (0x6a)
+ * followed by an `OP_PUSHBYTES_32` push, producing the standard NULL_DATA
+ * shape Bitcoin Core's `IsStandard` accepts. The numeric form silently
+ * produces `OP_PUSHBYTES_1 0x6a OP_PUSHBYTES_32 <32 bytes>`, which is
+ * non-standard and rejected at broadcast with `RPC error -26: scriptpubkey`.
  */
 export declare function opReturnScript(signalBytes: Uint8Array): Uint8Array;
 /**
@@ -79,7 +133,6 @@ export declare function buildAggregationBeaconTx(opts: {
  * @type {Beacon}
  */
 export declare abstract class Beacon {
-    #private;
     /**
      * The Beacon service configuration parsed from the DID Document.
      */
@@ -101,14 +154,17 @@ export declare abstract class Beacon {
      * Broadcasts a signed update as a Beacon Signal to the Bitcoin network.
      * Used during the update path.
      * @param {SignedBTCR2Update} signedUpdate The signed BTCR2 update to broadcast.
-     * @param {KeyBytes} secretKey The secret key for signing the Bitcoin transaction.
+     * @param {Signer} signer Signer that produces the signature for the spending input.
+     *   ECDSA for P2PKH / P2WPKH singletons, Schnorr (BIP-340) for P2TR key-path.
      * @param {BitcoinConnection} bitcoin The Bitcoin network connection.
      * @param {BroadcastOptions} [options] Optional broadcast configuration (e.g. fee estimator).
      * @returns {Promise<SignedBTCR2Update>} The signed update that was broadcast.
      */
-    abstract broadcastSignal(signedUpdate: SignedBTCR2Update, secretKey: KeyBytes, bitcoin: BitcoinConnection, options?: BroadcastOptions): Promise<SignedBTCR2Update>;
+    abstract broadcastSignal(signedUpdate: SignedBTCR2Update, signer: Signer, bitcoin: BitcoinConnection, options?: BroadcastOptions): Promise<SignedBTCR2Update>;
     /**
-     * Build + sign + broadcast a single-party beacon signal transaction (P2WPKH spend).
+     * Build + sign + broadcast a singleton beacon signal transaction. The beacon
+     * address's script kind (P2PKH / P2WPKH / P2TR) is detected automatically
+     * and the input is constructed and signed accordingly.
      *
      * Composed from the three extracted phases ({@link buildSinglePartyTx},
      * {@link signSinglePartyTx}, {@link broadcastRawTx}) so each piece can be exercised
@@ -117,33 +173,37 @@ export declare abstract class Beacon {
      * plumbing (UTXO fetch + OP_RETURN output + change output) is shared.
      *
      * @param signalBytes 32-byte payload to embed in OP_RETURN.
-     * @param secretKey Secret key used to sign the spending input.
+     * @param signer Signer used to sign the spending input.
      * @param bitcoin Bitcoin network connection.
      * @param options Broadcast options (fee estimator, etc.).
      * @returns The txid of the broadcast transaction.
      * @throws {BeaconError} if the address is unfunded, no UTXO is available, or fee exceeds value.
      */
-    protected buildSignAndBroadcast(signalBytes: Uint8Array, secretKey: KeyBytes, bitcoin: BitcoinConnection, options?: BroadcastOptions): Promise<string>;
+    protected buildSignAndBroadcast(signalBytes: Uint8Array, signer: Signer, bitcoin: BitcoinConnection, options?: BroadcastOptions): Promise<string>;
     /**
-     * Build an unsigned P2WPKH single-party beacon tx + probe-sign to determine vsize,
-     * then rebuild with the real fee. Returns the tx and prev-output metadata.
+     * Build an unsigned singleton beacon tx ready for {@link signSinglePartyTx}.
      *
-     * The secret key is required here (not just in `signSinglePartyTx`) because the
-     * two-pass fee estimation requires an actual signature to measure vsize accurately.
+     * Detects the beacon address script kind (P2PKH / P2WPKH / P2TR) and configures
+     * the input accordingly. Validates that the signer's pubkey produces the beacon
+     * address under that script kind — without this check, a misconfigured caller
+     * would burn a real UTXO on a tx that fails at broadcast. Fees are computed from
+     * the per-kind {@link SINGLETON_BEACON_TX_VSIZE} constant, avoiding any probe-sign
+     * round-trip.
      */
     protected buildSinglePartyTx(opts: {
         signalBytes: Uint8Array;
         beaconAddress: string;
         utxo: AddressUtxo;
         prevTxBytes: Uint8Array;
-        secretKey: KeyBytes;
+        signer: Signer;
         bitcoin: BitcoinConnection;
         feeEstimator: FeeEstimator;
     }): Promise<BeaconTxPlan>;
     /**
      * Sign + finalize the unsigned single-party tx and return its raw hex.
+     * Dispatches to the correct signing primitive based on `plan.scriptKind`.
      */
-    protected signSinglePartyTx(tx: Transaction, secretKey: KeyBytes): string;
+    protected signSinglePartyTx(plan: BeaconTxPlan, signer: Signer): Promise<string>;
     /**
      * Broadcast raw transaction hex via the Bitcoin REST endpoint. Returns the txid.
      */

package/dist/types/core/beacon/beacon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"beacon.d.ts","sourceRoot":"","sources":["../../../../src/core/beacon/beacon.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAGhE,OAAO,EAA4B,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAanE;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kGAAkG;IAClG,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,EAAE,EAAE,WAAW,CAAC;IAChB,6EAA6E;IAC7E,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,uDAAuD;IACvD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,oEAAoE;IACpE,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,UAAU,GAAG,UAAU,CAElE;AA4BD;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,cAAc,EAAE,UAAU,CAAC;IAC3B,8DAA8D;IAC9D,WAAW,EAAE,UAAU,CAAC;IACxB,yDAAyD;IACzD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,iEAAiE;IACjE,OAAO,EAAE,UAAU,CAAC;IACpB,qDAAqD;IACrD,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B,GAAG,OAAO,CAAC,YAAY,CAAC,CAoCxB;AAED;;;;;;;;;;;;;;GAcG;AACH,8BAAsB,MAAM;;IAC1B;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;gBAEpB,OAAO,EAAE,aAAa;IAIlC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CACrB,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,EAC5B,OAAO,EAAE,WAAW,GACnB,mBAAmB;IAEtB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CACtB,YAAY,EAAE,iBAAiB,EAC/B,SAAS,EAAE,QAAQ,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,iBAAiB,CAAC;IAE7B;;;;;;;;;;;;;;;OAeG;cACa,qBAAqB,CACnC,WAAW,EAAE,UAAU,EACvB,SAAS,EAAE,QAAQ,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC;IAWlB;;;;;;OAMG;cACa,kBAAkB,CAAC,IAAI,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,WAAW,CAAC;QAClB,WAAW,EAAE,UAAU,CAAC;QACxB,SAAS,EAAE,QAAQ,CAAC;QACpB,OAAO,EAAE,iBAAiB,CAAC;QAC3B,YAAY,EAAE,YAAY,CAAC;KAC5B,GAAG,OAAO,CAAC,YAAY,CAAC;IAiDzB;;OAEG;IACH,SAAS,CAAC,iBAAiB,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,GAAG,MAAM;IAMzE;;OAEG;cACa,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAQ5F"}
+{"version":3,"file":"beacon.d.ts","sourceRoot":"","sources":["../../../../src/core/beacon/beacon.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAA4D,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC1G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAKnE;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAInF,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,GAClB,mBAAmB,CAWrB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,UAAU,GAClB,MAAM,CAKR;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kGAAkG;IAClG,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,EAAE,EAAE,WAAW,CAAC;IAChB,6EAA6E;IAC7E,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,uDAAuD;IACvD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,oEAAoE;IACpE,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,mBAAmB,CAAC;CACjC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,UAAU,GAAG,UAAU,CAElE;AA4BD;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,cAAc,EAAE,UAAU,CAAC;IAC3B,8DAA8D;IAC9D,WAAW,EAAE,UAAU,CAAC;IACxB,yDAAyD;IACzD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,iEAAiE;IACjE,OAAO,EAAE,UAAU,CAAC;IACpB,qDAAqD;IACrD,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B,GAAG,OAAO,CAAC,YAAY,CAAC,CAwCxB;AAkFD;;;;;;;;;;;;;;GAcG;AACH,8BAAsB,MAAM;IAC1B;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;gBAEpB,OAAO,EAAE,aAAa;IAIlC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CACrB,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,EAC5B,OAAO,EAAE,WAAW,GACnB,mBAAmB;IAEtB;;;;;;;;;OASG;IACH,QAAQ,CAAC,eAAe,CACtB,YAAY,EAAE,iBAAiB,EAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,iBAAiB,CAAC;IAE7B;;;;;;;;;;;;;;;;;OAiBG;cACa,qBAAqB,CACnC,WAAW,EAAE,UAAU,EACvB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC;IAWlB;;;;;;;;;OASG;cACa,kBAAkB,CAAC,IAAI,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,WAAW,CAAC;QAClB,WAAW,EAAE,UAAU,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,iBAAiB,CAAC;QAC3B,YAAY,EAAE,YAAY,CAAC;KAC5B,GAAG,OAAO,CAAC,YAAY,CAAC;IA0EzB;;;OAGG;cACa,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOtF;;OAEG;cACa,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAG5F"}

package/dist/types/core/beacon/cas-beacon.d.ts

@@ -1,6 +1,6 @@
 import type { BitcoinConnection } from '@did-btcr2/bitcoin';
-import type { KeyBytes } from '@did-btcr2/common';
 import type { SignedBTCR2Update } from '@did-btcr2/cryptosuite';
+import type { Signer } from '@did-btcr2/keypair';
 import type { BeaconProcessResult } from '../resolver.js';
 import type { SidecarData } from '../types.js';
 import type { BroadcastOptions } from './beacon.js';
@@ -56,13 +56,13 @@ export declare class CASBeacon extends Beacon {
      * and broadcast are delegated to {@link Beacon.buildSignAndBroadcast}.
      *
      * @param {SignedBTCR2Update} signedUpdate The signed BTCR2 update to broadcast.
-     * @param {KeyBytes} secretKey The secret key for signing the Bitcoin transaction.
+     * @param {Signer} signer Signer that produces the ECDSA signature for the Bitcoin transaction.
      * @param {BitcoinConnection} bitcoin The Bitcoin network connection.
      * @param {CASBroadcastOptions} [options] Optional broadcast configuration, including a
      *   `casPublish` callback to publish the announcement off-chain and a `feeEstimator`.
      * @returns {Promise<SignedBTCR2Update>} The signed update that was broadcast.
      * @throws {BeaconError} if the bitcoin address is invalid, unfunded, or UTXO cannot cover the fee.
      */
-    broadcastSignal(signedUpdate: SignedBTCR2Update, secretKey: KeyBytes, bitcoin: BitcoinConnection, options?: CASBroadcastOptions): Promise<SignedBTCR2Update>;
+    broadcastSignal(signedUpdate: SignedBTCR2Update, signer: Signer, bitcoin: BitcoinConnection, options?: CASBroadcastOptions): Promise<SignedBTCR2Update>;
 }
 //# sourceMappingURL=cas-beacon.d.ts.map

package/dist/types/core/beacon/cas-beacon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cas-beacon.d.ts","sourceRoot":"","sources":["../../../../src/core/beacon/cas-beacon.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAY,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAiB,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEhG;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,UAAU,CAAC,EAAE,YAAY,CAAC;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,SAAU,SAAQ,MAAM;IACnC;;;OAGG;gBACS,OAAO,EAAE,aAAa;IAIlC;;;;;;;;;;;;OAYG;IACH,cAAc,CACZ,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,EAC5B,OAAO,EAAE,WAAW,GACnB,mBAAmB;IAsDtB;;;;;;;;;;;;;;;OAeG;IACG,eAAe,CACnB,YAAY,EAAE,iBAAiB,EAC/B,SAAS,EAAE,QAAQ,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,iBAAiB,CAAC;CAuB9B"}
+{"version":3,"file":"cas-beacon.d.ts","sourceRoot":"","sources":["../../../../src/core/beacon/cas-beacon.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAY,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAiB,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEhG;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,UAAU,CAAC,EAAE,YAAY,CAAC;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,SAAU,SAAQ,MAAM;IACnC;;;OAGG;gBACS,OAAO,EAAE,aAAa;IAIlC;;;;;;;;;;;;OAYG;IACH,cAAc,CACZ,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,EAC5B,OAAO,EAAE,WAAW,GACnB,mBAAmB;IAsDtB;;;;;;;;;;;;;;;OAeG;IACG,eAAe,CACnB,YAAY,EAAE,iBAAiB,EAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,iBAAiB,CAAC;CAuB9B"}

package/dist/types/core/beacon/singleton-beacon.d.ts

@@ -1,6 +1,6 @@
 import type { BitcoinConnection } from '@did-btcr2/bitcoin';
-import type { KeyBytes } from '@did-btcr2/common';
 import type { SignedBTCR2Update } from '@did-btcr2/cryptosuite';
+import type { Signer } from '@did-btcr2/keypair';
 import type { BeaconProcessResult } from '../resolver.js';
 import type { SidecarData } from '../types.js';
 import type { BroadcastOptions } from './beacon.js';
@@ -33,12 +33,12 @@ export declare class SingletonBeacon extends Beacon {
      * {@link Beacon.buildSignAndBroadcast}.
      *
      * @param {SignedBTCR2Update} signedUpdate The signed BTCR2 update to broadcast.
-     * @param {KeyBytes} secretKey The secret key for signing the Bitcoin transaction.
+     * @param {Signer} signer Signer that produces the ECDSA signature for the Bitcoin transaction.
      * @param {BitcoinConnection} bitcoin The Bitcoin network connection.
      * @param {BroadcastOptions} [options] Optional broadcast configuration (e.g. fee estimator).
      * @returns {Promise<SignedBTCR2Update>} The signed update that was broadcast.
      * @throws {BeaconError} if the bitcoin address is invalid, unfunded, or UTXO cannot cover the fee.
      */
-    broadcastSignal(signedUpdate: SignedBTCR2Update, secretKey: KeyBytes, bitcoin: BitcoinConnection, options?: BroadcastOptions): Promise<SignedBTCR2Update>;
+    broadcastSignal(signedUpdate: SignedBTCR2Update, signer: Signer, bitcoin: BitcoinConnection, options?: BroadcastOptions): Promise<SignedBTCR2Update>;
 }
 //# sourceMappingURL=singleton-beacon.d.ts.map

package/dist/types/core/beacon/singleton-beacon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"singleton-beacon.d.ts","sourceRoot":"","sources":["../../../../src/core/beacon/singleton-beacon.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAY,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAiB,MAAM,iBAAiB,CAAC;AAElF;;;;;GAKG;AACH,qBAAa,eAAgB,SAAQ,MAAM;IAEzC;;;OAGG;gBACS,OAAO,EAAE,aAAa;IAIlC;;;;;OAKG;IACH,cAAc,CACZ,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,EAC5B,OAAO,EAAE,WAAW,GACnB,mBAAmB;IA0BtB;;;;;;;;;;;;;OAaG;IACG,eAAe,CACnB,YAAY,EAAE,iBAAiB,EAC/B,SAAS,EAAE,QAAQ,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,iBAAiB,CAAC;CAK9B"}
+{"version":3,"file":"singleton-beacon.d.ts","sourceRoot":"","sources":["../../../../src/core/beacon/singleton-beacon.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAY,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAiB,MAAM,iBAAiB,CAAC;AAElF;;;;;GAKG;AACH,qBAAa,eAAgB,SAAQ,MAAM;IAEzC;;;OAGG;gBACS,OAAO,EAAE,aAAa;IAIlC;;;;;OAKG;IACH,cAAc,CACZ,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,EAC5B,OAAO,EAAE,WAAW,GACnB,mBAAmB;IA0BtB;;;;;;;;;;;;;OAaG;IACG,eAAe,CACnB,YAAY,EAAE,iBAAiB,EAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,iBAAiB,CAAC;CAK9B"}

package/dist/types/core/beacon/smt-beacon.d.ts

@@ -1,6 +1,6 @@
 import type { BitcoinConnection } from '@did-btcr2/bitcoin';
-import type { KeyBytes } from '@did-btcr2/common';
 import type { SignedBTCR2Update } from '@did-btcr2/cryptosuite';
+import type { Signer } from '@did-btcr2/keypair';
 import type { BeaconProcessResult } from '../resolver.js';
 import type { SidecarData } from '../types.js';
 import type { BroadcastOptions } from './beacon.js';
@@ -47,12 +47,12 @@ export declare class SMTBeacon extends Beacon {
      * signing, and broadcast are delegated to {@link Beacon.buildSignAndBroadcast}.
      *
      * @param {SignedBTCR2Update} signedUpdate The signed BTCR2 update to broadcast.
-     * @param {KeyBytes} secretKey The secret key for signing the Bitcoin transaction.
+     * @param {Signer} signer Signer that produces the ECDSA signature for the Bitcoin transaction.
      * @param {BitcoinConnection} bitcoin The Bitcoin network connection.
      * @param {BroadcastOptions} [options] Optional broadcast configuration (e.g. fee estimator).
      * @return {Promise<SignedBTCR2Update>} The signed update that was broadcast.
      * @throws {BeaconError} if the bitcoin address is invalid, unfunded, or UTXO cannot cover the fee.
      */
-    broadcastSignal(signedUpdate: SignedBTCR2Update, secretKey: KeyBytes, bitcoin: BitcoinConnection, options?: BroadcastOptions): Promise<SignedBTCR2Update>;
+    broadcastSignal(signedUpdate: SignedBTCR2Update, signer: Signer, bitcoin: BitcoinConnection, options?: BroadcastOptions): Promise<SignedBTCR2Update>;
 }
 //# sourceMappingURL=smt-beacon.d.ts.map

package/dist/types/core/beacon/smt-beacon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"smt-beacon.d.ts","sourceRoot":"","sources":["../../../../src/core/beacon/smt-beacon.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAGhE,OAAO,KAAK,EAAE,mBAAmB,EAAY,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAiB,MAAM,iBAAiB,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,qBAAa,SAAU,SAAQ,MAAM;IACnC;;;OAGG;gBACS,OAAO,EAAE,aAAa;IAIlC;;;;;;;;;;;;OAYG;IACH,cAAc,CACZ,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,EAC5B,OAAO,EAAE,WAAW,GACnB,mBAAmB;IAiEtB;;;;;;;;;;;;;;OAcG;IACG,eAAe,CACnB,YAAY,EAAE,iBAAiB,EAC/B,SAAS,EAAE,QAAQ,EACnB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,iBAAiB,CAAC;CAgB9B"}
+{"version":3,"file":"smt-beacon.d.ts","sourceRoot":"","sources":["../../../../src/core/beacon/smt-beacon.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAGjD,OAAO,KAAK,EAAE,mBAAmB,EAAY,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAiB,MAAM,iBAAiB,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,qBAAa,SAAU,SAAQ,MAAM;IACnC;;;OAGG;gBACS,OAAO,EAAE,aAAa;IAIlC;;;;;;;;;;;;OAYG;IACH,cAAc,CACZ,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,EAC5B,OAAO,EAAE,WAAW,GACnB,mBAAmB;IAiEtB;;;;;;;;;;;;;;OAcG;IACG,eAAe,CACnB,YAAY,EAAE,iBAAiB,EAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,iBAAiB,CAAC;CAgB9B"}