@did-btcr2/method 0.36.0 → 0.37.0

package/dist/types/core/beacon/beacon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"beacon.d.ts","sourceRoot":"","sources":["../../../../src/core/beacon/beacon.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAA4D,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC1G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAKnE;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAInF,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,GAClB,mBAAmB,CAWrB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,UAAU,GAClB,MAAM,CAKR;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kGAAkG;IAClG,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,EAAE,EAAE,WAAW,CAAC;IAChB,6EAA6E;IAC7E,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,uDAAuD;IACvD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,oEAAoE;IACpE,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,mBAAmB,CAAC;CACjC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,UAAU,GAAG,UAAU,CAElE;AA4BD;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,cAAc,EAAE,UAAU,CAAC;IAC3B,8DAA8D;IAC9D,WAAW,EAAE,UAAU,CAAC;IACxB,yDAAyD;IACzD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,iEAAiE;IACjE,OAAO,EAAE,UAAU,CAAC;IACpB,qDAAqD;IACrD,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B,GAAG,OAAO,CAAC,YAAY,CAAC,CAwCxB;AAkFD;;;;;;;;;;;;;;;;GAgBG;AACH,8BAAsB,iBAAiB;IACrC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;gBAEpB,OAAO,EAAE,aAAa;IAIlC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CACrB,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,EAC5B,OAAO,EAAE,WAAW,GACnB,mBAAmB;IAEtB;;;;;;;;;OASG;IACH,QAAQ,CAAC,eAAe,CACtB,YAAY,EAAE,iBAAiB,EAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,iBAAiB,CAAC;IAE7B;;;;;;;;;;;;;;;;;OAiBG;cACa,qBAAqB,CACnC,WAAW,EAAE,UAAU,EACvB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC;IAWlB;;;;;;;;;OASG;cACa,kBAAkB,CAAC,IAAI,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,WAAW,CAAC;QAClB,WAAW,EAAE,UAAU,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,iBAAiB,CAAC;QAC3B,YAAY,EAAE,YAAY,CAAC;KAC5B,GAAG,OAAO,CAAC,YAAY,CAAC;IA0EzB;;;OAGG;cACa,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOtF;;OAEG;cACa,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAG5F"}
+{"version":3,"file":"beacon.d.ts","sourceRoot":"","sources":["../../../../src/core/beacon/beacon.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAA4D,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC1G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAKnE;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAInF,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,GAClB,mBAAmB,CAWrB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,UAAU,GAClB,MAAM,CAKR;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kGAAkG;IAClG,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,EAAE,EAAE,WAAW,CAAC;IAChB,6EAA6E;IAC7E,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,uDAAuD;IACvD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,oEAAoE;IACpE,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,mBAAmB,CAAC;CACjC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,UAAU,GAAG,UAAU,CAElE;AA4BD;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,cAAc,EAAE,UAAU,CAAC;IAC3B,8DAA8D;IAC9D,WAAW,EAAE,UAAU,CAAC;IACxB,yDAAyD;IACzD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,iEAAiE;IACjE,OAAO,EAAE,UAAU,CAAC;IACpB,qDAAqD;IACrD,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B,GAAG,OAAO,CAAC,YAAY,CAAC,CA6CxB;AAkFD;;;;;;;;;;;;;;;;GAgBG;AACH,8BAAsB,iBAAiB;IACrC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;gBAEpB,OAAO,EAAE,aAAa;IAIlC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CACrB,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,EAC5B,OAAO,EAAE,WAAW,GACnB,mBAAmB;IAEtB;;;;;;;;;OASG;IACH,QAAQ,CAAC,eAAe,CACtB,YAAY,EAAE,iBAAiB,EAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,iBAAiB,CAAC;IAE7B;;;;;;;;;;;;;;;;;OAiBG;cACa,qBAAqB,CACnC,WAAW,EAAE,UAAU,EACvB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC;IAWlB;;;;;;;;;OASG;cACa,kBAAkB,CAAC,IAAI,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,WAAW,CAAC;QAClB,WAAW,EAAE,UAAU,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,iBAAiB,CAAC;QAC3B,YAAY,EAAE,YAAY,CAAC;KAC5B,GAAG,OAAO,CAAC,YAAY,CAAC;IA0EzB;;;OAGG;cACa,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOtF;;OAEG;cACa,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAG5F"}

package/dist/types/core/beacon/cas-beacon.d.ts

@@ -7,7 +7,7 @@ import type { BroadcastOptions } from './beacon.js';
 import { SinglePartyBeacon } from './beacon.js';
 import type { BeaconService, BeaconSignal, CasPublishFn } from './interfaces.js';
 /**
- * CAS-specific broadcast options — extends {@link BroadcastOptions} with an optional
+ * CAS-specific broadcast options: extends {@link BroadcastOptions} with an optional
  * `casPublish` callback used to publish the CAS Announcement off-chain after the
  * OP_RETURN signal is broadcast.
  */
@@ -18,7 +18,7 @@ export interface CASBroadcastOptions extends BroadcastOptions {
  * Implements {@link https://dcdpr.github.io/did-btcr2/terminology.html#cas-beacon | CAS Beacon}.
  *
  * A CAS (Content-Addressed Store) Beacon aggregates updates for multiple DIDs
- * into a single CAS Announcement — a mapping of DIDs to their update hashes.
+ * into a single CAS Announcement: a mapping of DIDs to their update hashes.
  * The hash of the CAS Announcement is broadcast on-chain via OP_RETURN.
  * During resolution, the CAS Announcement is retrieved from the sidecar (or CAS)
  * and used to look up the individual signed update for the DID being resolved.

package/dist/types/core/beacon/interfaces.d.ts

@@ -62,7 +62,7 @@ export interface BeaconSignal {
  * The method package defines this type; the api layer provides the implementation
  * (e.g., via CasApi.publish backed by IPFS/Helia).
  *
- * @param announcement The CAS Announcement object (DID → update hash mapping).
+ * @param announcement The CAS Announcement object (DID to update hash mapping).
  */
 export type CasPublishFn = (announcement: Record<string, string>) => Promise<void>;
 //# sourceMappingURL=interfaces.d.ts.map

package/dist/types/core/resolver.d.ts

@@ -99,7 +99,7 @@ export interface BeaconProcessResult {
 export declare class Resolver {
     #private;
     /**
-     * @internal — Use {@link DidBtcr2.resolve} to create instances.
+     * @internal Use {@link DidBtcr2.resolve} to create instances.
      */
     constructor(didComponents: DidComponents, sidecarData: SidecarData, currentDocument: DidDocument | null, options?: {
         versionId?: string;
@@ -153,8 +153,8 @@ export declare class Resolver {
     private static applyUpdate;
     /**
      * Advance the state machine. Returns either:
-     * - `{ status: 'action-required', needs }` — caller must provide data via {@link provide}
-     * - `{ status: 'resolved', result }` — resolution complete
+     * - `{ status: 'action-required', needs }` - caller must provide data via {@link provide}
+     * - `{ status: 'resolved', result }` - resolution complete
      *
      * Analogous to Rust's `Resolver::resolve()`.
      */

package/dist/types/core/updater.d.ts

@@ -93,7 +93,7 @@ export interface UpdaterParams {
     beaconService: BeaconService;
 }
 /**
- * Sans-I/O state machine for did:btcr2 updates — the counterpart to {@link Resolver}.
+ * Sans-I/O state machine for did:btcr2 updates: the counterpart to {@link Resolver}.
  *
  * Created by {@link DidBtcr2.update} (the factory). The caller drives the update by
  * repeatedly calling {@link advance} and {@link provide}:
@@ -139,7 +139,7 @@ export interface UpdaterParams {
 export declare class Updater {
     #private;
     /**
-     * @internal — Use {@link DidBtcr2.update} to create instances.
+     * @internal Use {@link DidBtcr2.update} to create instances.
      */
     constructor(params: UpdaterParams);
     /**
@@ -175,8 +175,8 @@ export declare class Updater {
     static announce(beaconService: BeaconService, update: SignedBTCR2Update, signer: Signer, bitcoin: BitcoinConnection): Promise<SignedBTCR2Update>;
     /**
      * Advance the state machine. Returns either:
-     * - `{ status: 'action-required', needs }` — caller must provide data via {@link provide}
-     * - `{ status: 'complete', result }` — update is signed and broadcast
+     * - `{ status: 'action-required', needs }` caller must provide data via {@link provide}
+     * - `{ status: 'complete', result }` update is signed and broadcast
      */
     advance(): UpdaterState;
     /**

package/dist/types/did-btcr2.d.ts

@@ -74,8 +74,8 @@ export declare class DidBtcr2 implements DidMethod {
      *
      * Factory method that validates the update parameters and returns a sans-I/O
      * {@link Updater} state machine. The caller drives the updater through its
-     * phases (Construct → Sign → Broadcast → Complete) by calling `advance()` and
-     * `provide()`. The method package performs **zero I/O** — signing key retrieval
+     * phases (Construct -> Sign -> Broadcast -> Complete) by calling `advance()` and
+     * `provide()`. The method package performs **zero I/O**: signing key retrieval
      * (or KMS delegation) and the on-chain broadcast are the caller's responsibility.
      *
      * For a fully-wired version with Bitcoin broadcast and key handling, see

package/dist/types/index.d.ts

@@ -2,6 +2,9 @@ export * from './core/aggregation/service.js';
 export * from './core/aggregation/participant.js';
 export * from './core/aggregation/signer.js';
 export * from './core/aggregation/conditions.js';
+export * from './core/aggregation/recovery-policy.js';
+export * from './core/aggregation/recovery-spend.js';
+export * from './core/aggregation/fallback-spend.js';
 export * from './core/aggregation/cohort.js';
 export * from './core/aggregation/signing-session.js';
 export * from './core/aggregation/phases.js';

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kCAAkC,CAAC;AACjD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uCAAuC,CAAC;AACtD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uCAAuC,CAAC;AACtD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AAGnD,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mCAAmC,CAAC;AAClD,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AAGvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iCAAiC,CAAC;AAChD,cAAc,yBAAyB,CAAC;AAGxC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,sCAAsC,CAAC;AACrD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uCAAuC,CAAC;AACtD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uCAAuC,CAAC;AACtD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AAGnD,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mCAAmC,CAAC;AAClD,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AAGvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iCAAiC,CAAC;AAChD,cAAc,yBAAyB,CAAC;AAGxC,cAAc,gBAAgB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@did-btcr2/method",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "type": "module",
   "description": "Reference implementation for the did:btcr2 DID method written in TypeScript and JavaScript. did:btcr2 is a censorship resistant DID Method using the Bitcoin blockchain as a Verifiable Data Registry to announce changes to the DID document. This is the core method implementation for the did-btcr2-js monorepo.",
   "main": "./dist/cjs/index.js",
@@ -80,11 +80,11 @@
     "helia": "^5.5.1",
     "multiformats": "^13.4.2",
     "nostr-tools": "^2.23.3",
-    "@did-btcr2/smt": "^0.3.0",
+    "@did-btcr2/bitcoin": "^0.6.0",
     "@did-btcr2/common": "^9.1.0",
-    "@did-btcr2/keypair": "^0.13.1",
+    "@did-btcr2/smt": "^0.3.0",
     "@did-btcr2/cryptosuite": "^8.0.0",
-    "@did-btcr2/bitcoin": "^0.6.0"
+    "@did-btcr2/keypair": "^0.13.1"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.4",

package/src/core/aggregation/beacon-strategy.ts

@@ -43,13 +43,17 @@ export interface AggregateBeaconStrategy {
 
   /**
    * Participant: verify the aggregated data they received reflects their own
-   * submitted update. Pure function — returns matches + sidecar fields for
-   * the caller to store.
+   * slot. A submitter (`included: true`) checks its update is included; a
+   * decliner (`included: false`, cooperative non-inclusion) checks its
+   * non-inclusion slot instead (absence from the CAS map, or an SMT
+   * non-inclusion proof). `submittedUpdate`/`expectedHash` are present only for a
+   * submitter. Pure function: returns matches + sidecar fields for the caller.
    */
   validateParticipantView(params: {
     participantDid: string;
-    submittedUpdate: SignedBTCR2Update;
-    expectedHash: string;
+    included: boolean;
+    submittedUpdate?: SignedBTCR2Update;
+    expectedHash?: string;
     body: BaseBody;
   }): BeaconValidationResult;
 }
@@ -65,9 +69,13 @@ const CAS_STRATEGY: AggregateBeaconStrategy = {
     return { casAnnouncement: cohort.casAnnouncement };
   },
 
-  validateParticipantView({ participantDid, expectedHash, body }) {
+  validateParticipantView({ participantDid, included, expectedHash, body }) {
     const casAnnouncement = body.casAnnouncement;
     if(!casAnnouncement) return { matches: false };
+    if(!included) {
+      // Cooperative non-inclusion: the decliner must be ABSENT from the map.
+      return { matches: !(participantDid in casAnnouncement), casAnnouncement };
+    }
     return {
       matches : casAnnouncement[participantDid] === expectedHash,
       casAnnouncement,
@@ -87,9 +95,20 @@ const SMT_STRATEGY: AggregateBeaconStrategy = {
     return { smtProof: proof as unknown as Record<string, unknown> | undefined };
   },
 
-  validateParticipantView({ participantDid, submittedUpdate, body }) {
+  validateParticipantView({ participantDid, included, submittedUpdate, body }) {
     const smtProof = body.smtProof as unknown as SerializedSMTProof | undefined;
-    if(!smtProof?.updateId || !smtProof?.nonce) return { matches: false };
+    const index = didToIndex(participantDid);
+
+    if(!included) {
+      // Cooperative non-inclusion: the proof has a nonce but no updateId by
+      // construction. The leaf is SHA-256(SHA-256(nonce)); do NOT run the
+      // inclusion-only updateId guard (a missing updateId is correct here).
+      if(!smtProof?.nonce || smtProof?.updateId) return { matches: false, smtProof };
+      const candidateHash = blockHash(blockHash(base64UrlToHash(smtProof.nonce)));
+      return { matches: verifySerializedProof(smtProof, index, candidateHash), smtProof };
+    }
+
+    if(!smtProof?.updateId || !smtProof?.nonce || !submittedUpdate) return { matches: false, smtProof };
     // Verify updateId matches the canonicalized update hash. Proof hash fields
     // are base64url (no padding) per the SMT Proof spec.
     const canonicalBytes = new TextEncoder().encode(canonicalize(submittedUpdate as unknown as Record<string, unknown>));
@@ -97,8 +116,7 @@ const SMT_STRATEGY: AggregateBeaconStrategy = {
     if(smtProof.updateId !== expectedUpdateId) {
       return { matches: false, smtProof };
     }
-    // Verify Merkle inclusion
-    const index = didToIndex(participantDid);
+    // Verify Merkle inclusion. The leaf is SHA-256(SHA-256(nonce) || SHA-256(update)).
     const candidateHash = blockHash(blockHash(base64UrlToHash(smtProof.nonce)), base64UrlToHash(smtProof.updateId));
     return {
       matches : verifySerializedProof(smtProof, index, candidateHash),

package/src/core/aggregation/cohort.ts

@@ -4,11 +4,13 @@ import type { SignedBTCR2Update } from '@did-btcr2/cryptosuite';
 import type { SerializedSMTProof, TreeEntry } from '@did-btcr2/smt';
 import { BTCR2MerkleTree } from '@did-btcr2/smt';
 import { schnorr } from '@noble/curves/secp256k1.js';
-import { hexToBytes, randomBytes } from '@noble/hashes/utils';
+import { concatBytes, hexToBytes, randomBytes } from '@noble/hashes/utils';
 import { p2tr } from '@scure/btc-signer';
 import { keyAggExport, keyAggregate, sortKeys } from '@scure/btc-signer/musig2';
 import type { CASAnnouncement } from '../types.js';
 import { AggregationCohortError } from './errors.js';
+import type { FundingModel } from './recovery-policy.js';
+import { DEFAULT_FUNDING_MODEL, buildRecoveryLeaves, resolveFallbackThreshold } from './recovery-policy.js';
 
 export type AggregationCohortParams = {
   id?: string;
@@ -16,14 +18,22 @@ export type AggregationCohortParams = {
   minParticipants?: number;
   network: string;
   beaconType?: string;
+  /** Operator recovery key, x-only (32 bytes). Required to compute the beacon address. */
+  recoveryKey?: Uint8Array;
+  /** Relative-timelock (BIP-68 nSequence) before recovery is spendable. Required to compute the beacon address. */
+  recoverySequence?: number;
+  /** Funding model governing the recovery leaves. Defaults to 'operator-funded'. */
+  fundingModel?: FundingModel;
+  /** Advertised k of the k-of-n fallback leaf. Absent defaults to n-1 at address computation. */
+  fallbackThreshold?: number;
 };
 
 /**
- * Represents an Aggregation Cohort — a set of Aggregation Participants who
+ * Represents an Aggregation Cohort: a set of Aggregation Participants who
  * submitted cryptographic material to an Aggregation Service to coordinate
  * signing of a shared n-of-n MuSig2 Bitcoin transaction.
  *
- * This is a pure data class — it holds cohort state and provides computation
+ * This is a pure data class: it holds cohort state and provides computation
  * helpers (key aggregation, CAS Announcement building, SMT tree building).
  * It performs no I/O and emits no messages. Both AggregationService and
  * AggregationParticipant create their own AggregationCohort instances to
@@ -51,8 +61,8 @@ export class AggregationCohort {
   participants: Array<string> = [];
 
   /**
-   * Mapping from participant DID → their compressed secp256k1 public key.
-   * Distinct from {@link cohortKeys} (which is sorted per BIP-327) — this lets
+   * Mapping from participant DID to their compressed secp256k1 public key.
+   * Distinct from {@link cohortKeys} (which is sorted per BIP-327): this lets
    * callers look up a participant's key without knowing their position in the
    * sorted array. Populated by the service at `acceptParticipant` time.
    */
@@ -62,19 +72,51 @@ export class AggregationCohort {
   #cohortKeys: Array<Uint8Array> = [];
 
   /**
-   * BIP-341 TapTweak — `taggedHash("TapTweak", internalPubkey)` for a key-path-only
-   * Taproot output. Despite prior naming, this is NOT a Merkle root: key-path-only
-   * spends have no script tree.
+   * BIP-341 TapTweak scalar: `taggedHash("TapTweak", internalPubkey || tapMerkleRoot)`.
+   * The beacon output is an internal key (the MuSig2 aggregate) plus a script
+   * tree (the recovery leaves), so the tweak commits to the tree's Merkle root.
+   * The MuSig2 signing session applies this as an x-only tweak; a value that does
+   * not match the root the funded address was derived from silently yields an
+   * invalid key-path signature.
    */
   tapTweak: Uint8Array = new Uint8Array();
 
-  /** The n-of-n MuSig2 Taproot beacon address. */
+  /** The n-of-n MuSig2 aggregate internal key, x-only (32 bytes), set by computeBeaconAddress(). */
+  internalKey: Uint8Array = new Uint8Array();
+
+  /** BIP-341 Taproot Merkle root of the recovery script tree, set by computeBeaconAddress(). */
+  tapMerkleRoot: Uint8Array = new Uint8Array();
+
+  /** Operator recovery key, x-only (32 bytes). Used to build the CSV recovery leaf. */
+  recoveryKey?: Uint8Array;
+
+  /** Relative-timelock (BIP-68 nSequence) before the recovery leaf is spendable. */
+  recoverySequence?: number;
+
+  /** Funding model governing the recovery leaves (default 'operator-funded'). */
+  fundingModel: FundingModel;
+
+  /**
+   * Advertised k of the k-of-n fallback leaf, or undefined to default to n-1 at
+   * address computation. Read the resolved value via {@link effectiveFallbackThreshold}.
+   */
+  fallbackThreshold?: number;
+
+  /** The Taproot beacon address: key path is the MuSig2 aggregate, script path is fallback + recovery. */
   beaconAddress: string = '';
 
   /** Pending DID updates submitted by participants, keyed by DID. */
   pendingUpdates: Map<string, SignedBTCR2Update> = new Map();
 
-  /** CAS Beacon Announcement Map (DID → updateHash), set by buildCASAnnouncement(). */
+  /**
+   * Participant DIDs that explicitly declined to submit an update this round
+   * (cooperative non-inclusion). A decliner is absent from the CAS Announcement
+   * Map and carries a non-inclusion leaf in the SMT, yet still signs. Kept
+   * disjoint from {@link pendingUpdates} so CAS correctness holds by construction.
+   */
+  nonIncluded: Set<string> = new Set();
+
+  /** CAS Beacon Announcement Map (DID to updateHash), set by buildCASAnnouncement(). */
   casAnnouncement?: CASAnnouncement;
 
   /** Per-participant SMT proofs, set by buildSMTTree(). */
@@ -89,7 +131,7 @@ export class AggregationCohort {
   /** Set of participant DIDs that have rejected the aggregated data. */
   validationRejections: Set<string> = new Set();
 
-  constructor({ id, minParticipants, serviceDid, network, beaconType }: AggregationCohortParams) {
+  constructor({ id, minParticipants, serviceDid, network, beaconType, recoveryKey, recoverySequence, fundingModel, fallbackThreshold }: AggregationCohortParams) {
     this.id = id || crypto.randomUUID();
     // `?? 2` (not `|| 2`) so a deliberately-passed 0 is preserved rather than
     // silently coerced; the service rejects an invalid count at createCohort.
@@ -97,6 +139,10 @@ export class AggregationCohort {
     this.serviceDid = serviceDid || '';
     this.network = network;
     this.beaconType = beaconType || 'CASBeacon';
+    this.recoveryKey = recoveryKey;
+    this.recoverySequence = recoverySequence;
+    this.fundingModel = fundingModel ?? DEFAULT_FUNDING_MODEL;
+    this.fallbackThreshold = fallbackThreshold;
   }
 
   /** Sorted cohort keys (sorted on assignment per BIP-327). */
@@ -109,8 +155,27 @@ export class AggregationCohort {
   }
 
   /**
-   * Computes the n-of-n MuSig2 Taproot beacon address from cohort keys.
-   * Sets `tapTweak` to the BIP-341 key-path-only tweak.
+   * The resolved k of the k-of-n fallback leaf: the advertised
+   * {@link fallbackThreshold}, or n-1 (floored at 1) when unadvertised, where n is
+   * the current cohort size. This is the value the beacon address commits to and
+   * the spend builders must reproduce. Returns 0 before any cohort keys are set.
+   */
+  public get effectiveFallbackThreshold(): number {
+    if(this.#cohortKeys.length === 0) return 0;
+    return resolveFallbackThreshold(this.fallbackThreshold, this.#cohortKeys.length);
+  }
+
+  /**
+   * Computes the Taproot beacon address from the cohort keys and recovery params.
+   *
+   * The output's key path is the n-of-n MuSig2 aggregate of the cohort keys; its
+   * script path is the recovery tree (a CSV recovery leaf so a missing signer
+   * cannot permanently lock the UTXO). Sets `internalKey`, `tapMerkleRoot`, and
+   * the `tapTweak` the MuSig2 session must apply for the key-path spend.
+   *
+   * The tweak is derived from the Merkle root the address was built with (read
+   * back from the payment), never recomputed by hand, so the MuSig2 key-path
+   * signature is guaranteed to validate against the funded address.
    */
   public computeBeaconAddress(): string {
     if(this.#cohortKeys.length === 0) {
@@ -119,16 +184,39 @@ export class AggregationCohort {
         'NO_COHORT_KEYS', { cohortId: this.id }
       );
     }
+    if(!this.recoveryKey || this.recoveryKey.length === 0 || this.recoverySequence === undefined) {
+      throw new AggregationCohortError(
+        'Cannot compute beacon address: missing recovery key or sequence.',
+        'NO_RECOVERY_PARAMS', { cohortId: this.id }
+      );
+    }
     const keyAggContext = keyAggregate(this.#cohortKeys);
     const aggPubkey = keyAggExport(keyAggContext);
-    // Derive the address for the cohort's network. Without the network arg
-    // p2tr defaults to mainnet, so a mutinynet/signet/regtest cohort would
-    // otherwise advertise a `bc1p...` address that no participant can fund.
-    const payment = p2tr(aggPubkey, undefined, getNetwork(this.network));
 
-    // BIP-341: key-path-only P2TR has no script tree. Compute the tweak:
-    // taggedHash("TapTweak", internalPubkey).
-    this.tapTweak = schnorr.utils.taggedHash('TapTweak', aggPubkey);
+    // The beacon output commits to the script tree (k-of-n fallback leaf + CSV
+    // recovery leaf) alongside the MuSig2 internal key. Derive the address for
+    // the cohort's network. Without the network arg p2tr defaults to mainnet, so
+    // a mutinynet/signet/regtest cohort would otherwise advertise a `bc1p...`
+    // address that no participant can fund.
+    const leaves = buildRecoveryLeaves(this.fundingModel, {
+      recoveryKey       : this.recoveryKey,
+      recoverySequence  : this.recoverySequence,
+      cohortKeys        : this.#cohortKeys,
+      fallbackThreshold : resolveFallbackThreshold(this.fallbackThreshold, this.#cohortKeys.length),
+    });
+    // allowUnknownOutputs: the CSV recovery leaf is a custom script, not one of
+    // p2tr's recognized templates (tr_ns/tr_ms), so the template check must be
+    // waived. The leaf hash (and thus the address) is computed from the raw
+    // script bytes regardless.
+    const payment = p2tr(aggPubkey, leaves, getNetwork(this.network), true);
+
+    // BIP-341: the key-path tweak commits to the script tree's Merkle root.
+    // taggedHash("TapTweak", internalPubkey || tapMerkleRoot). Use the root the
+    // library committed to (payment.tapMerkleRoot) so the tweak matches the
+    // funded address byte-for-byte.
+    this.internalKey = aggPubkey;
+    this.tapMerkleRoot = payment.tapMerkleRoot;
+    this.tapTweak = schnorr.utils.taggedHash('TapTweak', concatBytes(aggPubkey, payment.tapMerkleRoot));
 
     if(!payment.address) {
       throw new AggregationCohortError(
@@ -189,20 +277,56 @@ export class AggregationCohort {
     this.pendingUpdates.set(participantDid, signedUpdate);
   }
 
+  /**
+   * Record that a participant declined to submit an update this round
+   * (cooperative non-inclusion). The member stays in the cohort and still signs.
+   */
+  public addNonInclusion(participantDid: string): void {
+    if(!this.participants.includes(participantDid)) {
+      throw new AggregationCohortError(
+        `Participant ${participantDid} is not in cohort ${this.id}.`,
+        'UNKNOWN_PARTICIPANT', { cohortId: this.id, participantDid }
+      );
+    }
+    // A DID cannot both submit and decline. The service guards re-submission, but
+    // keep the invariant local so the response gate and builders stay consistent.
+    if(this.pendingUpdates.has(participantDid)) {
+      throw new AggregationCohortError(
+        `Participant ${participantDid} already submitted an update; cannot also decline.`,
+        'CONFLICTING_RESPONSE', { cohortId: this.id, participantDid }
+      );
+    }
+    this.nonIncluded.add(participantDid);
+  }
+
   public hasAllUpdates(): boolean {
     return this.pendingUpdates.size === this.participants.length;
   }
 
+  /**
+   * True when every participant has responded for this round, either with an
+   * update or with an explicit non-inclusion. This is the aggregation gate when
+   * non-inclusion is in play; it generalizes {@link hasAllUpdates} the same way
+   * {@link hasAllValidationResponses} generalizes a unanimous ack.
+   */
+  public hasAllResponses(): boolean {
+    return this.pendingUpdates.size + this.nonIncluded.size === this.participants.length;
+  }
+
   /**
    * Builds a CAS Announcement Map from collected updates.
-   * Maps each participant DID → base64url canonical hash of their signed update.
+   * Maps each participant DID to base64url canonical hash of their signed update.
    * Computes signal bytes as SHA-256 of canonicalized announcement.
+   *
+   * Members who declined (cooperative non-inclusion) are naturally absent from
+   * the map: the body iterates {@link pendingUpdates}, which never holds a
+   * decliner. Absence from the map is exactly the CAS non-inclusion signal.
    */
   public buildCASAnnouncement(): CASAnnouncement {
-    if(!this.hasAllUpdates()) {
+    if(!this.hasAllResponses()) {
       throw new AggregationCohortError(
-        'Cannot build CAS Announcement: not all updates collected.',
-        'INCOMPLETE_UPDATES', { cohortId: this.id, collected: this.pendingUpdates.size, total: this.participants.length }
+        'Cannot build CAS Announcement: not all participants have responded.',
+        'INCOMPLETE_RESPONSES', { cohortId: this.id, updates: this.pendingUpdates.size, declined: this.nonIncluded.size, total: this.participants.length }
       );
     }
     const announcement: CASAnnouncement = {};
@@ -215,25 +339,37 @@ export class AggregationCohort {
   }
 
   /**
-   * Builds an SMT tree from collected updates.
-   * Each entry uses a random 32-byte nonce + canonicalized signed update bytes.
-   * Stores per-participant proofs and the SMT root as signalBytes.
+   * Builds an SMT tree with one leaf per participant.
+   *
+   * A member who submitted an update gets an inclusion leaf
+   * (SHA-256(SHA-256(nonce) || SHA-256(update))); a member who declined gets a
+   * non-inclusion leaf (SHA-256(SHA-256(nonce)), the `signedUpdate` entry field
+   * omitted). The cohort mints each member's nonce and returns it inside that
+   * member's serialized proof, so a decliner can self-validate its own
+   * non-inclusion slot and the resolver can recompute the leaf. Stores
+   * per-participant proofs and the SMT root as signalBytes.
    */
   public buildSMTTree(): Map<string, SerializedSMTProof> {
-    if(!this.hasAllUpdates()) {
+    if(!this.hasAllResponses()) {
       throw new AggregationCohortError(
-        'Cannot build SMT tree: not all updates collected.',
-        'INCOMPLETE_UPDATES', { cohortId: this.id }
+        'Cannot build SMT tree: not all participants have responded.',
+        'INCOMPLETE_RESPONSES', { cohortId: this.id, updates: this.pendingUpdates.size, declined: this.nonIncluded.size, total: this.participants.length }
       );
     }
     const tree = new BTCR2MerkleTree();
     const entries: TreeEntry[] = [];
     const encoder = new TextEncoder();
 
-    for(const [did, signedUpdate] of this.pendingUpdates) {
-      const canonicalBytes = encoder.encode(canonicalize(signedUpdate));
+    // Slot every participant: an inclusion leaf for submitters, a non-inclusion
+    // leaf (signedUpdate omitted) for decliners.
+    for(const did of this.participants) {
       const nonce = randomBytes(32);
-      entries.push({ did, nonce, signedUpdate: canonicalBytes });
+      const signedUpdate = this.pendingUpdates.get(did);
+      if(signedUpdate) {
+        entries.push({ did, nonce, signedUpdate: encoder.encode(canonicalize(signedUpdate)) });
+      } else {
+        entries.push({ did, nonce });
+      }
     }
 
     tree.addEntries(entries);
@@ -241,7 +377,7 @@ export class AggregationCohort {
 
     this.signalBytes = tree.rootHash;
     this.smtProofs = new Map();
-    for(const [did] of this.pendingUpdates) {
+    for(const did of this.participants) {
       this.smtProofs.set(did, tree.proof(did));
     }
     return this.smtProofs;
@@ -269,7 +405,7 @@ export class AggregationCohort {
   }
 
   /**
-   * True when all participants approved. Note: differs from {@link hasAllValidationResponses} —
+   * True when all participants approved. Note: differs from {@link hasAllValidationResponses},
    * this returns false if any participant rejected, even if all responses are in.
    */
   public isFullyValidated(): boolean {

package/src/core/aggregation/conditions.ts

@@ -15,9 +15,15 @@
  * settlement (consistent with ADR 008).
  */
 
+import type { FundingModel } from './recovery-policy.js';
+import { MAX_RECOVERY_SEQUENCE } from './recovery-policy.js';
+
 /** Beacon types that support aggregation (singleton is single-party only, per ADR 037). */
 export const KNOWN_BEACON_TYPES = ['CASBeacon', 'SMTBeacon'] as const;
 
+/** Funding models an operator may advertise. Only 'operator-funded' is implemented (ADR 042). */
+export const KNOWN_FUNDING_MODELS = ['operator-funded', 'participant-funded'] as const;
+
 /**
  * An advertised price. `unit` is operator-defined (the spec does not specify a
  * currency); `basis` distinguishes a per-DID from a per-participant charge for
@@ -51,6 +57,31 @@ export interface CohortConditions {
   maxSecondsBetweenAnnouncements?: number;
   /** 7. Pending-update count that triggers an announcement. Advertised; enforcement staged (AGG-5) - generalizes hasAllUpdates(). */
   pendingUpdateTrigger?: number;
+  /**
+   * Who funds the beacon UTXO and holds the recovery path. Defaults to
+   * 'operator-funded' when absent. See ADR 042.
+   */
+  fundingModel?: FundingModel;
+  /**
+   * Operator recovery key, x-only (64-character hex / 32 bytes). The beacon
+   * output commits to a CSV recovery leaf keyed to this key, so a missing signer
+   * can never permanently lock the funded UTXO. Required (ADR 042).
+   */
+  recoveryKey: string;
+  /**
+   * Relative-timelock (BIP-68 nSequence, in blocks) before the recovery leaf is
+   * spendable. Required, >= 1 (ADR 042).
+   */
+  recoverySequence: number;
+  /**
+   * Number of signers (k) the k-of-n fallback leaf requires, so any k cohort
+   * members can still announce when the optimistic n-of-n key path stalls
+   * (graceful liveness, ADR 042). Optional: when absent it defaults to n-1 at
+   * keygen, where n is the finalized participant count. When advertised it must
+   * be an integer >= 1 (and <= maxParticipants when that is set); the upper bound
+   * against the actual cohort size n is enforced at keygen.
+   */
+  fallbackThreshold?: number;
 }
 
 /** Validate an optional [min, max] integer pair. */
@@ -109,8 +140,33 @@ export function validateCohortConditions(c: CohortConditions): string[] {
     problems.push('pendingUpdateTrigger must be an integer >= 1');
   }
 
+  // Fallback threshold (k of the k-of-n fallback leaf). Optional; when advertised
+  // it must be a positive integer and cannot exceed maxParticipants (the binding
+  // upper bound against the actual cohort size n is checked at keygen, where n is
+  // known). See ADR 042.
+  if(c.fallbackThreshold !== undefined) {
+    if(!Number.isInteger(c.fallbackThreshold) || c.fallbackThreshold < 1) {
+      problems.push('fallbackThreshold must be an integer >= 1');
+    } else if(c.maxParticipants !== undefined && Number.isInteger(c.maxParticipants) && c.fallbackThreshold > c.maxParticipants) {
+      problems.push('fallbackThreshold must be <= maxParticipants');
+    }
+  }
+
   checkCost(problems, 'costOfEnrollment', c.costOfEnrollment);
   checkCost(problems, 'costPerAnnouncement', c.costPerAnnouncement);
 
+  // Recovery params: the beacon output's CSV recovery leaf. Required so a
+  // missing signer can never permanently lock the funded UTXO (ADR 042). The
+  // key is an x-only (32-byte) Schnorr public key, carried as 64 hex chars.
+  if(typeof c.recoveryKey !== 'string' || !/^[0-9a-fA-F]{64}$/.test(c.recoveryKey)) {
+    problems.push('recoveryKey must be a 64-character hex string (x-only public key)');
+  }
+  if(!Number.isInteger(c.recoverySequence) || c.recoverySequence < 1 || c.recoverySequence > MAX_RECOVERY_SEQUENCE) {
+    problems.push(`recoverySequence must be a block-based BIP-68 relative timelock in [1, ${MAX_RECOVERY_SEQUENCE}]`);
+  }
+  if(c.fundingModel !== undefined && !(KNOWN_FUNDING_MODELS as readonly string[]).includes(c.fundingModel)) {
+    problems.push(`fundingModel must be one of ${KNOWN_FUNDING_MODELS.join(', ')}`);
+  }
+
   return problems;
 }