@did-btcr2/method 0.54.1 → 0.56.0

package/dist/cjs/index.js

@@ -60,7 +60,7 @@ __export(index_exports, {
   buildAggregationBeaconTx: () => buildAggregationBeaconTx,
   deriveSingletonAddress: () => deriveSingletonAddress,
   detectSingletonScriptKind: () => detectSingletonScriptKind,
-  extractOpReturnSignal: () => extractOpReturnSignal,
+  extractOpReturnSignalHash: () => extractOpReturnSignalHash,
   getAggregationCommunicationKey: () => getAggregationCommunicationKey,
   isMultikeyVerificationMethod: () => isMultikeyVerificationMethod,
   opReturnScript: () => opReturnScript,
@@ -694,15 +694,16 @@ var BeaconFactory = class {
 
 // src/core/beacon/signal-discovery.ts
 var import_bitcoin3 = require("@did-btcr2/bitcoin");
-var import_common8 = require("@did-btcr2/common");
+var import_common9 = require("@did-btcr2/common");
 
 // src/core/beacon/utils.ts
 var import_bitcoin2 = require("@did-btcr2/bitcoin");
-var import_common7 = require("@did-btcr2/common");
+var import_common8 = require("@did-btcr2/common");
 var import_btc_signer2 = require("@scure/btc-signer");
 
 // src/utils/appendix.ts
 var import_dids = require("@web5/dids");
+var import_common6 = require("@did-btcr2/common");
 var Appendix = class _Appendix {
   /**
    * Extracts a DID fragment from a given input
@@ -744,10 +745,10 @@ var Appendix = class _Appendix {
    * Extracts the verification methods from a given DID Document.
    * @param didDocument The DID Document to extract the verification methods from
    * @returns An array of DidVerificationMethod objects
-   * @throws TypeError if the didDocument is not provided
+   * @throws {DidDocumentError} if the didDocument is not provided
    */
   static getVerificationMethods(didDocument) {
-    if (!didDocument) throw new TypeError(`Required parameter missing: 'didDocument'`);
+    if (!didDocument) throw new import_common6.DidDocumentError(`Required parameter missing: 'didDocument'`);
     const verificationMethods = [];
     verificationMethods.push(...didDocument.verificationMethod?.filter(_Appendix.isDidVerificationMethod) ?? []);
     Object.keys(import_dids.DidVerificationRelationship).forEach((relationship) => {
@@ -851,7 +852,7 @@ var Appendix = class _Appendix {
 };
 
 // src/core/identifier.ts
-var import_common6 = require("@did-btcr2/common");
+var import_common7 = require("@did-btcr2/common");
 var import_keypair = require("@did-btcr2/keypair");
 var import_base = require("@scure/base");
 var Identifier = class _Identifier {
@@ -871,33 +872,33 @@ var Identifier = class _Identifier {
    */
   static encode(genesisBytes, options) {
     const { idType, version = 1, network = "bitcoin" } = options;
-    if (!(idType in import_common6.IdentifierTypes)) {
-      throw new import_common6.IdentifierError('Expected "idType" to be "KEY" or "EXTERNAL"', import_common6.INVALID_DID, { idType });
+    if (!(idType in import_common7.IdentifierTypes)) {
+      throw new import_common7.IdentifierError('Expected "idType" to be "KEY" or "EXTERNAL"', import_common7.INVALID_DID, { idType });
     }
     if (version !== 1) {
-      throw new import_common6.IdentifierError('Expected "version" to be 1', import_common6.INVALID_DID, { version });
+      throw new import_common7.IdentifierError('Expected "version" to be 1', import_common7.INVALID_DID, { version });
     }
     if (typeof network !== "string") {
-      throw new import_common6.IdentifierError('Expected "network" to be a known network name', import_common6.INVALID_DID, { network });
+      throw new import_common7.IdentifierError('Expected "network" to be a known network name', import_common7.INVALID_DID, { network });
     }
-    const networkValue = import_common6.BitcoinNetworkNames[network];
+    const networkValue = import_common7.BitcoinNetworkNames[network];
     if (networkValue === void 0) {
-      throw new import_common6.IdentifierError('Invalid "network" name', import_common6.INVALID_DID, { network });
+      throw new import_common7.IdentifierError('Invalid "network" name', import_common7.INVALID_DID, { network });
     }
     if (idType === "KEY") {
       try {
         new import_keypair.CompressedSecp256k1PublicKey(genesisBytes);
       } catch {
-        throw new import_common6.IdentifierError(
+        throw new import_common7.IdentifierError(
           'Expected "genesisBytes" to be a valid compressed secp256k1 public key',
-          import_common6.INVALID_DID,
+          import_common7.INVALID_DID,
           { genesisBytes }
         );
       }
     } else if (genesisBytes.length !== 32) {
-      throw new import_common6.IdentifierError(
+      throw new import_common7.IdentifierError(
         'Expected "genesisBytes" to be a 32-byte hash for EXTERNAL identifiers',
-        import_common6.INVALID_DID,
+        import_common7.INVALID_DID,
         { genesisBytes }
       );
     }
@@ -917,50 +918,50 @@ var Identifier = class _Identifier {
   static decode(identifier) {
     const components = identifier.split(":");
     if (components.length !== 3) {
-      throw new import_common6.IdentifierError(`Invalid did: ${identifier}`, import_common6.INVALID_DID, { identifier });
+      throw new import_common7.IdentifierError(`Invalid did: ${identifier}`, import_common7.INVALID_DID, { identifier });
     }
     const [scheme, method, encoded] = components;
     if (scheme !== "did") {
-      throw new import_common6.IdentifierError(`Invalid did: ${identifier}`, import_common6.INVALID_DID, { identifier });
+      throw new import_common7.IdentifierError(`Invalid did: ${identifier}`, import_common7.INVALID_DID, { identifier });
     }
     if (method !== "btcr2") {
-      throw new import_common6.IdentifierError(`Invalid did method: ${method}`, import_common6.METHOD_NOT_SUPPORTED, { identifier });
+      throw new import_common7.IdentifierError(`Invalid did method: ${method}`, import_common7.METHOD_NOT_SUPPORTED, { identifier });
     }
     if (!encoded) {
-      throw new import_common6.IdentifierError(`Invalid method-specific id: ${identifier}`, import_common6.INVALID_DID, { identifier });
+      throw new import_common7.IdentifierError(`Invalid method-specific id: ${identifier}`, import_common7.INVALID_DID, { identifier });
     }
     const { prefix: hrp, bytes: dataBytes } = import_base.bech32m.decodeToBytes(encoded);
     if (!["x", "k"].includes(hrp)) {
-      throw new import_common6.IdentifierError(`Invalid hrp: ${hrp}`, import_common6.INVALID_DID, { identifier });
+      throw new import_common7.IdentifierError(`Invalid hrp: ${hrp}`, import_common7.INVALID_DID, { identifier });
     }
     if (!dataBytes || dataBytes.length < 1) {
-      throw new import_common6.IdentifierError(`Failed to decode id: ${encoded}`, import_common6.INVALID_DID, { identifier });
+      throw new import_common7.IdentifierError(`Failed to decode id: ${encoded}`, import_common7.INVALID_DID, { identifier });
     }
     const idType = hrp === "k" ? "KEY" : "EXTERNAL";
     const btcr2Version = dataBytes[0] >>> 4;
     if (btcr2Version !== 0) {
-      throw new import_common6.IdentifierError(`Invalid btcr2_version (expected 0): ${btcr2Version}`, import_common6.INVALID_DID, { identifier });
+      throw new import_common7.IdentifierError(`Invalid btcr2_version (expected 0): ${btcr2Version}`, import_common7.INVALID_DID, { identifier });
     }
     const version = 1;
     const networkValue = dataBytes[0] & 15;
-    const networkName = import_common6.BitcoinNetworkNames[networkValue];
+    const networkName = import_common7.BitcoinNetworkNames[networkValue];
     let network;
     if (typeof networkName === "string") {
       network = networkName;
     } else if (networkValue >= 12 && networkValue <= 14) {
       network = networkValue - 11;
     } else {
-      throw new import_common6.IdentifierError(`Invalid network: ${networkValue}`, import_common6.INVALID_DID, { identifier });
+      throw new import_common7.IdentifierError(`Invalid network: ${networkValue}`, import_common7.INVALID_DID, { identifier });
     }
     const genesisBytes = dataBytes.slice(1);
     if (idType === "KEY") {
       try {
         new import_keypair.CompressedSecp256k1PublicKey(genesisBytes);
       } catch {
-        throw new import_common6.IdentifierError(`Invalid genesisBytes: ${genesisBytes}`, import_common6.INVALID_DID, { identifier });
+        throw new import_common7.IdentifierError(`Invalid genesisBytes: ${genesisBytes}`, import_common7.INVALID_DID, { identifier });
       }
     } else if (genesisBytes.length !== 32) {
-      throw new import_common6.IdentifierError(`Invalid genesisBytes: ${genesisBytes}`, import_common6.INVALID_DID, { identifier });
+      throw new import_common7.IdentifierError(`Invalid genesisBytes: ${genesisBytes}`, import_common7.INVALID_DID, { identifier });
     }
     return { idType, hrp, version, network, genesisBytes };
   }
@@ -989,9 +990,9 @@ var Identifier = class _Identifier {
   static getPublicKey(did) {
     const { idType, genesisBytes } = _Identifier.decode(did);
     if (idType !== "KEY") {
-      throw new import_common6.IdentifierError(
+      throw new import_common7.IdentifierError(
         `Cannot extract public key from EXTERNAL DID: ${did}. EXTERNAL DIDs encode a document hash, not a public key.`,
-        import_common6.INVALID_DID,
+        import_common7.INVALID_DID,
         { did, idType }
       );
     }
@@ -1022,7 +1023,7 @@ var BeaconUtils = class {
    */
   static parseBitcoinAddress(uri) {
     if (!uri.startsWith("bitcoin:")) {
-      throw new import_common7.MethodError("Invalid Bitcoin URI format", "BEACON_SERVICE_ERROR", { uri });
+      throw new import_common8.MethodError("Invalid Bitcoin URI format", "BEACON_SERVICE_ERROR", { uri });
     }
     return uri.replace("bitcoin:", "").split("?")[0];
   }
@@ -1103,7 +1104,7 @@ var BeaconUtils = class {
       const p2wpkhAddr = (0, import_btc_signer2.p2wpkh)(publicKey, network).address;
       const p2trAddr = (0, import_btc_signer2.p2tr)(publicKey.slice(1, 33), void 0, network).address;
       if (!p2pkhAddr || !p2wpkhAddr || !p2trAddr) {
-        throw new import_common7.DidMethodError("Failed to generate bitcoin addresses");
+        throw new import_common8.DidMethodError("Failed to generate bitcoin addresses");
       }
       return [
         {
@@ -1138,16 +1139,6 @@ var BeaconUtils = class {
   static parseBeaconServiceEndpoint(beacon) {
     return { ...beacon, serviceEndpoint: beacon.serviceEndpoint.replace("bitcoin:", "") };
   }
-  /**
-   * Create a map of address => beaconService with address field.
-   * @param {Array<BeaconService>} beacons The list of beacon services.
-   * @returns {Map<string, BeaconService>} A map of address => beaconService.
-   */
-  static getBeaconServicesMap(beacons) {
-    return new Map(
-      beacons.map(this.parseBeaconServiceEndpoint).map((beacon) => [beacon.serviceEndpoint, beacon])
-    );
-  }
   /**
    * Get the beacon service ids from a list of beacon services.
    * @param {DidDocument} didDocument The DID Document to extract the services from.
@@ -1159,21 +1150,53 @@ var BeaconUtils = class {
 };
 
 // src/core/beacon/signal-discovery.ts
-function extractOpReturnSignal(asm) {
-  if (!asm) {
-    return null;
-  }
-  const tokens = asm.trim().split(/\s+/);
-  if (tokens.length !== 3 || tokens[0] !== "OP_RETURN" || tokens[1] !== "OP_PUSHBYTES_32") {
+var BEACON_SIGNAL_SCRIPT = /^6a20([0-9a-f]{64})$/i;
+function extractOpReturnSignalHash(scriptPubKey) {
+  if (!scriptPubKey) {
     return null;
   }
-  const signalHash = tokens[2];
-  if (!/^[0-9a-fA-F]{64}$/.test(signalHash)) {
+  const signal = BEACON_SIGNAL_SCRIPT.exec(scriptPubKey.trim());
+  if (!signal) {
     return null;
   }
-  return signalHash.toLowerCase();
+  return signal[1].toLowerCase();
 }
-var BeaconSignalDiscovery = class {
+var BeaconSignalDiscovery = class _BeaconSignalDiscovery {
+  /**
+   * Determines whether a candidate transaction spends an output controlled by the given
+   * beacon address.
+   *
+   * A Beacon Signal is a transaction that *spends from* a Beacon Address, but an address
+   * transaction listing returns every transaction touching the address in either
+   * direction. Without this check, anyone able to pay dust to a beacon address could
+   * attach an arbitrary 32-byte OP_RETURN and have it read as a signal, so the input side
+   * has to be inspected before a transaction is treated as one.
+   *
+   * Esplora embeds the spent output in `vin[].prevout`; when a backend omits it the
+   * funding transaction is fetched instead, so a missing field cannot silently drop a
+   * real signal.
+   *
+   * @param {RawTransactionRest} tx The candidate transaction.
+   * @param {string} address The beacon address the transaction must spend from.
+   * @param {BitcoinConnection} bitcoin Bitcoin network connection to use for REST calls.
+   * @returns {Promise<boolean>} True if at least one input spends an output of the beacon address.
+   */
+  static async spendsFromAddress(tx, address, bitcoin) {
+    for (const vin of tx.vin ?? []) {
+      if (vin.is_coinbase) {
+        continue;
+      }
+      let prevout = vin.prevout;
+      if (!prevout && vin.txid) {
+        const fundingTx = await bitcoin.rest.transaction.get(vin.txid);
+        prevout = fundingTx?.vout?.[vin.vout];
+      }
+      if (prevout?.scriptpubkey_address === address) {
+        return true;
+      }
+    }
+    return false;
+  }
   /**
    * Retrieves the beacon signals for the given array of BeaconService objects
    * using an esplora/electrs REST API connection via a bitcoin I/O driver.
@@ -1186,21 +1209,23 @@ var BeaconSignalDiscovery = class {
     const currentBlockCount = await bitcoin.rest.block.count();
     for (const beaconService of beaconServices) {
       beaconServiceSignals.set(beaconService, []);
-      const beaconSignals = await bitcoin.rest.address.getTxs(
-        BeaconUtils.parseBitcoinAddress(beaconService.serviceEndpoint)
-      );
+      const beaconAddress = BeaconUtils.parseBitcoinAddress(beaconService.serviceEndpoint);
+      const beaconSignals = await bitcoin.rest.address.getTxs(beaconAddress);
       if (!beaconSignals || !beaconSignals.length) {
         continue;
       }
       for (const beaconSignal of beaconSignals) {
-        const signalVout = beaconSignal.vout.slice(-1)[0];
-        if (!signalVout) {
+        const lastSignalVout = beaconSignal.vout.slice(-1)[0];
+        if (!lastSignalVout) {
           continue;
         }
-        const updateHash = extractOpReturnSignal(signalVout.scriptpubkey_asm);
+        const updateHash = extractOpReturnSignalHash(lastSignalVout.scriptpubkey);
         if (!updateHash) {
           continue;
         }
+        if (!await _BeaconSignalDiscovery.spendsFromAddress(beaconSignal, beaconAddress, bitcoin)) {
+          continue;
+        }
         const confirmations = currentBlockCount - beaconSignal.status.block_height + 1;
         beaconServiceSignals.get(beaconService)?.push({
           tx: beaconSignal,
@@ -1228,10 +1253,12 @@ var BeaconSignalDiscovery = class {
     }
     const rpc = bitcoin.rpc;
     if (!rpc) {
-      throw new import_common8.ResolveError("RPC connection is not available", "RPC_CONNECTION_ERROR", bitcoin);
+      throw new import_common9.ResolveError("RPC connection is not available", "RPC_CONNECTION_ERROR", bitcoin);
     }
     const targetHeight = await rpc.getBlockCount();
-    const beaconServicesMap = BeaconUtils.getBeaconServicesMap(beaconServices);
+    const beaconServicesMap = new Map(
+      beaconServices.map((service) => [BeaconUtils.parseBitcoinAddress(service.serviceEndpoint), service])
+    );
     let height = 0;
     let block = await bitcoin.rpc.getBlock({ height });
     console.info(`Searching for beacon signals, please wait ...`);
@@ -1240,6 +1267,15 @@ var BeaconSignalDiscovery = class {
         if (tx.txid === import_bitcoin3.GENESIS_TX_ID) {
           continue;
         }
+        const lastSignalVout = tx.vout.slice(-1)[0];
+        if (!lastSignalVout) {
+          continue;
+        }
+        const updateHash = extractOpReturnSignalHash(lastSignalVout.scriptPubKey?.hex);
+        if (!updateHash) {
+          continue;
+        }
+        const signaled = /* @__PURE__ */ new Set();
         for (const vin of tx.vin) {
           if (vin.coinbase) {
             continue;
@@ -1262,15 +1298,11 @@ var BeaconSignalDiscovery = class {
             continue;
           }
           const beaconService = beaconServicesMap.get(scriptPubKey.address);
-          if (!beaconService) {
-            continue;
-          }
-          const txVoutScriptPubkeyAsm = prevout.vout[vin.vout].scriptPubKey.asm;
-          const updateHash = extractOpReturnSignal(txVoutScriptPubkeyAsm);
-          if (!updateHash) {
+          if (!beaconService || signaled.has(beaconService)) {
             continue;
           }
-          console.info(`Tx ${tx.txid} contains beacon service address ${scriptPubKey.address} and OP_RETURN!`, tx);
+          signaled.add(beaconService);
+          console.info(`Tx ${tx.txid} contains beacon address ${scriptPubKey.address}`);
           beaconServiceSignals.get(beaconService)?.push({
             tx,
             signalBytes: updateHash,
@@ -1295,27 +1327,27 @@ var BeaconSignalDiscovery = class {
 };
 
 // src/core/did-sender-resolver.ts
-var import_common13 = require("@did-btcr2/common");
+var import_common14 = require("@did-btcr2/common");
 var import_cryptosuite3 = require("@did-btcr2/cryptosuite");
 var import_keypair4 = require("@did-btcr2/keypair");
 
 // src/core/resolver.ts
 var import_bitcoin5 = require("@did-btcr2/bitcoin");
-var import_common12 = require("@did-btcr2/common");
+var import_common13 = require("@did-btcr2/common");
 var import_cryptosuite2 = require("@did-btcr2/cryptosuite");
 var import_keypair3 = require("@did-btcr2/keypair");
 
 // src/did-btcr2.ts
-var import_common11 = require("@did-btcr2/common");
+var import_common12 = require("@did-btcr2/common");
 var import_dids2 = require("@web5/dids");
 
 // src/core/updater.ts
-var import_common10 = require("@did-btcr2/common");
+var import_common11 = require("@did-btcr2/common");
 var import_cryptosuite = require("@did-btcr2/cryptosuite");
 
 // src/utils/did-document.ts
 var import_bitcoin4 = require("@did-btcr2/bitcoin");
-var import_common9 = require("@did-btcr2/common");
+var import_common10 = require("@did-btcr2/common");
 var import_keypair2 = require("@did-btcr2/keypair");
 var import_utils4 = require("@web5/dids/utils");
 var import_btc_signer3 = require("@scure/btc-signer");
@@ -1343,16 +1375,16 @@ var DidVerificationMethod = class {
   secretKeyMultibase;
   constructor({ id, type, controller, publicKeyMultibase, secretKeyMultibase }) {
     if (type !== MULTIKEY_VERIFICATION_METHOD_TYPE) {
-      throw new import_common9.DidDocumentError(
+      throw new import_common10.DidDocumentError(
         `Invalid verification method: type must be "${MULTIKEY_VERIFICATION_METHOD_TYPE}"`,
-        import_common9.INVALID_DID_DOCUMENT,
+        import_common10.INVALID_DID_DOCUMENT,
         { id, type }
       );
     }
     if (typeof publicKeyMultibase !== "string" || !publicKeyMultibase.startsWith(MULTIKEY_PUBLIC_KEY_MULTIBASE_PREFIX)) {
-      throw new import_common9.DidDocumentError(
+      throw new import_common10.DidDocumentError(
         `Invalid verification method: publicKeyMultibase must start with "${MULTIKEY_PUBLIC_KEY_MULTIBASE_PREFIX}"`,
-        import_common9.INVALID_DID_DOCUMENT,
+        import_common10.INVALID_DID_DOCUMENT,
         { id, publicKeyMultibase }
       );
     }
@@ -1382,20 +1414,20 @@ var DidDocument = class _DidDocument {
   deactivated;
   constructor(document) {
     if (!document.id) {
-      throw new import_common9.DidDocumentError("DID Document must have an id", import_common9.INVALID_DID_DOCUMENT, document);
+      throw new import_common10.DidDocumentError("DID Document must have an id", import_common10.INVALID_DID_DOCUMENT, document);
     }
-    const idType = document.id.includes("k1") ? import_common9.IdentifierTypes.KEY : import_common9.IdentifierTypes.EXTERNAL;
+    const idType = document.id.includes("k1") ? import_common10.IdentifierTypes.KEY : import_common10.IdentifierTypes.EXTERNAL;
     const isGenesis = document.id === ID_PLACEHOLDER_VALUE;
     const { id, verificationMethod: vm, service } = document;
     if (!isGenesis) {
       if (!_DidDocument.isValidId(id)) {
-        throw new import_common9.DidDocumentError(`Invalid id: ${id}`, import_common9.INVALID_DID_DOCUMENT, document);
+        throw new import_common10.DidDocumentError(`Invalid id: ${id}`, import_common10.INVALID_DID_DOCUMENT, document);
       }
       if (!_DidDocument.isValidVerificationMethods(vm)) {
-        throw new import_common9.DidDocumentError("Invalid verificationMethod: " + vm, import_common9.INVALID_DID_DOCUMENT, document);
+        throw new import_common10.DidDocumentError("Invalid verificationMethod: " + vm, import_common10.INVALID_DID_DOCUMENT, document);
       }
       if (!_DidDocument.isValidServices(service)) {
-        throw new import_common9.DidDocumentError("Invalid service: " + service, import_common9.INVALID_DID_DOCUMENT, document);
+        throw new import_common10.DidDocumentError("Invalid service: " + service, import_common10.INVALID_DID_DOCUMENT, document);
       }
     }
     this.id = document.id;
@@ -1405,7 +1437,7 @@ var DidDocument = class _DidDocument {
       "https://www.w3.org/ns/did/v1.1",
       "https://btcr2.dev/context/v1"
     ];
-    if (idType === import_common9.IdentifierTypes.KEY) {
+    if (idType === import_common10.IdentifierTypes.KEY) {
       const keyRef = `${this.id}#initialKey`;
       this.authentication = document.authentication || [keyRef];
       this.assertionMethod = document.assertionMethod || [keyRef];
@@ -1491,19 +1523,19 @@ var DidDocument = class _DidDocument {
    */
   static isValid(didDocument) {
     if (!this.isValidContext(didDocument?.["@context"])) {
-      throw new import_common9.DidDocumentError('Invalid "@context"', import_common9.INVALID_DID_DOCUMENT, didDocument);
+      throw new import_common10.DidDocumentError('Invalid "@context"', import_common10.INVALID_DID_DOCUMENT, didDocument);
     }
     if (!this.isValidId(didDocument?.id)) {
-      throw new import_common9.DidDocumentError('Invalid "id"', import_common9.INVALID_DID_DOCUMENT, didDocument);
+      throw new import_common10.DidDocumentError('Invalid "id"', import_common10.INVALID_DID_DOCUMENT, didDocument);
     }
     if (!this.isValidVerificationMethods(didDocument?.verificationMethod)) {
-      throw new import_common9.DidDocumentError('Invalid "verificationMethod"', import_common9.INVALID_DID_DOCUMENT, didDocument);
+      throw new import_common10.DidDocumentError('Invalid "verificationMethod"', import_common10.INVALID_DID_DOCUMENT, didDocument);
     }
     if (!this.isValidServices(didDocument?.service)) {
-      throw new import_common9.DidDocumentError('Invalid "service"', import_common9.INVALID_DID_DOCUMENT, didDocument);
+      throw new import_common10.DidDocumentError('Invalid "service"', import_common10.INVALID_DID_DOCUMENT, didDocument);
     }
     if (!this.isValidVerificationRelationships(didDocument)) {
-      throw new import_common9.DidDocumentError("Invalid verification relationships", import_common9.INVALID_DID_DOCUMENT, didDocument);
+      throw new import_common10.DidDocumentError("Invalid verification relationships", import_common10.INVALID_DID_DOCUMENT, didDocument);
     }
     return true;
   }
@@ -1591,16 +1623,16 @@ var DidDocument = class _DidDocument {
    */
   validateGenesis() {
     if (this.id !== ID_PLACEHOLDER_VALUE) {
-      throw new import_common9.DidDocumentError("Invalid GenesisDocument ID", import_common9.INVALID_DID_DOCUMENT, this);
+      throw new import_common10.DidDocumentError("Invalid GenesisDocument ID", import_common10.INVALID_DID_DOCUMENT, this);
     }
     if (!this.verificationMethod.every((vm) => vm.id.includes(ID_PLACEHOLDER_VALUE) && vm.controller === ID_PLACEHOLDER_VALUE)) {
-      throw new import_common9.DidDocumentError("Invalid GenesisDocument verificationMethod", import_common9.INVALID_DID_DOCUMENT, this);
+      throw new import_common10.DidDocumentError("Invalid GenesisDocument verificationMethod", import_common10.INVALID_DID_DOCUMENT, this);
     }
     if (!this.service.every((svc) => svc.id.includes(ID_PLACEHOLDER_VALUE))) {
-      throw new import_common9.DidDocumentError("Invalid GenesisDocument service", import_common9.INVALID_DID_DOCUMENT, this);
+      throw new import_common10.DidDocumentError("Invalid GenesisDocument service", import_common10.INVALID_DID_DOCUMENT, this);
     }
     if (!_DidDocument.isValidVerificationRelationships(this)) {
-      throw new import_common9.DidDocumentError("Invalid GenesisDocument assertionMethod", import_common9.INVALID_DID_DOCUMENT, this);
+      throw new import_common10.DidDocumentError("Invalid GenesisDocument assertionMethod", import_common10.INVALID_DID_DOCUMENT, this);
     }
     return true;
   }
@@ -1610,7 +1642,7 @@ var DidDocument = class _DidDocument {
    */
   toIntermediate() {
     if (this.id.includes("k1")) {
-      throw new import_common9.DidDocumentError("Cannot convert a key identifier to an intermediate document", import_common9.INVALID_DID_DOCUMENT, this);
+      throw new import_common10.DidDocumentError("Cannot convert a key identifier to an intermediate document", import_common10.INVALID_DID_DOCUMENT, this);
     }
     return new GenesisDocument(this);
   }
@@ -1635,7 +1667,7 @@ var GenesisDocument = class _GenesisDocument extends DidDocument {
    * @returns {GenesisDocument} The GenesisDocument representation of the DidDocument.
    */
   static fromDidDocument(didDocument) {
-    const intermediateDocument = import_common9.JSONUtils.cloneReplace(didDocument, DID_REGEX, ID_PLACEHOLDER_VALUE);
+    const intermediateDocument = import_common10.JSONUtils.cloneReplace(didDocument, DID_REGEX, ID_PLACEHOLDER_VALUE);
     return new _GenesisDocument(intermediateDocument);
   }
   /**
@@ -1692,7 +1724,7 @@ var GenesisDocument = class _GenesisDocument extends DidDocument {
    * @returns {Bytes} The genesis bytes.
    */
   static toGenesisBytes(genesisDocument) {
-    return (0, import_common9.hash)((0, import_common9.canonicalize)(genesisDocument));
+    return (0, import_common10.hash)((0, import_common10.canonicalize)(genesisDocument));
   }
 };
 
@@ -1737,26 +1769,26 @@ var Updater = class _Updater {
       patch: patches,
       targetHash: "",
       targetVersionId: sourceVersionId + 1,
-      sourceHash: (0, import_common10.canonicalHash)(sourceDocument)
+      sourceHash: (0, import_common11.canonicalHash)(sourceDocument)
     };
-    const targetDocument = import_common10.JSONPatch.apply(sourceDocument, patches);
+    const targetDocument = import_common11.JSONPatch.apply(sourceDocument, patches);
     if (targetDocument.id !== sourceDocument.id) {
-      throw new import_common10.UpdateError(
+      throw new import_common11.UpdateError(
         `Patches must not change the DID document id (source "${sourceDocument.id}" to target "${targetDocument.id}").`,
-        import_common10.INVALID_DID_UPDATE,
+        import_common11.INVALID_DID_UPDATE,
         { sourceId: sourceDocument.id, targetId: targetDocument.id }
       );
     }
     try {
       DidDocument.isValid(targetDocument);
     } catch (error) {
-      throw new import_common10.UpdateError(
+      throw new import_common11.UpdateError(
         "Error validating targetDocument: " + (error instanceof Error ? error.message : String(error)),
-        import_common10.INVALID_DID_UPDATE,
+        import_common11.INVALID_DID_UPDATE,
         targetDocument
       );
     }
-    unsignedUpdate.targetHash = (0, import_common10.canonicalHash)(targetDocument);
+    unsignedUpdate.targetHash = (0, import_common11.canonicalHash)(targetDocument);
     return unsignedUpdate;
   }
   /**
@@ -1770,18 +1802,18 @@ var Updater = class _Updater {
    */
   static sign(did, unsignedUpdate, verificationMethod, signer) {
     if (!did.startsWith("did:btcr2:")) {
-      throw new import_common10.UpdateError(
+      throw new import_common11.UpdateError(
         `Expected a did:btcr2 identifier for the root capability; got "${did}".`,
-        import_common10.INVALID_DID_UPDATE,
+        import_common11.INVALID_DID_UPDATE,
         { did }
       );
     }
     const controller = verificationMethod.controller;
     const hashIdx = verificationMethod.id.indexOf("#");
     if (hashIdx < 0) {
-      throw new import_common10.UpdateError(
+      throw new import_common11.UpdateError(
         `Verification method id must contain a fragment (e.g. "${verificationMethod.id}#initialKey"); got "${verificationMethod.id}".`,
-        import_common10.INVALID_DID_UPDATE,
+        import_common11.INVALID_DID_UPDATE,
         { verificationMethodId: verificationMethod.id }
       );
     }
@@ -1789,9 +1821,9 @@ var Updater = class _Updater {
     const multikey = import_cryptosuite.SchnorrMultikey.fromSigner(id, controller, signer);
     const signerKey = multikey.publicKey.multibase.encoded;
     if (verificationMethod.publicKeyMultibase && signerKey !== verificationMethod.publicKeyMultibase) {
-      throw new import_common10.UpdateError(
+      throw new import_common11.UpdateError(
         `Signing key does not match verification method "${verificationMethod.id}": the signer's public key differs from the method's published publicKeyMultibase.`,
-        import_common10.INVALID_DID_UPDATE,
+        import_common11.INVALID_DID_UPDATE,
         {
           verificationMethodId: verificationMethod.id,
           expected: verificationMethod.publicKeyMultibase,
@@ -1908,16 +1940,16 @@ var Updater = class _Updater {
     switch (need.kind) {
       case "NeedSigningKey": {
         if (this.#state.phase !== "Sign") {
-          throw new import_common10.UpdateError(
+          throw new import_common11.UpdateError(
             `Cannot provide NeedSigningKey: updater phase is ${this.#state.phase}, expected Sign.`,
-            import_common10.INVALID_DID_UPDATE,
+            import_common11.INVALID_DID_UPDATE,
             { phase: this.#state.phase }
           );
         }
         if (!data) {
-          throw new import_common10.UpdateError(
+          throw new import_common11.UpdateError(
             "NeedSigningKey requires a Signer.",
-            import_common10.INVALID_DID_UPDATE
+            import_common11.INVALID_DID_UPDATE
           );
         }
         const unsignedUpdate = this.#state.unsignedUpdate;
@@ -1932,18 +1964,18 @@ var Updater = class _Updater {
       }
       case "NeedFunding": {
         if (this.#state.phase !== "Fund") {
-          throw new import_common10.UpdateError(
+          throw new import_common11.UpdateError(
             `Cannot provide NeedFunding: updater phase is ${this.#state.phase}, expected Fund.`,
-            import_common10.INVALID_DID_UPDATE,
+            import_common11.INVALID_DID_UPDATE,
             { phase: this.#state.phase }
           );
         }
         if (data !== void 0) {
           const proof = data;
           if (typeof proof.utxoCount !== "number" || !Number.isFinite(proof.utxoCount) || proof.utxoCount < 1) {
-            throw new import_common10.UpdateError(
+            throw new import_common11.UpdateError(
               `NeedFunding proof must have utxoCount >= 1; got ${String(proof.utxoCount)}.`,
-              import_common10.INVALID_DID_UPDATE,
+              import_common11.INVALID_DID_UPDATE,
               { utxoCount: proof.utxoCount }
             );
           }
@@ -1957,9 +1989,9 @@ var Updater = class _Updater {
       }
       case "NeedBroadcast": {
         if (this.#state.phase !== "Broadcast") {
-          throw new import_common10.UpdateError(
+          throw new import_common11.UpdateError(
             `Cannot provide NeedBroadcast: updater phase is ${this.#state.phase}, expected Broadcast.`,
-            import_common10.INVALID_DID_UPDATE,
+            import_common11.INVALID_DID_UPDATE,
             { phase: this.#state.phase }
           );
         }
@@ -1995,9 +2027,9 @@ var DidBtcr2 = class {
   static create(genesisBytes, options) {
     const { idType, version = 1, network = "bitcoin" } = options || {};
     if (!idType) {
-      throw new import_common11.MethodError(
+      throw new import_common12.MethodError(
         "idType is required for creating a did:btcr2 identifier",
-        import_common11.INVALID_DID_DOCUMENT,
+        import_common12.INVALID_DID_DOCUMENT,
         options
       );
     }
@@ -2027,7 +2059,7 @@ var DidBtcr2 = class {
   static resolve(did, resolutionOptions = {}) {
     const didComponents = Identifier.decode(did);
     const sidecarData = Resolver.sidecarData(resolutionOptions.sidecar);
-    const currentDocument = didComponents.hrp === import_common11.IdentifierHrp.k ? Resolver.deterministic(didComponents) : null;
+    const currentDocument = didComponents.hrp === import_common12.IdentifierHrp.k ? Resolver.deterministic(didComponents) : null;
     return new Resolver(didComponents, sidecarData, currentDocument, {
       versionId: resolutionOptions.versionId,
       versionTime: resolutionOptions.versionTime,
@@ -2066,39 +2098,39 @@ var DidBtcr2 = class {
     beaconId
   }) {
     if (!sourceDocument.capabilityInvocation?.some((vr) => vr === verificationMethodId)) {
-      throw new import_common11.UpdateError(
+      throw new import_common12.UpdateError(
         "Invalid verificationMethodId: not authorized for capabilityInvocation",
-        import_common11.INVALID_DID_DOCUMENT,
+        import_common12.INVALID_DID_DOCUMENT,
         sourceDocument
       );
     }
     const verificationMethod = this.getSigningMethod(sourceDocument, verificationMethodId);
     if (!verificationMethod) {
-      throw new import_common11.UpdateError(
+      throw new import_common12.UpdateError(
         "Invalid verificationMethod: not found in source document",
-        import_common11.INVALID_DID_DOCUMENT,
+        import_common12.INVALID_DID_DOCUMENT,
         { sourceDocument, verificationMethodId }
       );
     }
     if (verificationMethod.type !== MULTIKEY_VERIFICATION_METHOD_TYPE) {
-      throw new import_common11.UpdateError(
+      throw new import_common12.UpdateError(
         `Invalid verificationMethod: verificationMethod.type must be "${MULTIKEY_VERIFICATION_METHOD_TYPE}"`,
-        import_common11.INVALID_DID_DOCUMENT,
+        import_common12.INVALID_DID_DOCUMENT,
         verificationMethod
       );
     }
     if (!verificationMethod.publicKeyMultibase?.startsWith(MULTIKEY_PUBLIC_KEY_MULTIBASE_PREFIX)) {
-      throw new import_common11.UpdateError(
+      throw new import_common12.UpdateError(
         `Invalid verificationMethodId: publicKeyMultibase prefix must start with "${MULTIKEY_PUBLIC_KEY_MULTIBASE_PREFIX}"`,
-        import_common11.INVALID_DID_DOCUMENT,
+        import_common12.INVALID_DID_DOCUMENT,
         verificationMethod
       );
     }
     const beaconService = sourceDocument.service.filter((service) => service.id === beaconId).filter((service) => !!service).shift();
     if (!beaconService) {
-      throw new import_common11.UpdateError(
+      throw new import_common12.UpdateError(
         "No beacon service found for provided beaconId",
-        import_common11.INVALID_DID_UPDATE,
+        import_common12.INVALID_DID_UPDATE,
         { sourceDocument, beaconId }
       );
     }
@@ -2124,7 +2156,7 @@ var DidBtcr2 = class {
     methodId ??= "#initialKey";
     const parsedDid = import_dids2.Did.parse(didDocument.id);
     if (parsedDid && parsedDid.method !== this.methodName) {
-      throw new import_common11.MethodError(`Method not supported: ${parsedDid.method}`, import_common11.METHOD_NOT_SUPPORTED, { identifier: didDocument.id });
+      throw new import_common12.MethodError(`Method not supported: ${parsedDid.method}`, import_common12.METHOD_NOT_SUPPORTED, { identifier: didDocument.id });
     }
     const verificationMethod = didDocument.verificationMethod?.find(
       (vm) => Appendix.extractDidFragment(vm.id) === (Appendix.extractDidFragment(methodId) ?? Appendix.extractDidFragment(didDocument.assertionMethod?.[0]))
@@ -2155,6 +2187,11 @@ function isSMTProof(value) {
   if (!isRecord(value)) return false;
   return typeof value.id === "string" && typeof value.collapsed === "string" && Array.isArray(value.hashes);
 }
+function relationshipMethodId(documentId, entry) {
+  const id = isRecord(entry) ? entry.id : entry;
+  if (typeof id !== "string" || id.length === 0) return void 0;
+  return id.startsWith("#") ? `${documentId}${id}` : id;
+}
 var Resolver = class _Resolver {
   // --- Immutable inputs ---
   #didComponents;
@@ -2244,14 +2281,14 @@ var Resolver = class _Resolver {
    * @throws {ResolveError} InvalidDidDocument if not conformant to DID Core v1.1
    */
   static external(didComponents, genesisDocument) {
-    const genesisDocumentHash = (0, import_common12.canonicalHashBytes)(genesisDocument);
+    const genesisDocumentHash = (0, import_common13.canonicalHashBytes)(genesisDocument);
     if (!(0, import_utils6.equalBytes)(didComponents.genesisBytes, genesisDocumentHash)) {
-      throw new import_common12.ResolveError(
+      throw new import_common13.ResolveError(
         `Initial document mismatch: genesisBytes !== genesisDocumentHash`,
-        import_common12.INVALID_DID_DOCUMENT,
+        import_common13.INVALID_DID_DOCUMENT,
         {
-          genesisBytes: (0, import_common12.encode)(didComponents.genesisBytes, "hex"),
-          genesisDocumentHash: (0, import_common12.encode)(genesisDocumentHash, "hex")
+          genesisBytes: (0, import_common13.encode)(didComponents.genesisBytes, "hex"),
+          genesisDocumentHash: (0, import_common13.encode)(genesisDocumentHash, "hex")
         }
       );
     }
@@ -2270,17 +2307,17 @@ var Resolver = class _Resolver {
     const updateMap = /* @__PURE__ */ new Map();
     if (sidecar.updates?.length)
       for (const update of sidecar.updates) {
-        updateMap.set((0, import_common12.canonicalHash)(update, { encoding: "hex" }), update);
+        updateMap.set((0, import_common13.canonicalHash)(update, { encoding: "hex" }), update);
       }
     const casMap = /* @__PURE__ */ new Map();
     if (sidecar.casUpdates?.length)
       for (const update of sidecar.casUpdates) {
-        casMap.set((0, import_common12.canonicalHash)(update, { encoding: "hex" }), update);
+        casMap.set((0, import_common13.canonicalHash)(update, { encoding: "hex" }), update);
       }
     const smtMap = /* @__PURE__ */ new Map();
     if (sidecar.smtProofs?.length)
       for (const proof of sidecar.smtProofs) {
-        smtMap.set((0, import_common12.encode)((0, import_common12.decode)(proof.id, "base64urlnopad"), "hex"), proof);
+        smtMap.set((0, import_common13.encode)((0, import_common13.decode)(proof.id, "base64urlnopad"), "hex"), proof);
       }
     return { updateMap, casMap, smtMap };
   }
@@ -2311,38 +2348,38 @@ var Resolver = class _Resolver {
       }
     };
     for (const [update, block] of updates) {
-      const currentDocumentHash = (0, import_common12.canonicalHashBytes)(response.didDocument);
-      const blocktime = import_common12.DateUtils.blocktimeToTimestamp(block.time);
-      response.metadata.updated = import_common12.DateUtils.toISOStringNonFractional(blocktime);
+      const currentDocumentHash = (0, import_common13.canonicalHashBytes)(response.didDocument);
+      const blocktime = import_common13.DateUtils.blocktimeToTimestamp(block.time);
+      response.metadata.updated = import_common13.DateUtils.toISOStringNonFractional(blocktime);
       response.metadata.confirmations = block.confirmations;
       if (update.targetVersionId <= currentVersionId) {
         this.confirmDuplicate(update, updateHashHistory);
         continue;
       }
       if (versionTime) {
-        if (blocktime > import_common12.DateUtils.dateStringToTimestamp(versionTime)) {
+        if (blocktime > import_common13.DateUtils.dateStringToTimestamp(versionTime)) {
           return response;
         }
       }
       if (update.targetVersionId === currentVersionId + 1) {
-        const sourceHashBytes = (0, import_common12.decode)(update.sourceHash, "base64urlnopad");
+        const sourceHashBytes = (0, import_common13.decode)(update.sourceHash, "base64urlnopad");
         if (!(0, import_utils6.equalBytes)(sourceHashBytes, currentDocumentHash)) {
-          throw new import_common12.ResolveError(
+          throw new import_common13.ResolveError(
             `Hash mismatch: update.sourceHash !== currentDocumentHash`,
-            import_common12.INVALID_DID_UPDATE,
+            import_common13.INVALID_DID_UPDATE,
             {
               sourceHash: update.sourceHash,
-              currentDocumentHash: (0, import_common12.encode)(currentDocumentHash, "hex")
+              currentDocumentHash: (0, import_common13.encode)(currentDocumentHash, "hex")
             }
           );
         }
         response.didDocument = this.applyUpdate(response.didDocument, update);
-        const unsignedUpdate = import_common12.JSONUtils.deleteKeys(update, ["proof"]);
-        updateHashHistory.push((0, import_common12.canonicalHashBytes)(unsignedUpdate));
+        const unsignedUpdate = import_common13.JSONUtils.deleteKeys(update, ["proof"]);
+        updateHashHistory.push((0, import_common13.canonicalHashBytes)(unsignedUpdate));
       } else {
-        throw new import_common12.ResolveError(
+        throw new import_common13.ResolveError(
           `Version Id Mismatch: targetVersionId cannot be > currentVersionId + 1`,
-          import_common12.LATE_PUBLISHING_ERROR,
+          import_common13.LATE_PUBLISHING_ERROR,
           {
             targetVersionId: update.targetVersionId,
             currentVersionId: currentVersionId + 1
@@ -2371,19 +2408,19 @@ var Resolver = class _Resolver {
    */
   static confirmDuplicate(update, updateHashHistory) {
     if (!Number.isInteger(update.targetVersionId) || update.targetVersionId < 2) {
-      throw new import_common12.ResolveError(
+      throw new import_common13.ResolveError(
         `Invalid duplicate: targetVersionId must be an integer >= 2`,
-        import_common12.INVALID_DID_UPDATE,
+        import_common13.INVALID_DID_UPDATE,
         { targetVersionId: update.targetVersionId }
       );
     }
     const { proof: _, ...unsignedUpdate } = update;
-    const unsignedUpdateHash = (0, import_common12.canonicalHashBytes)(unsignedUpdate);
+    const unsignedUpdateHash = (0, import_common13.canonicalHashBytes)(unsignedUpdate);
     const historicalUpdateHash = updateHashHistory[update.targetVersionId - 2];
     if (historicalUpdateHash === void 0) {
-      throw new import_common12.ResolveError(
+      throw new import_common13.ResolveError(
         `Invalid duplicate: no applied update in history for targetVersionId`,
-        import_common12.LATE_PUBLISHING_ERROR,
+        import_common13.LATE_PUBLISHING_ERROR,
         {
           targetVersionId: update.targetVersionId,
           historyLength: updateHashHistory.length
@@ -2391,12 +2428,12 @@ var Resolver = class _Resolver {
       );
     }
     if (!(0, import_utils6.equalBytes)(historicalUpdateHash, unsignedUpdateHash)) {
-      throw new import_common12.ResolveError(
+      throw new import_common13.ResolveError(
         `Invalid duplicate: unsigned update hash does not match historical hash`,
-        import_common12.LATE_PUBLISHING_ERROR,
+        import_common13.LATE_PUBLISHING_ERROR,
         {
-          unsignedUpdateHash: (0, import_common12.encode)(unsignedUpdateHash, "hex"),
-          historicalHash: (0, import_common12.encode)(historicalUpdateHash, "hex")
+          unsignedUpdateHash: (0, import_common13.encode)(unsignedUpdateHash, "hex"),
+          historicalHash: (0, import_common13.encode)(historicalUpdateHash, "hex")
         }
       );
     }
@@ -2411,42 +2448,56 @@ var Resolver = class _Resolver {
   static applyUpdate(currentDocument, update) {
     const capabilityId = update.proof?.capability;
     if (!capabilityId) {
-      throw new import_common12.ResolveError("No root capability found in update", import_common12.INVALID_DID_UPDATE, update);
+      throw new import_common13.ResolveError("No root capability found in update", import_common13.INVALID_DID_UPDATE, update);
     }
     const rootCapability = Appendix.dereferenceZcapId(capabilityId);
     const { invocationTarget, controller: rootController } = rootCapability;
     if (![invocationTarget, rootController].every((id) => id === currentDocument.id)) {
-      throw new import_common12.ResolveError(
+      throw new import_common13.ResolveError(
         "Invalid root capability",
-        import_common12.INVALID_DID_UPDATE,
+        import_common13.INVALID_DID_UPDATE,
         { rootCapability, currentDocument }
       );
     }
     const verificationMethodId = update.proof?.verificationMethod;
     if (!verificationMethodId) {
-      throw new import_common12.ResolveError("No verificationMethod found in update", import_common12.INVALID_DID_UPDATE, update);
+      throw new import_common13.ResolveError("No verificationMethod found in update", import_common13.INVALID_DID_UPDATE, update);
+    }
+    const authorizedMethodId = relationshipMethodId(currentDocument.id, verificationMethodId);
+    const authorized = authorizedMethodId !== void 0 && currentDocument.capabilityInvocation?.some(
+      (entry) => relationshipMethodId(currentDocument.id, entry) === authorizedMethodId
+    );
+    if (!authorized) {
+      throw new import_common13.ResolveError(
+        "Invalid update: verificationMethod is not authorized for capabilityInvocation",
+        import_common13.INVALID_DID_UPDATE,
+        {
+          verificationMethodId,
+          capabilityInvocation: currentDocument.capabilityInvocation
+        }
+      );
     }
     const vm = DidBtcr2.getSigningMethod(currentDocument, verificationMethodId);
     const multikey = import_cryptosuite2.SchnorrMultikey.fromVerificationMethod(vm);
     const cryptosuite = new import_cryptosuite2.BIP340Cryptosuite(multikey);
-    const canonicalUpdate = (0, import_common12.canonicalize)(update);
+    const canonicalUpdate = (0, import_common13.canonicalize)(update);
     const diProof = new import_cryptosuite2.BIP340DataIntegrityProof(cryptosuite);
     const verificationResult = diProof.verifyProof(canonicalUpdate, "capabilityInvocation");
     if (!verificationResult.verified) {
-      throw new import_common12.ResolveError(
+      throw new import_common13.ResolveError(
         "Invalid update: proof not verified",
-        import_common12.INVALID_DID_UPDATE,
+        import_common13.INVALID_DID_UPDATE,
         verificationResult
       );
     }
-    const updatedDocument = import_common12.JSONPatch.apply(currentDocument, update.patch);
+    const updatedDocument = import_common13.JSONPatch.apply(currentDocument, update.patch);
     DidDocument.validate(updatedDocument);
-    const currentDocumentHash = (0, import_common12.canonicalHashBytes)(updatedDocument);
-    const updateTargetHash = (0, import_common12.decode)(update.targetHash);
+    const currentDocumentHash = (0, import_common13.canonicalHashBytes)(updatedDocument);
+    const updateTargetHash = (0, import_common13.decode)(update.targetHash);
     if (!(0, import_utils6.equalBytes)(updateTargetHash, currentDocumentHash)) {
-      throw new import_common12.ResolveError(
+      throw new import_common13.ResolveError(
         `Invalid update: update.targetHash !== currentDocumentHash`,
-        import_common12.INVALID_DID_UPDATE,
+        import_common13.INVALID_DID_UPDATE,
         { updateTargetHash, currentDocumentHash }
       );
     }
@@ -2474,7 +2525,7 @@ var Resolver = class _Resolver {
             this.#phase = "BeaconDiscovery" /* BeaconDiscovery */;
             continue;
           }
-          const genesisHash = (0, import_common12.encode)(this.#didComponents.genesisBytes, "hex");
+          const genesisHash = (0, import_common13.encode)(this.#didComponents.genesisBytes, "hex");
           return {
             status: "action-required",
             needs: [{ kind: "NeedGenesisDocument", genesisHash }]
@@ -2543,9 +2594,9 @@ var Resolver = class _Resolver {
             });
             if (hasNewServices) {
               if (++this.#discoveryRounds > this.#maxDiscoveryRounds) {
-                throw new import_common12.ResolveError(
+                throw new import_common13.ResolveError(
                   `Exceeded the configured maximum of ${this.#maxDiscoveryRounds} beacon-discovery rounds. Raise or remove ResolutionOptions.maxDiscoveryRounds to resolve this DID.`,
-                  import_common12.INTERNAL_ERROR,
+                  import_common13.INTERNAL_ERROR,
                   { maxDiscoveryRounds: this.#maxDiscoveryRounds, discoveryRounds: this.#discoveryRounds }
                 );
               }
@@ -2576,9 +2627,9 @@ var Resolver = class _Resolver {
     switch (need.kind) {
       case "NeedGenesisDocument": {
         if (!isRecord(data)) {
-          throw new import_common12.ResolveError(
+          throw new import_common13.ResolveError(
             "Provided data for NeedGenesisDocument must be a document object.",
-            import_common12.INVALID_DID_UPDATE,
+            import_common13.INVALID_DID_UPDATE,
             { kind: need.kind }
           );
         }
@@ -2587,9 +2638,9 @@ var Resolver = class _Resolver {
       }
       case "NeedBeaconSignals": {
         if (!(data instanceof Map)) {
-          throw new import_common12.ResolveError(
+          throw new import_common13.ResolveError(
             "Provided data for NeedBeaconSignals must be a Map of beacon services to signals.",
-            import_common12.INVALID_DID_UPDATE,
+            import_common13.INVALID_DID_UPDATE,
             { kind: need.kind }
           );
         }
@@ -2600,17 +2651,17 @@ var Resolver = class _Resolver {
       }
       case "NeedCASAnnouncement": {
         if (!isCASAnnouncement(data)) {
-          throw new import_common12.ResolveError(
+          throw new import_common13.ResolveError(
             "Provided data for NeedCASAnnouncement is not a CAS announcement.",
-            import_common12.INVALID_DID_UPDATE,
+            import_common13.INVALID_DID_UPDATE,
             { kind: need.kind }
           );
         }
-        const announcementHash = (0, import_common12.canonicalHash)(data, { encoding: "hex" });
+        const announcementHash = (0, import_common13.canonicalHash)(data, { encoding: "hex" });
         if (announcementHash !== need.announcementHash) {
-          throw new import_common12.ResolveError(
+          throw new import_common13.ResolveError(
             `CAS announcement hash mismatch: expected ${need.announcementHash}, got ${announcementHash}.`,
-            import_common12.INVALID_DID_UPDATE,
+            import_common13.INVALID_DID_UPDATE,
             { expected: need.announcementHash, actual: announcementHash }
           );
         }
@@ -2619,17 +2670,17 @@ var Resolver = class _Resolver {
       }
       case "NeedSignedUpdate": {
         if (!isSignedBTCR2Update(data)) {
-          throw new import_common12.ResolveError(
+          throw new import_common13.ResolveError(
             "Provided data for NeedSignedUpdate is not a signed BTCR2 update.",
-            import_common12.INVALID_DID_UPDATE,
+            import_common13.INVALID_DID_UPDATE,
             { kind: need.kind }
           );
         }
-        const updateHash = (0, import_common12.canonicalHash)(data, { encoding: "hex" });
+        const updateHash = (0, import_common13.canonicalHash)(data, { encoding: "hex" });
         if (updateHash !== need.updateHash) {
-          throw new import_common12.ResolveError(
+          throw new import_common13.ResolveError(
             `Signed update hash mismatch: expected ${need.updateHash}, got ${updateHash}.`,
-            import_common12.INVALID_DID_UPDATE,
+            import_common13.INVALID_DID_UPDATE,
             { expected: need.updateHash, actual: updateHash }
           );
         }
@@ -2638,17 +2689,17 @@ var Resolver = class _Resolver {
       }
       case "NeedSMTProof": {
         if (!isSMTProof(data)) {
-          throw new import_common12.ResolveError(
+          throw new import_common13.ResolveError(
             "Provided data for NeedSMTProof is not an SMT proof.",
-            import_common12.INVALID_DID_UPDATE,
+            import_common13.INVALID_DID_UPDATE,
             { kind: need.kind }
           );
         }
-        const proofIdHex = (0, import_common12.encode)((0, import_common12.decode)(data.id, "base64urlnopad"), "hex");
+        const proofIdHex = (0, import_common13.encode)((0, import_common13.decode)(data.id, "base64urlnopad"), "hex");
         if (proofIdHex !== need.smtRootHash) {
-          throw new import_common12.ResolveError(
+          throw new import_common13.ResolveError(
             `SMT proof root hash mismatch: expected ${need.smtRootHash}, got ${proofIdHex}`,
-            import_common12.INVALID_DID_UPDATE,
+            import_common13.INVALID_DID_UPDATE,
             { expected: need.smtRootHash, actual: proofIdHex }
           );
         }
@@ -2663,17 +2714,17 @@ var Resolver = class _Resolver {
 function getAggregationCommunicationKey(document) {
   const invocation = document.capabilityInvocation?.[0];
   if (invocation === void 0) {
-    throw new import_common13.DidDocumentError(
+    throw new import_common14.DidDocumentError(
       "Cannot derive aggregation communication key: capabilityInvocation is absent",
-      import_common13.INVALID_DID_DOCUMENT,
+      import_common14.INVALID_DID_DOCUMENT,
       { id: document.id }
     );
   }
   const vm = typeof invocation === "string" ? document.verificationMethod?.find((method) => method.id === invocation) : invocation;
   if (!vm) {
-    throw new import_common13.DidDocumentError(
+    throw new import_common14.DidDocumentError(
       `Cannot derive aggregation communication key: capabilityInvocation[0] "${invocation}" does not resolve to a verification method`,
-      import_common13.INVALID_DID_DOCUMENT,
+      import_common14.INVALID_DID_DOCUMENT,
       { id: document.id, invocation }
     );
   }
@@ -2695,12 +2746,12 @@ function resolveBtcr2SenderPk(did, opts) {
 }
 
 // src/utils/did-document-builder.ts
-var import_common14 = require("@did-btcr2/common");
+var import_common15 = require("@did-btcr2/common");
 var DidDocumentBuilder = class {
   document = {};
   constructor(initialDocument) {
     if (!initialDocument.id) {
-      throw new import_common14.DidDocumentError('Missing required "id" property', import_common14.INVALID_DID_DOCUMENT, initialDocument);
+      throw new import_common15.DidDocumentError('Missing required "id" property', import_common15.INVALID_DID_DOCUMENT, initialDocument);
     }
     this.document.id = initialDocument.id;
     this.document.verificationMethod = initialDocument.verificationMethod ?? [];
@@ -2790,7 +2841,7 @@ var DidDocumentBuilder = class {
   buildAggregationBeaconTx,
   deriveSingletonAddress,
   detectSingletonScriptKind,
-  extractOpReturnSignal,
+  extractOpReturnSignalHash,
   getAggregationCommunicationKey,
   isMultikeyVerificationMethod,
   opReturnScript,