@did-btcr2/method 0.58.0 → 0.60.0

package/dist/cjs/index.js

@@ -32,6 +32,7 @@ __export(index_exports, {
   CASBeaconError: () => CASBeaconError,
   CHANGE_OUTPUT_VBYTES: () => CHANGE_OUTPUT_VBYTES,
   DEFAULT_FEE_ESTIMATOR: () => DEFAULT_FEE_ESTIMATOR,
+  DEFAULT_MIN_CONF: () => DEFAULT_MIN_CONF,
   DID_REGEX: () => DID_REGEX,
   DUST_LIMIT_SATS: () => DUST_LIMIT_SATS,
   DidBtcr2: () => DidBtcr2,
@@ -169,6 +170,9 @@ function opReturnScript(signalBytes) {
   return import_btc_signer.Script.encode(["RETURN", signalBytes]);
 }
 var SPENDABLE_DUST_LIMIT_SATS = 546;
+function isConfirmedUtxo(utxo) {
+  return utxo.status.confirmed === true;
+}
 function byDepthThenId(a, b) {
   if (a.status.block_height !== b.status.block_height) {
     return a.status.block_height - b.status.block_height;
@@ -184,7 +188,7 @@ function selectSpendableUtxo(utxos, address) {
       { address }
     );
   }
-  const confirmed = utxos.filter((utxo) => utxo.status.confirmed === true);
+  const confirmed = utxos.filter(isConfirmedUtxo);
   const spendable = confirmed.filter((utxo) => utxo.value > SPENDABLE_DUST_LIMIT_SATS);
   if (!spendable.length) {
     const reason = confirmed.length === 0 ? `all ${utxos.length} UTXO(s) are unconfirmed` : `all ${confirmed.length} confirmed UTXO(s) are at or below the ${SPENDABLE_DUST_LIMIT_SATS}-sat dust limit`;
@@ -707,13 +711,13 @@ var BeaconFactory = class {
 };
 
 // src/core/beacon/signal-discovery.ts
-var import_bitcoin3 = require("@did-btcr2/bitcoin");
-var import_common9 = require("@did-btcr2/common");
+var import_bitcoin4 = require("@did-btcr2/bitcoin");
+var import_common10 = require("@did-btcr2/common");
 
 // src/core/beacon/utils.ts
-var import_bitcoin2 = require("@did-btcr2/bitcoin");
-var import_common8 = require("@did-btcr2/common");
-var import_btc_signer2 = require("@scure/btc-signer");
+var import_bitcoin3 = require("@did-btcr2/bitcoin");
+var import_common9 = require("@did-btcr2/common");
+var import_btc_signer3 = require("@scure/btc-signer");
 
 // src/utils/appendix.ts
 var import_dids = require("@web5/dids");
@@ -895,883 +899,1048 @@ var Appendix = class _Appendix {
 };
 
 // src/core/identifier.ts
+var import_common8 = require("@did-btcr2/common");
+var import_keypair2 = require("@did-btcr2/keypair");
+var import_utils4 = require("@noble/curves/utils.js");
+var import_base = require("@scure/base");
+
+// src/utils/did-document.ts
+var import_bitcoin2 = require("@did-btcr2/bitcoin");
 var import_common7 = require("@did-btcr2/common");
 var import_keypair = require("@did-btcr2/keypair");
-var import_base = require("@scure/base");
-var Identifier = class _Identifier {
-  /**
-   * Implements {@link https://dcdpr.github.io/did-btcr2/#didbtcr2-identifier-encoding | 3.2 did:btcr2 Identifier Encoding}.
-   *
-   * A did:btcr2 DID consists of a did:btcr2 prefix, followed by an id-bech32 value, which is a Bech32m encoding of:
-   *  - the specification version;
-   *  - the Bitcoin network identifier; and
-   *  - either:
-   *    - a key-value representing a secp256k1 public key; or
-   *    - a hash-value representing the hash of an initiating external DID document.
-   *
-   * @param {KeyBytes | DocumentBytes} genesisBytes The genesis bytes (public key or document bytes).
-   * @param {DidCreateOptions} options The DID creation options.
-   * @returns {string} The new did:btcr2 identifier.
-   */
-  static encode(genesisBytes, options) {
-    const { idType, version = 1, network = "bitcoin" } = options;
-    if (!(idType in import_common7.IdentifierTypes)) {
-      throw new import_common7.IdentifierError('Expected "idType" to be "KEY" or "EXTERNAL"', import_common7.INVALID_DID, { idType });
-    }
-    if (version !== 1) {
-      throw new import_common7.IdentifierError('Expected "version" to be 1', import_common7.INVALID_DID, { version });
-    }
-    if (typeof network !== "string") {
-      throw new import_common7.IdentifierError('Expected "network" to be a known network name', import_common7.INVALID_DID, { network });
-    }
-    const networkValue = import_common7.BitcoinNetworkNames[network];
-    if (networkValue === void 0) {
-      throw new import_common7.IdentifierError('Invalid "network" name', import_common7.INVALID_DID, { network });
-    }
-    if (idType === "KEY") {
-      try {
-        new import_keypair.CompressedSecp256k1PublicKey(genesisBytes);
-      } catch {
-        throw new import_common7.IdentifierError(
-          'Expected "genesisBytes" to be a valid compressed secp256k1 public key',
-          import_common7.INVALID_DID,
-          { genesisBytes }
-        );
-      }
-    } else if (genesisBytes.length !== 32) {
-      throw new import_common7.IdentifierError(
-        'Expected "genesisBytes" to be a 32-byte hash for EXTERNAL identifiers',
-        import_common7.INVALID_DID,
-        { genesisBytes }
-      );
-    }
-    const hrp = idType === "KEY" ? "k" : "x";
-    const firstByte = version - 1 << 4 | networkValue;
-    const dataBytes = new Uint8Array([firstByte, ...genesisBytes]);
-    return `did:btcr2:${import_base.bech32m.encodeFromBytes(hrp, dataBytes)}`;
+var import_utils3 = require("@web5/dids/utils");
+var import_btc_signer2 = require("@scure/btc-signer");
+var BTCR2_DID_DOCUMENT_CONTEXT = [
+  "https://www.w3.org/ns/did/v1.1",
+  "https://btcr2.dev/context/v1"
+];
+var MULTIKEY_VERIFICATION_METHOD_TYPE = "Multikey";
+var MULTIKEY_PUBLIC_KEY_MULTIBASE_PREFIX = "zQ3s";
+var ID_PLACEHOLDER_VALUE = "did:btcr2:_";
+var BECH32M_CHARS = "";
+var DID_REGEX = /did:btcr2:(x1[qpzry9x8gf2tvdw0s3jn54khce6mua7l]*)/g;
+function isMultikeyVerificationMethod(vm) {
+  if (!Appendix.isDidVerificationMethod(vm)) {
+    return false;
   }
-  /**
-   * Implements {@link https://dcdpr.github.io/did-btcr2/#didbtcr2-identifier-decoding | 3.3 did:btcr2 Identifier Decoding}.
-   * @param {string} identifier The BTCR2 DID to be parsed
-   * @returns {DidComponents} The parsed identifier components. See {@link DidComponents} for details.
-   * @throws {DidError} if an error occurs while parsing the identifier
-   * @throws {DidErrorCode.InvalidDid} if identifier is invalid
-   * @throws {DidErrorCode.MethodNotSupported} if the method is not supported
-   */
-  static decode(identifier) {
-    const components = identifier.split(":");
-    if (components.length !== 3) {
-      throw new import_common7.IdentifierError(`Invalid did: ${identifier}`, import_common7.INVALID_DID, { identifier });
-    }
-    const [scheme, method, encoded] = components;
-    if (scheme !== "did") {
-      throw new import_common7.IdentifierError(`Invalid did: ${identifier}`, import_common7.INVALID_DID, { identifier });
-    }
-    if (method !== "btcr2") {
-      throw new import_common7.IdentifierError(`Invalid did method: ${method}`, import_common7.METHOD_NOT_SUPPORTED, { identifier });
+  const { type, publicKeyMultibase } = vm;
+  return type === MULTIKEY_VERIFICATION_METHOD_TYPE && typeof publicKeyMultibase === "string" && publicKeyMultibase.startsWith(MULTIKEY_PUBLIC_KEY_MULTIBASE_PREFIX);
+}
+var DidVerificationMethod = class {
+  id;
+  type;
+  controller;
+  publicKeyMultibase;
+  secretKeyMultibase;
+  constructor({ id, type, controller, publicKeyMultibase, secretKeyMultibase }) {
+    if (type !== MULTIKEY_VERIFICATION_METHOD_TYPE) {
+      throw new import_common7.DidDocumentError(
+        `Invalid verification method: type must be "${MULTIKEY_VERIFICATION_METHOD_TYPE}"`,
+        import_common7.INVALID_DID_DOCUMENT,
+        { id, type }
+      );
     }
-    if (!encoded) {
-      throw new import_common7.IdentifierError(`Invalid method-specific id: ${identifier}`, import_common7.INVALID_DID, { identifier });
+    if (typeof publicKeyMultibase !== "string" || !publicKeyMultibase.startsWith(MULTIKEY_PUBLIC_KEY_MULTIBASE_PREFIX)) {
+      throw new import_common7.DidDocumentError(
+        `Invalid verification method: publicKeyMultibase must start with "${MULTIKEY_PUBLIC_KEY_MULTIBASE_PREFIX}"`,
+        import_common7.INVALID_DID_DOCUMENT,
+        { id, publicKeyMultibase }
+      );
     }
-    const { prefix: hrp, bytes: dataBytes } = import_base.bech32m.decodeToBytes(encoded);
-    if (!["x", "k"].includes(hrp)) {
-      throw new import_common7.IdentifierError(`Invalid hrp: ${hrp}`, import_common7.INVALID_DID, { identifier });
+    this.id = id;
+    this.type = type;
+    this.controller = controller;
+    this.publicKeyMultibase = publicKeyMultibase;
+    this.secretKeyMultibase = secretKeyMultibase;
+    if (!secretKeyMultibase) {
+      delete this.secretKeyMultibase;
     }
-    if (!dataBytes || dataBytes.length < 1) {
-      throw new import_common7.IdentifierError(`Failed to decode id: ${encoded}`, import_common7.INVALID_DID, { identifier });
+  }
+  // TODO: Add helper methods and properties
+};
+var DidDocument = class _DidDocument {
+  id;
+  "@context" = [
+    "https://www.w3.org/ns/did/v1.1",
+    "https://btcr2.dev/context/v1"
+  ];
+  verificationMethod;
+  authentication;
+  assertionMethod;
+  capabilityInvocation;
+  capabilityDelegation;
+  service;
+  deactivated;
+  constructor(document) {
+    if (!document.id) {
+      throw new import_common7.DidDocumentError("DID Document must have an id", import_common7.INVALID_DID_DOCUMENT, document);
     }
-    const idType = hrp === "k" ? "KEY" : "EXTERNAL";
-    const btcr2Version = dataBytes[0] >>> 4;
-    if (btcr2Version !== 0) {
-      throw new import_common7.IdentifierError(`Invalid btcr2_version (expected 0): ${btcr2Version}`, import_common7.INVALID_DID, { identifier });
+    const idType = document.id.includes("k1") ? import_common7.IdentifierTypes.KEY : import_common7.IdentifierTypes.EXTERNAL;
+    const isGenesis = document.id === ID_PLACEHOLDER_VALUE;
+    const { id, verificationMethod: vm, service } = document;
+    if (!isGenesis) {
+      if (!_DidDocument.isValidId(id)) {
+        throw new import_common7.DidDocumentError(`Invalid id: ${id}`, import_common7.INVALID_DID_DOCUMENT, document);
+      }
+      if (!_DidDocument.isValidVerificationMethods(vm)) {
+        throw new import_common7.DidDocumentError("Invalid verificationMethod: " + vm, import_common7.INVALID_DID_DOCUMENT, document);
+      }
+      if (!_DidDocument.isValidServices(service)) {
+        throw new import_common7.DidDocumentError("Invalid service: " + service, import_common7.INVALID_DID_DOCUMENT, document);
+      }
     }
-    const version = 1;
-    const networkValue = dataBytes[0] & 15;
-    const networkName = import_common7.BitcoinNetworkNames[networkValue];
-    let network;
-    if (typeof networkName === "string") {
-      network = networkName;
-    } else if (networkValue >= 12 && networkValue <= 14) {
-      network = networkValue - 11;
+    this.id = document.id;
+    this.verificationMethod = document.verificationMethod || [];
+    this.service = document.service || [];
+    this["@context"] = document["@context"] || [
+      "https://www.w3.org/ns/did/v1.1",
+      "https://btcr2.dev/context/v1"
+    ];
+    if (idType === import_common7.IdentifierTypes.KEY) {
+      const keyRef = `${this.id}#initialKey`;
+      this.authentication = document.authentication || [keyRef];
+      this.assertionMethod = document.assertionMethod || [keyRef];
+      this.capabilityInvocation = document.capabilityInvocation || [keyRef];
+      this.capabilityDelegation = document.capabilityDelegation || [keyRef];
     } else {
-      throw new import_common7.IdentifierError(`Invalid network: ${networkValue}`, import_common7.INVALID_DID, { identifier });
+      this.authentication = document.authentication;
+      this.assertionMethod = document.assertionMethod;
+      this.capabilityInvocation = document.capabilityInvocation;
+      this.capabilityDelegation = document.capabilityDelegation;
     }
-    const genesisBytes = dataBytes.slice(1);
-    if (idType === "KEY") {
-      try {
-        new import_keypair.CompressedSecp256k1PublicKey(genesisBytes);
-      } catch {
-        throw new import_common7.IdentifierError(`Invalid genesisBytes: ${genesisBytes}`, import_common7.INVALID_DID, { identifier });
-      }
-    } else if (genesisBytes.length !== 32) {
-      throw new import_common7.IdentifierError(`Invalid genesisBytes: ${genesisBytes}`, import_common7.INVALID_DID, { identifier });
+    _DidDocument.sanitize(this);
+    if (isGenesis) {
+      this.validateGenesis();
+    } else {
+      _DidDocument.validate(this);
     }
-    return { idType, hrp, version, network, genesisBytes };
   }
   /**
-   * Generates a new did:btcr2 identifier based on a newly generated key pair.
-   * @returns {string} The new did:btcr2 identifier.
+   * Convert the DidDocument to a JSON object.
+   * @returns {DidDocument} The JSON representation of the DidDocument.
    */
-  static generate() {
-    const keyPair = import_keypair.SchnorrKeyPair.generate();
-    const did = this.encode(
-      keyPair.publicKey.compressed,
-      {
-        idType: "KEY",
-        version: 1,
-        network: "regtest"
-      }
-    );
-    return { keyPair: keyPair.exportJSON(), did };
+  toJSON() {
+    return {
+      id: this.id,
+      "@context": this["@context"],
+      verificationMethod: this.verificationMethod,
+      authentication: this.authentication,
+      assertionMethod: this.assertionMethod,
+      capabilityInvocation: this.capabilityInvocation,
+      capabilityDelegation: this.capabilityDelegation,
+      service: this.service,
+      deactivated: this.deactivated
+    };
   }
   /**
-   * Extracts the compressed secp256k1 public key from a KEY-type did:btcr2 identifier.
-   * @param {string} did The did:btcr2 identifier to extract the public key from.
-   * @returns {CompressedSecp256k1PublicKey} The compressed public key.
-   * @throws {IdentifierError} If the DID is EXTERNAL type (genesis bytes are a hash, not a pubkey).
+   * Create a minimal DidDocument from "k1" btcr2 identifier.
+   * @param {string} publicKeyMultibase The public key in multibase format.
+   * @param {Array<BeaconService>} service The beacon services to be included in the document.
+   * @returns {DidDocument} A new DidDocument with the placeholder ID.
    */
-  static getPublicKey(did) {
-    const { idType, genesisBytes } = _Identifier.decode(did);
-    if (idType !== "KEY") {
-      throw new import_common7.IdentifierError(
-        `Cannot extract public key from EXTERNAL DID: ${did}. EXTERNAL DIDs encode a document hash, not a public key.`,
-        import_common7.INVALID_DID,
-        { did, idType }
-      );
-    }
-    return new import_keypair.CompressedSecp256k1PublicKey(genesisBytes);
+  static fromKeyIdentifier(id, publicKeyMultibase, service) {
+    id = id.includes("#") ? id : `${id}#initialKey`;
+    const document = {
+      id,
+      verificationMethod: [
+        new DidVerificationMethod({
+          id,
+          type: "Multikey",
+          controller: id,
+          publicKeyMultibase
+        })
+      ],
+      service
+    };
+    return new _DidDocument(document);
   }
   /**
-   * Validates a did:btcr2 identifier.
-   * @param {string} identifier The did:btcr2 identifier to validate.
-   * @returns {boolean} True if the identifier is valid, false otherwise.
+   * Create a DidDocument from "x1" btcr2 identifier.
+   * @param {ExternalData} data The verification methods of the DID Document.
+   * @returns {DidDocument} A new DidDocument.
    */
-  static isValid(identifier) {
-    try {
-      this.decode(identifier);
-      return true;
-    } catch {
-      return false;
-    }
+  static fromExternalIdentifier(data) {
+    return new _DidDocument(data);
   }
-};
-
-// src/core/beacon/utils.ts
-var BeaconUtils = class {
   /**
-   * Converts a BIP21 Bitcoin URI to a Bitcoin address
-   * @param {string} uri The BIP21 Bitcoin URI to convert
-   * @returns {string} The Bitcoin address extracted from the URI
-   * @throws {DidMethodError} if the URI is not a valid Bitcoin URI
+   * Sanitize the DID Document by removing undefined values
+   * @returns {DidDocument} The sanitized DID Document
    */
-  static parseBitcoinAddress(uri) {
-    if (!uri.startsWith("bitcoin:")) {
-      throw new import_common8.MethodError("Invalid Bitcoin URI format", "BEACON_SERVICE_ERROR", { uri });
+  static sanitize(doc) {
+    for (const key of Object.keys(doc)) {
+      if (doc[key] === void 0) {
+        delete doc[key];
+      }
     }
-    return uri.replace("bitcoin:", "").split("?")[0];
+    return doc;
   }
   /**
-   * Validates that the given object is a Beacon Service
-   * @param {BeaconService} obj The object to validate
-   * @returns {boolean} A boolean indicating whether the object is a Beacon Service
+   * Validates a DidDocument by breaking it into modular validation methods.
+   * @param {DidDocument} didDocument The DID document to validate.
+   * @returns {boolean} True if the DID document is valid.
+   * @throws {DidDocumentError} If any validation check fails.
    */
-  static isBeaconService(obj) {
-    if (!Appendix.isDidService(obj)) return false;
-    if (!["SingletonBeacon", "CASBeacon", "SMTBeacon"].includes(obj.type)) return false;
-    if ([obj.serviceEndpoint].flat().some((ep) => typeof ep === "string" && !ep.startsWith("bitcoin:"))) return false;
+  static isValid(didDocument) {
+    if (!this.isValidContext(didDocument?.["@context"])) {
+      throw new import_common7.DidDocumentError('Invalid "@context"', import_common7.INVALID_DID_DOCUMENT, didDocument);
+    }
+    if (!this.isValidId(didDocument?.id)) {
+      throw new import_common7.DidDocumentError('Invalid "id"', import_common7.INVALID_DID_DOCUMENT, didDocument);
+    }
+    if (!this.isValidVerificationMethods(didDocument?.verificationMethod)) {
+      throw new import_common7.DidDocumentError('Invalid "verificationMethod"', import_common7.INVALID_DID_DOCUMENT, didDocument);
+    }
+    if (!this.isValidServices(didDocument?.service)) {
+      throw new import_common7.DidDocumentError('Invalid "service"', import_common7.INVALID_DID_DOCUMENT, didDocument);
+    }
+    if (!this.isValidVerificationRelationships(didDocument)) {
+      throw new import_common7.DidDocumentError("Invalid verification relationships", import_common7.INVALID_DID_DOCUMENT, didDocument);
+    }
     return true;
   }
   /**
-   * Extracts the services from a given DID Document
-   * @param {DidDocument} didDocument The DID Document to extract the services from
-   * @returns {DidService[]} An array of DidService objects
-   * @throws {TypeError} if the didDocument is not provided
+   * Validates that "@context" exists and includes correct values.
+   * @private
+   * @param {DidDocument['@context']} context The context to validate.
+   * @returns {boolean} True if the context is valid.
    */
-  static getBeaconServices(didDocument) {
-    return didDocument.service.filter(this.isBeaconService) ?? [];
+  static isValidContext(context) {
+    if (!Array.isArray(context) || context.length === 0) return false;
+    return BTCR2_DID_DOCUMENT_CONTEXT.every((required) => context.includes(required));
   }
   /**
-   * Create the 3 default Beacon Service Endpoints for a given `k` (public-key-based) identifier.
-   * @param {string} did The DID for which to create the beacon services.
-   * @returns {Array<Array<string>>} 2D Array of bitcoin addresses (p2pkh, p2wpkh, p2tr).
-   * @throws {DidMethodError} if the bitcoin address is invalid.
+   * Validates that the DID Document has a valid id.
+   * @private
+   * @param {string} id The id to validate.
+   * @returns {boolean} True if the id is valid.
    */
-  static createBeaconServices(did, beaconType) {
+  static isValidId(id) {
+    if (typeof id !== "string") return false;
     try {
-      const addrTypes = ["p2pkh", "p2wpkh", "p2tr"];
-      return addrTypes.map(
-        (addrType) => this.createBeaconService(did, addrType, beaconType)
-      );
-    } catch (error) {
-      throw new BeaconError(
-        "Failed to create beacon services: " + error.message,
-        "BEACON_SERVICE_ERROR",
-        { did, beaconType }
-      );
+      Identifier.decode(id);
+      return true;
+    } catch {
+      return false;
     }
   }
   /**
-   * Generate a set of Beacon Services for a given public key.
-   * @param {string} did The did for the beacon service.
-   * @param {string} addressType The type of bitcoin address to generate (p2pkh, p2wpkh, p2tr).
-   * @param {string} beaconType The type of beacon service to create.
-   * @returns {BeaconService} A BeaconService object.
-   * @throws {DidMethodError} if the bitcoin address is invalid.
+   * Validates that verification methods exist and are correctly formatted.
+   * @private
+   * @param {DidVerificationMethod[]} verificationMethod The verification methods to validate.
+   * @returns {boolean} True if the verification methods are valid.
    */
-  static createBeaconService(did, addressType, beaconType) {
-    try {
-      const components = Identifier.decode(did);
-      const network = (0, import_bitcoin2.getNetwork)(components.network);
-      const pubkey = components.genesisBytes;
-      const id = `${did}#initial${addressType.toUpperCase()}`;
-      const address = addressType === "p2tr" ? (0, import_btc_signer2.p2tr)(pubkey.slice(1, 33), void 0, network).address : addressType === "p2wpkh" ? (0, import_btc_signer2.p2wpkh)(pubkey, network).address : (0, import_btc_signer2.p2pkh)(pubkey, network).address;
-      const serviceEndpoint = `bitcoin:${address}`;
-      return { id, type: beaconType, serviceEndpoint };
-    } catch (error) {
-      throw new BeaconError(
-        "Failed to create beacon service: " + error.message,
-        "BEACON_SERVICE_ERROR",
-        { did, beaconType }
-      );
-    }
+  static isValidVerificationMethods(verificationMethod) {
+    return Array.isArray(verificationMethod) && verificationMethod.every(isMultikeyVerificationMethod);
   }
   /**
-   * Generate three default Beacon Service Endpoints for a given `k` (public-key-based) identifier.
-   * @param {string} did The DID for which to create the beacon services.
-   * @returns {Array<Array<string>>} 2D Array of bitcoin addresses (p2pkh, p2wpkh, p2tr).
-   * @throws {DidMethodError} if the bitcoin address is invalid.
+   * Validates that the DID Document has valid services.
+   * @private
+   * @param {DidService[]} service The services to validate.
+   * @returns {boolean} True if the services are valid.
    */
-  static generateBeaconServices({ id, publicKey, network, beaconType }) {
-    try {
-      const p2pkhAddr = (0, import_btc_signer2.p2pkh)(publicKey, network).address;
-      const p2wpkhAddr = (0, import_btc_signer2.p2wpkh)(publicKey, network).address;
-      const p2trAddr = (0, import_btc_signer2.p2tr)(publicKey.slice(1, 33), void 0, network).address;
-      if (!p2pkhAddr || !p2wpkhAddr || !p2trAddr) {
-        throw new import_common8.DidMethodError("Failed to generate bitcoin addresses");
-      }
-      return [
-        {
-          id: `${id}#initialP2PKH`,
-          type: beaconType,
-          serviceEndpoint: `bitcoin:${p2pkhAddr}`
-        },
-        {
-          id: `${id}#initialP2WPKH`,
-          type: beaconType,
-          serviceEndpoint: `bitcoin:${p2wpkhAddr}`
-        },
-        {
-          id: `${id}#initialP2TR`,
-          type: beaconType,
-          serviceEndpoint: `bitcoin:${p2trAddr}`
-        }
-      ];
-    } catch (error) {
-      throw new BeaconError(
-        "Failed to create beacon services: " + error.message,
-        "BEACON_SERVICE_ERROR",
-        { id, publicKey, network, beaconType }
+  static isValidServices(service) {
+    return Array.isArray(service) && service.every(import_utils3.isDidService);
+  }
+  /**
+   * Validates verification relationships (authentication, assertionMethod, capabilityInvocation, capabilityDelegation).
+   * @private
+   * @param {DidDocument} didDocument The DID Document to validate.
+   * @returns {boolean} True if the verification relationships are valid.
+   */
+  static isValidVerificationRelationships(didDocument) {
+    const possibleVerificationRelationships = [
+      "authentication",
+      "assertionMethod",
+      "capabilityInvocation",
+      "capabilityDelegation"
+    ];
+    const keys = Object.keys(didDocument);
+    const availableKeys = possibleVerificationRelationships.filter((key) => keys.includes(key));
+    return availableKeys.every((key) => {
+      const value = didDocument[key];
+      return value && Array.isArray(value) && value.every(
+        (entry) => typeof entry === "string" || Appendix.isDidVerificationMethod(entry)
       );
+    });
+  }
+  /**
+   * Validate the DID Document
+   * @returns {DidDocument} Validated DID Document.
+   * @throws {DidDocumentError} If the DID Document is invalid.
+   */
+  static validate(didDocument) {
+    if (didDocument.id === ID_PLACEHOLDER_VALUE) {
+      didDocument.validateGenesis();
+    } else {
+      _DidDocument.isValid(didDocument);
     }
+    return didDocument;
   }
   /**
-   * Convert beacon service endpoints from BIP-21 URIs to addresses.
-   * @param {BeaconService} beacon The beacon service to parse.
-   * @returns {BeaconServiceAddress} The beacon service with the address field extracted from the serviceEndpoint.
+   * Validate the GenesisDocument.
+   * @returns {boolean} True if the GenesisDocument is valid.
    */
-  static parseBeaconServiceEndpoint(beacon) {
-    return { ...beacon, serviceEndpoint: beacon.serviceEndpoint.replace("bitcoin:", "") };
+  validateGenesis() {
+    if (this.id !== ID_PLACEHOLDER_VALUE) {
+      throw new import_common7.DidDocumentError("Invalid GenesisDocument ID", import_common7.INVALID_DID_DOCUMENT, this);
+    }
+    if (!this.verificationMethod.every((vm) => vm.id.includes(ID_PLACEHOLDER_VALUE) && vm.controller === ID_PLACEHOLDER_VALUE)) {
+      throw new import_common7.DidDocumentError("Invalid GenesisDocument verificationMethod", import_common7.INVALID_DID_DOCUMENT, this);
+    }
+    if (!this.service.every((svc) => svc.id.includes(ID_PLACEHOLDER_VALUE))) {
+      throw new import_common7.DidDocumentError("Invalid GenesisDocument service", import_common7.INVALID_DID_DOCUMENT, this);
+    }
+    if (!_DidDocument.isValidVerificationRelationships(this)) {
+      throw new import_common7.DidDocumentError("Invalid GenesisDocument assertionMethod", import_common7.INVALID_DID_DOCUMENT, this);
+    }
+    return true;
   }
   /**
-   * Get the beacon service ids from a list of beacon services.
-   * @param {DidDocument} didDocument The DID Document to extract the services from.
-   * @returns {string[]} An array of beacon service ids.
+   * Convert the DidDocument to an GenesisDocument.
+   * @returns {GenesisDocument} The GenesisDocument representation of the DidDocument.
    */
-  static getBeaconServiceIds(didDocument) {
-    return this.getBeaconServices(didDocument).map((beacon) => beacon.id);
+  toIntermediate() {
+    if (this.id.includes("k1")) {
+      throw new import_common7.DidDocumentError("Cannot convert a key identifier to an intermediate document", import_common7.INVALID_DID_DOCUMENT, this);
+    }
+    return new GenesisDocument(this);
   }
 };
-
-// src/core/beacon/signal-discovery.ts
-var BEACON_SIGNAL_SCRIPT = /^6a20([0-9a-f]{64})$/i;
-function extractOpReturnSignalHash(scriptPubKey) {
-  if (!scriptPubKey) {
-    return null;
-  }
-  const signal = BEACON_SIGNAL_SCRIPT.exec(scriptPubKey.trim());
-  if (!signal) {
-    return null;
+var GenesisDocument = class _GenesisDocument extends DidDocument {
+  constructor(document) {
+    super(document);
   }
-  return signal[1].toLowerCase();
-}
-var BeaconSignalDiscovery = class _BeaconSignalDiscovery {
   /**
-   * Determines whether a candidate transaction spends an output controlled by the given
-   * beacon address.
-   *
-   * A Beacon Signal is a transaction that *spends from* a Beacon Address, but an address
-   * transaction listing returns every transaction touching the address in either
-   * direction. Without this check, anyone able to pay dust to a beacon address could
-   * attach an arbitrary 32-byte OP_RETURN and have it read as a signal, so the input side
-   * has to be inspected before a transaction is treated as one.
-   *
-   * Esplora embeds the spent output in `vin[].prevout`; when a backend omits it the
-   * funding transaction is fetched instead, so a missing field cannot silently drop a
-   * real signal.
-   *
-   * @param {RawTransactionRest} tx The candidate transaction.
-   * @param {string} address The beacon address the transaction must spend from.
-   * @param {BitcoinConnection} bitcoin Bitcoin network connection to use for REST calls.
-   * @returns {Promise<boolean>} True if at least one input spends an output of the beacon address.
+   * Convert the GenesisDocument to a DidDocument by replacing the placeholder value with the provided DID.
+   * @param did The DID to replace the placeholder value in the document.
+   * @returns {DidDocument} A new DidDocument with the placeholder value replaced by the provided DID.
    */
-  static async spendsFromAddress(tx, address, bitcoin) {
-    for (const vin of tx.vin ?? []) {
-      if (vin.is_coinbase) {
-        continue;
-      }
-      let prevout = vin.prevout;
-      if (!prevout && vin.txid) {
-        const fundingTx = await bitcoin.rest.transaction.get(vin.txid);
-        prevout = fundingTx?.vout?.[vin.vout];
-      }
-      if (prevout?.scriptpubkey_address === address) {
-        return true;
-      }
-    }
-    return false;
+  toDidDocument(did) {
+    const stringThis = JSON.stringify(this).replaceAll(ID_PLACEHOLDER_VALUE, did);
+    const parseThis = JSON.parse(stringThis);
+    return new DidDocument(parseThis);
   }
   /**
-   * Retrieves the beacon signals for the given array of BeaconService objects
-   * using an esplora/electrs REST API connection via a bitcoin I/O driver.
-   * @param {Array<BeaconService>} beaconServices Array of BeaconService objects to retrieve signals for
-   * @param {BitcoinConnection} bitcoin Bitcoin network connection to use for REST calls
-   * @returns {Promise<Map<BeaconService, Array<BeaconSignal>>>} Map of beacon service to its discovered signals
+   * Create an GenesisDocument from a DidDocument by replacing the DID with a placeholder value.
+   * @param {DidDocument} didDocument The DidDocument to convert.
+   * @returns {GenesisDocument} The GenesisDocument representation of the DidDocument.
    */
-  static async indexer(beaconServices, bitcoin) {
-    const beaconServiceSignals = /* @__PURE__ */ new Map();
-    const currentBlockCount = await bitcoin.rest.block.count();
-    for (const beaconService of beaconServices) {
-      beaconServiceSignals.set(beaconService, []);
-      const beaconAddress = BeaconUtils.parseBitcoinAddress(beaconService.serviceEndpoint);
-      const beaconSignals = await bitcoin.rest.address.getTxs(beaconAddress);
-      if (!beaconSignals || !beaconSignals.length) {
-        continue;
-      }
-      for (const beaconSignal of beaconSignals) {
-        const lastSignalVout = beaconSignal.vout.slice(-1)[0];
-        if (!lastSignalVout) {
-          continue;
-        }
-        const updateHash = extractOpReturnSignalHash(lastSignalVout.scriptpubkey);
-        if (!updateHash) {
-          continue;
-        }
-        if (!await _BeaconSignalDiscovery.spendsFromAddress(beaconSignal, beaconAddress, bitcoin)) {
-          continue;
-        }
-        const confirmations = currentBlockCount - beaconSignal.status.block_height + 1;
-        beaconServiceSignals.get(beaconService)?.push({
-          tx: beaconSignal,
-          signalBytes: updateHash,
-          blockMetadata: {
-            confirmations,
-            height: beaconSignal.status.block_height,
-            time: beaconSignal.status.block_time
-          }
-        });
-      }
-    }
-    return beaconServiceSignals;
+  static fromDidDocument(didDocument) {
+    const intermediateDocument = import_common7.JSONUtils.cloneReplace(didDocument, DID_REGEX, ID_PLACEHOLDER_VALUE);
+    return new _GenesisDocument(intermediateDocument);
   }
   /**
-   * Traverse the full blockchain from genesis to chain top looking for beacon signals.
-   * @param {Array<BeaconService>} beaconServices Array of BeaconService objects to search for signals.
-   * @param {BitcoinConnection} bitcoin Bitcoin network connection to use for RPC calls.
-   * @returns {Promise<Map<BeaconService, Array<BeaconSignal>>>} Map of beacon service to its discovered signals.
+   * Create a minimal GenesisDocument with a placeholder ID.
+   * @param {Array<DidVerificationMethod>} verificationMethod The public key in multibase format.
+   * @param {VerificationRelationships} relationships The public key in multibase format.
+   * @param {Array<BeaconService>} service The service to be included in the document.
+   * @returns {GenesisDocument} A new GenesisDocument with the placeholder ID.
    */
-  static async fullnode(beaconServices, bitcoin) {
-    const beaconServiceSignals = /* @__PURE__ */ new Map();
-    for (const beaconService of beaconServices) {
-      beaconServiceSignals.set(beaconService, []);
-    }
-    const rpc = bitcoin.rpc;
-    if (!rpc) {
-      throw new import_common9.ResolveError("RPC connection is not available", "RPC_CONNECTION_ERROR", bitcoin);
-    }
-    const targetHeight = await rpc.getBlockCount();
-    const beaconServicesMap = new Map(
-      beaconServices.map((service) => [BeaconUtils.parseBitcoinAddress(service.serviceEndpoint), service])
-    );
-    let height = 0;
-    let block = await bitcoin.rpc.getBlock({ height });
-    console.info(`Searching for beacon signals, please wait ...`);
-    while (block.height <= targetHeight) {
-      for (const tx of block.tx) {
-        if (tx.txid === import_bitcoin3.GENESIS_TX_ID) {
-          continue;
-        }
-        const lastSignalVout = tx.vout.slice(-1)[0];
-        if (!lastSignalVout) {
-          continue;
-        }
-        const updateHash = extractOpReturnSignalHash(lastSignalVout.scriptPubKey?.hex);
-        if (!updateHash) {
-          continue;
-        }
-        const signaled = /* @__PURE__ */ new Set();
-        for (const vin of tx.vin) {
-          if (vin.coinbase) {
-            continue;
-          }
-          if (vin.txinwitness && vin.txinwitness.length === 1 && vin.txinwitness[0] === import_bitcoin3.TXIN_WITNESS_COINBASE) {
-            continue;
-          }
-          if (!vin.txid) {
-            continue;
-          }
-          if (vin.vout === void 0) {
-            continue;
-          }
-          const prevout = await rpc.getRawTransaction(vin.txid, 2);
-          if (!prevout.vout[vin.vout]) {
-            continue;
-          }
-          const scriptPubKey = prevout.vout[vin.vout].scriptPubKey;
-          if (!scriptPubKey.address) {
-            continue;
-          }
-          const beaconService = beaconServicesMap.get(scriptPubKey.address);
-          if (!beaconService || signaled.has(beaconService)) {
-            continue;
-          }
-          signaled.add(beaconService);
-          console.info(`Tx ${tx.txid} contains beacon address ${scriptPubKey.address}`);
-          beaconServiceSignals.get(beaconService)?.push({
-            tx,
-            signalBytes: updateHash,
-            blockMetadata: {
-              height: block.height,
-              time: block.time,
-              confirmations: block.confirmations
-            }
-          });
-        }
-        ;
-      }
-      height += 1;
-      if (height > targetHeight) {
-        console.info(`Chain tip reached ${height}, breaking ...`);
-        break;
-      }
-      block = await rpc.getBlock({ height });
-    }
-    return beaconServiceSignals;
-  }
-};
-
-// src/core/did-sender-resolver.ts
-var import_common14 = require("@did-btcr2/common");
-var import_cryptosuite3 = require("@did-btcr2/cryptosuite");
-var import_keypair4 = require("@did-btcr2/keypair");
-
-// src/core/resolver.ts
-var import_bitcoin5 = require("@did-btcr2/bitcoin");
-var import_common13 = require("@did-btcr2/common");
-var import_cryptosuite2 = require("@did-btcr2/cryptosuite");
-var import_keypair3 = require("@did-btcr2/keypair");
-
-// src/did-btcr2.ts
-var import_common12 = require("@did-btcr2/common");
-var import_dids2 = require("@web5/dids");
-
-// src/core/updater.ts
-var import_common11 = require("@did-btcr2/common");
-var import_cryptosuite = require("@did-btcr2/cryptosuite");
-
-// src/utils/did-document.ts
-var import_bitcoin4 = require("@did-btcr2/bitcoin");
-var import_common10 = require("@did-btcr2/common");
-var import_keypair2 = require("@did-btcr2/keypair");
-var import_utils4 = require("@web5/dids/utils");
-var import_btc_signer3 = require("@scure/btc-signer");
-var BTCR2_DID_DOCUMENT_CONTEXT = [
-  "https://www.w3.org/ns/did/v1.1",
-  "https://btcr2.dev/context/v1"
-];
-var MULTIKEY_VERIFICATION_METHOD_TYPE = "Multikey";
-var MULTIKEY_PUBLIC_KEY_MULTIBASE_PREFIX = "zQ3s";
-var ID_PLACEHOLDER_VALUE = "did:btcr2:_";
-var BECH32M_CHARS = "";
-var DID_REGEX = /did:btcr2:(x1[qpzry9x8gf2tvdw0s3jn54khce6mua7l]*)/g;
-function isMultikeyVerificationMethod(vm) {
-  if (!Appendix.isDidVerificationMethod(vm)) {
-    return false;
-  }
-  const { type, publicKeyMultibase } = vm;
-  return type === MULTIKEY_VERIFICATION_METHOD_TYPE && typeof publicKeyMultibase === "string" && publicKeyMultibase.startsWith(MULTIKEY_PUBLIC_KEY_MULTIBASE_PREFIX);
-}
-var DidVerificationMethod = class {
-  id;
-  type;
-  controller;
-  publicKeyMultibase;
-  secretKeyMultibase;
-  constructor({ id, type, controller, publicKeyMultibase, secretKeyMultibase }) {
-    if (type !== MULTIKEY_VERIFICATION_METHOD_TYPE) {
-      throw new import_common10.DidDocumentError(
-        `Invalid verification method: type must be "${MULTIKEY_VERIFICATION_METHOD_TYPE}"`,
-        import_common10.INVALID_DID_DOCUMENT,
-        { id, type }
-      );
-    }
-    if (typeof publicKeyMultibase !== "string" || !publicKeyMultibase.startsWith(MULTIKEY_PUBLIC_KEY_MULTIBASE_PREFIX)) {
-      throw new import_common10.DidDocumentError(
-        `Invalid verification method: publicKeyMultibase must start with "${MULTIKEY_PUBLIC_KEY_MULTIBASE_PREFIX}"`,
-        import_common10.INVALID_DID_DOCUMENT,
-        { id, publicKeyMultibase }
-      );
-    }
-    this.id = id;
-    this.type = type;
-    this.controller = controller;
-    this.publicKeyMultibase = publicKeyMultibase;
-    this.secretKeyMultibase = secretKeyMultibase;
-    if (!secretKeyMultibase) {
-      delete this.secretKeyMultibase;
-    }
+  static create(verificationMethod, relationships, service) {
+    return new _GenesisDocument({ id: ID_PLACEHOLDER_VALUE, ...relationships, verificationMethod, service });
   }
-  // TODO: Add helper methods and properties
-};
-var DidDocument = class _DidDocument {
-  id;
-  "@context" = [
-    "https://www.w3.org/ns/did/v1.1",
-    "https://btcr2.dev/context/v1"
-  ];
-  verificationMethod;
-  authentication;
-  assertionMethod;
-  capabilityInvocation;
-  capabilityDelegation;
-  service;
-  deactivated;
-  constructor(document) {
-    if (!document.id) {
-      throw new import_common10.DidDocumentError("DID Document must have an id", import_common10.INVALID_DID_DOCUMENT, document);
-    }
-    const idType = document.id.includes("k1") ? import_common10.IdentifierTypes.KEY : import_common10.IdentifierTypes.EXTERNAL;
-    const isGenesis = document.id === ID_PLACEHOLDER_VALUE;
-    const { id, verificationMethod: vm, service } = document;
-    if (!isGenesis) {
-      if (!_DidDocument.isValidId(id)) {
-        throw new import_common10.DidDocumentError(`Invalid id: ${id}`, import_common10.INVALID_DID_DOCUMENT, document);
-      }
-      if (!_DidDocument.isValidVerificationMethods(vm)) {
-        throw new import_common10.DidDocumentError("Invalid verificationMethod: " + vm, import_common10.INVALID_DID_DOCUMENT, document);
-      }
-      if (!_DidDocument.isValidServices(service)) {
-        throw new import_common10.DidDocumentError("Invalid service: " + service, import_common10.INVALID_DID_DOCUMENT, document);
+  /**
+   * Create a minimal GenesisDocument from a public key.
+   * @param {KeyBytes} publicKey The public key in bytes format.
+   * @returns {GenesisDocument} A new GenesisDocument with the placeholder ID.
+   */
+  static fromPublicKey(publicKey, network) {
+    const pk = new import_keypair.CompressedSecp256k1PublicKey(publicKey);
+    const id = ID_PLACEHOLDER_VALUE;
+    const address = (0, import_btc_signer2.p2pkh)(pk.compressed, (0, import_bitcoin2.getNetwork)(network)).address;
+    const services = [{
+      id: `${id}#service-0`,
+      serviceEndpoint: `bitcoin:${address}`,
+      type: "SingletonBeacon"
+    }];
+    const relationships = {
+      authentication: [`${id}#key-0`],
+      assertionMethod: [`${id}#key-0`],
+      capabilityInvocation: [`${id}#key-0`],
+      capabilityDelegation: [`${id}#key-0`]
+    };
+    const verificationMethod = [
+      {
+        id: `${id}#key-0`,
+        type: "Multikey",
+        controller: id,
+        publicKeyMultibase: pk.multibase.encoded
       }
-    }
-    this.id = document.id;
-    this.verificationMethod = document.verificationMethod || [];
-    this.service = document.service || [];
-    this["@context"] = document["@context"] || [
-      "https://www.w3.org/ns/did/v1.1",
-      "https://btcr2.dev/context/v1"
     ];
-    if (idType === import_common10.IdentifierTypes.KEY) {
-      const keyRef = `${this.id}#initialKey`;
-      this.authentication = document.authentication || [keyRef];
-      this.assertionMethod = document.assertionMethod || [keyRef];
-      this.capabilityInvocation = document.capabilityInvocation || [keyRef];
-      this.capabilityDelegation = document.capabilityDelegation || [keyRef];
-    } else {
-      this.authentication = document.authentication;
-      this.assertionMethod = document.assertionMethod;
-      this.capabilityInvocation = document.capabilityInvocation;
-      this.capabilityDelegation = document.capabilityDelegation;
-    }
-    _DidDocument.sanitize(this);
-    if (isGenesis) {
-      this.validateGenesis();
-    } else {
-      _DidDocument.validate(this);
-    }
+    return _GenesisDocument.create(verificationMethod, relationships, services);
   }
   /**
-   * Convert the DidDocument to a JSON object.
-   * @returns {DidDocument} The JSON representation of the DidDocument.
+   * Taken an object, convert it to an IntermediateDocuemnt and then to a DidDocument.
+   * @param {object | DidDocument} object The JSON object to convert.
+   * @returns {DidDocument} The created DidDocument.
    */
-  toJSON() {
-    return {
-      id: this.id,
-      "@context": this["@context"],
-      verificationMethod: this.verificationMethod,
-      authentication: this.authentication,
-      assertionMethod: this.assertionMethod,
-      capabilityInvocation: this.capabilityInvocation,
-      capabilityDelegation: this.capabilityDelegation,
-      service: this.service,
-      deactivated: this.deactivated
-    };
+  static fromJSON(object) {
+    return new _GenesisDocument(object);
   }
   /**
-   * Create a minimal DidDocument from "k1" btcr2 identifier.
-   * @param {string} publicKeyMultibase The public key in multibase format.
-   * @param {Array<BeaconService>} service The beacon services to be included in the document.
-   * @returns {DidDocument} A new DidDocument with the placeholder ID.
+   * Convert a GenesisDocument to genesis bytes.
+   * @param {GenesisDocument} genesisDocument The GenesisDocument to convert.
+   * @returns {Bytes} The genesis bytes.
    */
-  static fromKeyIdentifier(id, publicKeyMultibase, service) {
-    id = id.includes("#") ? id : `${id}#initialKey`;
-    const document = {
-      id,
-      verificationMethod: [
-        new DidVerificationMethod({
-          id,
-          type: "Multikey",
-          controller: id,
-          publicKeyMultibase
-        })
-      ],
-      service
-    };
-    return new _DidDocument(document);
+  static toGenesisBytes(genesisDocument) {
+    return (0, import_common7.hash)((0, import_common7.canonicalize)(genesisDocument));
   }
+};
+
+// src/core/identifier.ts
+var DID_PREFIX = "did:btcr2:";
+var Identifier = class _Identifier {
   /**
-   * Create a DidDocument from "x1" btcr2 identifier.
-   * @param {ExternalData} data The verification methods of the DID Document.
-   * @returns {DidDocument} A new DidDocument.
+   * Implements {@link https://dcdpr.github.io/did-btcr2/#didbtcr2-identifier-encoding | 3.2 did:btcr2 Identifier Encoding}.
+   *
+   * A did:btcr2 DID consists of a did:btcr2 prefix, followed by an id-bech32 value, which is a Bech32m encoding of:
+   *  - the specification version;
+   *  - the Bitcoin network identifier; and
+   *  - either:
+   *    - a key-value representing a secp256k1 public key; or
+   *    - a hash-value representing the hash of an initiating external DID document.
+   *
+   * @param {KeyBytes | DocumentBytes} genesisBytes The genesis bytes (public key or document bytes).
+   * @param {DidCreateOptions} options The DID creation options.
+   * @returns {string} The new did:btcr2 identifier.
    */
-  static fromExternalIdentifier(data) {
-    return new _DidDocument(data);
+  static encode(genesisBytes, options) {
+    const { idType, version = 1, network = "bitcoin" } = options;
+    if (!(idType in import_common8.IdentifierTypes)) {
+      throw new import_common8.IdentifierError('Expected "idType" to be "KEY" or "EXTERNAL"', import_common8.INVALID_DID, { idType });
+    }
+    if (version !== 1) {
+      throw new import_common8.IdentifierError('Expected "version" to be 1', import_common8.INVALID_DID, { version });
+    }
+    if (typeof network !== "string") {
+      throw new import_common8.IdentifierError('Expected "network" to be a known network name', import_common8.INVALID_DID, { network });
+    }
+    const networkValue = import_common8.BitcoinNetworkNames[network];
+    if (networkValue === void 0) {
+      throw new import_common8.IdentifierError('Invalid "network" name', import_common8.INVALID_DID, { network });
+    }
+    if (idType === "KEY") {
+      try {
+        new import_keypair2.CompressedSecp256k1PublicKey(genesisBytes);
+      } catch {
+        throw new import_common8.IdentifierError(
+          'Expected "genesisBytes" to be a valid compressed secp256k1 public key',
+          import_common8.INVALID_DID,
+          { genesisBytes }
+        );
+      }
+    } else if (genesisBytes.length !== 32) {
+      throw new import_common8.IdentifierError(
+        'Expected "genesisBytes" to be a 32-byte hash for EXTERNAL identifiers',
+        import_common8.INVALID_DID,
+        { genesisBytes }
+      );
+    }
+    const hrp = idType === "KEY" ? "k" : "x";
+    const firstByte = version - 1 << 4 | networkValue;
+    const dataBytes = new Uint8Array([firstByte, ...genesisBytes]);
+    return `${DID_PREFIX}${import_base.bech32m.encodeFromBytes(hrp, dataBytes)}`;
   }
   /**
-   * Sanitize the DID Document by removing undefined values
-   * @returns {DidDocument} The sanitized DID Document
+   * Implements {@link https://dcdpr.github.io/did-btcr2/#didbtcr2-identifier-decoding | 3.3 did:btcr2 Identifier Decoding}.
+   * @param {string} identifier The BTCR2 DID to be parsed
+   * @returns {DidComponents} The parsed identifier components. See {@link DidComponents} for details.
+   * @throws {DidError} if an error occurs while parsing the identifier
+   * @throws {DidErrorCode.InvalidDid} if identifier is invalid
+   * @throws {DidErrorCode.MethodNotSupported} if the method is not supported
    */
-  static sanitize(doc) {
-    for (const key of Object.keys(doc)) {
-      if (doc[key] === void 0) {
-        delete doc[key];
+  static decode(identifier) {
+    const components = identifier.split(":");
+    if (components.length !== 3) {
+      throw new import_common8.IdentifierError(`Invalid did: ${identifier}`, import_common8.INVALID_DID, { identifier });
+    }
+    const [scheme, method, encoded] = components;
+    if (scheme !== "did") {
+      throw new import_common8.IdentifierError(`Invalid did: ${identifier}`, import_common8.INVALID_DID, { identifier });
+    }
+    if (method !== "btcr2") {
+      throw new import_common8.IdentifierError(`Invalid did method: ${method}`, import_common8.METHOD_NOT_SUPPORTED, { identifier });
+    }
+    if (!encoded) {
+      throw new import_common8.IdentifierError(`Invalid method-specific id: ${identifier}`, import_common8.INVALID_DID, { identifier });
+    }
+    if (encoded !== encoded.toLowerCase()) {
+      throw new import_common8.IdentifierError(`Invalid method-specific id (must be lowercase): ${identifier}`, import_common8.INVALID_DID, { identifier });
+    }
+    const { prefix: hrp, bytes: dataBytes } = import_base.bech32m.decodeToBytes(encoded);
+    if (!["x", "k"].includes(hrp)) {
+      throw new import_common8.IdentifierError(`Invalid hrp: ${hrp}`, import_common8.INVALID_DID, { identifier });
+    }
+    if (!dataBytes || dataBytes.length < 1) {
+      throw new import_common8.IdentifierError(`Failed to decode id: ${encoded}`, import_common8.INVALID_DID, { identifier });
+    }
+    const idType = hrp === "k" ? "KEY" : "EXTERNAL";
+    const btcr2Version = dataBytes[0] >>> 4;
+    if (btcr2Version !== 0) {
+      throw new import_common8.IdentifierError(`Invalid btcr2_version (expected 0): ${btcr2Version}`, import_common8.INVALID_DID, { identifier });
+    }
+    const version = 1;
+    const networkValue = dataBytes[0] & 15;
+    const network = import_common8.BitcoinNetworkNames[networkValue];
+    if (typeof network !== "string") {
+      const reason = networkValue >= 12 ? "custom network not supported" : "reserved";
+      throw new import_common8.IdentifierError(`Invalid network (${reason}): ${networkValue}`, import_common8.INVALID_DID, { identifier });
+    }
+    const genesisBytes = dataBytes.slice(1);
+    if (idType === "KEY") {
+      try {
+        new import_keypair2.CompressedSecp256k1PublicKey(genesisBytes);
+      } catch {
+        throw new import_common8.IdentifierError(`Invalid genesisBytes: ${genesisBytes}`, import_common8.INVALID_DID, { identifier });
       }
+    } else if (genesisBytes.length !== 32) {
+      throw new import_common8.IdentifierError(`Invalid genesisBytes: ${genesisBytes}`, import_common8.INVALID_DID, { identifier });
     }
-    return doc;
+    return { idType, hrp, version, network, genesisBytes };
   }
   /**
-   * Validates a DidDocument by breaking it into modular validation methods.
-   * @param {DidDocument} didDocument The DID document to validate.
-   * @returns {boolean} True if the DID document is valid.
-   * @throws {DidDocumentError} If any validation check fails.
+   * Validates that a did:btcr2 identifier conforms to
+   * {@link https://dcdpr.github.io/did-btcr2/#didbtcr2-identifier-decoding | 3.3 did:btcr2 Identifier Decoding}
+   * and returns a report of the checks. The method does not throw on an invalid identifier.
+   *
+   * The checks run in this order: `prefix`, `lowercase`, `bech32m`, `version`, `network`,
+   * `genesisBytes`, `roundTrip`, `genesisBytesMatch`, and `genesisDocument`. The run stops at the
+   * first failed check. The `network` check accepts a named network only: a reserved value (6 to
+   * 11) and a custom value (12 to 15) fail, because this implementation supports no custom network.
+   * The `genesisBytesMatch` check runs only if `options.genesisBytes` is present: the supplied bytes
+   * must equal the genesis bytes of the identifier, for a KEY or an EXTERNAL identifier. The
+   * `genesisDocument` check runs only if `options.genesisDocument` is present. For an EXTERNAL
+   * identifier it confirms that the document is a valid Genesis Document and that its canonical
+   * SHA-256 hash equals the genesis bytes. For a KEY identifier it fails.
+   *
+   * @param {string} identifier The did:btcr2 identifier to validate.
+   * @param {IdentifierValidateOptions} [options] The validation options.
+   * @returns {IdentifierReport} The report. See {@link IdentifierReport} for details.
    */
-  static isValid(didDocument) {
-    if (!this.isValidContext(didDocument?.["@context"])) {
-      throw new import_common10.DidDocumentError('Invalid "@context"', import_common10.INVALID_DID_DOCUMENT, didDocument);
+  static validate(identifier, options = {}) {
+    const checks = [];
+    const pass = (name, detail) => {
+      checks.push(detail === void 0 ? { name, ok: true } : { name, ok: true, detail });
+    };
+    const fail = (name, detail, partial = {}) => {
+      checks.push({ name, ok: false, detail });
+      return { did: identifier, valid: false, ...partial, checks };
+    };
+    if (typeof identifier !== "string") {
+      return fail("prefix", "The identifier is not a string.");
     }
-    if (!this.isValidId(didDocument?.id)) {
-      throw new import_common10.DidDocumentError('Invalid "id"', import_common10.INVALID_DID_DOCUMENT, didDocument);
+    const parts = identifier.split(":");
+    if (parts.length !== 3 || parts[0] !== "did" || parts[1] !== "btcr2") {
+      return fail("prefix", `The identifier must be "${DID_PREFIX}" followed by the method-specific id.`);
     }
-    if (!this.isValidVerificationMethods(didDocument?.verificationMethod)) {
-      throw new import_common10.DidDocumentError('Invalid "verificationMethod"', import_common10.INVALID_DID_DOCUMENT, didDocument);
+    const encoded = parts[2];
+    if (encoded.length === 0) {
+      return fail("prefix", "The method-specific id is empty.");
     }
-    if (!this.isValidServices(didDocument?.service)) {
-      throw new import_common10.DidDocumentError('Invalid "service"', import_common10.INVALID_DID_DOCUMENT, didDocument);
+    pass("prefix");
+    if (encoded !== encoded.toLowerCase()) {
+      return fail("lowercase", "The method-specific id must be lowercase.");
     }
-    if (!this.isValidVerificationRelationships(didDocument)) {
-      throw new import_common10.DidDocumentError("Invalid verification relationships", import_common10.INVALID_DID_DOCUMENT, didDocument);
+    pass("lowercase");
+    let hrp;
+    let dataBytes;
+    try {
+      ({ prefix: hrp, bytes: dataBytes } = import_base.bech32m.decodeToBytes(encoded));
+    } catch (error) {
+      return fail("bech32m", `Bech32m decoding failed: ${error instanceof Error ? error.message : String(error)}`);
     }
-    return true;
+    if (hrp !== "k" && hrp !== "x") {
+      return fail("bech32m", `The hrp must be "k" or "x", got "${hrp}".`);
+    }
+    const idType = hrp === "k" ? import_common8.IdentifierTypes.KEY : import_common8.IdentifierTypes.EXTERNAL;
+    if (dataBytes.length < 1) {
+      return fail("bech32m", "The data bytes are empty.", { idType });
+    }
+    pass("bech32m", `hrp "${hrp}", ${dataBytes.length} data bytes`);
+    const btcr2Version = dataBytes[0] >>> 4;
+    if (btcr2Version !== 0) {
+      return fail("version", `btcr2_version must be 0, got ${btcr2Version}.`, { idType });
+    }
+    pass("version", "btcr2_version 0 (version_number 1)");
+    const networkValue = dataBytes[0] & 15;
+    const network = import_common8.BitcoinNetworkNames[networkValue];
+    if (typeof network !== "string") {
+      const detail = networkValue >= 12 ? `network_value ${networkValue} is a custom network, not supported by this implementation.` : `network_value ${networkValue} is reserved.`;
+      return fail("network", detail, { idType });
+    }
+    pass("network", `network_value ${networkValue} (${network})`);
+    const genesisBytes = dataBytes.slice(1);
+    if (idType === import_common8.IdentifierTypes.KEY) {
+      try {
+        new import_keypair2.CompressedSecp256k1PublicKey(genesisBytes);
+      } catch {
+        return fail(
+          "genesisBytes",
+          `Expected a 33-byte SEC compressed secp256k1 public key, got ${genesisBytes.length} bytes that are not a valid key.`,
+          { idType, network }
+        );
+      }
+      pass("genesisBytes", "33-byte SEC compressed secp256k1 public key");
+    } else {
+      if (genesisBytes.length !== 32) {
+        return fail("genesisBytes", `Expected a 32-byte SHA-256 hash, got ${genesisBytes.length} bytes.`, { idType, network });
+      }
+      pass("genesisBytes", "32-byte SHA-256 hash");
+    }
+    let reEncoded;
+    try {
+      reEncoded = _Identifier.encode(genesisBytes, { idType, version: 1, network });
+    } catch (error) {
+      return fail("roundTrip", `Re-encoding failed: ${error instanceof Error ? error.message : String(error)}`, { idType, network });
+    }
+    if (reEncoded !== identifier) {
+      return fail("roundTrip", `Re-encoding produced "${reEncoded}".`, { idType, network });
+    }
+    pass("roundTrip");
+    if (options.genesisBytes !== void 0) {
+      const supplied = options.genesisBytes;
+      if (!(supplied instanceof Uint8Array)) {
+        return fail("genesisBytesMatch", "The supplied genesis bytes are not a Uint8Array.", { idType, network });
+      }
+      if (supplied.length !== genesisBytes.length) {
+        return fail(
+          "genesisBytesMatch",
+          `Expected ${genesisBytes.length} genesis bytes for a ${idType} identifier, got ${supplied.length}.`,
+          { idType, network }
+        );
+      }
+      if (!(0, import_utils4.equalBytes)(supplied, genesisBytes)) {
+        return fail(
+          "genesisBytesMatch",
+          `The supplied genesis bytes ${import_base.hex.encode(supplied)} do not equal the genesis bytes of the identifier ${import_base.hex.encode(genesisBytes)}.`,
+          { idType, network }
+        );
+      }
+      pass("genesisBytesMatch", "The supplied genesis bytes equal the genesis bytes of the identifier.");
+    }
+    if (options.genesisDocument !== void 0) {
+      const document = options.genesisDocument;
+      if (idType === import_common8.IdentifierTypes.KEY) {
+        return fail("genesisDocument", "A KEY identifier has no genesis document.", { idType, network });
+      }
+      const id = document.id;
+      if (id !== ID_PLACEHOLDER_VALUE) {
+        return fail("genesisDocument", `The genesis document id must be "${ID_PLACEHOLDER_VALUE}", got ${JSON.stringify(id)}.`, { idType, network });
+      }
+      try {
+        GenesisDocument.fromJSON(document);
+      } catch (error) {
+        return fail("genesisDocument", `Invalid genesis document: ${error instanceof Error ? error.message : String(error)}`, { idType, network });
+      }
+      const documentHash = (0, import_common8.canonicalHashBytes)(document);
+      if (!(0, import_utils4.equalBytes)(documentHash, genesisBytes)) {
+        return fail(
+          "genesisDocument",
+          `The genesis document hash ${import_base.hex.encode(documentHash)} does not equal the genesis bytes ${import_base.hex.encode(genesisBytes)}.`,
+          { idType, network }
+        );
+      }
+      pass("genesisDocument", "The genesis document hashes to the genesis bytes.");
+    }
+    return { did: identifier, valid: true, idType, network, checks };
   }
   /**
-   * Validates that "@context" exists and includes correct values.
-   * @private
-   * @param {DidDocument['@context']} context The context to validate.
-   * @returns {boolean} True if the context is valid.
+   * Generates a new did:btcr2 identifier based on a newly generated key pair.
+   * @returns {string} The new did:btcr2 identifier.
    */
-  static isValidContext(context) {
-    if (!Array.isArray(context) || context.length === 0) return false;
-    return BTCR2_DID_DOCUMENT_CONTEXT.every((required) => context.includes(required));
+  static generate() {
+    const keyPair = import_keypair2.SchnorrKeyPair.generate();
+    const did = this.encode(
+      keyPair.publicKey.compressed,
+      {
+        idType: "KEY",
+        version: 1,
+        network: "regtest"
+      }
+    );
+    return { keyPair: keyPair.exportJSON(), did };
   }
   /**
-   * Validates that the DID Document has a valid id.
-   * @private
-   * @param {string} id The id to validate.
-   * @returns {boolean} True if the id is valid.
+   * Extracts the compressed secp256k1 public key from a KEY-type did:btcr2 identifier.
+   * @param {string} did The did:btcr2 identifier to extract the public key from.
+   * @returns {CompressedSecp256k1PublicKey} The compressed public key.
+   * @throws {IdentifierError} If the DID is EXTERNAL type (genesis bytes are a hash, not a pubkey).
    */
-  static isValidId(id) {
-    if (typeof id !== "string") return false;
+  static getPublicKey(did) {
+    const { idType, genesisBytes } = _Identifier.decode(did);
+    if (idType !== "KEY") {
+      throw new import_common8.IdentifierError(
+        `Cannot extract public key from EXTERNAL DID: ${did}. EXTERNAL DIDs encode a document hash, not a public key.`,
+        import_common8.INVALID_DID,
+        { did, idType }
+      );
+    }
+    return new import_keypair2.CompressedSecp256k1PublicKey(genesisBytes);
+  }
+  /**
+   * Validates a did:btcr2 identifier.
+   * @param {string} identifier The did:btcr2 identifier to validate.
+   * @returns {boolean} True if the identifier is valid, false otherwise.
+   */
+  static isValid(identifier) {
     try {
-      Identifier.decode(id);
+      this.decode(identifier);
       return true;
     } catch {
       return false;
     }
   }
+};
+
+// src/core/beacon/utils.ts
+var BeaconUtils = class {
   /**
-   * Validates that verification methods exist and are correctly formatted.
-   * @private
-   * @param {DidVerificationMethod[]} verificationMethod The verification methods to validate.
-   * @returns {boolean} True if the verification methods are valid.
-   */
-  static isValidVerificationMethods(verificationMethod) {
-    return Array.isArray(verificationMethod) && verificationMethod.every(isMultikeyVerificationMethod);
-  }
-  /**
-   * Validates that the DID Document has valid services.
-   * @private
-   * @param {DidService[]} service The services to validate.
-   * @returns {boolean} True if the services are valid.
+   * Converts a BIP21 Bitcoin URI to a Bitcoin address
+   * @param {string} uri The BIP21 Bitcoin URI to convert
+   * @returns {string} The Bitcoin address extracted from the URI
+   * @throws {DidMethodError} if the URI is not a valid Bitcoin URI
    */
-  static isValidServices(service) {
-    return Array.isArray(service) && service.every(import_utils4.isDidService);
+  static parseBitcoinAddress(uri) {
+    if (!uri.startsWith("bitcoin:")) {
+      throw new import_common9.MethodError("Invalid Bitcoin URI format", "BEACON_SERVICE_ERROR", { uri });
+    }
+    return uri.replace("bitcoin:", "").split("?")[0];
   }
   /**
-   * Validates verification relationships (authentication, assertionMethod, capabilityInvocation, capabilityDelegation).
-   * @private
-   * @param {DidDocument} didDocument The DID Document to validate.
-   * @returns {boolean} True if the verification relationships are valid.
+   * Validates that the given object is a Beacon Service
+   * @param {BeaconService} obj The object to validate
+   * @returns {boolean} A boolean indicating whether the object is a Beacon Service
    */
-  static isValidVerificationRelationships(didDocument) {
-    const possibleVerificationRelationships = [
-      "authentication",
-      "assertionMethod",
-      "capabilityInvocation",
-      "capabilityDelegation"
-    ];
-    const keys = Object.keys(didDocument);
-    const availableKeys = possibleVerificationRelationships.filter((key) => keys.includes(key));
-    return availableKeys.every((key) => {
-      const value = didDocument[key];
-      return value && Array.isArray(value) && value.every(
-        (entry) => typeof entry === "string" || Appendix.isDidVerificationMethod(entry)
-      );
-    });
+  static isBeaconService(obj) {
+    if (!Appendix.isDidService(obj)) return false;
+    if (!["SingletonBeacon", "CASBeacon", "SMTBeacon"].includes(obj.type)) return false;
+    if ([obj.serviceEndpoint].flat().some((ep) => typeof ep === "string" && !ep.startsWith("bitcoin:"))) return false;
+    return true;
   }
   /**
-   * Validate the DID Document
-   * @returns {DidDocument} Validated DID Document.
-   * @throws {DidDocumentError} If the DID Document is invalid.
+   * Extracts the services from a given DID Document
+   * @param {DidDocument} didDocument The DID Document to extract the services from
+   * @returns {DidService[]} An array of DidService objects
+   * @throws {TypeError} if the didDocument is not provided
    */
-  static validate(didDocument) {
-    if (didDocument.id === ID_PLACEHOLDER_VALUE) {
-      didDocument.validateGenesis();
-    } else {
-      _DidDocument.isValid(didDocument);
-    }
-    return didDocument;
+  static getBeaconServices(didDocument) {
+    return didDocument.service.filter(this.isBeaconService) ?? [];
   }
   /**
-   * Validate the GenesisDocument.
-   * @returns {boolean} True if the GenesisDocument is valid.
+   * Create the 3 default Beacon Service Endpoints for a given `k` (public-key-based) identifier.
+   * @param {string} did The DID for which to create the beacon services.
+   * @returns {Array<Array<string>>} 2D Array of bitcoin addresses (p2pkh, p2wpkh, p2tr).
+   * @throws {DidMethodError} if the bitcoin address is invalid.
    */
-  validateGenesis() {
-    if (this.id !== ID_PLACEHOLDER_VALUE) {
-      throw new import_common10.DidDocumentError("Invalid GenesisDocument ID", import_common10.INVALID_DID_DOCUMENT, this);
-    }
-    if (!this.verificationMethod.every((vm) => vm.id.includes(ID_PLACEHOLDER_VALUE) && vm.controller === ID_PLACEHOLDER_VALUE)) {
-      throw new import_common10.DidDocumentError("Invalid GenesisDocument verificationMethod", import_common10.INVALID_DID_DOCUMENT, this);
-    }
-    if (!this.service.every((svc) => svc.id.includes(ID_PLACEHOLDER_VALUE))) {
-      throw new import_common10.DidDocumentError("Invalid GenesisDocument service", import_common10.INVALID_DID_DOCUMENT, this);
-    }
-    if (!_DidDocument.isValidVerificationRelationships(this)) {
-      throw new import_common10.DidDocumentError("Invalid GenesisDocument assertionMethod", import_common10.INVALID_DID_DOCUMENT, this);
+  static createBeaconServices(did, beaconType) {
+    try {
+      const addrTypes = ["p2pkh", "p2wpkh", "p2tr"];
+      return addrTypes.map(
+        (addrType) => this.createBeaconService(did, addrType, beaconType)
+      );
+    } catch (error) {
+      throw new BeaconError(
+        "Failed to create beacon services: " + error.message,
+        "BEACON_SERVICE_ERROR",
+        { did, beaconType }
+      );
     }
-    return true;
   }
   /**
-   * Convert the DidDocument to an GenesisDocument.
-   * @returns {GenesisDocument} The GenesisDocument representation of the DidDocument.
+   * Generate a set of Beacon Services for a given public key.
+   * @param {string} did The did for the beacon service.
+   * @param {string} addressType The type of bitcoin address to generate (p2pkh, p2wpkh, p2tr).
+   * @param {string} beaconType The type of beacon service to create.
+   * @returns {BeaconService} A BeaconService object.
+   * @throws {DidMethodError} if the bitcoin address is invalid.
    */
-  toIntermediate() {
-    if (this.id.includes("k1")) {
-      throw new import_common10.DidDocumentError("Cannot convert a key identifier to an intermediate document", import_common10.INVALID_DID_DOCUMENT, this);
+  static createBeaconService(did, addressType, beaconType) {
+    try {
+      const components = Identifier.decode(did);
+      const network = (0, import_bitcoin3.getNetwork)(components.network);
+      const pubkey = components.genesisBytes;
+      const id = `${did}#initial${addressType.toUpperCase()}`;
+      const address = addressType === "p2tr" ? (0, import_btc_signer3.p2tr)(pubkey.slice(1, 33), void 0, network).address : addressType === "p2wpkh" ? (0, import_btc_signer3.p2wpkh)(pubkey, network).address : (0, import_btc_signer3.p2pkh)(pubkey, network).address;
+      const serviceEndpoint = `bitcoin:${address}`;
+      return { id, type: beaconType, serviceEndpoint };
+    } catch (error) {
+      throw new BeaconError(
+        "Failed to create beacon service: " + error.message,
+        "BEACON_SERVICE_ERROR",
+        { did, beaconType }
+      );
     }
-    return new GenesisDocument(this);
-  }
-};
-var GenesisDocument = class _GenesisDocument extends DidDocument {
-  constructor(document) {
-    super(document);
   }
   /**
-   * Convert the GenesisDocument to a DidDocument by replacing the placeholder value with the provided DID.
-   * @param did The DID to replace the placeholder value in the document.
-   * @returns {DidDocument} A new DidDocument with the placeholder value replaced by the provided DID.
+   * Generate three default Beacon Service Endpoints for a given `k` (public-key-based) identifier.
+   * @param {string} did The DID for which to create the beacon services.
+   * @returns {Array<Array<string>>} 2D Array of bitcoin addresses (p2pkh, p2wpkh, p2tr).
+   * @throws {DidMethodError} if the bitcoin address is invalid.
    */
-  toDidDocument(did) {
-    const stringThis = JSON.stringify(this).replaceAll(ID_PLACEHOLDER_VALUE, did);
-    const parseThis = JSON.parse(stringThis);
-    return new DidDocument(parseThis);
+  static generateBeaconServices({ id, publicKey, network, beaconType }) {
+    try {
+      const p2pkhAddr = (0, import_btc_signer3.p2pkh)(publicKey, network).address;
+      const p2wpkhAddr = (0, import_btc_signer3.p2wpkh)(publicKey, network).address;
+      const p2trAddr = (0, import_btc_signer3.p2tr)(publicKey.slice(1, 33), void 0, network).address;
+      if (!p2pkhAddr || !p2wpkhAddr || !p2trAddr) {
+        throw new import_common9.DidMethodError("Failed to generate bitcoin addresses");
+      }
+      return [
+        {
+          id: `${id}#initialP2PKH`,
+          type: beaconType,
+          serviceEndpoint: `bitcoin:${p2pkhAddr}`
+        },
+        {
+          id: `${id}#initialP2WPKH`,
+          type: beaconType,
+          serviceEndpoint: `bitcoin:${p2wpkhAddr}`
+        },
+        {
+          id: `${id}#initialP2TR`,
+          type: beaconType,
+          serviceEndpoint: `bitcoin:${p2trAddr}`
+        }
+      ];
+    } catch (error) {
+      throw new BeaconError(
+        "Failed to create beacon services: " + error.message,
+        "BEACON_SERVICE_ERROR",
+        { id, publicKey, network, beaconType }
+      );
+    }
   }
   /**
-   * Create an GenesisDocument from a DidDocument by replacing the DID with a placeholder value.
-   * @param {DidDocument} didDocument The DidDocument to convert.
-   * @returns {GenesisDocument} The GenesisDocument representation of the DidDocument.
+   * Convert beacon service endpoints from BIP-21 URIs to addresses.
+   * @param {BeaconService} beacon The beacon service to parse.
+   * @returns {BeaconServiceAddress} The beacon service with the address field extracted from the serviceEndpoint.
    */
-  static fromDidDocument(didDocument) {
-    const intermediateDocument = import_common10.JSONUtils.cloneReplace(didDocument, DID_REGEX, ID_PLACEHOLDER_VALUE);
-    return new _GenesisDocument(intermediateDocument);
+  static parseBeaconServiceEndpoint(beacon) {
+    return { ...beacon, serviceEndpoint: beacon.serviceEndpoint.replace("bitcoin:", "") };
   }
   /**
-   * Create a minimal GenesisDocument with a placeholder ID.
-   * @param {Array<DidVerificationMethod>} verificationMethod The public key in multibase format.
-   * @param {VerificationRelationships} relationships The public key in multibase format.
-   * @param {Array<BeaconService>} service The service to be included in the document.
-   * @returns {GenesisDocument} A new GenesisDocument with the placeholder ID.
+   * Get the beacon service ids from a list of beacon services.
+   * @param {DidDocument} didDocument The DID Document to extract the services from.
+   * @returns {string[]} An array of beacon service ids.
    */
-  static create(verificationMethod, relationships, service) {
-    return new _GenesisDocument({ id: ID_PLACEHOLDER_VALUE, ...relationships, verificationMethod, service });
+  static getBeaconServiceIds(didDocument) {
+    return this.getBeaconServices(didDocument).map((beacon) => beacon.id);
+  }
+};
+
+// src/core/beacon/signal-discovery.ts
+var BEACON_SIGNAL_SCRIPT = /^6a20([0-9a-f]{64})$/i;
+function extractOpReturnSignalHash(scriptPubKey) {
+  if (!scriptPubKey) {
+    return null;
+  }
+  const signal = BEACON_SIGNAL_SCRIPT.exec(scriptPubKey.trim());
+  if (!signal) {
+    return null;
   }
+  return signal[1].toLowerCase();
+}
+var BeaconSignalDiscovery = class _BeaconSignalDiscovery {
   /**
-   * Create a minimal GenesisDocument from a public key.
-   * @param {KeyBytes} publicKey The public key in bytes format.
-   * @returns {GenesisDocument} A new GenesisDocument with the placeholder ID.
+   * Determines whether a candidate transaction spends an output controlled by the given
+   * beacon address.
+   *
+   * A Beacon Signal is a transaction that *spends from* a Beacon Address, but an address
+   * transaction listing returns every transaction touching the address in either
+   * direction. Without this check, anyone able to pay dust to a beacon address could
+   * attach an arbitrary 32-byte OP_RETURN and have it read as a signal, so the input side
+   * has to be inspected before a transaction is treated as one.
+   *
+   * Esplora embeds the spent output in `vin[].prevout`; when a backend omits it the
+   * funding transaction is fetched instead, so a missing field cannot silently drop a
+   * real signal.
+   *
+   * @param {RawTransactionRest} tx The candidate transaction.
+   * @param {string} address The beacon address the transaction must spend from.
+   * @param {BitcoinConnection} bitcoin Bitcoin network connection to use for REST calls.
+   * @returns {Promise<boolean>} True if at least one input spends an output of the beacon address.
    */
-  static fromPublicKey(publicKey, network) {
-    const pk = new import_keypair2.CompressedSecp256k1PublicKey(publicKey);
-    const id = ID_PLACEHOLDER_VALUE;
-    const address = (0, import_btc_signer3.p2pkh)(pk.compressed, (0, import_bitcoin4.getNetwork)(network)).address;
-    const services = [{
-      id: `${id}#service-0`,
-      serviceEndpoint: `bitcoin:${address}`,
-      type: "SingletonBeacon"
-    }];
-    const relationships = {
-      authentication: [`${id}#key-0`],
-      assertionMethod: [`${id}#key-0`],
-      capabilityInvocation: [`${id}#key-0`],
-      capabilityDelegation: [`${id}#key-0`]
-    };
-    const verificationMethod = [
-      {
-        id: `${id}#key-0`,
-        type: "Multikey",
-        controller: id,
-        publicKeyMultibase: pk.multibase.encoded
+  static async spendsFromAddress(tx, address, bitcoin) {
+    for (const vin of tx.vin ?? []) {
+      if (vin.is_coinbase) {
+        continue;
       }
-    ];
-    return _GenesisDocument.create(verificationMethod, relationships, services);
+      let prevout = vin.prevout;
+      if (!prevout && vin.txid) {
+        const fundingTx = await bitcoin.rest.transaction.get(vin.txid);
+        prevout = fundingTx?.vout?.[vin.vout];
+      }
+      if (prevout?.scriptpubkey_address === address) {
+        return true;
+      }
+    }
+    return false;
   }
   /**
-   * Taken an object, convert it to an IntermediateDocuemnt and then to a DidDocument.
-   * @param {object | DidDocument} object The JSON object to convert.
-   * @returns {DidDocument} The created DidDocument.
+   * Retrieves the beacon signals for the given array of BeaconService objects
+   * using an esplora/electrs REST API connection via a bitcoin I/O driver.
+   *
+   * The address listing includes mempool transactions. The method skips a
+   * transaction whose `status.confirmed` is not `true`. A mempool transaction
+   * has no block height and no block time, so it cannot carry block metadata.
+   * The specification also says that a resolver must not process an
+   * unconfirmed transaction. An absent flag counts as unconfirmed, as it does
+   * for UTXO selection. The check runs before the OP_RETURN parse, so a
+   * mempool transaction costs no prevout fetch. The {@link fullnode} path
+   * needs no such check: it walks mined blocks only.
+   *
+   * The `confirmations` count uses the block count fetched before the listing.
+   * A block that arrives between the two calls yields a count of `0` for its
+   * transactions. The resolver then excludes them, because its minimum is at
+   * least `1`. An under-count is the safe direction, so keep that order.
+   * @param {Array<BeaconService>} beaconServices Array of BeaconService objects to retrieve signals for
+   * @param {BitcoinConnection} bitcoin Bitcoin network connection to use for REST calls
+   * @returns {Promise<Map<BeaconService, Array<BeaconSignal>>>} Map of beacon service to its discovered signals
    */
-  static fromJSON(object) {
-    return new _GenesisDocument(object);
+  static async indexer(beaconServices, bitcoin) {
+    const beaconServiceSignals = /* @__PURE__ */ new Map();
+    const currentBlockCount = await bitcoin.rest.block.count();
+    for (const beaconService of beaconServices) {
+      beaconServiceSignals.set(beaconService, []);
+      const beaconAddress = BeaconUtils.parseBitcoinAddress(beaconService.serviceEndpoint);
+      const beaconSignals = await bitcoin.rest.address.getTxs(beaconAddress);
+      if (!beaconSignals || !beaconSignals.length) {
+        continue;
+      }
+      for (const beaconSignal of beaconSignals) {
+        const status = beaconSignal.status;
+        if (status.confirmed !== true) {
+          continue;
+        }
+        const lastSignalVout = beaconSignal.vout.slice(-1)[0];
+        if (!lastSignalVout) {
+          continue;
+        }
+        const updateHash = extractOpReturnSignalHash(lastSignalVout.scriptpubkey);
+        if (!updateHash) {
+          continue;
+        }
+        if (!await _BeaconSignalDiscovery.spendsFromAddress(beaconSignal, beaconAddress, bitcoin)) {
+          continue;
+        }
+        const confirmations = currentBlockCount - status.block_height + 1;
+        beaconServiceSignals.get(beaconService)?.push({
+          tx: beaconSignal,
+          signalBytes: updateHash,
+          blockMetadata: {
+            confirmations,
+            height: status.block_height,
+            time: status.block_time
+          }
+        });
+      }
+    }
+    return beaconServiceSignals;
   }
   /**
-   * Convert a GenesisDocument to genesis bytes.
-   * @param {GenesisDocument} genesisDocument The GenesisDocument to convert.
-   * @returns {Bytes} The genesis bytes.
+   * Traverse the full blockchain from genesis to chain top looking for beacon signals.
+   * @param {Array<BeaconService>} beaconServices Array of BeaconService objects to search for signals.
+   * @param {BitcoinConnection} bitcoin Bitcoin network connection to use for RPC calls.
+   * @returns {Promise<Map<BeaconService, Array<BeaconSignal>>>} Map of beacon service to its discovered signals.
    */
-  static toGenesisBytes(genesisDocument) {
-    return (0, import_common10.hash)((0, import_common10.canonicalize)(genesisDocument));
+  static async fullnode(beaconServices, bitcoin) {
+    const beaconServiceSignals = /* @__PURE__ */ new Map();
+    for (const beaconService of beaconServices) {
+      beaconServiceSignals.set(beaconService, []);
+    }
+    const rpc = bitcoin.rpc;
+    if (!rpc) {
+      throw new import_common10.ResolveError("RPC connection is not available", "RPC_CONNECTION_ERROR", bitcoin);
+    }
+    const targetHeight = await rpc.getBlockCount();
+    const beaconServicesMap = new Map(
+      beaconServices.map((service) => [BeaconUtils.parseBitcoinAddress(service.serviceEndpoint), service])
+    );
+    let height = 0;
+    let block = await bitcoin.rpc.getBlock({ height });
+    console.info(`Searching for beacon signals, please wait ...`);
+    while (block.height <= targetHeight) {
+      for (const tx of block.tx) {
+        if (tx.txid === import_bitcoin4.GENESIS_TX_ID) {
+          continue;
+        }
+        const lastSignalVout = tx.vout.slice(-1)[0];
+        if (!lastSignalVout) {
+          continue;
+        }
+        const updateHash = extractOpReturnSignalHash(lastSignalVout.scriptPubKey?.hex);
+        if (!updateHash) {
+          continue;
+        }
+        const signaled = /* @__PURE__ */ new Set();
+        for (const vin of tx.vin) {
+          if (vin.coinbase) {
+            continue;
+          }
+          if (vin.txinwitness && vin.txinwitness.length === 1 && vin.txinwitness[0] === import_bitcoin4.TXIN_WITNESS_COINBASE) {
+            continue;
+          }
+          if (!vin.txid) {
+            continue;
+          }
+          if (vin.vout === void 0) {
+            continue;
+          }
+          const prevout = await rpc.getRawTransaction(vin.txid, 2);
+          if (!prevout.vout[vin.vout]) {
+            continue;
+          }
+          const scriptPubKey = prevout.vout[vin.vout].scriptPubKey;
+          if (!scriptPubKey.address) {
+            continue;
+          }
+          const beaconService = beaconServicesMap.get(scriptPubKey.address);
+          if (!beaconService || signaled.has(beaconService)) {
+            continue;
+          }
+          signaled.add(beaconService);
+          console.info(`Tx ${tx.txid} contains beacon address ${scriptPubKey.address}`);
+          beaconServiceSignals.get(beaconService)?.push({
+            tx,
+            signalBytes: updateHash,
+            blockMetadata: {
+              height: block.height,
+              time: block.time,
+              confirmations: block.confirmations
+            }
+          });
+        }
+        ;
+      }
+      height += 1;
+      if (height > targetHeight) {
+        console.info(`Chain tip reached ${height}, breaking ...`);
+        break;
+      }
+      block = await rpc.getBlock({ height });
+    }
+    return beaconServiceSignals;
   }
 };
 
+// src/core/did-sender-resolver.ts
+var import_common14 = require("@did-btcr2/common");
+var import_cryptosuite3 = require("@did-btcr2/cryptosuite");
+var import_keypair4 = require("@did-btcr2/keypair");
+
+// src/core/resolver.ts
+var import_bitcoin5 = require("@did-btcr2/bitcoin");
+var import_common13 = require("@did-btcr2/common");
+var import_cryptosuite2 = require("@did-btcr2/cryptosuite");
+var import_keypair3 = require("@did-btcr2/keypair");
+
+// src/did-btcr2.ts
+var import_common12 = require("@did-btcr2/common");
+var import_dids2 = require("@web5/dids");
+
 // src/core/updater.ts
+var import_common11 = require("@did-btcr2/common");
+var import_cryptosuite = require("@did-btcr2/cryptosuite");
 var Updater = class _Updater {
   #state = { phase: "Construct" };
   #sourceDocument;
@@ -2116,7 +2285,8 @@ var DidBtcr2 = class {
       versionId: resolutionOptions.versionId,
       versionTime: resolutionOptions.versionTime,
       genesisDocument: resolutionOptions.sidecar?.genesisDocument,
-      maxDiscoveryRounds: resolutionOptions.maxDiscoveryRounds
+      maxDiscoveryRounds: resolutionOptions.maxDiscoveryRounds,
+      minConf: resolutionOptions.minConf
     });
   }
   /**
@@ -2230,7 +2400,8 @@ var DidBtcr2 = class {
 };
 
 // src/core/resolver.ts
-var import_utils6 = require("@noble/curves/utils.js");
+var import_utils7 = require("@noble/curves/utils.js");
+var DEFAULT_MIN_CONF = 6;
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -2245,6 +2416,16 @@ function isSMTProof(value) {
   if (!isRecord(value)) return false;
   return typeof value.id === "string" && typeof value.collapsed === "string" && Array.isArray(value.hashes);
 }
+function validateMinConf(value) {
+  if (value === void 0) return DEFAULT_MIN_CONF;
+  if (typeof value === "number" && Number.isInteger(value) && value >= 1) return value;
+  const shown = typeof value === "string" ? JSON.stringify(value) : String(value);
+  throw new import_common13.ResolveError(
+    `Invalid resolution option minConf: expected a positive integer (minimum 1), got ${shown}.`,
+    import_common13.INVALID_OPTIONS,
+    { minConf: value }
+  );
+}
 var Resolver = class _Resolver {
   // --- Immutable inputs ---
   #didComponents;
@@ -2284,6 +2465,14 @@ var Resolver = class _Resolver {
   #maxDiscoveryRounds;
   /** Count of beacon-discovery passes driven by updates adding new beacon services. */
   #discoveryRounds = 0;
+  /**
+   * Minimum block confirmations a Beacon Signal must have before this resolver
+   * processes it: `ResolutionOptions.minConf`, default {@link DEFAULT_MIN_CONF}.
+   * Applied at signal intake in the BeaconProcess phase. A signal below the
+   * threshold is excluded from the resolution; the rest of the signals are
+   * processed.
+   */
+  #minConf;
   /**
    * @internal Use {@link DidBtcr2.resolve} to create instances.
    */
@@ -2295,6 +2484,7 @@ var Resolver = class _Resolver {
     this.#versionTime = options?.versionTime;
     const rounds = options?.maxDiscoveryRounds;
     this.#maxDiscoveryRounds = typeof rounds === "number" && rounds > 0 ? rounds : Infinity;
+    this.#minConf = validateMinConf(options?.minConf);
     if (options?.genesisDocument) {
       this.#providedGenesisDocument = options.genesisDocument;
     }
@@ -2335,7 +2525,7 @@ var Resolver = class _Resolver {
    */
   static external(didComponents, genesisDocument) {
     const genesisDocumentHash = (0, import_common13.canonicalHashBytes)(genesisDocument);
-    if (!(0, import_utils6.equalBytes)(didComponents.genesisBytes, genesisDocumentHash)) {
+    if (!(0, import_utils7.equalBytes)(didComponents.genesisBytes, genesisDocumentHash)) {
       throw new import_common13.ResolveError(
         `Initial document mismatch: genesisBytes !== genesisDocumentHash`,
         import_common13.INVALID_DID_DOCUMENT,
@@ -2384,6 +2574,10 @@ var Resolver = class _Resolver {
    *   Version counter and update-hash history carried from earlier discovery rounds.
    *   Standalone callers omit it and start fresh at version 1 with an empty history.
    * @returns {DidResolutionResponse} The updated DID Document, number of confirmations, and version id.
+   *
+   * Confirmation depth is not checked here. The BeaconProcess phase excludes a
+   * signal below `ResolutionOptions.minConf` before its update reaches this method,
+   * so every tuple here comes from a block at or above the threshold.
    */
   static updates(currentDocument, unsortedUpdates, versionTime, versionId, resolutionState = { currentVersionId: 1, updateHashHistory: [] }) {
     let currentVersionId = resolutionState.currentVersionId;
@@ -2416,7 +2610,7 @@ var Resolver = class _Resolver {
       }
       if (update.targetVersionId === currentVersionId + 1) {
         const sourceHashBytes = (0, import_common13.decode)(update.sourceHash, "base64urlnopad");
-        if (!(0, import_utils6.equalBytes)(sourceHashBytes, currentDocumentHash)) {
+        if (!(0, import_utils7.equalBytes)(sourceHashBytes, currentDocumentHash)) {
           throw new import_common13.ResolveError(
             `Hash mismatch: update.sourceHash !== currentDocumentHash`,
             import_common13.INVALID_DID_UPDATE,
@@ -2480,7 +2674,7 @@ var Resolver = class _Resolver {
         }
       );
     }
-    if (!(0, import_utils6.equalBytes)(historicalUpdateHash, unsignedUpdateHash)) {
+    if (!(0, import_utils7.equalBytes)(historicalUpdateHash, unsignedUpdateHash)) {
       throw new import_common13.ResolveError(
         `Invalid duplicate: unsigned update hash does not match historical hash`,
         import_common13.LATE_PUBLISHING_ERROR,
@@ -2547,7 +2741,7 @@ var Resolver = class _Resolver {
     DidDocument.validate(updatedDocument);
     const currentDocumentHash = (0, import_common13.canonicalHashBytes)(updatedDocument);
     const updateTargetHash = (0, import_common13.decode)(update.targetHash);
-    if (!(0, import_utils6.equalBytes)(updateTargetHash, currentDocumentHash)) {
+    if (!(0, import_utils7.equalBytes)(updateTargetHash, currentDocumentHash)) {
       throw new import_common13.ResolveError(
         `Invalid update: update.targetHash !== currentDocumentHash`,
         import_common13.INVALID_DID_UPDATE,
@@ -2611,8 +2805,10 @@ var Resolver = class _Resolver {
           const allNeeds = [];
           for (const [service, signals] of this.#beaconServicesSignals) {
             if (this.#processedServices.has(service.id) || !signals.length) continue;
+            const eligible = this.#eligibleSignals(signals);
+            if (!eligible.length) continue;
             const beacon = BeaconFactory.establish(service, this.#currentDocument.id);
-            const result = beacon.processSignals(signals, this.#sidecarData);
+            const result = beacon.processSignals(eligible, this.#sidecarData);
             if (result.needs.length > 0) {
               allNeeds.push(...result.needs);
             } else {
@@ -2676,6 +2872,41 @@ var Resolver = class _Resolver {
       }
     }
   }
+  /**
+   * Return the signals of one beacon service that resolution may process: the
+   * signals with at least `#minConf` confirmations. The specification removes a
+   * transaction below the threshold from the set of Beacon Signals, so an
+   * excluded signal emits no data need and applies no update. A signal with no
+   * integer confirmation count is excluded too: that is a mempool transaction
+   * from a driver that did not skip it.
+   *
+   * An eligible signal must carry a finite block height and block time. A
+   * signal that passes the count but lacks them is malformed. It fails fast
+   * here with a typed error, in the style of the {@link provide} guards, and
+   * not later with an invalid date inside {@link updates}.
+   * @param {Array<BeaconSignal>} signals The signals the caller provided for one service.
+   * @returns {Array<BeaconSignal>} The signals at or above the threshold, in the given order.
+   * @throws {ResolveError} `INVALID_DID_UPDATE` for an eligible signal with no valid block metadata.
+   */
+  #eligibleSignals(signals) {
+    const eligible = [];
+    for (const signal of signals) {
+      const block = signal.blockMetadata;
+      const confirmations = block?.confirmations;
+      if (!Number.isInteger(confirmations) || confirmations < this.#minConf) {
+        continue;
+      }
+      if (!Number.isFinite(block?.height) || !Number.isFinite(block?.time)) {
+        throw new import_common13.ResolveError(
+          `Beacon signal ${signal.signalBytes} has ${confirmations} confirmations but no valid block height or block time.`,
+          import_common13.INVALID_DID_UPDATE,
+          { signalBytes: signal.signalBytes, confirmations, height: block?.height, time: block?.time }
+        );
+      }
+      eligible.push(signal);
+    }
+    return eligible;
+  }
   provide(need, data) {
     switch (need.kind) {
       case "NeedGenesisDocument": {
@@ -2869,6 +3100,7 @@ var DidDocumentBuilder = class {
   CASBeaconError,
   CHANGE_OUTPUT_VBYTES,
   DEFAULT_FEE_ESTIMATOR,
+  DEFAULT_MIN_CONF,
   DID_REGEX,
   DUST_LIMIT_SATS,
   DidBtcr2,