@qntx/spark 0.0.0-stage → 0.1.1

package/dist/signer.mjs

@@ -0,0 +1,1024 @@
+import { n as SparkError, r as SparkInputError, t as SparkCryptoError } from "./errors-5xLkExNL.mjs";
+import { At as SecretShareSchema, B as parseTransaction, F as checkIfValidSequence, H as taprootScriptSpendSighash, It as SparkInvoiceFieldsSchema, K as PartialTokenTransactionSchema, Mt as SendLeafKeyTweaksSchema, Q as ChallengeSchema, R as getTimelockFromSequence, V as taprootKeySpendSighash, bt as ClaimPackageSchema, c as staticDepositStatementDigest, ct as uint64be, d as LIGHTNING_HTLC_SEQUENCE, et as hashSparkInvoice, ft as requireLength, g as lightningHtlcOutputScript, i as claimPackageDigest, jt as SendLeafKeyTweakSchema, l as transferPackageDigest, m as createSequenceLockScript, mt as sparkNetworkConfig, n as hashPartialTokenTransaction, nt as protoInvoiceToPlain, o as sendLeafSigningDigest, r as authnChallengeDigest, s as sspChallengeDigest, u as watchtowerRecoveryStatementDigest, vt as ClaimLeafKeyTweakSchema, yt as ClaimLeafKeyTweaksSchema, zt as TransferPackageSchema } from "./token-DmojVTWi.mjs";
+import { i as lightningAddressMessageDigest, r as lightningAddressMessage } from "./lightning-address-CZrb8x4p.mjs";
+import "./crypto.mjs";
+import { bytesToHex, concatBytes, hexToBytes, utf8ToBytes } from "@noble/hashes/utils.js";
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
+import { schnorr, secp256k1 } from "@noble/curves/secp256k1.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { taprootTweakPrivKey } from "@scure/btc-signer/utils.js";
+import { HDKey } from "@scure/bip32";
+import { hmac } from "@noble/hashes/hmac.js";
+const VSS_PROOF_LENGTH = 33;
+const VSS_SHARE_LENGTH = 32;
+const IDENTIFIER_PATTERN = /^[0-9a-f]{64}$/;
+/**
+* The local backend is synchronous; awaiting a resolved promise keeps every method async so callers
+* always observe rejections, never synchronous throws.
+*/
+const ready = Promise.resolve();
+function unreachable(message) {
+	throw new SparkError(message);
+}
+function checkBatch(count, name) {
+	if (count > 256) throw new SparkInputError(`${name}: at most 256 items per call`);
+}
+/** Backend failures keep their ABI code; anything else becomes SparkCryptoError(8). */
+function backendCall(call) {
+	try {
+		return call();
+	} catch (error) {
+		if (error instanceof SparkCryptoError) throw error;
+		const code = typeof error === "object" && error !== null && "code" in error && typeof error.code === "number" ? error.code : 8;
+		throw new SparkCryptoError(code, { cause: error });
+	}
+}
+function randomBytes(random, length) {
+	const bytes = random(length);
+	if (bytes.length !== length) throw new SparkError(`random: expected ${length} bytes, got ${bytes.length}`);
+	return bytes;
+}
+/**
+* Draws `length` bytes of caller-supplied randomness for a single backend call, then wipes the
+* seed. The seed is secret-equivalent material: it determines FROST nonces, the VSS polynomial, and
+* the ECIES ephemeral key — knowing it undoes the secret the call protects.
+*/
+function withRandom(random, length, use) {
+	const seed = randomBytes(random, length);
+	try {
+		return use(seed);
+	} finally {
+		seed.fill(0);
+	}
+}
+/** A fresh 32-byte scalar, retrying on the (negligible) chance the RNG output is invalid. */
+function randomScalar(random) {
+	for (;;) {
+		const scalar = randomBytes(random, 32);
+		if (secp256k1.utils.isValidSecretKey(scalar)) return scalar;
+		scalar.fill(0);
+	}
+}
+function identifierBytes(identifier) {
+	if (!IDENTIFIER_PATTERN.test(identifier)) throw new SparkInputError("identifier: must be 64 lowercase hex characters");
+	return hexToBytes(identifier);
+}
+function commitmentKey(commitment) {
+	requireLength(commitment.hiding, 33, "commitment.hiding");
+	requireLength(commitment.binding, 33, "commitment.binding");
+	return bytesToHex(concatBytes(commitment.hiding, commitment.binding));
+}
+function checkOperators(operators) {
+	if (operators.length === 0) throw new SparkInputError("operators: must not be empty");
+	const ids = /* @__PURE__ */ new Set();
+	const identifiers = /* @__PURE__ */ new Set();
+	const publicKeys = /* @__PURE__ */ new Set();
+	for (const operator of operators) {
+		if (!Number.isSafeInteger(operator.id) || operator.id < 0) throw new SparkInputError("operator.id: must be a non-negative safe integer");
+		identifierBytes(operator.identifier);
+		requireLength(operator.identityPublicKey, 33, "operator.identityPublicKey");
+		const publicKey = bytesToHex(operator.identityPublicKey);
+		if (ids.has(operator.id) || identifiers.has(operator.identifier) || publicKeys.has(publicKey)) throw new SparkInputError("operators: id, identifier and identityPublicKey must each be unique");
+		ids.add(operator.id);
+		identifiers.add(operator.identifier);
+		publicKeys.add(publicKey);
+	}
+}
+/**
+* Rejects a VSS threshold that is not a safe integer in `2..=operators.length` — the Rust VSS
+* requires t ≥ 2, so accepting t = 1 here would only surface as a backend error. The wasm ABI
+* otherwise coerces the JS number into an i32 (fractions truncate, values past 2^32 wrap) and
+* silently splits at a different threshold than requested.
+*/
+function checkThreshold(threshold, operators) {
+	if (!Number.isSafeInteger(threshold) || threshold < 2 || threshold > operators.length) throw new SparkInputError(`threshold: must be an integer between 2 and ${operators.length}`);
+}
+/** Splits the flat `t×33 ‖ n×32` backend output into per-share proofs and share bytes. */
+function parseSplit(output, threshold, count) {
+	const proofsLength = threshold * VSS_PROOF_LENGTH;
+	if (output.length !== proofsLength + count * VSS_SHARE_LENGTH) throw new SparkCryptoError(8);
+	const proofs = [];
+	for (let i = 0; i < threshold; i++) proofs.push(output.slice(i * VSS_PROOF_LENGTH, (i + 1) * VSS_PROOF_LENGTH));
+	const shares = [];
+	for (let i = 0; i < count; i++) shares.push(output.slice(proofsLength + i * VSS_SHARE_LENGTH, proofsLength + (i + 1) * VSS_SHARE_LENGTH));
+	return {
+		proofs,
+		shares
+	};
+}
+/** The share for `operator` — share indexes run 1..n and operator id + 1 selects the share. */
+function operatorShare(shares, operator, context) {
+	const share = shares[operator.id];
+	if (share === void 0) throw new SparkError(`${context}: no share for operator id ${operator.id}`);
+	return share;
+}
+//#endregion
+//#region src/proto/gen/qntx_spark_ffi_pb.ts
+/**
+* Describes the file qntx_spark_ffi.proto.
+*/
+const file_qntx_spark_ffi = /*@__PURE__*/ fileDesc("ChRxbnR4X3NwYXJrX2ZmaS5wcm90bxIOcW50eC5zcGFyay5mZmkiLQoKQ29tbWl0bWVudBIOCgZoaWRpbmcYASABKAwSDwoHYmluZGluZxgCIAEoDCJYChJPcGVyYXRvckNvbW1pdG1lbnQSEgoKaWRlbnRpZmllchgBIAEoDBIuCgpjb21taXRtZW50GAIgASgLMhoucW50eC5zcGFyay5mZmkuQ29tbWl0bWVudCLsAQoMRnJvc3RTaWduSm9iEg8KB21lc3NhZ2UYASABKAwSEgoKc2VjcmV0X2tleRgCIAEoDBIVCg12ZXJpZnlpbmdfa2V5GAMgASgMEg0KBW5vbmNlGAQgASgMEjMKD3VzZXJfY29tbWl0bWVudBgFIAEoCzIaLnFudHguc3BhcmsuZmZpLkNvbW1pdG1lbnQSQAoUb3BlcmF0b3JfY29tbWl0bWVudHMYBiADKAsyIi5xbnR4LnNwYXJrLmZmaS5PcGVyYXRvckNvbW1pdG1lbnQSGgoSYWRhcHRvcl9wdWJsaWNfa2V5GAcgASgMIj4KEEZyb3N0U2lnblJlcXVlc3QSKgoEam9icxgBIAMoCzIcLnFudHguc3BhcmsuZmZpLkZyb3N0U2lnbkpvYiItChFGcm9zdFNpZ25SZXNwb25zZRIYChBzaWduYXR1cmVfc2hhcmVzGAEgAygMIoABCg1PcGVyYXRvclNoYXJlEhIKCmlkZW50aWZpZXIYASABKAwSLgoKY29tbWl0bWVudBgCIAEoCzIaLnFudHguc3BhcmsuZmZpLkNvbW1pdG1lbnQSFwoPc2lnbmF0dXJlX3NoYXJlGAMgASgMEhIKCnB1YmxpY19rZXkYBCABKAwi9QEKEUZyb3N0QWdncmVnYXRlSm9iEg8KB21lc3NhZ2UYASABKAwSFQoNdmVyaWZ5aW5nX2tleRgCIAEoDBIzCg91c2VyX2NvbW1pdG1lbnQYAyABKAsyGi5xbnR4LnNwYXJrLmZmaS5Db21taXRtZW50EhcKD3VzZXJfcHVibGljX2tleRgEIAEoDBIcChR1c2VyX3NpZ25hdHVyZV9zaGFyZRgFIAEoDBIwCglvcGVyYXRvcnMYBiADKAsyHS5xbnR4LnNwYXJrLmZmaS5PcGVyYXRvclNoYXJlEhoKEmFkYXB0b3JfcHVibGljX2tleRgHIAEoDCJIChVGcm9zdEFnZ3JlZ2F0ZVJlcXVlc3QSLwoEam9icxgBIAMoCzIhLnFudHguc3BhcmsuZmZpLkZyb3N0QWdncmVnYXRlSm9iIiwKFkZyb3N0QWdncmVnYXRlUmVzcG9uc2USEgoKc2lnbmF0dXJlcxgBIAMoDGIGcHJvdG8z");
+/**
+* Describes the message qntx.spark.ffi.FrostSignJob.
+* Use `create(FrostSignJobSchema)` to create a new message.
+*/
+const FrostSignJobSchema = /*@__PURE__*/ messageDesc(file_qntx_spark_ffi, 2);
+/**
+* Describes the message qntx.spark.ffi.FrostSignRequest.
+* Use `create(FrostSignRequestSchema)` to create a new message.
+*/
+const FrostSignRequestSchema = /*@__PURE__*/ messageDesc(file_qntx_spark_ffi, 3);
+/**
+* Describes the message qntx.spark.ffi.FrostSignResponse.
+* Use `create(FrostSignResponseSchema)` to create a new message.
+*/
+const FrostSignResponseSchema = /*@__PURE__*/ messageDesc(file_qntx_spark_ffi, 4);
+/**
+* Describes the message qntx.spark.ffi.FrostAggregateJob.
+* Use `create(FrostAggregateJobSchema)` to create a new message.
+*/
+const FrostAggregateJobSchema = /*@__PURE__*/ messageDesc(file_qntx_spark_ffi, 6);
+/**
+* Describes the message qntx.spark.ffi.FrostAggregateRequest.
+* Use `create(FrostAggregateRequestSchema)` to create a new message.
+*/
+const FrostAggregateRequestSchema = /*@__PURE__*/ messageDesc(file_qntx_spark_ffi, 7);
+/**
+* Describes the message qntx.spark.ffi.FrostAggregateResponse.
+* Use `create(FrostAggregateResponseSchema)` to create a new message.
+*/
+const FrostAggregateResponseSchema = /*@__PURE__*/ messageDesc(file_qntx_spark_ffi, 8);
+//#endregion
+//#region src/signer/frost.ts
+/**
+* User-side FROST signature shares, one 32-byte share per job in order. Every job's commitment
+* nonce is removed from the store before any other validation or the backend call — a batch that
+* fails partway leaves no job's nonce outstanding, and reuse fails even after an error. Resolved
+* private keys and consumed nonces are wiped.
+*/
+function frostSignJobs(crypto, jobs, keys, nonces) {
+	checkBatch(jobs.length, "signFrost");
+	if (jobs.length === 0) return [];
+	const secretKeys = [];
+	const consumedNonces = [];
+	try {
+		const request = create(FrostSignRequestSchema, { jobs: [] });
+		const taken = jobs.map((job) => {
+			const nonce = nonces.take(job.commitment);
+			consumedNonces.push(nonce);
+			return {
+				job,
+				nonce
+			};
+		});
+		for (const { job, nonce } of taken) {
+			const secretKey = keys.resolve(job.key);
+			secretKeys.push(secretKey);
+			request.jobs.push(create(FrostSignJobSchema, {
+				message: taprootKeySpendSighash(job.target),
+				secretKey,
+				verifyingKey: job.verifyingKey,
+				nonce,
+				userCommitment: {
+					hiding: job.commitment.hiding,
+					binding: job.commitment.binding
+				},
+				operatorCommitments: job.operatorCommitments.map((operator) => ({
+					identifier: identifierBytes(operator.identifier),
+					commitment: {
+						hiding: operator.commitment.hiding,
+						binding: operator.commitment.binding
+					}
+				})),
+				adaptorPublicKey: job.adaptorPublicKey ?? /* @__PURE__ */ new Uint8Array()
+			}));
+		}
+		const requestBytes = toBinary(FrostSignRequestSchema, request);
+		let responseBytes;
+		try {
+			responseBytes = backendCall(() => crypto.frostSign(requestBytes));
+		} finally {
+			requestBytes.fill(0);
+		}
+		const response = fromBinary(FrostSignResponseSchema, responseBytes);
+		if (response.signatureShares.length !== jobs.length) throw new SparkCryptoError(8);
+		return response.signatureShares;
+	} finally {
+		for (const key of secretKeys) key.fill(0);
+		for (const nonce of consumedNonces) nonce.fill(0);
+	}
+}
+/**
+* Aggregated 64-byte FROST (Schnorr) signatures, one per job in order. The user verifying share is
+* derived from the resolved private key.
+*/
+function frostAggregateJobs(crypto, jobs, keys) {
+	checkBatch(jobs.length, "aggregateFrost");
+	if (jobs.length === 0) return [];
+	const secretKeys = [];
+	try {
+		const request = create(FrostAggregateRequestSchema, { jobs: [] });
+		for (const job of jobs) {
+			const secretKey = keys.resolve(job.key);
+			secretKeys.push(secretKey);
+			request.jobs.push(create(FrostAggregateJobSchema, {
+				message: taprootKeySpendSighash(job.target),
+				verifyingKey: job.verifyingKey,
+				userCommitment: {
+					hiding: job.commitment.hiding,
+					binding: job.commitment.binding
+				},
+				userPublicKey: secp256k1.getPublicKey(secretKey, true),
+				userSignatureShare: job.signatureShare,
+				operators: job.operators.map((operator) => ({
+					identifier: identifierBytes(operator.identifier),
+					commitment: {
+						hiding: operator.commitment.hiding,
+						binding: operator.commitment.binding
+					},
+					signatureShare: operator.signatureShare,
+					publicKey: operator.publicKey
+				})),
+				adaptorPublicKey: job.adaptorPublicKey ?? /* @__PURE__ */ new Uint8Array()
+			}));
+		}
+		const responseBytes = backendCall(() => crypto.frostAggregate(toBinary(FrostAggregateRequestSchema, request)));
+		const response = fromBinary(FrostAggregateResponseSchema, responseBytes);
+		if (response.signatures.length !== jobs.length) throw new SparkCryptoError(8);
+		return response.signatures;
+	} finally {
+		for (const key of secretKeys) key.fill(0);
+	}
+}
+//#endregion
+//#region src/signer/keys.ts
+const HARDENED_OFFSET = 2147483648;
+const SPARK_PURPOSE = "m/8797555'";
+const DEFAULT_ACCOUNT = {
+	mainnet: 1,
+	regtest: 0
+};
+/**
+* The 64-byte extended private key (private key ‖ chain code) at `m/8797555'/account'` — the input
+* {@link createSparkSigner} expects. The default account matches the official SDK: mainnet 1,
+* regtest 0.
+*/
+function sparkAccountKey(seed, network, account) {
+	const resolvedAccount = account ?? DEFAULT_ACCOUNT[network];
+	if (!Number.isSafeInteger(resolvedAccount) || resolvedAccount < 0 || resolvedAccount >= HARDENED_OFFSET) throw new SparkInputError("account: must be a non-negative safe integer below 2^31");
+	let master;
+	try {
+		master = HDKey.fromMasterSeed(seed);
+	} catch (error) {
+		throw new SparkInputError("seed: invalid BIP-32 master seed", { cause: error });
+	}
+	const node = master.derive(`${SPARK_PURPOSE}/${resolvedAccount}'`);
+	if (node.privateKey === null || node.chainCode === null) throw new SparkInputError("seed: account derivation produced no private key");
+	const key = concatBytes(node.privateKey, node.chainCode);
+	master.wipePrivateData();
+	node.wipePrivateData();
+	return key;
+}
+function openKeys(accountKey, crypto) {
+	if (accountKey.length !== 64) throw new SparkInputError("accountKey: must be 64 bytes (private key ‖ chain code)");
+	const privateHalf = accountKey.slice(0, 32);
+	let root;
+	let identityNode;
+	let signingRoot;
+	let staticRoot;
+	try {
+		if (!secp256k1.utils.isValidSecretKey(privateHalf)) throw new SparkInputError("accountKey: private key half is not a valid secp256k1 scalar");
+		root = new HDKey({
+			privateKey: privateHalf,
+			chainCode: accountKey.slice(32)
+		});
+		identityNode = root.deriveChild(HARDENED_OFFSET);
+		signingRoot = root.deriveChild(2147483649);
+		staticRoot = root.deriveChild(2147483651);
+	} catch (error) {
+		privateHalf.fill(0);
+		throw error;
+	}
+	const identityPrivateKey = requiredPrivateKey(identityNode, "identity");
+	const identityPublicKey = secp256k1.getPublicKey(identityPrivateKey, true);
+	const identityPoint = secp256k1.Point.fromBytes(identityPublicKey);
+	const leafKeyCache = /* @__PURE__ */ new Map();
+	function leafPrivateKey(leafId) {
+		const cached = leafKeyCache.get(leafId);
+		if (cached !== void 0) return cached;
+		const hash = sha256(utf8ToBytes(leafId));
+		const index = new DataView(hash.buffer, hash.byteOffset, hash.byteLength).getUint32(0, false) % HARDENED_OFFSET;
+		const priv = requiredPrivateKey(signingRoot.deriveChild(HARDENED_OFFSET + index), "leaf key");
+		leafKeyCache.set(leafId, priv);
+		return priv;
+	}
+	function staticDepositPrivateKey(index) {
+		if (!Number.isSafeInteger(index) || index < 0 || index >= HARDENED_OFFSET) throw new SparkInputError("index: must be a non-negative safe integer below 2^31");
+		return requiredPrivateKey(staticRoot.deriveChild(HARDENED_OFFSET + index), "static deposit key");
+	}
+	function decryptReceivedKey(ciphertext) {
+		const plain = backendCall(() => crypto.eciesDecrypt(identityPrivateKey, ciphertext));
+		if (plain.length !== 32 || !secp256k1.utils.isValidSecretKey(plain)) {
+			plain.fill(0);
+			throw new SparkError("received key: decrypted payload is not a 32-byte secp256k1 private key");
+		}
+		return plain;
+	}
+	/** Resolves a key descriptor to a private-key copy the caller wipes after use. */
+	function resolve(key) {
+		if (key.type === "leaf") return new Uint8Array(leafPrivateKey(key.leafId));
+		if (key.type === "static-deposit") return staticDepositPrivateKey(key.index);
+		if (key.type === "received") return decryptReceivedKey(key.ciphertext);
+		return unreachable("unexpected key type");
+	}
+	return {
+		identityPrivateKey,
+		identityPublicKey,
+		identityPoint,
+		accountPrivate: privateHalf,
+		resolve,
+		staticDepositPrivateKey,
+		publicKeys(descriptors) {
+			return descriptors.map((descriptor) => {
+				const priv = resolve(descriptor);
+				try {
+					return secp256k1.getPublicKey(priv, true);
+				} finally {
+					priv.fill(0);
+				}
+			});
+		},
+		receivedPublicKeys(ciphertexts) {
+			return ciphertexts.map((ciphertext) => {
+				const priv = decryptReceivedKey(ciphertext);
+				try {
+					return secp256k1.getPublicKey(priv, true);
+				} finally {
+					priv.fill(0);
+				}
+			});
+		},
+		wipe() {
+			for (const priv of leafKeyCache.values()) priv.fill(0);
+			leafKeyCache.clear();
+			privateHalf.fill(0);
+			staticRoot.wipePrivateData();
+			signingRoot.wipePrivateData();
+			identityNode.wipePrivateData();
+			root.wipePrivateData();
+		}
+	};
+}
+function requiredPrivateKey(node, name) {
+	if (node.privateKey === null) throw new SparkError(`${name}: derivation produced no private key`);
+	return node.privateKey;
+}
+//#endregion
+//#region src/signer/nonces.ts
+const FROST_COMMITMENT_ITEM = 130;
+const NONCE_LENGTH = 64;
+const FROST_HEDGE_TAG = "spark/frost-hedge";
+const MAX_OUTSTANDING = 1024;
+function createNonceStore(crypto, accountPrivate, random) {
+	const hedgeKey = hmac(sha256, accountPrivate, utf8ToBytes(FROST_HEDGE_TAG));
+	const nonces = /* @__PURE__ */ new Map();
+	let hedgeCounter = 0n;
+	return {
+		commit(count) {
+			if (!Number.isSafeInteger(count) || count < 1 || count > 256) throw new SparkInputError(`newCommitments: count must be between 1 and 256`);
+			for (const [key, nonce] of nonces) {
+				if (nonces.size + count <= MAX_OUTSTANDING) break;
+				nonce.fill(0);
+				nonces.delete(key);
+			}
+			const hedge = hmac(sha256, hedgeKey, concatBytes(utf8ToBytes(FROST_HEDGE_TAG), uint64be(hedgeCounter)));
+			hedgeCounter += 1n;
+			let items;
+			try {
+				items = backendCall(() => withRandom(random, 32 * count, (seed) => crypto.frostCommit(hedge, seed)));
+			} finally {
+				hedge.fill(0);
+			}
+			if (items.length !== count * FROST_COMMITMENT_ITEM) {
+				items.fill(0);
+				throw new SparkCryptoError(8);
+			}
+			const commitments = [];
+			for (let i = 0; i < count; i++) {
+				const item = items.subarray(i * FROST_COMMITMENT_ITEM, (i + 1) * FROST_COMMITMENT_ITEM);
+				const nonce = item.slice(0, NONCE_LENGTH);
+				const hiding = item.slice(NONCE_LENGTH, 97);
+				const binding = item.slice(97, FROST_COMMITMENT_ITEM);
+				nonces.set(bytesToHex(concatBytes(hiding, binding)), nonce);
+				commitments.push({
+					hiding,
+					binding
+				});
+			}
+			items.fill(0);
+			return commitments;
+		},
+		take(commitment) {
+			const key = commitmentKey(commitment);
+			const nonce = nonces.get(key);
+			nonces.delete(key);
+			if (nonce === void 0) throw new SparkError("signFrost: unknown or already-consumed signing commitment");
+			return nonce;
+		},
+		wipe() {
+			hedgeKey.fill(0);
+			for (const nonce of nonces.values()) nonce.fill(0);
+			nonces.clear();
+		}
+	};
+}
+//#endregion
+//#region src/signer/statements.ts
+/**
+* Computes the digest for a statement from its complete protocol content, plus the signature format
+* upstream emits for that statement kind (DER ECDSA unless noted).
+*/
+function statementDigest(statement, context) {
+	if (statement.kind === "so-challenge") {
+		const challenge = decode(ChallengeSchema, statement.challenge, "so challenge");
+		if (challenge.$unknown !== void 0) throw new SparkInputError("so challenge: unknown fields are not allowed");
+		if (!decodePoint(challenge.publicKey, "challenge.publicKey").equals(context.identityPoint)) throw new SparkInputError("so challenge: challenge targets a different public key than the signer identity");
+		return {
+			digest: authnChallengeDigest(challenge),
+			format: "der"
+		};
+	}
+	if (statement.kind === "ssp-challenge") return {
+		digest: sspChallengeDigest(statement.protectedChallenge, context.identityPublicKey),
+		format: "der"
+	};
+	if (statement.kind === "transfer-package") {
+		const pkg = decode(TransferPackageSchema, statement.package, "transfer package");
+		return {
+			digest: transferPackageDigest(statement.transferId, pkg),
+			format: "der"
+		};
+	}
+	if (statement.kind === "claim-package") {
+		const pkg = decode(ClaimPackageSchema, statement.package, "claim package");
+		return {
+			digest: claimPackageDigest(statement.transferId, pkg.keyTweakPackage),
+			format: "der"
+		};
+	}
+	if (statement.kind === "static-deposit-claim") return {
+		digest: staticDepositStatementDigest({
+			transactionId: bytesToHex(statement.txid),
+			outputIndex: statement.vout,
+			network: statement.network,
+			requestType: "fixed",
+			creditAmountSats: statement.creditAmountSats,
+			payload: statement.sspSignature
+		}),
+		format: "der"
+	};
+	if (statement.kind === "static-deposit-refund") return {
+		digest: staticDepositStatementDigest({
+			transactionId: bytesToHex(statement.txid),
+			outputIndex: statement.vout,
+			network: statement.network,
+			requestType: "refund",
+			creditAmountSats: statement.amount,
+			payload: taprootKeySpendSighash(statement.target)
+		}),
+		format: "der"
+	};
+	if (statement.kind === "watchtower-recovery") return {
+		digest: watchtowerRecoveryStatementDigest(statement.network, statement.leafId, taprootKeySpendSighash(statement.target)),
+		format: "der"
+	};
+	if (statement.kind === "spark-invoice") {
+		const proto = decode(SparkInvoiceFieldsSchema, statement.invoice, "spark invoice");
+		const invoice = protoInvoiceToPlain(proto);
+		return {
+			digest: hashSparkInvoice(invoice, context.identityPublicKey, context.network),
+			format: "schnorr"
+		};
+	}
+	if (statement.kind === "lightning-address") return {
+		digest: lightningAddressMessageDigest(lightningAddressMessage(statement)),
+		format: "der"
+	};
+	if (statement.kind === "token-transaction") {
+		const partial = decode(PartialTokenTransactionSchema, statement.partialTransaction, "token transaction");
+		return {
+			digest: hashPartialTokenTransaction(partial),
+			format: "schnorr"
+		};
+	}
+	return unreachable("unexpected statement kind");
+}
+/** Signs `digest` in `format`: low-S ECDSA (`der`/`compact`) or BIP-340 (`schnorr`). */
+function signDigest(digest, format, secretKey, random) {
+	if (format === "schnorr") return schnorr.sign(digest, secretKey, randomBytes(random, 32));
+	return ecdsaSign(digest, secretKey, format);
+}
+function ecdsaSign(digest, secretKey, format) {
+	return secp256k1.sign(digest, secretKey, {
+		format,
+		prehash: false,
+		lowS: true
+	});
+}
+function decode(schema, bytes, name) {
+	try {
+		return fromBinary(schema, bytes);
+	} catch (error) {
+		throw new SparkInputError(`${name}: failed to decode protobuf`, { cause: error });
+	}
+}
+function decodePoint(bytes, name) {
+	try {
+		return secp256k1.Point.fromBytes(bytes);
+	} catch (error) {
+		throw new SparkInputError(`${name}: invalid secp256k1 public key`, { cause: error });
+	}
+}
+//#endregion
+//#region src/signer/packages.ts
+/**
+* VSS-splits `tweak` across `operators` at `threshold`, returning the proofs, a per-operator share
+* accessor and each operator's share public key (`share·G`). The backend output is registered in
+* `secrets` so the caller's `finally` wipes it.
+*/
+function splitTweak(tweak, operators, threshold, context, secrets, label) {
+	const { crypto, random } = context;
+	checkThreshold(threshold, operators);
+	const split = backendCall(() => withRandom(random, 32, (seed) => crypto.splitSecretWithProofs(tweak, threshold, operators.length, seed)));
+	secrets.push(split);
+	const { proofs, shares } = parseSplit(split, threshold, operators.length);
+	const shareFor = (operator) => operatorShare(shares, operator, label);
+	const pubkeySharesTweak = {};
+	for (const operator of operators) pubkeySharesTweak[operator.identifier] = secp256k1.getPublicKey(shareFor(operator), true);
+	return {
+		proofs,
+		shareFor,
+		pubkeySharesTweak
+	};
+}
+/**
+* Builds one plaintext per operator and ECIES-seals it to that operator's identity key. Every
+* plaintext is registered in `plaintexts` so the caller's `finally` wipes it.
+*/
+function sealPerOperator(operators, plaintextFor, context, plaintexts) {
+	const { crypto, random } = context;
+	const operatorPackages = {};
+	for (const operator of operators) {
+		const plaintext = plaintextFor(operator);
+		plaintexts.push(plaintext);
+		operatorPackages[operator.identifier] = backendCall(() => withRandom(random, 32, (seed) => crypto.eciesEncrypt(operator.identityPublicKey, plaintext, seed)));
+	}
+	return operatorPackages;
+}
+/**
+* Builds the sender transfer package: every leaf gets a fresh random recipient key, the
+* operator-visible tweak is `old − new` (mod n) split by VSS, and each `SendLeafKeyTweaks`
+* plaintext is ECIES-sealed to the operator it belongs to.
+*/
+function prepareTransferPackage(request, context) {
+	const { crypto, keys, random, operators, threshold } = context;
+	if (request.leaves.length === 0) throw new SparkInputError("leaves: must not be empty");
+	const secrets = [];
+	const plaintexts = [];
+	try {
+		const perOperator = /* @__PURE__ */ new Map();
+		for (const operator of operators) perOperator.set(operator.identifier, []);
+		const leaves = [];
+		for (const leaf of request.leaves) {
+			requireLength(leaf.receiverIdentityPublicKey, 33, "receiverIdentityPublicKey");
+			const oldPrivateKey = keys.resolve(leaf.key);
+			const newPrivateKey = randomScalar(random);
+			secrets.push(oldPrivateKey, newPrivateKey);
+			const secretCipher = backendCall(() => withRandom(random, 32, (seed) => crypto.eciesEncrypt(leaf.receiverIdentityPublicKey, newPrivateKey, seed)));
+			const signature = ecdsaSign(sendLeafSigningDigest(leaf.leafId, request.transferId, secretCipher), keys.identityPrivateKey, "compact");
+			const tweak = secp256k1.Point.Fn.toBytes(secp256k1.Point.Fn.sub(secp256k1.Point.Fn.fromBytes(oldPrivateKey), secp256k1.Point.Fn.fromBytes(newPrivateKey)));
+			secrets.push(tweak);
+			const { proofs, shareFor, pubkeySharesTweak } = splitTweak(tweak, operators, threshold, context, secrets, "prepareTransfer");
+			for (const operator of operators) perOperator.get(operator.identifier)?.push(create(SendLeafKeyTweakSchema, {
+				leafId: leaf.leafId,
+				secretShareTweak: {
+					secretShare: shareFor(operator),
+					proofs
+				},
+				pubkeySharesTweak,
+				secretCipher,
+				sig: {
+					case: "signature",
+					value: signature
+				}
+			}));
+			leaves.push({
+				leafId: leaf.leafId,
+				newPublicKey: secp256k1.getPublicKey(newPrivateKey, true),
+				secretCipher,
+				signature
+			});
+		}
+		return {
+			operatorPackages: sealPerOperator(operators, (operator) => {
+				const tweaks = perOperator.get(operator.identifier);
+				if (tweaks === void 0) throw new SparkError("prepareTransfer: internal operator grouping failure");
+				return toBinary(SendLeafKeyTweaksSchema, create(SendLeafKeyTweaksSchema, { leavesToSend: tweaks }));
+			}, context, plaintexts),
+			leaves
+		};
+	} finally {
+		for (const secret of secrets) secret.fill(0);
+		for (const plaintext of plaintexts) plaintext.fill(0);
+	}
+}
+/**
+* Builds the receiver claim package: each leaf's tweak is `received − leaf` (the sealed key minus
+* the local `LEAF{leafId}` key), VSS-split and sealed per operator as `ClaimLeafKeyTweaks`.
+*/
+function prepareClaimPackage(request, context) {
+	const { keys, operators, threshold } = context;
+	if (request.leaves.length === 0) throw new SparkInputError("leaves: must not be empty");
+	const secrets = [];
+	const plaintexts = [];
+	try {
+		const perOperator = /* @__PURE__ */ new Map();
+		for (const operator of operators) perOperator.set(operator.identifier, []);
+		for (const leaf of request.leaves) {
+			const receivedPrivateKey = keys.resolve({
+				type: "received",
+				ciphertext: leaf.secretCipher
+			});
+			const newPrivateKey = keys.resolve({
+				type: "leaf",
+				leafId: leaf.leafId
+			});
+			secrets.push(receivedPrivateKey, newPrivateKey);
+			const tweak = secp256k1.Point.Fn.toBytes(secp256k1.Point.Fn.sub(secp256k1.Point.Fn.fromBytes(receivedPrivateKey), secp256k1.Point.Fn.fromBytes(newPrivateKey)));
+			secrets.push(tweak);
+			const { proofs, shareFor, pubkeySharesTweak } = splitTweak(tweak, operators, threshold, context, secrets, "prepareClaim");
+			for (const operator of operators) perOperator.get(operator.identifier)?.push(create(ClaimLeafKeyTweakSchema, {
+				leafId: leaf.leafId,
+				secretShareTweak: {
+					secretShare: shareFor(operator),
+					proofs
+				},
+				pubkeySharesTweak
+			}));
+		}
+		return { operatorPackages: sealPerOperator(operators, (operator) => {
+			const tweaks = perOperator.get(operator.identifier);
+			if (tweaks === void 0) throw new SparkError("prepareClaim: internal operator grouping failure");
+			return toBinary(ClaimLeafKeyTweaksSchema, create(ClaimLeafKeyTweaksSchema, { leavesToReceive: tweaks }));
+		}, context, plaintexts) };
+	} finally {
+		for (const secret of secrets) secret.fill(0);
+		for (const plaintext of plaintexts) plaintext.fill(0);
+	}
+}
+/**
+* Generates a preimage, VSS-splits it across `operators` at `threshold`, and seals one
+* `SecretShare` plaintext per operator. Returns `sha256(preimage)` as the payment hash.
+*/
+function prepareLightningReceivePackage(context) {
+	const { crypto, random, operators, threshold } = context;
+	const secrets = [];
+	const plaintexts = [];
+	try {
+		const preimage = randomScalar(random);
+		secrets.push(preimage);
+		const split = backendCall(() => withRandom(random, 32, (seed) => crypto.splitSecretWithProofs(preimage, threshold, operators.length, seed)));
+		secrets.push(split);
+		const { proofs, shares } = parseSplit(split, threshold, operators.length);
+		const operatorPackages = sealPerOperator(operators, (operator) => toBinary(SecretShareSchema, create(SecretShareSchema, {
+			secretShare: operatorShare(shares, operator, "prepareLightningReceive"),
+			proofs
+		})), context, plaintexts);
+		return {
+			paymentHash: sha256(preimage),
+			operatorPackages
+		};
+	} finally {
+		for (const secret of secrets) secret.fill(0);
+		for (const plaintext of plaintexts) plaintext.fill(0);
+	}
+}
+/**
+* The static-deposit claim: ECIES-seals the child secret key to the SSP identity (the same scheme
+* as transfer leaf secret ciphers) and signs the claim statement with the identity key. The
+* plaintext key is wiped before returning.
+*/
+function claimStaticDepositPackage(request, context) {
+	const { crypto, keys, network, random, sspIdentityPublicKey } = context;
+	const { digest } = statementDigest(request.statement, {
+		identityPoint: keys.identityPoint,
+		identityPublicKey: keys.identityPublicKey,
+		network
+	});
+	const secret = keys.staticDepositPrivateKey(request.index);
+	try {
+		return {
+			encryptedSecretKey: backendCall(() => withRandom(random, 32, (seed) => crypto.eciesEncrypt(sspIdentityPublicKey, secret, seed))),
+			signature: ecdsaSign(digest, keys.identityPrivateKey, "der")
+		};
+	} finally {
+		secret.fill(0);
+	}
+}
+//#endregion
+//#region src/signer/local.ts
+/**
+* Creates the local Spark signer: the implementation of {@link SparkSigner} that holds the account
+* extended private key and delegates curve-heavy FROST/ECIES/VSS work to a `SparkCrypto` backend.
+* Throws `SparkInputError` on an ABI version mismatch or a malformed `accountKey`.
+*
+* The operator set, VSS threshold and SSP identity are bound here and default to the network's
+* `sparkNetworkConfig`; every key-tweak share and the static-deposit secret is sealed to these keys
+* and no request can retarget them. Pass explicit values only to point the signer at a different
+* deployment (the local stack's operators/SSP), exactly like the client's `operators` and `ssp`
+* options.
+*/
+function createSparkSigner(options) {
+	const { crypto, network, random } = options;
+	if (crypto.abiVersion !== 1) throw new SparkInputError(`crypto.abiVersion: expected 1, got ${crypto.abiVersion}`);
+	if (network !== "mainnet" && network !== "regtest") throw new SparkInputError(`network: unsupported network ${String(network)}`);
+	const config = sparkNetworkConfig(network);
+	const operators = options.operators ?? config.operators;
+	const threshold = options.threshold ?? config.threshold;
+	const sspIdentityPublicKey = options.sspIdentityPublicKey ?? config.ssp.identityPublicKey;
+	checkOperators(operators);
+	checkThreshold(threshold, operators);
+	requireLength(sspIdentityPublicKey, 33, "sspIdentityPublicKey");
+	try {
+		secp256k1.Point.fromBytes(sspIdentityPublicKey);
+	} catch (error) {
+		throw new SparkInputError("sspIdentityPublicKey is not a valid point", { cause: error });
+	}
+	const keys = openKeys(options.accountKey, crypto);
+	const nonces = createNonceStore(crypto, keys.accountPrivate, random);
+	const statements = {
+		identityPoint: keys.identityPoint,
+		identityPublicKey: keys.identityPublicKey,
+		network
+	};
+	const packages = {
+		crypto,
+		keys,
+		network,
+		random,
+		operators,
+		threshold,
+		sspIdentityPublicKey
+	};
+	let disposed = false;
+	function ensureAlive() {
+		if (disposed) throw new SparkError("signer: disposed");
+	}
+	const identityPublicKey = async () => {
+		ensureAlive();
+		await ready;
+		ensureAlive();
+		return new Uint8Array(keys.identityPublicKey);
+	};
+	const publicKeys = async (descriptors) => {
+		ensureAlive();
+		await ready;
+		ensureAlive();
+		checkBatch(descriptors.length, "publicKeys");
+		return keys.publicKeys(descriptors);
+	};
+	const receivedPublicKeys = async (ciphertexts) => {
+		ensureAlive();
+		await ready;
+		ensureAlive();
+		checkBatch(ciphertexts.length, "receivedPublicKeys");
+		return keys.receivedPublicKeys(ciphertexts);
+	};
+	const newCommitments = async (count) => {
+		ensureAlive();
+		await ready;
+		ensureAlive();
+		return nonces.commit(count);
+	};
+	const signFrost = async (jobs) => {
+		ensureAlive();
+		await ready;
+		ensureAlive();
+		return frostSignJobs(crypto, jobs, keys, nonces);
+	};
+	const aggregateFrost = async (jobs) => {
+		ensureAlive();
+		await ready;
+		ensureAlive();
+		return frostAggregateJobs(crypto, jobs, keys);
+	};
+	const signIdentity = async (statement) => {
+		ensureAlive();
+		await ready;
+		ensureAlive();
+		const { digest, format } = statementDigest(statement, statements);
+		return signDigest(digest, format, keys.identityPrivateKey, random);
+	};
+	const signKeySpend = async (key, target) => {
+		ensureAlive();
+		await ready;
+		ensureAlive();
+		const secretKey = keys.resolve(key);
+		let tweaked;
+		try {
+			tweaked = taprootTweakPrivKey(secretKey);
+			return schnorr.sign(taprootKeySpendSighash(target), tweaked, randomBytes(random, 32));
+		} finally {
+			secretKey.fill(0);
+			tweaked?.fill(0);
+		}
+	};
+	const signHtlcTimeout = async (request) => {
+		ensureAlive();
+		await ready;
+		ensureAlive();
+		const tx = parseTransaction(request.transaction);
+		if (tx.inputsLength !== 1 || request.inputIndex !== 0) throw new SparkInputError("htlc timeout: only the single-input sender sweep is supported");
+		const { sequence } = tx.getInput(0);
+		if (sequence === void 0) throw new SparkInputError("htlc timeout: input has no sequence");
+		checkIfValidSequence(sequence);
+		if (getTimelockFromSequence(sequence) < 2160) throw new SparkInputError(`htlc timeout: input sequence ${String(sequence)} does not satisfy the ${LIGHTNING_HTLC_SEQUENCE}-block HTLC CSV`);
+		const sequenceLockScript = createSequenceLockScript(LIGHTNING_HTLC_SEQUENCE, keys.identityPublicKey);
+		return signDigest(taprootScriptSpendSighash({
+			transaction: request.transaction,
+			inputIndex: request.inputIndex,
+			prevouts: [{
+				script: lightningHtlcOutputScript(request.paymentHash, request.hashLockPublicKey, keys.identityPublicKey),
+				amount: request.prevoutAmountSats
+			}]
+		}, sequenceLockScript), "schnorr", keys.identityPrivateKey, random);
+	};
+	const prepareTransfer = async (request) => {
+		ensureAlive();
+		await ready;
+		ensureAlive();
+		return prepareTransferPackage(request, packages);
+	};
+	const prepareClaim = async (request) => {
+		ensureAlive();
+		await ready;
+		ensureAlive();
+		return prepareClaimPackage(request, packages);
+	};
+	const prepareLightningReceive = async () => {
+		ensureAlive();
+		await ready;
+		ensureAlive();
+		return prepareLightningReceivePackage(packages);
+	};
+	const claimStaticDeposit = async (request) => {
+		ensureAlive();
+		await ready;
+		ensureAlive();
+		return claimStaticDepositPackage(request, packages);
+	};
+	const dispose = () => {
+		if (disposed) return;
+		disposed = true;
+		nonces.wipe();
+		keys.wipe();
+	};
+	return {
+		identityPublicKey,
+		publicKeys,
+		receivedPublicKeys,
+		newCommitments,
+		signFrost,
+		aggregateFrost,
+		signIdentity,
+		signKeySpend,
+		signHtlcTimeout,
+		prepareTransfer,
+		prepareClaim,
+		prepareLightningReceive,
+		claimStaticDeposit,
+		dispose
+	};
+}
+//#endregion
+//#region src/signer/lnurl-auth.ts
+const PURPOSE_138 = "m/138'";
+const HOST_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+const SECRET_KEY_LENGTH = 32;
+function pathElement(mac, offset) {
+	return new DataView(mac.buffer, mac.byteOffset, mac.byteLength).getUint32(offset);
+}
+function checkDomain(domain) {
+	if (domain !== domain.toLowerCase()) throw new SparkInputError("lnurl-auth domain: must be lowercase");
+	if (domain.length === 0 || domain.length > 253) throw new SparkInputError("lnurl-auth domain: invalid hostname length");
+	for (const label of domain.split(".")) if (!HOST_LABEL.test(label)) throw new SparkInputError("lnurl-auth domain: invalid hostname label");
+}
+function wipeNodes(nodes) {
+	for (const node of nodes) node.wipePrivateData();
+}
+function leafKeyOf(nodes) {
+	const leaf = nodes.at(-1);
+	if (leaf === void 0 || leaf.privateKey === null) throw new SparkError("lnurl-auth: linking-key derivation produced no private key");
+	return leaf.privateKey;
+}
+/**
+* The 64-byte extended private key (private key ‖ chain code) at `m/138'` — the input
+* {@link createLnurlAuthSigner} expects. The caller wipes the result when it is done holding the
+* material.
+*/
+function lnurlAuthRootKey(seed) {
+	let master;
+	try {
+		master = HDKey.fromMasterSeed(seed);
+	} catch (error) {
+		throw new SparkInputError("seed: invalid BIP-32 master seed", { cause: error });
+	}
+	const node = master.derive(PURPOSE_138);
+	if (node.privateKey === null || node.chainCode === null) throw new SparkInputError("seed: linking-key derivation produced no private key");
+	const key = concatBytes(node.privateKey, node.chainCode);
+	master.wipePrivateData();
+	node.wipePrivateData();
+	return key;
+}
+/** Creates the signer from a `m/138'` extended private key produced by {@link lnurlAuthRootKey}. */
+function createLnurlAuthSigner(options) {
+	if (options.rootKey.length !== 64) throw new SparkInputError("rootKey: must be 64 bytes (private key ‖ chain code)");
+	const privateHalf = options.rootKey.slice(0, SECRET_KEY_LENGTH);
+	let root;
+	try {
+		if (!secp256k1.utils.isValidSecretKey(privateHalf)) throw new SparkInputError("rootKey: private key half is not a valid secp256k1 scalar");
+		root = new HDKey({
+			privateKey: privateHalf,
+			chainCode: options.rootKey.slice(SECRET_KEY_LENGTH)
+		});
+	} catch (error) {
+		privateHalf.fill(0);
+		throw error;
+	}
+	let disposed = false;
+	function ensureAlive() {
+		if (disposed) throw new SparkError("lnurl-auth signer: disposed");
+	}
+	function linkingNodes(domain) {
+		checkDomain(domain);
+		const hashing = root.deriveChild(0);
+		const nodes = [hashing];
+		try {
+			const hashingPrivate = hashing.privateKey;
+			if (hashingPrivate === null) throw new SparkInputError("lnurl-auth: hashing-key derivation produced no private key");
+			const mac = hmac(sha256, hashingPrivate, utf8ToBytes(domain));
+			let node = root;
+			try {
+				for (let i = 0; i < 4; i += 1) {
+					node = node.deriveChild(pathElement(mac, i * 4));
+					nodes.push(node);
+				}
+				return nodes;
+			} finally {
+				mac.fill(0);
+			}
+		} catch (error) {
+			wipeNodes(nodes);
+			throw error;
+		}
+	}
+	const linkingKey = async (domain) => {
+		ensureAlive();
+		await ready;
+		const nodes = linkingNodes(domain);
+		try {
+			return secp256k1.getPublicKey(leafKeyOf(nodes), true);
+		} finally {
+			wipeNodes(nodes);
+		}
+	};
+	const sign = async (request) => {
+		ensureAlive();
+		await ready;
+		if (request.k1.length !== 32) throw new SparkInputError("lnurl-auth k1: must be 32 bytes");
+		const nodes = linkingNodes(request.domain);
+		try {
+			const privateKey = leafKeyOf(nodes);
+			return {
+				linkingKey: secp256k1.getPublicKey(privateKey, true),
+				signature: ecdsaSign(request.k1, privateKey, "der")
+			};
+		} finally {
+			wipeNodes(nodes);
+		}
+	};
+	const dispose = () => {
+		if (disposed) return;
+		disposed = true;
+		root.wipePrivateData();
+		privateHalf.fill(0);
+	};
+	return {
+		linkingKey,
+		sign,
+		dispose
+	};
+}
+//#endregion
+export { createLnurlAuthSigner, createSparkSigner, lnurlAuthRootKey, sparkAccountKey };