@utxopia/sdk 0.1.0-alpha.4 → 0.1.0-alpha.5

package/src/instructions.ts

@@ -2191,124 +2191,6 @@ export { hexToBytes, bytesToHex } from "./crypto";
 // Permissioned Pool Builders
 // =============================================================================
 
-// ---------------------------------------------------------------------------
-// initializePermissioned (disc=21)
-// ---------------------------------------------------------------------------
-
-/** initializePermissioned instruction options */
-export interface InitializePermissionedOptions {
-  /** PDA bump for pool state */
-  poolBump: number;
-  /** PDA bump for commitment tree */
-  treeBump: number;
-  /** Deposit fee in basis points (u16 LE) */
-  depositFeeBps: number;
-  /** Withdrawal fee in basis points (u16 LE) */
-  withdrawalFeeBps: number;
-  /** Auditor's Solana pubkey (32 bytes) */
-  auditor: Uint8Array;
-  /** Auditor's viewing public key (32 bytes) */
-  auditorViewingPubkey: Uint8Array;
-  /** Account addresses — same layout as initialize (disc=0) */
-  accounts: {
-    /** 0. pool_state (writable) */
-    poolState: Address;
-    /** 1. commitment_tree (writable) */
-    commitmentTree: Address;
-    /** 2. zkbtc_mint (writable) */
-    zkbtcMint: Address;
-    /** 3. pool_vault (writable) */
-    poolVault: Address;
-    /** 4. deposit_vault (writable) */
-    depositVault: Address;
-    /** 5. authority (signer, writable — pays for storage) */
-    authority: Address;
-    /** 6. system_program (readonly) */
-    systemProgram: Address;
-  };
-}
-
-/**
- * Build initializePermissioned instruction data (disc=21).
- *
- * Layout (after disc byte — same as initialize plus two 32-byte fields):
- *   pool_bump(1) + tree_bump(1) + deposit_fee_bps(2 LE) + withdrawal_fee_bps(2 LE)
- *   + auditor(32) + auditor_viewing_pubkey(32)
- *   = 70 bytes of payload; 71 bytes total with disc.
- */
-export function buildInitializePermissionedInstructionData(options: {
-  poolBump: number;
-  treeBump: number;
-  depositFeeBps: number;
-  withdrawalFeeBps: number;
-  auditor: Uint8Array;
-  auditorViewingPubkey: Uint8Array;
-}): Uint8Array {
-  if (options.auditor.length !== 32) {
-    throw new Error(`auditor must be 32 bytes, got ${options.auditor.length}`);
-  }
-  if (options.auditorViewingPubkey.length !== 32) {
-    throw new Error(`auditorViewingPubkey must be 32 bytes, got ${options.auditorViewingPubkey.length}`);
-  }
-
-  // disc(1) + pool_bump(1) + tree_bump(1) + deposit_fee_bps(2) + withdrawal_fee_bps(2) + auditor(32) + auditor_viewing_pubkey(32) = 71
-  const data = new Uint8Array(71);
-  const view = new DataView(data.buffer);
-  let offset = 0;
-
-  data[offset++] = PERMISSIONED_DISC.INITIALIZE_PERMISSIONED; // disc = 21
-  data[offset++] = options.poolBump;
-  data[offset++] = options.treeBump;
-  view.setUint16(offset, options.depositFeeBps, true); offset += 2;
-  view.setUint16(offset, options.withdrawalFeeBps, true); offset += 2;
-  data.set(options.auditor, offset); offset += 32;
-  data.set(options.auditorViewingPubkey, offset);
-
-  return data;
-}
-
-/**
- * Build a complete initializePermissioned instruction (disc=21).
- *
- * Initializes a pool in permissioned mode; deposits/shields require auditor co-signing.
- *
- * Accounts (identical to initialize, disc=0):
- * 0. pool_state          (writable)
- * 1. commitment_tree     (writable)
- * 2. zkbtc_mint          (writable)
- * 3. pool_vault          (writable)
- * 4. deposit_vault       (writable)
- * 5. authority           (writable signer)
- * 6. system_program      (readonly)
- */
-export function buildInitializePermissionedInstruction(
-  options: InitializePermissionedOptions,
-): Instruction {
-  const config = getConfig();
-  const data = buildInitializePermissionedInstructionData({
-    poolBump: options.poolBump,
-    treeBump: options.treeBump,
-    depositFeeBps: options.depositFeeBps,
-    withdrawalFeeBps: options.withdrawalFeeBps,
-    auditor: options.auditor,
-    auditorViewingPubkey: options.auditorViewingPubkey,
-  });
-
-  return {
-    programAddress: config.utxopiaProgramId,
-    accounts: [
-      { address: options.accounts.poolState,      role: AccountRole.WRITABLE },
-      { address: options.accounts.commitmentTree, role: AccountRole.WRITABLE },
-      { address: options.accounts.zkbtcMint,      role: AccountRole.WRITABLE },
-      { address: options.accounts.poolVault,      role: AccountRole.WRITABLE },
-      { address: options.accounts.depositVault,   role: AccountRole.WRITABLE },
-      { address: options.accounts.authority,      role: AccountRole.WRITABLE_SIGNER },
-      { address: options.accounts.systemProgram,  role: AccountRole.READONLY },
-    ],
-    data,
-  };
-}
-
 // ---------------------------------------------------------------------------
 // completeDepositPermissioned (disc=22)
 // ---------------------------------------------------------------------------
@@ -2681,102 +2563,6 @@ export function buildRegisterExitDestinationInstruction(options: {
   };
 }
 
-// ---------------------------------------------------------------------------
-// setAuditorFrozen (disc=28)
-// ---------------------------------------------------------------------------
-
-/** setAuditorFrozen instruction options */
-export interface SetAuditorFrozenOptions {
-  /** true = freeze the auditor role; false = un-freeze */
-  frozen: boolean;
-  accounts: {
-    /** 0. pool_state (writable) */
-    poolState: Address;
-    /** 1. auditor (signer) */
-    auditor: Address;
-  };
-}
-
-/**
- * Build setAuditorFrozen instruction data (disc=28).
- *
- * Layout: disc(1) + frozen(1)  — frozen byte: 0 = not frozen, 1 = frozen.
- */
-export function buildSetAuditorFrozenInstructionData(frozen: boolean): Uint8Array {
-  return new Uint8Array([INSTRUCTION.SET_AUDITOR_FROZEN, frozen ? 1 : 0]);
-}
-
-/**
- * Build a complete setAuditorFrozen instruction (disc=28).
- *
- * Accounts:
- * 0. pool_state (writable)
- * 1. auditor    (signer)
- */
-export function buildSetAuditorFrozenInstruction(options: SetAuditorFrozenOptions): Instruction {
-  const config = getConfig();
-  return {
-    programAddress: config.utxopiaProgramId,
-    accounts: [
-      { address: options.accounts.poolState, role: AccountRole.WRITABLE },
-      { address: options.accounts.auditor,   role: AccountRole.READONLY_SIGNER },
-    ],
-    data: buildSetAuditorFrozenInstructionData(options.frozen),
-  };
-}
-
-// ---------------------------------------------------------------------------
-// setAuditorViewingPubkey (disc=29)
-// ---------------------------------------------------------------------------
-
-/** setAuditorViewingPubkey instruction options */
-export interface SetAuditorViewingPubkeyOptions {
-  /** New 32-byte viewing pubkey for the auditor */
-  viewingPubkey: Uint8Array;
-  accounts: {
-    /** 0. pool_state (writable) */
-    poolState: Address;
-    /** 1. auditor (signer) */
-    auditor: Address;
-  };
-}
-
-/**
- * Build setAuditorViewingPubkey instruction data (disc=29).
- *
- * Layout: disc(1) + viewing_pubkey(32) = 33 bytes.
- */
-export function buildSetAuditorViewingPubkeyInstructionData(viewingPubkey: Uint8Array): Uint8Array {
-  if (viewingPubkey.length !== 32) {
-    throw new Error(`viewingPubkey must be 32 bytes, got ${viewingPubkey.length}`);
-  }
-  const data = new Uint8Array(33);
-  data[0] = INSTRUCTION.SET_AUDITOR_VIEWING_PUBKEY;
-  data.set(viewingPubkey, 1);
-  return data;
-}
-
-/**
- * Build a complete setAuditorViewingPubkey instruction (disc=29).
- *
- * Accounts:
- * 0. pool_state (writable)
- * 1. auditor    (signer)
- */
-export function buildSetAuditorViewingPubkeyInstruction(
-  options: SetAuditorViewingPubkeyOptions,
-): Instruction {
-  const config = getConfig();
-  return {
-    programAddress: config.utxopiaProgramId,
-    accounts: [
-      { address: options.accounts.poolState, role: AccountRole.WRITABLE },
-      { address: options.accounts.auditor,   role: AccountRole.READONLY_SIGNER },
-    ],
-    data: buildSetAuditorViewingPubkeyInstructionData(options.viewingPubkey),
-  };
-}
-
 // ---------------------------------------------------------------------------
 // rotateAuditor (disc=35)
 // ---------------------------------------------------------------------------

package/src/poseidon.ts

@@ -164,12 +164,3 @@ export function computeTokenId(mintBytes: Uint8Array): bigint {
   const reduced = reduceToField(mintBytes);
   return poseidonHashSync([reduced, 0n]);
 }
-
-/**
- * Convenience: compute token_id from a Solana address string
- */
-export function computeTokenIdFromAddress(mintAddress: string): bigint {
-  // Base58 decode — import from @solana/kit if available, otherwise use raw bytes
-  // For now, caller should pass raw bytes via computeTokenId
-  throw new Error("Use computeTokenId(mintBytes) with raw pubkey bytes");
-}

package/src/prover/index.ts

@@ -9,11 +9,3 @@
 
 // Re-export everything from the web prover (default for browser/Node.js)
 export * from "./web";
-
-// Re-export types
-export type {
-  MerkleProofInput,
-  ProofData,
-  CircuitType,
-  JoinSplitProofInputs,
-} from "./web";

package/src/prover/web.ts

@@ -15,7 +15,7 @@ import {
   computeJoinSplitCommitmentSync,
   computeJoinSplitNullifierSync,
 } from "../poseidon";
-import { BN254_FIELD_PRIME } from "../crypto";
+import { BN254_FIELD_PRIME, bytesToHex } from "../crypto";
 import { TREE_DEPTH } from "../merkle";
 import { getConfig } from "../config";
 import { MAX_SAFE_JOINSPLIT_SIZE } from "../vk-registry";
@@ -60,13 +60,6 @@ export interface ProofData {
 
 export type CircuitType = `joinsplit_${number}x${number}`;
 
-/** Names of non-JoinSplit auxiliary circuits (selective disclosure). */
-export type AuxCircuitName =
-  | "ownership"
-  | "range_sum"
-  | "range_sum_4"
-  | "range_sum_16";
-
 // Environment detection
 const isBrowser = typeof window !== "undefined";
 const isNode = typeof process !== "undefined" && process.versions?.node;
@@ -85,13 +78,6 @@ export function setCircuitPath(path: string): void {
   artifactDownloadCache.clear();
 }
 
-/**
- * Get the current circuit base path
- */
-export function getCircuitPath(): string {
-  return circuitBasePath;
-}
-
 // Lazy-loaded snarkjs module
 let snarkjs: any = null;
 
@@ -164,9 +150,6 @@ export function setCircuitArtifactDigests(digests: Record<string, string> | null
   artifactBytesCache.clear();
 }
 
-const toHex = (buf: ArrayBuffer) =>
-  Array.from(new Uint8Array(buf), (b) => b.toString(16).padStart(2, "0")).join("");
-
 async function verifyArtifactBytes(url: string, bytes: Uint8Array): Promise<void> {
   if (!artifactDigests) return;
   // Key by path-under-base so one manifest works across origins (local dev vs CDN).
@@ -177,8 +160,8 @@ async function verifyArtifactBytes(url: string, bytes: Uint8Array): Promise<void
         `Regenerate the artifact manifest so it covers every shape this origin serves.`,
     );
   }
-  const actual = toHex(
-    await crypto.subtle.digest("SHA-256", bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer),
+  const actual = bytesToHex(
+    new Uint8Array(await crypto.subtle.digest("SHA-256", bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer)),
   );
   if (actual !== artifactDigests[key]) {
     throw new Error(
@@ -717,55 +700,3 @@ export async function cleanup(): Promise<void> {
 // ==========================================================================
 // Solana Instruction Building (for Groth16 on-chain verification)
 // ==========================================================================
-
-/**
- * Groth16 verifier program ID (from current config)
- */
-export function getGroth16VerifierProgramId(): Address {
-  const config = getConfig();
-  return config.groth16VerifierProgramId;
-}
-
-/**
- * Build instruction data for Groth16 verification
- */
-export function buildVerifyInstructionData(
-  proof: Uint8Array,
-  publicSignals: string[],
-  vkHash: string
-): Uint8Array {
-  const piBytes = publicSignals.flatMap((pi) => {
-    const bytes = new Array(32).fill(0);
-    const bigint = BigInt(pi);
-    for (let i = 31; i >= 0; i--) {
-      bytes[i] = Number((bigint >> BigInt((31 - i) * 8)) & 0xFFn);
-    }
-    return bytes;
-  });
-
-  const cleanHex = vkHash.startsWith("0x") ? vkHash.slice(2) : vkHash;
-  const vkHashBytes = new Uint8Array(cleanHex.length / 2);
-  for (let i = 0; i < vkHashBytes.length; i++) {
-    vkHashBytes[i] = parseInt(cleanHex.substr(i * 2, 2), 16);
-  }
-
-  const totalSize = proof.length + 4 + piBytes.length + 32;
-  const data = new Uint8Array(totalSize);
-  let offset = 0;
-
-  data.set(proof, offset);
-  offset += proof.length;
-
-  const piCount = publicSignals.length;
-  data[offset++] = piCount & 0xff;
-  data[offset++] = (piCount >> 8) & 0xff;
-  data[offset++] = (piCount >> 16) & 0xff;
-  data[offset++] = (piCount >> 24) & 0xff;
-
-  data.set(new Uint8Array(piBytes), offset);
-  offset += piBytes.length;
-
-  data.set(vkHashBytes, offset);
-
-  return data;
-}

package/src/psbt.ts

@@ -12,7 +12,7 @@
 
 import * as btc from "@scure/btc-signer";
 import { hex } from "@scure/base";
-import { DEPOSIT_OP_RETURN_SIZE, createOpReturnScriptFromPayload } from "./taproot";
+import { DEPOSIT_OP_RETURN_SIZE, createOpReturnScriptFromPayload, bech32Hrp, type BitcoinNetwork } from "./taproot";
 
 // =============================================================================
 // Types
@@ -54,7 +54,7 @@ export interface BuildDepositPsbtParams {
   /** Fee rate in sats/vbyte */
   feeRate: number;
   /** Bitcoin network */
-  network?: "mainnet" | "testnet" | "signet";
+  network?: BitcoinNetwork;
 }
 
 /** Result of PSBT construction */
@@ -151,7 +151,12 @@ export function buildDepositPsbt(params: BuildDepositPsbtParams): BuildDepositPs
     throw new Error(`OP_RETURN payload must be ${DEPOSIT_OP_RETURN_SIZE} bytes, got ${opReturnPayload.length}`);
   }
 
-  const btcNetwork = network === "mainnet" ? btc.NETWORK : btc.TEST_NETWORK;
+  // Regtest shares testnet's version bytes but not its bech32 hrp, so folding it
+  // into TEST_NETWORK leaves every bcrt1 address undecodable.
+  const btcNetwork =
+    network === "mainnet"
+      ? btc.NETWORK
+      : { ...btc.TEST_NETWORK, bech32: bech32Hrp(network) };
 
   // Calculate total input value
   const totalInput = senderUtxos.reduce((sum, u) => sum + u.value, 0);

package/src/spend-doc.ts

@@ -18,6 +18,7 @@ import {
   createUnshieldBoundParams,
   type SolanaPrivacyDomainContext,
 } from "./bound-params";
+import { bytesToHex as hex } from "./crypto";
 
 export interface SpendDoc {
   mode: "transfer" | "unshield" | "redeem";
@@ -64,8 +65,6 @@ function fmt(raw: bigint, decimals: number): string {
   return `${neg ? "-" : ""}${whole}${frac ? `.${frac}` : ""}`;
 }
 
-const hex = (b: Uint8Array) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
-
 function sortedValues(v: bigint[]): string {
   return [...v].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)).join(",");
 }

package/src/stealth.ts

@@ -401,21 +401,21 @@ export interface NonInteractiveDepositWithRefundResult extends NonInteractiveDep
 export async function createNonInteractiveDeposit(
   recipientMeta: StealthMetaAddress,
   custodyInternalKey: Uint8Array,
-  network?: "mainnet" | "testnet" | "regtest",
+  network?: BitcoinNetwork,
   userRefundPubkey?: undefined,
   opReturnContext?: DepositOpReturnContext,
 ): Promise<NonInteractiveDepositResult>;
 export async function createNonInteractiveDeposit(
   recipientMeta: StealthMetaAddress,
   custodyInternalKey: Uint8Array,
-  network: "mainnet" | "testnet" | "regtest",
+  network: BitcoinNetwork,
   userRefundPubkey: Uint8Array,
   opReturnContext: DepositOpReturnContext,
 ): Promise<NonInteractiveDepositWithRefundResult>;
 export async function createNonInteractiveDeposit(
   recipientMeta: StealthMetaAddress,
   custodyInternalKey: Uint8Array,
-  network: "mainnet" | "testnet" | "regtest" = "testnet",
+  network: BitcoinNetwork = "testnet",
   userRefundPubkey?: Uint8Array,
   opReturnContext?: DepositOpReturnContext,
 ): Promise<NonInteractiveDepositResult | NonInteractiveDepositWithRefundResult> {
@@ -491,7 +491,7 @@ export async function createNonInteractiveDeposit(
 export async function createDirectVaultDeposit(
   recipientMeta: StealthMetaAddress,
   vaultXOnlyPubkey: Uint8Array,
-  network: "mainnet" | "testnet" | "regtest" = "testnet",
+  network: BitcoinNetwork = "testnet",
   opReturnContext?: DepositOpReturnContext,
 ): Promise<NonInteractiveDepositResult> {
   if (!opReturnContext) {
@@ -735,7 +735,7 @@ export async function createTweakDeposit(
   recipientMeta: StealthMetaAddress,
   vaultXOnlyPubkey: Uint8Array,
   recovery: DepositRecoveryMaterial,
-  network: "mainnet" | "testnet" | "regtest" = "testnet",
+  network: BitcoinNetwork = "testnet",
 ): Promise<TweakDepositResult> {
   if (vaultXOnlyPubkey.length !== 32) {
     throw new Error("vaultXOnlyPubkey must be 32 bytes");
@@ -781,7 +781,7 @@ export async function createTweakDeposit(
  */
 export async function createDepositFromConfig(
   recipientMeta: StealthMetaAddress,
-  network: "mainnet" | "testnet" | "regtest" = "testnet",
+  network: BitcoinNetwork = "testnet",
   opReturnContext?: DepositOpReturnContext,
 ): Promise<NonInteractiveDepositResult> {
   const config = getConfig();
@@ -1220,6 +1220,7 @@ export async function scanUnifiedNotes(
 // ========== Connection Adapter ==========
 
 import type { Address } from "@solana/kit";
+import type { BitcoinNetwork } from "./taproot";
 
 export interface ConnectionAdapter {
   getAccountInfo: (
@@ -1285,23 +1286,6 @@ export function packStealthOutputForCircuit(output: StealthOutputData): CircuitS
   };
 }
 
-/**
- * Unpack encrypted amount from packed Field element
- */
-export function unpackEncryptedAmountWithSign(packed: bigint): { encryptedAmount: Uint8Array; ySign: boolean } {
-  const ySign = (packed & (1n << 64n)) !== 0n;
-  const amount = packed & ((1n << 64n) - 1n);
-
-  const encryptedAmount = new Uint8Array(8);
-  let temp = amount;
-  for (let i = 0; i < 8; i++) {
-    encryptedAmount[i] = Number(temp & 0xffn);
-    temp >>= 8n;
-  }
-
-  return { encryptedAmount, ySign };
-}
-
 /**
  * Create stealth output data for a self-send (change output)
  */

package/src/taproot.ts

@@ -8,7 +8,7 @@
 
 import { sha256 } from "@noble/hashes/sha2.js";
 import { taggedHash, hexToBytes, bytesToHex } from "./crypto";
-import * as bech32 from "bech32";
+import { bech32, bech32m } from "@scure/base";
 import { secp256k1 } from "@noble/curves/secp256k1.js";
 
 // Never use the secp256k1 generator as a custody key. Its discrete log is
@@ -31,7 +31,7 @@ const UNSAFE_GENERATOR_INTERNAL_KEY_HEX =
  */
 export function deriveTaprootAddress(
   commitment: Uint8Array,
-  network: "mainnet" | "testnet" | "regtest" = "testnet",
+  network: BitcoinNetwork = "testnet",
   internalKey?: Uint8Array
 ): {
   address: string;
@@ -77,11 +77,7 @@ export function deriveTaprootAddress(
   const outputKeyHex = outputPoint.toHex(true); // 33-byte compressed hex
   const outputKey = hexToBytes(outputKeyHex.slice(2)); // drop "02"/"03" prefix
 
-  // Encode as bech32m address
-  const hrp = network === "mainnet" ? "bc" : network === "regtest" ? "bcrt" : "tb";
-  const words = bech32.bech32m.toWords(outputKey);
-  // Witness version 1 for taproot
-  const address = bech32.bech32m.encode(hrp, [1, ...words]);
+  const address = p2trAddress(outputKey, network);
 
   return {
     address,
@@ -164,7 +160,7 @@ export function depositLeafScript(
 export function deriveDepositAddress(
   commitment: Uint8Array,
   ikaXOnlyPubkey: Uint8Array,
-  network: "mainnet" | "testnet" | "regtest" = "testnet"
+  network: BitcoinNetwork = "testnet"
 ): {
   address: string;
   outputKey: Uint8Array;
@@ -203,25 +199,73 @@ export function verifyTaprootAddress(
   internalKey?: Uint8Array
 ): boolean {
   try {
-    const decoded = bech32.bech32m.decode(address);
+    const decoded = bech32m.decode(address as `${string}1${string}`);
     const witnessVersion = decoded.words[0];
     if (witnessVersion !== 1) {
       return false;
     }
 
-    const actualOutputKey = new Uint8Array(
-      bech32.bech32m.fromWords(decoded.words.slice(1))
-    );
+    const network = networkForHrp(decoded.prefix);
+    if (!network) return false;
 
-    const network = decoded.prefix === "bc" ? "mainnet" : "testnet";
     const expected = deriveTaprootAddress(commitment, network, internalKey);
 
-    return arraysEqual(actualOutputKey, expected.outputKey);
+    // Compare the whole address, not just the output key: the key is identical
+    // on every network, so an output-key match said nothing about the encoding.
+    // bech32 is case-insensitive, hence the fold.
+    return address.toLowerCase() === expected.address;
   } catch {
     return false;
   }
 }
 
+/**
+ * The networks whose addresses this SDK derives.
+ *
+ * Kept as one alias because the members drifted when it was spelled out at each
+ * call site: psbt.ts folded regtest into testnet while taproot.ts did not, and
+ * the two disagreed about what a bcrt1 address was.
+ */
+export type BitcoinNetwork = "mainnet" | "testnet" | "signet" | "regtest";
+
+/**
+ * bech32 human-readable prefix for a Bitcoin network.
+ *
+ * Regtest is the reason this exists: it shares testnet's version bytes but not
+ * its prefix, and every place that folded the two together produced addresses
+ * no regtest node would accept.
+ */
+export function bech32Hrp(network: BitcoinNetwork): string {
+  return network === "mainnet" ? "bc" : network === "regtest" ? "bcrt" : "tb";
+}
+
+/**
+ * The network an address's bech32 prefix names, or null if it names none.
+ *
+ * Null rather than a testnet default: an unrecognised prefix is an address this
+ * SDK cannot place, and quietly calling it testnet is how bcrt1 addresses ended
+ * up classified as testnet everywhere.
+ */
+export function networkForHrp(prefix: string): BitcoinNetwork | null {
+  return prefix === "bc"
+    ? "mainnet"
+    : prefix === "tb"
+      ? "testnet"
+      : prefix === "bcrt"
+        ? "regtest"
+        : null;
+}
+
+/**
+ * Encode an x-only output key as a witness-v1 (P2TR) address.
+ */
+export function p2trAddress(
+  outputKey: Uint8Array,
+  network: BitcoinNetwork,
+): string {
+  return bech32m.encode(bech32Hrp(network), [1, ...bech32m.toWords(outputKey)]);
+}
+
 /**
  * Generate a P2TR (Pay-to-Taproot) script pubkey
  *
@@ -264,18 +308,19 @@ export function parseP2TRScriptPubkey(
 export function isValidBitcoinAddress(address: string): {
   valid: boolean;
   type: "p2pkh" | "p2sh" | "p2wpkh" | "p2wsh" | "p2tr" | "unknown";
-  network: "mainnet" | "testnet" | "unknown";
+  network: BitcoinNetwork | "unknown";
 } {
   try {
     // Bech32m (Taproot)
-    if (address.startsWith("bc1p") || address.startsWith("tb1p")) {
-      const decoded = bech32.bech32m.decode(address);
-      if (decoded.words[0] === 1 && decoded.words.length === 53) {
-        return {
-          valid: true,
-          type: "p2tr",
-          network: decoded.prefix === "bc" ? "mainnet" : "testnet",
-        };
+    if (
+      address.startsWith("bc1p") ||
+      address.startsWith("tb1p") ||
+      address.startsWith("bcrt1p")
+    ) {
+      const decoded = bech32m.decode(address as `${string}1${string}`);
+      const network = networkForHrp(decoded.prefix);
+      if (network && decoded.words[0] === 1 && decoded.words.length === 53) {
+        return { valid: true, type: "p2tr", network };
       }
     }
 
@@ -285,19 +330,11 @@ export function isValidBitcoinAddress(address: string): {
       address.startsWith("tb1q") ||
       address.startsWith("bcrt1q")
     ) {
-      const decoded = bech32.bech32.decode(address);
-      if (decoded.words[0] === 0) {
+      const decoded = bech32.decode(address as `${string}1${string}`);
+      const network = networkForHrp(decoded.prefix);
+      if (network && decoded.words[0] === 0) {
         const type = decoded.words.length === 33 ? "p2wpkh" : "p2wsh";
-        return {
-          valid: true,
-          type,
-          network:
-            decoded.prefix === "bc"
-              ? "mainnet"
-              : decoded.prefix === "bcrt"
-              ? "testnet"
-              : "testnet",
-        };
+        return { valid: true, type, network };
       }
     }
 
@@ -623,7 +660,7 @@ export function deriveTaprootAddressWithRefund(
   npk: Uint8Array,
   userRefundPubkey: Uint8Array,
   internalKey: Uint8Array,
-  network: "mainnet" | "testnet" | "regtest" = "testnet"
+  network: BitcoinNetwork = "testnet"
 ): {
   address: string;
   outputKey: Uint8Array;
@@ -672,9 +709,7 @@ export function deriveTaprootAddressWithRefund(
   controlBlock.set(internalKey, 1);
 
   // 7. Encode as bech32m address
-  const hrp = network === "mainnet" ? "bc" : network === "regtest" ? "bcrt" : "tb";
-  const words = bech32.bech32m.toWords(outputKey);
-  const address = bech32.bech32m.encode(hrp, [1, ...words]);
+  const address = p2trAddress(outputKey, network);
 
   return {
     address,