diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 19d4dd9..eefe807 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,7 +37,28 @@ jobs:
       - name: Package extension (sideloadable unpacked zip)
         run: |
           mkdir -p dist
-          zip -r dist/podkey-extension.zip manifest.json src popup $([ -d icons ] && echo icons) -x '*.test.js'
+          # vendor/ holds the sidestr engine the spend window imports (MV3 forbids remote code)
+          zip -r dist/podkey-extension.zip manifest.json src popup vendor $([ -d icons ] && echo icons) -x '*.test.js'
+
+      - name: Check the package holds every file the extension loads
+        run: |
+          python3 - <<'PY'
+          import json, re, zipfile
+          z = set(zipfile.ZipFile('dist/podkey-extension.zip').namelist())
+          m = json.load(open('manifest.json'))
+          need = [m['background']['service_worker'], m['action']['default_popup'], *m['icons'].values()]
+          need += [f for c in m['content_scripts'] for f in c['js']]
+          need += [f for w in m.get('web_accessible_resources', []) for f in w['resources']]
+          for page in ['popup/popup.html', 'popup/approve.html', 'popup/spend.html']:
+              need += ['popup/' + r for r in re.findall(r'(?:src|href)="([^"#?:]+)"', open(page).read())]
+          # the spend window's engine: every vendored file PINS.json records
+          for pin in json.load(open('vendor/sidestr/PINS.json'))['pins']:
+              need += [f"vendor/sidestr/{pin['name']}/{f}" for f in pin['files']]
+          missing = sorted(set(need) - z)
+          if missing:
+              raise SystemExit('missing from the package: ' + ', '.join(missing))
+          print(f'package holds all {len(set(need))} files the extension loads')
+          PY
 
       - name: Upload extension artifact
         uses: actions/upload-artifact@v4
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c7a8acd..cb14f91 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,67 @@ All notable changes to Podkey will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.0.9] - 2026-09-24
+
+### Added
+
+- **sidestr spends: `window.nostr.sidestr.signTransaction({ chain, tx })`.**
+  Podkey is the reference signer for sidestr's browser-signer proposal
+  (`proposals/browser-signer.md` in sidestr/spec). A page on any sidestr chain
+  asks for a spend and never holds the key. Podkey's own spend window reads the
+  chain from its id (the signer's announcement, a mirror it names, every block
+  validated), checks that every input is your own mature, unspent coin, computes
+  each sighash itself, and shows what leaves your wallet: each recipient (their
+  npub, and their profile name when found), what comes back, the fee, and any
+  asset (SPEC 12) the spend moves, destroys or burns. Destroying or burning needs
+  an explicit tick. Every spend asks, whatever the site is trusted for; the key
+  stays in the background and signs only what the window computed, once.
+  Refusals reach the page with a `code`: `rejected`, `unsupported`,
+  `not-yours`, `invalid` or `unavailable`.
+- Chains beside a test network only for now. Each chain's signer is remembered
+  on first spend and a different one is refused, since a chain id is a name,
+  not a proof.
+- The sidestr engine is vendored at pinned commits (`scripts/vendor-sidestr.js`,
+  `vendor/sidestr/PINS.json` with a SHA-256 per file): Manifest V3 forbids code
+  from the network. Chains that name the EVM rule are `unsupported` until it is
+  vendored too.
+
+### Fixed
+
+- Requests from a page wait up to three minutes instead of 30 seconds, so a site
+  no longer times out while you unlock Podkey with a security key's PIN and
+  touch. Each request's timer is cleared when its answer arrives.
+
+- **Security keys: passkey windows no longer fail straight away.** A passkey
+  window started its WebAuthn ceremony on `DOMContentLoaded`, often before the
+  new window had focus, and WebAuthn refuses an unfocused document with the same
+  `NotAllowedError` as a cancel. Ceremonies now wait for focus.
+- **Security keys: the browser goes straight to the key.** The transports a
+  credential reports (`usb`, `nfc`, …) are stored and passed in
+  `allowCredentials`, so unlock asks to insert and touch the key instead of
+  opening the generic chooser that leads with a phone/QR option. Passkeys set up
+  before this keep working without the hint.
+- **"Unlock with passkey" showed with no passkey set up.** `.btn` overrode the
+  `hidden` attribute; a global `[hidden]` rule restores it.
+- Ceremony errors name the step and say what to do (PIN, touch, keep the window
+  in front); `InvalidStateError`, `NotSupportedError` and `SecurityError` get
+  their own messages. Failures show inline with **Try again** instead of an
+  `alert()` over a dead window, and set-up says which of its two touches is next.
+- Ceremony timeouts are three minutes (time to find a key and set a first PIN);
+  EdDSA and RS256 are offered after ES256 for authenticators that lack ES256.
+- A window opened only to unlock closes itself once unlocked, handing focus back
+  to the site that asked.
+- The **Set up** passkey button no longer stays on "Waiting…" after a failure.
+
+### Changed
+
+- The first-approval prompt says that approving also trusts the site from then
+  on (it always did; the prompt did not say so).
+- Export shows the key as `nsec`, the form other apps and Podkey's import take.
+- Plainer copy on the welcome, import and passkey screens; import says it takes
+  `nsec` or hex. Stronger text contrast in light and dark, a primary-button fill
+  that passes contrast in dark mode, and keyboard focus rings on every control.
+  Debug logging removed from the popup.
 
 ### Added
 
diff --git a/README.md b/README.md
index 11d5988..8165c61 100644
--- a/README.md
+++ b/README.md
@@ -118,6 +118,33 @@ const payload = await window.nostr.nip44.encrypt(peer, 'hello')
 const plaintext = await window.nostr.nip44.decrypt(peer, payload)
 ```
 
+#### `window.nostr.sidestr.signTransaction({ chain, tx })`
+
+Signs a spend on a [sidestr](https://sidestr.com) chain, per sidestr's
+[browser-signer proposal](https://github.com/sidestr/spec/blob/gh-pages/proposals/browser-signer.md).
+A sidestr coin pays `OP_1 <your key>`, so the key Podkey guards is the key that
+spends your coins. `chain` is a chain id such as `sidestr:dreamlab`; `tx` is the
+transaction as hex (any witness is ignored). It resolves `{ tx, txid }` with
+every input signed, or rejects with an `Error` whose `code` is `rejected`,
+`unsupported`, `not-yours`, `invalid` or `unavailable`.
+
+```javascript
+if (window.nostr?.sidestr?.version >= 1) {
+  const { tx, txid } = await window.nostr.sidestr.signTransaction({ chain: 'sidestr:dreamlab', tx: unsignedHex })
+  // publish `tx` as a kind 23500 event from any key: a transaction authorises itself
+}
+```
+
+The page is trusted for nothing but the request. Podkey opens its own spend
+window, reads the chain from its id (the signer's tip announcement, a mirror it
+names, every block validated), checks that every input is your own mature,
+unspent coin, computes each sighash itself, and shows what leaves your wallet:
+each recipient, what comes back, the fee, and any asset the spend moves or
+destroys. It asks every time, whatever else the site is trusted for, and signs
+only after you confirm. It takes chains beside test networks only for now, and
+remembers each chain's signer on the first spend so that a different signer
+announcing the same id is refused.
+
 ## Architecture
 
 ```
@@ -137,6 +164,13 @@ const plaintext = await window.nostr.nip44.decrypt(peer, payload)
 │  Page bridge (src/injected.js)           │
 │   injects window.nostr, relays requests  │
 │   to the worker, whitelists message types│
+│                                          │
+│  sidestr spend window (popup/spend.*,    │
+│   src/sidestr/)                          │
+│   validates the chain with the vendored  │
+│   engine (vendor/sidestr/), reviews and  │
+│   shows the spend; the worker signs its  │
+│   sighashes once, after you confirm      │
 └─────────────────────────────────────────┘
 ```
 
diff --git a/manifest.json b/manifest.json
index 0754b3f..76625aa 100644
--- a/manifest.json
+++ b/manifest.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Podkey",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "description": "Nostr (NIP-07) signer and Solid (NIP-98) login. One did:nostr key, encrypted on your device.",
   "content_security_policy": {
     "extension_pages": "script-src 'self'; object-src 'self'"
@@ -52,4 +52,4 @@
       ]
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/package.json b/package.json
index d5c12fb..99c2569 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "podkey",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "description": "did:nostr and Solid authentication extension - NIP-07 provider for decentralized identity",
   "main": "src/index.js",
   "type": "module",
diff --git a/popup/approve.css b/popup/approve.css
index 3f042c9..e0e0992 100644
--- a/popup/approve.css
+++ b/popup/approve.css
@@ -220,7 +220,7 @@ body {
   justify-content: center;
   gap: 6px;
   font-size: 11px;
-  color: var(--text-faint);
+  color: var(--text-muted);
   margin-bottom: 7px;
 }
 
diff --git a/popup/approve.html b/popup/approve.html
index 29b0099..0136260 100644
--- a/popup/approve.html
+++ b/popup/approve.html
@@ -46,7 +46,7 @@
           <line x1="12" y1="8" x2="12" y2="12" />
           <line x1="12" y1="16" x2="12.01" y2="16" />
         </svg>
-        <span>Approving lets this site act with your key as if it were you.</span>
+        <span>Approving also trusts this site: from now on it can sign and read messages as you without asking. You can remove it under Trusted sites in Podkey.</span>
       </div>
 
       <div class="btn-row">
diff --git a/popup/popup.css b/popup/popup.css
index 89bab18..299d032 100644
--- a/popup/popup.css
+++ b/popup/popup.css
@@ -14,8 +14,9 @@
 
   /* Text */
   --text: #1e293b;
-  --text-muted: #64748b;
-  --text-faint: #94a3b8;
+  --text-muted: #5b6b80;
+  /* decorative text only (placeholders, separators); never body copy */
+  --text-faint: #8391a5;
 
   /* Borders */
   --border: #e2e8f0;
@@ -26,6 +27,9 @@
   --accent-hover: #1d4ed8;
   --accent-soft: #eff6ff;
   --accent-ring: rgba(37, 99, 235, 0.25);
+  /* fill behind white text: dark mode's lighter --accent fails contrast there */
+  --accent-solid: #2563eb;
+  --accent-solid-hover: #1d4ed8;
 
   /* Semantic */
   --safe: #16a34a;
@@ -64,8 +68,8 @@
     --surface-inset: #0f151d;
 
     --text: #e6eaf0;
-    --text-muted: #9aa6b6;
-    --text-faint: #6b7888;
+    --text-muted: #a3afbf;
+    --text-faint: #7b8898;
 
     --border: #2a3340;
     --border-strong: #3a4452;
@@ -74,6 +78,8 @@
     --accent-hover: #74a0f4;
     --accent-soft: #16223a;
     --accent-ring: rgba(91, 141, 239, 0.35);
+    --accent-solid: #2f63d4;
+    --accent-solid-hover: #3a6fe0;
 
     --safe: #4ade80;
     --safe-hover: #6ee79a;
@@ -246,13 +252,13 @@ h2 {
 }
 
 .btn-primary {
-  background: var(--accent);
+  background: var(--accent-solid);
   color: #fff;
   box-shadow: var(--shadow-sm);
 }
 
 .btn-primary:hover {
-  background: var(--accent-hover);
+  background: var(--accent-solid-hover);
 }
 
 .btn-secondary {
@@ -279,13 +285,66 @@ h2 {
 .advanced-choice p { margin-top: 7px; line-height: 1.45; }
 .advanced-choice .advanced-audience { color: var(--text-muted); border-left: 2px solid var(--border-strong); padding-left: 9px; }
 .text-action { width: 100%; margin-top: 10px; padding: 9px; border: 1px solid var(--border-strong); border-radius: var(--radius-sm); background: var(--surface); color: var(--text); font: inherit; font-weight: 600; cursor: pointer; }
-.divider { display: flex; align-items: center; gap: 8px; margin: 12px 0; color: var(--text-faint); font-size: 10px; text-transform: uppercase; letter-spacing: .06em; }
+.divider { display: flex; align-items: center; gap: 8px; margin: 12px 0; color: var(--text-muted); font-size: 10px; text-transform: uppercase; letter-spacing: .06em; }
 .divider::before, .divider::after { content: ''; height: 1px; flex: 1; background: var(--border); }
 .settings-separated { margin-top: 12px; padding-top: 12px; border-top: 1px solid var(--border); }
 .btn-small { flex: none; padding: 6px 10px; border: 1px solid var(--border-strong); border-radius: var(--radius-sm); background: var(--surface); color: var(--accent); font: inherit; font-size: 11px; font-weight: 700; cursor: pointer; }
 .backup-ack { display: flex; align-items: center; gap: 8px; margin: 12px 0 4px; font-size: 12px; color: var(--text); cursor: pointer; }
 .backup-ack input { accent-color: var(--accent); width: 15px; height: 15px; flex: none; cursor: pointer; }
 
+/* Keyboard focus for every control that had none (small buttons, the
+   passkey summary, footer links, toggles). */
+.btn-small:focus-visible,
+.text-action:focus-visible,
+.btn-copy:focus-visible,
+.btn-remove:focus-visible,
+.advanced-choice summary:focus-visible,
+.footer a:focus-visible,
+.toggle input:focus-visible + .slider {
+  outline: none;
+  box-shadow: 0 0 0 3px var(--accent-ring);
+  border-radius: var(--radius-sm);
+}
+
+.btn-small:hover,
+.text-action:hover {
+  background: var(--surface-2);
+}
+
+.btn-small[disabled],
+.text-action[disabled] {
+  opacity: 0.55;
+  cursor: progress;
+}
+
+/* ---- Passkey status line ---- */
+.flow-status {
+  margin: 12px 18px 0;
+  padding: 10px 12px;
+  border: 1px solid var(--accent-ring);
+  border-radius: var(--radius-sm);
+  background: var(--accent-soft);
+  color: var(--text);
+  font-size: 12.5px;
+  line-height: 1.45;
+}
+
+.flow-status.error {
+  border-color: var(--danger-border);
+  background: var(--danger-soft);
+  color: var(--danger);
+}
+
+.flow-status .btn {
+  margin: 10px 0 0;
+  padding: 8px 12px;
+  font-size: 13px;
+}
+
+[hidden] {
+  display: none !important;
+}
+
 /* ---- Identity ---- */
 .identity-section .section-title {
   margin-bottom: 10px;
@@ -584,7 +643,7 @@ input:focus-visible + .slider {
 .empty-state {
   text-align: center;
   padding: 22px 16px;
-  color: var(--text-faint);
+  color: var(--text-muted);
   font-size: 12.5px;
 }
 
diff --git a/popup/popup.html b/popup/popup.html
index b816efe..11da8f4 100644
--- a/popup/popup.html
+++ b/popup/popup.html
@@ -7,6 +7,13 @@
     <link rel="stylesheet" href="popup.css" />
   </head>
   <body>
+    <!-- Passkey status: what to do with the authenticator now, or what went
+         wrong and a way to try again (set by popup.js showFlowStatus) -->
+    <div id="flowStatus" class="flow-status" role="status" aria-live="polite" hidden>
+      <p id="flowStatusText"></p>
+      <button id="flowRetryBtn" class="btn btn-secondary" type="button" hidden>Try again</button>
+    </div>
+
     <!-- Setup Screen (shown when no key exists) -->
     <div id="setupScreen" class="screen" style="display: none">
       <div class="header center">
@@ -20,7 +27,7 @@
         </div>
         <h1>Welcome to Podkey</h1>
         <p class="subtitle">
-          did:nostr and Solid authentication for the decentralized web
+          One key, kept on this device, for Nostr apps and Solid pods
         </p>
       </div>
 
@@ -43,19 +50,18 @@ <h1>Welcome to Podkey</h1>
         </button>
         <details class="advanced-choice">
           <summary>Advanced: passkey identity</summary>
-          <p class="advanced-audience">For managing agents or working under compliance rules: bind your key to a FIDO2 passkey — hardware-backed, phishing-resistant, and unlocked with biometrics or a security key.</p>
+          <p class="advanced-audience">For managing agents or working under compliance rules: tie your key to a passkey — a security key such as a YubiKey, or your phone or computer's own passkey.</p>
           <button id="passkeyDerivedBtn" class="text-action" type="button">Create identity from a passkey</button>
-          <p>No passphrase. Your passkey recreates the same Nostr key. Export a backup in case the passkey is lost.</p>
+          <p>No passphrase: your passkey recreates the same key each time. You'll touch a security key twice while setting up, and it needs a PIN (your browser helps you set one). Save the backup Podkey shows you, in case the passkey is lost.</p>
         </details>
       </div>
 
       <div class="info-box">
         <div class="info-box-title">What is Podkey?</div>
         <p>
-          A browser extension for <strong>did:nostr</strong> and
-          <strong>Solid</strong> authentication. It holds your cryptographic
-          identity and signs in to Solid pods using your did:nostr identity —
-          your keys never leave this device.
+          Podkey holds your <strong>Nostr</strong> key and signs for you when a
+          site asks — posts, messages, and sign-in to <strong>Solid</strong>
+          pods. You approve each new site. Your key never leaves this device.
         </p>
       </div>
     </div>
@@ -134,15 +140,15 @@ <h1>Unlock Podkey</h1>
         </div>
         <div>
           <h2>Import private key</h2>
-          <p class="subtitle">Enter your 64-character hex private key</p>
+          <p class="subtitle">Paste your nsec or 64-character hex key</p>
         </div>
       </div>
 
       <div class="section">
-        <label for="privateKeyInput">Private key (hex)</label>
+        <label for="privateKeyInput">Private key</label>
         <textarea
           id="privateKeyInput"
-          placeholder="64-character hexadecimal private key…"
+          placeholder="nsec1… or 64 hex characters"
           rows="3"
           spellcheck="false"
           autocomplete="off"
@@ -251,7 +257,7 @@ <h1>Podkey</h1>
         </div>
 
         <div class="identity-field">
-          <div class="identity-label">Public key (npub hex)</div>
+          <div class="identity-label">Public key (hex)</div>
           <div class="identity-value" id="publicKey">Loading…</div>
         </div>
 
diff --git a/popup/popup.js b/popup/popup.js
index 7f2678d..898175f 100644
--- a/popup/popup.js
+++ b/popup/popup.js
@@ -28,19 +28,73 @@ let pendingDerivedIdentity = null;
 
 // Initialize
 document.addEventListener('DOMContentLoaded', async () => {
-  console.log('[Podkey Popup] DOMContentLoaded fired');
   await checkKeypairStatus();
   setupEventListeners();
-  console.log('[Podkey Popup] Initialization complete');
 
   // When relaunched as a dedicated passkey window (?flow=…), start the
-  // requested ceremony immediately — see runPasskeyFlow.
-  const flow = new URLSearchParams(location.search).get('flow');
-  if (flow === 'create') handleCreatePasskeyIdentity();
-  else if (flow === 'enable') handleEnablePasskeyUnlock();
-  else if (flow === 'unlock') handlePasskeyUnlock();
+  // requested ceremony — see runPasskeyFlow — but only once this window has
+  // focus. WebAuthn refuses a ceremony from an unfocused document with the
+  // same NotAllowedError as a cancel, and a window created with focused:true
+  // is often not focused yet when DOMContentLoaded fires: that race was the
+  // "passkey prompt fails straight away" snag with security keys.
+  const handler = FLOW_HANDLERS[new URLSearchParams(location.search).get('flow')];
+  if (handler) {
+    showFlowStatus('Getting your passkey ready…');
+    await whenFocused();
+    handler();
+  }
 });
 
+const FLOW_HANDLERS = {
+  create: () => handleCreatePasskeyIdentity(),
+  enable: () => handleEnablePasskeyUnlock(),
+  unlock: () => handlePasskeyUnlock()
+};
+
+/** Resolve once this document has focus (at once if it already has). */
+function whenFocused() {
+  if (document.hasFocus()) return Promise.resolve();
+  return new Promise(resolve => window.addEventListener('focus', () => resolve(), { once: true }));
+}
+
+/**
+ * The passkey status line at the top of the window: what to do with the
+ * authenticator now, or what went wrong with a way to try again. Replaces
+ * alert() for ceremonies, which stacked a modal on top of the browser's own
+ * passkey dialog and left a dead window behind after a failure.
+ */
+function showFlowStatus(text, { error = false, retry = null } = {}) {
+  const box = document.getElementById('flowStatus');
+  document.getElementById('flowStatusText').textContent = text;
+  box.classList.toggle('error', error);
+  box.hidden = false;
+  const btn = document.getElementById('flowRetryBtn');
+  btn.hidden = !retry;
+  btn.onclick = retry ? () => { btn.hidden = true; retry(); } : null;
+}
+
+function hideFlowStatus() {
+  document.getElementById('flowStatus').hidden = true;
+}
+
+/** Whether this page runs in one of Podkey's own popup windows, not the toolbar popup. */
+async function inOwnWindow() {
+  try {
+    return (await chrome.windows.getCurrent()).type === 'popup';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * A window Podkey opened only so the person could unlock (the background's
+ * unlock prompt, or a passkey relaunch) has done its job once the key is
+ * unlocked: close it and hand focus back to the site that asked.
+ */
+async function closeIfUnlockWindow() {
+  if (await inOwnWindow()) setTimeout(() => window.close(), 700);
+}
+
 /**
  * Run a WebAuthn ceremony in a context that survives losing focus. The
  * toolbar action popup is destroyed on blur — and the platform authenticator
@@ -50,19 +104,15 @@ document.addEventListener('DOMContentLoaded', async () => {
  * let ?flow= restart the ceremony there.
  */
 async function runPasskeyFlow(flow, handler) {
-  let inOwnWindow = false;
-  try {
-    inOwnWindow = (await chrome.windows.getCurrent()).type === 'popup';
-  } catch { /* fall through: treat as action popup and relaunch */ }
-  if (inOwnWindow) {
+  if (await inOwnWindow()) {
     await handler();
     return;
   }
   await chrome.windows.create({
     url: chrome.runtime.getURL(`popup/popup.html?flow=${flow}`),
     type: 'popup',
-    width: 400,
-    height: 560,
+    width: 420,
+    height: 620,
     focused: true
   });
   window.close();
@@ -72,7 +122,6 @@ async function runPasskeyFlow(flow, handler) {
  * Check if keypair exists and show appropriate screen
  */
 async function checkKeypairStatus() {
-  console.log('[Podkey Popup] Checking keypair status...');
   try {
     const response = await chrome.runtime.sendMessage({ type: 'GET_KEYPAIR_STATUS' });
     if (DEBUG) console.log('[Podkey Popup] Keypair status response:', response);
@@ -97,13 +146,9 @@ async function checkKeypairStatus() {
  * Show setup screen
  */
 function showSetupScreen() {
-  console.log('[Podkey Popup] Showing setup screen');
   hideAllScreens();
-  const setupScreen = document.getElementById('setupScreen');
-  console.log('[Podkey Popup] Setup screen element:', setupScreen);
-  setupScreen.style.display = 'block';
+  document.getElementById('setupScreen').style.display = 'block';
   currentScreen = 'setup';
-  console.log('[Podkey Popup] Setup screen display set to block');
 }
 
 async function getPasskeyConfig() {
@@ -200,7 +245,6 @@ function hideAllScreens() {
  * Setup event listeners
  */
 function setupEventListeners() {
-  console.log('[Podkey Popup] Setting up event listeners');
   // Setup screen
   document.getElementById('generateBtn').addEventListener('click', () => showGenerateScreen());
   document.getElementById('importBtn').addEventListener('click', () => showImportScreen());
@@ -247,12 +291,15 @@ function setupEventListeners() {
 
 async function registerPrfPasskey(label) {
   const prfSalt = newPasskeySalt();
-  const { credentialId } = await createPasskey(prfSalt, label);
+  showFlowStatus('Step 1 of 2: register a passkey. With a security key, insert it, enter its PIN if asked, and touch it.');
+  const { credentialId, transports } = await createPasskey(prfSalt, label);
   // Key material comes from a get() assertion — the operation every future
   // unlock performs — so what we derive or wrap now is exactly what the
   // passkey will reproduce later. (Second prompt is the cost of that proof.)
-  const prfOutput = await getPasskeyPrf(credentialId, prfSalt);
-  return { credentialId, prfOutput, prfSalt };
+  showFlowStatus('Step 2 of 2: confirm the same passkey once more. Touch your security key again.');
+  const prfOutput = await getPasskeyPrf(credentialId, prfSalt, transports);
+  hideFlowStatus();
+  return { credentialId, transports, prfOutput, prfSalt };
 }
 
 async function handleCreatePasskeyIdentity() {
@@ -264,7 +311,7 @@ async function handleCreatePasskeyIdentity() {
   try {
     btn.disabled = true;
     btn.textContent = 'Creating passkey…';
-    const { credentialId, prfOutput, prfSalt } = await registerPrfPasskey('Podkey Nostr identity');
+    const { credentialId, transports, prfOutput, prfSalt } = await registerPrfPasskey('Podkey Nostr identity');
     const derivationSalt = newPasskeySalt();
     const privateKey = await deriveNostrKey(prfOutput, derivationSalt);
     // Persist nothing yet: the identity only comes into existence once the
@@ -272,13 +319,13 @@ async function handleCreatePasskeyIdentity() {
     pendingDerivedIdentity = {
       privateKey,
       config: {
-        v: 1, mode: 'derived', credentialId,
+        v: 1, mode: 'derived', credentialId, transports,
         prfSalt: toBase64Url(prfSalt), derivationSalt: toBase64Url(derivationSalt)
       }
     };
     showBackupScreen(privateKey);
   } catch (error) {
-    alert(error.message || 'Could not create a passkey identity.');
+    showFlowStatus(error.message || 'Could not create a passkey identity.', { error: true, retry: handleCreatePasskeyIdentity });
   } finally {
     btn.disabled = false;
     btn.textContent = 'Create identity from a passkey';
@@ -345,14 +392,18 @@ async function handleEnablePasskeyUnlock() {
     btn.textContent = 'Waiting…';
     const { podkey_private_key: privateKey } = await chrome.storage.session.get(['podkey_private_key']);
     if (!privateKey) throw new Error('Unlock Podkey before setting up passkey unlock');
-    const { credentialId, prfOutput, prfSalt } = await registerPrfPasskey('Podkey unlock');
+    const { credentialId, transports, prfOutput, prfSalt } = await registerPrfPasskey('Podkey unlock');
     const wrapped = await wrapPrivateKey(privateKey, prfOutput);
     await chrome.storage.local.set({ [PASSKEY_CONFIG_KEY]: {
-      v: 1, mode: 'wrapped', credentialId, prfSalt: toBase64Url(prfSalt), wrapped
+      v: 1, mode: 'wrapped', credentialId, transports, prfSalt: toBase64Url(prfSalt), wrapped
     } });
     await showMainScreen(await chrome.runtime.sendMessage({ type: 'GET_KEYPAIR_STATUS' }));
+    showFlowStatus('Passkey unlock is ready. Next time, unlock with your passkey instead of your passphrase.');
   } catch (error) {
-    alert(error.message || 'Could not enable passkey unlock.');
+    showFlowStatus(error.message || 'Could not set up passkey unlock.', { error: true, retry: handleEnablePasskeyUnlock });
+    // showMainScreen restores the label on success; on failure put it back here
+    const config = await getPasskeyConfig();
+    btn.textContent = config ? 'Replace' : 'Set up';
   } finally {
     btn.disabled = false;
   }
@@ -362,18 +413,21 @@ async function handlePasskeyUnlock() {
   const btn = document.getElementById('passkeyUnlockBtn');
   try {
     btn.disabled = true;
-    btn.textContent = 'Waiting for passkey…';
+    btn.textContent = 'Waiting for your passkey…';
     const config = await getPasskeyConfig();
-    if (!config) throw new Error('No passkey is configured');
-    const prfOutput = await getPasskeyPrf(config.credentialId, fromBase64Url(config.prfSalt));
+    if (!config) throw new Error('No passkey is set up on this browser');
+    showFlowStatus('Use your passkey. With a security key, insert it, enter its PIN if asked, and touch it.');
+    const prfOutput = await getPasskeyPrf(config.credentialId, fromBase64Url(config.prfSalt), config.transports);
     const privateKey = config.mode === 'derived'
       ? await deriveNostrKey(prfOutput, fromBase64Url(config.derivationSalt))
       : await unwrapPrivateKey(config.wrapped, prfOutput);
     const response = await chrome.runtime.sendMessage({ type: 'SET_SESSION_KEY', privateKey });
     if (response?.error) throw new Error(response.error);
+    showFlowStatus('Unlocked.');
     await showMainScreen(response);
+    await closeIfUnlockWindow();
   } catch (error) {
-    alert(error.message || 'Passkey unlock failed.');
+    showFlowStatus(error.message || 'Passkey unlock failed.', { error: true, retry: handlePasskeyUnlock });
   } finally {
     btn.disabled = false;
     btn.textContent = 'Unlock with passkey';
@@ -452,6 +506,7 @@ async function handleUnlock() {
       publicKey: response.publicKey,
       did: response.did
     });
+    await closeIfUnlockWindow();
   } catch (error) {
     // 'Incorrect passphrase' from the background — keep it on-screen to retry.
     alert(error.message || 'Unlock failed.');
@@ -575,11 +630,9 @@ async function handleAutoSignToggle(event) {
  */
 async function handleExport() {
   const confirmed = confirm(
-    '⚠️ WARNING ⚠️\n\n' +
-    'You are about to reveal your private key.\n\n' +
-    'NEVER share this with anyone!\n' +
-    'Anyone with your private key can control your identity.\n\n' +
-    'Continue?'
+    'Show your private key?\n\n' +
+    'Anyone who sees it can act as you, everywhere you use this identity. ' +
+    'Only continue if you are saving a backup somewhere private.'
   );
 
   if (!confirmed) return;
@@ -597,8 +650,8 @@ async function handleExport() {
       return;
     }
 
-    // Show private key
-    prompt('Your Private Key (keep this safe!):', privateKey);
+    // nsec is the form other Nostr apps (and Podkey's own import) accept.
+    prompt('Your private key (nsec). Keep it private:', hexToNsec(privateKey));
   } catch (error) {
     alert('Error exporting key: ' + error.message);
   }
diff --git a/popup/spend.css b/popup/spend.css
new file mode 100644
index 0000000..5ad80bd
--- /dev/null
+++ b/popup/spend.css
@@ -0,0 +1,338 @@
+/**
+ * Podkey - sidestr spend window
+ * Builds on popup.css (tokens) and approve.css (header, origin, buttons,
+ * countdown). The question the layout answers first: what leaves my wallet,
+ * and where does it go.
+ */
+
+body {
+  width: 440px;
+}
+
+.spend [hidden] {
+  display: none !important;
+}
+
+.spend-card {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 12px 14px;
+  margin-bottom: 10px;
+}
+
+.spend-card.compact {
+  padding: 8px 14px;
+}
+
+.spend-eyebrow {
+  font-size: 11px;
+  font-weight: 600;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  color: var(--text-muted);
+  margin-bottom: 8px;
+}
+
+.spend-hint {
+  font-size: 11.5px;
+  color: var(--text-muted);
+  line-height: 1.45;
+  margin: 8px 0 10px;
+}
+
+/* ---- Loading steps ---- */
+.steps {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+
+.step {
+  position: relative;
+  padding: 5px 0 5px 24px;
+  font-size: 13px;
+  color: var(--text-faint);
+}
+
+.step::before {
+  content: '';
+  position: absolute;
+  left: 2px;
+  top: 8px;
+  width: 12px;
+  height: 12px;
+  border-radius: 50%;
+  border: 2px solid var(--border-strong);
+}
+
+.step.active {
+  color: var(--text);
+}
+
+.step.active::before {
+  border-color: var(--accent);
+  border-right-color: transparent;
+  animation: spin 0.8s linear infinite;
+}
+
+.step.done {
+  color: var(--text-muted);
+}
+
+.step.done::before {
+  border-color: var(--safe);
+  background: var(--safe);
+}
+
+@keyframes spin {
+  to { transform: rotate(360deg); }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .step.active::before { animation: none; }
+}
+
+/* ---- Chain ---- */
+.chain-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+}
+
+.chain-id {
+  font-family: var(--mono);
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--text);
+  overflow-wrap: anywhere;
+}
+
+.pill {
+  flex: none;
+  font-size: 10.5px;
+  font-weight: 600;
+  padding: 2px 8px;
+  border-radius: 999px;
+  background: var(--surface-inset);
+  border: 1px solid var(--border);
+  color: var(--text-muted);
+  white-space: nowrap;
+}
+
+.pill.safe {
+  background: var(--safe-soft);
+  border-color: var(--safe-border);
+  color: var(--safe);
+}
+
+.pill.warn {
+  background: var(--warn-soft);
+  border-color: var(--warn-border);
+  color: var(--warn);
+}
+
+.chain-check {
+  font-size: 12px;
+  color: var(--safe);
+  margin-top: 6px;
+}
+
+.chain-signer {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  flex-wrap: wrap;
+  font-size: 11.5px;
+  color: var(--text-muted);
+  margin-top: 4px;
+}
+
+.chain-signer code {
+  font-family: var(--mono);
+  color: var(--text);
+}
+
+/* ---- Rows ---- */
+.rows {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+
+.rows li {
+  display: flex;
+  justify-content: space-between;
+  gap: 12px;
+  padding: 8px 0;
+  border-top: 1px solid var(--border);
+}
+
+.rows li:first-child {
+  border-top: none;
+  padding-top: 0;
+}
+
+.who {
+  min-width: 0;
+}
+
+.who-name {
+  font-size: 13.5px;
+  font-weight: 600;
+  color: var(--text);
+  overflow-wrap: anywhere;
+}
+
+.who-sub {
+  font-family: var(--mono);
+  font-size: 11px;
+  color: var(--text-muted);
+  overflow-wrap: anywhere;
+  margin-top: 2px;
+}
+
+.amounts {
+  flex: none;
+  text-align: right;
+}
+
+.amount-main {
+  font-size: 14px;
+  font-weight: 700;
+  color: var(--text);
+  white-space: nowrap;
+}
+
+.amount-sub {
+  font-size: 11.5px;
+  color: var(--text-muted);
+  white-space: nowrap;
+  margin-top: 2px;
+}
+
+.row-line {
+  display: flex;
+  justify-content: space-between;
+  gap: 12px;
+  padding: 4px 0;
+  font-size: 13px;
+}
+
+.row-label {
+  color: var(--text-muted);
+}
+
+.row-amount {
+  text-align: right;
+  color: var(--text);
+  font-weight: 600;
+}
+
+.row-line.total {
+  border-top: 1px solid var(--border);
+  margin-top: 4px;
+  padding-top: 8px;
+}
+
+.row-line.total .row-label {
+  color: var(--text);
+  font-weight: 600;
+}
+
+.row-line.total .row-amount {
+  font-size: 14px;
+  font-weight: 700;
+}
+
+/* ---- Warnings ---- */
+.warn-box {
+  background: var(--danger-soft);
+  border: 1px solid var(--danger-border);
+  border-radius: var(--radius);
+  padding: 10px 14px;
+  margin-bottom: 10px;
+  color: var(--danger);
+  font-size: 12.5px;
+  line-height: 1.45;
+}
+
+.warn-box ul {
+  margin: 0;
+  padding-left: 18px;
+}
+
+.ack {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-top: 8px;
+  font-size: 12.5px;
+  font-weight: 600;
+  color: var(--text);
+  cursor: pointer;
+}
+
+/* ---- Details ---- */
+.spend-details {
+  font-size: 12px;
+  color: var(--text-muted);
+  margin-bottom: 10px;
+}
+
+.spend-details summary {
+  cursor: pointer;
+  padding: 4px 0;
+}
+
+.spend-details dl {
+  margin: 6px 0 0;
+}
+
+.spend-details dt {
+  font-weight: 600;
+  margin-top: 6px;
+}
+
+.spend-details dd {
+  margin: 2px 0 0;
+}
+
+.spend-details code,
+.plain li {
+  font-family: var(--mono);
+  font-size: 11px;
+  overflow-wrap: anywhere;
+}
+
+.plain {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+
+/* ---- Outcomes ---- */
+.failure {
+  border-color: var(--danger-border);
+}
+
+.failure-title {
+  font-size: 14px;
+  font-weight: 700;
+  color: var(--text);
+  margin-bottom: 6px;
+}
+
+.failure-text {
+  font-size: 12.5px;
+  color: var(--text-muted);
+  line-height: 1.45;
+  margin: 0 0 8px;
+  overflow-wrap: anywhere;
+}
+
+.signed {
+  border-color: var(--safe-border);
+  background: var(--safe-soft);
+}
diff --git a/popup/spend.html b/popup/spend.html
new file mode 100644
index 0000000..a3317fb
--- /dev/null
+++ b/popup/spend.html
@@ -0,0 +1,136 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Podkey — Spend request</title>
+    <link rel="stylesheet" href="popup.css" />
+    <link rel="stylesheet" href="approve.css" />
+    <link rel="stylesheet" href="spend.css" />
+  </head>
+  <body>
+    <main class="approve spend">
+      <div class="approve-head">
+        <div class="approve-shield" aria-hidden="true">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+            <rect x="2" y="6" width="20" height="14" rx="2" />
+            <path d="M16 13h2" />
+            <path d="M2 10h20" />
+          </svg>
+        </div>
+        <div>
+          <div class="approve-title">Spend request</div>
+          <div class="approve-sub">Nothing leaves your wallet until you sign</div>
+        </div>
+      </div>
+
+      <section class="origin-block">
+        <div class="origin-eyebrow">Requested by</div>
+        <code class="origin-badge" id="origin">…</code>
+      </section>
+
+      <!-- 1. Podkey reads the chain itself -->
+      <section id="loading" class="spend-card" aria-live="polite">
+        <div class="spend-eyebrow">Podkey is checking <span id="loadingChain">the chain</span> itself</div>
+        <ol class="steps">
+          <li id="stepFind" class="step">Finding the chain and its signer</li>
+          <li id="stepCheck" class="step">Checking every block</li>
+          <li id="stepReview" class="step">Reading the spend against your coins</li>
+        </ol>
+        <p class="spend-hint">The site only sent the transaction. Everything below comes from Podkey's own reading of the chain.</p>
+      </section>
+
+      <!-- 2. The spend, as Podkey read it -->
+      <section id="review" hidden>
+        <div class="spend-card chain-card">
+          <div class="chain-row">
+            <code class="chain-id" id="chainId"></code>
+            <span class="pill" id="network"></span>
+          </div>
+          <div class="chain-check" id="chainCheck"></div>
+          <div class="chain-signer">
+            <span>Signer</span> <code id="signer"></code>
+            <span class="pill" id="signerPin"></span>
+          </div>
+        </div>
+
+        <div class="spend-card">
+          <div class="spend-eyebrow">Sending</div>
+          <ul class="rows" id="sending"></ul>
+        </div>
+
+        <div class="spend-card compact" id="backCard" hidden>
+          <div class="row-line">
+            <span class="row-label">Back to you</span>
+            <span class="row-amount" id="back"></span>
+          </div>
+        </div>
+
+        <div class="spend-card compact">
+          <div class="row-line">
+            <span class="row-label">Network fee</span>
+            <span class="row-amount" id="fee"></span>
+          </div>
+          <div class="row-line total">
+            <span class="row-label">Leaves your wallet</span>
+            <span class="row-amount" id="total"></span>
+          </div>
+        </div>
+
+        <p class="spend-hint" id="assetNote" hidden></p>
+
+        <div class="warn-box" id="warnings" hidden role="alert">
+          <ul id="warningList"></ul>
+          <label class="ack" id="ackRow" hidden>
+            <input type="checkbox" id="ack" />
+            <span>I understand, sign anyway</span>
+          </label>
+        </div>
+
+        <details class="spend-details">
+          <summary>Details</summary>
+          <dl>
+            <dt>Transaction id</dt><dd><code id="txid"></code></dd>
+            <dt>Your coins spent</dt><dd><ul class="plain" id="inputs"></ul></dd>
+            <dt>Asset records</dt><dd><ul class="plain" id="records"></ul></dd>
+            <dt>Mirror</dt><dd><code id="mirror"></code></dd>
+          </dl>
+        </details>
+
+        <div class="btn-row">
+          <button class="btn btn-deny" id="reject" type="button" autofocus>Reject</button>
+          <button class="btn btn-approve" id="sign" type="button" disabled>Sign</button>
+        </div>
+      </section>
+
+      <!-- 3. Podkey will not sign this -->
+      <section id="failure" class="spend-card failure" hidden role="alert">
+        <div class="failure-title" id="failureTitle">Podkey can't sign this</div>
+        <p class="failure-text" id="failureText"></p>
+        <div id="forgetRow" hidden>
+          <p class="spend-hint">Only do this if the chain's operator told you its signer changed. Podkey will then trust whichever signer announces this chain next.</p>
+          <label class="ack"><input type="checkbox" id="forgetAck" /><span>The operator told me the signer changed</span></label>
+          <button class="btn btn-deny" id="forget" type="button" disabled>Forget the old signer</button>
+        </div>
+        <div class="btn-row">
+          <button class="btn btn-deny" id="close" type="button">Close</button>
+        </div>
+      </section>
+
+      <section id="signed" class="spend-card signed" hidden aria-live="polite">
+        <div class="failure-title">Signed</div>
+        <p class="failure-text">The site now sends it to the chain.</p>
+      </section>
+
+      <div class="countdown" id="countdownWrap">
+        <div class="countdown-text">
+          Closes in <strong id="countdown">4:00</strong>
+        </div>
+        <div class="timeout-bar">
+          <div class="timeout-bar-inner" id="timeoutBar"></div>
+        </div>
+      </div>
+    </main>
+    <script type="module" src="spend.js"></script>
+  </body>
+</html>
diff --git a/popup/spend.js b/popup/spend.js
new file mode 100644
index 0000000..4e0eb21
--- /dev/null
+++ b/popup/spend.js
@@ -0,0 +1,286 @@
+/**
+ * Podkey - sidestr spend window (sidestr/spec proposals/browser-signer.md)
+ *
+ * Opened by the background for one spend request. Reads and validates the
+ * chain itself, reviews the page's transaction against the person's own
+ * coins, shows what leaves the wallet and where it goes, and asks. On Sign it
+ * sends the sighashes it computed to the background, which holds the key,
+ * then checks the signatures and hands the signed transaction back.
+ *
+ * Everything shown that came from a page or a relay is written with
+ * textContent, never innerHTML.
+ */
+
+import * as core from '../src/sidestr/core.js';
+
+const PINS_KEY = 'podkey_sidestr_signers';
+const PROFILE_KIND = 0;
+const $ = (id) => document.getElementById(id);
+const id = new URLSearchParams(location.search).get('id');
+
+const send = async (message) => {
+  const r = await chrome.runtime.sendMessage(message);
+  if (r && r.error) throw Object.assign(new Error(r.error), { code: r.code });
+  return r;
+};
+
+// ---- outcome, exactly once ------------------------------------------------
+
+let finished = false;
+function finishWith (outcome) {
+  if (finished) return;
+  finished = true;
+  clearInterval(keepalive);
+  send({ type: 'SIDESTR_DONE', id, ...outcome }).catch(() => {});
+}
+// Closing the window is a rejection (the background also sees the window go).
+window.addEventListener('beforeunload', () => finishWith({ error: { code: 'rejected', message: 'You closed the spend window' } }));
+// Keep the service worker awake while the person reads.
+const keepalive = setInterval(() => send({ type: 'SIDESTR_KEEPALIVE', id }).catch(() => {}), 20_000);
+
+// ---- small formatters -----------------------------------------------------
+
+const sats = (n) => `${n.toLocaleString('en-GB')} sat${n === 1 ? '' : 's'}`;
+const short = (s, head = 12, tail = 6) => (s.length > head + tail + 1 ? `${s.slice(0, head)}…${s.slice(-tail)}` : s);
+const assetText = (a) => `${core.formatAsset(a.amount, a.decimals)} ${a.ticker}`;
+function el (tag, cls, text) { const e = document.createElement(tag); if (cls) e.className = cls; if (text != null) e.textContent = text; return e; }
+function sumAssets (lists) {
+  const m = new Map();
+  for (const a of lists.flat()) { const k = a.asset; const cur = m.get(k); m.set(k, cur ? { ...cur, amount: cur.amount + a.amount } : { ...a }); }
+  return [...m.values()];
+}
+
+// ---- steps ----------------------------------------------------------------
+
+function step (which) {
+  const order = ['stepFind', 'stepCheck', 'stepReview'];
+  const at = order.indexOf(which);
+  order.forEach((s, i) => { $(s).className = `step${i < at ? ' done' : i === at ? ' active' : ''}`; });
+}
+
+// ---- countdown --------------------------------------------------------------
+
+let counting = false;
+function startCountdown (expiresAt) {
+  if (counting) return;
+  counting = true;
+  const total = Math.max(1, expiresAt - Date.now());
+  const tick = () => {
+    if (finished) return;
+    const left = Math.max(0, expiresAt - Date.now());
+    const s = Math.ceil(left / 1000);
+    $('countdown').textContent = `${Math.floor(s / 60)}:${String(s % 60).padStart(2, '0')}`;
+    $('timeoutBar').style.width = `${((left / total) * 100).toFixed(2)}%`;
+    $('timeoutBar').classList.toggle('urgent', s <= 20);
+    if (left <= 0) { finishWith({ error: { code: 'rejected', message: 'The spend window timed out' } }); window.close(); return; }
+    setTimeout(tick, 250);
+  };
+  tick();
+}
+
+// ---- names, from each key's own profile (kind 0) --------------------------
+
+// Best effort and never blocking: a name is the key's own claim, so the npub
+// stays on screen beside it.
+function fetchNames (pubkeys, lib, onName) {
+  if (!pubkeys.length) return;
+  const want = new Set(pubkeys); const best = new Map();
+  for (const url of core.RELAYS) {
+    let ws; try { ws = new WebSocket(url); } catch { continue; }
+    const stop = setTimeout(() => { try { ws.close(); } catch { /* already closed */ } }, 3000);
+    ws.onopen = () => ws.send(JSON.stringify(['REQ', 'n', { kinds: [PROFILE_KIND], authors: [...want] }]));
+    ws.onmessage = (m) => {
+      let msg; try { msg = JSON.parse(m.data); } catch { return; }
+      if (msg[0] === 'EOSE') { clearTimeout(stop); try { ws.close(); } catch { /* already closed */ } return; }
+      const ev = msg[0] === 'EVENT' ? msg[2] : null;
+      if (!ev || ev.kind !== PROFILE_KIND || !want.has(ev.pubkey)) return;
+      let ok = false; try { ok = lib.nostr.verifyNostrEvent(ev); } catch { /* malformed: not ok */ }
+      if (!ok || (best.get(ev.pubkey)?.created_at ?? 0) >= ev.created_at) return;
+      best.set(ev.pubkey, ev);
+      let p; try { p = JSON.parse(ev.content); } catch { return; }
+      // drop control characters and the invisible and bidi marks a name could hide behind
+      // eslint-disable-next-line no-control-regex
+      const name = String(p?.display_name || p?.name || '').replace(/[\u0000-\u001f\u200b-\u200f\u202a-\u202e]/g, '').trim().slice(0, 48);
+      if (name) onName(ev.pubkey, name);
+    };
+    ws.onerror = () => {};
+  }
+}
+
+// ---- review ---------------------------------------------------------------
+
+function render ({ req, opened, reviewed, pinned, lib }) {
+  const { ex, signer, parent, mirror, mirrorNote } = opened;
+  $('loading').hidden = true;
+  $('review').hidden = false;
+
+  $('chainId').textContent = ex.chain.id;
+  $('network').textContent = parent.mainnet ? parent.label : `Test coins · ${parent.label}`;
+  $('chainCheck').textContent = `✓ ${(ex.tip().height + 1).toLocaleString('en-GB')} blocks checked by Podkey · ${mirrorNote}`;
+  $('signer').textContent = short(signer, 8, 8);
+  $('signer').title = signer;
+  const pin = $('signerPin');
+  if (pinned) { pin.textContent = 'same as before'; pin.className = 'pill safe'; }
+  else { pin.textContent = 'first spend here: Podkey will remember it'; pin.className = 'pill warn'; }
+
+  // sending
+  const list = $('sending'); list.replaceChildren();
+  const nameSlots = new Map();
+  const others = reviewed.outputs.filter((o) => o.kind !== 'change' && o.kind !== 'asset-record');
+  if (!others.length) list.append(el('li', 'who-sub', 'Nothing goes to anyone else: this only rearranges your own coins.'));
+  for (const o of others) {
+    const li = el('li'); const who = el('div', 'who'); const amounts = el('div', 'amounts');
+    if (o.kind === 'key') {
+      const name = el('div', 'who-name', short(o.npub, 14, 8)); name.title = o.npub;
+      const sub = el('div', 'who-sub', o.npub); sub.hidden = true;
+      who.append(name, sub);
+      if (!nameSlots.has(o.pubkey)) nameSlots.set(o.pubkey, []);
+      nameSlots.get(o.pubkey).push({ name, sub });
+    } else if (o.kind === 'script') {
+      who.append(el('div', 'who-name', o.address ? short(o.address, 16, 8) : 'A script'), el('div', 'who-sub', o.address ?? o.script));
+    } else if (o.kind === 'pegout') {
+      who.append(el('div', 'who-name', 'Peg-out to the parent chain'), el('div', 'who-sub', o.to));
+    } else if (o.kind === 'burn') {
+      who.append(el('div', 'who-name', 'Burned'), el('div', 'who-sub', o.text ?? o.script));
+    } else {
+      who.append(el('div', 'who-name', 'Note on the chain'), el('div', 'who-sub', o.text ?? o.script));
+    }
+    if (o.assets.length) {
+      amounts.append(el('div', 'amount-main', o.assets.map(assetText).join(' + ')));
+      if (o.value) amounts.append(el('div', 'amount-sub', `+ ${sats(o.value)}`));
+    } else if (o.value || o.kind !== 'record') {
+      amounts.append(el('div', 'amount-main', sats(o.value)));
+    }
+    li.append(who, amounts); list.append(li);
+  }
+  fetchNames([...nameSlots.keys()], lib, (pubkey, nm) => {
+    for (const { name, sub } of nameSlots.get(pubkey) ?? []) { name.textContent = nm; sub.hidden = false; }
+  });
+
+  // back to you
+  const change = reviewed.outputs.filter((o) => o.kind === 'change');
+  if (change.length) {
+    const back = change.reduce((s, o) => s + o.value, 0);
+    const assetsBack = sumAssets(change.map((o) => o.assets));
+    $('back').textContent = [sats(back), ...assetsBack.map(assetText)].join(' + ');
+    $('backCard').hidden = false;
+  }
+
+  // fee and total
+  $('fee').textContent = sats(reviewed.fee);
+  const leavingSats = reviewed.inSum - change.reduce((s, o) => s + o.value, 0);
+  const leavingAssets = sumAssets([...others.map((o) => o.assets), reviewed.destroyed.map((d) => ({ ...d, ...labelOf(reviewed, d.asset) }))]);
+  $('total').textContent = [...leavingAssets.map(assetText), sats(leavingSats)].join(' + ');
+
+  if (reviewed.inputs.some((i) => i.carries.length) || others.some((o) => o.assets.length)) {
+    $('assetNote').hidden = false;
+    $('assetNote').textContent = reviewed.assetMode === 'rule'
+      ? `${ex.chain.id} enforces its assets: every node checks these amounts.`
+      : `Assets on ${ex.chain.id} are kept by their holders' records; the chain itself does not enforce them. Podkey read them from every block.`;
+  }
+
+  // warnings: anything that destroys or burns needs an explicit tick
+  const severe = reviewed.warnings.filter((w) => ['destroys', 'breaks', 'burn', 'pegout'].includes(w.kind));
+  if (reviewed.warnings.length) {
+    $('warnings').hidden = false;
+    $('warningList').replaceChildren(...reviewed.warnings.map((w) => el('li', null, w.text)));
+    $('ackRow').hidden = !severe.length;
+  }
+
+  // details
+  $('txid').textContent = reviewed.txid;
+  $('inputs').replaceChildren(...reviewed.inputs.map((i) => el('li', null, `${short(i.key, 16, 4)} · ${sats(i.value)}${i.carries.length ? ` · ${i.carries.map(assetText).join(', ')}` : ''}`)));
+  const recs = reviewed.outputs.filter((o) => o.kind === 'asset-record');
+  $('records').replaceChildren(...(recs.length ? recs.map((o) => el('li', null, o.text)) : [el('li', null, 'none')]));
+  $('mirror').textContent = mirror;
+
+  const sign = $('sign');
+  const ready = () => { sign.disabled = severe.length > 0 && !$('ack').checked; };
+  $('ack').addEventListener('change', ready); ready();
+  sign.addEventListener('click', () => doSign({ req, opened, reviewed, pinned, lib }));
+}
+
+function labelOf (reviewed, asset) {
+  const found = [...reviewed.outputs.flatMap((o) => o.assets), ...reviewed.inputs.flatMap((i) => i.carries)].find((a) => a.asset === asset);
+  return found ? { ticker: found.ticker, decimals: found.decimals } : { ticker: `${asset.slice(0, 8)}…`, decimals: 0 };
+}
+
+async function doSign ({ req, opened, reviewed, pinned, lib }) {
+  $('sign').disabled = true; $('reject').disabled = true;
+  $('sign').textContent = 'Signing…';
+  try {
+    const { signatures } = await send({ type: 'SIDESTR_SIGN_DIGESTS', id, digests: reviewed.sighashes.map((s) => s.digest) });
+    const result = core.finish({ ex: opened.ex, lib, reviewed, signatures, pub: req.pub });
+    if (!pinned) {
+      const pins = (await chrome.storage.local.get(PINS_KEY))[PINS_KEY] ?? {};
+      pins[req.chain] = opened.signer;
+      await chrome.storage.local.set({ [PINS_KEY]: pins });
+    }
+    finishWith({ result });
+    $('review').hidden = true; $('countdownWrap').hidden = true; $('signed').hidden = false;
+    setTimeout(() => window.close(), 1200);
+  } catch (e) {
+    fail(e);
+  }
+}
+
+// ---- failure --------------------------------------------------------------
+
+const TITLES = {
+  'not-yours': 'This spends coins that are not yours',
+  unsupported: 'Podkey does not sign for this chain',
+  invalid: 'This is not a spend Podkey can read',
+  unavailable: 'Podkey could not check this spend',
+  rejected: 'Spend rejected'
+};
+
+function fail (e) {
+  const code = core.CODES.includes(e?.code) ? e.code : 'unavailable';
+  const message = e?.message || String(e);
+  $('loading').hidden = true; $('review').hidden = true; $('failure').hidden = false;
+  $('failureTitle').textContent = TITLES[code];
+  $('failureText').textContent = message;
+  $('forgetRow').hidden = !(code === 'unsupported' && /different signer/.test(message));
+  $('close').onclick = () => { finishWith({ error: { code, message } }); window.close(); };
+}
+
+$('forgetAck').addEventListener('change', () => { $('forget').disabled = !$('forgetAck').checked; });
+$('forget').addEventListener('click', async () => {
+  const req = await send({ type: 'SIDESTR_REQUEST', id });
+  const pins = (await chrome.storage.local.get(PINS_KEY))[PINS_KEY] ?? {};
+  delete pins[req.chain];
+  await chrome.storage.local.set({ [PINS_KEY]: pins });
+  $('failure').hidden = true; $('loading').hidden = false;
+  main();
+});
+
+$('reject').addEventListener('click', () => {
+  finishWith({ error: { code: 'rejected', message: 'You rejected the spend' } });
+  window.close();
+});
+
+// ---- main -----------------------------------------------------------------
+
+async function main () {
+  try {
+    const req = await send({ type: 'SIDESTR_REQUEST', id });
+    $('origin').textContent = req.origin;
+    $('loadingChain').textContent = req.chain;
+    startCountdown(req.expiresAt);
+    step('stepFind');
+    const lib = await core.loadLib();
+    const pinned = ((await chrome.storage.local.get(PINS_KEY))[PINS_KEY] ?? {})[req.chain] ?? null;
+    const opened = await core.openChain({
+      lib, chainId: req.chain, pinned,
+      onProgress: (m) => { if (/^Checking/.test(m)) step('stepCheck'); }
+    });
+    step('stepReview');
+    const view = core.assetView(opened.ex, lib);
+    const reviewed = core.review({ ex: opened.ex, lib, view, pub: req.pub, txHex: req.tx });
+    render({ req, opened, reviewed, pinned, lib });
+  } catch (e) {
+    fail(e);
+  }
+}
+
+main();
diff --git a/scripts/vendor-sidestr.js b/scripts/vendor-sidestr.js
new file mode 100644
index 0000000..5f57ede
--- /dev/null
+++ b/scripts/vendor-sidestr.js
@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+/**
+ * Vendor the sidestr engine into vendor/sidestr/ from pinned upstream commits.
+ *
+ * A Manifest V3 extension may not run code it fetches from the network, and
+ * the sidestr explorer and wallet load their engine from jsdelivr at run time.
+ * The spend window (popup/spend.html) runs the same engine, so Podkey carries
+ * pinned copies of exactly the modules it imports, and nothing else:
+ *
+ *   bitcoin-desktop/schema   the kernel (codec) and its JSON-LD documents
+ *   sidestr/spec             siding/lib: parents, overlays, records, signing
+ *   sidestr/explorer         explorer.mjs: reads and validates a chain
+ *
+ * Two patches, both recorded in vendor/sidestr/PINS.json:
+ *   - explorer.mjs: its default engine locations point at the vendored copies
+ *     instead of jsdelivr, so nothing is ever imported from the network;
+ *   - siding/lib/overlays/evm.mjs: replaced by a stub, because the EVM rule
+ *     imports ethereumjs from jsdelivr when it starts. A chain that names the
+ *     rule is refused as `unsupported` until the rule is vendored too.
+ *
+ * PINS.json records a SHA-256 per file; test/sidestr-vendor.test.js checks
+ * the tree against it. Run: `node scripts/vendor-sidestr.js` (needs git), optionally with
+ * `--from <name>=<local clone>` per pin to read an already-reviewed clone instead of fetching.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync, readdirSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, posix, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+const out = join(root, 'vendor', 'sidestr');
+
+export const PINS = [
+  {
+    name: 'schema',
+    repo: 'https://github.com/bitcoin-desktop/schema',
+    tag: 'v0.0.27',
+    commit: 'b8cbf6337c7450fe14ddc5bce00c7280059aab5d',
+    // what explorer.mjs imports from `${cdn}` (and the BLAKE2b parent's overlay)
+    entries: ['codec/kernel.js', 'codec/hash.js', 'codec/nostr.js', 'codec/secp256k1.js', 'codec/interpreter.js', 'codec/overlays/knots-blake2b.js'],
+    documents: ['schema/core.jsonld', 'schema/proof.jsonld', 'schema/script.jsonld', 'schema/chain.jsonld', 'schema/validate.jsonld', 'schema/overlays/knots-blake2b.jsonld'],
+    licence: 'LICENSE'
+  },
+  {
+    name: 'spec',
+    repo: 'https://github.com/sidestr/spec',
+    commit: '373d3eb6accd163f418e8a813052f1516a942bb3',
+    // what explorer.mjs imports from `${sidestr}`, plus what the spend window uses
+    entries: ['siding/lib/parents.mjs', 'siding/lib/overlay.mjs', 'siding/lib/overlays/index.mjs', 'siding/lib/txsign.mjs', 'siding/lib/announce.mjs', 'siding/lib/records.mjs', 'siding/lib/overlays/assets.mjs'],
+    documents: [],
+    licence: 'LICENSE'
+  },
+  {
+    name: 'explorer',
+    repo: 'https://github.com/sidestr/explorer',
+    commit: 'db5a04e756243f9a73cba11b083d715c2ee3b327',
+    entries: ['explorer.mjs'],
+    documents: [],
+    licence: 'LICENSE'
+  }
+];
+
+const EVM_STUB = `// Podkey stub for siding/lib/overlays/evm.mjs. The EVM rule imports ethereumjs
+// from jsdelivr when it starts, and a Manifest V3 extension may not run code
+// from the network, so a chain that names the rule is refused as unsupported
+// until the rule is vendored too. See scripts/vendor-sidestr.js.
+export function evmOverlay (chain) {
+  const e = new Error(\`\${chain?.id ?? 'this chain'} names the evm rule, which Podkey cannot run yet\`);
+  e.code = 'unsupported';
+  throw e;
+}
+`;
+
+// relative module specifiers a file imports: static `from '…'` and `import('…')` with a literal
+const importsOf = (src) => [...src.matchAll(/(?:from\s*|import\s*\(\s*)['"](\.{1,2}\/[^'"]+)['"]/g)].map((m) => m[1]);
+
+// A repo holding the pinned commit: a local clone named with `--from <name>=<path>` (it must
+// contain the commit), else a shallow fetch of just that commit. Files are always read from the
+// commit object with `git show`, never from a working tree, so a local clone's edits cannot leak in.
+function openPin (pin, from) {
+  const local = from[pin.name];
+  const dir = local ?? mkdtempSync(join(tmpdir(), `podkey-${pin.name}-`));
+  const git = (...args) => execFileSync('git', args, { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 1 << 26 }).toString();
+  if (!local) { git('init', '-q'); git('fetch', '-q', '--depth', '1', pin.repo, pin.commit); }
+  const found = git('rev-parse', '--verify', `${pin.commit}^{commit}`).trim();
+  if (found !== pin.commit) throw new Error(`${pin.name}: ${dir} resolves ${found}, pinned ${pin.commit}`);
+  return {
+    read: (file) => git('show', `${pin.commit}:${file}`),
+    has: (file) => { try { git('cat-file', '-e', `${pin.commit}:${file}`); return true; } catch { return false; } },
+    close: () => { if (!local) rmSync(dir, { recursive: true, force: true }); }
+  };
+}
+
+// the entries and every module they import, transitively, as repo-relative posix paths
+function closure (repo, entries) {
+  const seen = new Set(); const queue = [...entries];
+  while (queue.length) {
+    const file = queue.shift(); if (seen.has(file)) continue;
+    if (!repo.has(file)) throw new Error(`missing ${file}`);
+    seen.add(file);
+    for (const spec of importsOf(repo.read(file))) queue.push(posix.normalize(posix.join(posix.dirname(file), spec)));
+  }
+  return [...seen].sort();
+}
+
+function patch (pin, file, text) {
+  if (pin.name === 'explorer' && file === 'explorer.mjs') {
+    const cdn = "export const CDN = 'https://cdn.jsdelivr.net/gh/bitcoin-desktop/schema@v0.0.27';";
+    const side = /export const SIDESTR = 'https:\/\/cdn\.jsdelivr\.net\/gh\/sidestr\/spec@[0-9a-f]{40}\/siding\/lib';/;
+    if (!text.includes(cdn) || !side.test(text)) throw new Error('explorer.mjs: the engine locations moved; review the patch');
+    return {
+      text: text
+        .replace(cdn, "export const CDN = new URL('../schema', import.meta.url).href; // Podkey: the vendored engine, never the network")
+        .replace(side, "export const SIDESTR = new URL('../spec/siding/lib', import.meta.url).href; // Podkey: the vendored lib"),
+      note: 'engine locations point at the vendored copies instead of jsdelivr'
+    };
+  }
+  if (pin.name === 'spec' && file === 'siding/lib/overlays/evm.mjs') {
+    if (!/export function evmOverlay\(/.test(text)) throw new Error('evm.mjs: evmOverlay moved; review the stub');
+    return { text: EVM_STUB, note: 'stub: the EVM rule imports ethereumjs from the network at start' };
+  }
+  return { text, note: null };
+}
+
+const sha256 = (s) => createHash('sha256').update(s).digest('hex');
+
+// every file under vendor/sidestr except PINS.json, as posix paths relative to it
+export function listVendored (base = out) {
+  const files = [];
+  const walk = (d) => { for (const e of readdirSync(d, { withFileTypes: true })) { const p = join(d, e.name); if (e.isDirectory()) walk(p); else files.push(relative(base, p).split('\\').join('/')); } };
+  if (existsSync(base)) walk(base);
+  return files.filter((f) => f !== 'PINS.json').sort();
+}
+
+function main (argv) {
+  const from = {};
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] !== '--from') throw new Error(`unknown argument ${argv[i]}; usage: vendor-sidestr.js [--from <name>=<git dir>]...`);
+    const [name, dir] = String(argv[++i] ?? '').split('=');
+    if (!PINS.some((p) => p.name === name) || !dir) throw new Error(`--from takes <name>=<dir>, name one of ${PINS.map((p) => p.name).join(', ')}`);
+    from[name] = dir;
+  }
+  rmSync(out, { recursive: true, force: true });
+  const record = { note: 'Generated by scripts/vendor-sidestr.js. Do not edit by hand.', pins: [] };
+  for (const pin of PINS) {
+    const repo = openPin(pin, from);
+    try {
+      const files = [...closure(repo, pin.entries), ...pin.documents, pin.licence];
+      const entry = { name: pin.name, repo: pin.repo, commit: pin.commit, ...(pin.tag ? { tag: pin.tag } : {}), files: {}, patched: {} };
+      for (const file of files) {
+        const { text, note } = patch(pin, file, repo.read(file));
+        const dest = join(out, pin.name, file);
+        mkdirSync(dirname(dest), { recursive: true });
+        writeFileSync(dest, text);
+        entry.files[file] = sha256(text);
+        if (note) entry.patched[file] = note;
+      }
+      record.pins.push(entry);
+      console.log(`${pin.name}@${pin.commit.slice(0, 7)}: ${files.length} files`);
+    } finally {
+      repo.close();
+    }
+  }
+  writeFileSync(join(out, 'PINS.json'), JSON.stringify(record, null, 2) + '\n');
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) main(process.argv.slice(2));
diff --git a/src/background.js b/src/background.js
index bcbcac1..54a27df 100644
--- a/src/background.js
+++ b/src/background.js
@@ -3,7 +3,8 @@
  * Coordinates key management, signing, and Solid auto-auth
  */
 
-import { generateKeypair, signEvent, getPublicKey } from './crypto.js';
+import { generateKeypair, signEvent, getPublicKey, signSighashes } from './crypto.js';
+import { createSpends } from './sidestr/spends.js';
 import {
   getConversationKey,
   encrypt as nip44Encrypt,
@@ -66,8 +67,9 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
       sendResponse(result);
     })
     .catch(error => {
-      console.error('[Podkey] Error handling message:', message.type, error);
-      sendResponse({ error: error.message });
+      // A refused spend is an answer, not a fault: only log the unexpected.
+      if (!error?.code) console.error('[Podkey] Error handling message:', message.type, error);
+      sendResponse({ error: error.message, ...(typeof error?.code === 'string' ? { code: error.code } : {}) });
     });
 
   return true; // Async response
@@ -94,7 +96,12 @@ const EXTENSION_UI_ONLY_TYPES = new Set([
   'UNLOCK_VAULT',
   'LOCK_VAULT',
   'SET_SESSION_KEY',
-  'GET_KEYPAIR_STATUS'
+  'GET_KEYPAIR_STATUS',
+  // the sidestr spend window's side of a spend (src/sidestr/spends.js)
+  'SIDESTR_REQUEST',
+  'SIDESTR_SIGN_DIGESTS',
+  'SIDESTR_DONE',
+  'SIDESTR_KEEPALIVE'
 ]);
 
 function isExtensionUiSender (sender) {
@@ -149,6 +156,23 @@ async function handleMessage (message, sender) {
     case 'NIP44_GET_CONVERSATION_KEY':
       return await handleNip44GetConversationKey(message.pubkey, origin);
 
+    case 'SIDESTR_SIGN_TRANSACTION':
+      return await spends.request({ chain: message.chain, tx: message.tx }, pageOrigin(sender, origin));
+
+    case 'SIDESTR_REQUEST':
+      return spends.describe(message.id);
+
+    case 'SIDESTR_SIGN_DIGESTS':
+      return await spends.signDigests(message.id, message.digests);
+
+    case 'SIDESTR_DONE':
+      spends.done(message.id, { result: message.result, error: message.error });
+      return { ok: true };
+
+    case 'SIDESTR_KEEPALIVE':
+      // the spend window pings while it is open, so the worker outlives a slow decision
+      return { ok: spends.pending.has(message.id) };
+
     case 'CREATE_NIP98_AUTH_HEADER':
       return await createNip98AuthHeader(
         message.url,
@@ -162,6 +186,38 @@ async function handleMessage (message, sender) {
   }
 }
 
+/**
+ * sidestr spends (sidestr/spec proposals/browser-signer.md). Each one opens the
+ * spend window, which reads the chain itself and shows the spend; the key stays
+ * here and signs only the sighashes that window computed, once, after the
+ * person confirms. See src/sidestr/spends.js.
+ */
+const spends = createSpends({
+  ensureUnlocked: () => ensureUnlocked(),
+  getKeypair: () => getKeypair(),
+  signSighashes,
+  openWindow: (id) => new Promise((resolve, reject) => {
+    chrome.windows.create({
+      url: `popup/spend.html?${new URLSearchParams({ id })}`,
+      type: 'popup',
+      width: 440,
+      height: 720,
+      focused: true
+    }, (w) => (chrome.runtime.lastError ? reject(new Error(chrome.runtime.lastError.message)) : resolve(w?.id ?? null)));
+  })
+});
+
+// Closing the spend window rejects the spend. (Guarded: the unit tests' chrome stub has no windows API.)
+chrome.windows?.onRemoved?.addListener((windowId) => spends.windowClosed(windowId));
+
+// The origin shown for a spend is the one Chrome reports for the sending
+// frame, not anything the page wrote into the message.
+function pageOrigin (sender, claimed) {
+  if (sender?.origin && sender.origin !== 'null') return sender.origin;
+  try { if (sender?.url) return new URL(sender.url).origin; } catch { /* not a URL: fall back */ }
+  return claimed;
+}
+
 /**
  * Coalesce concurrent unlock requests behind a SINGLE passphrase prompt.
  *
@@ -581,7 +637,7 @@ async function showPermissionPrompt (origin, action, eventPreview) {
       url: `popup/approve.html?${params.toString()}`,
       type: 'popup',
       width: 420,
-      height: 380,
+      height: 470, // room for the trust note without scrolling
       focused: true
     });
   });
diff --git a/src/crypto.js b/src/crypto.js
index 297fe24..a73526c 100644
--- a/src/crypto.js
+++ b/src/crypto.js
@@ -96,6 +96,35 @@ export async function signEvent (event, privateKeyHex) {
   };
 }
 
+/**
+ * BIP 340 signatures over sidestr key-path sighashes.
+ *
+ * Deliberately NOT a page-facing "sign these 32 bytes" call: a signature over
+ * arbitrary bytes is also a signature over any event id. Only the background's
+ * SIDESTR_SIGN_DIGESTS path calls this, for digests the spend window computed
+ * itself from Podkey's own reading of the chain, once per approved request.
+ * Every signature is self-verified before it leaves, as signEvent does.
+ * @param {string[]} digestsHex - 64-char hex sighashes
+ * @param {string} privateKeyHex - 64-char hex private key
+ * @returns {string[]} 128-char hex signatures, in order
+ */
+export function signSighashes (digestsHex, privateKeyHex) {
+  validatePrivateKey(privateKeyHex);
+  const privateKeyBytes = hexToBytes(privateKeyHex);
+  const pubkeyBytes = hexToBytes(getPublicKey(privateKeyHex));
+  return digestsHex.map((digestHex) => {
+    if (typeof digestHex !== 'string' || !/^[0-9a-f]{64}$/.test(digestHex)) {
+      throw new Error('A sighash is 32 bytes of lowercase hex');
+    }
+    const digest = hexToBytes(digestHex);
+    const signature = schnorr.sign(digest, privateKeyBytes);
+    if (!schnorr.verify(signature, digest, pubkeyBytes)) {
+      throw new Error('Signature self-verification failed');
+    }
+    return bytesToHex(signature);
+  });
+}
+
 /**
  * Verify a signed Nostr event
  * @param {object} event - Signed event
diff --git a/src/injected.js b/src/injected.js
index d8b0cdc..6363f93 100644
--- a/src/injected.js
+++ b/src/injected.js
@@ -108,7 +108,8 @@ const ALLOWED_TYPES = new Set([
   'GET_PUBLIC_KEY',
   'SIGN_EVENT',
   'NIP44_ENCRYPT',
-  'NIP44_DECRYPT'
+  'NIP44_DECRYPT',
+  'SIDESTR_SIGN_TRANSACTION'
 ]);
 
 // Listen for requests from the injected script (NIP-07 relay)
@@ -133,6 +134,10 @@ window.addEventListener('podkey-request', async (event) => {
     if (data.pubkey) safeData.pubkey = String(data.pubkey);
     if (data.plaintext !== undefined) safeData.plaintext = String(data.plaintext || '');
     if (data.ciphertext !== undefined) safeData.ciphertext = String(data.ciphertext);
+  } else if (type === 'SIDESTR_SIGN_TRANSACTION') {
+    // Shape only; the background checks both and the spend window checks the rest.
+    safeData.chain = typeof data.chain === 'string' ? data.chain : '';
+    safeData.tx = typeof data.tx === 'string' ? data.tx : '';
   }
 
   try {
@@ -159,7 +164,8 @@ window.addEventListener('podkey-request', async (event) => {
       window.dispatchEvent(new CustomEvent('podkey-response', {
         detail: {
           id,
-          error: response.error
+          error: response.error,
+          ...(typeof response.code === 'string' ? { code: response.code } : {})
         }
       }));
       return;
diff --git a/src/keyformat.js b/src/keyformat.js
index c37701e..fe0b153 100644
--- a/src/keyformat.js
+++ b/src/keyformat.js
@@ -162,6 +162,22 @@ export function hexToNsec (hex) {
   return bech32Encode('nsec', convertBits(bytes, 8, 5, true));
 }
 
+/**
+ * Encode a 64-char hex x-only public key as its NIP-19 `npub1…` form. The
+ * sidestr spend window shows a coin that pays `OP_1 <key>` as the Nostr
+ * identity it is, since that is how people know each other.
+ * @param {string} hex 64-char hex public key
+ * @returns {string} npub1… bech32 string
+ */
+export function hexToNpub (hex) {
+  if (typeof hex !== 'string' || !/^[0-9a-fA-F]{64}$/.test(hex)) {
+    throw new Error('Invalid key');
+  }
+  const bytes = [];
+  for (let i = 0; i < 64; i += 2) bytes.push(parseInt(hex.slice(i, i + 2), 16));
+  return bech32Encode('npub', convertBits(bytes, 8, 5, true));
+}
+
 /**
  * Normalise a pasted private key into canonical 64-char lowercase hex, accepting
  * either raw hex or an `nsec1…` bech32 key. The nsec form is converted inline so
diff --git a/src/nostr-provider.js b/src/nostr-provider.js
index 6cab005..f34d2ff 100644
--- a/src/nostr-provider.js
+++ b/src/nostr-provider.js
@@ -94,25 +94,67 @@
           ciphertext
         });
       }
-    }
+    },
+
+    /**
+     * sidestr spends (sidestr/spec proposals/browser-signer.md). Podkey reads
+     * and validates the chain itself, shows the spend in its own window and
+     * asks every time; the page supplies only the chain id and the
+     * transaction. Rejections carry `code`: rejected, unsupported, not-yours,
+     * invalid or unavailable.
+     */
+    sidestr: Object.freeze({
+      version: 1,
+      // what a page calls this signer in its own copy ("Podkey will show you this spend")
+      name: 'Podkey',
+
+      /**
+       * @param {{chain: string, tx: string}} request - chain id and the
+       *   transaction as hex (any witness is ignored and replaced)
+       * @returns {Promise<{tx: string, txid: string}>} the signed transaction
+       */
+      signTransaction: async (request) => {
+        if (!request || typeof request !== 'object') {
+          throw Object.assign(new Error('signTransaction takes { chain, tx }'), { code: 'invalid' });
+        }
+        return sendMessageToExtension({
+          type: 'SIDESTR_SIGN_TRANSACTION',
+          chain: request.chain,
+          tx: request.tx
+        }, SPEND_TIMEOUT_MS);
+      }
+    })
   };
 
+  // A spend waits for Podkey to read the chain and for the person to decide,
+  // so it gets longer than the 30 seconds other requests do. Podkey's own
+  // window closes itself before this.
+  const SPEND_TIMEOUT_MS = 5 * 60 * 1000;
+
   /**
    * Send message to extension background script
    * @param {object} message - Message to send
    * @returns {Promise<any>} Response from extension
    */
-  async function sendMessageToExtension (message) {
+  // Three minutes by default: a request that finds Podkey locked waits for the
+  // person to unlock it, and a security key's PIN and touch take longer than
+  // the 30 seconds this used to allow (the site saw a timeout although the
+  // unlock succeeded).
+  async function sendMessageToExtension (message, timeoutMs = 180000) {
     return new Promise((resolve, reject) => {
       // Create custom event to communicate with content script
       const eventId = Math.random().toString(36).substring(7);
 
+      let timer = null;
       const handler = (event) => {
         if (event.detail.id === eventId) {
           window.removeEventListener('podkey-response', handler);
+          clearTimeout(timer);
 
           if (event.detail.error) {
-            reject(new Error(event.detail.error));
+            const error = new Error(event.detail.error);
+            if (event.detail.code) error.code = event.detail.code;
+            reject(error);
           } else {
             resolve(event.detail.result);
           }
@@ -129,11 +171,12 @@
         }
       }));
 
-      // Timeout after 30 seconds
-      setTimeout(() => {
+      // Cleared when the answer arrives, so a spend's five-minute wait does
+      // not outlive it.
+      timer = setTimeout(() => {
         window.removeEventListener('podkey-response', handler);
-        reject(new Error('Podkey request timeout'));
-      }, 30000);
+        reject(Object.assign(new Error('Podkey request timeout'), { code: 'unavailable' }));
+      }, timeoutMs);
     });
   }
 
diff --git a/src/passkey.js b/src/passkey.js
index 3ec05dc..9706037 100644
--- a/src/passkey.js
+++ b/src/passkey.js
@@ -89,46 +89,103 @@ const PRF_UNSUPPORTED_MESSAGE =
   'Try a phone passkey or a modern security key that supports PRF, or create a ' +
   'passphrase-based key instead.';
 
+// Transports an authenticator can report (WebAuthn AuthenticatorTransport).
+// Passing the ones a credential reported back in allowCredentials lets the
+// browser go straight to "insert and touch your security key" (or NFC)
+// instead of opening its generic chooser, which on desktop leads with the
+// phone/QR option — where hardware-key users got lost.
+export const KNOWN_TRANSPORTS = ['usb', 'nfc', 'ble', 'hybrid', 'internal', 'smart-card'];
+
+export function cleanTransports (transports) {
+  if (!Array.isArray(transports)) return [];
+  return [...new Set(transports.filter(t => KNOWN_TRANSPORTS.includes(t)))];
+}
+
 // WebAuthn surfaces almost every ceremony failure as NotAllowedError — a
 // deliberately vague catch-all covering user cancel, timeout, no available
-// authenticator, and lost window focus. Name the likely causes (including the
-// two-prompt shape below) without over-claiming which one occurred; pass any
-// other error through unchanged.
-function translateCeremonyError (err) {
-  if (err && (err.name === 'NotAllowedError' || err.name === 'AbortError')) {
+// authenticator, a wrong PIN, and the document not having focus. Name the
+// likely causes for the step that failed without over-claiming which one
+// occurred; pass any other error through unchanged.
+export function translateCeremonyError (err, step = 'unlock') {
+  const name = err?.name;
+  if (name === 'NotAllowedError' || name === 'AbortError') {
+    const what = step === 'register'
+      ? 'Registering the passkey was cancelled or timed out.'
+      : 'The passkey step was cancelled or timed out.';
     return new Error(
-      'The passkey step was cancelled, timed out, or could not be completed. ' +
-      'Podkey prompts twice — once to register the passkey, once to derive the key — ' +
-      'so confirm every prompt. If it keeps failing, try a phone passkey or a ' +
-      'different security key.'
+      `${what} With a security key: insert it, enter its PIN if asked, and touch it when it flashes. ` +
+      'Keep this window in front while you do, then try again.'
     );
   }
+  if (name === 'InvalidStateError') {
+    return new Error('This authenticator already holds a Podkey passkey. Use it to unlock, or choose a different key.');
+  }
+  if (name === 'NotSupportedError') {
+    return new Error('This authenticator cannot make the kind of passkey Podkey needs. Try a phone passkey or a newer security key.');
+  }
+  if (name === 'SecurityError') {
+    return new Error('The browser refused the passkey request for this extension. Reload Podkey and try again.');
+  }
   return err instanceof Error ? err : new Error(String(err?.message || err));
 }
 
-export async function createPasskey (prfSalt, label = 'Podkey identity') {
-  if (!window.PublicKeyCredential || !navigator.credentials) {
+// userVerification is 'required' on both ceremonies, and must stay equal
+// between them: CTAP2 hmac-secret derives from a different per-credential
+// secret with and without user verification, so a key registered with UV but
+// asserted without it (or the reverse) returns a different PRF output — a
+// different Nostr identity, or an unwrap failure. For a security key, UV is
+// its PIN; the browser asks the person to set one if the key has none.
+export function creationOptions (prfSalt, label = 'Podkey identity') {
+  return {
+    challenge: randomBytes(32),
+    user: { id: randomBytes(32), name: 'podkey', displayName: label },
+    rp: { name: 'Podkey' },
+    // ES256 first (every FIDO2 key), then EdDSA and RS256 so an authenticator
+    // that offers only those (some Windows Hello TPMs: RS256) is not refused.
+    pubKeyCredParams: [
+      { type: 'public-key', alg: -7 },
+      { type: 'public-key', alg: -8 },
+      { type: 'public-key', alg: -257 }
+    ],
+    // Podkey stores the credentialId itself and always passes it via
+    // allowCredentials at unlock, so it never needs a discoverable (resident)
+    // credential. Requesting one adds cost, uses one of a security key's few
+    // resident slots and, on some TPM/security-key authenticators (e.g.
+    // tpm-fido), a makeCredential failure path — so discourage it.
+    // hmac-secret/PRF works fine on non-resident credentials.
+    authenticatorSelection: { residentKey: 'discouraged', requireResidentKey: false, userVerification: 'required' },
+    // Three minutes: long enough to find a key, set a first PIN and touch it.
+    timeout: 180000,
+    attestation: 'none',
+    extensions: { prf: { eval: { first: prfSalt } } }
+  };
+}
+
+export function assertionOptions (credentialId, prfSalt, transports = []) {
+  const id = typeof credentialId === 'string' ? fromBase64Url(credentialId) : credentialId;
+  const hint = cleanTransports(transports);
+  return {
+    challenge: randomBytes(32),
+    allowCredentials: [{ type: 'public-key', id, ...(hint.length ? { transports: hint } : {}) }],
+    userVerification: 'required',
+    timeout: 180000,
+    extensions: { prf: { eval: { first: prfSalt } } }
+  };
+}
+
+function requireWebAuthn () {
+  if (!globalThis.PublicKeyCredential || !globalThis.navigator?.credentials) {
     throw new Error('Passkeys are not supported by this browser');
   }
+}
+
+export async function createPasskey (prfSalt, label = 'Podkey identity') {
+  requireWebAuthn();
   let credential;
   try {
-    credential = await navigator.credentials.create({ publicKey: {
-      challenge: randomBytes(32),
-      user: { id: randomBytes(32), name: 'podkey', displayName: label },
-      rp: { name: 'Podkey' },
-      pubKeyCredParams: [{ type: 'public-key', alg: -7 }],
-      // Podkey stores the credentialId itself and always passes it via
-      // allowCredentials at unlock, so it never needs a discoverable (resident)
-      // credential. Requesting one adds cost and, on some TPM/security-key
-      // authenticators (e.g. tpm-fido), a makeCredential failure path — so
-      // discourage it. hmac-secret/PRF works fine on non-resident credentials.
-      authenticatorSelection: { residentKey: 'discouraged', userVerification: 'required' },
-      timeout: 120000,
-      attestation: 'none',
-      extensions: { prf: { eval: { first: prfSalt } } }
-    } });
+    credential = await navigator.credentials.create({ publicKey: creationOptions(prfSalt, label) });
   } catch (err) {
-    throw translateCeremonyError(err);
+    throw translateCeremonyError(err, 'register');
   }
   if (!credential) throw new Error('Passkey creation was cancelled');
   // Definitive PRF-support signal: with prf requested at creation, the client
@@ -139,22 +196,18 @@ export async function createPasskey (prfSalt, label = 'Podkey identity') {
   if (!prf || prf.enabled !== true) {
     throw new Error(PRF_UNSUPPORTED_MESSAGE);
   }
-  return { credentialId: toBase64Url(new Uint8Array(credential.rawId)) };
+  let transports = [];
+  try { transports = cleanTransports(credential.response?.getTransports?.()); } catch { /* only a hint */ }
+  return { credentialId: toBase64Url(new Uint8Array(credential.rawId)), transports };
 }
 
-export async function getPasskeyPrf (credentialId, prfSalt) {
-  const id = typeof credentialId === 'string' ? fromBase64Url(credentialId) : credentialId;
+export async function getPasskeyPrf (credentialId, prfSalt, transports = []) {
+  requireWebAuthn();
   let assertion;
   try {
-    assertion = await navigator.credentials.get({ publicKey: {
-      challenge: randomBytes(32),
-      allowCredentials: [{ type: 'public-key', id }],
-      userVerification: 'required',
-      timeout: 120000,
-      extensions: { prf: { eval: { first: prfSalt } } }
-    } });
+    assertion = await navigator.credentials.get({ publicKey: assertionOptions(credentialId, prfSalt, transports) });
   } catch (err) {
-    throw translateCeremonyError(err);
+    throw translateCeremonyError(err, 'unlock');
   }
   const output = assertion?.getClientExtensionResults().prf?.results?.first;
   if (!output) throw new Error(PRF_UNSUPPORTED_MESSAGE);
diff --git a/src/sidestr/core.js b/src/sidestr/core.js
new file mode 100644
index 0000000..b184988
--- /dev/null
+++ b/src/sidestr/core.js
@@ -0,0 +1,253 @@
+/**
+ * Podkey - sidestr browser signer core (proposals/browser-signer.md in sidestr/spec)
+ *
+ * Everything the spend window decides, with no DOM and no chrome.* so Node can
+ * test it: open a chain from its id alone, read what the person's coins carry,
+ * review an unsigned transaction against the chain Podkey validated itself,
+ * and assemble the signed result. The page supplies only the chain id and the
+ * transaction; every coin, amount, asset and sighash here comes from Podkey's
+ * own reading of the chain.
+ *
+ * The engine is the one the sidestr explorer and wallet run, vendored under
+ * vendor/sidestr/ (scripts/vendor-sidestr.js): an extension may not load code
+ * from the network.
+ */
+
+import { hexToNpub } from '../keyformat.js';
+import { SpendError } from './request.js';
+
+export { CODES, SpendError, checkRequest, MAX_TX_HEX } from './request.js';
+
+/** A fee at or above this many sats, or above the sats a plain payment sends, is flagged. */
+export const LARGE_FEE = 5_000;
+
+/** The relays sidestr's wallet asks for tip announcements (SPEC 11). */
+export const RELAYS = ['wss://nos.lol', 'wss://relay.damus.io', 'wss://relay.primal.net', 'wss://nostr.mom', 'wss://nostr.oxtr.dev'];
+
+/**
+ * Load the vendored engine. `base` is the vendor/sidestr/ directory as a URL
+ * (the extension's own files in the spend window, file: URLs in tests).
+ */
+export async function loadLib (base = new URL('../../vendor/sidestr/', import.meta.url)) {
+  const at = (p) => new URL(p, base).href;
+  const [explorer, announce, txsign, records, assets, parents, nostr, secp] = await Promise.all([
+    import(at('explorer/explorer.mjs')),
+    import(at('spec/siding/lib/announce.mjs')),
+    import(at('spec/siding/lib/txsign.mjs')),
+    import(at('spec/siding/lib/records.mjs')),
+    import(at('spec/siding/lib/overlays/assets.mjs')),
+    import(at('spec/siding/lib/parents.mjs')),
+    import(at('schema/codec/nostr.js')),
+    import(at('schema/codec/secp256k1.js'))
+  ]);
+  return { explorer, announce, txsign, records, assets, parents, nostr, secp };
+}
+
+/**
+ * Open a chain from its id, as SPEC 11 says, and validate every block.
+ *
+ * `pinned` is the signer Podkey settled on the first time this person spent on
+ * this chain, or null. A chain id is a name, not a proof: with a pin only that
+ * signer's announcements count, and an announcement for the same id by anyone
+ * else is refused rather than followed.
+ *
+ * @returns {Promise<{ex, signer, announced, mirror, parent, mirrorNote}>}
+ */
+export async function openChain ({ lib, chainId, pinned = null, relays = RELAYS, fetchJson, loadJson, onProgress = () => {} }) {
+  const { announce, explorer, parents, nostr } = lib;
+  const verify = nostr.verifyNostrEvent;
+  onProgress(`Asking ${relays.length} relays where ${chainId} is`);
+  let found;
+  try {
+    found = await announce.findChain({ relays, chainId, verify, signer: pinned ?? undefined, ...(fetchJson ? { fetchJson } : {}) });
+  } catch (e) {
+    if (pinned) {
+      // nothing from the pinned signer: say so plainly if someone else now announces this id
+      let other = null;
+      try { other = await announce.fetchLatestTip({ relays, chainId, verify }); } catch { /* no other announcement either */ }
+      if (other && other.pubkey !== pinned) {
+        throw new SpendError('unsupported', `${chainId} is now announced by a different signer (${other.pubkey.slice(0, 12)}…) than the one you first spent with (${pinned.slice(0, 12)}…). Podkey will not follow it.`);
+      }
+    }
+    throw new SpendError('unavailable', `Could not find ${chainId}: ${e.message}`);
+  }
+  let parent;
+  try { parent = parents.resolveParent(found.chain.parent); } catch (e) { throw new SpendError('unsupported', e.message); }
+  if (parent.mainnet) throw new SpendError('unsupported', `${chainId} sits beside ${parent.label}. Podkey signs only for chains beside test networks for now.`);
+
+  onProgress(`Checking every block of ${chainId}`);
+  const ex = new explorer.Explorer(found.mirror, loadJson ? { loadJson } : {});
+  try {
+    await ex.open();
+  } catch (e) {
+    if (e.code === 'unsupported' || /names rule|rule needs/.test(e.message)) throw new SpendError('unsupported', e.message);
+    throw new SpendError('unavailable', `Could not read ${chainId} from ${found.mirror}: ${e.message}`);
+  }
+  if (ex.chain.id !== chainId || ex.chain.signer !== found.tip.pubkey) {
+    throw new SpendError('unavailable', `The mirror ${found.mirror} does not serve ${chainId} as its signer announced it.`);
+  }
+  const bad = ex.blocks.find((b) => b && b.verdict && b.verdict.ok === false);
+  if (bad) throw new SpendError('unavailable', `Block ${bad.height} of ${chainId} failed validation; Podkey will not sign against it.`);
+  const tip = ex.tip();
+  const judged = announce.judgeMirror({ announced: found.tip, height: tip.height, headerHex: ex.headerHex(tip.height) });
+  if (judged.ok === false) throw new SpendError('unavailable', `The mirror contradicts ${chainId}'s signer: ${judged.note}`);
+  return { ex, signer: found.tip.pubkey, announced: found.tip, mirror: found.mirror, parent, mirrorNote: judged.note };
+}
+
+const outpoint = (inp) => `${inp.prevout.txid}:${inp.prevout.vout}`;
+
+/**
+ * What each unspent output carries (SPEC 12). On a chain that names the
+ * `assets` rule this is the rule's own state. On one that names no rules it is
+ * the holders' reading of the same records: a transaction that breaks the rule
+ * keeps its spends and carries nothing, so what it tried to move is destroyed
+ * (the view sidestr-core's AssetView takes, so the two agree).
+ */
+export function assetView (ex, lib) {
+  const { assets } = lib;
+  if (ex.rules?.assets) {
+    const r = ex.rules.assets;
+    return { mode: 'rule', carried: r.carried, issued: r.issued, check: r.check, CarryView: assets.CarryView };
+  }
+  const ov = assets.assetsOverlay(ex.chain);
+  for (let h = 0; h < ex.blocks.length; h++) {
+    const b = ex.blocks[h];
+    if (!b?.block) throw new SpendError('unavailable', `Block ${h} is not in memory; the asset view needs every block.`);
+    const view = new assets.CarryView(ov.carried);
+    b.block.transactions.forEach((tx, i) => {
+      if (i === 0) return; // a coinbase carries nothing
+      const txid = b.txids[i];
+      const r = ov.check(tx, txid, view);
+      if (!r.ok) { for (const inp of tx.inputs) view.spend(outpoint(inp)); return; }
+      if (r.issue) ov.issued.set(txid, { ticker: r.issue.ticker, decimals: r.issue.decimals, height: h });
+    });
+    for (const [k, v] of view.temp) if (!view.spent.has(k)) ov.carried.set(k, v);
+    for (const k of view.spent.keys()) ov.carried.delete(k);
+  }
+  return { mode: 'view', carried: ov.carried, issued: ov.issued, check: ov.check, CarryView: assets.CarryView };
+}
+
+const addAll = (into, from) => { for (const [a, n] of from ?? []) into.set(a, (into.get(a) ?? 0) + n); return into; };
+
+/** An asset amount in its own units, e.g. 1.50 for 150 at 2 decimals. */
+export function formatAsset (amount, decimals = 0) {
+  if (!decimals) return amount.toLocaleString('en-GB');
+  const s = String(amount).padStart(decimals + 1, '0');
+  const whole = Number(s.slice(0, -decimals)).toLocaleString('en-GB');
+  return `${whole}.${s.slice(-decimals)}`;
+}
+
+/**
+ * Review an unsigned transaction for `pub` against the validated chain.
+ *
+ * Refuses (`not-yours`) any input that is not an unspent, mature coin in
+ * Podkey's own set paying `5120‖pub`, and (`invalid`) anything it cannot read
+ * or that the chain's own asset rule would refuse. Returns what the window
+ * shows and the sighashes to sign, computed here from Podkey's own prevouts.
+ */
+export function review ({ ex, lib, view, pub, txHex }) {
+  const { txsign, records, explorer } = lib;
+  const k = ex.k;
+  if (!/^[0-9a-f]{64}$/.test(pub)) throw new SpendError('unavailable', 'No public key');
+  const me = `5120${pub}`;
+  let tx;
+  try { tx = k.codec.decode('Transaction', txHex); } catch (e) { throw new SpendError('invalid', `Not a transaction: ${e.message}`); }
+  if (!tx?.inputs?.length || !tx?.outputs?.length) throw new SpendError('invalid', 'A transaction needs inputs and outputs');
+  tx.witness = []; // any witness the page sent is ignored and replaced
+  const txid = k.codec.txid(tx);
+
+  const tip = ex.tip().height; const maturity = k.params.coinbaseMaturity;
+  const seen = new Set(); const coins = [];
+  for (const inp of tx.inputs) {
+    const key = outpoint(inp);
+    if (seen.has(key)) throw new SpendError('invalid', `Input ${key.slice(0, 12)}… is spent twice`);
+    seen.add(key);
+    const c = ex.utxo.get(key);
+    if (!c) throw new SpendError('not-yours', `Input ${key.slice(0, 12)}… is not an unspent coin on ${ex.chain.id} (spent, unconfirmed or never made)`);
+    if (c.output.scriptPubKey !== me) throw new SpendError('not-yours', `Input ${key.slice(0, 12)}… is not your coin`);
+    if (c.coinbase && tip + 1 - c.height < maturity) throw new SpendError('not-yours', `Input ${key.slice(0, 12)}… is a block reward that is not mature yet`);
+    coins.push({ key, value: c.output.value, carries: view.carried.get(key) ?? null });
+  }
+  const prevouts = coins.map((c) => ({ value: c.value, scriptPubKey: me }));
+  const inSum = coins.reduce((s, c) => s + c.value, 0);
+  const outSum = tx.outputs.reduce((s, o) => s + o.value, 0);
+  const fee = inSum - outSum;
+  if (fee < 0) throw new SpendError('invalid', 'The outputs spend more than the inputs hold');
+
+  // assets: what the inputs carry, what the tallies assign, and what is destroyed
+  const r = view.check(tx, txid, new view.CarryView(view.carried));
+  const inCarry = new Map(); for (const c of coins) addAll(inCarry, c.carries);
+  if (!r.ok && view.mode === 'rule') throw new SpendError('invalid', `${ex.chain.id} would refuse this transaction: ${r.error}`);
+  const assigned = new Map(); if (r.ok) for (const m of r.out.values()) addAll(assigned, m);
+  const destroyed = [];
+  for (const [asset, n] of inCarry) { const left = n - (assigned.get(asset) ?? 0); if (left > 0) destroyed.push({ asset, amount: left }); }
+  const label = (asset) => {
+    const i = view.issued.get(asset) ?? (r.ok && r.issue && asset === txid ? r.issue : null);
+    return { asset, ticker: i?.ticker ?? `${asset.slice(0, 8)}…`, decimals: i?.decimals ?? 0 };
+  };
+
+  const hrp = ex.chain.addressPrefix;
+  const outputs = tx.outputs.map((o, vout) => {
+    const spk = o.scriptPubKey; const carries = r.ok ? (r.out.get(vout) ?? null) : null;
+    const assetsOut = carries ? [...carries].map(([asset, amount]) => ({ ...label(asset), amount })) : [];
+    const base = { vout, value: o.value, script: spk, assets: assetsOut };
+    if (spk === me) return { ...base, kind: 'change' };
+    if (spk.startsWith('6a')) {
+      const text = records.recordText(spk);
+      if (text?.startsWith('pegout:')) return { ...base, kind: 'pegout', text, to: text.slice(7) };
+      if (text && /^(issue|tally|pool):/.test(text)) return { ...base, kind: 'asset-record', text };
+      return { ...base, kind: o.value > 0 ? 'burn' : 'record', text };
+    }
+    const key = /^5120([0-9a-f]{64})$/.exec(spk);
+    const address = explorer.scriptToAddress(spk, hrp);
+    if (key) return { ...base, kind: 'key', pubkey: key[1], npub: hexToNpub(key[1]), address };
+    return { ...base, kind: 'script', address };
+  });
+
+  const toOthers = outputs.filter((o) => o.kind === 'key' || o.kind === 'script').reduce((s, o) => s + o.value, 0);
+  const warnings = [];
+  for (const d of destroyed) {
+    const l = label(d.asset);
+    warnings.push({ kind: 'destroys', text: `This destroys ${formatAsset(d.amount, l.decimals)} ${l.ticker} that your coins carry.`, ...l, amount: d.amount });
+  }
+  if (!r.ok) warnings.push({ kind: 'breaks', text: `This breaks the asset rule (${r.error}), so everything your coins carry is destroyed.` });
+  for (const o of outputs) {
+    if (o.kind === 'burn') warnings.push({ kind: 'burn', text: `Output ${o.vout} burns ${o.value.toLocaleString('en-GB')} sats for good.` });
+    if (o.kind === 'pegout') warnings.push({ kind: 'pegout', text: `Output ${o.vout} is a peg-out: ${o.value.toLocaleString('en-GB')} sats burn here and are owed on the parent chain.` });
+  }
+  // Against the sats sent only when no asset goes with them: an asset rides on a
+  // few hundred sats of carrier, and a normal fee is not "more than it sends".
+  const sendsAssets = outputs.some((o) => (o.kind === 'key' || o.kind === 'script') && o.assets.length);
+  if (fee >= LARGE_FEE || (!sendsAssets && toOthers > 0 && fee > toOthers)) warnings.push({ kind: 'fee', text: `The fee is ${fee.toLocaleString('en-GB')} sats${toOthers > 0 ? `, more than the ${toOthers.toLocaleString('en-GB')} sats this sends` : ''}.` });
+
+  const sighashes = tx.inputs.map((_, i) => {
+    const { m, ht } = txsign.keyPathSighash({ k, hash: ex.hash }, tx, i, prevouts);
+    return { digest: ex.hash.bytesToHex(m), ht };
+  });
+
+  return {
+    tx, txid, prevouts, fee, inSum, outSum, toOthers,
+    inputs: coins.map((c) => ({ ...c, carries: c.carries ? [...c.carries].map(([asset, amount]) => ({ ...label(asset), amount })) : [] })),
+    outputs, destroyed, warnings, sighashes,
+    assetMode: view.mode
+  };
+}
+
+/**
+ * Put the signatures on and check them as a validator would. `signatures` are
+ * 64-byte BIP 340 signatures as hex, one per input, over the review's digests.
+ * @returns {{ tx: string, txid: string }}
+ */
+export function finish ({ ex, lib, reviewed, signatures, pub }) {
+  const { txsign } = lib; const k = ex.k;
+  if (!Array.isArray(signatures) || signatures.length !== reviewed.sighashes.length || !signatures.every((s) => /^[0-9a-f]{128}$/.test(s))) {
+    throw new SpendError('unavailable', 'The key did not return one signature per input');
+  }
+  const tx = { ...reviewed.tx, witness: signatures.map((s, i) => [s + reviewed.sighashes[i].ht.toString(16).padStart(2, '0')]) };
+  if (!txsign.verifyKeyPath({ k, hash: ex.hash, secp: lib.secp }, tx, reviewed.prevouts, pub)) {
+    throw new SpendError('unavailable', 'A signature did not verify; nothing was returned');
+  }
+  const txid = k.codec.txid(tx);
+  if (txid !== reviewed.txid) throw new SpendError('unavailable', 'Signing changed the transaction id; nothing was returned');
+  return { tx: k.codec.encodeHex('Transaction', tx), txid };
+}
diff --git a/src/sidestr/request.js b/src/sidestr/request.js
new file mode 100644
index 0000000..6ca2dc8
--- /dev/null
+++ b/src/sidestr/request.js
@@ -0,0 +1,33 @@
+/**
+ * Podkey - the shape of a sidestr spend request (sidestr/spec proposals/browser-signer.md)
+ *
+ * Shared by the background service worker, which checks a page's request
+ * before opening the spend window, and by the window itself. No imports, so
+ * the service worker bundle stays free of the chain engine.
+ */
+
+/** Error codes the page sees, per the proposal. */
+export const CODES = ['rejected', 'unsupported', 'not-yours', 'invalid', 'unavailable'];
+
+/** An error with one of CODES, for the page. */
+export class SpendError extends Error {
+  constructor (code, message) {
+    super(message);
+    this.name = 'SpendError';
+    this.code = CODES.includes(code) ? code : 'unavailable';
+  }
+}
+
+const CHAIN_ID = /^sidestr:[a-z0-9][a-z0-9._-]{0,63}$/;
+const HEX = /^(?:[0-9a-f]{2})+$/;
+/** The largest transaction a page may ask about, in hex characters (200 kB). */
+export const MAX_TX_HEX = 400_000;
+
+/** Check a request's shape before anything is fetched. Throws a SpendError. */
+export function checkRequest ({ chain, tx } = {}) {
+  if (typeof chain !== 'string' || !CHAIN_ID.test(chain)) throw new SpendError('invalid', 'chain must be a sidestr chain id, such as sidestr:dreamlab');
+  if (typeof tx !== 'string') throw new SpendError('invalid', 'tx must be the transaction as hex');
+  const hex = tx.trim().toLowerCase();
+  if (!hex || hex.length > MAX_TX_HEX || !HEX.test(hex)) throw new SpendError('invalid', 'tx must be the transaction as hex, at most 200 kB');
+  return { chain, tx: hex };
+}
diff --git a/src/sidestr/spends.js b/src/sidestr/spends.js
new file mode 100644
index 0000000..05e136e
--- /dev/null
+++ b/src/sidestr/spends.js
@@ -0,0 +1,86 @@
+/**
+ * Podkey - the life of one sidestr spend request, in the background
+ *
+ * A page asks (SIDESTR_SIGN_TRANSACTION). The background checks the request's
+ * shape, makes sure the key is unlocked, and opens the spend window
+ * (popup/spend.html), which reads and validates the chain, reviews the
+ * transaction and shows it. The window asks for the request
+ * (SIDESTR_REQUEST), for signatures over the sighashes it computed
+ * (SIDESTR_SIGN_DIGESTS, once) and reports the outcome (SIDESTR_DONE). The
+ * key never leaves the background; the window never sees it.
+ *
+ * Every spend opens the window: trust given to an origin for events does not
+ * extend to spends. Closing the window rejects; so does silence.
+ *
+ * Dependencies are passed in so Node can test this without chrome.*.
+ */
+
+import { SpendError, checkRequest } from './request.js';
+
+/** The window closes itself with a rejection after this long. */
+export const SPEND_WINDOW_MS = 4 * 60 * 1000;
+/** At most this many inputs are signed in one request. */
+export const MAX_INPUTS = 500;
+
+export function createSpends ({ ensureUnlocked, getKeypair, signSighashes, openWindow, now = () => Date.now(), setTimer = setTimeout, clearTimer = clearTimeout, randomId = () => crypto.randomUUID() }) {
+  const pending = new Map(); // id -> { origin, chain, tx, pub, windowId, signed, settle }
+
+  function settle (id, outcome) {
+    const p = pending.get(id); if (!p) return false;
+    pending.delete(id); clearTimer(p.timer); p.settle(outcome); return true;
+  }
+
+  /** From a page, via the content script. Resolves { tx, txid } or rejects with a SpendError. */
+  async function request ({ chain, tx }, origin) {
+    const req = checkRequest({ chain, tx });
+    if (typeof origin !== 'string' || !origin) throw new SpendError('invalid', 'No origin for this request');
+    try { await ensureUnlocked(); } catch (e) { throw new SpendError('unavailable', e.message); }
+    const keypair = await getKeypair();
+    if (!keypair || !/^[0-9a-f]{64}$/.test(keypair.publicKey ?? '')) throw new SpendError('unavailable', 'No key in Podkey');
+    const id = randomId();
+    return new Promise((resolve, reject) => {
+      const entry = {
+        origin, chain: req.chain, tx: req.tx, pub: keypair.publicKey, windowId: null, signed: false, opened: now(),
+        settle: (o) => (o.error ? reject(o.error) : resolve(o.result))
+      };
+      entry.timer = setTimer(() => settle(id, { error: new SpendError('rejected', 'The spend window timed out') }), SPEND_WINDOW_MS + 15_000);
+      pending.set(id, entry);
+      Promise.resolve(openWindow(id)).then((windowId) => { if (pending.has(id)) entry.windowId = windowId ?? null; })
+        .catch((e) => settle(id, { error: new SpendError('unavailable', `Could not open the spend window: ${e.message}`) }));
+    });
+  }
+
+  /** From the spend window: what it is to review. */
+  function describe (id) {
+    const p = pending.get(id); if (!p) throw new SpendError('unavailable', 'This spend request is no longer open');
+    return { origin: p.origin, chain: p.chain, tx: p.tx, pub: p.pub, expiresAt: p.opened + SPEND_WINDOW_MS };
+  }
+
+  /** From the spend window, after the person confirmed: sign its sighashes, once. */
+  async function signDigests (id, digests) {
+    const p = pending.get(id); if (!p) throw new SpendError('unavailable', 'This spend request is no longer open');
+    if (p.signed) throw new SpendError('invalid', 'This spend has already been signed');
+    if (!Array.isArray(digests) || digests.length < 1 || digests.length > MAX_INPUTS) throw new SpendError('invalid', 'One sighash per input');
+    p.signed = true;
+    const keypair = await getKeypair();
+    if (!keypair || keypair.publicKey !== p.pub) throw new SpendError('unavailable', 'The key changed while the spend was open');
+    return { signatures: signSighashes(digests, keypair.privateKey) };
+  }
+
+  /** From the spend window: the outcome. `result` is { tx, txid }; `error` is { code, message }. */
+  function done (id, { result, error } = {}) {
+    if (result && typeof result.tx === 'string' && /^[0-9a-f]{64}$/.test(result.txid ?? '')) {
+      const p = pending.get(id);
+      if (!p?.signed) return settle(id, { error: new SpendError('unavailable', 'A result arrived for a spend that was never signed') });
+      return settle(id, { result: { tx: result.tx, txid: result.txid } });
+    }
+    return settle(id, { error: new SpendError(error?.code ?? 'rejected', error?.message ?? 'You rejected the spend') });
+  }
+
+  /** A window closed: a spend still open in it is rejected. */
+  function windowClosed (windowId) {
+    for (const [id, p] of pending) if (p.windowId !== null && p.windowId === windowId) settle(id, { error: new SpendError('rejected', 'The spend window was closed') });
+  }
+
+  return { request, describe, signDigests, done, windowClosed, pending };
+}
diff --git a/test/content-whitelist.test.js b/test/content-whitelist.test.js
index 229b680..5238b7b 100644
--- a/test/content-whitelist.test.js
+++ b/test/content-whitelist.test.js
@@ -39,6 +39,7 @@ before(async () => {
         forwarded.push(message);
         if (message.type === 'GET_PUBLIC_KEY') return 'a'.repeat(64);
         if (message.type === 'SIGN_EVENT') return { ...message.event, id: 'i'.repeat(64), sig: 's'.repeat(128) };
+        if (message.type === 'SIDESTR_SIGN_TRANSACTION' && message.tx === 'refuse') return { error: 'Input is not your coin', code: 'not-yours' };
         return 'OK';
       },
       lastError: null
@@ -139,4 +140,29 @@ describe('content-script field stripping (only safe fields forwarded)', () => {
     assert.equal(typeof msg.pubkey, 'string');
     assert.equal(typeof msg.plaintext, 'string');
   });
+
+  it('SIDESTR_SIGN_TRANSACTION forwards only chain + tx (as strings) + origin', async () => {
+    await request({ type: 'SIDESTR_SIGN_TRANSACTION', chain: 'sidestr:dreamlab', tx: '0200', digests: ['aa'], pub: 'x' });
+    const msg = forwarded[0];
+    assert.deepEqual(Object.keys(msg).sort(), ['chain', 'origin', 'tx', 'type']);
+    assert.equal(msg.chain, 'sidestr:dreamlab');
+    assert.equal(msg.tx, '0200');
+    await request({ type: 'SIDESTR_SIGN_TRANSACTION', chain: { evil: 1 }, tx: 7 });
+    assert.equal(forwarded[1].chain, '');
+    assert.equal(forwarded[1].tx, '');
+  });
+
+  it('passes a refusal code back to the page', async () => {
+    const res = await request({ type: 'SIDESTR_SIGN_TRANSACTION', chain: 'sidestr:dreamlab', tx: 'refuse' });
+    assert.equal(res.error, 'Input is not your coin');
+    assert.equal(res.code, 'not-yours');
+  });
+
+  it('never forwards the spend window\'s own message types from a page', async () => {
+    for (const type of ['SIDESTR_REQUEST', 'SIDESTR_SIGN_DIGESTS', 'SIDESTR_DONE', 'SIDESTR_KEEPALIVE']) {
+      const res = await request({ type, digests: ['00'.repeat(32)] });
+      assert.equal(res.error, 'Unknown request type');
+    }
+    assert.equal(forwarded.length, 0);
+  });
 });
diff --git a/test/fixtures/sidestr-dreamlab.chain.json b/test/fixtures/sidestr-dreamlab.chain.json
new file mode 100644
index 0000000..a8c17e2
--- /dev/null
+++ b/test/fixtures/sidestr-dreamlab.chain.json
@@ -0,0 +1 @@
+{"id":"sidestr:dreamlab","name":"dreamlab","parent":"tbtc4","comment":"DreamLab root chain (agentbox PRD-024, ADR-2101, ADR-2103), made 2026-09-22 beside Bitcoin testnet4 on the estate's own node. Research stage: level 1, one signer, depth 0. Coins carry no value. Mainnet parents are behind the P21 owner-and-legal gate.","challenge":"51207092810a05359b29acfa1f884d0e1a8e0290309e1133198b0f059447a4c76d62","powLimit":"7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff","addressPrefix":"drm","magic":"d981eab1","pegConfirmations":6,"refundBlocks":10000,"pegoutBlocks":144,"pegoutMin":10000,"minFeeRate":1,"genesisTime":1790076686,"pegs":[],"signer":"7092810a05359b29acfa1f884d0e1a8e0290309e1133198b0f059447a4c76d62","genesisHash":"4db37517728bd509c0cb96ee5a2e3e2a77f9e965a092e9f67948b413d453dbc0","depth":0,"containment":{"parent":"tbtc4","currencyPin":"tbtc","cashOut":false,"pegConfirmations":6,"refundBlocks":10000,"protocolProfile":"sidestr/0.0.2"},"containmentDigest":"sha256:3b7c0af3e96b26bbad83cbb093f9783b10e181343df5f438d7f3d618aa81cef5"}
\ No newline at end of file
diff --git a/test/keyformat.test.js b/test/keyformat.test.js
index da5bbb7..084d725 100644
--- a/test/keyformat.test.js
+++ b/test/keyformat.test.js
@@ -69,3 +69,13 @@ test('hexToNsec rejects non-hex and wrong-length input', () => {
   assert.throws(() => hexToNsec('zz' + HEX.slice(2)), /Invalid key/);
   assert.throws(() => hexToNsec(null), /Invalid key/);
 });
+
+test('hexToNpub encodes the NIP-19 test vector', async () => {
+  const { hexToNpub } = await import('../src/keyformat.js');
+  assert.equal(hexToNpub('3bf0c63fcb93463407af97a5e5ee64fa883d107ef9e558472c4eb9aaaefa459d'), 'npub180cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsyjh6w6');
+});
+
+test('hexToNpub refuses anything but 64 hex characters', async () => {
+  const { hexToNpub } = await import('../src/keyformat.js');
+  assert.throws(() => hexToNpub('xyz'), /Invalid key/);
+});
diff --git a/test/passkey.test.js b/test/passkey.test.js
index 460ae9a..3d315e5 100644
--- a/test/passkey.test.js
+++ b/test/passkey.test.js
@@ -3,9 +3,13 @@ import assert from 'node:assert/strict';
 import { webcrypto } from 'node:crypto';
 import { getPublicKey } from '../src/crypto.js';
 import {
+  assertionOptions,
+  cleanTransports,
+  creationOptions,
   deriveNostrKey,
   fromBase64Url,
   toBase64Url,
+  translateCeremonyError,
   unwrapPrivateKey,
   wrapPrivateKey
 } from '../src/passkey.js';
@@ -79,3 +83,75 @@ describe('wrap freshness and domain separation', () => {
     assert.notEqual(derived, Buffer.from(salt).toString('hex'));
   });
 });
+
+describe('ceremony options (hardware security keys)', () => {
+  const salt = new Uint8Array(32).fill(4);
+
+  it('requires user verification on both ceremonies, so hmac-secret output is stable', () => {
+    // CTAP2 hmac-secret uses a different secret with and without UV: the two
+    // ceremonies must agree or unlock yields a different key.
+    assert.equal(creationOptions(salt).authenticatorSelection.userVerification, 'required');
+    assert.equal(assertionOptions('AAAA', salt).userVerification, 'required');
+  });
+
+  it('asks for a non-resident credential with PRF', () => {
+    const o = creationOptions(salt, 'Podkey unlock');
+    assert.equal(o.authenticatorSelection.residentKey, 'discouraged');
+    assert.equal(o.authenticatorSelection.requireResidentKey, false);
+    assert.deepEqual(o.extensions.prf.eval.first, salt);
+    assert.equal(o.user.displayName, 'Podkey unlock');
+    assert.equal(o.rp.id, undefined, 'rp.id stays unset so the credential binds to the extension origin');
+  });
+
+  it('offers ES256 first, then EdDSA and RS256', () => {
+    assert.deepEqual(creationOptions(salt).pubKeyCredParams.map(p => p.alg), [-7, -8, -257]);
+  });
+
+  it('gives a security key at least three minutes', () => {
+    assert.ok(creationOptions(salt).timeout >= 180000);
+    assert.ok(assertionOptions('AAAA', salt).timeout >= 180000);
+  });
+
+  it('passes the stored transports so the browser goes straight to the key', () => {
+    const o = assertionOptions(toBase64Url(Uint8Array.from([1, 2, 3])), salt, ['usb', 'nfc']);
+    assert.deepEqual(o.allowCredentials[0].transports, ['usb', 'nfc']);
+    assert.deepEqual(o.allowCredentials[0].id, Uint8Array.from([1, 2, 3]));
+    assert.deepEqual(o.extensions.prf.eval.first, salt);
+  });
+
+  it('omits transports for a passkey set up before they were stored', () => {
+    assert.equal('transports' in assertionOptions('AAAA', salt).allowCredentials[0], false);
+    assert.equal('transports' in assertionOptions('AAAA', salt, undefined).allowCredentials[0], false);
+  });
+
+  it('keeps only known transports, once each', () => {
+    assert.deepEqual(cleanTransports(['usb', 'usb', 'bogus', 'nfc', 7]), ['usb', 'nfc']);
+    assert.deepEqual(cleanTransports('usb'), []);
+  });
+});
+
+describe('ceremony errors', () => {
+  const named = (name) => Object.assign(new Error('x'), { name });
+
+  it('tells a security-key user what to do after a cancel or timeout', () => {
+    const e = translateCeremonyError(named('NotAllowedError'), 'unlock');
+    assert.match(e.message, /PIN/);
+    assert.match(e.message, /touch it/);
+    assert.doesNotMatch(e.message, /twice/, 'an unlock prompts once');
+  });
+
+  it('names the registration step when that is what failed', () => {
+    assert.match(translateCeremonyError(named('AbortError'), 'register').message, /Registering/);
+  });
+
+  it('explains InvalidStateError and NotSupportedError', () => {
+    assert.match(translateCeremonyError(named('InvalidStateError')).message, /already holds/);
+    assert.match(translateCeremonyError(named('NotSupportedError')).message, /cannot make/);
+  });
+
+  it('passes other errors through', () => {
+    const original = new Error('boom');
+    assert.equal(translateCeremonyError(original), original);
+    assert.equal(translateCeremonyError('plain').message, 'plain');
+  });
+});
diff --git a/test/provider-surface.test.js b/test/provider-surface.test.js
index dd307b6..9862346 100644
--- a/test/provider-surface.test.js
+++ b/test/provider-surface.test.js
@@ -3,7 +3,8 @@
  *
  * The provider must advertise ONLY what it implements, so that page-side
  * feature-detection is truthful:
- *   - exposes getPublicKey, signEvent, nip44.{encrypt,decrypt}
+ *   - exposes getPublicKey, signEvent, nip44.{encrypt,decrypt}, and
+ *     sidestr.signTransaction (sidestr/spec proposals/browser-signer.md)
  *   - does NOT expose nip04 (deprecated, unauthenticated; not shipped)
  *   - does NOT expose getRelays (Podkey holds no relay list)
  *
@@ -30,8 +31,16 @@ before(async () => {
 });
 
 describe('provider surface (honest feature-detection)', () => {
-  it('exposes exactly getPublicKey, signEvent and nip44', () => {
-    assert.deepEqual(Object.keys(nostr).sort(), ['getPublicKey', 'nip44', 'signEvent']);
+  it('exposes exactly getPublicKey, signEvent, nip44 and sidestr', () => {
+    assert.deepEqual(Object.keys(nostr).sort(), ['getPublicKey', 'nip44', 'sidestr', 'signEvent']);
+  });
+
+  it('sidestr is frozen, version 1, named, and offers only signTransaction', () => {
+    assert.equal(Object.isFrozen(nostr.sidestr), true);
+    assert.equal(nostr.sidestr.version, 1);
+    assert.equal(nostr.sidestr.name, 'Podkey');
+    assert.deepEqual(Object.keys(nostr.sidestr).sort(), ['name', 'signTransaction', 'version']);
+    assert.equal(typeof nostr.sidestr.signTransaction, 'function');
   });
 
   it('exposes nip44.encrypt and nip44.decrypt as functions', () => {
@@ -143,6 +152,34 @@ describe('provider request wiring (podkey-request CustomEvent)', () => {
     assert.equal(await resP, 'plaintext-out');
   });
 
+  it('sidestr.signTransaction dispatches SIDESTR_SIGN_TRANSACTION with chain + tx only', async () => {
+    const reqP = captureRequest(() => ({ tx: 'ab', txid: 'c'.repeat(64) }));
+    const resP = nostr.sidestr.signTransaction({ chain: 'sidestr:dreamlab', tx: '0200', extra: 'dropped' });
+    const req = await reqP;
+    assert.equal(req.type, 'SIDESTR_SIGN_TRANSACTION');
+    assert.equal(req.chain, 'sidestr:dreamlab');
+    assert.equal(req.tx, '0200');
+    assert.equal('extra' in req, false);
+    assert.deepEqual(await resP, { tx: 'ab', txid: 'c'.repeat(64) });
+  });
+
+  it('sidestr.signTransaction rejects a non-object request with code invalid', async () => {
+    await assert.rejects(() => nostr.sidestr.signTransaction(null), (e) => e.code === 'invalid');
+  });
+
+  it('a refused spend reaches the page with its code', async () => {
+    const handler = (e) => {
+      global.window.removeEventListener('podkey-request', handler);
+      queueMicrotask(() => {
+        global.window.dispatchEvent(new CustomEvent('podkey-response', {
+          detail: { id: e.detail.id, error: 'You rejected the spend', code: 'rejected' }
+        }));
+      });
+    };
+    global.window.addEventListener('podkey-request', handler);
+    await assert.rejects(() => nostr.sidestr.signTransaction({ chain: 'sidestr:x', tx: '00' }), (e) => e.code === 'rejected' && /rejected the spend/.test(e.message));
+  });
+
   it('propagates a background error back to the caller as a rejection', async () => {
     const handler = (e) => {
       global.window.removeEventListener('podkey-request', handler);
diff --git a/test/sidestr-core.test.js b/test/sidestr-core.test.js
new file mode 100644
index 0000000..f57cc24
--- /dev/null
+++ b/test/sidestr-core.test.js
@@ -0,0 +1,188 @@
+/**
+ * Tests for the sidestr spend window's core (src/sidestr/core.js), offline,
+ * against the real vendored engine: the kernel decodes and hashes, the spec
+ * lib computes BIP 341 sighashes and checks signatures, and the assets rule
+ * reads records. Only the chain's block history is synthetic.
+ *
+ * What is proved: a spend of the person's own coins reviews, signs through
+ * Podkey's own signing path, and verifies as a validator would; anything else
+ * is refused with the proposal's codes; a transaction that would destroy an
+ * asset its inputs carry says so.
+ */
+
+import { describe, it, before } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import * as secp256k1 from '@noble/secp256k1';
+import * as core from '../src/sidestr/core.js';
+import { signSighashes, getPublicKey } from '../src/crypto.js';
+
+const loadJson = async (u) => JSON.parse(await readFile(new URL(u), 'utf8'));
+const chain = JSON.parse(await readFile(new URL('./fixtures/sidestr-dreamlab.chain.json', import.meta.url), 'utf8'));
+
+let lib, engine;
+const hex = (b) => Buffer.from(b).toString('hex');
+const secret = hex(secp256k1.utils.randomSecretKey());
+const pub = getPublicKey(secret);
+const me = `5120${pub}`;
+const stranger = `5120${'ab'.repeat(32)}`;
+
+/** A fake explorer: the real kernel over a synthetic, already-validated history. */
+function makeEx ({ utxo = [], blocks = [], height = 200, rules = { overlays: [], assets: null } } = {}) {
+  return {
+    k: engine.k, hash: engine.hash, chain, rules,
+    utxo: new Map(utxo),
+    blocks,
+    tip: () => ({ height })
+  };
+}
+const coin = (value, script = me, { height = 10, coinbase = false } = {}) => ({ output: { value, scriptPubKey: script }, height, coinbase, outpoint: {} });
+const input = (txid, vout = 0) => ({ prevout: { txid, vout }, scriptSig: '', sequence: 0xfffffffd });
+const T = (n) => String(n).repeat(64).slice(0, 64);
+const encode = (tx) => engine.k.codec.encodeHex('Transaction', { version: 2, lockTime: 0, witness: [], ...tx });
+const emptyView = () => core.assetView(makeEx(), lib);
+
+before(async () => {
+  lib = await core.loadLib();
+  engine = await lib.explorer.loadEngine(chain, { loadJson });
+});
+
+describe('checkRequest', () => {
+  it('takes a chain id and hex, lower-casing the hex', () => {
+    assert.deepEqual(core.checkRequest({ chain: 'sidestr:dreamlab', tx: 'AB00' }), { chain: 'sidestr:dreamlab', tx: 'ab00' });
+  });
+  it('refuses a bad chain id, odd or non-hex tx, and oversized tx as invalid', () => {
+    for (const bad of [{ chain: 'dreamlab', tx: '00' }, { chain: 'sidestr:', tx: '00' }, { chain: 'sidestr:x', tx: '0' }, { chain: 'sidestr:x', tx: 'zz' }, { chain: 'sidestr:x', tx: '00'.repeat(core.MAX_TX_HEX) }, {}]) {
+      assert.throws(() => core.checkRequest(bad), (e) => e.code === 'invalid');
+    }
+  });
+});
+
+describe('review and finish: the whole signing path', () => {
+  it('reviews a spend of your own coin, signs it with Podkey\'s key, and it verifies', () => {
+    const ex = makeEx({ utxo: [[`${T(1)}:0`, coin(10_000)]] });
+    const txHex = encode({ inputs: [input(T(1))], outputs: [{ value: 3_000, scriptPubKey: stranger }, { value: 6_800, scriptPubKey: me }] });
+    const r = core.review({ ex, lib, view: emptyView(), pub, txHex });
+    assert.equal(r.fee, 200);
+    assert.deepEqual(r.outputs.map((o) => o.kind), ['key', 'change']);
+    assert.match(r.outputs[0].npub, /^npub1/);
+    assert.equal(r.toOthers, 3_000);
+    assert.equal(r.warnings.length, 0);
+    assert.equal(r.sighashes.length, 1);
+    assert.equal(r.sighashes[0].ht, 0x01, 'beside stock Bitcoin: BIP 341, SIGHASH_ALL');
+
+    const signatures = signSighashes(r.sighashes.map((s) => s.digest), secret);
+    const out = core.finish({ ex, lib, reviewed: r, signatures, pub });
+    assert.equal(out.txid, r.txid, 'a witness does not change the txid');
+    const signed = engine.k.codec.decode('Transaction', out.tx);
+    assert.equal(signed.witness[0][0].length, 130, '64-byte signature plus the hash type');
+    // an independent implementation (the engine's own secp256k1) agrees
+    assert.equal(lib.txsign.verifyKeyPath({ k: engine.k, hash: engine.hash, secp: lib.secp }, signed, r.prevouts, pub), true);
+  });
+
+  it('replaces any witness the page sent', () => {
+    const ex = makeEx({ utxo: [[`${T(1)}:0`, coin(10_000)]] });
+    const txHex = encode({ inputs: [input(T(1))], outputs: [{ value: 9_000, scriptPubKey: stranger }], witness: [['ff'.repeat(65)]] });
+    const r = core.review({ ex, lib, view: emptyView(), pub, txHex });
+    assert.deepEqual(r.tx.witness, []);
+  });
+
+  it('refuses a signature that is not over the reviewed sighash', () => {
+    const ex = makeEx({ utxo: [[`${T(1)}:0`, coin(10_000)]] });
+    const r = core.review({ ex, lib, view: emptyView(), pub, txHex: encode({ inputs: [input(T(1))], outputs: [{ value: 9_000, scriptPubKey: stranger }] }) });
+    const wrong = signSighashes(['00'.repeat(32)], secret);
+    assert.throws(() => core.finish({ ex, lib, reviewed: r, signatures: wrong, pub }), /did not verify/);
+    assert.throws(() => core.finish({ ex, lib, reviewed: r, signatures: [], pub }), /one signature per input/);
+  });
+});
+
+describe('review refuses what is not yours', () => {
+  const view = () => emptyView();
+  it('a coin paying someone else', () => {
+    const ex = makeEx({ utxo: [[`${T(1)}:0`, coin(10_000, stranger)]] });
+    assert.throws(() => core.review({ ex, lib, view: view(), pub, txHex: encode({ inputs: [input(T(1))], outputs: [{ value: 9_000, scriptPubKey: me }] }) }), (e) => e.code === 'not-yours');
+  });
+  it('a coin Podkey cannot see (spent, unconfirmed or invented)', () => {
+    const ex = makeEx();
+    assert.throws(() => core.review({ ex, lib, view: view(), pub, txHex: encode({ inputs: [input(T(2))], outputs: [{ value: 1, scriptPubKey: me }] }) }), (e) => e.code === 'not-yours');
+  });
+  it('an immature block reward', () => {
+    const ex = makeEx({ utxo: [[`${T(1)}:0`, coin(10_000, me, { height: 150, coinbase: true })]], height: 200 });
+    assert.throws(() => core.review({ ex, lib, view: view(), pub, txHex: encode({ inputs: [input(T(1))], outputs: [{ value: 9_000, scriptPubKey: me }] }) }), (e) => e.code === 'not-yours' && /not mature/.test(e.message));
+  });
+  it('the same coin twice, outputs over inputs, and junk as invalid', () => {
+    const ex = makeEx({ utxo: [[`${T(1)}:0`, coin(10_000)]] });
+    assert.throws(() => core.review({ ex, lib, view: view(), pub, txHex: encode({ inputs: [input(T(1)), input(T(1))], outputs: [{ value: 1, scriptPubKey: me }] }) }), (e) => e.code === 'invalid');
+    assert.throws(() => core.review({ ex, lib, view: view(), pub, txHex: encode({ inputs: [input(T(1))], outputs: [{ value: 20_000, scriptPubKey: me }] }) }), (e) => e.code === 'invalid');
+    assert.throws(() => core.review({ ex, lib, view: view(), pub, txHex: 'deadbeef' }), (e) => e.code === 'invalid');
+  });
+});
+
+describe('warnings', () => {
+  it('a burn, a peg-out and a large fee are all flagged', () => {
+    const ex = makeEx({ utxo: [[`${T(1)}:0`, coin(50_000)]] });
+    const pegout = lib.records.recordScript(`pegout:${'00'.repeat(2)}14${'11'.repeat(20)}`);
+    const txHex = encode({ inputs: [input(T(1))], outputs: [{ value: 10_000, scriptPubKey: pegout }, { value: 1_000, scriptPubKey: lib.records.recordScript('gone') }, { value: 100, scriptPubKey: stranger }] });
+    const r = core.review({ ex, lib, view: emptyView(), pub, txHex });
+    assert.deepEqual(r.warnings.map((w) => w.kind).sort(), ['burn', 'fee', 'pegout']);
+  });
+});
+
+describe('assets (SPEC 12)', () => {
+  // history: an issue of 1000 DREAM onto one of my coins, then a transfer that
+  // breaks the rule (assigns more than it carries), whose outputs must carry nothing
+  function history () {
+    const issue = { version: 2, lockTime: 0, witness: [], inputs: [input(T(5))], outputs: [{ value: 330, scriptPubKey: me }, { value: 0, scriptPubKey: lib.records.recordScript('issue:DREAM:0') }, { value: 0, scriptPubKey: lib.records.recordScript('tally:self:0=1000') }] };
+    const issueId = engine.k.codec.txid(issue);
+    const other = { version: 2, lockTime: 0, witness: [], inputs: [input(T(6))], outputs: [{ value: 330, scriptPubKey: me }, { value: 0, scriptPubKey: lib.records.recordScript(`tally:${issueId}:0=5`) }] };
+    const otherId = engine.k.codec.txid(other);
+    const blocks = [{ block: { transactions: [{}, issue] }, txids: ['cb0', issueId] }, { block: { transactions: [{}, other] }, txids: ['cb1', otherId] }];
+    const utxo = [[`${issueId}:0`, coin(330)], [`${otherId}:0`, coin(330)], [`${T(7)}:0`, coin(20_000)]];
+    return { ex: makeEx({ utxo, blocks }), issueId, otherId };
+  }
+
+  it('the holders\' view reads the issue and refuses to create from nothing', () => {
+    const { ex, issueId, otherId } = history();
+    const view = core.assetView(ex, lib);
+    assert.equal(view.mode, 'view');
+    assert.equal(view.issued.get(issueId).ticker, 'DREAM');
+    assert.equal(view.carried.get(`${issueId}:0`).get(issueId), 1000);
+    assert.equal(view.carried.has(`${otherId}:0`), false, 'a transaction that breaks the rule carries nothing');
+  });
+
+  it('a transfer that tallies DREAM onward shows it, with nothing destroyed', () => {
+    const { ex, issueId } = history();
+    const view = core.assetView(ex, lib);
+    const txHex = encode({ inputs: [input(issueId), input(T(7))], outputs: [{ value: 330, scriptPubKey: stranger }, { value: 330, scriptPubKey: me }, { value: 0, scriptPubKey: lib.records.recordScript(`tally:${issueId}:0=100,1=900`) }, { value: 19_000, scriptPubKey: me }] });
+    const r = core.review({ ex, lib, view, pub, txHex });
+    assert.deepEqual(r.outputs[0].assets.map((a) => [a.ticker, a.amount]), [['DREAM', 100]]);
+    assert.deepEqual(r.outputs[1].assets.map((a) => [a.ticker, a.amount]), [['DREAM', 900]]);
+    assert.equal(r.destroyed.length, 0);
+    assert.equal(r.warnings.length, 0);
+  });
+
+  it('a "sats only" spend that sweeps a DREAM coin is flagged as destroying it', () => {
+    const { ex, issueId } = history();
+    const view = core.assetView(ex, lib);
+    const txHex = encode({ inputs: [input(issueId), input(T(7))], outputs: [{ value: 20_000, scriptPubKey: stranger }] });
+    const r = core.review({ ex, lib, view, pub, txHex });
+    assert.deepEqual(r.destroyed, [{ asset: issueId, amount: 1000 }]);
+    assert.ok(r.warnings.some((w) => w.kind === 'destroys' && /1,000 DREAM/.test(w.text)));
+  });
+
+  it('on a chain that enforces the rule, a breaking transaction is refused as invalid', () => {
+    const { ex, issueId } = history();
+    const view = core.assetView(ex, lib);
+    const enforced = { ...view, mode: 'rule' };
+    const txHex = encode({ inputs: [input(issueId)], outputs: [{ value: 330, scriptPubKey: stranger }, { value: 0, scriptPubKey: lib.records.recordScript(`tally:${issueId}:0=5000`) }] });
+    assert.throws(() => core.review({ ex, lib, view: enforced, pub, txHex }), (e) => e.code === 'invalid');
+  });
+});
+
+describe('formatAsset', () => {
+  it('formats whole and decimal units', () => {
+    assert.equal(core.formatAsset(1_000_000, 0), '1,000,000');
+    assert.equal(core.formatAsset(150, 2), '1.50');
+    assert.equal(core.formatAsset(5, 2), '0.05');
+  });
+});
diff --git a/test/sidestr-spends.test.js b/test/sidestr-spends.test.js
new file mode 100644
index 0000000..be0f086
--- /dev/null
+++ b/test/sidestr-spends.test.js
@@ -0,0 +1,115 @@
+/**
+ * Tests for the background's side of a sidestr spend (src/sidestr/spends.js):
+ * the request opens the window, the window signs once, the outcome resolves
+ * the page's promise, and closing, silence or a locked key reject it.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { createSpends, SPEND_WINDOW_MS } from '../src/sidestr/spends.js';
+
+const PUB = 'a'.repeat(64);
+const REQ = { chain: 'sidestr:dreamlab', tx: '0200' };
+
+function harness ({ locked = false, key = { publicKey: PUB, privateKey: 'b'.repeat(64) } } = {}) {
+  const timers = []; const opened = []; let n = 0;
+  const signed = [];
+  const spends = createSpends({
+    ensureUnlocked: async () => { if (locked) throw new Error('Podkey is locked'); },
+    getKeypair: async () => key,
+    signSighashes: (digests, priv) => { signed.push({ digests, priv }); return digests.map(() => 'c'.repeat(128)); },
+    openWindow: async (id) => { opened.push(id); return 42; },
+    setTimer: (fn, ms) => { timers.push({ fn, ms }); return timers.length; },
+    clearTimer: () => {},
+    randomId: () => `id-${++n}`
+  });
+  const tick = () => new Promise((resolve) => setImmediate(resolve));
+  return { spends, timers, opened, signed, tick };
+}
+
+describe('sidestr spends', () => {
+  it('opens the window and resolves with the signed transaction after one signing', async () => {
+    const h = harness();
+    const p = h.spends.request(REQ, 'https://forum.example');
+    await h.tick();
+    assert.deepEqual(h.opened, ['id-1']);
+    const d = h.spends.describe('id-1');
+    assert.equal(d.origin, 'https://forum.example');
+    assert.equal(d.pub, PUB);
+    assert.ok(d.expiresAt > Date.now() && d.expiresAt <= Date.now() + SPEND_WINDOW_MS);
+    const { signatures } = await h.spends.signDigests('id-1', ['d'.repeat(64)]);
+    assert.equal(signatures.length, 1);
+    await assert.rejects(() => h.spends.signDigests('id-1', ['d'.repeat(64)]), /already been signed/);
+    h.spends.done('id-1', { result: { tx: 'ff', txid: 'e'.repeat(64) } });
+    assert.deepEqual(await p, { tx: 'ff', txid: 'e'.repeat(64) });
+    assert.equal(h.spends.pending.size, 0);
+  });
+
+  it('refuses a result for a spend that was never signed', async () => {
+    const h = harness();
+    const p = h.spends.request(REQ, 'https://x.example');
+    await h.tick();
+    h.spends.done('id-1', { result: { tx: 'ff', txid: 'e'.repeat(64) } });
+    await assert.rejects(p, (e) => e.code === 'unavailable');
+  });
+
+  it('a rejection in the window reaches the page with its code', async () => {
+    const h = harness();
+    const p = h.spends.request(REQ, 'https://x.example');
+    await h.tick();
+    h.spends.done('id-1', { error: { code: 'rejected', message: 'You rejected the spend' } });
+    await assert.rejects(p, (e) => e.code === 'rejected' && /rejected the spend/.test(e.message));
+  });
+
+  it('closing the window rejects', async () => {
+    const h = harness();
+    const p = h.spends.request(REQ, 'https://x.example');
+    await h.tick();
+    h.spends.windowClosed(7); // another window: nothing happens
+    assert.equal(h.spends.pending.size, 1);
+    h.spends.windowClosed(42);
+    await assert.rejects(p, (e) => e.code === 'rejected');
+  });
+
+  it('silence rejects when the timer fires', async () => {
+    const h = harness();
+    const p = h.spends.request(REQ, 'https://x.example');
+    await h.tick();
+    assert.ok(h.timers[0].ms > SPEND_WINDOW_MS);
+    h.timers[0].fn();
+    await assert.rejects(p, (e) => e.code === 'rejected' && /timed out/.test(e.message));
+  });
+
+  it('checks the request before opening anything', async () => {
+    const h = harness();
+    await assert.rejects(() => h.spends.request({ chain: 'nope', tx: '00' }, 'https://x.example'), (e) => e.code === 'invalid');
+    await assert.rejects(() => h.spends.request(REQ, ''), (e) => e.code === 'invalid');
+    assert.equal(h.opened.length, 0);
+  });
+
+  it('a locked key is unavailable, and no window opens', async () => {
+    const h = harness({ locked: true });
+    await assert.rejects(() => h.spends.request(REQ, 'https://x.example'), (e) => e.code === 'unavailable');
+    assert.equal(h.opened.length, 0);
+  });
+
+  it('refuses to sign if the key changed while the window was open', async () => {
+    const h = harness();
+    const p = h.spends.request(REQ, 'https://x.example');
+    await h.tick();
+    h.spends.pending.get('id-1').pub = 'f'.repeat(64);
+    await assert.rejects(() => h.spends.signDigests('id-1', ['d'.repeat(64)]), /key changed/);
+    assert.equal(h.signed.length, 0);
+    h.spends.windowClosed(42);
+    await assert.rejects(p);
+  });
+
+  it('refuses an empty or oversized digest list', async () => {
+    const h = harness();
+    const p = h.spends.request(REQ, 'https://x.example');
+    await h.tick();
+    await assert.rejects(() => h.spends.signDigests('id-1', []), (e) => e.code === 'invalid');
+    h.spends.windowClosed(42);
+    await assert.rejects(p);
+  });
+});
diff --git a/test/sidestr-vendor.test.js b/test/sidestr-vendor.test.js
new file mode 100644
index 0000000..60f65f0
--- /dev/null
+++ b/test/sidestr-vendor.test.js
@@ -0,0 +1,57 @@
+/**
+ * The vendored sidestr engine (vendor/sidestr/) is exactly what
+ * scripts/vendor-sidestr.js wrote from the pinned commits: every file's
+ * SHA-256 matches PINS.json, nothing unrecorded is present, and no vendored
+ * module imports code from the network (Manifest V3 forbids it).
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { listVendored, PINS } from '../scripts/vendor-sidestr.js';
+
+const base = join(dirname(fileURLToPath(import.meta.url)), '..', 'vendor', 'sidestr');
+const record = JSON.parse(readFileSync(join(base, 'PINS.json'), 'utf8'));
+
+describe('vendored sidestr engine', () => {
+  it('records the pins the script names', () => {
+    assert.deepEqual(record.pins.map((p) => [p.name, p.commit]), PINS.map((p) => [p.name, p.commit]));
+  });
+
+  it('every file matches its recorded SHA-256, and nothing else is present', () => {
+    const recorded = [];
+    for (const pin of record.pins) {
+      for (const [file, sum] of Object.entries(pin.files)) {
+        const path = `${pin.name}/${file}`; recorded.push(path);
+        const actual = createHash('sha256').update(readFileSync(join(base, path), 'utf8')).digest('hex');
+        assert.equal(actual, sum, `${path} changed since it was vendored`);
+      }
+    }
+    assert.deepEqual(listVendored(base), recorded.sort());
+  });
+
+  it('records the two patches', () => {
+    const patched = record.pins.flatMap((p) => Object.keys(p.patched).map((f) => `${p.name}/${f}`)).sort();
+    assert.deepEqual(patched, ['explorer/explorer.mjs', 'spec/siding/lib/overlays/evm.mjs']);
+  });
+
+  it('no vendored module imports, fetches or evaluates code from the network', () => {
+    for (const path of listVendored(base).filter((f) => /\.m?js$/.test(f))) {
+      const src = readFileSync(join(base, path), 'utf8');
+      assert.doesNotMatch(src, /import\s*\(\s*[`'"]https?:/, `${path} imports from the network`);
+      assert.doesNotMatch(src, /from\s*['"]https?:/, `${path} imports from the network`);
+      assert.doesNotMatch(src, /new Function|\beval\(/, `${path} evaluates strings`);
+    }
+  });
+
+  it('the explorer defaults to the vendored engine, and the EVM rule refuses as unsupported', async () => {
+    const explorer = await import('../vendor/sidestr/explorer/explorer.mjs');
+    assert.match(explorer.CDN, /^file:.*\/vendor\/sidestr\/schema$/);
+    assert.match(explorer.SIDESTR, /^file:.*\/vendor\/sidestr\/spec\/siding\/lib$/);
+    const { evmOverlay } = await import('../vendor/sidestr/spec/siding/lib/overlays/evm.mjs');
+    assert.throws(() => evmOverlay({ id: 'sidestr:x' }), (e) => e.code === 'unsupported');
+  });
+});
diff --git a/vendor/sidestr/PINS.json b/vendor/sidestr/PINS.json
new file mode 100644
index 0000000..4dfa000
--- /dev/null
+++ b/vendor/sidestr/PINS.json
@@ -0,0 +1,68 @@
+{
+  "note": "Generated by scripts/vendor-sidestr.js. Do not edit by hand.",
+  "pins": [
+    {
+      "name": "schema",
+      "repo": "https://github.com/bitcoin-desktop/schema",
+      "commit": "b8cbf6337c7450fe14ddc5bce00c7280059aab5d",
+      "tag": "v0.0.27",
+      "files": {
+        "codec/blocks.js": "ec8e943cf27bdf34a9c97c6d742a2a6ecddf07121c65d433031560422a487649",
+        "codec/codec.js": "4c6ecc0cc159e9e16134391e68cef9ab6d3fc5ab8fa59ca5c9004ff6786efdf8",
+        "codec/hash.js": "79af401550a274dbe49a32530595feaf0c43b830587fab2034f3afb1fe09420f",
+        "codec/headers.js": "68898ce77a8a8abb6fda73d82c42eb462959a321298e6b7716cb6ac5e19ac431",
+        "codec/interpreter.js": "445149e7f3b972844fe33b9d3f60adb8387f220351dbd3394f0a79a8dd73aba0",
+        "codec/kernel.js": "632bb850628e095b289def04642a85fa98007f99e6ebf50d43fb24bcd46fbac8",
+        "codec/nostr.js": "edec8be7e884cbc1b05b0d9b38b1725bc2e86179cdfed3ed0fc05bed0cf4be14",
+        "codec/overlay.js": "3e09ea8aa80a2ec8641f0cb06f693c7624b54a9943c2222ebf658e75cc53dd59",
+        "codec/overlays/knots-blake2b.js": "7036bece208c01db6b102d2fc04d74c113a487d904b3678df493fae6653be57a",
+        "codec/pow/blake2b.js": "154583b7b6a9d8a604a5d7e83a2ab82d32b9009fa7be478e5143d56c34abd06b",
+        "codec/pow/knots-header-v2.js": "669086796668ac1018abef6aba961ded316a4d55270cf5280d4c89d15360a033",
+        "codec/script.js": "df05394e0fc765b647d2b1b9dbf091809926125cbbe5ba84f607b84e5dc4644b",
+        "codec/secp256k1.js": "bd3a6b034024978f9dd8923685567ce2834ed9631119f0d3b410e6d2efb41e14",
+        "schema/core.jsonld": "fb5f3e2b984bfaa36eee6d5e6a6a191c3865cc09cadb4ffee16fae76a54e6ef5",
+        "schema/proof.jsonld": "0defcdc32d7421d1440628681027564a7e5590f62d351cc5f075b6cd57c4d1e0",
+        "schema/script.jsonld": "c3a28b41ceae1c1f83288fe1755d1550989e5c5a3e51f1bf8c729a6e42db73a8",
+        "schema/chain.jsonld": "ccbdb40f9ffd72c0686c6303ab8899f79f6c651735bdfcef431af6c23efec821",
+        "schema/validate.jsonld": "4eb6792d4330397631d14dc4a8734ddb28fdd2459a3f98fc2bf822596a95bfb0",
+        "schema/overlays/knots-blake2b.jsonld": "b5b76b03a8b1159b4dd304a9b3b65b9a5891204f81fa0b26e4b42692d0a2022e",
+        "LICENSE": "0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0"
+      },
+      "patched": {}
+    },
+    {
+      "name": "spec",
+      "repo": "https://github.com/sidestr/spec",
+      "commit": "373d3eb6accd163f418e8a813052f1516a942bb3",
+      "files": {
+        "siding/lib/announce.mjs": "67a4e18d13eaa234fb4e9ddb5c3a275140fb33055e60e1d4150e4b0f23b12862",
+        "siding/lib/block.mjs": "3f9de6866080ff788aab6e898be7744c12988636f9137ec1eeddcfa66d57ca48",
+        "siding/lib/federation.mjs": "6fe5da6b5ea78473a8c49cd53414e2334714debfc580301a27c8ef9f29450c04",
+        "siding/lib/overlay.mjs": "d0bea820231a1ff252df9025b9b7a067a1263fc0047bf24d3f20364654b86b89",
+        "siding/lib/overlays/assets.mjs": "66fb734043e67ef2aee501f60ed60ebd3a9484588454e340ca3edbe5597515c6",
+        "siding/lib/overlays/evm.mjs": "59947b6681033f4bab2ec0500bd0ae2ab789f0bde261f31c1abb279d6dd36119",
+        "siding/lib/overlays/index.mjs": "58cccd190238b349c6f7815aefe1e2c4a337e8e770b060e06710824e8700f834",
+        "siding/lib/overlays/pool.mjs": "c86584bac7f4ff9c6af41f76dd6abd52c0a9e49bce23c9a5df218729377a0f04",
+        "siding/lib/parents.mjs": "a5e697a61e25c32a0df66def2809bac284247c777d5fa32647c08cfd249548ca",
+        "siding/lib/records.mjs": "8afa474cf154d8db6442a269deb30a83e67e8cc36e295c03c47a67c0c934ccca",
+        "siding/lib/txsign.mjs": "5f2af06056e30e6c0997c917ba05bfcce305b947a80df1c242a6b04931039875",
+        "LICENSE": "0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0"
+      },
+      "patched": {
+        "siding/lib/overlays/evm.mjs": "stub: the EVM rule imports ethereumjs from the network at start"
+      }
+    },
+    {
+      "name": "explorer",
+      "repo": "https://github.com/sidestr/explorer",
+      "commit": "db5a04e756243f9a73cba11b083d715c2ee3b327",
+      "files": {
+        "explorer.mjs": "17828f9a0205aa254afc3bda5b94a8faec90213146a4310882581bb3e8a2fb26",
+        "LICENSE": "0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0"
+      },
+      "patched": {
+        "explorer.mjs": "engine locations point at the vendored copies instead of jsdelivr"
+      }
+    }
+  ]
+}
diff --git a/vendor/sidestr/explorer/LICENSE b/vendor/sidestr/explorer/LICENSE
new file mode 100644
index 0000000..be3f7b2
--- /dev/null
+++ b/vendor/sidestr/explorer/LICENSE
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
diff --git a/vendor/sidestr/explorer/explorer.mjs b/vendor/sidestr/explorer/explorer.mjs
new file mode 100644
index 0000000..dc744e2
--- /dev/null
+++ b/vendor/sidestr/explorer/explorer.mjs
@@ -0,0 +1,114 @@
+// Reads a sidestr chain from a mirror (chain.json, blocks.json, blocks.dat with Range) and validates
+// every block with the engine in memory: headers, structure including the block signature, and
+// context against a UTXO set it builds itself. No key, no submit, no DOM: index.html renders this.
+export const CDN = new URL('../schema', import.meta.url).href; // Podkey: the vendored engine, never the network
+export const SIDESTR = new URL('../spec/siding/lib', import.meta.url).href; // Podkey: the vendored lib
+
+const CHARSET = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';
+const polymod = (values) => { const G = [0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3]; let chk = 1; for (const v of values) { const top = chk >>> 25; chk = ((chk & 0x1ffffff) << 5) ^ v; for (let i = 0; i < 5; i++) if ((top >>> i) & 1) chk ^= G[i]; } return chk >>> 0; };
+const hrpExpand = (hrp) => { const out = []; for (const c of hrp) out.push(c.charCodeAt(0) >>> 5); out.push(0); for (const c of hrp) out.push(c.charCodeAt(0) & 31); return out; };
+const toWords = (bytes) => { const out = []; let acc = 0, bits = 0; for (const b of bytes) { acc = (acc << 8) | b; bits += 8; while (bits >= 5) { bits -= 5; out.push((acc >>> bits) & 31); } } if (bits) out.push((acc << (5 - bits)) & 31); return out; };
+const unhex = (h) => Uint8Array.from(h.match(/../g) ?? [], (x) => parseInt(x, 16));
+export function scriptToAddress(spk, hrp) {
+  const m = /^(00|5[1-9a-f]|60)([0-9a-f]{2})([0-9a-f]+)$/i.exec(spk); if (!m) return null;
+  const version = m[1] === '00' ? 0 : parseInt(m[1], 16) - 0x50, len = parseInt(m[2], 16), program = m[3];
+  if (program.length !== len * 2 || len < 2 || len > 40) return null;
+  const words = [version, ...toWords(unhex(program))]; const pm = polymod([...hrpExpand(hrp), ...words, 0, 0, 0, 0, 0, 0]) ^ (version === 0 ? 1 : 0x2bc830a3);
+  const chk = []; for (let i = 0; i < 6; i++) chk.push((pm >>> (5 * (5 - i))) & 31);
+  return hrp + '1' + [...words, ...chk].map((w) => CHARSET[w]).join('');
+}
+export function addressToScript(addr, hrp) {
+  const s = addr.toLowerCase(); if (!s.startsWith(hrp + '1')) return null;
+  const data = [...s.slice(hrp.length + 1)].map((c) => CHARSET.indexOf(c)); if (data.some((d) => d < 0) || data.length < 7) return null;
+  const words = data.slice(0, -6), version = words[0]; const bytes = []; let acc = 0, bits = 0;
+  for (const w of words.slice(1)) { acc = (acc << 5) | w; bits += 5; while (bits >= 8) { bits -= 8; bytes.push((acc >>> bits) & 255); } }
+  const prog = bytes.map((b) => b.toString(16).padStart(2, '0')).join(''); const op = version === 0 ? '00' : (0x50 + version).toString(16);
+  return op + (bytes.length).toString(16).padStart(2, '0') + prog;
+}
+export const opReturnText = (spk) => { const m = /^6a(?:4c)?([0-9a-f]{2})([0-9a-f]*)$/i.exec(spk); if (!m) return null; const b = unhex(m[2]); const t = new TextDecoder().decode(b); return /^[\x20-\x7e]+$/.test(t) ? t : null; };
+
+// `opts` lets a test point at local checkouts: { cdn, sidestr, loadJson(url) }
+export async function loadEngine(chain, opts = {}) {
+  const cdn = opts.cdn ?? CDN, side = opts.sidestr ?? SIDESTR, j = opts.loadJson ?? (async (u) => (await fetch(u)).json());
+  const [{ createKernel }, { resolveParent }, { sidestrOverlay }, hash, nostr, { rulesFor }, secp] = await Promise.all([import(`${cdn}/codec/kernel.js`), import(`${side}/parents.mjs`), import(`${side}/overlay.mjs`), import(`${cdn}/codec/hash.js`), import(`${cdn}/codec/nostr.js`), import(`${side}/overlays/index.mjs`), import(`${cdn}/codec/secp256k1.js`)]);
+  const jj = (p) => j(`${cdn}/${p}`); const rules = rulesFor(chain); // SPEC 12: the rules the document names, or a refusal
+  const parent = resolveParent(chain.parent); const overlays = [sidestrOverlay(chain, { hash, secp }), ...rules.overlays]; // SPEC 3.2: the header format follows the parent
+  if (parent.family === 'blake2b') { const { knotsBlake2b } = await import(`${cdn}/codec/overlays/knots-blake2b.js`); overlays.unshift(knotsBlake2b(await jj('schema/overlays/knots-blake2b.jsonld'))); }
+  const k = createKernel({ core: await jj('schema/core.jsonld'), proof: await jj('schema/proof.jsonld'), script: await jj('schema/script.jsonld'), chain: await jj('schema/chain.jsonld'), validate: await jj('schema/validate.jsonld'),
+    network: chain.id, overlays }); // secp: a federated document's challenge is checked against its signers
+  if (rules.evm) await rules.evm.init(); // the evm rule fetches ethereumjs (from jsdelivr in a page) only on a chain that names it
+  return { k, hash, nostr, rules, parent };
+}
+
+// the chain as a model: blocks in order, each validated, plus indexes for the page
+// bumped when a saved state could be wrong: 2 after the concurrent-refresh fix (a v1 cache may hold duplicated history)
+export const CACHE_VERSION = 2;
+export class Explorer {
+  // opts.store: { get(key), set(key, value), delete(key) } (strings; sync or async), e.g. localStorage. With a store the
+  // validated state (coins, per-script history, the last 11 headers) is saved at the tip and a later open resumes from it,
+  // validating only the blocks since. The cache is dropped when the mirror's block at that height has another hash (a chain
+  // reset) or the chain names rules (their state is not cached yet). `fromCache` is the height resumed from, else null.
+  constructor(mirror, opts = {}) { this.opts = opts; this.mirror = mirror.replace(/\/$/, ''); this.blocks = []; this.txs = new Map(); this.utxo = new Map(); this.byScript = new Map(); this.headers = []; this.store = opts.store ?? null; this.fromCache = null; }
+  get cacheKey() { return `sidestr:state:${this.chain?.id}`; }
+  get cacheable() { return !!(this.store && this.chain && !(this.rules?.overlays?.length)); }
+  async clearCache() { if (this.store && this.chain) await this.store.delete?.(this.cacheKey); }
+  async #restore(index) {
+    let c; try { const raw = await this.store.get(this.cacheKey); c = raw ? JSON.parse(raw) : null; } catch { c = null; }
+    if (!c || c.v !== CACHE_VERSION || c.chain !== this.chain.id) { if (c) await this.clearCache(); return; } // an older cache format is dropped, not read
+    const e = index.blocks[c.height]; if (!e || e.hash !== c.hash) { await this.clearCache(); return; } // the chain is not the one the cache saw
+    this.utxo = new Map(c.utxo); this.byScript = new Map(c.byScript); for (const [h, hex] of c.headers) this.headers[h] = this.k.codec.decode('BlockHeader', hex);
+    this.blocks.length = c.height + 1; this.blocks[c.height] = { height: c.height, hash: c.hash, time: c.time, cached: true, verdict: { ok: true, cached: true } }; this.fromCache = c.height;
+  }
+  async #save() {
+    const tip = this.tip(); if (!tip) return; const headers = []; for (let h = Math.max(0, tip.height - 10); h <= tip.height; h++) if (this.headers[h]) headers.push([h, this.k.codec.encodeHex('BlockHeader', this.headers[h])]);
+    try { await this.store.set(this.cacheKey, JSON.stringify({ v: CACHE_VERSION, chain: this.chain.id, height: tip.height, hash: tip.hash, time: tip.time, utxo: [...this.utxo], byScript: [...this.byScript], headers })); } catch {}
+  }
+  async open() {
+    this.chain = await (await fetch(`${this.mirror}/chain.json`, { cache: 'no-store' })).json();
+    const { k, hash, nostr, rules, parent } = await loadEngine(this.chain, this.opts); this.k = k; this.hash = hash; this.nostr = nostr; this.rules = rules; this.parent = parent;
+    return this.refresh();
+  }
+  // one refresh at a time: a second caller waits for the first and gets its result, so a block is never applied twice
+  refresh() { if (!this._refreshing) this._refreshing = this.#refresh().finally(() => { this._refreshing = null; }); return this._refreshing; }
+  async #refresh() {
+    const index = await (await fetch(`${this.mirror}/blocks.json`, { cache: 'no-store' })).json();
+    if (this.blocks.length === 0 && this.cacheable) await this.#restore(index);
+    const pending = index.blocks.filter((e) => e.height > this.blocks.length - 1);
+    const fetched = new Map();
+    for (let i = 0; i < pending.length; i += 16) await Promise.all(pending.slice(i, i + 16).map(async (e) => {
+      const r = await fetch(`${this.mirror}/blocks.dat`, { headers: { range: `bytes=${e.offset + 8}-${e.offset + 8 + e.size - 1}` }, cache: 'no-store' });
+      fetched.set(e.height, new Uint8Array(await r.arrayBuffer()));
+    }));
+    for (const e of pending) await this.#apply(e, fetched.get(e.height));
+    this.index = index; if (pending.length && this.cacheable) await this.#save(); return this;
+  }
+  async #apply(entry, bytes) {
+    const { k } = this; const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+    const block = k.codec.decode('Block', hex); const h = entry.height; const hash = k.codec.blockHash(block.header);
+    let verdict = { ok: true, failed: [], skipped: [] };
+    // the evm rule executes before the kernel's checks and leaves the verdict the sync rule reads (proposals/evm.md)
+    if (this.rules?.evm) { if (h === 0) { this.rules.evm.roots.set(0, this.rules.evm.roots.get(-1)); this.rules.evm.blocks.set(0, { hashes: [], root: '0x' + this.rules.evm.roots.get(-1) }); } else { const v = await this.rules.evm.prepare(block, h, k.codec); if (!v.ok) verdict.evm = v.error; } }
+    if (h > 0) {
+      const [hv] = k.headers.validateChain([block.header], { startHeight: h, prevContext: this.headers.slice(Math.max(0, h - 11), h).filter(Boolean), now: Math.floor(Date.now() / 1000) + 7200 });
+      const s = k.blocks.validateBlockStructure(block); const c = k.blocks.validateBlockContext(block, { height: h, utxo: this.utxo, mtp: k.headers.medianTimePast(this.headers.slice(Math.max(0, h - 11), h)) });
+      for (const r of [...hv.results, ...s.results, ...c.results]) { if (r.ok === false) verdict.failed.push(r.rule); if (r.ok === null) verdict.skipped.push(r.rule); }
+      verdict.ok = verdict.failed.length === 0 && hash === entry.hash && block.header.prevBlockHash === this.blocks[h - 1].hash;
+    }
+    // fees and the spend index, from the coins as they are before this block
+    let fees = 0; const spends = [];
+    block.transactions.forEach((tx, i) => { if (i === 0) return; let inSum = 0; for (const inp of tx.inputs) { const key = `${inp.prevout.txid}:${inp.prevout.vout}`; const coin = this.utxo.get(key); if (coin) { inSum += coin.output.value; spends.push([key, coin, k.codec.txid(tx)]); } } fees += inSum - tx.outputs.reduce((s, o) => s + o.value, 0); });
+    k.blocks.applyBlock(this.utxo, block, h);
+    const txids = block.transactions.map((tx) => k.codec.txid(tx));
+    const rec = { height: h, hash, time: block.header.time, size: bytes.length, txs: txids.length, fees, verdict, block, txids, coinbaseValue: block.transactions[0].outputs.reduce((s, o) => s + o.value, 0) };
+    this.blocks[h] = rec; this.headers[h] = block.header;
+    block.transactions.forEach((tx, i) => { const txid = txids[i]; this.txs.set(txid, { tx, txid, height: h, coinbase: i === 0, fee: i === 0 ? null : (() => { let s = 0; for (const inp of tx.inputs) { const c = spends.find((x) => x[2] === txid && x[0] === `${inp.prevout.txid}:${inp.prevout.vout}`); if (c) s += c[1].output.value; } return s - tx.outputs.reduce((a, o) => a + o.value, 0); })() });
+      tx.outputs.forEach((o, vout) => { if (o.scriptPubKey.startsWith('6a')) return; const a = this.byScript.get(o.scriptPubKey) ?? { received: 0, spent: 0, outputs: [] }; a.received += o.value; a.outputs.push({ txid, vout, value: o.value, height: h }); this.byScript.set(o.scriptPubKey, a); }); });
+    for (const [key, coin, txid] of spends) { const a = this.byScript.get(coin.output.scriptPubKey); if (a) { a.spent += coin.output.value; a.spends = a.spends ?? []; a.spends.push({ key, txid, value: coin.output.value, height: h }); } }
+  }
+  tip() { return this.blocks[this.blocks.length - 1]; }
+  headerHex(h) { return this.headers[h] ? this.k.codec.encodeHex('BlockHeader', this.headers[h]) : null; }
+  supply() { let s = 0; for (const c of this.utxo.values()) s += c.output.value; return s; }
+  balance(spk) { let s = 0; for (const c of this.utxo.values()) if (c.output.scriptPubKey === spk) s += c.output.value; return s; }
+  address(spk) { return scriptToAddress(spk, this.chain.addressPrefix) ?? spk; }
+  block(ref) { return /^\d+$/.test(ref) ? this.blocks[Number(ref)] : this.blocks.find((b) => b.hash === ref); }
+}
diff --git a/vendor/sidestr/schema/LICENSE b/vendor/sidestr/schema/LICENSE
new file mode 100644
index 0000000..be3f7b2
--- /dev/null
+++ b/vendor/sidestr/schema/LICENSE
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
diff --git a/vendor/sidestr/schema/codec/blocks.js b/vendor/sidestr/schema/codec/blocks.js
new file mode 100644
index 0000000..3f2d6b4
--- /dev/null
+++ b/vendor/sidestr/schema/codec/blocks.js
@@ -0,0 +1,383 @@
+// Schema-driven block engine: the `transaction`, `block`, and `block-context`
+// phases from schema/validate.jsonld, plus UTXO window evolution — a pruned
+// node in miniature.
+//
+// Outcomes follow the established convention: true (pass), false (fail with
+// the rule's errorCode), null (skipped — context unavailable or, for rules
+// with an activationParam, height below the deployment's activation).
+// Skipping is the honest pruned-node tradeoff: an input spending a coin
+// created before the window can only be checked if its transaction is
+// supplied via `external`.
+//
+// Out of scope, deliberately: witness/signature script execution.
+
+import { dsha256, bytesToHex, hexToBytes } from './hash.js';
+import { ScriptEngine } from './script.js';
+import { ScriptInterpreter } from './interpreter.js';
+
+const NULL_TXID = '0'.repeat(64);
+const keyOf = (prevout) => `${prevout.txid}:${prevout.vout}`;
+
+export const isCoinbase = (tx) =>
+  tx.inputs.length === 1
+  && tx.inputs[0].prevout.txid === NULL_TXID
+  && tx.inputs[0].prevout.vout === 0xffffffff;
+
+export class BlockEngine {
+  constructor(codec, params, ruleSets, scriptEngine = null, interpreter = null) {
+    this.codec = codec;
+    this.params = params;
+    this.ruleSets = ruleSets; // {transaction, block, blockContext}
+    this.scriptEngine = scriptEngine; // needed by the sigop rule
+    this.interpreter = interpreter;   // needed by the scripts rule
+
+    const sumOut = (tx) => tx.outputs.reduce((s, o) => s + o.value, 0);
+
+    this.txChecks = {
+      'btc:rule-tx-inputs-nonempty': ({ tx }) => tx.inputs.length > 0,
+      'btc:rule-tx-outputs-nonempty': ({ tx }) => tx.outputs.length > 0,
+      'btc:rule-tx-size': ({ tx }) => this.codec.txWeight(tx) <= params.maxBlockWeight,
+      'btc:rule-tx-output-values': ({ tx }) =>
+        tx.outputs.every((o) => o.value >= 0 && o.value <= params.maxMoney)
+        && sumOut(tx) <= params.maxMoney,
+      'btc:rule-tx-inputs-unique': ({ tx }) =>
+        new Set(tx.inputs.map((i) => keyOf(i.prevout))).size === tx.inputs.length,
+      'btc:rule-tx-prevouts': ({ tx, coinbase }) => coinbase
+        ? isCoinbase(tx)
+        : tx.inputs.every((i) => i.prevout.txid !== NULL_TXID),
+      'btc:rule-tx-coinbase-script': ({ tx, coinbase }) => {
+        if (!coinbase) return null;
+        const len = tx.inputs[0].scriptSig.length / 2;
+        return len >= 2 && len <= 100;
+      },
+    };
+
+    this.blockChecks = {
+      'btc:rule-block-coinbase-first': ({ block }) =>
+        block.transactions.length > 0 && isCoinbase(block.transactions[0]),
+      'btc:rule-block-coinbase-single': ({ block }) =>
+        block.transactions.slice(1).every((tx) => !isCoinbase(tx)),
+      'btc:rule-block-merkle-root': ({ block, txids }) =>
+        this.codec.merkleRoot(txids) === block.header.merkleRoot,
+      'btc:rule-block-tx-duplicates': ({ txids }) => new Set(txids).size === txids.length,
+      'btc:rule-block-weight': ({ block }) => this.blockWeight(block) <= params.maxBlockWeight,
+      'btc:rule-block-sigops': ({ block }) => {
+        if (!this.scriptEngine) return null;
+        const sigops = block.transactions.reduce((s, tx) =>
+          s + tx.inputs.reduce((a, i) => a + this.legacySigOps(i.scriptSig), 0)
+            + tx.outputs.reduce((a, o) => a + this.legacySigOps(o.scriptPubKey), 0), 0);
+        return 4 * sigops <= params.maxBlockSigopsCost;
+      },
+      'btc:rule-block-transactions': ({ block }) =>
+        block.transactions.every((tx, i) => this.validateTransaction(tx, i === 0).ok),
+    };
+
+    this.contextChecks = {
+      'btc:rule-blockctx-bip34-height': ({ block, height }) =>
+        this.bip34Height(block.transactions[0]) === height,
+      // definite violations (double spend, nonexistent vout) fail even in a
+      // pruned window; out-of-window coins whose unspent-ness can't be
+      // verified make the rule skip — that is the pruning tradeoff
+      'btc:rule-blockctx-inputs-available': ({ spending }) =>
+        spending.missing.length > 0 ? false
+          : spending.valueUnresolved > 0 || spending.unverified > 0 ? null : true,
+      'btc:rule-blockctx-fees': ({ spending }) =>
+        spending.deficits.length > 0 ? false
+          : spending.valueUnresolved > 0 ? null : true,
+      // lockTime 0 and the all-final-sequences escape need no context; a
+      // time-based lockTime needs median-time-past, which a caller may lack
+      'btc:rule-blockctx-finality': ({ block, height, mtp }) => {
+        let unknown = false;
+        for (const tx of block.transactions) {
+          if (tx.lockTime === 0) continue;
+          if (tx.inputs.every((i) => i.sequence === 0xffffffff)) continue;
+          if (tx.lockTime < 500000000) {
+            if (tx.lockTime >= height) return false;
+          } else if (mtp == null) unknown = true;
+          else if (tx.lockTime >= mtp) return false;
+        }
+        return unknown ? null : true;
+      },
+      'btc:rule-blockctx-coinbase-maturity': ({ spending }) =>
+        spending.premature.length > 0 ? false
+          : spending.maturityUnknown > 0 ? null : true,
+      // BIP68/112 relative lock-time: definite violations fail; height-based
+      // locks on out-of-window coins and all time-based locks skip honestly
+      'btc:rule-blockctx-sequence-locks': ({ spending }) =>
+        spending.seqlockViolations.length > 0 ? false
+          : spending.seqlockUnknown > 0 ? null : true,
+      // real script + signature verification of every resolvable input;
+      // pruned-away prevouts and taproot inputs skip honestly
+      'btc:rule-blockctx-scripts': ({ spending, height }) => {
+        if (!this.interpreter) return null;
+        // Knots' unified opt-in sighash applies from the height the chain's
+        // unifiedSighashParam names (the BLAKE2b fork height); before it, and
+        // on chains without the parameter, an opted-in signature reads legacy.
+        const usp = this.params.unifiedSighashParam;
+        const unifiedSighash = !!usp && height != null && height >= this.params[usp];
+        let unsupported = 0;
+        const byTx = new Map();
+        for (const ri of spending.resolvedInputs) {
+          if (!byTx.has(ri.tx)) byTx.set(ri.tx, new Map());
+          byTx.get(ri.tx).set(ri.inIndex, ri.prevout);
+        }
+        for (const [tx, resolved] of byTx) {
+          // taproot sighash commits to every input's prevout, so the full
+          // array is only available when the whole tx resolved
+          const allPrevouts = resolved.size === tx.inputs.length
+            ? tx.inputs.map((_, i) => resolved.get(i)) : null;
+          for (const [inIndex, prevout] of resolved) {
+            const v = this.interpreter.verifyInput(tx, inIndex, prevout, allPrevouts, null, { unifiedSighash });
+            if (v.ok === false) return false;
+            if (v.ok === null) unsupported++;
+          }
+        }
+        return (spending.valueUnresolved > 0 || unsupported > 0) ? null : true;
+      },
+      'btc:rule-blockctx-coinbase-amount': ({ block, height, spending }) =>
+        spending.valueUnresolved > 0 ? null
+          : block.transactions[0].outputs.reduce((s, o) => s + o.value, 0)
+            <= this.subsidy(height) + spending.fees,
+      'btc:rule-blockctx-witness-commitment': ({ block }) => {
+        const hasWitness = block.transactions.some((tx) => tx.witness?.some((s) => s.length > 0));
+        if (!hasWitness) return null;
+        const commitment = this.witnessCommitment(block.transactions[0]);
+        if (!commitment) return false;
+        return commitment === this.witnessCommitmentHash(block);
+      },
+    };
+  }
+
+  static fromSchemas(codec, chainSchema, validateSchema, scriptSchema = null, network = 'btc:mainnet') {
+    const params = chainSchema['@graph'].find((n) => n['@id'] === network);
+    if (!params) throw new Error(`unknown network: ${network}`);
+    codec.setChainParams?.(params); // variants + PoW hash follow the chain
+    const set = (phase) => validateSchema['@graph'].find((n) => n['@type'] === 'RuleSet' && n.phase === phase);
+    const scriptEngine = scriptSchema
+      ? ScriptEngine.fromSchemas(scriptSchema, chainSchema, network)
+      : null;
+    const limits = scriptSchema?.['@graph'].find((n) => n['@id'] === 'btc:scriptLimits');
+    const interpreter = scriptEngine
+      ? new ScriptInterpreter(codec, scriptEngine, limits)
+      : null;
+    return new BlockEngine(codec, params, {
+      transaction: set('transaction'),
+      block: set('block'),
+      blockContext: set('block-context'),
+    }, scriptEngine, interpreter);
+  }
+
+  // Legacy signature-operation count (Bitcoin Core's GetSigOpCount with
+  // fAccurate=false): CHECKSIG(VERIFY) counts 1, CHECKMULTISIG(VERIFY) 20.
+  legacySigOps(scriptHex) {
+    let n = 0;
+    for (const op of this.scriptEngine.parse(scriptHex)) {
+      if (op.name === 'OP_CHECKSIG' || op.name === 'OP_CHECKSIGVERIFY') n += 1;
+      else if (op.name === 'OP_CHECKMULTISIG' || op.name === 'OP_CHECKMULTISIGVERIFY') n += 20;
+    }
+    return n;
+  }
+
+  // ---- consensus arithmetic ----
+
+  subsidy(height) {
+    const halvings = Math.floor(height / this.params.halvingInterval);
+    return halvings >= 64 ? 0 : Math.floor(this.params.initialSubsidy / 2 ** halvings);
+  }
+
+  blockWeight(block) {
+    const total = this.codec.encode('Block', block).length;
+    const legacy = block.transactions.reduce(
+      (s, tx) => s + this.codec.encode('Transaction', tx, { legacy: true }).length,
+      this.codec.encode('BlockHeader', block.header).length + this.#varintSize(block.transactions.length));
+    return 3 * legacy + total;
+  }
+
+  #varintSize(n) { return n < 0xfd ? 1 : n <= 0xffff ? 3 : n <= 0xffffffff ? 5 : 9; }
+
+  // BIP 34: the height encoded as a script-number push at the start of the
+  // coinbase scriptSig. Returns null if unparseable.
+  bip34Height(coinbaseTx) {
+    const script = hexToBytes(coinbaseTx.inputs[0].scriptSig);
+    const op = script[0];
+    if (op === undefined) return null;
+    // Heights 1-16 use the minimal push OP_1..OP_16 (0x51..0x60), a single
+    // opcode byte rather than a length-prefixed push. Core's `CScript() << height`
+    // encodes them this way, so BIP34 requires exactly this on those blocks.
+    if (op >= 0x51 && op <= 0x60) return op - 0x50;
+    // Otherwise a length-prefixed little-endian scriptnum push (1..5 data bytes).
+    const len = op;
+    if (len < 1 || len > 5 || script.length < 1 + len) return null;
+    let n = 0;
+    for (let i = len; i >= 1; i--) n = n * 256 + script[i];
+    return n;
+  }
+
+  // The witness commitment carried in a coinbase output: the last output
+  // whose scriptPubKey starts OP_RETURN 0x24 0xaa21a9ed; returns the 32-byte
+  // commitment hex, or null.
+  witnessCommitment(coinbaseTx) {
+    for (let i = coinbaseTx.outputs.length - 1; i >= 0; i--) {
+      const spk = coinbaseTx.outputs[i].scriptPubKey;
+      if (spk.startsWith('6a24aa21a9ed') && spk.length >= 12 + 64) {
+        return spk.slice(12, 12 + 64);
+      }
+    }
+    return null;
+  }
+
+  // dsha256(witness merkle root || witness reserved value). The coinbase
+  // wtxid is defined as all zeros; the reserved value comes from the
+  // coinbase's own witness stack (usually 32 zero bytes).
+  witnessCommitmentHash(block) {
+    const wtxids = block.transactions.map((tx, i) =>
+      i === 0 ? NULL_TXID : this.codec.wtxid(tx));
+    const root = hexToBytes(this.codec.merkleRoot(wtxids)).reverse();
+    const reserved = hexToBytes(block.transactions[0].witness?.[0]?.[0] ?? '00'.repeat(32));
+    const cat = new Uint8Array(64);
+    cat.set(root); cat.set(reserved, 32);
+    return bytesToHex(dsha256(cat));
+  }
+
+  // ---- ruleset execution ----
+
+  // Overlay rules bind their checks here, by phase: {transaction, block, blockContext}.
+  registerChecks({ transaction = {}, block = {}, blockContext = {} } = {}) {
+    Object.assign(this.txChecks, transaction);
+    Object.assign(this.blockChecks, block);
+    Object.assign(this.contextChecks, blockContext);
+  }
+
+  #run(ruleSet, checks, ctx) {
+    const results = ruleSet.rules.map((rule) => {
+      let outcome;
+      const check = checks[rule['@id']];
+      if (!check) throw new Error(`no check registered for ${rule['@id']}`);
+      if (rule.activationParam && ctx.height != null
+          && ctx.height < this.params[rule.activationParam]) {
+        outcome = null; // not yet activated at this height
+      } else {
+        outcome = check(ctx);
+      }
+      return {
+        rule: rule['@id'],
+        label: rule.label,
+        ok: outcome,
+        error: outcome === false ? rule.errorCode : null,
+      };
+    });
+    return { ok: results.every((r) => r.ok !== false), results };
+  }
+
+  validateTransaction(tx, coinbase = false) {
+    return this.#run(this.ruleSets.transaction, this.txChecks, { tx, coinbase });
+  }
+
+  validateBlockStructure(block) {
+    const txids = block.transactions.map((tx) => this.codec.txid(tx));
+    return this.#run(this.ruleSets.block, this.blockChecks, { block, txids });
+  }
+
+  // Walk the block's transactions in order, resolving each input against
+  // (1) coins created earlier in the window or block — availability proven,
+  // (2) externally supplied prevout transactions — value known, unspent-ness
+  //     unverifiable in a pruned window ("unverified"),
+  // (3) nothing — "valueUnresolved".
+  // Definite violations land in `missing` (double spend within the window
+  // or block, or a vout that does not exist on a known transaction).
+  // Does not mutate utxo.
+  #resolveSpending(block, utxo, external, height) {
+    const spentHere = new Set();
+    const createdHere = new Map();
+    let fees = 0, valueUnresolved = 0, unverified = 0, maturityUnknown = 0, seqlockUnknown = 0;
+    const missing = [], deficits = [], premature = [], resolvedInputs = [], seqlockViolations = [];
+    // BIP68 nSequence fields
+    const SEQ_DISABLE = 0x80000000, SEQ_TYPE = 0x00400000, SEQ_MASK = 0x0000ffff;
+
+    block.transactions.forEach((tx, i) => {
+      const txid = this.codec.txid(tx);
+      if (i > 0) {
+        let inSum = 0, valuesOk = true;
+        tx.inputs.forEach((inp, inIndex) => {
+          const key = keyOf(inp.prevout);
+          if (spentHere.has(key)) {
+            missing.push(key); valuesOk = false;
+          } else {
+            let coinHeight = null;
+            const coin = createdHere.get(key) ?? utxo.get(key);
+            if (coin) {
+              inSum += coin.output.value;
+              resolvedInputs.push({ tx, inIndex, prevout: coin.output });
+              coinHeight = coin.height;
+              if (coin.coinbase && height - coin.height < this.params.coinbaseMaturity) {
+                premature.push(key);
+              }
+            } else {
+              const ext = external.get(inp.prevout.txid);
+              const out = ext?.outputs[inp.prevout.vout];
+              if (out) {
+                inSum += out.value; unverified++;
+                resolvedInputs.push({ tx, inIndex, prevout: out });
+                // out-of-window coin: creation height (and coinbase-ness) unknown
+                if (isCoinbase(ext)) maturityUnknown++;
+              } else if (ext) { missing.push(key); valuesOk = false; }
+              else { valueUnresolved++; valuesOk = false; }
+            }
+            // BIP68 relative lock-time: only for v2 txs with the disable flag clear
+            if (tx.version >= 2 && (inp.sequence & SEQ_DISABLE) === 0) {
+              const value = inp.sequence & SEQ_MASK;
+              if (value > 0) {
+                if (inp.sequence & SEQ_TYPE) seqlockUnknown++;   // time-based: no per-coin MTP in this context
+                else if (coinHeight == null) seqlockUnknown++;   // height-based but coin height unknown
+                else if (height < coinHeight + value) seqlockViolations.push(key);
+              }
+            }
+          }
+          spentHere.add(key);
+        });
+        const outSum = tx.outputs.reduce((s, o) => s + o.value, 0);
+        if (valuesOk) {
+          if (inSum < outSum) deficits.push(txid);
+          else fees += inSum - outSum;
+        }
+      }
+      tx.outputs.forEach((output, vout) => {
+        if (!output.scriptPubKey.startsWith('6a')) {
+          createdHere.set(`${txid}:${vout}`, { output, coinbase: i === 0, height });
+        }
+      });
+    });
+    return { fees, missing, deficits, premature, valueUnresolved, unverified, maturityUnknown,
+      seqlockViolations, seqlockUnknown, resolvedInputs };
+  }
+
+  validateBlockContext(block, { height, utxo = new Map(), external = new Map(), mtp = null }) {
+    const spending = this.#resolveSpending(block, utxo, external, height);
+    const verdict = this.#run(this.ruleSets.blockContext, this.contextChecks,
+      { block, height, spending, mtp });
+    return { ...verdict, spending };
+  }
+
+  // Apply a fully-validated block to the UTXO window map (mutates).
+  // Returns {created, spent} counts.
+  applyBlock(utxo, block, height) {
+    let created = 0, spent = 0;
+    block.transactions.forEach((tx, i) => {
+      if (i > 0) {
+        for (const inp of tx.inputs) {
+          if (utxo.delete(keyOf(inp.prevout))) spent++;
+        }
+      }
+      const txid = this.codec.txid(tx);
+      tx.outputs.forEach((output, vout) => {
+        if (!output.scriptPubKey.startsWith('6a')) { // unspendable: not a coin
+          utxo.set(`${txid}:${vout}`, {
+            outpoint: { txid, vout }, output, height, coinbase: i === 0,
+          });
+          created++;
+        }
+      });
+    });
+    return { created, spent };
+  }
+}
diff --git a/vendor/sidestr/schema/codec/codec.js b/vendor/sidestr/schema/codec/codec.js
new file mode 100644
index 0000000..3c5bf77
--- /dev/null
+++ b/vendor/sidestr/schema/codec/codec.js
@@ -0,0 +1,364 @@
+// Schema-driven Bitcoin codec.
+//
+// The codec contains no per-type serialization logic: it walks the ordered
+// `fields` lists in the JSON-LD schema and interprets each field's wireType.
+// Two genuine special cases of the protocol are handled by named wire rules
+// rather than hardcoded types:
+//   - presentIf "segwit": on decode, segwit serialization is detected by the
+//     0x00 marker byte (a legacy transaction cannot have zero inputs); on
+//     encode, by the presence of a non-empty `witness` array.
+//   - wireType "witness": the witness vector carries no count prefix; its
+//     length equals the number of inputs already decoded.
+//
+// Hashes (hash256) and scripts (varbytes) are represented as hex strings in
+// instances; hash256 values use display order (byte-reversed), as in every
+// explorer and RPC interface. Satoshi amounts (i64le) are plain numbers —
+// the maximum supply (2.1e15 sats) is well inside Number.MAX_SAFE_INTEGER.
+
+import { dsha256, bytesToHex, hexToBytes, reverseHex } from './hash.js';
+
+const shortId = (id) => id.replace(/^btc:/, '').replace(/^.*\//, '');
+
+class Reader {
+  constructor(bytes) {
+    this.bytes = bytes;
+    this.dv = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    this.pos = 0;
+  }
+  peek() { return this.bytes[this.pos]; }
+  take(n) {
+    if (this.pos + n > this.bytes.length) throw new Error('unexpected end of data');
+    const out = this.bytes.subarray(this.pos, this.pos + n);
+    this.pos += n;
+    return out;
+  }
+  u8() { return this.take(1)[0]; }
+  u16le() { const v = this.dv.getUint16(this.pos, true); this.pos += 2; return v; }
+  u16be() { const v = this.dv.getUint16(this.pos, false); this.pos += 2; return v; }
+  u64le() {
+    const v = this.dv.getBigUint64(this.pos, true); this.pos += 8;
+    return v <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(v) : v.toString();
+  }
+  u32le() { const v = this.dv.getUint32(this.pos, true); this.pos += 4; return v; }
+  i32le() { const v = this.dv.getInt32(this.pos, true); this.pos += 4; return v; }
+  i64le() { const v = this.dv.getBigInt64(this.pos, true); this.pos += 8; return Number(v); }
+  varint() {
+    const first = this.u8();
+    if (first < 0xfd) return first;
+    if (first === 0xfd) return this.u16le();
+    if (first === 0xfe) return this.u32le();
+    const v = this.dv.getBigUint64(this.pos, true); this.pos += 8;
+    return Number(v);
+  }
+}
+
+class Writer {
+  constructor() { this.chunks = []; }
+  bytes(b) { this.chunks.push(b); }
+  u8(v) { this.bytes(Uint8Array.of(v)); }
+  u16le(v) { const b = new Uint8Array(2); new DataView(b.buffer).setUint16(0, v, true); this.bytes(b); }
+  u16be(v) { const b = new Uint8Array(2); new DataView(b.buffer).setUint16(0, v, false); this.bytes(b); }
+  u64le(v) { const b = new Uint8Array(8); new DataView(b.buffer).setBigUint64(0, BigInt(v), true); this.bytes(b); }
+  u32le(v) { const b = new Uint8Array(4); new DataView(b.buffer).setUint32(0, v, true); this.bytes(b); }
+  i32le(v) { const b = new Uint8Array(4); new DataView(b.buffer).setInt32(0, v, true); this.bytes(b); }
+  i64le(v) { const b = new Uint8Array(8); new DataView(b.buffer).setBigInt64(0, BigInt(v), true); this.bytes(b); }
+  varint(v) {
+    if (v < 0xfd) this.u8(v);
+    else if (v <= 0xffff) { this.u8(0xfd); this.u16le(v); }
+    else if (v <= 0xffffffff) { this.u8(0xfe); this.u32le(v); }
+    else { this.u8(0xff); const b = new Uint8Array(8); new DataView(b.buffer).setBigUint64(0, BigInt(v), true); this.bytes(b); }
+  }
+  out() {
+    const len = this.chunks.reduce((n, c) => n + c.length, 0);
+    const all = new Uint8Array(len);
+    let p = 0;
+    for (const c of this.chunks) { all.set(c, p); p += c.length; }
+    return all;
+  }
+}
+
+export class Codec {
+  constructor(...schemas) {
+    this.types = new Map();
+    for (const schema of schemas) {
+      for (const node of schema['@graph'] ?? []) {
+        if (node['@type'] === 'ConsensusStruct') this.types.set(shortId(node['@id']), node);
+      }
+    }
+    // Chain binding (see setChainParams): a chain may declare struct variants
+    // and the proof-of-work hash. Unbound, the codec knows exactly the base
+    // structures and SHA256d — Bitcoin, byte for byte.
+    this.chain = null;
+    this.powHashes = new Map([['sha256d', (bytes) => reverseHex(dsha256(bytes))]]);
+    this.derived = new Map(); // struct @id -> fn(obj) returning derived fields (never serialized)
+  }
+
+  // Register derived fields for a structure: computed from its consensus
+  // fields after decode, ignored by encode. The base registers none.
+  registerDerived(structId, fn) { this.derived.set(structId, fn); }
+
+  // Bind the codec to a chain's NetworkParams node. Variants and the PoW hash
+  // are looked up from it; nothing else in the codec changes. Misconfiguration
+  // fails here, at bind time, not later inside decode or checkProofOfWork.
+  setChainParams(params) {
+    if (params) {
+      const name = params.powHash ?? 'sha256d';
+      if (!this.powHashes.has(name)) throw new Error(`${params['@id']}: proof-of-work hash not registered: ${name}`);
+      for (const [base, variants] of Object.entries(params.structVariants ?? {})) {
+        if (!this.types.has(shortId(base))) throw new Error(`${params['@id']}: structVariants for unknown ${base}`);
+        for (const v of variants) {
+          if (!v?.when?.field || !v.struct) throw new Error(`${params['@id']}: variant of ${base} needs when.field and struct`);
+          if (!this.types.has(shortId(v.struct))) throw new Error(`${params['@id']}: variant struct unknown: ${v.struct}`);
+          const hasBit = v.when.bit !== undefined, hasEq = v.when.equals !== undefined;
+          if (hasBit === hasEq) throw new Error(`${params['@id']}: variant of ${base} needs exactly one of when.bit / when.equals`);
+          if (hasBit && !(Number.isInteger(v.when.bit) && v.when.bit >= 0 && v.when.bit <= 31)) {
+            throw new Error(`${params['@id']}: when.bit must be an integer in 0..31`);
+          }
+        }
+      }
+    }
+    this.chain = params ?? null;
+  }
+
+  // Register a proof-of-work hash by the name a chain's `powHash` uses.
+  // fn(encodedHeaderBytes, headerObject) -> display-order hex.
+  registerPowHash(name, fn) { this.powHashes.set(name, fn); }
+
+  // A chain may declare, per base structure, variants selected by a predicate
+  // on a leading field: `structVariants: { "btc:BlockHeader": [ { when: {field, bit|equals}, struct } ] }`.
+  // The predicate is evaluated on the raw wire value when decoding and on the
+  // object's field when encoding, so both directions agree. The bit test is
+  // on the unsigned view, so `bit: 31` works for an i32le field too.
+  #variants(def) { return this.chain?.structVariants?.[def['@id']] ?? null; }
+  #predicate(when, value) {
+    if (value === undefined) return false;
+    if (when.bit !== undefined) return ((value >>> 0) & (2 ** when.bit)) !== 0;
+    return value === when.equals;
+  }
+  #pickVariant(def, r) {
+    const variants = this.#variants(def);
+    if (!variants) return null;
+    const start = r.pos;
+    const seen = Object.create(null); // field labels come from overlays: no prototype surprises
+    for (const f of def.fields) {
+      seen[f.label] = this.#readField(f, r, seen);
+      const hit = variants.find((v) => v.when.field === f.label && this.#predicate(v.when, seen[f.label]));
+      if (hit) { r.pos = start; return hit; }
+      if (variants.every((v) => Object.hasOwn(seen, v.when.field))) break;
+    }
+    r.pos = start;
+    return null;
+  }
+  #pickVariantForObject(def, obj) {
+    const variants = this.#variants(def);
+    return variants?.find((v) => this.#predicate(v.when, obj[v.when.field])) ?? null;
+  }
+
+  def(typeName) {
+    const def = this.types.get(typeName);
+    if (!def) throw new Error(`unknown type: ${typeName}`);
+    return def;
+  }
+
+  // ---- decode ----
+
+  decode(typeName, bytesOrHex, opts = {}) {
+    const bytes = typeof bytesOrHex === 'string' ? hexToBytes(bytesOrHex) : bytesOrHex;
+    const r = new Reader(bytes);
+    const obj = this.#readStruct(typeName, r, opts);
+    if (r.pos !== bytes.length) throw new Error(`${bytes.length - r.pos} trailing bytes after ${typeName}`);
+    return obj;
+  }
+
+  #readStruct(typeName, r, opts = {}) {
+    const def = this.def(typeName);
+    const variant = this.#pickVariant(def, r);
+    if (variant) return this.#readStruct(shortId(variant.struct), r, opts);
+    const obj = {};
+    let segwit = opts.legacy ? false : null;
+    for (const f of def.fields) {
+      if (f.presentIf === 'segwit') {
+        if (segwit === null) segwit = r.peek() === 0x00;
+        if (!segwit) continue;
+      }
+      if (f.optionalTrailing && r.pos >= r.bytes.length) continue;
+      const v = this.#readField(f, r, obj);
+      if (f.constValue !== undefined) {
+        if (v !== f.constValue) throw new Error(`${typeName}.${f.label}: expected ${f.constValue}, got ${v}`);
+        continue; // marker/flag are serialization artifacts, not data
+      }
+      obj[f.label] = v;
+    }
+    const derive = this.derived.get(def['@id']);
+    if (!derive) return obj;
+    const extra = derive(obj);
+    for (const k of Object.keys(extra)) {
+      if (def.fields.some((f) => f.label === k)) throw new Error(`${def['@id']}: derived field ${k} collides with a consensus field`);
+    }
+    return Object.assign(obj, extra);
+  }
+
+  #readField(f, r, obj) {
+    switch (f.wireType) {
+      case 'u8': return r.u8();
+      case 'u16le': return r.u16le();
+      case 'u16be': return r.u16be();
+      case 'u32le': return r.u32le();
+      case 'i32le': return r.i32le();
+      case 'i64le': return r.i64le();
+      case 'u64le': return r.u64le();
+      case 'varint': return r.varint();
+      case 'hash256': return reverseHex(r.take(32));
+      case 'varbytes': return bytesToHex(r.take(r.varint()));
+      case 'bytes': return bytesToHex(r.take(f.wireSize));
+      case 'ascii': {
+        const raw = r.take(f.wireSize);
+        let end = raw.length;
+        while (end > 0 && raw[end - 1] === 0) end--;
+        return new TextDecoder().decode(raw.subarray(0, end));
+      }
+      case 'varstr': return new TextDecoder().decode(r.take(r.varint()));
+      case 'struct': return this.#readStruct(shortId(f.structType), r);
+      case 'vec': {
+        const n = r.varint();
+        const out = [];
+        for (let i = 0; i < n; i++) out.push(this.#readItem(f.itemType, r));
+        return out;
+      }
+      case 'witness': {
+        const out = [];
+        for (let i = 0; i < obj.inputs.length; i++) {
+          const items = r.varint();
+          const stack = [];
+          for (let j = 0; j < items; j++) stack.push(bytesToHex(r.take(r.varint())));
+          out.push(stack);
+        }
+        return out;
+      }
+      default: throw new Error(`unknown wireType: ${f.wireType}`);
+    }
+  }
+
+  #readItem(itemType, r) {
+    if (itemType === 'varbytes') return bytesToHex(r.take(r.varint()));
+    if (itemType === 'hash256') return reverseHex(r.take(32));
+    return this.#readStruct(shortId(itemType), r);
+  }
+
+  // ---- encode ----
+
+  encode(typeName, obj, opts = {}) {
+    const w = new Writer();
+    this.#writeStruct(typeName, obj, w, opts);
+    return w.out();
+  }
+
+  encodeHex(typeName, obj, opts = {}) { return bytesToHex(this.encode(typeName, obj, opts)); }
+
+  #writeStruct(typeName, obj, w, opts = {}) {
+    const def = this.def(typeName);
+    const variant = this.#pickVariantForObject(def, obj);
+    if (variant) return this.#writeStruct(shortId(variant.struct), obj, w, opts);
+    const segwit = !opts.legacy && Array.isArray(obj.witness) && obj.witness.some((s) => s.length > 0);
+    for (const f of def.fields) {
+      if (f.presentIf === 'segwit' && !segwit) continue;
+      if (f.optionalTrailing && obj[f.label] === undefined) continue;
+      this.#writeField(f, f.constValue !== undefined ? f.constValue : obj[f.label], w);
+    }
+  }
+
+  #writeField(f, v, w) {
+    switch (f.wireType) {
+      case 'u8': return w.u8(v);
+      case 'u16le': return w.u16le(v);
+      case 'u16be': return w.u16be(v);
+      case 'u32le': return w.u32le(v);
+      case 'i32le': return w.i32le(v);
+      case 'i64le': return w.i64le(v);
+      case 'u64le': return w.u64le(v);
+      case 'varint': return w.varint(v);
+      case 'hash256': return w.bytes(hexToBytes(v).reverse());
+      case 'bytes': {
+        const b = hexToBytes(v);
+        if (b.length !== f.wireSize) throw new Error(`${f.label}: expected ${f.wireSize} bytes`);
+        return w.bytes(b);
+      }
+      case 'ascii': {
+        const b = new Uint8Array(f.wireSize);
+        b.set(new TextEncoder().encode(v).subarray(0, f.wireSize));
+        return w.bytes(b);
+      }
+      case 'varstr': {
+        const b = new TextEncoder().encode(v);
+        w.varint(b.length);
+        return w.bytes(b);
+      }
+      case 'varbytes': { const b = hexToBytes(v); w.varint(b.length); return w.bytes(b); }
+      case 'struct': return this.#writeStruct(shortId(f.structType), v, w);
+      case 'vec': {
+        w.varint(v.length);
+        for (const item of v) this.#writeItem(f.itemType, item, w);
+        return;
+      }
+      case 'witness': {
+        for (const stack of v) {
+          w.varint(stack.length);
+          for (const item of stack) { const b = hexToBytes(item); w.varint(b.length); w.bytes(b); }
+        }
+        return;
+      }
+      default: throw new Error(`unknown wireType: ${f.wireType}`);
+    }
+  }
+
+  #writeItem(itemType, v, w) {
+    if (itemType === 'varbytes') { const b = hexToBytes(v); w.varint(b.length); return w.bytes(b); }
+    if (itemType === 'hash256') return w.bytes(hexToBytes(v).reverse());
+    return this.#writeStruct(shortId(itemType), v, w);
+  }
+
+  // ---- derived fields (implementations of the schema's `derivation` formulas) ----
+
+  txid(tx) { return reverseHex(dsha256(this.encode('Transaction', tx, { legacy: true }))); }
+  wtxid(tx) { return reverseHex(dsha256(this.encode('Transaction', tx))); }
+  // The chain's proof-of-work hash over the encoded header (default SHA256d).
+  blockHash(header) {
+    const name = this.chain?.powHash ?? 'sha256d';
+    const fn = this.powHashes.get(name);
+    if (!fn) throw new Error(`proof-of-work hash not registered: ${name}`);
+    return fn(this.encode('BlockHeader', header), header);
+  }
+  txSize(tx) { return this.encode('Transaction', tx).length; }
+  txWeight(tx) {
+    return 3 * this.encode('Transaction', tx, { legacy: true }).length + this.encode('Transaction', tx).length;
+  }
+  txVsize(tx) { return Math.ceil(this.txWeight(tx) / 4); }
+
+  // Merkle root over display-order txids (BIP 98 duplicate-last for odd levels).
+  merkleRoot(txids) {
+    let level = txids.map((id) => hexToBytes(id).reverse());
+    while (level.length > 1) {
+      const next = [];
+      for (let i = 0; i < level.length; i += 2) {
+        const a = level[i];
+        const b = level[i + 1] ?? a;
+        const cat = new Uint8Array(64);
+        cat.set(a); cat.set(b, 32);
+        next.push(dsha256(cat));
+      }
+      level = next;
+    }
+    return reverseHex(level[0]);
+  }
+
+  // Expand compact nBits to a 256-bit target (as BigInt).
+  expandCompact(bits) {
+    const exponent = bits >>> 24;
+    const mantissa = BigInt(bits & 0x007fffff);
+    return exponent <= 3 ? mantissa >> (8n * BigInt(3 - exponent)) : mantissa << (8n * BigInt(exponent - 3));
+  }
+
+  checkProofOfWork(header) {
+    return BigInt('0x' + this.blockHash(header)) <= this.expandCompact(header.bits);
+  }
+}
diff --git a/vendor/sidestr/schema/codec/hash.js b/vendor/sidestr/schema/codec/hash.js
new file mode 100644
index 0000000..947f37b
--- /dev/null
+++ b/vendor/sidestr/schema/codec/hash.js
@@ -0,0 +1,295 @@
+// Pure-JS SHA-256 and Bitcoin hash helpers. Zero dependencies, works in
+// browsers and Node alike. Operates on Uint8Array.
+
+const K = new Uint32Array([
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+
+const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+
+// Optional SHA-256 backend (e.g. native node:crypto / WebCrypto / WASM) injected
+// by performance-sensitive callers; null = the pure-JS path below. Keeps this
+// module zero-dependency: the engine never imports an accelerated hasher, the
+// caller supplies one. Must return a 32-byte Uint8Array byte-identical to the
+// pure-JS implementation (callers gate on a consensus-equivalence proof).
+let __sha256Backend = null;
+export function setSha256Backend(fn) { __sha256Backend = fn; }
+
+export function sha256(data) {
+  if (__sha256Backend) return __sha256Backend(data);
+  const len = data.length;
+  const bitLen = len * 8;
+  const padded = new Uint8Array((((len + 8) >> 6) + 1) << 6);
+  padded.set(data);
+  padded[len] = 0x80;
+  const dv = new DataView(padded.buffer);
+  dv.setUint32(padded.length - 8, Math.floor(bitLen / 0x100000000));
+  dv.setUint32(padded.length - 4, bitLen >>> 0);
+
+  const h = new Uint32Array([
+    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+    0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+  ]);
+  const w = new Uint32Array(64);
+
+  for (let off = 0; off < padded.length; off += 64) {
+    for (let i = 0; i < 16; i++) w[i] = dv.getUint32(off + i * 4);
+    for (let i = 16; i < 64; i++) {
+      const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+      const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+      w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;
+    }
+    let [a, b, c, d, e, f, g, hh] = h;
+    for (let i = 0; i < 64; i++) {
+      const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+      const ch = (e & f) ^ (~e & g);
+      const t1 = (hh + S1 + ch + K[i] + w[i]) >>> 0;
+      const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+      const maj = (a & b) ^ (a & c) ^ (b & c);
+      const t2 = (S0 + maj) >>> 0;
+      hh = g; g = f; f = e; e = (d + t1) >>> 0;
+      d = c; c = b; b = a; a = (t1 + t2) >>> 0;
+    }
+    h[0] = (h[0] + a) >>> 0; h[1] = (h[1] + b) >>> 0;
+    h[2] = (h[2] + c) >>> 0; h[3] = (h[3] + d) >>> 0;
+    h[4] = (h[4] + e) >>> 0; h[5] = (h[5] + f) >>> 0;
+    h[6] = (h[6] + g) >>> 0; h[7] = (h[7] + hh) >>> 0;
+  }
+
+  const out = new Uint8Array(32);
+  const ov = new DataView(out.buffer);
+  for (let i = 0; i < 8; i++) ov.setUint32(i * 4, h[i]);
+  return out;
+}
+
+// Bitcoin's hash function: double SHA-256.
+export const dsha256 = (data) => sha256(sha256(data));
+
+export function bytesToHex(bytes) {
+  let s = '';
+  for (const b of bytes) s += b.toString(16).padStart(2, '0');
+  return s;
+}
+
+export function hexToBytes(hex) {
+  if (hex.length % 2) throw new Error('odd-length hex');
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.substr(i * 2, 2), 16);
+  return out;
+}
+
+// Internal byte order -> display order (and vice versa).
+export const reverseHex = (bytes) => bytesToHex(Uint8Array.from(bytes).reverse());
+
+// ---- SHA-1 (needed only for OP_SHA1) ----
+export function sha1(data) {
+  const len = data.length, bitLen = len * 8;
+  const padded = new Uint8Array((((len + 8) >> 6) + 1) << 6);
+  padded.set(data); padded[len] = 0x80;
+  const dv = new DataView(padded.buffer);
+  dv.setUint32(padded.length - 8, Math.floor(bitLen / 0x100000000));
+  dv.setUint32(padded.length - 4, bitLen >>> 0);
+  const h = new Uint32Array([0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0]);
+  const w = new Uint32Array(80);
+  const rol = (x, n) => (x << n) | (x >>> (32 - n));
+  for (let off = 0; off < padded.length; off += 64) {
+    for (let i = 0; i < 16; i++) w[i] = dv.getUint32(off + i * 4);
+    for (let i = 16; i < 80; i++) w[i] = rol(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);
+    let [a, b, c, d, e] = h;
+    for (let i = 0; i < 80; i++) {
+      const [f, k] = i < 20 ? [(b & c) | (~b & d), 0x5a827999]
+        : i < 40 ? [b ^ c ^ d, 0x6ed9eba1]
+        : i < 60 ? [(b & c) | (b & d) | (c & d), 0x8f1bbcdc]
+        : [b ^ c ^ d, 0xca62c1d6];
+      const t = (rol(a, 5) + f + e + k + w[i]) >>> 0;
+      e = d; d = c; c = rol(b, 30); b = a; a = t;
+    }
+    h[0] = (h[0] + a) >>> 0; h[1] = (h[1] + b) >>> 0; h[2] = (h[2] + c) >>> 0;
+    h[3] = (h[3] + d) >>> 0; h[4] = (h[4] + e) >>> 0;
+  }
+  const out = new Uint8Array(20);
+  const ov = new DataView(out.buffer);
+  for (let i = 0; i < 5; i++) ov.setUint32(i * 4, h[i]);
+  return out;
+}
+
+// ---- RIPEMD-160 (OP_RIPEMD160, and OP_HASH160 = ripemd160(sha256(x))) ----
+const RL = [
+  0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,
+  7,4,13,1,10,6,15,3,12,0,9,5,2,14,11,8,
+  3,10,14,4,9,15,8,1,2,7,0,6,13,11,5,12,
+  1,9,11,10,0,8,12,4,13,3,7,15,14,5,6,2,
+  4,0,5,9,7,12,2,10,14,1,3,8,11,6,15,13];
+const RR = [
+  5,14,7,0,9,2,11,4,13,6,15,8,1,10,3,12,
+  6,11,3,7,0,13,5,10,14,15,8,12,4,9,1,2,
+  15,5,1,3,7,14,6,9,11,8,12,2,10,0,4,13,
+  8,6,4,1,3,11,15,0,5,12,2,13,9,7,10,14,
+  12,15,10,4,1,5,8,7,6,2,13,14,0,3,9,11];
+const SL = [
+  11,14,15,12,5,8,7,9,11,13,14,15,6,7,9,8,
+  7,6,8,13,11,9,7,15,7,12,15,9,11,7,13,12,
+  11,13,6,7,14,9,13,15,14,8,13,6,5,12,7,5,
+  11,12,14,15,14,15,9,8,9,14,5,6,8,6,5,12,
+  9,15,5,11,6,8,13,12,5,12,13,14,11,8,5,6];
+const SR = [
+  8,9,9,11,13,15,15,5,7,7,8,11,14,14,12,6,
+  9,13,15,7,12,8,9,11,7,7,12,7,6,15,13,11,
+  9,7,15,11,8,6,6,14,12,13,5,14,13,13,7,5,
+  15,5,8,11,14,14,6,14,6,9,12,9,12,5,15,8,
+  8,5,12,9,12,5,14,6,8,13,6,5,15,13,11,11];
+
+export function ripemd160(data) {
+  const len = data.length, bitLen = len * 8;
+  const padded = new Uint8Array((((len + 8) >> 6) + 1) << 6);
+  padded.set(data); padded[len] = 0x80;
+  const dv = new DataView(padded.buffer);
+  dv.setUint32(padded.length - 8, bitLen >>> 0, true);          // little-endian length
+  dv.setUint32(padded.length - 4, Math.floor(bitLen / 0x100000000), true);
+  const h = new Uint32Array([0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0]);
+  const rol = (x, n) => ((x << n) | (x >>> (32 - n))) >>> 0;
+  const F = [
+    (x, y, z) => x ^ y ^ z,
+    (x, y, z) => (x & y) | (~x & z),
+    (x, y, z) => (x | ~y) ^ z,
+    (x, y, z) => (x & z) | (y & ~z),
+    (x, y, z) => x ^ (y | ~z),
+  ];
+  const KL = [0, 0x5a827999, 0x6ed9eba1, 0x8f1bbcdc, 0xa953fd4e];
+  const KR = [0x50a28be6, 0x5c4dd124, 0x6d703ef3, 0x7a6d76e9, 0];
+  for (let off = 0; off < padded.length; off += 64) {
+    const x = new Uint32Array(16);
+    for (let i = 0; i < 16; i++) x[i] = dv.getUint32(off + i * 4, true);
+    let [al, bl, cl, dl, el] = h;
+    let [ar, br, cr, dr, er] = h;
+    for (let j = 0; j < 80; j++) {
+      const round = j >> 4;
+      let t = (al + F[round](bl, cl, dl) + x[RL[j]] + KL[round]) >>> 0;
+      t = (rol(t, SL[j]) + el) >>> 0;
+      al = el; el = dl; dl = rol(cl, 10); cl = bl; bl = t;
+      t = (ar + F[4 - round](br, cr, dr) + x[RR[j]] + KR[round]) >>> 0;
+      t = (rol(t, SR[j]) + er) >>> 0;
+      ar = er; er = dr; dr = rol(cr, 10); cr = br; br = t;
+    }
+    const t = (h[1] + cl + dr) >>> 0;
+    h[1] = (h[2] + dl + er) >>> 0;
+    h[2] = (h[3] + el + ar) >>> 0;
+    h[3] = (h[4] + al + br) >>> 0;
+    h[4] = (h[0] + bl + cr) >>> 0;
+    h[0] = t;
+  }
+  const out = new Uint8Array(20);
+  const ov = new DataView(out.buffer);
+  for (let i = 0; i < 5; i++) ov.setUint32(i * 4, h[i], true);
+  return out;
+}
+
+export const hash160 = (data) => ripemd160(sha256(data));
+
+// BIP 340 tagged hash: sha256(sha256(tag) || sha256(tag) || msg).
+const tagMidstates = new Map();
+export function taggedHash(tag, ...chunks) {
+  let pre = tagMidstates.get(tag);
+  if (!pre) {
+    const th = sha256(new TextEncoder().encode(tag));
+    pre = new Uint8Array(64); pre.set(th); pre.set(th, 32);
+    tagMidstates.set(tag, pre);
+  }
+  const len = chunks.reduce((s, c) => s + c.length, 64);
+  const buf = new Uint8Array(len);
+  buf.set(pre);
+  let p = 64;
+  for (const c of chunks) { buf.set(c, p); p += c.length; }
+  return sha256(buf);
+}
+
+// ---- SHA-512 + HMAC-SHA512 (BIP 32 key derivation) ----
+// Round constants are the fractional parts of cube/square roots of the
+// first primes — generated here with integer Newton iterations rather
+// than hardcoding 80 magic numbers.
+const M64 = (1n << 64n) - 1n;
+
+function primes(n) {
+  const out = [];
+  for (let c = 2; out.length < n; c++) {
+    if (out.every((p) => c % p)) out.push(c);
+  }
+  return out;
+}
+function isqrt(n) {
+  let x = n, y = (x + 1n) >> 1n;
+  while (y < x) { x = y; y = (x + n / x) >> 1n; }
+  return x;
+}
+function icbrt(n) {
+  let x = 1n << BigInt(Math.ceil(n.toString(2).length / 3) + 1);
+  for (;;) {
+    const y = (2n * x + n / (x * x)) / 3n;
+    if (y >= x) return x;
+    x = y;
+  }
+}
+const P80 = primes(80).map(BigInt);
+const K512 = P80.map((p) => icbrt(p << 192n) & M64);
+const H512 = P80.slice(0, 8).map((p) => isqrt(p << 128n) & M64);
+
+const rotr64 = (x, n) => ((x >> n) | (x << (64n - n))) & M64;
+
+export function sha512(data) {
+  const len = data.length;
+  const padded = new Uint8Array((((len + 16) >> 7) + 1) << 7);
+  padded.set(data);
+  padded[len] = 0x80;
+  const dv = new DataView(padded.buffer);
+  const bitLen = BigInt(len) * 8n;
+  dv.setBigUint64(padded.length - 8, bitLen & M64);
+  dv.setBigUint64(padded.length - 16, bitLen >> 64n);
+
+  const h = [...H512];
+  const w = new Array(80);
+  for (let off = 0; off < padded.length; off += 128) {
+    for (let i = 0; i < 16; i++) w[i] = dv.getBigUint64(off + i * 8);
+    for (let i = 16; i < 80; i++) {
+      const s0 = rotr64(w[i - 15], 1n) ^ rotr64(w[i - 15], 8n) ^ (w[i - 15] >> 7n);
+      const s1 = rotr64(w[i - 2], 19n) ^ rotr64(w[i - 2], 61n) ^ (w[i - 2] >> 6n);
+      w[i] = (w[i - 16] + s0 + w[i - 7] + s1) & M64;
+    }
+    let [a, b, c, d, e, f, g, hh] = h;
+    for (let i = 0; i < 80; i++) {
+      const S1 = rotr64(e, 14n) ^ rotr64(e, 18n) ^ rotr64(e, 41n);
+      const ch = (e & f) ^ (~e & g & M64);
+      const t1 = (hh + S1 + ch + K512[i] + w[i]) & M64;
+      const S0 = rotr64(a, 28n) ^ rotr64(a, 34n) ^ rotr64(a, 39n);
+      const maj = (a & b) ^ (a & c) ^ (b & c);
+      const t2 = (S0 + maj) & M64;
+      hh = g; g = f; f = e; e = (d + t1) & M64;
+      d = c; c = b; b = a; a = (t1 + t2) & M64;
+    }
+    h[0] = (h[0] + a) & M64; h[1] = (h[1] + b) & M64; h[2] = (h[2] + c) & M64; h[3] = (h[3] + d) & M64;
+    h[4] = (h[4] + e) & M64; h[5] = (h[5] + f) & M64; h[6] = (h[6] + g) & M64; h[7] = (h[7] + hh) & M64;
+  }
+  const out = new Uint8Array(64);
+  const ov = new DataView(out.buffer);
+  for (let i = 0; i < 8; i++) ov.setBigUint64(i * 8, h[i]);
+  return out;
+}
+
+export function hmacSha512(key, data) {
+  if (key.length > 128) key = sha512(key);
+  const ipad = new Uint8Array(128 + data.length);
+  const opad = new Uint8Array(128 + 64);
+  for (let i = 0; i < 128; i++) {
+    ipad[i] = (key[i] ?? 0) ^ 0x36;
+    opad[i] = (key[i] ?? 0) ^ 0x5c;
+  }
+  ipad.set(data, 128);
+  opad.set(sha512(ipad), 128);
+  return sha512(opad);
+}
diff --git a/vendor/sidestr/schema/codec/headers.js b/vendor/sidestr/schema/codec/headers.js
new file mode 100644
index 0000000..04f93a2
--- /dev/null
+++ b/vendor/sidestr/schema/codec/headers.js
@@ -0,0 +1,223 @@
+// Schema-driven header chain engine.
+//
+// Executes the `header` phase ruleset from schema/validate.jsonld against
+// decoded BlockHeader objects, with network parameters from schema/chain.jsonld.
+// Rule order, identity, and error codes come from the schema; this file holds
+// only the pure check implementations the rule IDs bind to (Hornet-style:
+// one invariant per rule, no side effects, typed errors).
+//
+// A check returns true (pass), false (fail -> the rule's errorCode), or
+// null (insufficient context to evaluate; reported as skipped).
+
+export class HeaderEngine {
+  constructor(codec, params, ruleSet) {
+    this.codec = codec;
+    this.params = params;
+    this.ruleSet = ruleSet;
+    this.powLimit = BigInt('0x' + params.powLimit);
+    this.interval = params.difficultyAdjustmentInterval;
+    // Consensus-critical chain params are validated here, once, so a typo or a
+    // malformed overlay fails at construction rather than changing verdicts.
+    const id = params['@id'] ?? params.name ?? 'chain';
+    if (params.retargetSeed !== undefined && !['first', 'last'].includes(params.retargetSeed)) {
+      throw new Error(`${id}: retargetSeed must be 'first' or 'last', got ${JSON.stringify(params.retargetSeed)}`);
+    }
+    if (params.targetAdjustments !== undefined) {
+      if (!Array.isArray(params.targetAdjustments)) throw new Error(`${id}: targetAdjustments must be an array of {height, shiftLeft}`);
+      for (const a of params.targetAdjustments) {
+        if (!Number.isInteger(a?.height) || a.height < 0 || !Number.isInteger(a?.shiftLeft) || a.shiftLeft < 0 || a.shiftLeft > 255) {
+          throw new Error(`${id}: targetAdjustments entries need an integer height >= 0 and shiftLeft in 0..255, got ${JSON.stringify(a)}`);
+        }
+      }
+    }
+
+    this.checks = {
+      'btc:rule-header-prev-link': (ctx) =>
+        ctx.prev == null ? null : ctx.header.prevBlockHash === this.codec.blockHash(ctx.prev),
+      'btc:rule-header-pow': (ctx) =>
+        this.codec.checkProofOfWork(ctx.header),
+      'btc:rule-header-difficulty': (ctx) => {
+        if (ctx.prev == null) return null;
+        const expected = this.expectedBits(ctx.prev, ctx.height - 1, ctx.epochFirst,
+          { header: ctx.header, chainAt: ctx.chainAt });
+        return expected == null ? null : ctx.header.bits === expected;
+      },
+      'btc:rule-header-mtp': (ctx) => {
+        // a window truncated by storage limits (e.g. just after a sync
+        // checkpoint) yields a wrong median — skip rather than misjudge
+        const need = Math.min(11, ctx.height ?? 11);
+        if (!ctx.mtpWindow || ctx.mtpWindow.length < need) return null;
+        return ctx.header.time > this.medianTimePast(ctx.mtpWindow);
+      },
+      'btc:rule-header-time-future': (ctx) =>
+        ctx.now == null ? null : ctx.header.time <= ctx.now + this.params.maxFutureBlockTime,
+      'btc:rule-header-timewarp': (ctx) => {
+        if (!this.params.timewarpFix) return null;
+        if (ctx.height == null || ctx.prev == null) return null;
+        if (ctx.height % this.interval !== 0) return true; // only epoch-first blocks
+        return ctx.header.time >= ctx.prev.time - this.params.maxTimewarp;
+      },
+      'btc:rule-header-version': (ctx) => {
+        if (ctx.height == null) return null;
+        const p = this.params;
+        const min = ctx.height >= p.bip65Height ? 4
+          : ctx.height >= p.bip66Height ? 3
+          : ctx.height >= p.bip34Height ? 2 : 1;
+        return ctx.header.version >= min;
+      },
+    };
+  }
+
+  static fromSchemas(codec, chainSchema, validateSchema, network = 'btc:mainnet') {
+    const params = chainSchema['@graph'].find((n) => n['@id'] === network);
+    if (!params) throw new Error(`unknown network: ${network}`);
+    codec.setChainParams?.(params); // variants + PoW hash follow the chain
+    const ruleSet = validateSchema['@graph'].find((n) => n['@type'] === 'RuleSet' && n.phase === 'header');
+    return new HeaderEngine(codec, params, ruleSet);
+  }
+
+  // ---- consensus arithmetic ----
+
+  // Expected work to find a block at this target: 2^256 / (target + 1).
+  work(header) {
+    return (1n << 256n) / (this.codec.expandCompact(header.bits) + 1n);
+  }
+
+  // Median of the last (up to) 11 block timestamps.
+  medianTimePast(window) {
+    const times = window.slice(-11).map((h) => h.time).sort((a, b) => a - b);
+    return times[times.length >> 1];
+  }
+
+  // Compact-encode a 256-bit target (inverse of expandCompact), matching
+  // Bitcoin Core's arith_uint256::GetCompact mantissa truncation.
+  compactFromTarget(target) {
+    let size = Math.ceil(target.toString(16).length / 2);
+    let compact = size <= 3
+      ? Number(target << (8n * BigInt(3 - size)))
+      : Number(target >> (8n * BigInt(size - 3)));
+    if (compact & 0x800000) { compact >>= 8; size++; }
+    return (compact | (size << 24)) >>> 0;
+  }
+
+  // The bits required of the block following `prev` at height prevHeight.
+  // Within an epoch: unchanged — except on min-difficulty networks, where a
+  // 20-minute gap permits powLimit bits and otherwise the difficulty is that
+  // of the last real-difficulty block (the walk-back needs opts.chainAt; if
+  // unavailable, returns null to skip honestly). At a boundary: retargeted
+  // from the previous epoch's timespan, based on the epoch-first block's
+  // bits under BIP 94 (timewarpFix) and the last block's otherwise.
+  expectedBits(prev, prevHeight, epochFirst, opts = {}) {
+    if (this.params.powNoRetargeting) return prev.bits;
+    const height = prevHeight + 1;
+    const boundary = height % this.interval === 0;
+    if (!boundary && this.params.allowMinDifficultyBlocks) {
+      const powBits = this.compactFromTarget(this.powLimit);
+      if (opts.header && opts.header.time > prev.time + 2 * this.params.targetSpacing) {
+        return powBits; // the minimum-difficulty exception: no adjustment applies (Core returns here)
+      }
+      let h = prevHeight, hdr = prev;
+      while (h % this.interval !== 0 && hdr.bits === powBits) {
+        const back = opts.chainAt?.(h - 1);
+        if (!back) return null; // walk-back context exhausted
+        h--; hdr = back;
+      }
+      return this.adjustAt(height, hdr.bits);
+    }
+    if (!boundary) return this.adjustAt(height, prev.bits);
+    if (epochFirst == null) return null;
+    // Retarget seed: Bitcoin scales the last block's bits; BIP 94 (testnet4)
+    // the first block of the period's, so a min-difficulty last block cannot
+    // reset the difficulty. Explicit as `retargetSeed`, defaulting from timewarpFix.
+    const seed = this.params.retargetSeed ?? (this.params.timewarpFix ? 'first' : 'last');
+    const base = seed === 'first' ? epochFirst.bits : prev.bits;
+    return this.adjustAt(height, this.retarget(epochFirst.time, prev.time, base));
+  }
+
+  // A chain may declare one-off target adjustments, `targetAdjustments:
+  // [{ height, shiftLeft }]`: at exactly that height the expected target is
+  // eased by 2^shiftLeft, clamped at powLimit (a proof-of-work change's first
+  // block, e.g. Knots' ApplyBlake2bTargetShift). Absent on Bitcoin chains.
+  adjustAt(height, bits) {
+    const adj = this.params.targetAdjustments?.find((a) => a.height === height);
+    if (!adj || bits == null) return bits;
+    const target = this.codec.expandCompact(bits);
+    const shifted = target > (this.powLimit >> BigInt(adj.shiftLeft)) ? this.powLimit : target << BigInt(adj.shiftLeft);
+    return this.compactFromTarget(shifted);
+  }
+
+  retarget(firstTime, lastTime, baseBits) {
+    const span = this.params.targetTimespan;
+    const actual = Math.max(span / 4, Math.min(lastTime - firstTime, span * 4));
+    let target = this.codec.expandCompact(baseBits) * BigInt(actual) / BigInt(span);
+    if (target > this.powLimit) target = this.powLimit;
+    return this.compactFromTarget(target);
+  }
+
+  // ---- ruleset execution ----
+
+  // Overlay rules bind their checks here, keyed by rule @id.
+  registerChecks(map) { Object.assign(this.checks, map); }
+
+  validateHeader(ctx) {
+    const results = this.ruleSet.rules.map((rule) => {
+      const check = this.checks[rule['@id']];
+      if (!check) throw new Error(`no check registered for ${rule['@id']}`);
+      const gated = rule.activationParam && ctx.height != null && ctx.height < this.params[rule.activationParam];
+      const outcome = gated ? null : check(ctx);
+      return {
+        rule: rule['@id'],
+        label: rule.label,
+        ok: outcome,
+        error: outcome === false ? rule.errorCode : null,
+      };
+    });
+    return { ok: results.every((r) => r.ok !== false), results };
+  }
+
+  // Validate consecutive headers starting at startHeight.
+  //   prevContext: up to 11 decoded headers immediately preceding headers[0]
+  //   epochFirsts: {height: header} for epoch-first headers needed at
+  //                retarget boundaries that fall before the window
+  //   now: unix time for the future-time rule (null to skip)
+  validateChain(headers, { startHeight, prevContext = [], epochFirsts = {}, now = null, ...extra }) {
+    const all = [...prevContext, ...headers];
+    const firstIndex = prevContext.length;
+    const heightOf = (i) => startHeight - prevContext.length + i;
+    let chainWork = 0n;
+
+    return headers.map((header, k) => {
+      const i = firstIndex + k;
+      const height = startHeight + k;
+      const boundaryFirst = height % this.interval === 0 ? height - this.interval : null;
+      const inWindow = boundaryFirst != null && boundaryFirst >= heightOf(0)
+        ? all[boundaryFirst - heightOf(0)]
+        : null;
+      const chainAt = (h) => {
+        const idx = h - heightOf(0);
+        if (idx >= 0 && idx < i) return all[idx];
+        return epochFirsts[h] ?? extra.chainAt?.(h) ?? null;
+      };
+      const ctx = {
+        header,
+        height,
+        prev: i > 0 ? all[i - 1] : null,
+        mtpWindow: all.slice(Math.max(0, i - 11), i),
+        epochFirst: inWindow ?? epochFirsts[boundaryFirst]
+          ?? (boundaryFirst != null ? extra.chainAt?.(boundaryFirst) : null) ?? null,
+        chainAt,
+        now,
+      };
+      const verdict = this.validateHeader(ctx);
+      chainWork += this.work(header);
+      return {
+        height,
+        hash: this.codec.blockHash(header),
+        time: header.time,
+        bits: header.bits,
+        chainWork,
+        ...verdict,
+      };
+    });
+  }
+}
diff --git a/vendor/sidestr/schema/codec/interpreter.js b/vendor/sidestr/schema/codec/interpreter.js
new file mode 100644
index 0000000..06103be
--- /dev/null
+++ b/vendor/sidestr/schema/codec/interpreter.js
@@ -0,0 +1,939 @@
+// Bitcoin script interpreter, Hornet-style: each opcode is a self-contained
+// handler (contrast Bitcoin Core's ~1,500-line EvalScript), keyed by the
+// opcode names of the schema's Opcode enumeration, with execution limits
+// taken from the schema's scriptLimits instance.
+//
+// Supported spend paths: p2pk, p2pkh, bare multisig, p2sh (including
+// wrapped segwit), p2wpkh, p2wsh — with legacy and BIP 143 sighash and
+// real ECDSA verification. OP_CODESEPARATOR truncates the legacy/segwit-v0
+// sighash scriptCode at the last executed separator (Core's pbegincodehash).
+// verifyInput follows Core's VerifyScript, including the BIP 141 structural
+// rules (witness program shape and length, malleated scriptSig, unexpected
+// witness, 520-byte witness elements). Unknown witness versions return
+// ok:null rather than Core's "success", by design.
+// Legacy (pre-segwit) sighash follows Core exactly: every OP_CODESEPARATOR is
+// dropped from the serialized scriptCode, and CHECKSIG/CHECKMULTISIG first
+// FindAndDelete the signature push(es) from it (SCRIPT_VERIFY_CONST_SCRIPTCODE
+// turns both into failures). Known simplification, accepted for now: the
+// tapscript codeseparator position (BIP 342) is not yet committed in the
+// BIP 341 message.
+
+import { sha256, dsha256, sha1, ripemd160, hash160, bytesToHex, hexToBytes, taggedHash } from './hash.js';
+import { parsePubkey, parseDerSignature, verifyEcdsa, verifySchnorr, checkTapTweak, N } from './secp256k1.js';
+
+class ScriptError extends Error {}
+const fail = (msg) => { throw new ScriptError(msg); };
+
+// CScriptNum: little-endian, sign bit in the high bit of the last byte.
+export function numDecode(bytes, maxLen = 4, requireMinimal = false) {
+  if (bytes.length > maxLen) fail('scriptnum overflow');
+  // BIP 62 minimal scriptnum (SCRIPT_VERIFY_MINIMALDATA): no trailing zero
+  // byte unless it sets the sign bit of the previous byte.
+  if (requireMinimal && bytes.length > 0
+      && (bytes[bytes.length - 1] & 0x7f) === 0
+      && (bytes.length <= 1 || (bytes[bytes.length - 2] & 0x80) === 0)) {
+    fail('non-minimal scriptnum');
+  }
+  if (bytes.length === 0) return 0;
+  let n = 0;
+  for (let i = 0; i < bytes.length; i++) n += bytes[i] * 2 ** (8 * i);
+  if (bytes[bytes.length - 1] & 0x80) n = -(n - 2 ** (8 * bytes.length - 1));
+  return n;
+}
+
+export function numEncode(n) {
+  if (n === 0) return new Uint8Array(0);
+  const neg = n < 0;
+  let abs = Math.abs(n);
+  const bytes = [];
+  while (abs > 0) { bytes.push(abs % 256); abs = Math.floor(abs / 256); }
+  if (bytes[bytes.length - 1] & 0x80) bytes.push(neg ? 0x80 : 0x00);
+  else if (neg) bytes[bytes.length - 1] |= 0x80;
+  return Uint8Array.from(bytes);
+}
+
+const truthy = (bytes) => {
+  for (let i = 0; i < bytes.length; i++) {
+    if (bytes[i] !== 0) return !(i === bytes.length - 1 && bytes[i] === 0x80); // negative zero
+  }
+  return false;
+};
+const boolBytes = (b) => (b ? Uint8Array.of(1) : new Uint8Array(0));
+const eq = (a, b) => a.length === b.length && a.every((v, i) => v === b[i]);
+// BIP 141 IsWitnessProgram: 4..42 bytes, OP_0 or OP_1..OP_16, then a single
+// direct push of exactly the rest. A PUSHDATA-encoded program is not a program.
+function witnessProgram(scriptHex) {
+  const b = hexToBytes(scriptHex);
+  if (b.length < 4 || b.length > 42) return null;
+  if (b[0] !== 0x00 && (b[0] < 0x51 || b[0] > 0x60)) return null;
+  if (b[1] + 2 !== b.length) return null;
+  return { version: b[0] === 0x00 ? 0 : b[0] - 0x50, program: bytesToHex(b.subarray(2)) };
+}
+// Core's SigVersion::BASE: the pre-segwit sighash rules (callers that omit
+// sigVersion get legacy semantics throughout this file).
+const isLegacy = (sigVersion) => sigVersion !== 'witnessV0' && sigVersion !== 'tapscript';
+
+// ---- byte-level script walking, for the two legacy-sighash quirks ----
+// End offset of the op starting at `pos`, or -1 when the push is truncated
+// (Core's CScript::GetOp failing).
+function opEnd(bytes, pos) {
+  const op = bytes[pos];
+  let len = 0, hdr = 1;
+  if (op < 0x4c) len = op;
+  else if (op === 0x4c) { if (pos + 2 > bytes.length) return -1; len = bytes[pos + 1]; hdr = 2; }
+  else if (op === 0x4d) { if (pos + 3 > bytes.length) return -1; len = bytes[pos + 1] | (bytes[pos + 2] << 8); hdr = 3; }
+  else if (op === 0x4e) { if (pos + 5 > bytes.length) return -1; len = (bytes[pos + 1] | (bytes[pos + 2] << 8) | (bytes[pos + 3] << 16) | (bytes[pos + 4] << 24)) >>> 0; hdr = 5; }
+  const end = pos + hdr + len;
+  return end > bytes.length ? -1 : end;
+}
+// CScript() << vector: the push encoding Core uses for a signature element.
+function pushEncode(data) {
+  const n = data.length;
+  const head = n < 0x4c ? [n] : n <= 0xff ? [0x4c, n] : n <= 0xffff ? [0x4d, n & 0xff, n >> 8]
+    : [0x4e, n & 0xff, (n >> 8) & 0xff, (n >> 16) & 0xff, (n >>> 24) & 0xff];
+  return Uint8Array.from([...head, ...data]);
+}
+// Core's FindAndDelete: at every opcode boundary, delete each consecutive
+// occurrence of `needle`; returns {script, found}.
+export function findAndDelete(script, needle) {
+  if (!needle.length) return { script, found: 0 };
+  const out = []; let found = 0, pc = 0, pc2 = 0;
+  do {
+    for (let i = pc2; i < pc; i++) out.push(script[i]);
+    while (script.length - pc >= needle.length && eq(script.subarray(pc, pc + needle.length), needle)) { pc += needle.length; found++; }
+    pc2 = pc;
+    if (pc >= script.length) break;
+    pc = opEnd(script, pc);
+  } while (pc !== -1);
+  if (!found) return { script, found: 0 };
+  for (let i = pc2; i < script.length; i++) out.push(script[i]);
+  return { script: Uint8Array.from(out), found };
+}
+// Core's CTransactionSignatureSerializer::SerializeScriptCode: the legacy
+// sighash commits to scriptCode with every OP_CODESEPARATOR removed. On a
+// malformed trailing push (GetOp fails) the remainder is emitted verbatim.
+// (Core also keeps the pre-strip length in the size prefix in that case; a
+// scriptCode ending in a truncated push cannot execute to completion, so the
+// resulting digest never decides validity and the difference is not modelled.)
+export function stripCodeSeparators(script) {
+  const out = []; let pc = 0;
+  while (pc < script.length) {
+    const end = opEnd(script, pc);
+    if (end === -1) { for (let i = pc; i < script.length; i++) out.push(script[i]); break; }
+    if (script[pc] !== 0xab) for (let i = pc; i < end; i++) out.push(script[i]);
+    pc = end;
+  }
+  return Uint8Array.from(out);
+}
+
+// Bitcoin CompactSize (1/3/5/9 bytes), matching the codec's varint writer.
+// Used for the script-length prefix in the BIP341 TapLeaf hash; tapscripts can
+// exceed 65,535 bytes (large inscriptions), so the 0xfe 4-byte case is required.
+export function compactSize(n) {
+  if (n < 0xfd) return Uint8Array.of(n);
+  if (n <= 0xffff) return Uint8Array.of(0xfd, n & 0xff, (n >>> 8) & 0xff);
+  if (n <= 0xffffffff) return Uint8Array.of(0xfe, n & 0xff, (n >>> 8) & 0xff, (n >>> 16) & 0xff, (n >>> 24) & 0xff);
+  const b = new Uint8Array(9); b[0] = 0xff; new DataView(b.buffer).setBigUint64(1, BigInt(n), true); return b;
+}
+
+const DEFAULT_LIMITS = {
+  maxScriptSize: 10000, maxScriptElementSize: 520,
+  maxOpsPerScript: 201, maxStackSize: 1000, maxMultisigKeys: 20,
+};
+
+// BIP 62 minimal-push (SCRIPT_VERIFY_MINIMALDATA): a data push must use the
+// shortest possible encoding. `code` is the push opcode actually used.
+function minimalPushOk(code, dataHex) {
+  const len = dataHex.length / 2;
+  if (len === 0) return code === 0x00;                 // must be OP_0
+  if (len === 1) {
+    const b = parseInt(dataHex.slice(0, 2), 16);
+    if (b >= 1 && b <= 16) return false;               // must be OP_1..OP_16
+    if (b === 0x81) return false;                       // must be OP_1NEGATE
+    return code === 0x01;                               // else a direct 1-byte push
+  }
+  if (len <= 75) return code === len;                   // direct push
+  if (len <= 255) return code === 0x4c;                 // OP_PUSHDATA1
+  if (len <= 65535) return code === 0x4d;               // OP_PUSHDATA2
+  return true;
+}
+
+// ---- signature/pubkey encoding rules, gated by verification flags ----
+// (sig includes its trailing 1-byte hashtype.)
+// BIP 66 strict DER:
+function isValidDerSig(sig) {
+  const len = sig.length;
+  if (len < 9 || len > 73) return false;
+  if (sig[0] !== 0x30 || sig[1] !== len - 3 || sig[2] !== 0x02) return false;
+  const lenR = sig[3];
+  if (5 + lenR >= len) return false;
+  const lenS = sig[5 + lenR];
+  if (lenR + lenS + 7 !== len) return false;
+  if (lenR === 0 || (sig[4] & 0x80)) return false;
+  if (lenR > 1 && sig[4] === 0x00 && !(sig[5] & 0x80)) return false;
+  if (sig[lenR + 4] !== 0x02 || lenS === 0 || (sig[lenR + 6] & 0x80)) return false;
+  if (lenS > 1 && sig[lenR + 6] === 0x00 && !(sig[lenR + 7] & 0x80)) return false;
+  return true;
+}
+// BIP 62 low-S:
+function isLowDerSig(sig) {
+  const p = parseDerSignature(sig.subarray(0, sig.length - 1));
+  return !!p && p.s <= N / 2n;
+}
+// STRICTENC defined hashtype (SIGHASH_ALL/NONE/SINGLE, optionally ANYONECANPAY);
+// where the unified sighash applies, SIGHASH_UNIFIED (0x20) is a defined bit too.
+function isDefinedHashtype(sig, unified = false) {
+  let ht = sig[sig.length - 1] & ~0x80;
+  if (unified) ht &= ~SIGHASH_UNIFIED;
+  return ht >= 1 && ht <= 3;
+}
+
+// Bitcoin Knots' unified opt-in signature hash (doc/unified-sighash.md in
+// v29.4.1.knots20260508): one message for every script type, selected per
+// signature by this bit in the hash type byte. Active from the chain's
+// `unifiedSighashParam` height (the BLAKE2b fork height on the Knots chains).
+export const SIGHASH_UNIFIED = 0x20;
+// Thrown when an opted-in signature is met without every input's prevout:
+// the message commits to all spent amounts and scripts, so it is honestly
+// unverifiable rather than wrong. verifyInput turns it into ok: null.
+class NeedsPrevouts extends Error {}
+// STRICTENC pubkey: compressed (33, 0x02/0x03) or uncompressed (65, 0x04):
+function isPubKeyEnc(pub) {
+  return (pub.length === 33 && (pub[0] === 0x02 || pub[0] === 0x03))
+      || (pub.length === 65 && pub[0] === 0x04);
+}
+
+export class ScriptInterpreter {
+  constructor(codec, scriptEngine, limits = DEFAULT_LIMITS) {
+    this.codec = codec;
+    this.scriptEngine = scriptEngine;
+    this.limits = limits;
+    this.handlers = this.#buildHandlers();
+    // Per-transaction sighash midstate cache (BIP143/BIP341 hashPrevouts,
+    // hashSequence, hashOutputs, etc. depend only on the whole tx, not the input
+    // being signed). Without this, a tx with n segwit/taproot inputs recomputes
+    // these O(n)-sized hashes n times = O(n^2); a 1,400-input consolidation then
+    // takes ~minutes. Keyed by the tx object (WeakMap) so it clears itself.
+    this._sigCache = new WeakMap();
+  }
+
+  #txCache(tx) {
+    let c = this._sigCache.get(tx);
+    if (!c) { c = {}; this._sigCache.set(tx, c); }
+    return c;
+  }
+
+  // ---- sighash ----
+
+  sighashLegacy(tx, inIndex, scriptCodeHex, hashType) {
+    scriptCodeHex = bytesToHex(stripCodeSeparators(hexToBytes(scriptCodeHex)));
+    const anyone = hashType & 0x80;
+    const base = hashType & 0x1f;
+    if (base === 3 && inIndex >= tx.outputs.length) {
+      // historical SIGHASH_SINGLE bug: the "hash" is the number 1
+      const one = new Uint8Array(32); one[0] = 1;
+      return one;
+    }
+    const inputs = (anyone ? [tx.inputs[inIndex]] : tx.inputs).map((inp, i) => ({
+      ...inp,
+      scriptSig: (anyone || i === inIndex) ? scriptCodeHex : '',
+      sequence: (!anyone && (base === 2 || base === 3) && i !== inIndex) ? 0 : inp.sequence,
+    }));
+    const outputs = base === 2 ? []
+      : base === 3 ? tx.outputs.slice(0, inIndex + 1).map((o, i) =>
+          i < inIndex ? { value: -1, scriptPubKey: '' } : o)
+      : tx.outputs;
+    const ser = this.codec.encode('Transaction',
+      { version: tx.version, inputs, outputs, lockTime: tx.lockTime }, { legacy: true });
+    const buf = new Uint8Array(ser.length + 4);
+    buf.set(ser);
+    new DataView(buf.buffer).setUint32(ser.length, hashType, true);
+    return dsha256(buf);
+  }
+
+  sighashWitnessV0(tx, inIndex, scriptCodeHex, amount, hashType) {
+    const anyone = hashType & 0x80;
+    const base = hashType & 0x1f;
+    const zero = new Uint8Array(32);
+    const w = [];
+    const push = (b) => w.push(b);
+    const u32 = (v) => { const b = new Uint8Array(4); new DataView(b.buffer).setUint32(0, v, true); return b; };
+    const i64 = (v) => { const b = new Uint8Array(8); new DataView(b.buffer).setBigInt64(0, BigInt(v), true); return b; };
+    const outpoint = (inp) => {
+      const b = new Uint8Array(36);
+      b.set(hexToBytes(inp.prevout.txid).reverse());
+      b.set(u32(inp.prevout.vout), 32);
+      return b;
+    };
+    const cat = (arrs) => {
+      const out = new Uint8Array(arrs.reduce((s, a) => s + a.length, 0));
+      let p = 0; for (const a of arrs) { out.set(a, p); p += a.length; }
+      return out;
+    };
+    const serOut = (o) => this.codec.encode('TransactionOutput', o);
+    // These three depend only on the whole tx — memoize per tx (see #txCache).
+    const C = this.#txCache(tx);
+    const hashPrevouts = anyone ? zero : (C.wPrevouts ??= dsha256(cat(tx.inputs.map(outpoint))));
+    const hashSequence = (anyone || base === 2 || base === 3) ? zero
+      : (C.wSequence ??= dsha256(cat(tx.inputs.map((i) => u32(i.sequence)))));
+    const hashOutputs = (base !== 2 && base !== 3) ? (C.wOutputs ??= dsha256(cat(tx.outputs.map(serOut))))
+      : (base === 3 && inIndex < tx.outputs.length) ? dsha256(serOut(tx.outputs[inIndex]))
+      : zero;
+    const script = hexToBytes(scriptCodeHex);
+    const scriptLen = script.length < 0xfd ? Uint8Array.of(script.length)
+      : cat([Uint8Array.of(0xfd), new Uint8Array(new Uint16Array([script.length]).buffer)]);
+    push(u32(tx.version)); push(hashPrevouts); push(hashSequence);
+    push(outpoint(tx.inputs[inIndex]));
+    push(scriptLen); push(script);
+    push(i64(amount));
+    push(u32(tx.inputs[inIndex].sequence));
+    push(hashOutputs);
+    push(u32(tx.lockTime)); push(u32(hashType));
+    return dsha256(cat(w));
+  }
+
+  // BIP 341 signature message. Single SHA-256 hashing throughout (not double),
+  // wrapped in the TapSighash tag. Commits to every input's amount AND
+  // scriptPubKey — hence `prevouts` is the full per-input array.
+  sighashTaproot(tx, inIndex, prevouts, hashType, { annex = null, leafHash = null, codeSepPos = 0xffffffff } = {}) {
+    if (![0x00, 0x01, 0x02, 0x03, 0x81, 0x82, 0x83].includes(hashType)) fail('invalid taproot sighash type');
+    const anyone = hashType & 0x80;
+    const base = hashType & 0x03; // 0 = DEFAULT (ALL semantics)
+    const u8 = (v) => Uint8Array.of(v);
+    const u32 = (v) => { const b = new Uint8Array(4); new DataView(b.buffer).setUint32(0, v, true); return b; };
+    const i64 = (v) => { const b = new Uint8Array(8); new DataView(b.buffer).setBigInt64(0, BigInt(v), true); return b; };
+    const varbytes = (bytes) => {
+      if (bytes.length >= 0xfd) fail('oversized script in sighash');
+      const b = new Uint8Array(1 + bytes.length); b[0] = bytes.length; b.set(bytes, 1);
+      return b;
+    };
+    const cat = (arrs) => {
+      const out = new Uint8Array(arrs.reduce((s, a) => s + a.length, 0));
+      let p = 0; for (const a of arrs) { out.set(a, p); p += a.length; }
+      return out;
+    };
+    const outpoint = (inp) => cat([hexToBytes(inp.prevout.txid).reverse(), u32(inp.prevout.vout)]);
+
+    // sha_prevouts/amounts/scriptpubkeys/sequences/outputs depend only on the
+    // whole tx (+ its prevout set, identical across inputs) — memoize per tx.
+    const C = this.#txCache(tx);
+    const parts = [u8(0x00), u8(hashType), u32(tx.version), u32(tx.lockTime)];
+    if (!anyone) {
+      parts.push(C.tPrevouts ??= sha256(cat(tx.inputs.map(outpoint))));
+      parts.push(C.tAmounts ??= sha256(cat(prevouts.map((p) => i64(p.value)))));
+      parts.push(C.tScriptpubkeys ??= sha256(cat(prevouts.map((p) => varbytes(hexToBytes(p.scriptPubKey))))));
+      parts.push(C.tSequences ??= sha256(cat(tx.inputs.map((i) => u32(i.sequence)))));
+    }
+    if (base !== 2 && base !== 3) {
+      parts.push(C.tOutputs ??= sha256(cat(tx.outputs.map((o) => this.codec.encode('TransactionOutput', o)))));
+    }
+    parts.push(u8((leafHash ? 2 : 0) + (annex ? 1 : 0))); // spend_type
+    if (anyone) {
+      parts.push(outpoint(tx.inputs[inIndex]), i64(prevouts[inIndex].value),
+        varbytes(hexToBytes(prevouts[inIndex].scriptPubKey)), u32(tx.inputs[inIndex].sequence));
+    } else {
+      parts.push(u32(inIndex));
+    }
+    if (annex) parts.push(sha256(varbytes(annex)));
+    if (base === 3) {
+      if (inIndex >= tx.outputs.length) fail('sighash single without matching output');
+      parts.push(sha256(this.codec.encode('TransactionOutput', tx.outputs[inIndex])));
+    }
+    if (leafHash) parts.push(leafHash, u8(0x00), u32(codeSepPos));
+    return taggedHash('TapSighash', cat(parts));
+  }
+
+  // Knots' unified sighash: BIP 341's layout with a script-type byte in place
+  // of the spend type, single SHA-256 aggregates, TaggedHash("UnifiedSighash").
+  // scriptType 0 = bare/P2SH (scriptCode after FindAndDelete and the last
+  // executed OP_CODESEPARATOR, as the legacy rules use it, OP_CODESEPARATORs
+  // kept), 1 = witness v0 (BIP 143 scriptCode), 2 = taproot key path,
+  // 3 = tapscript (leafHash, key version 0, codeseparator position).
+  sighashUnified(tx, inIndex, prevouts, hashType, scriptType,
+      { scriptCodeHex = null, annex = null, leafHash = null, codeSepPos = 0xffffffff } = {}) {
+    if (!(hashType & SIGHASH_UNIFIED)) fail('unified sighash without SIGHASH_UNIFIED');
+    if (!prevouts || prevouts.length !== tx.inputs.length) throw new NeedsPrevouts('unified sighash needs every input prevout');
+    const taproot = scriptType === 2 || scriptType === 3;
+    const outputType = hashType & 0x1f;
+    if (taproot) { // BIP 341's reading: undefined bytes are refused at consensus
+      if (hashType & ~(0x1f | 0x80 | SIGHASH_UNIFIED)) fail('invalid taproot sighash type');
+      if (outputType < 1 || outputType > 3) fail('invalid taproot sighash type');
+    }
+    const anyone = hashType & 0x80;
+    const u8 = (v) => Uint8Array.of(v);
+    const u32 = (v) => { const b = new Uint8Array(4); new DataView(b.buffer).setUint32(0, v, true); return b; };
+    const i64 = (v) => { const b = new Uint8Array(8); new DataView(b.buffer).setBigInt64(0, BigInt(v), true); return b; };
+    const cat = (arrs) => {
+      const out = new Uint8Array(arrs.reduce((s, a) => s + a.length, 0));
+      let p = 0; for (const a of arrs) { out.set(a, p); p += a.length; }
+      return out;
+    };
+    const varbytes = (bytes) => cat([compactSize(bytes.length), bytes]);
+    const outpoint = (inp) => cat([hexToBytes(inp.prevout.txid).reverse(), u32(inp.prevout.vout)]);
+    const serOut = (o) => this.codec.encode('TransactionOutput', o);
+    const C = this.#txCache(tx);
+    const parts = [u8(0x00), u8(hashType & 0xff), u32(tx.version), u32(tx.lockTime), u8(0x00)];
+    if (!anyone) {
+      parts.push(C.tPrevouts ??= sha256(cat(tx.inputs.map(outpoint))));
+      parts.push(C.tAmounts ??= sha256(cat(prevouts.map((p) => i64(p.value)))));
+      parts.push(C.tScriptpubkeys ??= sha256(cat(prevouts.map((p) => varbytes(hexToBytes(p.scriptPubKey))))));
+      parts.push(C.tSequences ??= sha256(cat(tx.inputs.map((i) => u32(i.sequence)))));
+    }
+    if (outputType !== 2 && outputType !== 3) parts.push(C.tOutputs ??= sha256(cat(tx.outputs.map(serOut))));
+    parts.push(u8(scriptType));
+    if (anyone) parts.push(outpoint(tx.inputs[inIndex]), serOut(prevouts[inIndex]), u32(tx.inputs[inIndex].sequence));
+    else parts.push(u32(inIndex));
+    if (!taproot) {
+      if (scriptCodeHex == null) fail('unified sighash needs scriptCode');
+      parts.push(varbytes(hexToBytes(scriptCodeHex)));
+    } else {
+      parts.push(u8(annex ? 1 : 0));
+      if (annex) parts.push(sha256(varbytes(annex)));
+    }
+    if (outputType === 3) {
+      if (inIndex >= tx.outputs.length) fail('sighash single without matching output');
+      parts.push(sha256(serOut(tx.outputs[inIndex])));
+    }
+    if (scriptType === 3) {
+      if (!leafHash) fail('unified tapscript sighash needs the leaf hash');
+      parts.push(leafHash, u8(0x00), u32(codeSepPos));
+    }
+    return taggedHash('UnifiedSighash', cat(parts));
+  }
+
+  // Tapscript signature check (BIP 342): an empty signature pushes false;
+  // a non-empty INVALID signature fails the whole script; a non-32-byte
+  // public key is an "unknown key type" and succeeds (upgrade hook).
+  #checkSigTapscript(sigBytes, pubBytes, ctx) {
+    if (pubBytes.length === 0) fail('empty pubkey');
+    if (sigBytes.length === 0) return false;
+    if (ctx.budget) { ctx.budget.n -= 50; if (ctx.budget.n < 0) fail('sigops budget exceeded'); }
+    if (pubBytes.length !== 32) return true; // unknown pubkey type
+    let hashType = 0x00, sig = sigBytes;
+    if (sigBytes.length === 65) {
+      hashType = sigBytes[64];
+      if (hashType === 0x00) fail('explicit SIGHASH_DEFAULT in 65-byte signature');
+      sig = sigBytes.subarray(0, 64);
+    } else if (sigBytes.length !== 64) fail('bad schnorr signature size');
+    const tail = { annex: ctx.annex, leafHash: ctx.leafHash, codeSepPos: ctx.codeSepPos ?? 0xffffffff };
+    const msg = (ctx.unified && (hashType & SIGHASH_UNIFIED))
+      ? this.sighashUnified(ctx.tx, ctx.inIndex, ctx.prevouts, hashType, 3, tail)
+      : this.sighashTaproot(ctx.tx, ctx.inIndex, ctx.prevouts, hashType, tail);
+    if (!verifySchnorr(msg, sig, pubBytes)) fail('invalid schnorr signature');
+    return true;
+  }
+
+  #checkSig(sigBytes, pubBytes, ctx) {
+    if (ctx.sigVersion === 'tapscript') return this.#checkSigTapscript(sigBytes, pubBytes, ctx);
+    const f = ctx.flags;
+    // scriptCode is truncated to start after the last executed OP_CODESEPARATOR
+    let scriptCode = ctx.codeSepOffset ? ctx.scriptCode.slice(ctx.codeSepOffset * 2) : ctx.scriptCode;
+    // Legacy only, and before any encoding check (Core's order): the signature
+    // push is deleted from scriptCode. An empty signature is the push OP_0, so
+    // it deletes OP_0 opcodes too, which CONST_SCRIPTCODE then rejects.
+    // (CHECKMULTISIG deletes every signature up front and sets _sigsDeleted.)
+    if (isLegacy(ctx.sigVersion) && !ctx._sigsDeleted) {
+      const { script, found } = findAndDelete(hexToBytes(scriptCode), pushEncode(sigBytes));
+      if (found && f?.has('CONST_SCRIPTCODE')) fail('SIG_FINDANDDELETE');
+      if (found) scriptCode = bytesToHex(script);
+    }
+    if (f && sigBytes.length > 0) {
+      if ((f.has('DERSIG') || f.has('LOW_S') || f.has('STRICTENC')) && !isValidDerSig(sigBytes)) fail('non-DER signature');
+      if (f.has('LOW_S') && !isLowDerSig(sigBytes)) fail('high-S signature');
+      if (f.has('STRICTENC') && !isDefinedHashtype(sigBytes, ctx.unified)) fail('undefined hashtype');
+    }
+    if (f?.has('STRICTENC') && !isPubKeyEnc(pubBytes)) fail('bad pubkey encoding');
+    // BIP 143: witness v0 pubkeys must be compressed under WITNESS_PUBKEYTYPE
+    if (ctx.sigVersion === 'witnessV0' && f?.has('WITNESS_PUBKEYTYPE')
+        && !(pubBytes.length === 33 && (pubBytes[0] === 0x02 || pubBytes[0] === 0x03))) {
+      fail('WITNESS_PUBKEYTYPE');
+    }
+    if (sigBytes.length === 0) return false;
+    const hashType = sigBytes[sigBytes.length - 1];
+    const sig = parseDerSignature(sigBytes.subarray(0, sigBytes.length - 1));
+    const pub = parsePubkey(pubBytes);
+    if (!sig || !pub) return false;
+    const witnessV0 = ctx.sigVersion === 'witnessV0';
+    const hash = (ctx.unified && (hashType & SIGHASH_UNIFIED))
+      ? this.sighashUnified(ctx.tx, ctx.inIndex, ctx.prevouts, hashType, witnessV0 ? 1 : 0, { scriptCodeHex: scriptCode })
+      : witnessV0
+        ? this.sighashWitnessV0(ctx.tx, ctx.inIndex, scriptCode, ctx.amount, hashType)
+        : this.sighashLegacy(ctx.tx, ctx.inIndex, scriptCode, hashType);
+    return verifyEcdsa(hash, sig, pub);
+  }
+
+  // ---- opcode handlers ----
+
+  #buildHandlers() {
+    const L = this.limits;
+    const pop = (s) => { if (!s.length) fail('stack underflow'); return s.pop(); };
+    const peek = (s, n = 1) => { if (s.length < n) fail('stack underflow'); return s[s.length - n]; };
+    const num = (s) => numDecode(pop(s), 4, this.requireMinimalNum);
+    const pushNum = (s, n) => s.push(numEncode(n));
+    const unary = (f) => (s) => pushNum(s, f(num(s)));
+    const binary = (f) => (s) => { const b = num(s), a = num(s); pushNum(s, f(a, b)); };
+    const binBool = (f) => (s) => { const b = num(s), a = num(s); s.push(boolBytes(f(a, b))); };
+    const hashOp = (f) => (s) => s.push(f(pop(s)));
+
+    const h = {
+      OP_0: (s) => s.push(new Uint8Array(0)),
+      OP_1NEGATE: (s) => pushNum(s, -1),
+      OP_NOP: () => {},
+      // Legacy/segwit-v0: the sighash scriptCode begins after the last *executed*
+      // OP_CODESEPARATOR (Core's pbegincodehash). Only updated when executing, so
+      // a separator inside an untaken IF branch has no effect.
+      OP_CODESEPARATOR: (s, ctx, exec, op) => {
+        if (isLegacy(ctx.sigVersion) && ctx.flags?.has('CONST_SCRIPTCODE')) fail('OP_CODESEPARATOR under CONST_SCRIPTCODE');
+        ctx.codeSepOffset = op.at + 1;
+        ctx.codeSepPos = ctx.opPos;
+      },
+      OP_IF: (s, ctx, exec, _, executing) => {
+        let f = false;
+        if (executing) {
+          const v = pop(s);
+          if ((ctx.sigVersion === 'tapscript'
+               || (ctx.sigVersion === 'witnessV0' && ctx.flags?.has('MINIMALIF')))
+              && !(v.length === 0 || (v.length === 1 && v[0] === 1))) {
+            fail('minimal IF'); // BIP 342 (tapscript) / SCRIPT_VERIFY_MINIMALIF (witness v0)
+          }
+          f = truthy(v);
+        }
+        exec.push(f);
+      },
+      OP_NOTIF: (s, ctx, exec, _, executing) => {
+        let f = false;
+        if (executing) {
+          const v = pop(s);
+          if ((ctx.sigVersion === 'tapscript'
+               || (ctx.sigVersion === 'witnessV0' && ctx.flags?.has('MINIMALIF')))
+              && !(v.length === 0 || (v.length === 1 && v[0] === 1))) {
+            fail('minimal IF');
+          }
+          f = !truthy(v);
+        }
+        exec.push(f);
+      },
+      OP_ELSE: (s, ctx, exec) => {
+        if (!exec.length) fail('unbalanced ELSE');
+        exec[exec.length - 1] = !exec[exec.length - 1];
+      },
+      OP_ENDIF: (s, ctx, exec) => {
+        if (!exec.length) fail('unbalanced ENDIF');
+        exec.pop();
+      },
+      OP_VERIFY: (s) => { if (!truthy(pop(s))) fail('verify failed'); },
+      OP_RETURN: () => fail('op_return'),
+
+      OP_TOALTSTACK: (s, ctx) => ctx.alt.push(pop(s)),
+      OP_FROMALTSTACK: (s, ctx) => { if (!ctx.alt.length) fail('alt underflow'); s.push(ctx.alt.pop()); },
+      OP_2DROP: (s) => { pop(s); pop(s); },
+      OP_2DUP: (s) => { const a = peek(s, 2), b = peek(s, 1); s.push(a, b); },
+      OP_3DUP: (s) => { const a = peek(s, 3), b = peek(s, 2), c = peek(s, 1); s.push(a, b, c); },
+      OP_2OVER: (s) => { const a = peek(s, 4), b = peek(s, 3); s.push(a, b); },
+      OP_2ROT: (s) => { if (s.length < 6) fail('stack underflow'); s.push(...s.splice(s.length - 6, 2)); },
+      OP_2SWAP: (s) => { if (s.length < 4) fail('stack underflow'); s.push(...s.splice(s.length - 4, 2)); },
+      OP_IFDUP: (s) => { if (truthy(peek(s))) s.push(peek(s)); },
+      OP_DEPTH: (s) => pushNum(s, s.length),
+      OP_DROP: (s) => pop(s),
+      OP_DUP: (s) => s.push(peek(s)),
+      OP_NIP: (s) => { const t = pop(s); pop(s); s.push(t); },
+      OP_OVER: (s) => s.push(peek(s, 2)),
+      OP_PICK: (s) => { const n = num(s); if (n < 0 || n >= s.length) fail('pick range'); s.push(s[s.length - 1 - n]); },
+      OP_ROLL: (s) => { const n = num(s); if (n < 0 || n >= s.length) fail('roll range'); s.push(s.splice(s.length - 1 - n, 1)[0]); },
+      OP_ROT: (s) => { if (s.length < 3) fail('stack underflow'); s.push(s.splice(s.length - 3, 1)[0]); },
+      OP_SWAP: (s) => { if (s.length < 2) fail('stack underflow'); s.push(s.splice(s.length - 2, 1)[0]); },
+      OP_TUCK: (s) => { if (s.length < 2) fail('stack underflow'); s.splice(s.length - 2, 0, peek(s)); },
+      OP_SIZE: (s) => pushNum(s, peek(s).length),
+
+      OP_EQUAL: (s) => s.push(boolBytes(eq(pop(s), pop(s)))),
+      OP_EQUALVERIFY: (s) => { if (!eq(pop(s), pop(s))) fail('equalverify'); },
+
+      OP_1ADD: unary((a) => a + 1), OP_1SUB: unary((a) => a - 1),
+      OP_NEGATE: unary((a) => -a), OP_ABS: unary(Math.abs),
+      OP_NOT: (s) => s.push(boolBytes(num(s) === 0)),
+      OP_0NOTEQUAL: (s) => s.push(boolBytes(num(s) !== 0)),
+      OP_ADD: binary((a, b) => a + b), OP_SUB: binary((a, b) => a - b),
+      OP_BOOLAND: binBool((a, b) => a !== 0 && b !== 0),
+      OP_BOOLOR: binBool((a, b) => a !== 0 || b !== 0),
+      OP_NUMEQUAL: binBool((a, b) => a === b),
+      OP_NUMEQUALVERIFY: (s) => { const b = num(s), a = num(s); if (a !== b) fail('numequalverify'); },
+      OP_NUMNOTEQUAL: binBool((a, b) => a !== b),
+      OP_LESSTHAN: binBool((a, b) => a < b),
+      OP_GREATERTHAN: binBool((a, b) => a > b),
+      OP_LESSTHANOREQUAL: binBool((a, b) => a <= b),
+      OP_GREATERTHANOREQUAL: binBool((a, b) => a >= b),
+      OP_MIN: binary(Math.min), OP_MAX: binary(Math.max),
+      OP_WITHIN: (s) => { const max = num(s), min = num(s), x = num(s); s.push(boolBytes(x >= min && x < max)); },
+
+      OP_RIPEMD160: hashOp(ripemd160), OP_SHA1: hashOp(sha1),
+      OP_SHA256: hashOp(sha256), OP_HASH160: hashOp(hash160), OP_HASH256: hashOp(dsha256),
+
+      OP_CHECKSIG: (s, ctx) => {
+        const pub = pop(s), sig = pop(s);
+        const ok = this.#checkSig(sig, pub, ctx);
+        if (!ok && sig.length > 0 && ctx.flags?.has('NULLFAIL')) fail('NULLFAIL');
+        s.push(boolBytes(ok));
+      },
+      OP_CHECKSIGVERIFY: (s, ctx) => {
+        const pub = pop(s), sig = pop(s);
+        const ok = this.#checkSig(sig, pub, ctx);
+        if (!ok && sig.length > 0 && ctx.flags?.has('NULLFAIL')) fail('NULLFAIL');
+        if (!ok) fail('checksigverify');
+      },
+      OP_CHECKMULTISIG: (s, ctx) => {
+        if (ctx.sigVersion === 'tapscript') fail('CHECKMULTISIG disabled in tapscript');
+        s.push(boolBytes(this.#checkMultisig(s, ctx)));
+      },
+      OP_CHECKMULTISIGVERIFY: (s, ctx) => {
+        if (ctx.sigVersion === 'tapscript') fail('CHECKMULTISIG disabled in tapscript');
+        if (!this.#checkMultisig(s, ctx)) fail('checkmultisigverify');
+      },
+      OP_CHECKSIGADD: (s, ctx) => {
+        if (ctx.sigVersion !== 'tapscript') fail('CHECKSIGADD outside tapscript');
+        const pub = pop(s);
+        const n = numDecode(pop(s));
+        const sig = pop(s);
+        s.push(numEncode(n + (this.#checkSigTapscript(sig, pub, ctx) ? 1 : 0)));
+      },
+
+      // BIP 65 / BIP 112 are flag-gated in Core: without the flag the opcode is
+      // the pre-softfork NOP2 / NOP3 (a plain no-op, not "discouraged"). With
+      // no flag set at all (null/undefined, the block-validation default) both
+      // stay enforced, matching the P2SH gate; a flag set that omits them
+      // turns them off.
+      OP_CHECKLOCKTIMEVERIFY: (s, ctx) => {
+        if (ctx.flags != null && !ctx.flags.has('CHECKLOCKTIMEVERIFY')) return;
+        const n = numDecode(peek(s), 5);
+        if (n < 0) fail('negative locktime');
+        const sameKind = (n < 500000000) === (ctx.tx.lockTime < 500000000);
+        if (!sameKind || n > ctx.tx.lockTime) fail('unsatisfied locktime');
+        if (ctx.tx.inputs[ctx.inIndex].sequence === 0xffffffff) fail('final sequence');
+      },
+      OP_CHECKSEQUENCEVERIFY: (s, ctx) => {
+        if (ctx.flags != null && !ctx.flags.has('CHECKSEQUENCEVERIFY')) return;
+        const n = numDecode(peek(s), 5);
+        if (n < 0) fail('negative sequence');
+        if (n & (1 << 31)) return; // disable flag: behaves as NOP
+        const seq = ctx.tx.inputs[ctx.inIndex].sequence;
+        if (ctx.tx.version < 2) fail('csv pre-v2');
+        if (seq & 0x80000000) fail('sequence disable flag set');
+        const typeMask = 1 << 22, valueMask = 0xffff;
+        if ((n & typeMask) !== (seq & typeMask)) fail('sequence type mismatch');
+        if ((n & valueMask) > (seq & valueMask)) fail('unsatisfied sequence');
+      },
+    };
+    for (let i = 1; i <= 16; i++) h[`OP_${i}`] = ((v) => (s) => pushNum(s, v))(i);
+    // OP_NOP1, OP_NOP4..OP_NOP10 are upgradable no-ops; rejected under
+    // SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS. (NOP2/NOP3 are CLTV/CSV.)
+    for (let i = 1; i <= 10; i++) h[`OP_NOP${i}`] = (s, ctx) => {
+      if (ctx.flags?.has('DISCOURAGE_UPGRADABLE_NOPS')) fail('upgradable NOP');
+    };
+    return h;
+  }
+
+  #checkMultisig(s, ctx) {
+    const pop = () => { if (!s.length) fail('stack underflow'); return s.pop(); };
+    const n = numDecode(pop(), 4, this.requireMinimalNum);
+    if (n < 0 || n > this.limits.maxMultisigKeys) fail('pubkey count');
+    ctx._extraOps = (ctx._extraOps || 0) + n; // CHECKMULTISIG adds its key count to the op limit
+    const pubs = [];
+    for (let i = 0; i < n; i++) pubs.push(pop());
+    const m = numDecode(pop(), 4, this.requireMinimalNum);
+    if (m < 0 || m > n) fail('sig count');
+    const sigs = [];
+    for (let i = 0; i < m; i++) sigs.push(pop());
+    const dummy = pop(); // the historical extra-pop dummy
+    if (ctx.flags?.has('NULLDUMMY') && dummy.length !== 0) fail('NULLDUMMY');
+    // sigs and pubs are in stack-pop order (top first) — Core evaluates in
+    // exactly this order, checking the current pair's encoding before the
+    // not-enough-keys early-exit, so a later invalid key/sig may never be
+    // reached. (No reverse: matching is order-preserving for valid cases.)
+    let sigCtx = ctx;
+    if (isLegacy(ctx.sigVersion)) {
+      // Legacy: every signature is FindAndDelete'd from scriptCode before any is checked
+      let code = hexToBytes(ctx.codeSepOffset ? ctx.scriptCode.slice(ctx.codeSepOffset * 2) : ctx.scriptCode);
+      for (const sg of sigs) {
+        const { script, found } = findAndDelete(code, pushEncode(sg));
+        if (found && ctx.flags?.has('CONST_SCRIPTCODE')) fail('SIG_FINDANDDELETE');
+        code = script;
+      }
+      sigCtx = { ...ctx, scriptCode: bytesToHex(code), codeSepOffset: 0, _sigsDeleted: true };
+    }
+    let isig = 0, ikey = 0, success = true;
+    while (success && isig < sigs.length) {
+      if (this.#checkSig(sigs[isig], pubs[ikey], sigCtx)) isig++;
+      ikey++;
+      if (sigs.length - isig > pubs.length - ikey) success = false;
+    }
+    const ok = success && isig === sigs.length;
+    // BIP 146: a failed multisig requires every signature to be empty
+    if (!ok && ctx.flags?.has('NULLFAIL')) {
+      for (const sg of sigs) if (sg.length > 0) fail('NULLFAIL');
+    }
+    return ok;
+  }
+
+  // ---- execution ----
+
+  // Execute one script against a stack. ctx: {tx, inIndex, scriptCode,
+  // amount, sigVersion, alt}. Returns {ok, error?}; stack is mutated.
+  execute(scriptHex, stack, ctx = {}) {
+    try {
+      // BIP342: tapscript has no per-script size limit. The legacy 10kB
+      // MAX_SCRIPT_SIZE does not apply; a tapscript's size is bounded only by the
+      // transaction/block weight limit (it has to fit in a block).
+      if (ctx.sigVersion !== 'tapscript' && scriptHex.length / 2 > this.limits.maxScriptSize) fail('script too large');
+      ctx.alt = ctx.alt ?? [];
+      ctx.scriptCode = ctx.scriptCode ?? scriptHex;
+      ctx.codeSepOffset = 0;          // bytes before the last executed OP_CODESEPARATOR; reset per script run
+      ctx.codeSepPos = 0xffffffff;    // BIP 342: opcode position of the last executed OP_CODESEPARATOR, none yet
+      this.requireMinimalNum = !!ctx.flags?.has('MINIMALDATA'); // for the shared num() helper
+
+      const ops = this.scriptEngine.parse(scriptHex);
+      if (ctx.sigVersion === 'tapscript') {
+        // BIP 342: OP_SUCCESSx is decided at parse time, before execution
+        for (const op of ops) {
+          if (op.error) fail(op.error);
+          if (op.data == null && this.#isOpSuccess(op.code)) return { ok: true, opSuccess: true };
+        }
+      }
+      const exec = [];
+      let opCount = 0, opPos = 0;
+      for (const op of ops) {
+        if (op.error) fail(op.error);
+        ctx.opPos = opPos++; // Core's opcode_pos: every opcode read counts, pushes included
+        const executing = exec.every(Boolean);
+        if (op.data != null) {
+          if (op.data.length / 2 > this.limits.maxScriptElementSize) fail('push too large');
+          if (executing) {
+            if (ctx.flags?.has('MINIMALDATA') && !minimalPushOk(op.code, op.data)) fail('non-minimal data push');
+            stack.push(hexToBytes(op.data));
+          }
+          continue;
+        }
+        // BIP342: tapscript removes the 201-non-push-opcode-per-script limit
+        // entirely (there is no opcode-count cap). Signature-checking cost is
+        // instead bounded separately by the per-input sigops budget.
+        if (ctx.sigVersion !== 'tapscript' && op.code > 0x60 && ++opCount > this.limits.maxOpsPerScript) fail('op count');
+        if (this.#isDisabled(op.name)) fail(`disabled opcode ${op.name}`);
+        const isBranch = ['OP_IF', 'OP_NOTIF', 'OP_ELSE', 'OP_ENDIF'].includes(op.name);
+        if (!executing && !isBranch) continue;
+        const handler = this.handlers[op.name];
+        if (!handler) fail(`bad opcode ${op.name}`);
+        handler(stack, ctx, exec, op, executing);
+        if (ctx._extraOps) { // CHECKMULTISIG key count, counted after the op runs
+          opCount += ctx._extraOps; ctx._extraOps = 0;
+          if (opCount > this.limits.maxOpsPerScript) fail('op count');
+        }
+        if (stack.length + ctx.alt.length > this.limits.maxStackSize) fail('stack size');
+      }
+      if (exec.length) fail('unbalanced conditional');
+      return { ok: true };
+    } catch (e) {
+      if (e instanceof ScriptError) return { ok: false, error: e.message };
+      throw e;
+    }
+  }
+
+  #isDisabled(name) {
+    return ['OP_CAT', 'OP_SUBSTR', 'OP_LEFT', 'OP_RIGHT', 'OP_INVERT', 'OP_AND', 'OP_OR',
+      'OP_XOR', 'OP_2MUL', 'OP_2DIV', 'OP_MUL', 'OP_DIV', 'OP_MOD', 'OP_LSHIFT', 'OP_RSHIFT',
+      'OP_VERIF', 'OP_VERNOTIF'].includes(name);
+  }
+
+  // BIP 342 OP_SUCCESSx set: these byte values make a tapscript
+  // unconditionally valid, reserving them for future upgrades.
+  #isOpSuccess(code) {
+    return code === 80 || code === 98
+      || (code >= 126 && code <= 129) || (code >= 131 && code <= 134)
+      || code === 137 || code === 138 || code === 141 || code === 142
+      || (code >= 149 && code <= 153) || (code >= 187 && code <= 254);
+  }
+
+
+  // Core's VerifyWitnessProgram. `isP2SH` matters for v1: a P2SH-wrapped
+  // 32-byte v1 program is not taproot (BIP 341) and falls through as unknown.
+  #verifyWitnessProgram(tx, inIndex, version, programHex, amount, flags, isP2SH, allPrevouts, unified = false) {
+    const extra = { prevouts: allPrevouts, unified };
+    const witness = (tx.witness?.[inIndex] ?? []).map(hexToBytes);
+    if (version === 0) {
+      if (programHex.length === 64) { // BIP 141 P2WSH
+        if (!witness.length) return { ok: false, error: 'WITNESS_PROGRAM_WITNESS_EMPTY' };
+        const witnessScript = witness.pop();
+        if (bytesToHex(sha256(witnessScript)) !== programHex) return { ok: false, error: 'WITNESS_PROGRAM_MISMATCH' };
+        return this.#executeWitnessScript(witness, bytesToHex(witnessScript), tx, inIndex, amount, flags, extra);
+      }
+      if (programHex.length === 40) { // BIP 141 P2WPKH
+        if (witness.length !== 2) return { ok: false, error: 'WITNESS_PROGRAM_MISMATCH' };
+        return this.#executeWitnessScript(witness, '76a914' + programHex + '88ac', tx, inIndex, amount, flags, extra);
+      }
+      return { ok: false, error: 'WITNESS_PROGRAM_WRONG_LENGTH' };
+    }
+    if (version === 1 && programHex.length === 64 && !isP2SH) { // BIP 341 taproot
+      if (flags && !flags.has('TAPROOT')) return { ok: true }; // not enabled: anyone-can-spend, as in Core
+      if (!allPrevouts) return { ok: null, reason: 'taproot needs every input prevout resolved' };
+      return this.#verifyTaproot(tx, inIndex, allPrevouts, flags, unified);
+    }
+    // BIP 431 pay-to-anchor: Core accepts OP_1 <0x4e73> with an empty witness
+    // outright, bare (not P2SH-wrapped), even under DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM.
+    if (version === 1 && programHex === '4e73' && !isP2SH && witness.length === 0) return { ok: true, path: 'anchor' };
+    if (flags?.has('DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM')) return { ok: false, error: 'DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM' };
+    // Core returns success here (future soft-fork compatibility); we decline
+    // to vouch for rules we do not know rather than claim they passed.
+    return { ok: null, reason: 'unknown witness version' };
+  }
+
+  // Core's ExecuteWitnessScript for witness v0: 520-byte cap on every initial
+  // stack element, evaluate, exactly one truthy element must remain.
+  #executeWitnessScript(stack, scriptHex, tx, inIndex, amount, flags, extra = {}) {
+    for (const el of stack) if (el.length > this.limits.maxScriptElementSize) return { ok: false, error: 'PUSH_SIZE' };
+    const st = stack.map((w) => Uint8Array.from(w));
+    const r = this.execute(scriptHex, st, { tx, inIndex, amount, sigVersion: 'witnessV0', scriptCode: scriptHex, flags, ...extra });
+    if (!r.ok) return r;
+    if (st.length !== 1) return { ok: false, error: 'CLEANSTACK' };
+    return truthy(st[0]) ? { ok: true } : { ok: false, error: 'EVAL_FALSE' };
+  }
+
+  // BIP 341 taproot spend verification: key path (one Schnorr signature
+  // with the tweaked output key) or script path (reveal a leaf script and
+  // a control block proving its commitment, then execute as tapscript).
+  #verifyTaproot(tx, inIndex, prevouts, flags = null, unified = false) {
+    const program = hexToBytes(prevouts[inIndex].scriptPubKey.slice(4));
+    const witness = (tx.witness?.[inIndex] ?? []).map(hexToBytes);
+    if (!witness.length) return { ok: false, error: 'empty taproot witness' };
+
+    // total serialized witness size, for the tapscript sigops budget
+    const witnessSize = witness.reduce((s, w) =>
+      s + w.length + (w.length < 0xfd ? 1 : w.length <= 0xffff ? 3 : 5), 1);
+
+    let annex = null;
+    if (witness.length >= 2 && witness[witness.length - 1][0] === 0x50) annex = witness.pop();
+
+    if (witness.length === 1) { // key path
+      const raw = witness[0];
+      let hashType = 0x00, sig = raw;
+      if (raw.length === 65) {
+        hashType = raw[64];
+        if (hashType === 0x00) return { ok: false, error: 'explicit SIGHASH_DEFAULT in 65-byte signature' };
+        sig = raw.subarray(0, 64);
+      } else if (raw.length !== 64) return { ok: false, error: 'bad key-path signature size' };
+      try {
+        const msg = (unified && (hashType & SIGHASH_UNIFIED))
+          ? this.sighashUnified(tx, inIndex, prevouts, hashType, 2, { annex })
+          : this.sighashTaproot(tx, inIndex, prevouts, hashType, { annex });
+        return verifySchnorr(msg, sig, program)
+          ? { ok: true, path: 'key' } : { ok: false, error: 'invalid key-path schnorr signature' };
+      } catch (e) {
+        if (e instanceof ScriptError) return { ok: false, error: e.message };
+        throw e;
+      }
+    }
+
+    // script path
+    const control = witness.pop();
+    const script = witness.pop();
+    if (control.length < 33 || (control.length - 33) % 32 !== 0 || control.length > 33 + 32 * 128) {
+      return { ok: false, error: 'bad control block size' };
+    }
+    const leafVersion = control[0] & 0xfe;
+    const parity = control[0] & 0x01;
+    const internalKey = control.subarray(1, 33);
+    const leafHash = taggedHash('TapLeaf', Uint8Array.of(leafVersion), compactSize(script.length), script);
+    let k = leafHash;
+    for (let i = 33; i < control.length; i += 32) {
+      const e = control.subarray(i, i + 32);
+      const less = bytesToHex(k) < bytesToHex(e);
+      k = less ? taggedHash('TapBranch', k, e) : taggedHash('TapBranch', e, k);
+    }
+    if (!checkTapTweak(internalKey, k, program, parity)) {
+      return { ok: false, error: 'control block commitment mismatch' };
+    }
+    if (leafVersion !== 0xc0) return { ok: null, reason: 'unknown tapleaf version', path: 'script' };
+
+    const stack = witness; // remaining items are the initial stack
+    const scriptHex = bytesToHex(script);
+    const ctx = {
+      tx, inIndex, prevouts, amount: prevouts[inIndex].value,
+      sigVersion: 'tapscript', leafHash, annex, budget: { n: 50 + witnessSize }, flags, unified,
+    };
+    const r = this.execute(scriptHex, stack, ctx);
+    if (!r.ok) return { ...r, path: 'script' };
+    if (r.opSuccess) return { ok: true, path: 'script' };
+    return (stack.length === 1 && truthy(stack[0]))
+      ? { ok: true, path: 'script' } : { ok: false, error: 'tapscript evaluated false', path: 'script' };
+  }
+
+  // Verify one input against its prevout. For taproot, `allPrevouts` (one
+  // {value, scriptPubKey} per input, in order) is required because the
+  // BIP 341 sighash commits to all of them. Returns {ok: true|false|null};
+  // null = honestly unverifiable (missing prevouts / future versions).
+  // `unifiedSighash`: whether Knots' unified opt-in sighash applies (the block
+  // is at or past the chain's activation height); an opted-in signature is
+  // then verified against that message, and needs `allPrevouts` like taproot.
+  verifyInput(tx, inIndex, prevout, allPrevouts = null, flags = null, { unifiedSighash = false } = {}) {
+    try {
+      return this.#verifyInput(tx, inIndex, prevout, allPrevouts, flags, unifiedSighash);
+    } catch (e) {
+      if (e instanceof NeedsPrevouts) return { ok: null, reason: 'unified sighash needs every input prevout resolved', type: this.scriptEngine.classify(prevout.scriptPubKey).type };
+      throw e;
+    }
+  }
+
+  #verifyInput(tx, inIndex, prevout, allPrevouts, flags, unified) {
+    // Core's VerifyScript, in its order: scriptSig then scriptPubKey on one
+    // stack; bare witness program; P2SH (redeem script, then a wrapped witness
+    // program); CLEANSTACK; unexpected witness. P2SH and segwit are only active
+    // under their flags; legacy callers (flags=null) keep both on, and a P2SH-
+    // or witness-shaped scriptPubKey runs as a plain script when they are off.
+    const spk = prevout.scriptPubKey;
+    let type = this.scriptEngine.classify(spk).type;
+    const input = tx.inputs[inIndex];
+    const ctx = { tx, inIndex, amount: prevout.value, sigVersion: 'legacy', flags, prevouts: allPrevouts, unified };
+    const p2shActive = flags === null || flags.has('P2SH');
+    const witnessActive = flags === null || flags.has('WITNESS');
+    const pushOnly = this.scriptEngine.parse(input.scriptSig).every((o) => o.code <= 0x60);
+    if (flags?.has('SIGPUSHONLY') && !pushOnly) return { ok: false, error: 'SIG_PUSHONLY', type };
+
+    let stack = [];
+    let r = this.execute(input.scriptSig, stack, { ...ctx, scriptCode: input.scriptSig });
+    if (!r.ok) return { ...r, type };
+    const stackCopy = p2shActive ? stack.slice() : null;
+    r = this.execute(spk, stack, { ...ctx, scriptCode: spk });
+    if (!r.ok) return { ...r, type };
+    if (!stack.length || !truthy(stack[stack.length - 1])) return { ok: false, error: 'EVAL_FALSE', type };
+
+    let hadWitness = false, witnessResult = {};
+    const bare = witnessActive ? witnessProgram(spk) : null;
+    if (bare) {
+      hadWitness = true;
+      if (input.scriptSig.length) return { ok: false, error: 'WITNESS_MALLEATED', type };
+      const w = this.#verifyWitnessProgram(tx, inIndex, bare.version, bare.program, prevout.value, flags, false, allPrevouts, unified);
+      if (w.ok !== true) return { ...w, type };
+      witnessResult = w; // keeps e.g. the taproot `path`
+      stack = [Uint8Array.of(1)]; // Core's stack.resize(1): one element, so the CLEANSTACK check below passes
+    } else if (p2shActive && type === 'p2sh') {
+      if (!pushOnly) return { ok: false, error: 'SIG_PUSHONLY', type };
+      stack = stackCopy; // the stack as scriptSig left it; its top is the redeem script
+      const redeem = stack.pop();
+      const redeemHex = bytesToHex(redeem);
+      const redeemType = this.scriptEngine.classify(redeemHex).type;
+      type = `p2sh-${redeemType}`;
+      r = this.execute(redeemHex, stack, { ...ctx, scriptCode: redeemHex });
+      if (!r.ok) return { ...r, type };
+      if (!stack.length || !truthy(stack[stack.length - 1])) return { ok: false, error: 'EVAL_FALSE', type };
+      const wrapped = witnessActive ? witnessProgram(redeemHex) : null;
+      if (wrapped) {
+        hadWitness = true;
+        // the scriptSig must be exactly one push of the redeem script
+        if (input.scriptSig !== bytesToHex(pushEncode(redeem))) return { ok: false, error: 'WITNESS_MALLEATED_P2SH', type };
+        const w = this.#verifyWitnessProgram(tx, inIndex, wrapped.version, wrapped.program, prevout.value, flags, true, allPrevouts, unified);
+        if (w.ok !== true) return { ...w, type };
+        witnessResult = w;
+        stack = [Uint8Array.of(1)];
+      }
+    }
+    if (flags?.has('CLEANSTACK') && stack.length !== 1) return { ok: false, error: 'CLEANSTACK', type };
+    if (witnessActive && !hadWitness && (tx.witness?.[inIndex] ?? []).length) return { ok: false, error: 'WITNESS_UNEXPECTED', type };
+    return { ...witnessResult, ok: true, type };
+  }
+}
diff --git a/vendor/sidestr/schema/codec/kernel.js b/vendor/sidestr/schema/codec/kernel.js
new file mode 100644
index 0000000..6cf89c5
--- /dev/null
+++ b/vendor/sidestr/schema/codec/kernel.js
@@ -0,0 +1,31 @@
+// One entry point that wires the schema-driven engines for a network, with
+// optional overlays (see overlay.js). An overlay is { graph, install?, installChecks? }:
+//   graph                  its JSON-LD (chains, structs, rules)
+//   install(codec)         runs before the chain is bound: proof-of-work hashes, derived fields
+//   installChecks(engines) runs after the engines exist: the checks behind its rules
+// With no overlays this is exactly the hand wiring the tests and apps have always done.
+import { Codec } from './codec.js';
+import { ScriptEngine } from './script.js';
+import { ScriptInterpreter } from './interpreter.js';
+import { HeaderEngine } from './headers.js';
+import { BlockEngine } from './blocks.js';
+import { mergeSchemas } from './overlay.js';
+
+export function createKernel({ core, proof, script, chain, validate, network = 'btc:mainnet', overlays = [] }) {
+  const graphs = overlays.map((o) => o.graph);
+  const chainG = mergeSchemas(chain, ...graphs);
+  const validateG = mergeSchemas(validate, ...graphs);
+  const net = chainG['@graph'].find((n) => n['@id'] === network);
+  if (!net) throw new Error(`unknown network: ${network}`);
+  if (net.extends) throw new Error(`${network} extends unknown ${net.extends}`);
+  const codec = new Codec(core, proof, ...graphs);
+  for (const o of overlays) o.install?.(codec); // PoW hashes, derived fields — before the chain is bound
+  const headers = HeaderEngine.fromSchemas(codec, chainG, validateG, network);
+  const scriptEngine = script ? ScriptEngine.fromSchemas(script, chainG, network) : null;
+  const limits = script?.['@graph'].find((n) => n['@id'] === 'btc:scriptLimits');
+  const interpreter = scriptEngine ? new ScriptInterpreter(codec, scriptEngine, limits) : null;
+  const blocks = BlockEngine.fromSchemas(codec, chainG, validateG, script, network);
+  const engines = { codec, headers, blocks, script: scriptEngine, interpreter, network, params: headers.params, schemas: { chain: chainG, validate: validateG } };
+  for (const o of overlays) o.installChecks?.(engines);
+  return engines;
+}
diff --git a/vendor/sidestr/schema/codec/nostr.js b/vendor/sidestr/schema/codec/nostr.js
new file mode 100644
index 0000000..a63bd7e
--- /dev/null
+++ b/vendor/sidestr/schema/codec/nostr.js
@@ -0,0 +1,124 @@
+// A LightNode header source backed by the NIP-333 live stream: kind-33333
+// parameterized replaceable events carrying the newest 12 headers, one
+// stream per network (d = network code). See https://nip-333.github.io/.
+//
+// READ-ONLY by design: this module verifies events (NIP-01 id hash plus
+// BIP-340 signature, using our own verifier) and never signs anything —
+// publishing lives outside the schema. The publisher key is a filter, not
+// a security boundary: headers from here pass the same LightNode
+// validation rules as headers from any other source.
+//
+// Within its 12-header window the source serves both LightNode contracts:
+// headersAfter(tipHash) for syncP2p-style tip following, and
+// tipHeight()/headersRange() so the divergence cross-check can use it.
+
+import { sha256, hexToBytes, bytesToHex } from './hash.js';
+import { verifySchnorr } from './secp256k1.js';
+
+const HEADER_HEX = 160; // 80 bytes
+const KIND = 33333;
+
+// NIP-01: id is the sha256 of the canonical serialization; sig is BIP-340
+// over the id. Returns true iff both hold.
+export function verifyNostrEvent(event) {
+  const serial = JSON.stringify([
+    0, event.pubkey, event.created_at, event.kind, event.tags, event.content,
+  ]);
+  if (bytesToHex(sha256(new TextEncoder().encode(serial))) !== event.id) return false;
+  return verifySchnorr(hexToBytes(event.id), hexToBytes(event.sig), hexToBytes(event.pubkey));
+}
+
+export class NostrSource {
+  constructor({ relays, pubkey, network, codec, verifySig = true, timeoutMs = 8000 }) {
+    if (!relays?.length) throw new Error('NostrSource needs at least one relay');
+    this.relays = relays;
+    this.pubkey = pubkey;
+    this.network = network; // NIP-333 code: btc | tbtc3 | tbtc4
+    this.codec = codec;
+    this.verifySig = verifySig;
+    this.timeoutMs = timeoutMs;
+    this.base = `nostr://${network}`;
+    this.lastEvent = null; // newest accepted event, for callers that care
+  }
+
+  // newest matching event from one relay; null on miss/timeout/junk
+  #fetchFrom(url) {
+    return new Promise((resolve) => {
+      let ws;
+      const done = (v) => { clearTimeout(timer); try { ws?.close(); } catch { /* closing */ } resolve(v); };
+      const timer = setTimeout(() => done(null), this.timeoutMs);
+      try { ws = new WebSocket(url); } catch { return done(null); }
+      ws.binaryType = 'arraybuffer';
+      let newest = null;
+      ws.onopen = () => ws.send(JSON.stringify(['REQ', 'nostr-source',
+        { kinds: [KIND], authors: [this.pubkey], '#d': [this.network], limit: 1 }]));
+      ws.onmessage = (ev) => {
+        const m = JSON.parse(typeof ev.data === 'string' ? ev.data : new TextDecoder().decode(ev.data));
+        if (m[0] === 'EVENT') {
+          const e = m[2];
+          // never trust relay filtering — re-check everything ourselves
+          const d = e.tags?.find((t) => t[0] === 'd')?.[1];
+          if (e.kind === KIND && e.pubkey === this.pubkey && d === this.network
+              && (!newest || e.created_at > newest.created_at)) newest = e;
+        } else if (m[0] === 'EOSE') done(newest);
+      };
+      ws.onerror = () => done(newest);
+      ws.onclose = () => done(newest);
+    });
+  }
+
+  // newest event across all relays, signature-checked; throws if nothing usable
+  async #fetchEvent() {
+    const events = (await Promise.all(this.relays.map((r) => this.#fetchFrom(r)))).filter(Boolean);
+    const ok = this.verifySig ? events.filter((e) => verifyNostrEvent(e)) : events;
+    if (!ok.length) throw new Error(`${this.base}: no valid event on ${this.relays.length} relay(s)`);
+    this.lastEvent = ok.reduce((a, b) => (b.created_at > a.created_at ? b : a));
+    return this.lastEvent;
+  }
+
+  // the event's 12 headers as [{hex, hash, prevBlockHash}], ascending
+  #window(event) {
+    const c = event.content ?? '';
+    if (!/^[0-9a-f]+$/.test(c) || c.length % HEADER_HEX !== 0 || !c.length) {
+      throw new Error(`${this.base}: malformed event content`);
+    }
+    const out = [];
+    for (let i = 0; i < c.length / HEADER_HEX; i++) {
+      const hex = c.slice(i * HEADER_HEX, (i + 1) * HEADER_HEX);
+      const header = this.codec.decode('BlockHeader', hex);
+      out.push({ hex, hash: this.codec.blockHash(header), prevBlockHash: header.prevBlockHash });
+    }
+    return out;
+  }
+
+  #tip(event) {
+    const tip = parseInt(event.tags.find((t) => t[0] === 'tip')?.[1] ?? '', 10);
+    if (!Number.isFinite(tip)) throw new Error(`${this.base}: event has no tip tag`);
+    return tip;
+  }
+
+  // headers strictly after tipHash, [] if we can't connect to it — the
+  // window only reaches 12 back, so a node further behind needs another
+  // source (or the NIP's u-tag bulk channels) first.
+  async headersAfter(tipHash) {
+    const w = this.#window(await this.#fetchEvent());
+    if (w[0].prevBlockHash === tipHash) return w.map((h) => h.hex);
+    const i = w.findIndex((h) => h.hash === tipHash);
+    return i < 0 ? [] : w.slice(i + 1).map((h) => h.hex);
+  }
+
+  async tipHeight() { return this.#tip(await this.#fetchEvent()); }
+
+  // serve heights inside the window; throw outside it (the cross-check
+  // treats an unreachable source as not-divergence, which is honest)
+  async headersRange(start, count) {
+    const event = await this.#fetchEvent();
+    const w = this.#window(event);
+    const tip = this.#tip(event);
+    const first = tip - w.length + 1;
+    if (start < first || start + count - 1 > tip) {
+      throw new Error(`${this.base}: heights ${start}..${start + count - 1} outside window ${first}..${tip}`);
+    }
+    return w.slice(start - first, start - first + count).map((h) => h.hex);
+  }
+}
diff --git a/vendor/sidestr/schema/codec/overlay.js b/vendor/sidestr/schema/codec/overlay.js
new file mode 100644
index 0000000..eb432e3
--- /dev/null
+++ b/vendor/sidestr/schema/codec/overlay.js
@@ -0,0 +1,50 @@
+// Schema overlays: a chain, a structure or a rule that is not part of the
+// Bitcoin model arrives as another JSON-LD graph and is merged in *additively*.
+// An overlay may only add nodes; redefining an `@id` that already exists is an
+// error, so the base model cannot be edited by an overlay, only extended.
+// A node may `extends` an earlier node: missing keys are copied from it, so a
+// forked chain declares just what differs from the chain it forked.
+//
+// An overlay is one graph spanning modules (chains, structs, rules), while the
+// base model is several documents, so a merge into one document leaves
+// references it cannot see (an `extends` or `ruleSet` that lives in another
+// document) untouched for the merge that can. Only a reference that resolves
+// to the wrong kind of node is an error here; a chain that never resolved its
+// `extends` is refused by createKernel.
+export function mergeSchemas(base, ...overlays) {
+  const graph = [];
+  const byId = new Map();
+  const add = (node, origin) => {
+    const id = node['@id'];
+    if (id && byId.has(id)) throw new Error(`overlay ${origin} redefines ${id}`);
+    const parent = node.extends ? byId.get(node.extends) : null;
+    if (parent) {
+      const { extends: _, ...own } = node;
+      node = { ...parent, ...own, '@id': id };
+    }
+    if (id) byId.set(id, node);
+    graph.push(node);
+  };
+  for (const node of base['@graph'] ?? []) add(node, 'base');
+  overlays.forEach((o, i) => { for (const node of o['@graph'] ?? []) add(node, o['@id'] ?? `#${i + 1}`); });
+  // A ValidationRule node with `ruleSet` joins that set (appended, in overlay
+  // order). The set node is cloned first so the base graph is never mutated.
+  for (const node of graph.slice()) {
+    if (node['@type'] !== 'ValidationRule' || !node.ruleSet) continue;
+    const set = byId.get(node.ruleSet);
+    if (!set) continue; // lives in another document
+    if (set['@type'] !== 'RuleSet') throw new Error(`${node['@id']}: ruleSet ${node.ruleSet} is not a RuleSet`);
+    if (!set.__overlayClone) {
+      const clone = { ...set, rules: [...(set.rules ?? [])] };
+      Object.defineProperty(clone, '__overlayClone', { value: true, enumerable: false });
+      graph[graph.indexOf(set)] = clone; byId.set(set['@id'], clone);
+    }
+    byId.get(node.ruleSet).rules.push(node);
+  }
+  // JSON-LD contexts: a base file references its context by string; overlays
+  // add prefixes as objects. Keep both as an array of contexts (valid JSON-LD)
+  // rather than merging a string into an object.
+  const contexts = [base['@context'], ...overlays.map((o) => o['@context'])].filter((c) => c != null);
+  const context = contexts.length === 1 ? contexts[0] : contexts;
+  return { ...base, '@context': context, '@graph': graph };
+}
diff --git a/vendor/sidestr/schema/codec/overlays/knots-blake2b.js b/vendor/sidestr/schema/codec/overlays/knots-blake2b.js
new file mode 100644
index 0000000..7818110
--- /dev/null
+++ b/vendor/sidestr/schema/codec/overlays/knots-blake2b.js
@@ -0,0 +1,66 @@
+// Code half of the Bitcoin Knots BLAKE2b overlay (data half:
+// schema/overlays/knots-blake2b.jsonld). Installs the proof-of-work hash, the
+// derived `time` of a v2 header, and the checks behind the overlay's rules.
+// Semantics follow Knots v29.4.1 validation.cpp; error codes are Knots'.
+import { registerKnotsBlake2b, headerTime, isHeaderV2 } from '../pow/knots-header-v2.js';
+import { hexToBytes } from '../hash.js';
+
+export const REDUCED_DATA_MAX_BLOCK_WEIGHT = 800000;
+
+// RDTS applies to exactly the blocks from the fork height until the parent's
+// median-time-past reaches the expiry (Consensus::Params::RdtsActiveAt).
+export const rdtsActiveAt = (params, height, mtpPrev) =>
+  height >= params.blake2bHeight && mtpPrev < params.rdtsExpiryTime;
+
+const containsBytes = (hay, needle) => {
+  if (!needle.length) return true;
+  outer: for (let i = 0; i + needle.length <= hay.length; i++) {
+    for (let j = 0; j < needle.length; j++) if (hay[i + j] !== needle[j]) continue outer;
+    return true;
+  }
+  return false;
+};
+
+export function headerChecks(params) {
+  return {
+    // CheckBlockHeader: a v2 header's committed height must be at/after the fork
+    'knots:rule-header-v1-until-fork': ({ header }) => !isHeaderV2(header) || header.height >= params.blake2bHeight,
+    // ContextualCheckBlockHeader: from the fork height every header is v2
+    'knots:rule-header-v2-from-fork': ({ header, height }) => height == null ? null : (height < params.blake2bHeight || isHeaderV2(header)),
+    'knots:rule-header-height': ({ header, height }) => !isHeaderV2(header) ? true : height == null ? null : header.height === height,
+    'knots:rule-header-flags-reserved': ({ header }) => !isHeaderV2(header) || (header.flags & 0xc0) === 0,
+  };
+}
+
+export function blockChecks(params, engine) {
+  const headline = params.blake2bHeadline ? new TextEncoder().encode(params.blake2bHeadline) : new Uint8Array(0);
+  return {
+    block: {
+      'knots:rule-block-txcount': ({ block }) => !isHeaderV2(block.header) || block.header.txCount === block.transactions.length,
+      'knots:rule-block-headline': ({ block }) => {
+        if (!isHeaderV2(block.header) || block.header.height !== params.blake2bHeight) return true;
+        const cb = block.transactions[0];
+        return !!cb && containsBytes(hexToBytes(cb.inputs[0].scriptSig), headline);
+      },
+    },
+    blockContext: {
+      'knots:rule-blockctx-weight-rdts': ({ block, height, mtp }) => {
+        if (height == null || mtp == null) return null;
+        return !rdtsActiveAt(params, height, mtp) || engine.blockWeight(block) <= REDUCED_DATA_MAX_BLOCK_WEIGHT;
+      },
+    },
+  };
+}
+
+// createKernel overlay object; `graph` is supplied by the caller (the JSON-LD).
+export const knotsBlake2b = (graph) => ({
+  graph,
+  install(codec) {
+    registerKnotsBlake2b(codec);
+    codec.registerDerived('knots:BlockHeaderV2', (h) => ({ time: headerTime(h) }));
+  },
+  installChecks({ headers, blocks, params }) {
+    headers.registerChecks(headerChecks(params));
+    blocks.registerChecks(blockChecks(params, blocks));
+  },
+});
diff --git a/vendor/sidestr/schema/codec/pow/blake2b.js b/vendor/sidestr/schema/codec/pow/blake2b.js
new file mode 100644
index 0000000..131b780
--- /dev/null
+++ b/vendor/sidestr/schema/codec/pow/blake2b.js
@@ -0,0 +1,87 @@
+// Pure-JS BLAKE2b (RFC 7693), unkeyed, arbitrary output length 1..64.
+// 64-bit words are held as [lo, hi] uint32 pairs so this runs anywhere.
+// The Knots hardfork uses blake2b_nokey(out, 32, in, len) — note that a
+// 32-byte digest is NOT a truncated blake2b-512: the output length is mixed
+// into the parameter block, so the IV differs. Hence this implementation.
+
+const IV = new Uint32Array([
+  0xf3bcc908, 0x6a09e667, 0x84caa73b, 0xbb67ae85, 0xfe94f82b, 0x3c6ef372, 0x5f1d36f1, 0xa54ff53a,
+  0xade682d1, 0x510e527f, 0x2b3e6c1f, 0x9b05688c, 0xfb41bd6b, 0x1f83d9ab, 0x137e2179, 0x5be0cd19,
+]);
+const SIGMA = [
+  [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15],
+  [14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3],
+  [11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4],
+  [7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8],
+  [9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13],
+  [2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9],
+  [12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11],
+  [13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10],
+  [6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5],
+  [10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0],
+  [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15],
+  [14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3],
+].flat().map((x) => x * 2);
+
+const v = new Uint32Array(32), m = new Uint32Array(32);
+
+function add64AA(a, b) { // v[a] += v[b]
+  const o0 = v[a] + v[b]; let o1 = v[a + 1] + v[b + 1]; if (o0 >= 0x100000000) o1++;
+  v[a] = o0; v[a + 1] = o1;
+}
+function add64AC(a, b0, b1) { // v[a] += (b0, b1)
+  let o0 = v[a] + b0; if (b0 < 0) o0 += 0x100000000;
+  let o1 = v[a + 1] + b1; if (o0 >= 0x100000000) o1++;
+  v[a] = o0; v[a + 1] = o1;
+}
+function G(a, b, c, d, ix, iy) {
+  const x0 = m[ix], x1 = m[ix + 1], y0 = m[iy], y1 = m[iy + 1];
+  add64AA(a, b); add64AC(a, x0, x1);
+  let xor0 = v[d] ^ v[a], xor1 = v[d + 1] ^ v[a + 1];
+  v[d] = xor1; v[d + 1] = xor0;                                             // rotr 32
+  add64AA(c, d);
+  xor0 = v[b] ^ v[c]; xor1 = v[b + 1] ^ v[c + 1];
+  v[b] = (xor0 >>> 24) ^ (xor1 << 8); v[b + 1] = (xor1 >>> 24) ^ (xor0 << 8); // rotr 24
+  add64AA(a, b); add64AC(a, y0, y1);
+  xor0 = v[d] ^ v[a]; xor1 = v[d + 1] ^ v[a + 1];
+  v[d] = (xor0 >>> 16) ^ (xor1 << 16); v[d + 1] = (xor1 >>> 16) ^ (xor0 << 16); // rotr 16
+  add64AA(c, d);
+  xor0 = v[b] ^ v[c]; xor1 = v[b + 1] ^ v[c + 1];
+  v[b] = (xor1 >>> 31) ^ (xor0 << 1); v[b + 1] = (xor0 >>> 31) ^ (xor1 << 1); // rotr 63
+}
+
+function compress(ctx, last) {
+  for (let i = 0; i < 16; i++) { v[i] = ctx.h[i]; v[i + 16] = IV[i]; }
+  v[24] ^= ctx.t; v[25] ^= ctx.t / 0x100000000;
+  if (last) { v[28] = ~v[28]; v[29] = ~v[29]; }
+  const b = ctx.b;
+  for (let i = 0; i < 32; i++) m[i] = b[4 * i] ^ (b[4 * i + 1] << 8) ^ (b[4 * i + 2] << 16) ^ (b[4 * i + 3] << 24);
+  for (let r = 0; r < 12; r++) {
+    const s = r * 16;
+    G(0, 8, 16, 24, SIGMA[s + 0], SIGMA[s + 1]);
+    G(2, 10, 18, 26, SIGMA[s + 2], SIGMA[s + 3]);
+    G(4, 12, 20, 28, SIGMA[s + 4], SIGMA[s + 5]);
+    G(6, 14, 22, 30, SIGMA[s + 6], SIGMA[s + 7]);
+    G(0, 10, 20, 30, SIGMA[s + 8], SIGMA[s + 9]);
+    G(2, 12, 22, 24, SIGMA[s + 10], SIGMA[s + 11]);
+    G(4, 14, 16, 26, SIGMA[s + 12], SIGMA[s + 13]);
+    G(6, 8, 18, 28, SIGMA[s + 14], SIGMA[s + 15]);
+  }
+  for (let i = 0; i < 16; i++) ctx.h[i] ^= v[i] ^ v[i + 16];
+}
+
+export function blake2b(input, outlen = 32) {
+  if (!(outlen > 0 && outlen <= 64)) throw new Error('blake2b: outlen must be 1..64');
+  const ctx = { h: new Uint32Array(IV), b: new Uint8Array(128), c: 0, t: 0, outlen };
+  ctx.h[0] ^= 0x01010000 ^ outlen; // parameter block: digest_length, key_length=0, fanout=1, depth=1
+  for (let i = 0; i < input.length; i++) {
+    if (ctx.c === 128) { ctx.t += ctx.c; compress(ctx, false); ctx.c = 0; }
+    ctx.b[ctx.c++] = input[i];
+  }
+  ctx.t += ctx.c;
+  while (ctx.c < 128) ctx.b[ctx.c++] = 0;
+  compress(ctx, true);
+  const out = new Uint8Array(outlen);
+  for (let i = 0; i < outlen; i++) out[i] = ctx.h[i >> 2] >> (8 * (i & 3));
+  return out;
+}
diff --git a/vendor/sidestr/schema/codec/pow/knots-header-v2.js b/vendor/sidestr/schema/codec/pow/knots-header-v2.js
new file mode 100644
index 0000000..a1bfb39
--- /dev/null
+++ b/vendor/sidestr/schema/codec/pow/knots-header-v2.js
@@ -0,0 +1,69 @@
+// Bitcoin Knots BLAKE2b proof of work for the v2 block header (v29.4.1,
+// src/primitives/block.cpp CBlockHeader::GetHash). Operates on the object the
+// codec decodes for knots:BlockHeaderV2 (see schema/overlays/knots-blake2b.jsonld):
+// hashes in display order, 16-byte fields in wire order, `version` raw.
+//
+//   h1  = tagged("Bitcoin block header 1", version‖prev‖height‖merkle‖time‖0‖bits‖txCount(u32)‖flags‖clearBits‖sha256tag(xorKey))
+//   h2  = tagged("Merge-mining hook", h1 ‖ 0¹⁶ ‖ 0¹⁶ ‖ mmRhs)
+//   b1  = blake2b-256(0³² ‖ h2 ‖ extranonce)
+//   b2  = blake2b-256(profile-dependent layout of prevHidden/h2, nonces, b1)
+//   hash = b2 XOR mask(xorKey, clearBits)          (display-order bytes)
+import { taggedHash, bytesToHex, hexToBytes } from '../hash.js';
+import { blake2b } from './blake2b.js';
+
+export const VERSION_HEADER_V2_FLAG = 0x80000000;
+export const FLAG_USE_TIME_OFFSET = 4;
+export const POW_HASH_NAME = 'knots:blake2b-v2';
+
+const rev = (b) => Uint8Array.from(b).reverse();
+const u32 = (n) => { const b = new Uint8Array(4); new DataView(b.buffer).setUint32(0, n >>> 0, true); return b; };
+const cat = (...parts) => { const out = new Uint8Array(parts.reduce((s, p) => s + p.length, 0)); let o = 0; for (const p of parts) { out.set(p, o); o += p.length; } return out; };
+
+export const isHeaderV2 = (h) => ((h.version >>> 0) & VERSION_HEADER_V2_FLAG) !== 0;
+// Consensus block time: the wire time plus the offset when the flag says so.
+export const headerTime = (h) => (h.flags & FLAG_USE_TIME_OFFSET) ? (h.timeOnWire + h.timeOffset) >>> 0 : h.timeOnWire;
+
+export function hashHeaderV2Detailed(h) {
+  const xorKeyWire = hexToBytes(h.xorKey);
+  const prevDisplay = hexToBytes(h.prevBlockHash);          // hashPrevBlock.ReversedBytes()
+  const xorKeyHash = taggedHash('Bitcoin block hash PoW XOR key', xorKeyWire);
+  const mask = new Uint8Array(32);
+  if (xorKeyWire.some((x) => x !== 0)) {
+    mask.set(taggedHash('Bitcoin block hash PoW XOR mask', xorKeyWire));
+    const clearBytes = h.xorKeyMaskClearBits >> 3;
+    mask.fill(0, 0, clearBytes);
+    if (clearBytes < 32) mask[clearBytes] &= 0xff >> (h.xorKeyMaskClearBits & 7);
+  }
+  const prevHidden = taggedHash('Bitcoin prevblock header, hashed', prevDisplay);
+  const h1 = taggedHash('Bitcoin block header 1', cat(
+    u32(h.version), prevDisplay, u32(h.height), rev(hexToBytes(h.merkleRoot)), u32(h.timeOnWire),
+    Uint8Array.of(0), u32(h.bits), u32(h.txCount), Uint8Array.of(h.flags, h.xorKeyMaskClearBits), xorKeyHash,
+  ));
+  const zeros16 = new Uint8Array(16);
+  const h2 = taggedHash('Merge-mining hook', cat(h1, zeros16, zeros16, rev(hexToBytes(h.mmRhs))));
+  const b1 = blake2b(cat(u32(0), h2, hexToBytes(h.extranonce)), 32);
+  const nonces = [u32(h.nonce), u32(h.nonce2), u32(h.timeOffset), u32(h.nonce3)];
+  let asicInput;
+  switch (h.flags & 3) {
+    case 0: { const p = Uint8Array.from(prevHidden); p.fill(0, 0, 6); asicInput = cat(p, ...nonces, b1); break; }
+    case 1: asicInput = cat(u32(h.nonce), u32(h.nonce2), u32(h.nonce3), u32(h.timeOffset), b1, h2); break;
+    case 2: asicInput = cat(new Uint8Array(48), h2, ...nonces, b1); break;
+    default: asicInput = cat(new Uint8Array(80), h2, ...nonces, b1); break;
+  }
+  const b2 = blake2b(asicInput, 32);
+  const hash = b2.map((x, i) => x ^ mask[i]);
+  return {
+    xorKeyHash: bytesToHex(xorKeyHash), h1: bytesToHex(h1), h2: bytesToHex(h2),
+    blake2b1: bytesToHex(b1), blake2b2: bytesToHex(b2), mask: bytesToHex(mask),
+    asicProfile: h.flags & 3, asicInput: bytesToHex(asicInput), blockHash: bytesToHex(hash),
+  };
+}
+export const hashHeaderV2 = (h) => hashHeaderV2Detailed(h).blockHash;
+
+// Register the chain's PoW hash on a codec. A v1 (80-byte) header on these
+// chains — the pre-fork history — is still SHA256d.
+export function registerKnotsBlake2b(codec) {
+  const sha256d = codec.powHashes.get('sha256d');
+  codec.registerPowHash(POW_HASH_NAME, (bytes, header) => isHeaderV2(header) ? hashHeaderV2(header) : sha256d(bytes));
+  return codec;
+}
diff --git a/vendor/sidestr/schema/codec/script.js b/vendor/sidestr/schema/codec/script.js
new file mode 100644
index 0000000..ffd98ae
--- /dev/null
+++ b/vendor/sidestr/schema/codec/script.js
@@ -0,0 +1,246 @@
+// Schema-driven script engine.
+//
+// Opcode names come from the Opcode enumeration and classification templates
+// from the ScriptType enumeration in schema/script.jsonld; address encoding
+// is parameterized by NetworkParams (schema/chain.jsonld). This file holds
+// only the mechanics: byte walking, template matching, base58check and
+// bech32/bech32m encoding.
+
+import { dsha256, bytesToHex, hexToBytes } from './hash.js';
+
+const B58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+const B32 = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';
+
+function base58check(versionByte, payload) {
+  const data = new Uint8Array(1 + payload.length + 4);
+  data[0] = versionByte;
+  data.set(payload, 1);
+  data.set(dsha256(data.subarray(0, 1 + payload.length)).subarray(0, 4), 1 + payload.length);
+  let n = 0n;
+  for (const b of data) n = (n << 8n) | BigInt(b);
+  let out = '';
+  while (n > 0n) { out = B58[Number(n % 58n)] + out; n /= 58n; }
+  for (const b of data) { if (b !== 0) break; out = '1' + out; }
+  return out;
+}
+
+function bech32Polymod(values) {
+  const GEN = [0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3];
+  let chk = 1;
+  for (const v of values) {
+    const top = chk >>> 25;
+    chk = ((chk & 0x1ffffff) << 5) ^ v;
+    for (let i = 0; i < 5; i++) if ((top >>> i) & 1) chk ^= GEN[i];
+  }
+  return chk >>> 0;
+}
+
+function bech32Encode(hrp, witnessVersion, program, constant) {
+  const data = [witnessVersion];
+  let acc = 0, bits = 0;
+  for (const b of program) {
+    acc = (acc << 8) | b; bits += 8;
+    while (bits >= 5) { bits -= 5; data.push((acc >>> bits) & 31); }
+  }
+  if (bits > 0) data.push((acc << (5 - bits)) & 31);
+  const hrpExp = [...[...hrp].map((c) => c.charCodeAt(0) >>> 5), 0, ...[...hrp].map((c) => c.charCodeAt(0) & 31)];
+  const polymod = bech32Polymod([...hrpExp, ...data, 0, 0, 0, 0, 0, 0]) ^ constant;
+  const checksum = Array.from({ length: 6 }, (_, i) => (polymod >>> (5 * (5 - i))) & 31);
+  return hrp + '1' + [...data, ...checksum].map((d) => B32[d]).join('');
+}
+
+export class ScriptEngine {
+  constructor(opcodeEnum, scriptTypeEnum, params) {
+    this.params = params;
+    this.byCode = new Map(opcodeEnum.members.map((m) => [m.code, m.name]));
+    this.byName = new Map(opcodeEnum.members.map((m) => [m.name, m.code]));
+    this.scriptTypes = scriptTypeEnum.members;
+  }
+
+  static fromSchemas(scriptSchema, chainSchema, network = 'btc:mainnet') {
+    const node = (id) => scriptSchema['@graph'].find((n) => n['@id'] === id);
+    return new ScriptEngine(node('btc:Opcode'), node('btc:ScriptType'),
+      chainSchema['@graph'].find((n) => n['@id'] === network));
+  }
+
+  // hex -> [{code, name, data?}]; data (hex) present for pushes.
+  // A malformed tail yields a final op with `error` set rather than a throw.
+  parse(hex) {
+    const bytes = hexToBytes(hex);
+    const ops = [];
+    let i = 0;
+    while (i < bytes.length) {
+      const at = i;                     // byte offset of this opcode (OP_CODESEPARATOR scriptCode truncation needs it)
+      const code = bytes[i++];
+      let len = null;
+      if (code >= 0x01 && code <= 0x4b) len = code;
+      else if (code === 0x4c) { len = bytes[i]; i += 1; }
+      else if (code === 0x4d) { len = bytes[i] | (bytes[i + 1] << 8); i += 2; }
+      // >>> 0: the 4-byte length is unsigned. Without it, JS's `<< 24` makes a
+      // high-bit length negative, which slips past the bounds check below and
+      // sends `i` negative, looping into undefined bytes (crashes on malformed
+      // coinbase scriptSig data). See bitcoin-desktop/schema#62.
+      else if (code === 0x4e) { len = (bytes[i] | (bytes[i + 1] << 8) | (bytes[i + 2] << 16) | (bytes[i + 3] << 24)) >>> 0; i += 4; }
+      if (len === null) {
+        ops.push({ code, name: this.byCode.get(code) ?? `OP_UNKNOWN_0x${code.toString(16).padStart(2, '0')}`, at });
+        continue;
+      }
+      // Truncated if the length prefix itself overran the end (i > length, len
+      // undefined/0), the declared push runs past the end, or len isn't finite.
+      if (len == null || Number.isNaN(len) || i > bytes.length || i + len > bytes.length) {
+        ops.push({ code, name: 'OP_PUSH', error: 'truncated push', at });
+        break;
+      }
+      const name = code <= 0x4b ? `OP_PUSHBYTES_${code}` : this.byCode.get(code);
+      ops.push({ code, name, data: bytesToHex(bytes.subarray(i, i + len)), at });
+      i += len;
+    }
+    return ops;
+  }
+
+  asm(hex) {
+    return this.parse(hex).map((op) => op.error ? `[${op.error}]` : op.data ?? op.name).join(' ');
+  }
+
+  // Match one ScriptType template ("OP_DUP OP_HASH160 <20> ..."): <n> matches
+  // a *direct* push (opcode 0x01..0x4b) of exactly n bytes, <a|b> of either
+  // length. A PUSHDATA1/2/4 carrying the same bytes does not match, exactly as
+  // in Core (IsPayToScriptHash / IsWitnessProgram / the Solver templates check
+  // the byte layout): BIP 16 treats "HASH160 PUSHDATA1 <20> EQUAL" as a bare
+  // script, not P2SH.
+  #matchTemplate(template, ops) {
+    const tokens = template.split(' ');
+    if (tokens.length !== ops.length) return false;
+    return tokens.every((tok, i) => {
+      const op = ops[i];
+      if (tok.startsWith('<')) {
+        if (op.data == null || op.code > 0x4b) return false;
+        return tok.slice(1, -1).split('|').some((n) => op.data.length === 2 * Number(n));
+      }
+      return op.name === tok && op.data == null;
+    });
+  }
+
+  #isSmallInt(op) { return op.code === 0x00 || (op.code >= 0x51 && op.code <= 0x60); }
+  #smallInt(op) { return op.code === 0x00 ? 0 : op.code - 0x50; }
+
+  #matchSpecial(kind, ops) {
+    switch (kind) {
+      case 'nulldata':
+        return ops.length >= 1 && ops[0].name === 'OP_RETURN';
+      case 'multisig': {
+        if (ops.length < 4 || ops.at(-1).name !== 'OP_CHECKMULTISIG') return false;
+        const [m, n] = [ops[0], ops.at(-2)];
+        if (!this.#isSmallInt(m) || !this.#isSmallInt(n)) return false;
+        const keys = ops.slice(1, -2);
+        return keys.length === this.#smallInt(n) && this.#smallInt(m) >= 1
+          && this.#smallInt(m) <= this.#smallInt(n)
+          && keys.every((k) => k.data && (k.data.length === 66 || k.data.length === 130));
+      }
+      case 'witness-unknown': {
+        if (ops.length !== 2 || !ops[1].data || ops[1].code > 0x4b) return false;
+        const v = ops[0].code;
+        const len = ops[1].data.length / 2;
+        return v >= 0x52 && v <= 0x60 && len >= 2 && len <= 40;
+      }
+      case 'anchor': // BIP 431: exactly OP_1 PUSH2 0x4e73
+        return ops.length === 2 && ops[0].name === 'OP_1' && ops[1].code === 2 && ops[1].data === '4e73';
+      case 'fallback':
+        return true;
+      default:
+        return false;
+    }
+  }
+
+  address(type, ops) {
+    const enc = type.addressEncoding;
+    if (!enc) return null;
+    const pushes = ops.filter((op) => op.data != null);
+    const payload = hexToBytes(pushes[Number(enc.payload.split(':')[1])].data);
+    if (enc.encoding === 'base58check') return base58check(this.params[enc.versionParam], payload);
+    const witnessVersion = enc.witnessVersion ?? this.#smallInt(ops[0]);
+    const constant = enc.encoding === 'bech32' ? 1 : 0x2bc830a3;
+    return bech32Encode(this.params.bech32Hrp, witnessVersion, payload, constant);
+  }
+
+  // hex -> {type, address|null, asm}
+  classify(hex) {
+    const ops = this.parse(hex);
+    const broken = ops.some((op) => op.error);
+    for (const t of this.scriptTypes) {
+      const matched = !broken && (t.template
+        ? this.#matchTemplate(t.template, ops)
+        : this.#matchSpecial(t.special, ops));
+      if (matched || (broken && t.special === 'fallback')) {
+        return { type: t.name, address: matched ? this.address(t, ops) : null, asm: this.asm(hex) };
+      }
+    }
+    return { type: 'nonstandard', address: null, asm: this.asm(hex) };
+  }
+}
+
+// ---- address decoding (the inverse of the encoders above) ----
+
+export function base58checkDecode(str) {
+  let n = 0n;
+  for (const ch of str) {
+    const v = B58.indexOf(ch);
+    if (v < 0) return null;
+    n = n * 58n + BigInt(v);
+  }
+  const bytes = [];
+  while (n > 0n) { bytes.unshift(Number(n & 0xffn)); n >>= 8n; }
+  for (const ch of str) { if (ch !== '1') break; bytes.unshift(0); }
+  if (bytes.length < 5) return null;
+  const data = Uint8Array.from(bytes);
+  const payload = data.subarray(0, data.length - 4);
+  const check = dsha256(payload).subarray(0, 4);
+  if (!check.every((b, i) => b === data[data.length - 4 + i])) return null;
+  return { version: payload[0], payload: payload.subarray(1) };
+}
+
+export function bech32Decode(addr) {
+  const lower = addr.toLowerCase();
+  if (addr !== lower && addr !== addr.toUpperCase()) return null;
+  const sep = lower.lastIndexOf('1');
+  if (sep < 1 || sep + 7 > lower.length) return null;
+  const hrp = lower.slice(0, sep);
+  const data = [...lower.slice(sep + 1)].map((c) => B32.indexOf(c));
+  if (data.includes(-1)) return null;
+  const hrpExp = [...[...hrp].map((c) => c.charCodeAt(0) >>> 5), 0, ...[...hrp].map((c) => c.charCodeAt(0) & 31)];
+  const polymod = bech32Polymod([...hrpExp, ...data]);
+  const encoding = polymod === 1 ? 'bech32' : polymod === 0x2bc830a3 ? 'bech32m' : null;
+  if (!encoding) return null;
+  const values = data.slice(0, -6);
+  const witnessVersion = values[0];
+  let acc = 0, bits = 0;
+  const program = [];
+  for (const v of values.slice(1)) {
+    acc = (acc << 5) | v; bits += 5;
+    while (bits >= 8) { bits -= 8; program.push((acc >>> bits) & 0xff); }
+  }
+  if (bits >= 5 || ((acc << (8 - bits)) & 0xff)) return null;
+  return { hrp, witnessVersion, program: Uint8Array.from(program), encoding };
+}
+
+// address -> scriptPubKey hex for the given NetworkParams, or null.
+export function addressToScript(address, params) {
+  const b32 = bech32Decode(address);
+  if (b32) {
+    if (b32.hrp !== params.bech32Hrp) return null;
+    const { witnessVersion: v, program, encoding } = b32;
+    if (v < 0 || v > 16 || program.length < 2 || program.length > 40) return null;
+    if (v === 0 && (encoding !== 'bech32' || (program.length !== 20 && program.length !== 32))) return null;
+    if (v > 0 && encoding !== 'bech32m') return null;
+    const opcode = v === 0 ? 0 : 0x50 + v;
+    return opcode.toString(16).padStart(2, '0')
+      + program.length.toString(16).padStart(2, '0') + bytesToHex(program);
+  }
+  const b58 = base58checkDecode(address);
+  if (b58 && b58.payload.length === 20) {
+    const h = bytesToHex(b58.payload);
+    if (b58.version === params.p2pkhVersion) return '76a914' + h + '88ac';
+    if (b58.version === params.p2shVersion) return 'a914' + h + '87';
+  }
+  return null;
+}
diff --git a/vendor/sidestr/schema/codec/secp256k1.js b/vendor/sidestr/schema/codec/secp256k1.js
new file mode 100644
index 0000000..a06da3d
--- /dev/null
+++ b/vendor/sidestr/schema/codec/secp256k1.js
@@ -0,0 +1,237 @@
+// Zero-dependency ECDSA *verification* over secp256k1, in BigInt arithmetic.
+// Verification only — no signing, no private keys, and no constant-time
+// requirements. Jacobian coordinates avoid a field inversion per step.
+
+const P = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2fn;
+export const N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;
+const GX = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798n;
+const GY = 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8n;
+
+const mod = (a, m = P) => ((a % m) + m) % m;
+
+function modpow(b, e, m) {
+  let r = 1n; b = mod(b, m);
+  while (e > 0n) {
+    if (e & 1n) r = (r * b) % m;
+    b = (b * b) % m;
+    e >>= 1n;
+  }
+  return r;
+}
+const inv = (a, m) => modpow(a, m - 2n, m); // m prime (Fermat)
+
+// Jacobian point ops; null = point at infinity.
+function jDouble(p) {
+  if (!p) return null;
+  const [X, Y, Z] = p;
+  if (Y === 0n) return null;
+  const S = mod(4n * X * Y * Y);
+  const M = mod(3n * X * X); // a = 0 for secp256k1
+  const X2 = mod(M * M - 2n * S);
+  const Y2 = mod(M * (S - X2) - 8n * Y * Y * Y * Y);
+  return [X2, Y2, mod(2n * Y * Z)];
+}
+
+function jAdd(p, q) {
+  if (!p) return q;
+  if (!q) return p;
+  const [X1, Y1, Z1] = p, [X2, Y2, Z2] = q;
+  const Z1Z1 = mod(Z1 * Z1), Z2Z2 = mod(Z2 * Z2);
+  const U1 = mod(X1 * Z2Z2), U2 = mod(X2 * Z1Z1);
+  const S1 = mod(Y1 * Z2 * Z2Z2), S2 = mod(Y2 * Z1 * Z1Z1);
+  if (U1 === U2) return S1 === S2 ? jDouble(p) : null;
+  const H = mod(U2 - U1);
+  const R = mod(S2 - S1);
+  const HH = mod(H * H), HHH = mod(H * HH);
+  const X3 = mod(R * R - HHH - 2n * U1 * HH);
+  const Y3 = mod(R * (U1 * HH - X3) - S1 * HHH);
+  return [X3, Y3, mod(H * Z1 * Z2)];
+}
+
+function jMul(p, k) {
+  let acc = null, addend = p;
+  while (k > 0n) {
+    if (k & 1n) acc = jAdd(acc, addend);
+    addend = jDouble(addend);
+    k >>= 1n;
+  }
+  return acc;
+}
+
+const toAffineX = (p) => {
+  const zi = inv(p[2], P);
+  return mod(p[0] * zi * zi);
+};
+
+const bytesToBig = (bytes) => {
+  let n = 0n;
+  for (const b of bytes) n = (n << 8n) | BigInt(b);
+  return n;
+};
+
+// 33-byte compressed (02/03) or 65-byte uncompressed (04) SEC1 public key
+// -> affine point, or null if not on the curve.
+export function parsePubkey(bytes) {
+  // 0x04 uncompressed; 0x06/0x07 hybrid (valid pre-STRICTENC, y given explicitly)
+  if (bytes.length === 65 && (bytes[0] === 0x04 || bytes[0] === 0x06 || bytes[0] === 0x07)) {
+    const x = bytesToBig(bytes.subarray(1, 33));
+    const y = bytesToBig(bytes.subarray(33, 65));
+    if (mod(y * y) !== mod(x * x * x + 7n)) return null;
+    return [x, y];
+  }
+  if (bytes.length === 33 && (bytes[0] === 0x02 || bytes[0] === 0x03)) {
+    const x = bytesToBig(bytes.subarray(1));
+    if (x >= P) return null;
+    let y = modpow(mod(x * x * x + 7n), (P + 1n) / 4n, P);
+    if (mod(y * y) !== mod(x * x * x + 7n)) return null;
+    if ((y & 1n) !== BigInt(bytes[0] & 1)) y = P - y;
+    return [x, y];
+  }
+  return null;
+}
+
+// Lenient DER (r, s) parsing — pre-BIP66 chain data is not always minimally
+// encoded, and verification of historical blocks must accept it.
+export function parseDerSignature(bytes) {
+  try {
+    if (bytes[0] !== 0x30) return null;
+    let i = 2;
+    if (bytes[i] !== 0x02) return null;
+    const rLen = bytes[i + 1];
+    const r = bytesToBig(bytes.subarray(i + 2, i + 2 + rLen));
+    i += 2 + rLen;
+    if (bytes[i] !== 0x02) return null;
+    const sLen = bytes[i + 1];
+    const s = bytesToBig(bytes.subarray(i + 2, i + 2 + sLen));
+    return { r, s };
+  } catch {
+    return null;
+  }
+}
+
+// Optional verify backend (e.g. WASM libsecp256k1) injected by performance-
+// sensitive callers; null = the pure-JS path. Keeps this module zero-dependency:
+// the engine never imports a WASM lib, the caller supplies one.
+let __verifyBackend = null;
+export function setVerifyBackend(b) { __verifyBackend = b; }
+
+// ECDSA verify: signature (parsed r,s) over a 32-byte message hash with an
+// affine public key point.
+export function verifyEcdsa(msgHash, sig, pubkey) {
+  if (__verifyBackend) return __verifyBackend.ecdsa(msgHash, sig, pubkey);
+  const { r, s } = sig;
+  if (r <= 0n || r >= N || s <= 0n || s >= N) return false;
+  const e = mod(bytesToBig(msgHash), N);
+  const w = inv(s, N);
+  const u1 = mod(e * w, N);
+  const u2 = mod(r * w, N);
+  const G = [GX, GY, 1n];
+  const Q = [pubkey[0], pubkey[1], 1n];
+  const R = jAdd(jMul(G, u1), jMul(Q, u2));
+  if (!R) return false;
+  return mod(toAffineX(R), N) === r;
+}
+
+// ---- BIP 340 Schnorr verification ----
+
+import { taggedHash } from './hash.js';
+
+const bigToBytes = (n) => {
+  const out = new Uint8Array(32);
+  for (let i = 31; i >= 0; i--) { out[i] = Number(n & 0xffn); n >>= 8n; }
+  return out;
+};
+
+// Lift an x-only key to the even-y curve point, or null.
+export function liftX(xBytes) {
+  const x = bytesToBig(xBytes);
+  if (x >= P) return null;
+  const c = mod(x * x * x + 7n);
+  const y = modpow(c, (P + 1n) / 4n, P);
+  if (mod(y * y) !== c) return null;
+  return [x, (y & 1n) === 0n ? y : P - y];
+}
+
+export function verifySchnorr(msg32, sig64, pubkey32) {
+  if (__verifyBackend) return __verifyBackend.schnorr(msg32, sig64, pubkey32);
+  if (sig64.length !== 64 || pubkey32.length !== 32) return false;
+  const Ppoint = liftX(pubkey32);
+  if (!Ppoint) return false;
+  const r = bytesToBig(sig64.subarray(0, 32));
+  const s = bytesToBig(sig64.subarray(32));
+  if (r >= P || s >= N) return false;
+  const e = mod(bytesToBig(taggedHash('BIP0340/challenge',
+    sig64.subarray(0, 32), pubkey32, msg32)), N);
+  // R = s*G - e*P
+  const G = [GX, GY, 1n];
+  const R = jAdd(jMul(G, s), jMul([Ppoint[0], Ppoint[1], 1n], mod(N - e, N)));
+  if (!R) return false;
+  const zi = inv(R[2], P);
+  const ax = mod(R[0] * zi * zi);
+  const ay = mod(R[1] * zi * zi * zi);
+  return (ay & 1n) === 0n && ax === r;
+}
+
+// Verify a taproot output-key commitment: outputKey == lift_x(internalKey) + t*G
+// with the given y-parity, where t = taggedHash("TapTweak", internalKey || merkleRoot).
+export function checkTapTweak(internalKey32, merkleRoot, outputKey32, parity) {
+  const Pp = liftX(internalKey32);
+  if (!Pp) return false;
+  const t = bytesToBig(taggedHash('TapTweak',
+    internalKey32, ...(merkleRoot ? [merkleRoot] : [])));
+  if (t >= N) return false;
+  const G = [GX, GY, 1n];
+  const Q = jAdd([Pp[0], Pp[1], 1n], jMul(G, t));
+  if (!Q) return false;
+  const zi = inv(Q[2], P);
+  const qx = mod(Q[0] * zi * zi);
+  const qy = mod(Q[1] * zi * zi * zi);
+  return qx === bytesToBig(outputKey32) && Number(qy & 1n) === parity;
+}
+
+// ---- BIP 32 public derivation + BIP 86 output keys ----
+
+function compress(point) {
+  const out = new Uint8Array(33);
+  out[0] = (point[1] & 1n) === 0n ? 0x02 : 0x03;
+  out.set(bigToBytes(point[0]), 1);
+  return out;
+}
+
+// Compressed public key for a 32-byte scalar — pure public curve math
+// (the schema stays verify-only: no signing, nonces, or key generation).
+export function publicKeyFromPrivate(priv32) {
+  const d = bytesToBig(priv32);
+  if (d <= 0n || d >= N) return null;
+  const Q = jMul([GX, GY, 1n], d);
+  if (!Q) return null;
+  const zi = inv(Q[2], P);
+  return compress([mod(Q[0] * zi * zi), mod(Q[1] * zi * zi * zi)]);
+}
+
+// CKDpub child key: point(IL) + Kpar. Returns compressed bytes or null on
+// the (negligible-probability) invalid cases BIP 32 says to skip.
+export function ckdPubKey(parentPub33, il32) {
+  const il = bytesToBig(il32);
+  if (il >= N) return null;
+  const K = parsePubkey(parentPub33);
+  if (!K) return null;
+  const child = jAdd(jMul([GX, GY, 1n], il), [K[0], K[1], 1n]);
+  if (!child) return null;
+  const zi = inv(child[2], P);
+  return compress([mod(child[0] * zi * zi), mod(child[1] * zi * zi * zi)]);
+}
+
+// BIP 341/86 output key: x-only internal key tweaked by the (optional)
+// merkle root. Returns the 32-byte x-only output key, or null.
+export function tapOutputKey(internalKey32, merkleRoot = null) {
+  const Pp = liftX(internalKey32);
+  if (!Pp) return null;
+  const t = bytesToBig(taggedHash('TapTweak',
+    internalKey32, ...(merkleRoot ? [merkleRoot] : [])));
+  if (t >= N) return null;
+  const Q = jAdd([Pp[0], Pp[1], 1n], jMul([GX, GY, 1n], t));
+  if (!Q) return null;
+  const zi = inv(Q[2], P);
+  return bigToBytes(mod(Q[0] * zi * zi));
+}
diff --git a/vendor/sidestr/schema/schema/chain.jsonld b/vendor/sidestr/schema/schema/chain.jsonld
new file mode 100644
index 0000000..0c03fbb
--- /dev/null
+++ b/vendor/sidestr/schema/schema/chain.jsonld
@@ -0,0 +1,474 @@
+{
+  "@context": "../context.jsonld",
+  "@graph": [
+    {
+      "@id": "btc:chain",
+      "@type": "Module",
+      "label": "chain",
+      "version": "0.0.13",
+      "comment": "Chain-contextual structures: state that depends on which chain you are following and where its tip is. Nothing in this module is covered by proof-of-work; it parameterizes and indexes the consensus structures defined in core.",
+      "layer": "context"
+    },
+    {
+      "@id": "btc:NetworkParams",
+      "@type": "ContextStruct",
+      "module": "btc:chain",
+      "label": "NetworkParams",
+      "comment": "Consensus parameters of a Bitcoin network deployment. These are constants agreed by convention at network genesis, not serialized data.",
+      "fields": [
+        {
+          "property": "btc:networkName",
+          "label": "name",
+          "valueType": "string",
+          "comment": "Human name of the network."
+        },
+        {
+          "property": "btc:magic",
+          "label": "magic",
+          "valueType": "hex",
+          "comment": "Four magic bytes prefixing every P2P message on this network."
+        },
+        {
+          "property": "btc:genesisHash",
+          "label": "genesisHash",
+          "valueType": "hash",
+          "comment": "Hash of the network's genesis block header."
+        },
+        {
+          "property": "btc:powLimit",
+          "label": "powLimit",
+          "valueType": "hex",
+          "comment": "Maximum (easiest) allowed proof-of-work target, as a 256-bit value."
+        },
+        {
+          "property": "btc:targetTimespan",
+          "label": "targetTimespan",
+          "valueType": "u32",
+          "comment": "Difficulty retarget period in seconds: two weeks (1,209,600)."
+        },
+        {
+          "property": "btc:targetSpacing",
+          "label": "targetSpacing",
+          "valueType": "u32",
+          "comment": "Target interval between blocks in seconds: ten minutes (600)."
+        },
+        {
+          "property": "btc:difficultyAdjustmentInterval",
+          "label": "difficultyAdjustmentInterval",
+          "valueType": "u32",
+          "comment": "Blocks per difficulty epoch: targetTimespan / targetSpacing = 2016."
+        },
+        {
+          "property": "btc:maxFutureBlockTime",
+          "label": "maxFutureBlockTime",
+          "valueType": "u32",
+          "comment": "Maximum seconds a block timestamp may be ahead of network-adjusted time: 7200 (2 hours)."
+        },
+        {
+          "property": "btc:halvingInterval",
+          "label": "halvingInterval",
+          "valueType": "u32",
+          "comment": "Blocks between block-subsidy halvings: 210,000."
+        },
+        {
+          "property": "btc:port",
+          "label": "port",
+          "valueType": "u16",
+          "comment": "Default P2P TCP port."
+        },
+        {
+          "property": "btc:p2pkhVersion",
+          "label": "p2pkhVersion",
+          "valueType": "u8",
+          "comment": "Base58Check version byte for pay-to-public-key-hash addresses."
+        },
+        {
+          "property": "btc:p2shVersion",
+          "label": "p2shVersion",
+          "valueType": "u8",
+          "comment": "Base58Check version byte for pay-to-script-hash addresses."
+        },
+        {
+          "property": "btc:bech32Hrp",
+          "label": "bech32Hrp",
+          "valueType": "string",
+          "comment": "Human-readable part of bech32/bech32m segwit addresses (BIP 173/350)."
+        },
+        {
+          "property": "btc:maxMoney",
+          "label": "maxMoney",
+          "valueType": "i64",
+          "comment": "Maximum total supply in satoshis: 21,000,000 BTC."
+        },
+        {
+          "property": "btc:initialSubsidy",
+          "label": "initialSubsidy",
+          "valueType": "i64",
+          "comment": "Block subsidy at genesis in satoshis: 50 BTC, halving every halvingInterval blocks."
+        },
+        {
+          "property": "btc:maxBlockWeight",
+          "label": "maxBlockWeight",
+          "valueType": "u32",
+          "comment": "Consensus block weight limit (BIP 141): 4,000,000 weight units."
+        },
+        {
+          "property": "btc:bip34Height",
+          "label": "bip34Height",
+          "valueType": "u32",
+          "comment": "Buried deployment: height from which coinbase scripts must encode the block height (BIP 34)."
+        },
+        {
+          "property": "btc:bip65Height",
+          "label": "bip65Height",
+          "valueType": "u32",
+          "comment": "Buried deployment: OP_CHECKLOCKTIMEVERIFY activation height (BIP 65)."
+        },
+        {
+          "property": "btc:bip66Height",
+          "label": "bip66Height",
+          "valueType": "u32",
+          "comment": "Buried deployment: strict DER signatures activation height (BIP 66)."
+        },
+        {
+          "property": "btc:csvHeight",
+          "label": "csvHeight",
+          "valueType": "u32",
+          "comment": "Buried deployment: OP_CHECKSEQUENCEVERIFY / relative lock-time activation height (BIP 68/112/113)."
+        },
+        {
+          "property": "btc:segwitHeight",
+          "label": "segwitHeight",
+          "valueType": "u32",
+          "comment": "Buried deployment: segregated witness activation height (BIP 141/143/147)."
+        },
+        {
+          "property": "btc:maxBlockSigopsCost",
+          "label": "maxBlockSigopsCost",
+          "valueType": "u32",
+          "comment": "Consensus limit on signature-operation cost per block: 80,000 (legacy sigops count 4x)."
+        },
+        {
+          "property": "btc:coinbaseMaturity",
+          "label": "coinbaseMaturity",
+          "valueType": "u32",
+          "comment": "Confirmations before a coinbase output may be spent: 100."
+        },
+        {
+          "property": "btc:powNoRetargeting",
+          "label": "powNoRetargeting",
+          "valueType": "bool",
+          "comment": "Whether difficulty retargeting is disabled (regtest only)."
+        },
+        {
+          "property": "btc:allowMinDifficultyBlocks",
+          "label": "allowMinDifficultyBlocks",
+          "valueType": "bool",
+          "comment": "Testnet rule: a block whose timestamp exceeds the previous block's by more than 2x targetSpacing may be mined at powLimit difficulty; otherwise difficulty is that of the last non-minimum-difficulty block of the epoch."
+        },
+        {
+          "property": "btc:timewarpFix",
+          "label": "timewarpFix",
+          "valueType": "bool",
+          "comment": "BIP 94 (testnet4): retargets compute from the epoch-first block's bits, and the first block of each epoch may not be timestamped more than maxTimewarp before its predecessor."
+        },
+        {
+          "property": "btc:retargetSeed",
+          "label": "retargetSeed",
+          "valueType": "string",
+          "comment": "Which block's bits the period retarget scales: 'last' (Bitcoin) or 'first' (BIP 94: the first block of the period, so a min-difficulty last block cannot reset difficulty). Defaults from timewarpFix."
+        },
+        {
+          "property": "btc:targetAdjustments",
+          "label": "targetAdjustments",
+          "valueType": "array",
+          "comment": "One-off target adjustments, [{height, shiftLeft}]: at exactly that height the expected target is eased by 2^shiftLeft, clamped at powLimit \u2014 the first block of a proof-of-work change. Absent on Bitcoin chains."
+        },
+        {
+          "property": "btc:maxTimewarp",
+          "label": "maxTimewarp",
+          "valueType": "u32",
+          "comment": "BIP 94: maximum seconds an epoch-first block may lag its predecessor: 600."
+        },
+        {
+          "property": "btc:xpubVersion",
+          "label": "xpubVersion",
+          "valueType": "u32",
+          "comment": "Serialization version of extended public keys (BIP 32): 0x0488b21e (xpub) on mainnet, 0x043587cf (tpub) on test networks."
+        }
+      ]
+    },
+    {
+      "@id": "btc:mainnet",
+      "@type": "btc:NetworkParams",
+      "label": "mainnet",
+      "comment": "The Bitcoin mainnet, live since 2009-01-03.",
+      "name": "mainnet",
+      "magic": "f9beb4d9",
+      "genesisHash": "000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f",
+      "powLimit": "00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "targetTimespan": 1209600,
+      "targetSpacing": 600,
+      "difficultyAdjustmentInterval": 2016,
+      "maxFutureBlockTime": 7200,
+      "halvingInterval": 210000,
+      "port": 8333,
+      "p2pkhVersion": 0,
+      "p2shVersion": 5,
+      "bech32Hrp": "bc",
+      "maxMoney": 2100000000000000,
+      "initialSubsidy": 5000000000,
+      "maxBlockWeight": 4000000,
+      "bip34Height": 227931,
+      "bip65Height": 388381,
+      "bip66Height": 363725,
+      "csvHeight": 419328,
+      "segwitHeight": 481824,
+      "maxBlockSigopsCost": 80000,
+      "coinbaseMaturity": 100,
+      "xpubVersion": 76067358
+    },
+    {
+      "@id": "btc:Coin",
+      "@type": "ContextStruct",
+      "module": "btc:chain",
+      "label": "Coin",
+      "comment": "An entry in the UTXO set: an unspent transaction output together with the chain context needed to validate its spending. The UTXO set is the complete state of bitcoin ownership; a pruned node keeps it (or a window of its evolution) while discarding old block data.",
+      "fields": [
+        {
+          "property": "btc:outpoint",
+          "label": "outpoint",
+          "valueType": "OutPoint",
+          "comment": "The txid:vout identifying this output."
+        },
+        {
+          "property": "btc:output",
+          "label": "output",
+          "valueType": "TransactionOutput",
+          "comment": "The output itself: value and scriptPubKey."
+        },
+        {
+          "property": "btc:height",
+          "label": "height",
+          "valueType": "u32",
+          "comment": "Height of the block that created this coin."
+        },
+        {
+          "property": "btc:coinbase",
+          "label": "coinbase",
+          "valueType": "bool",
+          "comment": "Whether the coin is a coinbase output; coinbase coins are spendable only after 100 confirmations (maturity)."
+        }
+      ]
+    },
+    {
+      "@id": "btc:testnet",
+      "@type": "btc:NetworkParams",
+      "label": "testnet",
+      "comment": "Testnet3: the long-running public test network. Coins are worthless by design. Allows minimum-difficulty blocks after a 20-minute gap.",
+      "name": "testnet",
+      "magic": "0b110907",
+      "genesisHash": "000000000933ea01ad0ee984209779baaec3ced90fa3f408719526f8d77f4943",
+      "powLimit": "00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "targetTimespan": 1209600,
+      "targetSpacing": 600,
+      "difficultyAdjustmentInterval": 2016,
+      "maxFutureBlockTime": 7200,
+      "halvingInterval": 210000,
+      "port": 18333,
+      "p2pkhVersion": 111,
+      "p2shVersion": 196,
+      "bech32Hrp": "tb",
+      "maxMoney": 2100000000000000,
+      "initialSubsidy": 5000000000,
+      "maxBlockWeight": 4000000,
+      "bip34Height": 21111,
+      "bip65Height": 581885,
+      "bip66Height": 330776,
+      "csvHeight": 770112,
+      "segwitHeight": 834624,
+      "maxBlockSigopsCost": 80000,
+      "coinbaseMaturity": 100,
+      "allowMinDifficultyBlocks": true,
+      "xpubVersion": 70617039
+    },
+    {
+      "@id": "btc:testnet4",
+      "@type": "btc:NetworkParams",
+      "label": "testnet4",
+      "comment": "Testnet4 (BIP 94, live since 2024): a reset public test network with the timewarp fix and epoch-first retargeting; keeps the 20-minute minimum-difficulty exception.",
+      "name": "testnet4",
+      "magic": "1c163f28",
+      "genesisHash": "00000000da84f2bafbbc53dee25a72ae507ff4914b867c565be350b0da8bf043",
+      "powLimit": "00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "targetTimespan": 1209600,
+      "targetSpacing": 600,
+      "difficultyAdjustmentInterval": 2016,
+      "maxFutureBlockTime": 7200,
+      "halvingInterval": 210000,
+      "port": 48333,
+      "p2pkhVersion": 111,
+      "p2shVersion": 196,
+      "bech32Hrp": "tb",
+      "maxMoney": 2100000000000000,
+      "initialSubsidy": 5000000000,
+      "maxBlockWeight": 4000000,
+      "bip34Height": 1,
+      "bip65Height": 1,
+      "bip66Height": 1,
+      "csvHeight": 1,
+      "segwitHeight": 1,
+      "maxBlockSigopsCost": 80000,
+      "coinbaseMaturity": 100,
+      "allowMinDifficultyBlocks": true,
+      "timewarpFix": true,
+      "maxTimewarp": 600,
+      "xpubVersion": 70617039,
+      "retargetSeed": "first"
+    },
+    {
+      "@id": "btc:signet",
+      "@type": "btc:NetworkParams",
+      "label": "signet",
+      "comment": "Signet (default global signet): blocks additionally require a signature from the network's signers; proof-of-work is easy.",
+      "name": "signet",
+      "magic": "0a03cf40",
+      "genesisHash": "00000008819873e925422c1ff0f99f7cc9bbb232af63a077a480a3633bee1ef6",
+      "powLimit": "00000377ae000000000000000000000000000000000000000000000000000000",
+      "targetTimespan": 1209600,
+      "targetSpacing": 600,
+      "difficultyAdjustmentInterval": 2016,
+      "maxFutureBlockTime": 7200,
+      "halvingInterval": 210000,
+      "port": 38333,
+      "p2pkhVersion": 111,
+      "p2shVersion": 196,
+      "bech32Hrp": "tb",
+      "maxMoney": 2100000000000000,
+      "initialSubsidy": 5000000000,
+      "maxBlockWeight": 4000000,
+      "bip34Height": 1,
+      "bip65Height": 1,
+      "bip66Height": 1,
+      "csvHeight": 1,
+      "segwitHeight": 1,
+      "maxBlockSigopsCost": 80000,
+      "coinbaseMaturity": 100,
+      "xpubVersion": 70617039
+    },
+    {
+      "@id": "btc:regtest",
+      "@type": "btc:NetworkParams",
+      "label": "regtest",
+      "comment": "Regression-test network: trivial proof-of-work (and no retargeting), local-only, for development. Subsidy halves every 150 blocks.",
+      "name": "regtest",
+      "magic": "fabfb5da",
+      "genesisHash": "0f9188f13cb7b2c71f2a335e3a4fc328bf5beb436012afca590b1a11466e2206",
+      "powLimit": "7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "targetTimespan": 1209600,
+      "targetSpacing": 600,
+      "difficultyAdjustmentInterval": 2016,
+      "maxFutureBlockTime": 7200,
+      "halvingInterval": 150,
+      "port": 18444,
+      "p2pkhVersion": 111,
+      "p2shVersion": 196,
+      "bech32Hrp": "bcrt",
+      "maxMoney": 2100000000000000,
+      "initialSubsidy": 5000000000,
+      "maxBlockWeight": 4000000,
+      "bip34Height": 1,
+      "bip65Height": 1,
+      "bip66Height": 1,
+      "csvHeight": 1,
+      "segwitHeight": 0,
+      "maxBlockSigopsCost": 80000,
+      "coinbaseMaturity": 100,
+      "powNoRetargeting": true,
+      "xpubVersion": 70617039
+    },
+    {
+      "@id": "btc:Checkpoint",
+      "@type": "ContextStruct",
+      "module": "btc:chain",
+      "label": "Checkpoint",
+      "comment": "An AssumeValid-style sync anchor: a known-good header at a retarget boundary from which a light client syncs forward. Trust-minimized by reproducibility \u2014 anyone with a node can verify the hash \u2014 and chosen at epoch boundaries so all subsequent retarget context is within the synced range.",
+      "fields": [
+        {
+          "property": "btc:checkpointNetwork",
+          "label": "network",
+          "valueType": "NetworkParams",
+          "comment": "Which network the checkpoint anchors."
+        },
+        {
+          "property": "btc:height",
+          "label": "height",
+          "valueType": "u32",
+          "comment": "Block height (a multiple of the retarget interval)."
+        },
+        {
+          "property": "btc:hash",
+          "label": "hash",
+          "valueType": "hash",
+          "comment": "The block hash."
+        },
+        {
+          "property": "btc:rawHeader",
+          "label": "rawHeader",
+          "valueType": "hex",
+          "comment": "The 80-byte header, so the chain can be extended without any fetch."
+        },
+        {
+          "property": "btc:contextHeaders",
+          "label": "contextHeaders",
+          "valueType": "hex",
+          "comment": "The ten headers immediately preceding the checkpoint, so median-time-past is fully decidable from the first synced header."
+        }
+      ]
+    },
+    {
+      "@id": "btc:mainnetCheckpoint",
+      "@type": "btc:Checkpoint",
+      "label": "mainnetCheckpoint",
+      "comment": "Mainnet sync anchor (retarget boundary, 2026-05).",
+      "network": "btc:mainnet",
+      "height": 951552,
+      "rawHeader": "046021200d794080a57a498c0d80e681de3e443488359077dd9501000000000000000000d52087be6c9a811306bd2da144e60e868ec93fb7803748fa7f62a701458987989a6a196a8f0602176f9614b2",
+      "hash": "00000000000000000001b472f1922f86148c8286609fb14be39e12b8bd14bb64",
+      "contextHeaders": [
+        "00e00320329170c306507e7241468b278022f409b1ba286c558f000000000000000000002b6aec9c94d018c8d4fda8b4ac3f8e94a33cfaa0af3ed1baf7e27978cd2fc90f7155196a790f02177f886517",
+        "0000003a1bda7e2a9b1b280b965d9c97282dd68f4c9c1730633e01000000000000000000969c0239f766df46e9d6fa46d47966ce25be7b8ff9a5b891c2a430cc84abb094cf58196a790f0217cdd4173b",
+        "00a00120f0002c1bd21454e92465a2e7cb685ce31fdbedb402030100000000000000000053a16d2a4a3cf97a66b924cbfa111d3191334cadd109670cc3b86f9660eb40c3525a196a790f021758e40d8e",
+        "00200520e234e1802bf8a13c1f36b42bfbf0f9402dc578d27d4300000000000000000000a7840a32bf37022e05f85e5fcc6a1aa3cdba6e6fbe00a9b2358a684a13160a552c5d196a790f021712e104ab",
+        "0000ff3f694ec45318e78a395db6c92479f87a02d5471538ff4a0100000000000000000088b2c3f67ece6204c627a90c7c3407e8116d1e0aa0901a9bf7d25b469d378bf93b61196a790f0217184b87f4",
+        "0000003cfafb792e6bfda2b9c1c2038e70bbfb5db00107fc9c33000000000000000000005b77567da023d144627900af2530970994973356e70e563782d2e3f1810ec2ac3c60196a790f0217231ab498",
+        "00403b224db1673e13cbfceadf0e779c8836a0b6ca2a1c5ee0e6000000000000000000006d02ba1190a57e3ac7550b53266b32ad53917b8339168ab16497c388e2989be2e961196a790f02173b04fafa",
+        "00e00020443827f43d0cb8db69ded9b5df758d128a8e1f908b1401000000000000000000cf67b5629994bc3bff35b2231de572ba1345c845dbecc3440a9603be354e25508f62196a790f0217c8f008de",
+        "0020cf2cc087b7a6c63b4efe3704246570571f1602ec6a54f4df010000000000000000006ca5a966665036584d71601f49779195dc0e0d39f8e6f80fd51dad19cc507f8ade66196a790f021791ae1370",
+        "0060012023af18bbc7d27a88edd1608079125d238ff939a98aef01000000000000000000327873f5c6eb22fc90fa130ff01dee2314b9df925ae3e78c6c754fc176a6165d7c68196a790f021798d22209"
+      ]
+    },
+    {
+      "@id": "btc:testnet4Checkpoint",
+      "@type": "btc:Checkpoint",
+      "label": "testnet4Checkpoint",
+      "comment": "Testnet4 sync anchor (retarget boundary, 2026-06).",
+      "network": "btc:testnet4",
+      "height": 137088,
+      "rawHeader": "0000f7201b5ff9ab68e80c066b16fd7164237beeeba524c9811cd13ab94325000000000076fc49b54f167d7ea3162ea421578eafd75bfdef99b818708c908c862c2daba8f6a41b6ab67603197c40888d",
+      "hash": "00000000000000021645cc90db9b1ad27156e130620a074028676fbeca049502",
+      "contextHeaders": [
+        "0020822b10c39a2aa9451222aa706721b1b66010d2566633c2178065bc51480000000000e7209e1e5df9875817dcca78e3f32621bc69b321e497ae8e8613b93feb9228ba157d1b6affff001dd80102bd",
+        "0060c62984ab117890abfdd498be9da2ae22503df220c75380f7e0d5851cf80000000000a4f2079d37205c4da3f4ebcff731185ed7580b038ae29ed22e9788b8072ca8f9c6811b6affff001d2c01a86f",
+        "0040c92dadc6694a30d208af88f438cb3d31534eaedc5b2d44c3e77e5f538f00000000008a180adf92a1997b6e8b50d54df8dff83b4d5ceae5ff64e183cd8c3ddde3a76677861b6affff001d8201c8ae",
+        "0040b82d1f702bca6dc1dd4406666dc54f57447d51e2b3ac9c93d315f2413000000000001c07b41608184dfef0ad72728e46f4902efba888dfbae9a2d0e7d3602e2b4f67288b1b6affff001d8a01550a",
+        "006031281f7e2a20e4f6d9aff5be223905c075a2516859db73d4321df8b78d00000000004442cb3ca5f694cb2ab1f90b4fc48626f4e9c93594c9166a0405a69947fc28dcd98f1b6affff001d50020eb3",
+        "0000602aab7be2beb013f0669e3fe8080e5b5f631caa1b6283ab2aa9d5680000000000004e574f4ec64c3f349c494575094c50b1900e1abe54342b2e3fa05b025a6055cf8a941b6affff001d8400f018",
+        "00a0632ec5854ca79337334f603aa86aa30b392989751014d7938277dcc0ce000000000041ebeff4da8e88193780a41f9bd1be92e1aea0b5c72e90f83f3cd5ac1e27a1d73b991b6affff001d4200d8fb",
+        "0040d7270f600bd55375dfbdb9427b408ef1e206b6b70dddf83c52ecfe97e20000000000db9067c08dbd41de36ad31e58d06935f301a49e7a3237eb365b67edc41f6b4a5ec9d1b6affff001d740263d3",
+        "0040532e071c2b4fd781b267fd6905f686362ef6be7f517b64429909e4b36d00000000009125e0b0ed6b67866520fe4eab8f6cedc4487383e4b6c97d526ee0fe4a7475d69da21b6affff001dd0025912",
+        "00c03131c3f75fe30714f2c9479bee4d4a7e654713899b96c5ae3cc2c9c5c5000000000082758b8d019959809c50dcbe4c297f396093282d320297d2e3a4533f869592864ea71b6affff001d9e00d72d"
+      ]
+    }
+  ]
+}
diff --git a/vendor/sidestr/schema/schema/core.jsonld b/vendor/sidestr/schema/schema/core.jsonld
new file mode 100644
index 0000000..fd4b249
--- /dev/null
+++ b/vendor/sidestr/schema/schema/core.jsonld
@@ -0,0 +1,329 @@
+{
+  "@context": "../context.jsonld",
+  "@graph": [
+    {
+      "@id": "btc:core",
+      "@type": "Module",
+      "label": "core",
+      "version": "0.0.2",
+      "comment": "Consensus-critical structures of the Bitcoin protocol. Every field tagged with a wireType exists in the canonical byte serialization and is covered by proof-of-work. Derived fields are computed deterministically from consensus bytes and are never serialized.",
+      "layer": "consensus"
+    },
+
+    {
+      "@id": "btc:OutPoint",
+      "@type": "ConsensusStruct",
+      "module": "btc:core",
+      "label": "OutPoint",
+      "comment": "A reference to a specific output of a previous transaction. Exactly 36 bytes on the wire.",
+      "wireSize": 36,
+      "fields": [
+        {
+          "property": "btc:txid",
+          "label": "txid",
+          "comment": "Transaction identifier of the transaction containing the output being spent. Serialized as 32 bytes in internal (little-endian) order; displayed reversed as hex.",
+          "wireType": "hash256"
+        },
+        {
+          "property": "btc:vout",
+          "label": "vout",
+          "comment": "Zero-based index of the output within the referenced transaction.",
+          "wireType": "u32le"
+        }
+      ]
+    },
+
+    {
+      "@id": "btc:TransactionInput",
+      "@type": "ConsensusStruct",
+      "module": "btc:core",
+      "label": "TransactionInput",
+      "comment": "An input of a transaction: a pointer to the coin being spent, the unlocking script, and the sequence number. A coinbase input references the null outpoint (all-zero txid, vout 0xffffffff).",
+      "fields": [
+        {
+          "property": "btc:prevout",
+          "label": "prevout",
+          "comment": "The outpoint identifying the transaction output being spent.",
+          "wireType": "struct",
+          "structType": "btc:OutPoint"
+        },
+        {
+          "property": "btc:scriptSig",
+          "label": "scriptSig",
+          "comment": "Unlocking script satisfying the conditions of the referenced output's scriptPubKey. Empty for native segwit spends. Variable length, prefixed by a CompactSize count.",
+          "wireType": "varbytes"
+        },
+        {
+          "property": "btc:sequence",
+          "label": "sequence",
+          "comment": "Sequence number. Used for relative lock-time (BIP 68) and opt-in replace-by-fee signalling (BIP 125).",
+          "wireType": "u32le",
+          "bip": [68, 125]
+        }
+      ]
+    },
+
+    {
+      "@id": "btc:TransactionOutput",
+      "@type": "ConsensusStruct",
+      "module": "btc:core",
+      "label": "TransactionOutput",
+      "comment": "An output of a transaction: an amount and the locking script that encumbers it. An unspent output (UTXO) is the fundamental unit of bitcoin ownership.",
+      "fields": [
+        {
+          "property": "btc:value",
+          "label": "value",
+          "comment": "Amount in satoshis (1 BTC = 100,000,000 satoshis). Signed 64-bit little-endian on the wire; consensus-valid range is 0 to 21,000,000 BTC.",
+          "wireType": "i64le"
+        },
+        {
+          "property": "btc:scriptPubKey",
+          "label": "scriptPubKey",
+          "comment": "Locking script defining the conditions under which this output may be spent. Variable length, prefixed by a CompactSize count.",
+          "wireType": "varbytes"
+        }
+      ]
+    },
+
+    {
+      "@id": "btc:Witness",
+      "@type": "ConsensusStruct",
+      "module": "btc:core",
+      "label": "Witness",
+      "comment": "The segregated witness for a single input: a stack of byte vectors consumed by script execution (BIP 141). On the wire each witness is a CompactSize item count followed by that many CompactSize-prefixed byte vectors. Witness data is committed to by wtxid and the witness commitment in the coinbase, but excluded from txid.",
+      "bip": [141],
+      "fields": [
+        {
+          "property": "btc:stack",
+          "label": "stack",
+          "comment": "Ordered stack items, bottom first, each an arbitrary byte vector.",
+          "wireType": "vec",
+          "itemType": "varbytes"
+        }
+      ]
+    },
+
+    {
+      "@id": "btc:Transaction",
+      "@type": "ConsensusStruct",
+      "module": "btc:core",
+      "label": "Transaction",
+      "comment": "A transfer of bitcoin value: a list of inputs spending existing outputs and a list of new outputs. Two serializations exist: legacy (txid, excludes marker/flag/witness) and full segwit (wtxid, BIP 144).",
+      "fields": [
+        {
+          "property": "btc:version",
+          "label": "version",
+          "comment": "Transaction format version. Version 2 enables BIP 68 relative lock-time semantics.",
+          "wireType": "i32le",
+          "bip": [68]
+        },
+        {
+          "property": "btc:marker",
+          "label": "marker",
+          "comment": "Segwit marker byte, always 0x00. Present only in the segwit serialization (BIP 144). Distinguishable from legacy because a legacy transaction cannot have zero inputs.",
+          "wireType": "u8",
+          "presentIf": "segwit",
+          "constValue": 0,
+          "bip": [144]
+        },
+        {
+          "property": "btc:flag",
+          "label": "flag",
+          "comment": "Segwit flag byte, currently always 0x01. Present only in the segwit serialization.",
+          "wireType": "u8",
+          "presentIf": "segwit",
+          "constValue": 1,
+          "bip": [144]
+        },
+        {
+          "property": "btc:inputs",
+          "label": "inputs",
+          "comment": "Transaction inputs, prefixed by a CompactSize count. Must be non-empty.",
+          "wireType": "vec",
+          "itemType": "btc:TransactionInput"
+        },
+        {
+          "property": "btc:outputs",
+          "label": "outputs",
+          "comment": "Transaction outputs, prefixed by a CompactSize count. Must be non-empty.",
+          "wireType": "vec",
+          "itemType": "btc:TransactionOutput"
+        },
+        {
+          "property": "btc:witness",
+          "label": "witness",
+          "comment": "One witness per input, in input order. NOT prefixed by a count: the number of witnesses equals the number of inputs. Present only in the segwit serialization.",
+          "wireType": "witness",
+          "itemType": "btc:Witness",
+          "presentIf": "segwit",
+          "bip": [141, 144]
+        },
+        {
+          "property": "btc:lockTime",
+          "label": "lockTime",
+          "comment": "Earliest time the transaction may be mined: a block height if below 500,000,000, otherwise a Unix timestamp. Only enforced if some input has a non-final sequence (BIP 65 for script-level enforcement).",
+          "wireType": "u32le",
+          "bip": [65]
+        }
+      ],
+      "derived": [
+        {
+          "property": "btc:txid",
+          "label": "txid",
+          "comment": "Transaction identifier: double-SHA256 of the legacy serialization (witness excluded), displayed byte-reversed as hex.",
+          "derivation": "reverseHex(dsha256(serializeLegacy(this)))"
+        },
+        {
+          "property": "btc:wtxid",
+          "label": "wtxid",
+          "comment": "Witness transaction identifier: double-SHA256 of the full segwit serialization. Equal to txid for transactions with no witness data.",
+          "derivation": "reverseHex(dsha256(serialize(this)))"
+        },
+        {
+          "property": "btc:size",
+          "label": "size",
+          "comment": "Size in bytes of the full serialization.",
+          "derivation": "byteLength(serialize(this))"
+        },
+        {
+          "property": "btc:weight",
+          "label": "weight",
+          "comment": "Block weight contribution (BIP 141): 3 × legacy size + full size. The consensus block limit is 4,000,000 weight units.",
+          "derivation": "3 * byteLength(serializeLegacy(this)) + byteLength(serialize(this))",
+          "bip": [141]
+        },
+        {
+          "property": "btc:vsize",
+          "label": "vsize",
+          "comment": "Virtual size in vbytes: weight / 4, rounded up. The unit used for fee rates.",
+          "derivation": "ceil(weight(this) / 4)"
+        }
+      ]
+    },
+
+    {
+      "@id": "btc:BlockHeader",
+      "@type": "ConsensusStruct",
+      "module": "btc:core",
+      "label": "BlockHeader",
+      "comment": "The 80-byte block header: the structure actually hashed for proof-of-work. A headers-only chain is sufficient to verify cumulative work and anchor SPV proofs.",
+      "wireSize": 80,
+      "fields": [
+        {
+          "property": "btc:version",
+          "label": "version",
+          "comment": "Block version. Since BIP 9, version bits signal readiness for soft forks.",
+          "wireType": "i32le",
+          "bip": [9, 34]
+        },
+        {
+          "property": "btc:prevBlockHash",
+          "label": "prevBlockHash",
+          "comment": "Hash of the previous block header, forming the chain. All zeros for the genesis block.",
+          "wireType": "hash256"
+        },
+        {
+          "property": "btc:merkleRoot",
+          "label": "merkleRoot",
+          "comment": "Root of the merkle tree over all transaction txids in the block, committing the header to the block's transactions.",
+          "wireType": "hash256"
+        },
+        {
+          "property": "btc:time",
+          "label": "time",
+          "comment": "Block timestamp as Unix time. Must be greater than the median time of the previous 11 blocks and no more than 2 hours in the future.",
+          "wireType": "u32le"
+        },
+        {
+          "property": "btc:bits",
+          "label": "bits",
+          "comment": "Compact (nBits) encoding of the proof-of-work target threshold the block hash must not exceed.",
+          "wireType": "u32le"
+        },
+        {
+          "property": "btc:nonce",
+          "label": "nonce",
+          "comment": "Arbitrary value miners vary to search for a hash satisfying the target.",
+          "wireType": "u32le"
+        }
+      ],
+      "derived": [
+        {
+          "property": "btc:hash",
+          "label": "hash",
+          "comment": "Block hash: double-SHA256 of the 80 serialized header bytes, displayed byte-reversed as hex. Must be numerically below the target encoded by bits.",
+          "derivation": "reverseHex(dsha256(serialize(this)))"
+        },
+        {
+          "property": "btc:target",
+          "label": "target",
+          "comment": "The 256-bit proof-of-work target threshold expanded from the compact bits encoding.",
+          "derivation": "expandCompact(bits)"
+        },
+        {
+          "property": "btc:work",
+          "label": "work",
+          "comment": "Expected work to find this block: 2^256 / (target + 1). Summed along a chain to determine the best (most-work) chain.",
+          "derivation": "2^256 / (target(this) + 1)"
+        }
+      ]
+    },
+
+    {
+      "@id": "btc:Block",
+      "@type": "ConsensusStruct",
+      "module": "btc:core",
+      "label": "Block",
+      "comment": "A full block: an 80-byte header followed by the block's transactions. The first transaction must be the coinbase.",
+      "fields": [
+        {
+          "property": "btc:header",
+          "label": "header",
+          "comment": "The block header.",
+          "wireType": "struct",
+          "structType": "btc:BlockHeader"
+        },
+        {
+          "property": "btc:transactions",
+          "label": "transactions",
+          "comment": "The block's transactions, prefixed by a CompactSize count. The first must be the coinbase transaction.",
+          "wireType": "vec",
+          "itemType": "btc:Transaction"
+        }
+      ],
+      "derived": [
+        {
+          "property": "btc:hash",
+          "label": "hash",
+          "comment": "The block hash, derived from the header alone.",
+          "derivation": "hash(header)"
+        },
+        {
+          "property": "btc:txCount",
+          "label": "txCount",
+          "comment": "Number of transactions in the block.",
+          "derivation": "length(transactions)"
+        },
+        {
+          "property": "btc:merkleRoot",
+          "label": "merkleRoot",
+          "comment": "Merkle root recomputed from the transactions' txids; block is invalid unless it equals header.merkleRoot.",
+          "derivation": "merkleRoot(map(transactions, txid))"
+        },
+        {
+          "property": "btc:size",
+          "label": "size",
+          "comment": "Size in bytes of the full block serialization.",
+          "derivation": "byteLength(serialize(this))"
+        },
+        {
+          "property": "btc:weight",
+          "label": "weight",
+          "comment": "Total block weight (BIP 141). Consensus limit: 4,000,000 weight units.",
+          "derivation": "sum(map(transactions, weight)) + 4 * (byteLength(serialize(header)) + byteLength(varint(txCount)))",
+          "bip": [141]
+        }
+      ]
+    }
+  ]
+}
diff --git a/vendor/sidestr/schema/schema/overlays/knots-blake2b.jsonld b/vendor/sidestr/schema/schema/overlays/knots-blake2b.jsonld
new file mode 100644
index 0000000..9c4981e
--- /dev/null
+++ b/vendor/sidestr/schema/schema/overlays/knots-blake2b.jsonld
@@ -0,0 +1,240 @@
+{
+  "@context": {
+    "knots": "https://bitcoinknots.org/ns#"
+  },
+  "@id": "knots:blake2b-overlay",
+  "comment": "Bitcoin Knots BLAKE2b hardfork (v29.4.1.knots20260508, PRs 357/359/385): a 164-byte v2 block header selected by the top bit of version, a new proof-of-work hash, the unified opt-in signature hash (SIGHASH_UNIFIED, active from the same height: unifiedSighashParam names it), and two chains forking from Bitcoin history. Additive overlay: nothing in the base model is redefined.",
+  "@graph": [
+    {
+      "@id": "knots:BlockHeaderV2",
+      "@type": "ConsensusStruct",
+      "module": "knots:blake2b",
+      "label": "BlockHeaderV2",
+      "comment": "The 164-byte header used from the BLAKE2b fork height. The first 80 bytes keep the classic layout (version with bit 31 set; the wire time may be offset). Proof of work is the BLAKE2b construction over a commitment tree of these fields, not SHA256d of the bytes.",
+      "wireSize": 164,
+      "fields": [
+        {
+          "property": "btc:version",
+          "label": "version",
+          "comment": "Raw wire version: bit 31 set marks a v2 header; the low bits carry the usual version.",
+          "wireType": "u32le"
+        },
+        {
+          "property": "btc:prevBlockHash",
+          "label": "prevBlockHash",
+          "wireType": "hash256"
+        },
+        {
+          "property": "btc:merkleRoot",
+          "label": "merkleRoot",
+          "wireType": "hash256"
+        },
+        {
+          "property": "knots:timeOnWire",
+          "label": "timeOnWire",
+          "comment": "Block time as serialized. The consensus time is timeOnWire + timeOffset when flags bit 2 is set.",
+          "wireType": "u32le"
+        },
+        {
+          "property": "btc:bits",
+          "label": "bits",
+          "wireType": "u32le"
+        },
+        {
+          "property": "btc:nonce",
+          "label": "nonce",
+          "wireType": "u32le"
+        },
+        {
+          "property": "knots:nonce2",
+          "label": "nonce2",
+          "wireType": "u32le"
+        },
+        {
+          "property": "knots:nonce3",
+          "label": "nonce3",
+          "wireType": "u32le"
+        },
+        {
+          "property": "knots:extranonce",
+          "label": "extranonce",
+          "comment": "128-bit extranonce, wire order (bitcoind's RPC shows it byte-reversed).",
+          "wireType": "bytes",
+          "wireSize": 16
+        },
+        {
+          "property": "knots:timeOffset",
+          "label": "timeOffset",
+          "wireType": "u32le"
+        },
+        {
+          "property": "knots:txCount",
+          "label": "txCount",
+          "comment": "Committed transaction count; must equal the block's transaction count.",
+          "wireType": "u16le"
+        },
+        {
+          "property": "knots:flags",
+          "label": "flags",
+          "comment": "Bits 0-1: ASIC layout profile; bit 2: time offset in use; bits 6-7 reserved for future hardforks (must be 0).",
+          "wireType": "u8"
+        },
+        {
+          "property": "knots:xorKeyMaskClearBits",
+          "label": "xorKeyMaskClearBits",
+          "wireType": "u8"
+        },
+        {
+          "property": "knots:xorKey",
+          "label": "xorKey",
+          "comment": "128-bit PoW XOR key, wire order.",
+          "wireType": "bytes",
+          "wireSize": 16
+        },
+        {
+          "property": "knots:height",
+          "label": "height",
+          "comment": "Committed height; must equal the previous header's height + 1.",
+          "wireType": "i32le"
+        },
+        {
+          "property": "knots:mmRhs",
+          "label": "mmRhs",
+          "comment": "Merge-mining hook right-hand side (reserved; all zeros so far).",
+          "wireType": "hash256"
+        }
+      ]
+    },
+    {
+      "@id": "btc:testnet4-blake2b",
+      "@type": "btc:NetworkParams",
+      "extends": "btc:testnet4",
+      "label": "testnet4-blake2b",
+      "name": "testnet4-blake2b",
+      "comment": "Bitcoin Knots' BLAKE2b fork of testnet4: shares Core's testnet4 history through 150307, then v2 headers and BLAKE2b proof of work from 150308 (2026-08-30). Keeps testnet4's 20-minute minimum-difficulty exception.",
+      "powHash": "knots:blake2b-v2",
+      "structVariants": {
+        "btc:BlockHeader": [
+          {
+            "when": {
+              "field": "version",
+              "bit": 31
+            },
+            "struct": "knots:BlockHeaderV2"
+          }
+        ]
+      },
+      "blake2bHeight": 150308,
+      "unifiedSighashParam": "blake2bHeight",
+      "rdtsExpiryTime": 1791903600,
+      "lastSharedBlock": {
+        "height": 150307,
+        "hash": "000000000017ec2251d81c8d2ca401c713e98e85196c7f660a4088a7ca57b1cc"
+      },
+      "forkBlockHash": "000000000000b9d1b7e1bb0e77215ee92c6ef7ec8f4473e23908380649e779b6",
+      "targetAdjustments": [
+        {
+          "height": 150308,
+          "shiftLeft": 20
+        }
+      ]
+    },
+    {
+      "@id": "btc:mainnet-blake2b",
+      "@type": "btc:NetworkParams",
+      "extends": "btc:mainnet",
+      "label": "mainnet-blake2b",
+      "name": "mainnet-blake2b",
+      "comment": "Bitcoin Knots' BLAKE2b hardfork chain: shares Bitcoin's history through 961631, eight Knots-only SHA256d blocks 961632-961639, then v2 headers and BLAKE2b proof of work from 961640 (2026-08-30).",
+      "powHash": "knots:blake2b-v2",
+      "structVariants": {
+        "btc:BlockHeader": [
+          {
+            "when": {
+              "field": "version",
+              "bit": 31
+            },
+            "struct": "knots:BlockHeaderV2"
+          }
+        ]
+      },
+      "blake2bHeight": 961640,
+      "unifiedSighashParam": "blake2bHeight",
+      "blake2bHeadline": "8-30 NYPost Deride And Conquer",
+      "forkBlockHash": "0000000000000050c1e5f69672f459293be14f46e5a494e7a8c8541396f18eeb",
+      "rdtsExpiryTime": 1819756800,
+      "targetAdjustments": [
+        {
+          "height": 961640,
+          "shiftLeft": 22
+        }
+      ]
+    },
+    {
+      "@id": "knots:rule-header-v1-until-fork",
+      "@type": "ValidationRule",
+      "ruleSet": "btc:HeaderRules",
+      "label": "v1-until-fork",
+      "errorCode": "bad-version-sha256d",
+      "comment": "A v2 (BLAKE2b) header may only commit to a height at or after the fork height; before it, blocks are SHA256d v1 headers.",
+      "check": "!isV2(header) || header.height >= blake2bHeight"
+    },
+    {
+      "@id": "knots:rule-header-v2-from-fork",
+      "@type": "ValidationRule",
+      "ruleSet": "btc:HeaderRules",
+      "label": "v2-from-fork",
+      "errorCode": "bad-version-blake2b",
+      "comment": "From the fork height every header must be v2 with BLAKE2b proof of work.",
+      "check": "height < blake2bHeight || isV2(header)",
+      "activationParam": "blake2bHeight"
+    },
+    {
+      "@id": "knots:rule-header-height",
+      "@type": "ValidationRule",
+      "ruleSet": "btc:HeaderRules",
+      "label": "header-height",
+      "errorCode": "bad-header-height",
+      "comment": "The height committed in a v2 header must equal the block's chain height (the previous block's height + 1). v1 headers commit no height and pass.",
+      "check": "!isV2(header) || header.height === height",
+      "activationParam": "blake2bHeight"
+    },
+    {
+      "@id": "knots:rule-header-flags-reserved",
+      "@type": "ValidationRule",
+      "ruleSet": "btc:HeaderRules",
+      "label": "flags-reserved",
+      "errorCode": "bad-flags-highbits",
+      "comment": "The top two bits of a v2 header's flags are reserved for future hardforks and must be zero.",
+      "check": "!isV2(header) || (header.flags & 0xc0) === 0",
+      "activationParam": "blake2bHeight"
+    },
+    {
+      "@id": "knots:rule-block-txcount",
+      "@type": "ValidationRule",
+      "ruleSet": "btc:BlockRules",
+      "label": "txcount",
+      "errorCode": "bad-txnlist-size",
+      "comment": "The transaction count committed in a v2 header must equal the number of transactions in the block.",
+      "check": "!isV2(block.header) || block.header.txCount === block.transactions.length"
+    },
+    {
+      "@id": "knots:rule-block-headline",
+      "@type": "ValidationRule",
+      "ruleSet": "btc:BlockRules",
+      "label": "headline",
+      "errorCode": "bad-headline",
+      "comment": "The fork block's coinbase scriptSig must contain the chain's proof-of-time headline (mainnet: '8-30 NYPost Deride And Conquer'; testnet4 sets none).",
+      "check": "block.header.height !== blake2bHeight || coinbase.scriptSig includes blake2bHeadline"
+    },
+    {
+      "@id": "knots:rule-blockctx-weight-rdts",
+      "@type": "ValidationRule",
+      "ruleSet": "btc:BlockContextRules",
+      "label": "weight-rdts",
+      "errorCode": "bad-blk-weight-reduced_data",
+      "comment": "While the ReducedData temporary softfork is active (from the fork height until the parent's median-time-past reaches rdtsExpiryTime) block weight is capped at 800,000.",
+      "check": "!rdtsActiveAt(height, mtpPrev) || weight(block) <= 800000"
+    }
+  ]
+}
diff --git a/vendor/sidestr/schema/schema/proof.jsonld b/vendor/sidestr/schema/schema/proof.jsonld
new file mode 100644
index 0000000..0d792a8
--- /dev/null
+++ b/vendor/sidestr/schema/schema/proof.jsonld
@@ -0,0 +1,102 @@
+{
+  "@context": "../context.jsonld",
+  "@graph": [
+    {
+      "@id": "btc:proof",
+      "@type": "Module",
+      "label": "proof",
+      "version": "0.0.12",
+      "comment": "Compact proofs that let a client verify facts about the chain without holding the chain: merkle inclusion proofs anchor a transaction to a header, and the header chain's proof-of-work does the rest. This is the basis of SPV (Simplified Payment Verification, described in section 8 of the Bitcoin whitepaper).",
+      "layer": "proof"
+    },
+    {
+      "@id": "btc:MerkleBlock",
+      "@type": "ConsensusStruct",
+      "module": "btc:proof",
+      "label": "MerkleBlock",
+      "comment": "A partial merkle tree proof (BIP 37): a block header plus the minimal set of hashes and traversal flags needed to prove that specific transactions are committed by the header's merkleRoot. Verifying one requires only the 80-byte header chain \u2014 no block data.",
+      "bip": [
+        37
+      ],
+      "fields": [
+        {
+          "property": "btc:header",
+          "label": "header",
+          "comment": "The block header whose merkleRoot the proof reconstructs. Its proof-of-work and chain membership are verified exactly as in headers-only sync.",
+          "wireType": "struct",
+          "structType": "btc:BlockHeader"
+        },
+        {
+          "property": "btc:txCount",
+          "label": "txCount",
+          "comment": "Total number of transactions in the block, defining the shape of the full merkle tree.",
+          "wireType": "u32le"
+        },
+        {
+          "property": "btc:hashes",
+          "label": "hashes",
+          "comment": "The pruned-branch and matched-transaction hashes, in depth-first traversal order, prefixed by a CompactSize count.",
+          "wireType": "vec",
+          "itemType": "hash256"
+        },
+        {
+          "property": "btc:flags",
+          "label": "flags",
+          "comment": "Depth-first traversal flag bits, least-significant bit of each byte first, prefixed by a CompactSize byte count. A set bit at an interior node means descend; a set bit at a leaf marks a matched transaction; a clear bit means the subtree is summarized by one hash.",
+          "wireType": "varbytes"
+        }
+      ],
+      "derived": [
+        {
+          "property": "btc:root",
+          "label": "root",
+          "comment": "The merkle root reconstructed by depth-first traversal of the partial tree. The proof is valid only if it equals header.merkleRoot.",
+          "derivation": "extractPartialMerkleTree(txCount, hashes, flags).root"
+        },
+        {
+          "property": "btc:matchedTransactions",
+          "label": "matchedTransactions",
+          "comment": "The txids the proof demonstrates inclusion for, with their positions in the block.",
+          "derivation": "extractPartialMerkleTree(txCount, hashes, flags).matches"
+        }
+      ]
+    },
+    {
+      "@id": "btc:FilterParams",
+      "@type": "ContextStruct",
+      "module": "btc:proof",
+      "label": "FilterParams",
+      "bip": 158,
+      "comment": "Parameters of a Golomb-Rice coded set filter. Items are hashed with SipHash-2-4 (keyed by the first 16 bytes of the block hash) into [0, N*M), sorted, and delta-encoded with Rice parameter P. A filter's serialization is a CompactSize item count followed by the bitstream.",
+      "fields": [
+        {
+          "property": "btc:filterType",
+          "label": "filterType",
+          "valueType": "u8",
+          "comment": "Filter type byte; 0x00 is the basic filter."
+        },
+        {
+          "property": "btc:riceParameter",
+          "label": "p",
+          "valueType": "u8",
+          "comment": "Golomb-Rice remainder bit width."
+        },
+        {
+          "property": "btc:falsePositiveModulus",
+          "label": "m",
+          "valueType": "u32",
+          "comment": "Target range multiplier; the per-item false-positive rate is 1/M."
+        }
+      ]
+    },
+    {
+      "@id": "btc:basicFilter",
+      "@type": "btc:FilterParams",
+      "label": "basicFilter",
+      "comment": "The BIP 158 basic filter: every spent prevout scriptPubKey and every created scriptPubKey (empty scripts and OP_RETURN outputs excluded). Filter headers chain as dsha256(filterHash || prevFilterHeader), giving light clients a comparable commitment across peers (BIP 157).",
+      "filterType": 0,
+      "p": 19,
+      "m": 784931
+    }
+  ]
+}
\ No newline at end of file
diff --git a/vendor/sidestr/schema/schema/script.jsonld b/vendor/sidestr/schema/schema/script.jsonld
new file mode 100644
index 0000000..29c0db5
--- /dev/null
+++ b/vendor/sidestr/schema/schema/script.jsonld
@@ -0,0 +1,1004 @@
+{
+  "@context": "../context.jsonld",
+  "@graph": [
+    {
+      "@id": "btc:script",
+      "@type": "Module",
+      "label": "script",
+      "version": "0.0.8",
+      "comment": "The Bitcoin script language surface: the opcode set, the standard output script templates with their address encodings, and signature hash types. Templates are declarative \u2014 the classifier matches them as data.",
+      "layer": "consensus"
+    },
+    {
+      "@id": "btc:Opcode",
+      "@type": "Enumeration",
+      "module": "btc:script",
+      "label": "Opcode",
+      "comment": "Every assigned script opcode. Bytes 0x01-0x4b are OP_PUSHBYTES_1..75 (push that many following bytes) and are modeled as a range rather than 75 members. Disabled opcodes make a transaction invalid if present in an executed script. Unassigned bytes above OP_CHECKSIGADD are invalid in legacy/segwit script and OP_SUCCESSx in tapscript (BIP 342).",
+      "members": [
+        {
+          "name": "OP_0",
+          "code": 0,
+          "category": "constants",
+          "comment": "Push an empty byte vector (numeric zero). Alias OP_FALSE."
+        },
+        {
+          "name": "OP_PUSHDATA1",
+          "code": 76,
+          "category": "constants",
+          "comment": "The next byte gives the number of bytes to push."
+        },
+        {
+          "name": "OP_PUSHDATA2",
+          "code": 77,
+          "category": "constants",
+          "comment": "The next two bytes (LE) give the number of bytes to push."
+        },
+        {
+          "name": "OP_PUSHDATA4",
+          "code": 78,
+          "category": "constants",
+          "comment": "The next four bytes (LE) give the number of bytes to push."
+        },
+        {
+          "name": "OP_1NEGATE",
+          "code": 79,
+          "category": "constants",
+          "comment": "Push the number -1."
+        },
+        {
+          "name": "OP_RESERVED",
+          "code": 80,
+          "category": "reserved",
+          "comment": "Reserved; transaction is invalid unless occurring in an unexecuted branch."
+        },
+        {
+          "name": "OP_1",
+          "code": 81,
+          "category": "constants",
+          "comment": "Push the number 1. Also the segwit/taproot witness version prefix."
+        },
+        {
+          "name": "OP_2",
+          "code": 82,
+          "category": "constants",
+          "comment": "Push the number 2."
+        },
+        {
+          "name": "OP_3",
+          "code": 83,
+          "category": "constants",
+          "comment": "Push the number 3."
+        },
+        {
+          "name": "OP_4",
+          "code": 84,
+          "category": "constants",
+          "comment": "Push the number 4."
+        },
+        {
+          "name": "OP_5",
+          "code": 85,
+          "category": "constants",
+          "comment": "Push the number 5."
+        },
+        {
+          "name": "OP_6",
+          "code": 86,
+          "category": "constants",
+          "comment": "Push the number 6."
+        },
+        {
+          "name": "OP_7",
+          "code": 87,
+          "category": "constants",
+          "comment": "Push the number 7."
+        },
+        {
+          "name": "OP_8",
+          "code": 88,
+          "category": "constants",
+          "comment": "Push the number 8."
+        },
+        {
+          "name": "OP_9",
+          "code": 89,
+          "category": "constants",
+          "comment": "Push the number 9."
+        },
+        {
+          "name": "OP_10",
+          "code": 90,
+          "category": "constants",
+          "comment": "Push the number 10."
+        },
+        {
+          "name": "OP_11",
+          "code": 91,
+          "category": "constants",
+          "comment": "Push the number 11."
+        },
+        {
+          "name": "OP_12",
+          "code": 92,
+          "category": "constants",
+          "comment": "Push the number 12."
+        },
+        {
+          "name": "OP_13",
+          "code": 93,
+          "category": "constants",
+          "comment": "Push the number 13."
+        },
+        {
+          "name": "OP_14",
+          "code": 94,
+          "category": "constants",
+          "comment": "Push the number 14."
+        },
+        {
+          "name": "OP_15",
+          "code": 95,
+          "category": "constants",
+          "comment": "Push the number 15."
+        },
+        {
+          "name": "OP_16",
+          "code": 96,
+          "category": "constants",
+          "comment": "Push the number 16."
+        },
+        {
+          "name": "OP_NOP",
+          "code": 97,
+          "category": "flow",
+          "comment": "Does nothing."
+        },
+        {
+          "name": "OP_VER",
+          "code": 98,
+          "category": "reserved",
+          "comment": "Reserved; invalid unless in an unexecuted branch."
+        },
+        {
+          "name": "OP_IF",
+          "code": 99,
+          "category": "flow",
+          "comment": "Execute the following statements if the top stack value is true (popped)."
+        },
+        {
+          "name": "OP_NOTIF",
+          "code": 100,
+          "category": "flow",
+          "comment": "Execute the following statements if the top stack value is false (popped)."
+        },
+        {
+          "name": "OP_VERIF",
+          "code": 101,
+          "category": "reserved",
+          "comment": "Reserved; transaction is invalid even in an unexecuted branch."
+        },
+        {
+          "name": "OP_VERNOTIF",
+          "code": 102,
+          "category": "reserved",
+          "comment": "Reserved; transaction is invalid even in an unexecuted branch."
+        },
+        {
+          "name": "OP_ELSE",
+          "code": 103,
+          "category": "flow",
+          "comment": "Execute if the preceding OP_IF/OP_NOTIF branch was not executed."
+        },
+        {
+          "name": "OP_ENDIF",
+          "code": 104,
+          "category": "flow",
+          "comment": "Ends an OP_IF/OP_NOTIF/OP_ELSE block."
+        },
+        {
+          "name": "OP_VERIFY",
+          "code": 105,
+          "category": "flow",
+          "comment": "Fail the script if the top stack value is not true; pops it."
+        },
+        {
+          "name": "OP_RETURN",
+          "code": 106,
+          "category": "flow",
+          "comment": "Fail the script immediately. Standard for provably-unspendable data-carrier outputs."
+        },
+        {
+          "name": "OP_TOALTSTACK",
+          "code": 107,
+          "category": "stack",
+          "comment": "Move the top item to the alt stack."
+        },
+        {
+          "name": "OP_FROMALTSTACK",
+          "code": 108,
+          "category": "stack",
+          "comment": "Move the top alt-stack item to the main stack."
+        },
+        {
+          "name": "OP_2DROP",
+          "code": 109,
+          "category": "stack",
+          "comment": "Drop the top two items."
+        },
+        {
+          "name": "OP_2DUP",
+          "code": 110,
+          "category": "stack",
+          "comment": "Duplicate the top two items."
+        },
+        {
+          "name": "OP_3DUP",
+          "code": 111,
+          "category": "stack",
+          "comment": "Duplicate the top three items."
+        },
+        {
+          "name": "OP_2OVER",
+          "code": 112,
+          "category": "stack",
+          "comment": "Copy the third and fourth items to the top."
+        },
+        {
+          "name": "OP_2ROT",
+          "code": 113,
+          "category": "stack",
+          "comment": "Move the fifth and sixth items to the top."
+        },
+        {
+          "name": "OP_2SWAP",
+          "code": 114,
+          "category": "stack",
+          "comment": "Swap the top two pairs of items."
+        },
+        {
+          "name": "OP_IFDUP",
+          "code": 115,
+          "category": "stack",
+          "comment": "Duplicate the top item if it is not zero."
+        },
+        {
+          "name": "OP_DEPTH",
+          "code": 116,
+          "category": "stack",
+          "comment": "Push the stack depth."
+        },
+        {
+          "name": "OP_DROP",
+          "code": 117,
+          "category": "stack",
+          "comment": "Drop the top item."
+        },
+        {
+          "name": "OP_DUP",
+          "code": 118,
+          "category": "stack",
+          "comment": "Duplicate the top item."
+        },
+        {
+          "name": "OP_NIP",
+          "code": 119,
+          "category": "stack",
+          "comment": "Remove the second item."
+        },
+        {
+          "name": "OP_OVER",
+          "code": 120,
+          "category": "stack",
+          "comment": "Copy the second item to the top."
+        },
+        {
+          "name": "OP_PICK",
+          "code": 121,
+          "category": "stack",
+          "comment": "Copy the item n back to the top (n popped)."
+        },
+        {
+          "name": "OP_ROLL",
+          "code": 122,
+          "category": "stack",
+          "comment": "Move the item n back to the top (n popped)."
+        },
+        {
+          "name": "OP_ROT",
+          "code": 123,
+          "category": "stack",
+          "comment": "Rotate the top three items."
+        },
+        {
+          "name": "OP_SWAP",
+          "code": 124,
+          "category": "stack",
+          "comment": "Swap the top two items."
+        },
+        {
+          "name": "OP_TUCK",
+          "code": 125,
+          "category": "stack",
+          "comment": "Copy the top item below the second."
+        },
+        {
+          "name": "OP_CAT",
+          "code": 126,
+          "category": "splice",
+          "comment": "Concatenate two byte vectors.",
+          "disabled": true
+        },
+        {
+          "name": "OP_SUBSTR",
+          "code": 127,
+          "category": "splice",
+          "comment": "Return a section of a byte vector.",
+          "disabled": true
+        },
+        {
+          "name": "OP_LEFT",
+          "code": 128,
+          "category": "splice",
+          "comment": "Keep only bytes left of a position.",
+          "disabled": true
+        },
+        {
+          "name": "OP_RIGHT",
+          "code": 129,
+          "category": "splice",
+          "comment": "Keep only bytes right of a position.",
+          "disabled": true
+        },
+        {
+          "name": "OP_SIZE",
+          "code": 130,
+          "category": "splice",
+          "comment": "Push the length of the top byte vector (without popping it)."
+        },
+        {
+          "name": "OP_INVERT",
+          "code": 131,
+          "category": "bitlogic",
+          "comment": "Bitwise NOT.",
+          "disabled": true
+        },
+        {
+          "name": "OP_AND",
+          "code": 132,
+          "category": "bitlogic",
+          "comment": "Bitwise AND.",
+          "disabled": true
+        },
+        {
+          "name": "OP_OR",
+          "code": 133,
+          "category": "bitlogic",
+          "comment": "Bitwise OR.",
+          "disabled": true
+        },
+        {
+          "name": "OP_XOR",
+          "code": 134,
+          "category": "bitlogic",
+          "comment": "Bitwise XOR.",
+          "disabled": true
+        },
+        {
+          "name": "OP_EQUAL",
+          "code": 135,
+          "category": "bitlogic",
+          "comment": "Push true if the top two items are exactly equal."
+        },
+        {
+          "name": "OP_EQUALVERIFY",
+          "code": 136,
+          "category": "bitlogic",
+          "comment": "OP_EQUAL then OP_VERIFY."
+        },
+        {
+          "name": "OP_RESERVED1",
+          "code": 137,
+          "category": "reserved",
+          "comment": "Reserved; invalid unless in an unexecuted branch."
+        },
+        {
+          "name": "OP_RESERVED2",
+          "code": 138,
+          "category": "reserved",
+          "comment": "Reserved; invalid unless in an unexecuted branch."
+        },
+        {
+          "name": "OP_1ADD",
+          "code": 139,
+          "category": "arithmetic",
+          "comment": "Add 1."
+        },
+        {
+          "name": "OP_1SUB",
+          "code": 140,
+          "category": "arithmetic",
+          "comment": "Subtract 1."
+        },
+        {
+          "name": "OP_2MUL",
+          "code": 141,
+          "category": "arithmetic",
+          "comment": "Multiply by 2.",
+          "disabled": true
+        },
+        {
+          "name": "OP_2DIV",
+          "code": 142,
+          "category": "arithmetic",
+          "comment": "Divide by 2.",
+          "disabled": true
+        },
+        {
+          "name": "OP_NEGATE",
+          "code": 143,
+          "category": "arithmetic",
+          "comment": "Negate."
+        },
+        {
+          "name": "OP_ABS",
+          "code": 144,
+          "category": "arithmetic",
+          "comment": "Absolute value."
+        },
+        {
+          "name": "OP_NOT",
+          "code": 145,
+          "category": "arithmetic",
+          "comment": "Push true if input is zero, else false."
+        },
+        {
+          "name": "OP_0NOTEQUAL",
+          "code": 146,
+          "category": "arithmetic",
+          "comment": "Push false if input is zero, else true."
+        },
+        {
+          "name": "OP_ADD",
+          "code": 147,
+          "category": "arithmetic",
+          "comment": "Add the top two numbers."
+        },
+        {
+          "name": "OP_SUB",
+          "code": 148,
+          "category": "arithmetic",
+          "comment": "Subtract the top number from the second."
+        },
+        {
+          "name": "OP_MUL",
+          "code": 149,
+          "category": "arithmetic",
+          "comment": "Multiply.",
+          "disabled": true
+        },
+        {
+          "name": "OP_DIV",
+          "code": 150,
+          "category": "arithmetic",
+          "comment": "Divide.",
+          "disabled": true
+        },
+        {
+          "name": "OP_MOD",
+          "code": 151,
+          "category": "arithmetic",
+          "comment": "Remainder.",
+          "disabled": true
+        },
+        {
+          "name": "OP_LSHIFT",
+          "code": 152,
+          "category": "arithmetic",
+          "comment": "Left shift.",
+          "disabled": true
+        },
+        {
+          "name": "OP_RSHIFT",
+          "code": 153,
+          "category": "arithmetic",
+          "comment": "Right shift.",
+          "disabled": true
+        },
+        {
+          "name": "OP_BOOLAND",
+          "code": 154,
+          "category": "arithmetic",
+          "comment": "Boolean AND of the top two numbers."
+        },
+        {
+          "name": "OP_BOOLOR",
+          "code": 155,
+          "category": "arithmetic",
+          "comment": "Boolean OR of the top two numbers."
+        },
+        {
+          "name": "OP_NUMEQUAL",
+          "code": 156,
+          "category": "arithmetic",
+          "comment": "Push true if the top two numbers are equal."
+        },
+        {
+          "name": "OP_NUMEQUALVERIFY",
+          "code": 157,
+          "category": "arithmetic",
+          "comment": "OP_NUMEQUAL then OP_VERIFY."
+        },
+        {
+          "name": "OP_NUMNOTEQUAL",
+          "code": 158,
+          "category": "arithmetic",
+          "comment": "Push true if the top two numbers differ."
+        },
+        {
+          "name": "OP_LESSTHAN",
+          "code": 159,
+          "category": "arithmetic",
+          "comment": "a < b."
+        },
+        {
+          "name": "OP_GREATERTHAN",
+          "code": 160,
+          "category": "arithmetic",
+          "comment": "a > b."
+        },
+        {
+          "name": "OP_LESSTHANOREQUAL",
+          "code": 161,
+          "category": "arithmetic",
+          "comment": "a <= b."
+        },
+        {
+          "name": "OP_GREATERTHANOREQUAL",
+          "code": 162,
+          "category": "arithmetic",
+          "comment": "a >= b."
+        },
+        {
+          "name": "OP_MIN",
+          "code": 163,
+          "category": "arithmetic",
+          "comment": "Lesser of two numbers."
+        },
+        {
+          "name": "OP_MAX",
+          "code": 164,
+          "category": "arithmetic",
+          "comment": "Greater of two numbers."
+        },
+        {
+          "name": "OP_WITHIN",
+          "code": 165,
+          "category": "arithmetic",
+          "comment": "True if x is within [min, max)."
+        },
+        {
+          "name": "OP_RIPEMD160",
+          "code": 166,
+          "category": "crypto",
+          "comment": "RIPEMD-160 hash of the top item."
+        },
+        {
+          "name": "OP_SHA1",
+          "code": 167,
+          "category": "crypto",
+          "comment": "SHA-1 hash of the top item."
+        },
+        {
+          "name": "OP_SHA256",
+          "code": 168,
+          "category": "crypto",
+          "comment": "SHA-256 hash of the top item."
+        },
+        {
+          "name": "OP_HASH160",
+          "code": 169,
+          "category": "crypto",
+          "comment": "SHA-256 then RIPEMD-160 \u2014 the public-key and script hash used in addresses."
+        },
+        {
+          "name": "OP_HASH256",
+          "code": 170,
+          "category": "crypto",
+          "comment": "Double SHA-256 \u2014 the block and transaction hash function."
+        },
+        {
+          "name": "OP_CODESEPARATOR",
+          "code": 171,
+          "category": "crypto",
+          "comment": "Marks the start of signed script data."
+        },
+        {
+          "name": "OP_CHECKSIG",
+          "code": 172,
+          "category": "crypto",
+          "comment": "Verify a signature against a public key and the transaction sighash."
+        },
+        {
+          "name": "OP_CHECKSIGVERIFY",
+          "code": 173,
+          "category": "crypto",
+          "comment": "OP_CHECKSIG then OP_VERIFY."
+        },
+        {
+          "name": "OP_CHECKMULTISIG",
+          "code": 174,
+          "category": "crypto",
+          "comment": "Verify m signatures against n public keys. Pops one extra item (historical off-by-one)."
+        },
+        {
+          "name": "OP_CHECKMULTISIGVERIFY",
+          "code": 175,
+          "category": "crypto",
+          "comment": "OP_CHECKMULTISIG then OP_VERIFY."
+        },
+        {
+          "name": "OP_NOP1",
+          "code": 176,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_CHECKLOCKTIMEVERIFY",
+          "code": 177,
+          "category": "locktime",
+          "comment": "Fail if the transaction lockTime is below the top stack number. Formerly OP_NOP2.",
+          "bip": 65
+        },
+        {
+          "name": "OP_CHECKSEQUENCEVERIFY",
+          "code": 178,
+          "category": "locktime",
+          "comment": "Fail if the input sequence relative lock-time is below the top stack number. Formerly OP_NOP3.",
+          "bip": 112
+        },
+        {
+          "name": "OP_NOP4",
+          "code": 179,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_NOP5",
+          "code": 180,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_NOP6",
+          "code": 181,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_NOP7",
+          "code": 182,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_NOP8",
+          "code": 183,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_NOP9",
+          "code": 184,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_NOP10",
+          "code": 185,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_CHECKSIGADD",
+          "code": 186,
+          "category": "crypto",
+          "comment": "Tapscript batch-friendly multisig: add a signature check result to a counter.",
+          "bip": 342
+        }
+      ]
+    },
+    {
+      "@id": "btc:ScriptType",
+      "@type": "Enumeration",
+      "module": "btc:script",
+      "label": "ScriptType",
+      "comment": "Standard output script templates. <n> in a template matches a data push of exactly n bytes; <a|b> matches either length. The addressEncoding rule derives the address from the matched data pushes (payload 'push:n' is the n-th data push) and the network's parameters (base58 version bytes, bech32 HRP).",
+      "members": [
+        {
+          "name": "p2pk",
+          "comment": "Pay to public key: the original output form, used by early coinbases including the genesis block. No address form exists.",
+          "template": "<33|65> OP_CHECKSIG"
+        },
+        {
+          "name": "p2pkh",
+          "comment": "Pay to public key hash: the classic base58 '1\u2026' address.",
+          "template": "OP_DUP OP_HASH160 <20> OP_EQUALVERIFY OP_CHECKSIG",
+          "addressEncoding": {
+            "encoding": "base58check",
+            "versionParam": "p2pkhVersion",
+            "payload": "push:0"
+          }
+        },
+        {
+          "name": "p2sh",
+          "comment": "Pay to script hash (BIP 16): the spender reveals a redeem script matching the hash. Base58 '3\u2026' address.",
+          "template": "OP_HASH160 <20> OP_EQUAL",
+          "bip": 16,
+          "addressEncoding": {
+            "encoding": "base58check",
+            "versionParam": "p2shVersion",
+            "payload": "push:0"
+          }
+        },
+        {
+          "name": "p2wpkh",
+          "comment": "Native segwit v0 pay to witness public key hash (BIP 141). Bech32 'bc1q\u2026' address.",
+          "template": "OP_0 <20>",
+          "bip": [
+            141,
+            173
+          ],
+          "addressEncoding": {
+            "encoding": "bech32",
+            "witnessVersion": 0,
+            "payload": "push:0"
+          }
+        },
+        {
+          "name": "p2wsh",
+          "comment": "Native segwit v0 pay to witness script hash (BIP 141). Bech32 'bc1q\u2026' address (longer).",
+          "template": "OP_0 <32>",
+          "bip": [
+            141,
+            173
+          ],
+          "addressEncoding": {
+            "encoding": "bech32",
+            "witnessVersion": 0,
+            "payload": "push:0"
+          }
+        },
+        {
+          "name": "p2tr",
+          "comment": "Taproot (BIP 341): pay to a tweaked x-only public key. Bech32m 'bc1p\u2026' address.",
+          "template": "OP_1 <32>",
+          "bip": [
+            341,
+            350
+          ],
+          "addressEncoding": {
+            "encoding": "bech32m",
+            "witnessVersion": 1,
+            "payload": "push:0"
+          }
+        },
+        {
+          "name": "anchor",
+          "comment": "Pay-to-anchor (BIP 431): OP_1 <0x4e73>, a 2-byte witness v1 program spendable by anyone with an empty witness; the ephemeral anchor of v3 transaction packages. Bech32m 'bc1pfeessrawgf'. Standard since Core 28.",
+          "special": "anchor",
+          "bip": [
+            431
+          ],
+          "addressEncoding": {
+            "encoding": "bech32m",
+            "witnessVersion": 1,
+            "payload": "push:0"
+          }
+        },
+        {
+          "name": "multisig",
+          "comment": "Bare m-of-n multisig: OP_m <pubkey>\u2026 OP_n OP_CHECKMULTISIG. No address form.",
+          "special": "multisig"
+        },
+        {
+          "name": "nulldata",
+          "comment": "OP_RETURN data carrier: provably unspendable, excluded from the UTXO set.",
+          "special": "nulldata"
+        },
+        {
+          "name": "witness-unknown",
+          "comment": "A witness program with a version not yet assigned semantics (OP_2..OP_16 followed by a 2-40 byte push). Valid to send to; anyone-can-spend until a soft fork defines it.",
+          "special": "witness-unknown",
+          "bip": 141,
+          "addressEncoding": {
+            "encoding": "bech32m",
+            "payload": "push:0"
+          }
+        },
+        {
+          "name": "nonstandard",
+          "comment": "Any script matching no standard template. Consensus-valid but not relayed by default policy.",
+          "special": "fallback"
+        }
+      ]
+    },
+    {
+      "@id": "btc:SighashType",
+      "@type": "Enumeration",
+      "module": "btc:script",
+      "label": "SighashType",
+      "comment": "Signature hash modes controlling which parts of a transaction a signature commits to. ANYONECANPAY is a flag combinable with the base modes.",
+      "members": [
+        {
+          "name": "SIGHASH_DEFAULT",
+          "code": 0,
+          "comment": "Taproot only (BIP 341): equivalent to SIGHASH_ALL but allows the shorter 64-byte signature.",
+          "bip": 341
+        },
+        {
+          "name": "SIGHASH_ALL",
+          "code": 1,
+          "comment": "Commit to all inputs and all outputs \u2014 the default and overwhelmingly most common mode."
+        },
+        {
+          "name": "SIGHASH_NONE",
+          "code": 2,
+          "comment": "Commit to all inputs and no outputs."
+        },
+        {
+          "name": "SIGHASH_SINGLE",
+          "code": 3,
+          "comment": "Commit to all inputs and only the output with the same index as the signed input."
+        },
+        {
+          "name": "SIGHASH_ANYONECANPAY",
+          "code": 128,
+          "comment": "Flag: commit only to the signed input, allowing others to add inputs."
+        }
+      ]
+    },
+    {
+      "@id": "btc:ScriptLimits",
+      "@type": "ContextStruct",
+      "module": "btc:script",
+      "label": "ScriptLimits",
+      "comment": "Consensus limits on script execution. Enforced by the interpreter; exceeding any of them fails the script.",
+      "fields": [
+        {
+          "property": "btc:maxScriptSize",
+          "label": "maxScriptSize",
+          "valueType": "u32",
+          "comment": "Maximum script length in bytes: 10,000."
+        },
+        {
+          "property": "btc:maxScriptElementSize",
+          "label": "maxScriptElementSize",
+          "valueType": "u32",
+          "comment": "Maximum size of a stack element: 520 bytes."
+        },
+        {
+          "property": "btc:maxOpsPerScript",
+          "label": "maxOpsPerScript",
+          "valueType": "u32",
+          "comment": "Maximum non-push operations per script: 201."
+        },
+        {
+          "property": "btc:maxStackSize",
+          "label": "maxStackSize",
+          "valueType": "u32",
+          "comment": "Maximum combined main+alt stack depth: 1,000."
+        },
+        {
+          "property": "btc:maxMultisigKeys",
+          "label": "maxMultisigKeys",
+          "valueType": "u32",
+          "comment": "Maximum public keys in a CHECKMULTISIG: 20."
+        }
+      ]
+    },
+    {
+      "@id": "btc:scriptLimits",
+      "@type": "btc:ScriptLimits",
+      "label": "scriptLimits",
+      "comment": "The consensus script-execution limits.",
+      "maxScriptSize": 10000,
+      "maxScriptElementSize": 520,
+      "maxOpsPerScript": 201,
+      "maxStackSize": 1000,
+      "maxMultisigKeys": 20
+    },
+    {
+      "@id": "btc:ControlBlock",
+      "@type": "ContextStruct",
+      "module": "btc:script",
+      "label": "ControlBlock",
+      "bip": 341,
+      "comment": "The proof carried in a taproot script-path witness (as its last element, after removing any annex): it demonstrates that the revealed leaf script is committed by the output key. Length 33 + 32m bytes, m <= 128.",
+      "fields": [
+        {
+          "property": "btc:leafVersionParity",
+          "label": "leafVersionAndParity",
+          "valueType": "u8",
+          "comment": "High 7 bits: the leaf version (0xc0 = tapscript). Low bit: the y-parity of the tweaked output key."
+        },
+        {
+          "property": "btc:internalKey",
+          "label": "internalKey",
+          "valueType": "hex",
+          "comment": "The 32-byte x-only internal public key P, before tweaking."
+        },
+        {
+          "property": "btc:merklePath",
+          "label": "merklePath",
+          "valueType": "hex",
+          "comment": "Zero or more 32-byte sibling hashes; combined pairwise (lexicographically ordered) with TapBranch tagged hashes up to the merkle root, which feeds the TapTweak."
+        }
+      ]
+    },
+    {
+      "@id": "btc:TaprootConstants",
+      "@type": "ContextStruct",
+      "module": "btc:script",
+      "label": "TaprootConstants",
+      "comment": "Constants of the taproot construction (BIP 340/341/342). Tagged hashes are sha256(sha256(tag) || sha256(tag) || msg).",
+      "fields": [
+        {
+          "property": "btc:tapLeafTag",
+          "label": "tapLeafTag",
+          "valueType": "string",
+          "comment": "Tag for hashing a leaf script."
+        },
+        {
+          "property": "btc:tapBranchTag",
+          "label": "tapBranchTag",
+          "valueType": "string",
+          "comment": "Tag for combining two tree nodes."
+        },
+        {
+          "property": "btc:tapTweakTag",
+          "label": "tapTweakTag",
+          "valueType": "string",
+          "comment": "Tag for tweaking the internal key with the tree root."
+        },
+        {
+          "property": "btc:tapSighashTag",
+          "label": "tapSighashTag",
+          "valueType": "string",
+          "comment": "Tag wrapping the BIP 341 signature message."
+        },
+        {
+          "property": "btc:tapscriptLeafVersion",
+          "label": "tapscriptLeafVersion",
+          "valueType": "u8",
+          "comment": "The leaf version with defined semantics: 0xc0 (tapscript, BIP 342)."
+        },
+        {
+          "property": "btc:annexPrefix",
+          "label": "annexPrefix",
+          "valueType": "u8",
+          "comment": "A final witness element beginning 0x50 (with >= 2 elements) is the annex, reserved for future use but committed by the sighash."
+        },
+        {
+          "property": "btc:sigopsBudgetBase",
+          "label": "sigopsBudgetBase",
+          "valueType": "u32",
+          "comment": "Tapscript signature budget: 50 plus the serialized witness size; each non-empty signature check costs 50."
+        }
+      ]
+    },
+    {
+      "@id": "btc:taproot",
+      "@type": "btc:TaprootConstants",
+      "label": "taproot",
+      "comment": "The taproot constants deployed on mainnet at height 709,632.",
+      "tapLeafTag": "TapLeaf",
+      "tapBranchTag": "TapBranch",
+      "tapTweakTag": "TapTweak",
+      "tapSighashTag": "TapSighash",
+      "tapscriptLeafVersion": 192,
+      "annexPrefix": 80,
+      "sigopsBudgetBase": 50
+    }
+  ]
+}
\ No newline at end of file
diff --git a/vendor/sidestr/schema/schema/validate.jsonld b/vendor/sidestr/schema/schema/validate.jsonld
new file mode 100644
index 0000000..f6fcb3e
--- /dev/null
+++ b/vendor/sidestr/schema/schema/validate.jsonld
@@ -0,0 +1,344 @@
+{
+  "@context": "../context.jsonld",
+  "@graph": [
+    {
+      "@id": "btc:validate",
+      "@type": "Module",
+      "label": "validate",
+      "version": "0.0.13",
+      "comment": "Validation rules as data, in the spirit of Hornet Node's formal consensus specification: ordered rulesets of pure checks, each enforcing a single invariant and naming a typed error. Error codes match Bitcoin Core's reject reasons so results are comparable across implementations.",
+      "layer": "rules"
+    },
+    {
+      "@id": "btc:HeaderRules",
+      "@type": "RuleSet",
+      "module": "btc:validate",
+      "label": "HeaderRules",
+      "phase": "header",
+      "comment": "Contextual validation of a block header against its predecessor chain. Sufficient for headers-only sync: a chain passing these rules has verifiable cumulative proof-of-work.",
+      "rules": [
+        {
+          "@id": "btc:rule-header-prev-link",
+          "@type": "ValidationRule",
+          "label": "prev-link",
+          "errorCode": "bad-prevblk",
+          "comment": "The header's prevBlockHash must equal the hash of the preceding header, extending a known chain.",
+          "check": "header.prevBlockHash == hash(prev)"
+        },
+        {
+          "@id": "btc:rule-header-pow",
+          "@type": "ValidationRule",
+          "label": "proof-of-work",
+          "errorCode": "high-hash",
+          "comment": "The header's hash, interpreted as a 256-bit number, must not exceed the target encoded by its bits field.",
+          "check": "hash(header) <= expandCompact(header.bits)"
+        },
+        {
+          "@id": "btc:rule-header-difficulty",
+          "@type": "ValidationRule",
+          "label": "difficulty",
+          "errorCode": "bad-diffbits",
+          "comment": "The bits field must equal the expected target: unchanged within a difficulty epoch; at each 2016-block boundary, retargeted by the previous epoch's actual timespan (clamped to [targetTimespan/4, targetTimespan*4]), never easier than powLimit.",
+          "check": "header.bits == expectedBits(prev, prevHeight, epochFirst, params)"
+        },
+        {
+          "@id": "btc:rule-header-mtp",
+          "@type": "ValidationRule",
+          "label": "median-time-past",
+          "errorCode": "time-too-old",
+          "comment": "The header's timestamp must be strictly greater than the median timestamp of the previous 11 blocks.",
+          "check": "header.time > medianTimePast(prev11)"
+        },
+        {
+          "@id": "btc:rule-header-time-future",
+          "@type": "ValidationRule",
+          "label": "future-time",
+          "errorCode": "time-too-new",
+          "comment": "The header's timestamp must be no more than maxFutureBlockTime (2 hours) ahead of network-adjusted time.",
+          "check": "header.time <= now + params.maxFutureBlockTime"
+        },
+        {
+          "@id": "btc:rule-header-version",
+          "@type": "ValidationRule",
+          "label": "version",
+          "errorCode": "bad-version",
+          "bip": [
+            34,
+            66,
+            65
+          ],
+          "comment": "Obsolete block versions are rejected once the corresponding deployment is buried: version >= 2 from params.bip34Height, >= 3 from params.bip66Height, >= 4 from params.bip65Height.",
+          "check": "header.version >= minVersionAt(height, params)"
+        },
+        {
+          "@id": "btc:rule-header-timewarp",
+          "@type": "ValidationRule",
+          "label": "timewarp",
+          "errorCode": "time-timewarp-attack",
+          "bip": 94,
+          "comment": "On networks with the timewarp fix (testnet4), the first block of a difficulty epoch may not be timestamped more than params.maxTimewarp (600s) before its predecessor \u2014 closing the timewarp difficulty exploit. Skipped on networks without the fix.",
+          "check": "isEpochFirst(height) implies header.time >= prev.time - params.maxTimewarp"
+        }
+      ]
+    },
+    {
+      "@id": "btc:SpvRules",
+      "@type": "RuleSet",
+      "module": "btc:validate",
+      "label": "SpvRules",
+      "phase": "spv",
+      "comment": "Verification of a merkle inclusion proof (MerkleBlock). Combined with header chain validation, a proof passing these rules demonstrates a transaction's inclusion under the chain's cumulative proof-of-work without any block data.",
+      "rules": [
+        {
+          "@id": "btc:rule-spv-pow",
+          "@type": "ValidationRule",
+          "label": "proof-of-work",
+          "errorCode": "high-hash",
+          "comment": "The embedded header's hash must satisfy its own target. (Chain membership and cumulative work are established by the header phase.)",
+          "check": "hash(merkleBlock.header) <= expandCompact(merkleBlock.header.bits)"
+        },
+        {
+          "@id": "btc:rule-spv-tree",
+          "@type": "ValidationRule",
+          "label": "tree-consistency",
+          "errorCode": "bad-merkle-tree",
+          "comment": "The partial merkle tree must be well-formed: every hash and every flag bit consumed exactly once (modulo byte padding), no identical left/right branches (CVE-2012-2459), and a non-zero transaction count.",
+          "check": "extractPartialMerkleTree(merkleBlock).wellFormed"
+        },
+        {
+          "@id": "btc:rule-spv-merkle-root",
+          "@type": "ValidationRule",
+          "label": "merkle-root",
+          "errorCode": "bad-txnmrklroot",
+          "comment": "The root reconstructed from the partial tree must equal the header's merkleRoot.",
+          "check": "extractPartialMerkleTree(merkleBlock).root == merkleBlock.header.merkleRoot"
+        },
+        {
+          "@id": "btc:rule-spv-inclusion",
+          "@type": "ValidationRule",
+          "label": "inclusion",
+          "errorCode": "tx-not-included",
+          "comment": "The transaction being verified must appear among the proof's matched txids. Skipped when no target transaction is specified.",
+          "check": "txid in extractPartialMerkleTree(merkleBlock).matches"
+        }
+      ]
+    },
+    {
+      "@id": "btc:TransactionRules",
+      "@type": "RuleSet",
+      "module": "btc:validate",
+      "label": "TransactionRules",
+      "phase": "transaction",
+      "comment": "Context-free structural validation of a single transaction (Bitcoin Core's CheckTransaction). These rules need no chain state. Signature and script execution are a separate, later concern.",
+      "rules": [
+        {
+          "@id": "btc:rule-tx-inputs-nonempty",
+          "@type": "ValidationRule",
+          "label": "inputs-nonempty",
+          "errorCode": "bad-txns-vin-empty",
+          "check": "tx.inputs.length > 0"
+        },
+        {
+          "@id": "btc:rule-tx-outputs-nonempty",
+          "@type": "ValidationRule",
+          "label": "outputs-nonempty",
+          "errorCode": "bad-txns-vout-empty",
+          "check": "tx.outputs.length > 0"
+        },
+        {
+          "@id": "btc:rule-tx-size",
+          "@type": "ValidationRule",
+          "label": "size-limit",
+          "errorCode": "bad-txns-oversize",
+          "comment": "A single transaction may not exceed the block weight limit.",
+          "check": "weight(tx) <= params.maxBlockWeight"
+        },
+        {
+          "@id": "btc:rule-tx-output-values",
+          "@type": "ValidationRule",
+          "label": "output-values",
+          "errorCode": "bad-txns-vout-toolarge",
+          "comment": "Each output value must be in [0, maxMoney], and so must their sum.",
+          "check": "every(tx.outputs, 0 <= value <= params.maxMoney) && sum(tx.outputs.value) <= params.maxMoney"
+        },
+        {
+          "@id": "btc:rule-tx-inputs-unique",
+          "@type": "ValidationRule",
+          "label": "inputs-unique",
+          "errorCode": "bad-txns-inputs-duplicate",
+          "comment": "No two inputs of a transaction may spend the same outpoint.",
+          "check": "unique(tx.inputs.prevout)"
+        },
+        {
+          "@id": "btc:rule-tx-prevouts",
+          "@type": "ValidationRule",
+          "label": "prevouts",
+          "errorCode": "bad-txns-prevout-null",
+          "comment": "A coinbase has exactly one input with the null outpoint; a non-coinbase transaction must have no null outpoints.",
+          "check": "coinbase ? (tx.inputs.length == 1 && isNull(tx.inputs[0].prevout)) : none(tx.inputs, isNull(prevout))"
+        },
+        {
+          "@id": "btc:rule-tx-coinbase-script",
+          "@type": "ValidationRule",
+          "label": "coinbase-script-size",
+          "errorCode": "bad-cb-length",
+          "comment": "A coinbase scriptSig must be between 2 and 100 bytes. Skipped for non-coinbase transactions.",
+          "check": "2 <= byteLength(tx.inputs[0].scriptSig) <= 100"
+        }
+      ]
+    },
+    {
+      "@id": "btc:BlockRules",
+      "@type": "RuleSet",
+      "module": "btc:validate",
+      "label": "BlockRules",
+      "phase": "block",
+      "comment": "Context-free structural validation of a block (Bitcoin Core's CheckBlock), given that its header has already passed the header phase. Every transaction must additionally pass the transaction phase.",
+      "rules": [
+        {
+          "@id": "btc:rule-block-coinbase-first",
+          "@type": "ValidationRule",
+          "label": "coinbase-first",
+          "errorCode": "bad-cb-missing",
+          "comment": "The block must be non-empty and its first transaction must be the coinbase.",
+          "check": "block.transactions.length > 0 && isCoinbase(block.transactions[0])"
+        },
+        {
+          "@id": "btc:rule-block-coinbase-single",
+          "@type": "ValidationRule",
+          "label": "coinbase-single",
+          "errorCode": "bad-cb-multiple",
+          "comment": "No transaction after the first may be a coinbase.",
+          "check": "none(block.transactions[1..], isCoinbase)"
+        },
+        {
+          "@id": "btc:rule-block-merkle-root",
+          "@type": "ValidationRule",
+          "label": "merkle-root",
+          "errorCode": "bad-txnmrklroot",
+          "comment": "The merkle root recomputed from the transactions' txids must equal the header's.",
+          "check": "merkleRoot(map(block.transactions, txid)) == block.header.merkleRoot"
+        },
+        {
+          "@id": "btc:rule-block-tx-duplicates",
+          "@type": "ValidationRule",
+          "label": "no-duplicate-txids",
+          "errorCode": "bad-txns-duplicate",
+          "comment": "No two transactions in the block may share a txid (guards the merkle mutation of CVE-2012-2459).",
+          "check": "unique(map(block.transactions, txid))"
+        },
+        {
+          "@id": "btc:rule-block-sigops",
+          "@type": "ValidationRule",
+          "label": "sigop-limit",
+          "errorCode": "bad-blk-sigops",
+          "comment": "Total legacy signature operations (CHECKSIG counts 1, CHECKMULTISIG counts 20, over all scriptSigs and scriptPubKeys) times the witness scale factor (4) may not exceed params.maxBlockSigopsCost.",
+          "check": "4 * sum(map(block.transactions, legacySigOps)) <= params.maxBlockSigopsCost"
+        },
+        {
+          "@id": "btc:rule-block-weight",
+          "@type": "ValidationRule",
+          "label": "weight-limit",
+          "errorCode": "bad-blk-weight",
+          "check": "weight(block) <= params.maxBlockWeight"
+        },
+        {
+          "@id": "btc:rule-block-transactions",
+          "@type": "ValidationRule",
+          "label": "transactions-valid",
+          "errorCode": "bad-txns",
+          "comment": "Every transaction in the block passes the transaction phase.",
+          "check": "every(block.transactions, passes(TransactionRules))"
+        }
+      ]
+    },
+    {
+      "@id": "btc:BlockContextRules",
+      "@type": "RuleSet",
+      "module": "btc:validate",
+      "label": "BlockContextRules",
+      "phase": "block-context",
+      "comment": "Validation of a block against chain state: the UTXO set, the block's height, and activated deployments. Rules whose required context is unavailable are skipped and reported \u2014 in a pruned window, inputs spending coins created before the window can be resolved only if their transactions are provided. Witness/signature script execution is out of scope of this phase.",
+      "rules": [
+        {
+          "@id": "btc:rule-blockctx-bip34-height",
+          "@type": "ValidationRule",
+          "label": "coinbase-height",
+          "errorCode": "bad-cb-height",
+          "bip": 34,
+          "activationParam": "bip34Height",
+          "comment": "The coinbase scriptSig must begin with a push of the block height. Active from params.bip34Height.",
+          "check": "scriptNumber(firstPush(coinbase.scriptSig)) == height"
+        },
+        {
+          "@id": "btc:rule-blockctx-finality",
+          "@type": "ValidationRule",
+          "label": "tx-finality",
+          "errorCode": "bad-txns-nonfinal",
+          "bip": 113,
+          "comment": "Every transaction must be final at this block: lockTime of zero, or lockTime below the block height (if < 500,000,000) or below the median-time-past (otherwise), or all input sequences final (0xffffffff).",
+          "check": "every(block.transactions, isFinal(tx, height, medianTimePast))"
+        },
+        {
+          "@id": "btc:rule-blockctx-sequence-locks",
+          "@type": "ValidationRule",
+          "label": "sequence-locks",
+          "errorCode": "bad-txns-nonfinal",
+          "bip": [68, 112],
+          "comment": "BIP68 relative lock-time (enforced via BIP112). For a transaction of version >= 2, each input whose nSequence leaves the disable flag (bit 31) clear imposes a relative lock on the coin it spends. Height-based locks (type flag, bit 22, clear) require spendingHeight >= coinHeight + (nSequence & 0xffff). Time-based locks (bit 22 set) require (nSequence & 0xffff) << 9 seconds to have elapsed since the spent coin's median-time-past; that per-coin time context is not available to a light or pruned validator, so time-based locks are skipped honestly rather than guessed. A height-based lock whose coin height is unknown (out-of-window) is likewise skipped. Coinbase transactions and version-1 transactions are exempt.",
+          "check": "every(resolvedInputs of version>=2 txs, spendingHeight >= coinHeight + (sequence & 0xffff)) for height-based locks; time-based and out-of-window locks skip"
+        },
+        {
+          "@id": "btc:rule-blockctx-inputs-available",
+          "@type": "ValidationRule",
+          "label": "inputs-available",
+          "errorCode": "bad-txns-inputs-missingorspent",
+          "comment": "Every non-coinbase input must spend a coin that exists and is unspent at this point in the block's execution (no double spends within or across the block's transactions).",
+          "check": "every(inputs, utxo.has(prevout)) with sequential spending"
+        },
+        {
+          "@id": "btc:rule-blockctx-coinbase-maturity",
+          "@type": "ValidationRule",
+          "label": "coinbase-maturity",
+          "errorCode": "bad-txns-premature-spend-of-coinbase",
+          "comment": "A coinbase coin may be spent only at least params.coinbaseMaturity (100) blocks after its creation. In a pruned window the rule fails on a provably premature spend of a window coinbase; spends of out-of-window coinbase coins, whose height is unknowable, skip.",
+          "check": "every(spentCoinbaseCoins, height - coin.height >= params.coinbaseMaturity)"
+        },
+        {
+          "@id": "btc:rule-blockctx-fees",
+          "@type": "ValidationRule",
+          "label": "no-fee-deficit",
+          "errorCode": "bad-txns-in-belowout",
+          "comment": "For every non-coinbase transaction, the sum of input values must be at least the sum of output values.",
+          "check": "every(txs[1..], sum(inputValues) >= sum(outputValues))"
+        },
+        {
+          "@id": "btc:rule-blockctx-coinbase-amount",
+          "@type": "ValidationRule",
+          "label": "coinbase-amount",
+          "errorCode": "bad-cb-amount",
+          "comment": "The coinbase outputs may not exceed the block subsidy plus the block's total fees.",
+          "check": "sum(coinbase.outputs.value) <= subsidy(height, params) + fees(block)"
+        },
+        {
+          "@id": "btc:rule-blockctx-witness-commitment",
+          "@type": "ValidationRule",
+          "label": "witness-commitment",
+          "errorCode": "bad-witness-merkle-match",
+          "bip": 141,
+          "activationParam": "segwitHeight",
+          "comment": "If any transaction has witness data, the coinbase must carry a commitment output (OP_RETURN 0xaa21a9ed\u2026) equal to dsha256(witnessMerkleRoot || witnessReservedValue). Active from params.segwitHeight.",
+          "check": "commitment(coinbase) == dsha256(witnessMerkleRoot(block) || witnessReserved)"
+        },
+        {
+          "@id": "btc:rule-blockctx-scripts",
+          "@type": "ValidationRule",
+          "label": "scripts",
+          "errorCode": "mandatory-script-verify-flag-failed",
+          "comment": "Every resolvable non-coinbase input's unlocking script (and witness) must satisfy its prevout's locking script, with real signature verification: ECDSA for legacy/segwit-v0 paths (legacy and BIP 143 sighash) and Schnorr for taproot key and script paths (BIP 340/341/342). The only honest skips remaining are pruned-away prevouts (taproot additionally needs every input's prevout, as its sighash commits to all of them) and unknown future witness/leaf versions.",
+          "check": "every(resolvedInputs, executeScripts(input, prevout) == valid)"
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/vendor/sidestr/spec/LICENSE b/vendor/sidestr/spec/LICENSE
new file mode 100644
index 0000000..be3f7b2
--- /dev/null
+++ b/vendor/sidestr/spec/LICENSE
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
diff --git a/vendor/sidestr/spec/siding/lib/announce.mjs b/vendor/sidestr/spec/siding/lib/announce.mjs
new file mode 100644
index 0000000..1053fc0
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/announce.mjs
@@ -0,0 +1,67 @@
+// The signer's tip announcement (SPEC 11): a NIP-333 event, kind 33333, addressable by `d` =
+// chain id, content the last twelve headers, `u` tags naming mirrors that serve the block file.
+// A client that knows only a chain id asks a relay for this, takes a mirror from it, reads that
+// mirror's chain.json, and accepts the mirror when the document's signer is the event's author.
+// A mirror is then held to the announcement: same tip hash, or it is behind or lying. The `t` =
+// sidestr tag is what a directory filters on: relays index single-letter tags only.
+// Pure: browsers and Node alike. WebSocket is the platform's.
+export const TIP_KIND = 33333, TIP_HEADERS = 12;
+// a header's hex width follows the chain's parent (SPEC 3): 328 for the 164-byte v2 header beside a
+// BLAKE2b parent, 160 for the 80-byte stock header beside Bitcoin. An announcement carries at most
+// TIP_HEADERS headers, and no multiple of 160 up to 12 headers is a multiple of 328, so the width is
+// read from the content's length without knowing the parent
+export const HEADER_HEX = [328, 160];
+// at most TIP_HEADERS headers of hex: the disambiguation above holds only within that bound, and relay content is untrusted
+export const headerWidth = (content) => { if (!content.length || !/^[0-9a-f]+$/i.test(content)) return null; const w = HEADER_HEX.find((x) => content.length % x === 0); return w && content.length / w <= TIP_HEADERS ? w : null; };
+
+// pegScript: the parent output script a peg-in pays (SPEC 6), announced by the signer so a wallet can build one without asking anyone; the newest announcement wins, so it can rotate
+export function tipEvent({ events, key, chainId, headersHex, tip, mirrors = [], pegScript = null }) {
+  const start = tip - headersHex.length + 1; if (pegScript != null && !/^([0-9a-f]{2}){2,80}$/i.test(pegScript)) throw new Error('pegScript is a script of 2 to 80 bytes as hex');
+  return events.signEvent(key, { kind: TIP_KIND, tags: [['d', chainId], ['n', chainId], ['t', 'sidestr'], ['tip', String(tip)], ['alt', `sidestr headers ${start}-${tip} of ${chainId}`], ...mirrors.map((u) => ['u', u, 'mirror']), ...(pegScript ? [['peg', pegScript.toLowerCase()]] : [])], content: headersHex.join('') });
+}
+export function parseTip(ev) {
+  const tag = (n) => (ev.tags ?? []).filter((t) => t[0] === n).map((t) => t[1]);
+  const tip = Number(tag('tip')[0]); const content = String(ev.content ?? ''); const w = headerWidth(content); if (!Number.isInteger(tip) || !w) return null;
+  return { chainId: tag('d')[0], tip, mirrors: tag('u').map((u) => String(u).replace(/\/+$/, '')), headersHex: content.match(new RegExp(`.{${w}}`, 'g')) ?? [], headerBytes: w / 2, pegScript: (() => { const p = tag('peg')[0]; return p && /^([0-9a-f]{2}){2,80}$/i.test(p) ? p.toLowerCase() : null; })(), pubkey: ev.pubkey, created_at: ev.created_at, id: ev.id };
+}
+
+// the newest announcement for a chain, from any of the relays, within `timeout` ms
+export function fetchLatestTip({ relays, chainId, verify = () => true, signer, timeout = 6000 }) {
+  return new Promise((resolve) => {
+    let best = null, open = relays.length; const done = () => { if (--open <= 0) finish(); }; const finish = () => { clearTimeout(t); resolve(best); };
+    const t = setTimeout(finish, timeout);
+    for (const url of relays) {
+      let ws; try { ws = new WebSocket(url); } catch { done(); continue; }
+      ws.onopen = () => ws.send(JSON.stringify(['REQ', 'tip', { kinds: [TIP_KIND], '#d': [chainId], limit: 5 }]));
+      ws.onmessage = (m) => { let msg; try { msg = JSON.parse(typeof m.data === 'string' ? m.data : String(m.data)); } catch { return; }
+        if (msg[0] === 'EVENT' && msg[2]?.kind === TIP_KIND) { const ev = msg[2]; let ok = false; try { ok = !!verify(ev); } catch {} const p = ok && (!signer || ev.pubkey === signer) ? parseTip(ev) : null; if (p && p.chainId === chainId && (!best || p.tip > best.tip || (p.tip === best.tip && p.created_at > best.created_at))) best = { ...p, event: ev }; }
+        if (msg[0] === 'EOSE' || msg[0] === 'CLOSED') { try { ws.close(); } catch {} done(); } };
+      ws.onerror = () => {}; ws.onclose = () => done();
+    }
+  });
+}
+
+// Resolve a chain id to a mirror the chain's own signer vouches for: the announcement's author
+// must be the signer named in the mirror's chain.json. Returns { mirror, tip, chain }. A chain id
+// is a name, not a proof: with only the id, the newest announcement wins, so a client shows the
+// signer it ended up with; one that already knows the signer passes it and takes no other's.
+export async function findChain({ relays, chainId, verify, signer, fetchJson }) {
+  const t = await fetchLatestTip({ relays, chainId, verify, signer }); if (!t) throw new Error(`no announcement for ${chainId} on ${relays.length} relay(s)`);
+  return chooseMirror({ tip: t, chainId, fetchJson });
+}
+export async function chooseMirror({ tip: t, chainId, fetchJson = async (u) => (await fetch(u, { cache: 'no-store' })).json() }) {
+  const tried = [];
+  for (const m of t.mirrors) { try { const chain = await fetchJson(`${m}/chain.json`); if (chain.id === chainId && chain.signer === t.pubkey) return { mirror: m, tip: t, chain }; tried.push(`${m}: signer ${String(chain.signer).slice(0, 8)}… is not the announcer ${t.pubkey.slice(0, 8)}…`); } catch (e) { tried.push(`${m}: ${e.message}`); } }
+  throw new Error(`${chainId}: announced at tip ${t.tip} by ${t.pubkey.slice(0, 8)}… but no mirror it names checks out (${tried.join('; ') || 'no mirrors named'})`);
+}
+
+// how a mirror stands against the announcement, given the mirror's tip height and that header's
+// hex: matching, behind (the mirror has not caught up), or contradicting it (a different block,
+// or blocks the signer never announced)
+export function judgeMirror({ announced, height, headerHex }) {
+  if (!announced) return { ok: null, note: 'no announcement to compare with' };
+  if (height > announced.tip) return { ok: false, note: `the mirror is ahead of the signer's announcement (${height} > ${announced.tip})` };
+  const i = height - (announced.tip - announced.headersHex.length + 1);
+  if (i >= 0 && headerHex && headerHex !== announced.headersHex[i]) return { ok: false, note: `the mirror's block ${height} is not the one the signer announced` };
+  return { ok: true, note: height < announced.tip ? `the mirror is ${announced.tip - height} block(s) behind the announcement` : `the mirror matches the signer's announcement of ${height}` };
+}
diff --git a/vendor/sidestr/spec/siding/lib/block.mjs b/vendor/sidestr/spec/siding/lib/block.mjs
new file mode 100644
index 0000000..97dcca8
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/block.mjs
@@ -0,0 +1,122 @@
+// Blocks on a sidestr chain (SPEC 4): building, the block data that is signed, the virtual
+// transactions the challenge is evaluated against, the solution's place in the coinbase.
+const SIGNET_HEADER = 'ecc7daa2';
+const NULL32 = '00'.repeat(32);
+
+const compactSize = (n) => n < 0xfd ? [n] : n <= 0xffff ? [0xfd, n & 0xff, n >> 8] : [0xfe, n & 0xff, (n >> 8) & 0xff, (n >> 16) & 0xff, (n >>> 24) & 0xff];
+const readCompact = (b, i) => b[i] < 0xfd ? [b[i], i + 1] : b[i] === 0xfd ? [b[i + 1] | (b[i + 2] << 8), i + 3] : [b[i + 1] | (b[i + 2] << 8) | (b[i + 3] << 16) | (b[i + 4] * 2 ** 24), i + 5];
+const hex = (bytes) => Array.from(bytes, (x) => x.toString(16).padStart(2, '0')).join('');
+const unhex = (h) => Uint8Array.from(h.match(/../g) ?? [], (x) => parseInt(x, 16));
+
+// serialized script witness: count, then each item length-prefixed
+export function encodeWitness(items) { const out = [...compactSize(items.length)]; for (const it of items) { const b = unhex(it); out.push(...compactSize(b.length), ...b); } return hex(Uint8Array.from(out)); }
+export function decodeWitness(h) { const b = unhex(h); let [n, i] = readCompact(b, 0); const items = []; while (n-- > 0) { let len; [len, i] = readCompact(b, i); items.push(hex(b.slice(i, i + len))); i += len; } return items; }
+
+// the coinbase output carrying the witness commitment, and the solution push after it
+export function commitmentOutput(block) {
+  const cb = block.transactions[0]; if (!cb) return null;
+  for (let i = cb.outputs.length - 1; i >= 0; i--) { const spk = cb.outputs[i].scriptPubKey; if (spk.startsWith('6a24aa21a9ed') && spk.length >= 76) return { index: i, spk }; }
+  return null;
+}
+export function solutionOf(block) {
+  const c = commitmentOutput(block); if (!c) return null;
+  const rest = unhex(c.spk.slice(76)); if (!rest.length) return null;
+  // one push: direct (<= 75 bytes), OP_PUSHDATA1 (<= 255) or OP_PUSHDATA2 (<= 65535) as the size needs (SPEC 4)
+  let n, at; if (rest[0] > 0 && rest[0] <= 75) { n = rest[0]; at = 1; } else if (rest[0] === 0x4c && rest.length >= 2) { n = rest[1]; at = 2; } else if (rest[0] === 0x4d && rest.length >= 3) { n = rest[1] | (rest[2] << 8); at = 3; } else return null;
+  if (n === 0 || rest.length !== at + n) return null;
+  const push = hex(rest.slice(at, at + n)); if (!push.startsWith(SIGNET_HEADER)) return null;
+  return { witness: decodeWitness(push.slice(8)), stripped: c.spk.slice(0, 76), index: c.index };
+}
+export function withSolution(block, witnessItems) {
+  const c = commitmentOutput(block); if (!c) throw new Error('no witness commitment output to carry the solution');
+  const push = SIGNET_HEADER + encodeWitness(witnessItems); const len = push.length / 2; if (len > 65535) throw new Error('solution too long for one push');
+  const op = len <= 75 ? len.toString(16).padStart(2, '0') : len <= 255 ? '4c' + len.toString(16).padStart(2, '0') : '4d' + (len & 255).toString(16).padStart(2, '0') + (len >> 8).toString(16).padStart(2, '0');
+  const cb = structuredClone(block.transactions[0]); cb.outputs[c.index].scriptPubKey = c.spk.slice(0, 76) + op + push;
+  return { ...block, transactions: [cb, ...block.transactions.slice(1)] };
+}
+
+// SPEC 4: the block data is sha256 of the first 72 header bytes (version, prev, merkle root,
+// time on wire) with the merkle root recomputed over the coinbase stripped of its solution
+export function blockData({ codec, hash }, block) {
+  const c = commitmentOutput(block);
+  const cb = structuredClone(block.transactions[0]); if (c) cb.outputs[c.index].scriptPubKey = c.spk.slice(0, 76);
+  const root = codec.merkleRoot([codec.txid(cb), ...block.transactions.slice(1).map((t) => codec.txid(t))]);
+  const bytes = codec.encode('BlockHeader', { ...block.header, merkleRoot: root }).slice(0, 72);
+  return hash.bytesToHex(hash.sha256(bytes));
+}
+
+// BIP 325's shape: a virtual output paying the challenge, spent by a virtual transaction whose
+// input carries the solution; the block data sits in to_spend's scriptSig
+export function virtualTxs({ codec }, data, challenge, witness = []) {
+  const toSpend = { version: 0, inputs: [{ prevout: { txid: NULL32, vout: 0xffffffff }, scriptSig: '0020' + data, sequence: 0 }], outputs: [{ value: 0, scriptPubKey: challenge }], lockTime: 0 };
+  const prevout = { value: 0, scriptPubKey: challenge };
+  const toSign = { version: 0, inputs: [{ prevout: { txid: codec.txid(toSpend), vout: 0 }, scriptSig: '', sequence: 0 }], outputs: [{ value: 0, scriptPubKey: '6a' }], lockTime: 0, witness: [witness] };
+  return { toSpend, toSign, prevout };
+}
+
+// height push for the coinbase (BIP 34), then a marker
+const heightPush = (h) => { const out = []; let n = h; while (n > 0) { out.push(n & 0xff); n >>>= 8; } if (out.length && out[out.length - 1] & 0x80) out.push(0); if (!out.length) return '00'; return hex(Uint8Array.from([out.length, ...out])); };
+// the height a coinbase scriptSig pushes first (BIP 34): the inverse of heightPush. A scriptSig
+// that does not start with a height push is refused, never read as height 0: beside a stock
+// parent the coinbase is the only place the height is written.
+export function coinbaseHeight(coinbase) {
+  const sig = coinbase?.inputs?.[0]?.scriptSig ?? ''; if (!sig.length || sig.length % 2 || !/^[0-9a-f]*$/i.test(sig)) throw new Error('coinbase scriptSig is not a hex script');
+  const b = unhex(sig); const n = b[0];
+  if (n === 0) return 0; if (n >= 0x51 && n <= 0x60) return n - 0x50; // OP_0, OP_1..OP_16
+  if (n > 75 || n < 1 || b.length < 1 + n) throw new Error('coinbase scriptSig does not start with a height push');
+  if (n > 1 && b[n] === 0 && !(b[n - 1] & 0x80)) throw new Error('coinbase height push is not minimal'); // a padding byte only after a high bit
+  if (b[n] & 0x80) throw new Error('coinbase height push is negative'); // BIP34: a ScriptNum; the top bit of the last byte is the sign
+  let h = 0; for (let i = n; i >= 1; i--) h = h * 256 + b[i]; return h;
+}
+// a block's height: the v2 header carries it; the stock header does not, so the coinbase says
+export function blockHeight(block) { return block.header.height ?? coinbaseHeight(block.transactions[0]); }
+
+// an unsigned block on `prev` with these transactions; outputs: the coinbase's, then the witness
+// commitment (the solution is appended by signBlock). The header's shape follows the parent's
+// family (SPEC 3.2, parents.mjs): the 164-byte v2 header with its BLAKE2b fields beside a BLAKE2b
+// parent, the stock 80-byte header, version with bit 31 clear, beside stock Bitcoin.
+export function buildBlock({ k, hash, parent = null }, { height, prev, time, transactions, outputs, bits, marker = 'sidestr' }) {
+  const wtxids = [NULL32, ...transactions.map((t) => k.codec.wtxid(t))];
+  const root = hash.hexToBytes(k.codec.merkleRoot(wtxids)).reverse(); const cat = new Uint8Array(64); cat.set(root);
+  const commitment = hash.bytesToHex(hash.dsha256(cat));
+  const tag = hash.bytesToHex(new TextEncoder().encode(marker));
+  const coinbase = { version: 2, inputs: [{ prevout: { txid: NULL32, vout: 0xffffffff }, scriptSig: heightPush(height) + (tag.length / 2).toString(16).padStart(2, '0') + tag, sequence: 0xffffffff }],
+    outputs: [...outputs, { value: 0, scriptPubKey: '6a24aa21a9ed' + commitment }], witness: [[NULL32]], lockTime: 0 };
+  const txs = [coinbase, ...transactions];
+  const merkleRoot = k.codec.merkleRoot(txs.map((t) => k.codec.txid(t)));
+  const family = parent?.family ?? (k.params?.powHash === 'knots:blake2b-v2' ? 'blake2b' : 'stock');
+  const header = family === 'blake2b'
+    ? { version: 0xa0000000, prevBlockHash: prev, merkleRoot, timeOnWire: time, bits, nonce: 0, nonce2: 0, nonce3: 0,
+        extranonce: '00'.repeat(16), timeOffset: 0, txCount: txs.length, flags: 0, xorKeyMaskClearBits: 0, xorKey: '00'.repeat(16), height, mmRhs: NULL32 }
+    : { version: 0x20000000, prevBlockHash: prev, merkleRoot, time, bits, nonce: 0 };
+  return { header, transactions: txs };
+}
+
+// sign with the challenge key (key path, no tweak: the challenge is 5120‖pubkey), then satisfy
+// the proof of work
+// what a block signature signs: the taproot sighash of the virtual transaction, for the key path
+// (level 1) or for a leaf of the challenge (level 2: `leafHash` of the multi_a leaf)
+export function blockSigHash({ k, hash, interpreter }, block, challenge, leafHash = null) {
+  const data = blockData({ codec: k.codec, hash }, block);
+  const { toSign, prevout } = virtualTxs({ codec: k.codec }, data, challenge);
+  let msg = interpreter.sighashTaproot(toSign, 0, [prevout], 0x00, leafHash ? { leafHash } : {}); if (typeof msg === 'string') msg = hash.hexToBytes(msg);
+  return msg;
+}
+// a block with its witness in place: the solution appended, the merkle root recomputed, the header
+// nonce found for powLimit
+export function sealBlock({ k }, block, witnessItems) {
+  let signed = withSolution(block, witnessItems);
+  signed.header = { ...signed.header, merkleRoot: k.codec.merkleRoot(signed.transactions.map((t) => k.codec.txid(t))) };
+  const target = k.codec.expandCompact(signed.header.bits);
+  for (let nonce = 0; nonce < 0xffffffff; nonce++) { signed.header.nonce = nonce; if (BigInt('0x' + k.codec.blockHash(signed.header)) <= target) break; }
+  return signed;
+}
+export function signBlock({ k, hash, interpreter, schnorrSign }, block, challenge, privHex) {
+  const msg = blockSigHash({ k, hash, interpreter }, block, challenge);
+  const sig = hash.bytesToHex(schnorrSign(msg, privHex));
+  let signed = withSolution(block, [sig]);
+  signed.header = { ...signed.header, merkleRoot: k.codec.merkleRoot(signed.transactions.map((t) => k.codec.txid(t))) };
+  const target = k.codec.expandCompact(signed.header.bits);
+  for (let nonce = 0; nonce < 0xffffffff; nonce++) { signed.header.nonce = nonce; if (BigInt('0x' + k.codec.blockHash(signed.header)) <= target) break; }
+  return signed;
+}
diff --git a/vendor/sidestr/spec/siding/lib/federation.mjs b/vendor/sidestr/spec/siding/lib/federation.mjs
new file mode 100644
index 0000000..7663d99
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/federation.mjs
@@ -0,0 +1,68 @@
+// Level 2 (proposals/level-2.md): a chain with n signers and a threshold k. The challenge is a
+// taproot output whose internal key is provably unspendable (the BIP 341 NUMS point tweaked by
+// the chain id) and whose single leaf is multi_a(k, pk_1 … pk_n). A block's solution is the
+// script-path witness: n signature slots in leaf order (empty for a signer who did not sign),
+// the leaf script, the control block. Pure: browsers and Node alike.
+import { blockSigHash, sealBlock } from './block.mjs';
+export const NUMS_X = '50929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0'; // BIP 341's H
+const hex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
+const unhex = (h) => Uint8Array.from(h.match(/../g) ?? [], (x) => parseInt(x, 16));
+const compact = (n) => n < 0xfd ? [n] : n <= 0xffff ? [0xfd, n & 255, n >> 8] : [0xfe, n & 255, (n >> 8) & 255, (n >> 16) & 255, n >>> 24];
+
+// the internal key: H + int(tagged("sidestr/nums", chain id))·G, so it is unspendable and per chain
+export function numsKey({ hash, secp }, chainId) {
+  const t = hash.taggedHash('sidestr/nums', new TextEncoder().encode(chainId));
+  const K = secp.ckdPubKey(unhex('02' + NUMS_X), t); if (!K) throw new Error('nums derivation failed');
+  return hex(K.slice(1));
+}
+// the leaf: <pk_1> CHECKSIG <pk_2> CHECKSIGADD … <pk_n> CHECKSIGADD <k> NUMEQUAL
+export function leafScript(signers, threshold) {
+  if (!Array.isArray(signers) || signers.length < 1 || signers.length > 16) throw new Error('1 to 16 signers'); if (!(threshold >= 1 && threshold <= signers.length)) throw new Error('threshold between 1 and the number of signers');
+  for (const s of signers) if (!/^[0-9a-f]{64}$/.test(s)) throw new Error(`signer ${s} is not an x-only key`);
+  return signers.map((pk, i) => '20' + pk + (i === 0 ? 'ac' : 'ba')).join('') + (0x50 + threshold).toString(16) + '9c';
+}
+export function leafHashOf({ hash }, script) { const s = unhex(script); return hash.taggedHash('TapLeaf', Uint8Array.of(0xc0), Uint8Array.from(compact(s.length)), s); }
+// everything a document with `signers` and `threshold` implies
+export function federation({ hash, secp }, chain) {
+  const signers = chain.signers.map((s) => String(s).toLowerCase()), threshold = Number(chain.threshold);
+  const script = leafScript(signers, threshold); const leaf = leafHashOf({ hash }, script); const internal = numsKey({ hash, secp }, chain.id);
+  const out = secp.tapOutputKey(unhex(internal), leaf); if (!out) throw new Error('tap tweak failed');
+  const outputKey = hex(out); const parity = secp.liftX ? (() => { const Q = secp.liftX(out); return 0; })() : 0;
+  // the control block's parity bit is that of the output key's Y; tapOutputKey gives only x, so both are tried by the validator-side checker here
+  const challenge = '5120' + outputKey;
+  const control = (p) => (0xc0 | p).toString(16).padStart(2, '0') + internal;
+  const parityBit = secp.checkTapTweak(unhex(internal), leaf, out, 0) ? 0 : 1;
+  return { signers, threshold, script, leafHash: hex(leaf), internalKey: internal, outputKey, challenge, controlBlock: control(parityBit) };
+}
+// one signer's partial signature over a block, as hex (64 bytes: SIGHASH_DEFAULT)
+export function partialSignature({ k, hash, interpreter, schnorrSign }, block, fed, privHex) {
+  const msg = blockSigHash({ k, hash, interpreter }, block, fed.challenge, unhex(fed.leafHash));
+  return hex(schnorrSign(msg, privHex));
+}
+export function verifyPartial({ k, hash, interpreter, secp }, block, fed, pubkey, sigHex) {
+  const msg = blockSigHash({ k, hash, interpreter }, block, fed.challenge, unhex(fed.leafHash));
+  try { return secp.verifySchnorr(msg, unhex(sigHex), unhex(pubkey)) === true; } catch { return false; }
+}
+// the witness from a map pubkey -> signature: slots in reverse leaf order (pk_1's on top), then the script, then the control block
+export function assembleWitness(fed, sigs) {
+  const have = fed.signers.filter((pk) => sigs.has(pk)); if (have.length < fed.threshold) throw new Error(`${have.length} of ${fed.threshold} signatures`);
+  const chosen = new Set(have.slice(0, fed.threshold)); // exactly k: extra signatures would make NUMEQUAL fail
+  const slots = fed.signers.map((pk) => chosen.has(pk) ? sigs.get(pk) : '').reverse();
+  return [...slots, fed.script, fed.controlBlock];
+}
+// a block sealed with k of n signatures
+export function sealFederated(engine, block, fed, sigs) { return sealBlock(engine, block, assembleWitness(fed, sigs)); }
+
+// --- the peg wallet (step 6): the same k-of-n on the parent ------------------------------
+// The parent's peg output is the chain's challenge, literally: tr(<internal>, multi_a(k, …)) in a
+// node's descriptor language derives the same address. Each signer imports it with its own key
+// private (WIF), the others' public, so it can sign a PSBT that spends the peg.
+const B58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+export function wif({ hash }, privHex, { testnet = true } = {}) {
+  const p = new Uint8Array(34); p[0] = testnet ? 0xef : 0x80; p.set(unhex(privHex), 1); p[33] = 1; const c = hash.sha256(hash.sha256(p)); const all = new Uint8Array(38); all.set(p); all.set(c.subarray(0, 4), 34);
+  let n = BigInt('0x' + hex(all)), s = ''; while (n > 0n) { s = B58[Number(n % 58n)] + s; n /= 58n; } return s;
+}
+export function pegDescriptor(fed, { wifFor = null } = {}) {
+  const keys = fed.signers.map((pk) => (wifFor && wifFor(pk)) || pk);
+  return `tr(${fed.internalKey},multi_a(${fed.threshold},${keys.join(',')}))`;
+}
diff --git a/vendor/sidestr/spec/siding/lib/overlay.mjs b/vendor/sidestr/spec/siding/lib/overlay.mjs
new file mode 100644
index 0000000..14b9f69
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/overlay.mjs
@@ -0,0 +1,122 @@
+// The sidestr overlay for one chain document (SPEC 3, 4): a network beside its parent with
+// signed blocks, no subsidy, trivial proof of work and its own address prefix. Data half: the
+// network node and the signature rule joining btc:BlockRules. Code half: the check behind it.
+import { blockData, solutionOf, virtualTxs } from './block.mjs';
+import { resolveParent } from './parents.mjs';
+import { federation } from './federation.mjs';
+
+// --- peg-in claims (SPEC 6) --------------------------------------------------------------
+// A claim is two consecutive coinbase outputs: the payout, then an OP_RETURN carrying
+// `claim:<parent txid>:<vout>`. The pairing is structural, so a level-1 validator, which has no
+// parent view, can still bind each claimed amount to one outpoint; a level-2 validator checks
+// the pair against the parent. Coinbase value may exceed fees by exactly the paid claims.
+const enc = new TextEncoder(), dec = new TextDecoder();
+const toHex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
+const fromHex = (h) => Uint8Array.from(h.match(/../g) ?? [], (x) => parseInt(x, 16));
+export const outpointOf = (txid, vout) => `${txid}:${vout}`;
+export function claimMarker(txid, vout) { const d = enc.encode(`claim:${txid}:${vout}`); return '6a' + d.length.toString(16).padStart(2, '0') + toHex(d); }
+export function opReturnData(spk) { const m = /^6a(?:4c)?([0-9a-f]{2})([0-9a-f]*)$/i.exec(spk); if (!m) return null; const b = fromHex(m[2]); return parseInt(m[1], 16) === b.length ? b : null; }
+export function parseClaims(coinbase) {
+  const claims = [], errors = [];
+  coinbase.outputs.forEach((o, i) => {
+    const d = opReturnData(o.scriptPubKey); if (!d) return; let t; try { t = dec.decode(d); } catch { return; }
+    const m = /^claim:([0-9a-f]{64}):(\d{1,5})$/.exec(t); if (!m) return;
+    const payout = coinbase.outputs[i - 1];
+    if (!payout || payout.scriptPubKey.startsWith('6a') || !(payout.value > 0)) { errors.push(`claim at output ${i} has no payout before it`); return; }
+    claims.push({ index: i, txid: m[1], vout: Number(m[2]), payout: { index: i - 1, value: payout.value, scriptPubKey: payout.scriptPubKey } });
+  });
+  return { claims, errors };
+}
+
+// --- peg-outs (SPEC 7) -----------------------------------------------------------------
+// A burn is an OP_RETURN output carrying `pegout:<parent output script hex>` with a value: the
+// value leaves the supply and the peg holders owe that script that value on the parent. The
+// producer records each burn as it validates the block, by height, like claims.
+export function pegoutMarker(script) { const d = enc.encode(`pegout:${script.toLowerCase()}`); return '6a' + d.length.toString(16).padStart(2, '0') + toHex(d); }
+export function parsePegout(spk) {
+  const d = opReturnData(spk); if (!d) return null; let t; try { t = dec.decode(d); } catch { return null; }
+  const m = /^pegout:((?:[0-9a-f]{2}){2,40})$/.exec(t); return m ? m[1] : null;
+}
+export function parsePegouts(tx, txid) { const out = []; tx.outputs.forEach((o, i) => { const script = parsePegout(o.scriptPubKey); if (script) out.push({ txid, vout: i, script, value: o.value }); }); return out; }
+
+export function sidestrGraph(chain) {
+  return {
+    '@id': 'sidestr:overlay', '@context': { sidestr: 'https://sidestr.com/ns#', knots: 'https://bitcoinknots.org/ns#' },
+    '@graph': [
+      {
+        '@id': chain.id, '@type': 'btc:NetworkParams', extends: 'btc:regtest', label: chain.name, name: chain.name,
+        comment: `sidestr chain beside ${chain.parent}: Bitcoin's rules with signed blocks (SPEC 4), no subsidy, every coin a peg.`,
+        magic: chain.magic ?? 'e5d5e5d5', bech32Hrp: chain.addressPrefix, initialSubsidy: 0, halvingInterval: 210000,
+        powLimit: chain.powLimit, powNoRetargeting: true, allowMinDifficultyBlocks: false,
+        // the header format follows the parent (SPEC 3): beside a BLAKE2b parent, v2 headers from height 0, no headline, no reduced-data period; beside stock Bitcoin, stock headers
+        ...(resolveParent(chain.parent).family === 'blake2b' ? { powHash: 'knots:blake2b-v2', structVariants: { 'btc:BlockHeader': [{ when: { field: 'version', bit: 31 }, struct: 'knots:BlockHeaderV2' }] },
+          blake2bHeight: 0, blake2bHeadline: '', unifiedSighashParam: 'blake2bHeight', rdtsExpiryTime: 0 } : {}),
+        sidestrParent: chain.parent, sidestrChallenge: chain.challenge, sidestrPegConfirmations: chain.pegConfirmations ?? 6, sidestrRefundBlocks: chain.refundBlocks ?? 10000,
+        sidestrPegoutBlocks: chain.pegoutBlocks ?? 144, sidestrPegoutMin: chain.pegoutMin ?? 10000,
+      },
+      { '@id': 'sidestr:rule-pegouts', '@type': 'ValidationRule', ruleSet: 'btc:BlockContextRules', label: 'pegouts', errorCode: 'bad-pegout',
+        comment: 'A pegout:<script> OP_RETURN names a parent output script of 2 to 40 bytes and carries at least pegoutMin sats; the coinbase carries none (SPEC 7). The value leaves the supply; the peg holders owe it on the parent.' },
+      { '@id': 'sidestr:rule-claims', '@type': 'ValidationRule', ruleSet: 'btc:BlockContextRules', label: 'claims', errorCode: 'bad-claim',
+        comment: 'Each claim:<txid>:<vout> OP_RETURN in the coinbase is immediately preceded by its payout output; no outpoint is claimed twice in the block or on the chain (SPEC 6). A level-1 validator accepts what the signers claim; a level-2 validator also checks each pair against the parent.' },
+      { '@id': 'sidestr:rule-block-signature', '@type': 'ValidationRule', ruleSet: 'btc:BlockRules', label: 'block-signature', errorCode: 'bad-block-signature',
+        comment: 'The coinbase witness commitment output carries, after the commitment, a push of ecc7daa2 followed by a serialized witness that satisfies the chain challenge for the block data (SPEC 4).' },
+    ],
+  };
+}
+
+// Level 2: a document with `signers` and `threshold` names its challenge only through them; a
+// challenge that is not the derived one is a broken document. Needs the curve for the tweak.
+export function checkFederation(chain, { hash, secp }) {
+  if (!chain.signers) return null;
+  const fed = federation({ hash, secp }, chain);
+  if (chain.challenge && chain.challenge.toLowerCase() !== fed.challenge) throw new Error(`${chain.id}: challenge ${chain.challenge.slice(0, 12)}… is not the one ${chain.signers.length} signers with threshold ${chain.threshold} derive (${fed.challenge.slice(0, 12)}…)`);
+  return fed;
+}
+export const sidestrOverlay = (chain, { hash, secp = null }) => ({
+  federation: secp ? checkFederation(chain, { hash, secp }) : null,
+  graph: sidestrGraph(chain),
+  // outpoints claimed so far, by the height that claimed them. Validation is idempotent for one
+  // height (a block re-validated, or a competing block at the same height, may claim the same
+  // outpoint); a different height may not. Level 1: no reorgs, so no unwinding is needed.
+  claims: new Map(),
+  // burns seen so far: `${txid}:${vout}` -> { txid, vout, script, value, height }
+  pegouts: new Map(),
+  installChecks({ blocks, interpreter, codec, params }) {
+    const claimed = this.claims, burned = this.pegouts;
+    blocks.registerChecks({ blockContext: {
+      'sidestr:rule-pegouts': ({ block, height }) => {
+        if (block.transactions[0].outputs.some((o) => parsePegout(o.scriptPubKey))) return false;
+        const found = [];
+        for (const tx of block.transactions.slice(1)) { const txid = codec.txid(tx); for (const o of tx.outputs) { const d = opReturnData(o.scriptPubKey); if (!d) continue; let t = ''; try { t = dec.decode(d); } catch {} if (!t.startsWith('pegout:')) continue;
+          const script = parsePegout(o.scriptPubKey); if (!script || o.value < params.sidestrPegoutMin) return false; found.push({ txid, vout: tx.outputs.indexOf(o), script, value: o.value, height }); } }
+        for (const b of found) { const k = outpointOf(b.txid, b.vout); const at = burned.get(k)?.height; if (at !== undefined && at !== height) return false; burned.set(k, b); }
+        return true;
+      },
+      'sidestr:rule-claims': ({ block, height }) => {
+        const { claims, errors } = parseClaims(block.transactions[0]); if (errors.length) return false;
+        const inBlock = new Set();
+        for (const c of claims) { const op = outpointOf(c.txid, c.vout); if (inBlock.has(op)) return false; inBlock.add(op); const at = claimed.get(op); if (at !== undefined && at !== height) return false; }
+        for (const op of inBlock) claimed.set(op, height);
+        return true;
+      },
+      // the kernel's rule, plus the paid claims: coinbase value <= subsidy (0) + fees + claims
+      'btc:rule-blockctx-coinbase-amount': ({ block, height, spending }) => {
+        if (spending.valueUnresolved > 0) return null;
+        const cb = block.transactions[0]; const { claims, errors } = parseClaims(cb); if (errors.length) return false;
+        const paid = claims.reduce((s, c) => s + c.payout.value, 0);
+        return cb.outputs.reduce((s, o) => s + o.value, 0) <= blocks.subsidy(height) + spending.fees + paid;
+      },
+    } });
+    blocks.registerChecks({ block: {
+      'sidestr:rule-block-signature': ({ block }) => {
+        if (!interpreter) return null;
+        const sol = solutionOf(block);
+        if (!sol) return false;
+        const data = blockData({ codec, hash }, block);
+        const { toSign, prevout } = virtualTxs({ codec }, data, params.sidestrChallenge, sol.witness);
+        const v = interpreter.verifyInput(toSign, 0, prevout, [prevout], null);
+        return v.ok === true;
+      },
+    } });
+  },
+});
diff --git a/vendor/sidestr/spec/siding/lib/overlays/assets.mjs b/vendor/sidestr/spec/siding/lib/overlays/assets.mjs
new file mode 100644
index 0000000..bc44c7d
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/overlays/assets.mjs
@@ -0,0 +1,76 @@
+// The `assets` rule (SPEC 12.2): issued assets ride on ordinary coins by tally records; for every
+// asset, a transaction's inputs carry at least what its tallies assign, and the difference is
+// destroyed. Issuance (`issue:` with `tally:self:`) is the one creation. Share assets of pools
+// are the pool rule's to account for, so they are exempt here when a pool rule is present.
+// State beside the UTXO set: what each unspent output carries, derived from the chain on open.
+import { classify } from '../records.mjs';
+export const RULE = 'sidestr:rule-assets';
+const key = (txid, vout) => `${txid}:${vout}`;
+
+// A view over the committed map with the block's own effects on top, so a transaction can spend
+// what an earlier one in the same block created. `commit()` folds it in under a height.
+export class CarryView {
+  constructor(base) { this.base = base; this.temp = new Map(); this.spent = new Map(); }
+  get(k) { if (this.spent.has(k)) return undefined; return this.temp.has(k) ? this.temp.get(k) : this.base.get(k); }
+  set(k, v) { this.temp.set(k, v); }
+  spend(k) { const v = this.get(k); if (v) this.spent.set(k, v); }
+  before(k) { return this.spent.get(k) ?? this.get(k); } // what an outpoint carried, even if this view has spent it
+}
+
+export function assetsOverlay(chain, { pools = null } = {}) {
+  const carried = new Map();   // outpoint -> Map(asset id -> amount), for unspent tallied outputs
+  const byHeight = new Map();  // height -> { added: [outpoints], removed: [[outpoint, carry]] }, so one height re-validated is idempotent
+  const issued = new Map();    // asset id -> { ticker, decimals, height }
+  const isShare = (asset, tx, txid, cls) => !!pools && (pools.has(asset) || (asset === txid && cls.pools.some((p) => p.pool === 'self')));
+  // check one transaction against a view; returns { ok, error, out: Map(vout -> Map(asset -> amount)) } and, when ok, writes its outputs into the view
+  function check(tx, txid, view, { coinbase = false } = {}) {
+    const cls = classify(tx); const bad = (error) => ({ ok: false, error });
+    if (coinbase) return cls.issues.length || cls.tallies.length || cls.bad.length ? bad('the coinbase carries no records') : { ok: true, out: new Map() };
+    if (cls.bad.length) return bad(`malformed record: ${cls.bad[0].slice(0, 40)}`);
+    if (cls.issues.length > 1) return bad('at most one issue: per transaction');
+    const opensPool = cls.pools.some((p) => p.pool === 'self'); if (cls.issues.length && opensPool) return bad('a transaction that opens a pool does not issue');
+    // what the inputs carry, per asset
+    const inCarry = new Map();
+    for (const inp of tx.inputs) { const c = view.get(key(inp.prevout.txid, inp.prevout.vout)); if (!c) continue; for (const [a, n] of c) inCarry.set(a, (inCarry.get(a) ?? 0) + n); }
+    // what the tallies assign, per asset and per output
+    const out = new Map(), assigned = new Map(), seenAsset = new Set();
+    for (const t of cls.tallies) {
+      const asset = t.asset === 'self' ? txid : t.asset;
+      if (t.asset === 'self' && !cls.issues.length && !opensPool) return bad('tally:self without issue: or pool:self:');
+      if (seenAsset.has(asset)) return bad(`asset ${asset.slice(0, 8)}… tallied twice`); seenAsset.add(asset);
+      for (const { vout, amount } of t.assigns) {
+        const o = tx.outputs[vout]; if (!o) return bad(`tally names output ${vout}, which does not exist`); if (o.scriptPubKey.startsWith('6a')) return bad(`tally names output ${vout}, an OP_RETURN`); if (!(o.value >= 1)) return bad(`tally names output ${vout}, which has no value`);
+        if (!out.has(vout)) out.set(vout, new Map()); out.get(vout).set(asset, amount); assigned.set(asset, (assigned.get(asset) ?? 0) + amount);
+      }
+    }
+    for (const [asset, n] of assigned) {
+      if (asset === txid && cls.issues.length) continue;                 // issuance: created from nothing
+      if (isShare(asset, tx, txid, cls)) continue;                       // shares: the pool rule accounts
+      if (n > (inCarry.get(asset) ?? 0)) return bad(`assigns ${n} of ${asset.slice(0, 8)}… but carries ${inCarry.get(asset) ?? 0}`);
+    }
+    for (const inp of tx.inputs) view.spend(key(inp.prevout.txid, inp.prevout.vout)); // spent: carries nothing now
+    for (const [vout, m] of out) view.set(key(txid, vout), m);
+    return { ok: true, out, issue: cls.issues[0] ? { id: txid, ...cls.issues[0] } : null, inCarry };
+  }
+  const self = {
+    lastHeight: -1, lastView: null, // the view of the block just validated, so a later rule can read what its inputs carried
+    graph: { '@id': 'sidestr:overlay-assets', '@context': { sidestr: 'https://sidestr.com/ns#' }, '@graph': [
+      { '@id': RULE, '@type': 'ValidationRule', ruleSet: 'btc:BlockContextRules', label: 'assets', errorCode: 'bad-tally',
+        comment: 'For every asset, what a transaction\'s inputs carry is at least what its tallies assign; issue: creates; the coinbase carries no records (SPEC 12.2).' } ] },
+    carried, issued, check, CarryView,
+    // the carried amounts of an unspent output, or null
+    of(txid, vout) { return carried.get(key(txid, vout)) ?? null; },
+    installChecks({ blocks, codec }) {
+      blocks.registerChecks({ blockContext: { [RULE]: ({ block, height }) => {
+        const prev = byHeight.get(height); if (prev) { for (const k of prev.added) carried.delete(k); for (const [k, v] of prev.removed) carried.set(k, v); } // idempotent per height
+        const view = new CarryView(carried); const added = [], removed = [];
+        for (let i = 0; i < block.transactions.length; i++) { const tx = block.transactions[i]; const r = check(tx, codec.txid(tx), view, { coinbase: i === 0 }); if (!r.ok) return false; }
+        for (const [k, v] of view.temp) { carried.set(k, v); added.push(k); }
+        for (const [k, v] of view.spent) { if (carried.has(k)) { if (!view.temp.has(k)) removed.push([k, v]); carried.delete(k); } }
+        for (let i = 1; i < block.transactions.length; i++) { const tx = block.transactions[i]; const { issues } = classify(tx); if (issues[0]) issued.set(codec.txid(tx), { ...issues[0], height }); }
+        byHeight.set(height, { added, removed }); self.lastHeight = height; self.lastView = view; return true;
+      } } });
+    },
+  };
+  return self;
+}
diff --git a/vendor/sidestr/spec/siding/lib/overlays/evm.mjs b/vendor/sidestr/spec/siding/lib/overlays/evm.mjs
new file mode 100644
index 0000000..46db079
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/overlays/evm.mjs
@@ -0,0 +1,9 @@
+// Podkey stub for siding/lib/overlays/evm.mjs. The EVM rule imports ethereumjs
+// from jsdelivr when it starts, and a Manifest V3 extension may not run code
+// from the network, so a chain that names the rule is refused as unsupported
+// until the rule is vendored too. See scripts/vendor-sidestr.js.
+export function evmOverlay (chain) {
+  const e = new Error(`${chain?.id ?? 'this chain'} names the evm rule, which Podkey cannot run yet`);
+  e.code = 'unsupported';
+  throw e;
+}
diff --git a/vendor/sidestr/spec/siding/lib/overlays/index.mjs b/vendor/sidestr/spec/siding/lib/overlays/index.mjs
new file mode 100644
index 0000000..c88406d
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/overlays/index.mjs
@@ -0,0 +1,16 @@
+// The rules a chain document names (SPEC 12): `"rules": ["assets", "pool"]`. A validator without
+// one of them refuses the chain. Both Node and browsers import this.
+import { assetsOverlay } from './assets.mjs';
+import { poolOverlay } from './pool.mjs';
+import { evmOverlay } from './evm.mjs';
+import { parseClaims } from '../overlay.mjs';
+export const KNOWN = ['assets', 'pool', 'evm'];
+export function rulesFor(chain) {
+  const names = chain.rules ?? []; for (const n of names) if (!KNOWN.includes(n)) throw new Error(`chain ${chain.id} names rule "${n}", which this validator does not have`);
+  if (names.includes('pool') && !names.includes('assets')) throw new Error('the pool rule needs the assets rule');
+  const out = { overlays: [], assets: null, pool: null, evm: null }; if (!names.length) return out;
+  if (names.includes('evm')) out.evm = evmOverlay(chain, { claimsOf: (cb) => parseClaims(cb).claims.reduce((s, c) => s + c.payout.value, 0) });
+  const pools = new Map(); out.assets = assetsOverlay(chain, { pools: names.includes('pool') ? pools : null });
+  if (names.includes('pool')) out.pool = poolOverlay(chain, { assets: out.assets, pools });
+  out.overlays = [out.assets, out.pool, out.evm].filter(Boolean); return out;
+}
diff --git a/vendor/sidestr/spec/siding/lib/overlays/pool.mjs b/vendor/sidestr/spec/siding/lib/overlays/pool.mjs
new file mode 100644
index 0000000..e48c4b5
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/overlays/pool.mjs
@@ -0,0 +1,64 @@
+// The `pool` rule (SPEC 12.3): a pool is one OP_TRUE coin holding x sats and y of one asset; a
+// transaction spends at most one pool coin and leaves exactly one, as a swap (constant product,
+// 3 per 1000 on what comes in), an add or a remove (shares pro rata, rounded to the pool's favour).
+// Shares are the asset whose id is the pool id. State: pools, derived from the chain on open.
+import { classify, isqrt } from '../records.mjs';
+export const RULE = 'sidestr:rule-pool', POOL_SCRIPT = '51';
+const key = (txid, vout) => `${txid}:${vout}`;
+const B = (n) => BigInt(n);
+
+export function poolOverlay(chain, { assets, pools = new Map() }) {
+  // pools: pool id -> { asset, x, y, shares, outpoint, opened }; shared with the assets rule, which exempts share assets
+  const byOutpoint = new Map(); // pool coin outpoint -> pool id
+  const journal = new Map();   // height -> [{ id, before }] to undo a re-validated height
+  // check one transaction; `view` is the assets CarryView already holding this tx's outputs (the assets check ran first)
+  function check(tx, txid, view, { coinbase = false, apply = () => {} } = {}) {
+    const cls = classify(tx); const bad = (error) => ({ ok: false, error });
+    if (coinbase) return cls.pools.length ? bad('the coinbase carries no records') : { ok: true };
+    const spent = tx.inputs.map((i) => byOutpoint.get(key(i.prevout.txid, i.prevout.vout))).filter(Boolean);
+    if (spent.length > 1) return bad('a transaction spends at most one pool coin');
+    const opening = cls.pools.filter((p) => p.pool === 'self'), continuing = cls.pools.filter((p) => p.pool !== 'self');
+    if (cls.pools.length > 1) return bad('a transaction carries at most one pool: record');
+    if (!spent.length && !cls.pools.length) return { ok: true };
+    const carriedOn = (vout) => view.get(key(txid, vout)) ?? new Map();
+    const sharesIn = (id) => { let s = 0; for (const i of tx.inputs) { const c = view.before(key(i.prevout.txid, i.prevout.vout)); if (c?.has(id)) s += c.get(id); } return s; };
+    const sharesOut = (id) => { let s = 0; for (const [, m] of viewOutputs(view, txid, tx)) if (m.has(id)) s += m.get(id); return s; };
+    if (opening.length) {
+      if (spent.length) return bad('a transaction opens a pool or spends one, not both');
+      const { vout } = opening[0]; const o = tx.outputs[vout]; if (!o || o.scriptPubKey !== POOL_SCRIPT || !(o.value >= 1)) return bad('the pool coin is an OP_TRUE output with value');
+      const m = carriedOn(vout); if (m.size !== 1) return bad('a pool coin carries exactly one asset'); const [asset, y0] = [...m][0]; if (asset === txid) return bad('a pool does not hold its own shares');
+      const shares = isqrt(B(o.value) * B(y0)); if (B(sharesOut(txid)) !== shares) return bad(`opening tallies exactly ${shares} shares (tally:self)`);
+      return { ok: true, effect: { id: txid, asset, x: o.value, y: y0, shares: Number(shares), outpoint: key(txid, vout), opened: true } };
+    }
+    // continuing: the spent pool is recreated
+    if (!spent.length) return bad('pool: names a pool this transaction does not spend');
+    const id = spent[0], p = pools.get(id); if (!continuing.length || continuing[0].pool !== id) return bad('a spent pool coin is recreated with pool:<its id>:<vout>');
+    const { vout } = continuing[0]; const o = tx.outputs[vout]; if (!o || o.scriptPubKey !== POOL_SCRIPT || !(o.value >= 1)) return bad('the pool coin is an OP_TRUE output with value');
+    const m = carriedOn(vout); if (m.size !== 1 || !m.has(p.asset)) return bad('the pool coin carries exactly its asset'); const x = B(p.x), y = B(p.y), x2 = B(o.value), y2 = B(m.get(p.asset));
+    if (y2 < 1n) return bad('a pool is never emptied');
+    const S = B(p.shares), S2 = S - B(sharesIn(id)) + B(sharesOut(id)); if (S2 < 0n) return bad('more shares destroyed than exist');
+    let kind;
+    if (S2 === S) { const dx = x2 > x ? x2 - x : 0n, dy = y2 > y ? y2 - y : 0n; if ((1000n * x2 - 3n * dx) * (1000n * y2 - 3n * dy) < 1000000n * x * y) return bad('swap: the constant product does not hold after the fee'); kind = 'swap'; }
+    else if (S2 > S) { if (x2 < x || y2 < y) return bad('add: the pool does not shrink'); const lim = (a, b) => (a - b) * S / b; const cap = [lim(x2, x), lim(y2, y)].reduce((a, b) => a < b ? a : b); if (S2 - S > cap) return bad(`add: at most ${cap} shares for what was added`); kind = 'add'; }
+    else { if (x2 > x || y2 > y) return bad('remove: the pool does not grow'); const d = S - S2; if (x - x2 > x * d / S || y - y2 > y * d / S) return bad('remove: more than the shares\' pro-rata part'); kind = 'remove'; }
+    return { ok: true, kind, effect: { id, asset: p.asset, x: Number(x2), y: Number(y2), shares: Number(S2), outpoint: key(txid, vout), opened: p.opened } };
+  }
+  // this transaction's outputs as the view holds them (assets check wrote them)
+  function viewOutputs(view, txid, tx) { const out = []; tx.outputs.forEach((_, vout) => { const m = view.get(key(txid, vout)); if (m) out.push([vout, m]); }); return out; }
+  function apply(effect, height, log) { const before = pools.get(effect.id) ?? null; log?.push({ id: effect.id, before }); if (before) byOutpoint.delete(before.outpoint); pools.set(effect.id, { ...effect }); byOutpoint.set(effect.outpoint, effect.id); }
+  return {
+    graph: { '@id': 'sidestr:overlay-pool', '@context': { sidestr: 'https://sidestr.com/ns#' }, '@graph': [
+      { '@id': RULE, '@type': 'ValidationRule', ruleSet: 'btc:BlockContextRules', label: 'pool', errorCode: 'bad-pool',
+        comment: 'A transaction spends at most one pool coin and recreates it: a swap keeps the constant product after a fee of 3 per 1000, an add mints shares pro rata, a remove withdraws pro rata and never empties the pool (SPEC 12.3).' } ] },
+    pools, byOutpoint, journal, check, apply, // journal: height -> [{ id, before }] for every applied height, so a page can replay a pool's history (trades, adds, removes)
+    installChecks({ blocks, codec }) {
+      blocks.registerChecks({ blockContext: { [RULE]: ({ block, height }) => {
+        for (const { id, before } of (journal.get(height) ?? []).reverse()) { const cur = pools.get(id); if (cur) byOutpoint.delete(cur.outpoint); if (before) { pools.set(id, before); byOutpoint.set(before.outpoint, id); } else pools.delete(id); }
+        // the assets rule ran first for this block: its view holds this block's outputs and what the spent inputs carried
+        const view = assets.lastHeight === height && assets.lastView ? assets.lastView : new assets.CarryView(assets.carried); const log = []; journal.set(height, log);
+        for (let i = 0; i < block.transactions.length; i++) { const tx = block.transactions[i]; const r = check(tx, codec.txid(tx), view, { coinbase: i === 0 }); if (!r.ok) return false; if (r.effect) apply(r.effect, height, log); }
+        return true;
+      } } });
+    },
+  };
+}
diff --git a/vendor/sidestr/spec/siding/lib/parents.mjs b/vendor/sidestr/spec/siding/lib/parents.mjs
new file mode 100644
index 0000000..8509de2
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/parents.mjs
@@ -0,0 +1,29 @@
+// The parents a chain can sit beside (SPEC 3.2): a short alias per chain, the long kernel id it
+// resolves to, and the header family the chain inherits. Browsers and Node alike; no imports.
+// Old spellings (the kernel's long ids) stay accepted, so no running chain's document changes.
+// `mainnet` picks the key and address encodings a node expects (WIF 0x80 vs 0xef).
+export const PARENTS = {
+  btc:   { network: 'btc:mainnet',          label: 'Bitcoin mainnet',          family: 'stock',   pow: 'sha256d', mainnet: true,
+           genesis: '000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f' },
+  tbtc4: { network: 'btc:testnet4',         label: 'Bitcoin testnet4',         family: 'stock',   pow: 'sha256d', mainnet: false,
+           genesis: '00000000da84f2bafbbc53dee25a72ae507ff4914b867c565be350b0da8bf043' },
+  xbt:   { network: 'btc:mainnet-blake2b',  label: 'BLAKE2b mainnet (Knots)',  family: 'blake2b', pow: 'blake2b', mainnet: true,
+           genesis: '000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f',
+           fork: { height: 961640, hash: '0000000000000050c1e5f69672f459293be14f46e5a494e7a8c8541396f18eeb' } },
+  txbt4: { network: 'btc:testnet4-blake2b', label: 'BLAKE2b testnet4 (Knots)', family: 'blake2b', pow: 'blake2b', mainnet: false,
+           genesis: '00000000da84f2bafbbc53dee25a72ae507ff4914b867c565be350b0da8bf043',
+           fork: { height: 150308, hash: '000000000000b9d1b7e1bb0e77215ee92c6ef7ec8f4473e23908380649e779b6' } },
+  ltc:   { network: null, label: 'Litecoin mainnet', family: 'stock', pow: 'scrypt',   mainnet: true, reserved: true },
+  vtc:   { network: null, label: 'Vertcoin mainnet', family: 'stock', pow: 'verthash', mainnet: true, reserved: true },
+};
+const LONG = Object.fromEntries(Object.entries(PARENTS).filter(([, p]) => p.network).map(([a, p]) => [p.network, a]));
+
+// alias or long id → the alias; null when neither
+export function parentAlias(id) { if (typeof id !== 'string') return null; if (Object.hasOwn(PARENTS, id)) return id; return Object.hasOwn(LONG, id) ? LONG[id] : null; }
+// alias or long id → { alias, ...entry }; throws for a reserved or unknown parent
+export function resolveParent(id) {
+  const alias = parentAlias(id); if (!alias) throw new Error(`unknown parent "${id}": one of ${Object.keys(PARENTS).join(', ')} (SPEC 3.2)`);
+  const p = PARENTS[alias]; if (p.reserved) throw new Error(`parent "${alias}" (${p.label}) is reserved: no validator carries its rules yet (SPEC 3.2)`);
+  return { alias, ...p };
+}
+export const isBlake2b = (id) => resolveParent(id).family === 'blake2b';
diff --git a/vendor/sidestr/spec/siding/lib/records.mjs b/vendor/sidestr/spec/siding/lib/records.mjs
new file mode 100644
index 0000000..5155307
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/records.mjs
@@ -0,0 +1,33 @@
+// Records (SPEC 12.1): OP_RETURN outputs whose data is UTF-8 text of at most 255 bytes, a single
+// push. `issue:`, `tally:` and `pool:` are parsed here; the rules decide what they mean.
+const dec = new TextDecoder('utf-8', { fatal: true }), enc = new TextEncoder();
+const toHex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
+export const MAX_AMOUNT = 2 ** 53 - 1;
+// the text of an OP_RETURN output, or null when it is not a single push of <= 255 bytes of UTF-8
+export function recordText(spk) {
+  const m = /^6a(?:4c([0-9a-f]{2})|([0-9a-f]{2}))([0-9a-f]*)$/i.exec(spk); if (!m) return null;
+  const len = parseInt(m[1] ?? m[2], 16); if (m[2] && len > 75) return null; if (m[1] && len <= 75) return null; // minimal push only if (m[3].length !== len * 2 || len > 255) return null;
+  try { return dec.decode(Uint8Array.from(m[3].match(/../g) ?? [], (x) => parseInt(x, 16))); } catch { return null; }
+}
+export function recordScript(text) { const b = enc.encode(text); if (b.length > 255) throw new Error('a record is at most 255 bytes'); return '6a' + (b.length <= 75 ? b.length.toString(16).padStart(2, '0') : '4c' + b.length.toString(16).padStart(2, '0')) + toHex(b); }
+export const recordsOf = (tx) => tx.outputs.map((o, vout) => ({ vout, text: recordText(o.scriptPubKey) })).filter((r) => r.text !== null);
+const amount = (s) => { if (!/^[1-9]\d{0,15}$/.test(s)) return null; const n = Number(s); return n <= MAX_AMOUNT ? n : null; };
+export function parseIssue(text) { const m = /^issue:([A-Z0-9]{1,8}):([0-8])$/.exec(text); return m ? { ticker: m[1], decimals: Number(m[2]) } : null; }
+// { asset: <64 hex> | 'self', assigns: [{ vout, amount }] }, or null when malformed (a duplicate vout is malformed)
+export function parseTally(text) {
+  const m = /^tally:([0-9a-f]{64}|self):(.+)$/.exec(text); if (!m) return null; const assigns = [], seen = new Set();
+  for (const part of m[2].split(',')) { const p = /^(\d{1,5})=(\d+)$/.exec(part); if (!p) return null; const vout = Number(p[1]), a = amount(p[2]); if (a === null || seen.has(vout)) return null; seen.add(vout); assigns.push({ vout, amount: a }); }
+  return { asset: m[1], assigns };
+}
+export function parsePool(text) { const m = /^pool:([0-9a-f]{64}|self):(\d{1,5})$/.exec(text); return m ? { pool: m[1], vout: Number(m[2]) } : null; }
+// every record of a transaction, classified; `bad` lists records that look like ours but do not parse
+export function classify(tx) {
+  const out = { issues: [], tallies: [], pools: [], bad: [] };
+  for (const { vout, text } of recordsOf(tx)) {
+    if (text.startsWith('issue:')) { const r = parseIssue(text); r ? out.issues.push({ vout, ...r }) : out.bad.push(text); }
+    else if (text.startsWith('tally:')) { const r = parseTally(text); r ? out.tallies.push({ vout, ...r }) : out.bad.push(text); }
+    else if (text.startsWith('pool:')) { const r = parsePool(text); r ? out.pools.push({ vout, ...r }) : out.bad.push(text); }
+  }
+  return out;
+}
+export const isqrt = (n) => { if (n < 0n) throw new Error('isqrt of a negative'); if (n < 2n) return n; let x = BigInt(Math.floor(Math.sqrt(Number(n)))); while (x * x > n) x--; while ((x + 1n) * (x + 1n) <= n) x++; return x; };
diff --git a/vendor/sidestr/spec/siding/lib/txsign.mjs b/vendor/sidestr/spec/siding/lib/txsign.mjs
new file mode 100644
index 0000000..b91ab54
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/txsign.mjs
@@ -0,0 +1,20 @@
+// Key-path signing for a chain's transactions. The sighash follows the parent's family (SPEC 3):
+// beside a BLAKE2b parent the kernel's params carry `unifiedSighashParam` and the unified sighash
+// is the rule; beside stock Bitcoin it is BIP 341's. Browsers and Node alike; no imports.
+export const SIGHASH_UNIFIED = 0x20;
+export const usesUnifiedSighash = (k) => k?.params?.unifiedSighashParam != null;
+// the message an input's key-path signature commits to, and the hash type byte appended to it
+export function keyPathSighash({ k, hash }, tx, i, prevouts) {
+  const unified = usesUnifiedSighash(k); const ht = 0x01 | (unified ? SIGHASH_UNIFIED : 0);
+  let m = unified ? k.interpreter.sighashUnified(tx, i, prevouts, ht, 2) : k.interpreter.sighashTaproot(tx, i, prevouts, ht);
+  if (typeof m === 'string') m = hash.hexToBytes(m); return { m, ht };
+}
+// sign every input of `tx` (all key-path spends of `key`) in place; returns tx
+export function signKeyPath({ k, hash, signer }, tx, prevouts, key) {
+  tx.witness = tx.inputs.map((_, i) => { const { m, ht } = keyPathSighash({ k, hash }, tx, i, prevouts); return [hash.bytesToHex(signer.schnorrSign(m, key)) + ht.toString(16).padStart(2, '0')]; });
+  return tx;
+}
+// our own check before publishing: every witness is a valid signature by `pub` under the chain's sighash
+export function verifyKeyPath({ k, hash, secp }, tx, prevouts, pub) {
+  return tx.inputs.every((_, i) => { const { m, ht } = keyPathSighash({ k, hash }, tx, i, prevouts); const w = tx.witness?.[i]?.[0] ?? ''; return w.length === 130 && w.endsWith(ht.toString(16).padStart(2, '0')) && secp.verifySchnorr(m, hash.hexToBytes(w.slice(0, 128)), hash.hexToBytes(pub)); });
+}