From fe710cca6f3eb203dd9f42e7aa69822790fb89f2 Mon Sep 17 00:00:00 2001
From: Claude Code <github@thedreamlab.uk>
Date: Thu, 24 Sep 2026 16:25:07 +0000
Subject: [PATCH 1/5] =?UTF-8?q?fix(passkey):=20hardware=20keys=20=E2=80=94?=
 =?UTF-8?q?=20transport=20hints,=20clearer=20errors,=20testable=20ceremony?=
 =?UTF-8?q?=20options?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Store the transports a credential reports and pass them in allowCredentials,
so unlock goes straight to the security key instead of the generic chooser.
Name the failed step and what to do (PIN, touch, keep the window in front);
own messages for InvalidStateError, NotSupportedError and SecurityError.
Three-minute timeouts; EdDSA and RS256 offered after ES256. UV stays
'required' on both ceremonies (hmac-secret differs with and without UV).
creationOptions/assertionOptions/cleanTransports exported and tested.

Co-Authored-By: jjohare <github@thedreamlab.uk>
---
 src/passkey.js       | 129 ++++++++++++++++++++++++++++++-------------
 test/passkey.test.js |  76 +++++++++++++++++++++++++
 2 files changed, 167 insertions(+), 38 deletions(-)

diff --git a/src/passkey.js b/src/passkey.js
index 3ec05dc..9706037 100644
--- a/src/passkey.js
+++ b/src/passkey.js
@@ -89,46 +89,103 @@ const PRF_UNSUPPORTED_MESSAGE =
   'Try a phone passkey or a modern security key that supports PRF, or create a ' +
   'passphrase-based key instead.';
 
+// Transports an authenticator can report (WebAuthn AuthenticatorTransport).
+// Passing the ones a credential reported back in allowCredentials lets the
+// browser go straight to "insert and touch your security key" (or NFC)
+// instead of opening its generic chooser, which on desktop leads with the
+// phone/QR option — where hardware-key users got lost.
+export const KNOWN_TRANSPORTS = ['usb', 'nfc', 'ble', 'hybrid', 'internal', 'smart-card'];
+
+export function cleanTransports (transports) {
+  if (!Array.isArray(transports)) return [];
+  return [...new Set(transports.filter(t => KNOWN_TRANSPORTS.includes(t)))];
+}
+
 // WebAuthn surfaces almost every ceremony failure as NotAllowedError — a
 // deliberately vague catch-all covering user cancel, timeout, no available
-// authenticator, and lost window focus. Name the likely causes (including the
-// two-prompt shape below) without over-claiming which one occurred; pass any
-// other error through unchanged.
-function translateCeremonyError (err) {
-  if (err && (err.name === 'NotAllowedError' || err.name === 'AbortError')) {
+// authenticator, a wrong PIN, and the document not having focus. Name the
+// likely causes for the step that failed without over-claiming which one
+// occurred; pass any other error through unchanged.
+export function translateCeremonyError (err, step = 'unlock') {
+  const name = err?.name;
+  if (name === 'NotAllowedError' || name === 'AbortError') {
+    const what = step === 'register'
+      ? 'Registering the passkey was cancelled or timed out.'
+      : 'The passkey step was cancelled or timed out.';
     return new Error(
-      'The passkey step was cancelled, timed out, or could not be completed. ' +
-      'Podkey prompts twice — once to register the passkey, once to derive the key — ' +
-      'so confirm every prompt. If it keeps failing, try a phone passkey or a ' +
-      'different security key.'
+      `${what} With a security key: insert it, enter its PIN if asked, and touch it when it flashes. ` +
+      'Keep this window in front while you do, then try again.'
     );
   }
+  if (name === 'InvalidStateError') {
+    return new Error('This authenticator already holds a Podkey passkey. Use it to unlock, or choose a different key.');
+  }
+  if (name === 'NotSupportedError') {
+    return new Error('This authenticator cannot make the kind of passkey Podkey needs. Try a phone passkey or a newer security key.');
+  }
+  if (name === 'SecurityError') {
+    return new Error('The browser refused the passkey request for this extension. Reload Podkey and try again.');
+  }
   return err instanceof Error ? err : new Error(String(err?.message || err));
 }
 
-export async function createPasskey (prfSalt, label = 'Podkey identity') {
-  if (!window.PublicKeyCredential || !navigator.credentials) {
+// userVerification is 'required' on both ceremonies, and must stay equal
+// between them: CTAP2 hmac-secret derives from a different per-credential
+// secret with and without user verification, so a key registered with UV but
+// asserted without it (or the reverse) returns a different PRF output — a
+// different Nostr identity, or an unwrap failure. For a security key, UV is
+// its PIN; the browser asks the person to set one if the key has none.
+export function creationOptions (prfSalt, label = 'Podkey identity') {
+  return {
+    challenge: randomBytes(32),
+    user: { id: randomBytes(32), name: 'podkey', displayName: label },
+    rp: { name: 'Podkey' },
+    // ES256 first (every FIDO2 key), then EdDSA and RS256 so an authenticator
+    // that offers only those (some Windows Hello TPMs: RS256) is not refused.
+    pubKeyCredParams: [
+      { type: 'public-key', alg: -7 },
+      { type: 'public-key', alg: -8 },
+      { type: 'public-key', alg: -257 }
+    ],
+    // Podkey stores the credentialId itself and always passes it via
+    // allowCredentials at unlock, so it never needs a discoverable (resident)
+    // credential. Requesting one adds cost, uses one of a security key's few
+    // resident slots and, on some TPM/security-key authenticators (e.g.
+    // tpm-fido), a makeCredential failure path — so discourage it.
+    // hmac-secret/PRF works fine on non-resident credentials.
+    authenticatorSelection: { residentKey: 'discouraged', requireResidentKey: false, userVerification: 'required' },
+    // Three minutes: long enough to find a key, set a first PIN and touch it.
+    timeout: 180000,
+    attestation: 'none',
+    extensions: { prf: { eval: { first: prfSalt } } }
+  };
+}
+
+export function assertionOptions (credentialId, prfSalt, transports = []) {
+  const id = typeof credentialId === 'string' ? fromBase64Url(credentialId) : credentialId;
+  const hint = cleanTransports(transports);
+  return {
+    challenge: randomBytes(32),
+    allowCredentials: [{ type: 'public-key', id, ...(hint.length ? { transports: hint } : {}) }],
+    userVerification: 'required',
+    timeout: 180000,
+    extensions: { prf: { eval: { first: prfSalt } } }
+  };
+}
+
+function requireWebAuthn () {
+  if (!globalThis.PublicKeyCredential || !globalThis.navigator?.credentials) {
     throw new Error('Passkeys are not supported by this browser');
   }
+}
+
+export async function createPasskey (prfSalt, label = 'Podkey identity') {
+  requireWebAuthn();
   let credential;
   try {
-    credential = await navigator.credentials.create({ publicKey: {
-      challenge: randomBytes(32),
-      user: { id: randomBytes(32), name: 'podkey', displayName: label },
-      rp: { name: 'Podkey' },
-      pubKeyCredParams: [{ type: 'public-key', alg: -7 }],
-      // Podkey stores the credentialId itself and always passes it via
-      // allowCredentials at unlock, so it never needs a discoverable (resident)
-      // credential. Requesting one adds cost and, on some TPM/security-key
-      // authenticators (e.g. tpm-fido), a makeCredential failure path — so
-      // discourage it. hmac-secret/PRF works fine on non-resident credentials.
-      authenticatorSelection: { residentKey: 'discouraged', userVerification: 'required' },
-      timeout: 120000,
-      attestation: 'none',
-      extensions: { prf: { eval: { first: prfSalt } } }
-    } });
+    credential = await navigator.credentials.create({ publicKey: creationOptions(prfSalt, label) });
   } catch (err) {
-    throw translateCeremonyError(err);
+    throw translateCeremonyError(err, 'register');
   }
   if (!credential) throw new Error('Passkey creation was cancelled');
   // Definitive PRF-support signal: with prf requested at creation, the client
@@ -139,22 +196,18 @@ export async function createPasskey (prfSalt, label = 'Podkey identity') {
   if (!prf || prf.enabled !== true) {
     throw new Error(PRF_UNSUPPORTED_MESSAGE);
   }
-  return { credentialId: toBase64Url(new Uint8Array(credential.rawId)) };
+  let transports = [];
+  try { transports = cleanTransports(credential.response?.getTransports?.()); } catch { /* only a hint */ }
+  return { credentialId: toBase64Url(new Uint8Array(credential.rawId)), transports };
 }
 
-export async function getPasskeyPrf (credentialId, prfSalt) {
-  const id = typeof credentialId === 'string' ? fromBase64Url(credentialId) : credentialId;
+export async function getPasskeyPrf (credentialId, prfSalt, transports = []) {
+  requireWebAuthn();
   let assertion;
   try {
-    assertion = await navigator.credentials.get({ publicKey: {
-      challenge: randomBytes(32),
-      allowCredentials: [{ type: 'public-key', id }],
-      userVerification: 'required',
-      timeout: 120000,
-      extensions: { prf: { eval: { first: prfSalt } } }
-    } });
+    assertion = await navigator.credentials.get({ publicKey: assertionOptions(credentialId, prfSalt, transports) });
   } catch (err) {
-    throw translateCeremonyError(err);
+    throw translateCeremonyError(err, 'unlock');
   }
   const output = assertion?.getClientExtensionResults().prf?.results?.first;
   if (!output) throw new Error(PRF_UNSUPPORTED_MESSAGE);
diff --git a/test/passkey.test.js b/test/passkey.test.js
index 460ae9a..3d315e5 100644
--- a/test/passkey.test.js
+++ b/test/passkey.test.js
@@ -3,9 +3,13 @@ import assert from 'node:assert/strict';
 import { webcrypto } from 'node:crypto';
 import { getPublicKey } from '../src/crypto.js';
 import {
+  assertionOptions,
+  cleanTransports,
+  creationOptions,
   deriveNostrKey,
   fromBase64Url,
   toBase64Url,
+  translateCeremonyError,
   unwrapPrivateKey,
   wrapPrivateKey
 } from '../src/passkey.js';
@@ -79,3 +83,75 @@ describe('wrap freshness and domain separation', () => {
     assert.notEqual(derived, Buffer.from(salt).toString('hex'));
   });
 });
+
+describe('ceremony options (hardware security keys)', () => {
+  const salt = new Uint8Array(32).fill(4);
+
+  it('requires user verification on both ceremonies, so hmac-secret output is stable', () => {
+    // CTAP2 hmac-secret uses a different secret with and without UV: the two
+    // ceremonies must agree or unlock yields a different key.
+    assert.equal(creationOptions(salt).authenticatorSelection.userVerification, 'required');
+    assert.equal(assertionOptions('AAAA', salt).userVerification, 'required');
+  });
+
+  it('asks for a non-resident credential with PRF', () => {
+    const o = creationOptions(salt, 'Podkey unlock');
+    assert.equal(o.authenticatorSelection.residentKey, 'discouraged');
+    assert.equal(o.authenticatorSelection.requireResidentKey, false);
+    assert.deepEqual(o.extensions.prf.eval.first, salt);
+    assert.equal(o.user.displayName, 'Podkey unlock');
+    assert.equal(o.rp.id, undefined, 'rp.id stays unset so the credential binds to the extension origin');
+  });
+
+  it('offers ES256 first, then EdDSA and RS256', () => {
+    assert.deepEqual(creationOptions(salt).pubKeyCredParams.map(p => p.alg), [-7, -8, -257]);
+  });
+
+  it('gives a security key at least three minutes', () => {
+    assert.ok(creationOptions(salt).timeout >= 180000);
+    assert.ok(assertionOptions('AAAA', salt).timeout >= 180000);
+  });
+
+  it('passes the stored transports so the browser goes straight to the key', () => {
+    const o = assertionOptions(toBase64Url(Uint8Array.from([1, 2, 3])), salt, ['usb', 'nfc']);
+    assert.deepEqual(o.allowCredentials[0].transports, ['usb', 'nfc']);
+    assert.deepEqual(o.allowCredentials[0].id, Uint8Array.from([1, 2, 3]));
+    assert.deepEqual(o.extensions.prf.eval.first, salt);
+  });
+
+  it('omits transports for a passkey set up before they were stored', () => {
+    assert.equal('transports' in assertionOptions('AAAA', salt).allowCredentials[0], false);
+    assert.equal('transports' in assertionOptions('AAAA', salt, undefined).allowCredentials[0], false);
+  });
+
+  it('keeps only known transports, once each', () => {
+    assert.deepEqual(cleanTransports(['usb', 'usb', 'bogus', 'nfc', 7]), ['usb', 'nfc']);
+    assert.deepEqual(cleanTransports('usb'), []);
+  });
+});
+
+describe('ceremony errors', () => {
+  const named = (name) => Object.assign(new Error('x'), { name });
+
+  it('tells a security-key user what to do after a cancel or timeout', () => {
+    const e = translateCeremonyError(named('NotAllowedError'), 'unlock');
+    assert.match(e.message, /PIN/);
+    assert.match(e.message, /touch it/);
+    assert.doesNotMatch(e.message, /twice/, 'an unlock prompts once');
+  });
+
+  it('names the registration step when that is what failed', () => {
+    assert.match(translateCeremonyError(named('AbortError'), 'register').message, /Registering/);
+  });
+
+  it('explains InvalidStateError and NotSupportedError', () => {
+    assert.match(translateCeremonyError(named('InvalidStateError')).message, /already holds/);
+    assert.match(translateCeremonyError(named('NotSupportedError')).message, /cannot make/);
+  });
+
+  it('passes other errors through', () => {
+    const original = new Error('boom');
+    assert.equal(translateCeremonyError(original), original);
+    assert.equal(translateCeremonyError('plain').message, 'plain');
+  });
+});

From 08869a95816b596fb03725f65e3e65e01f2f81aa Mon Sep 17 00:00:00 2001
From: Claude Code <github@thedreamlab.uk>
Date: Thu, 24 Sep 2026 16:25:14 +0000
Subject: [PATCH 2/5] fix(popup): passkey windows wait for focus; inline status
 and retry; look and feel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- a ?flow= window waits for focus before its ceremony: WebAuthn refused the
  unfocused new window with NotAllowedError, the main security-key snag
- inline passkey status (step 1 of 2 / 2 of 2, errors with Try again)
  instead of alert(); transports stored in the passkey config
- a window opened only to unlock closes once unlocked
- [hidden] restored over .btn: 'Unlock with passkey' showed with no passkey
- Set up button no longer stuck on 'Waiting…' after a failure
- approve prompt says approving also trusts the site; export shows nsec
- plainer UK copy; text contrast and a dark-mode primary fill that pass;
  focus rings on every control; popup debug logging removed

Co-Authored-By: jjohare <github@thedreamlab.uk>
---
 CHANGELOG.md       |  33 +++++++++++
 popup/approve.css  |   2 +-
 popup/approve.html |   2 +-
 popup/popup.css    |  75 ++++++++++++++++++++++---
 popup/popup.html   |  28 ++++++----
 popup/popup.js     | 135 +++++++++++++++++++++++++++++++--------------
 6 files changed, 213 insertions(+), 62 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c7a8acd..7dc9cdf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- **Security keys: passkey windows no longer fail straight away.** A passkey
+  window started its WebAuthn ceremony on `DOMContentLoaded`, often before the
+  new window had focus, and WebAuthn refuses an unfocused document with the same
+  `NotAllowedError` as a cancel. Ceremonies now wait for focus.
+- **Security keys: the browser goes straight to the key.** The transports a
+  credential reports (`usb`, `nfc`, …) are stored and passed in
+  `allowCredentials`, so unlock asks to insert and touch the key instead of
+  opening the generic chooser that leads with a phone/QR option. Passkeys set up
+  before this keep working without the hint.
+- **"Unlock with passkey" showed with no passkey set up.** `.btn` overrode the
+  `hidden` attribute; a global `[hidden]` rule restores it.
+- Ceremony errors name the step and say what to do (PIN, touch, keep the window
+  in front); `InvalidStateError`, `NotSupportedError` and `SecurityError` get
+  their own messages. Failures show inline with **Try again** instead of an
+  `alert()` over a dead window, and set-up says which of its two touches is next.
+- Ceremony timeouts are three minutes (time to find a key and set a first PIN);
+  EdDSA and RS256 are offered after ES256 for authenticators that lack ES256.
+- A window opened only to unlock closes itself once unlocked, handing focus back
+  to the site that asked.
+- The **Set up** passkey button no longer stays on "Waiting…" after a failure.
+
+### Changed
+
+- The first-approval prompt says that approving also trusts the site from then
+  on (it always did; the prompt did not say so).
+- Export shows the key as `nsec`, the form other apps and Podkey's import take.
+- Plainer copy on the welcome, import and passkey screens; import says it takes
+  `nsec` or hex. Stronger text contrast in light and dark, a primary-button fill
+  that passes contrast in dark mode, and keyboard focus rings on every control.
+  Debug logging removed from the popup.
+
 ### Added
 
 - **FIDO2 / WebAuthn passkey master identity (advanced).** Create a Nostr
diff --git a/popup/approve.css b/popup/approve.css
index 3f042c9..e0e0992 100644
--- a/popup/approve.css
+++ b/popup/approve.css
@@ -220,7 +220,7 @@ body {
   justify-content: center;
   gap: 6px;
   font-size: 11px;
-  color: var(--text-faint);
+  color: var(--text-muted);
   margin-bottom: 7px;
 }
 
diff --git a/popup/approve.html b/popup/approve.html
index 29b0099..0136260 100644
--- a/popup/approve.html
+++ b/popup/approve.html
@@ -46,7 +46,7 @@
           <line x1="12" y1="8" x2="12" y2="12" />
           <line x1="12" y1="16" x2="12.01" y2="16" />
         </svg>
-        <span>Approving lets this site act with your key as if it were you.</span>
+        <span>Approving also trusts this site: from now on it can sign and read messages as you without asking. You can remove it under Trusted sites in Podkey.</span>
       </div>
 
       <div class="btn-row">
diff --git a/popup/popup.css b/popup/popup.css
index 89bab18..299d032 100644
--- a/popup/popup.css
+++ b/popup/popup.css
@@ -14,8 +14,9 @@
 
   /* Text */
   --text: #1e293b;
-  --text-muted: #64748b;
-  --text-faint: #94a3b8;
+  --text-muted: #5b6b80;
+  /* decorative text only (placeholders, separators); never body copy */
+  --text-faint: #8391a5;
 
   /* Borders */
   --border: #e2e8f0;
@@ -26,6 +27,9 @@
   --accent-hover: #1d4ed8;
   --accent-soft: #eff6ff;
   --accent-ring: rgba(37, 99, 235, 0.25);
+  /* fill behind white text: dark mode's lighter --accent fails contrast there */
+  --accent-solid: #2563eb;
+  --accent-solid-hover: #1d4ed8;
 
   /* Semantic */
   --safe: #16a34a;
@@ -64,8 +68,8 @@
     --surface-inset: #0f151d;
 
     --text: #e6eaf0;
-    --text-muted: #9aa6b6;
-    --text-faint: #6b7888;
+    --text-muted: #a3afbf;
+    --text-faint: #7b8898;
 
     --border: #2a3340;
     --border-strong: #3a4452;
@@ -74,6 +78,8 @@
     --accent-hover: #74a0f4;
     --accent-soft: #16223a;
     --accent-ring: rgba(91, 141, 239, 0.35);
+    --accent-solid: #2f63d4;
+    --accent-solid-hover: #3a6fe0;
 
     --safe: #4ade80;
     --safe-hover: #6ee79a;
@@ -246,13 +252,13 @@ h2 {
 }
 
 .btn-primary {
-  background: var(--accent);
+  background: var(--accent-solid);
   color: #fff;
   box-shadow: var(--shadow-sm);
 }
 
 .btn-primary:hover {
-  background: var(--accent-hover);
+  background: var(--accent-solid-hover);
 }
 
 .btn-secondary {
@@ -279,13 +285,66 @@ h2 {
 .advanced-choice p { margin-top: 7px; line-height: 1.45; }
 .advanced-choice .advanced-audience { color: var(--text-muted); border-left: 2px solid var(--border-strong); padding-left: 9px; }
 .text-action { width: 100%; margin-top: 10px; padding: 9px; border: 1px solid var(--border-strong); border-radius: var(--radius-sm); background: var(--surface); color: var(--text); font: inherit; font-weight: 600; cursor: pointer; }
-.divider { display: flex; align-items: center; gap: 8px; margin: 12px 0; color: var(--text-faint); font-size: 10px; text-transform: uppercase; letter-spacing: .06em; }
+.divider { display: flex; align-items: center; gap: 8px; margin: 12px 0; color: var(--text-muted); font-size: 10px; text-transform: uppercase; letter-spacing: .06em; }
 .divider::before, .divider::after { content: ''; height: 1px; flex: 1; background: var(--border); }
 .settings-separated { margin-top: 12px; padding-top: 12px; border-top: 1px solid var(--border); }
 .btn-small { flex: none; padding: 6px 10px; border: 1px solid var(--border-strong); border-radius: var(--radius-sm); background: var(--surface); color: var(--accent); font: inherit; font-size: 11px; font-weight: 700; cursor: pointer; }
 .backup-ack { display: flex; align-items: center; gap: 8px; margin: 12px 0 4px; font-size: 12px; color: var(--text); cursor: pointer; }
 .backup-ack input { accent-color: var(--accent); width: 15px; height: 15px; flex: none; cursor: pointer; }
 
+/* Keyboard focus for every control that had none (small buttons, the
+   passkey summary, footer links, toggles). */
+.btn-small:focus-visible,
+.text-action:focus-visible,
+.btn-copy:focus-visible,
+.btn-remove:focus-visible,
+.advanced-choice summary:focus-visible,
+.footer a:focus-visible,
+.toggle input:focus-visible + .slider {
+  outline: none;
+  box-shadow: 0 0 0 3px var(--accent-ring);
+  border-radius: var(--radius-sm);
+}
+
+.btn-small:hover,
+.text-action:hover {
+  background: var(--surface-2);
+}
+
+.btn-small[disabled],
+.text-action[disabled] {
+  opacity: 0.55;
+  cursor: progress;
+}
+
+/* ---- Passkey status line ---- */
+.flow-status {
+  margin: 12px 18px 0;
+  padding: 10px 12px;
+  border: 1px solid var(--accent-ring);
+  border-radius: var(--radius-sm);
+  background: var(--accent-soft);
+  color: var(--text);
+  font-size: 12.5px;
+  line-height: 1.45;
+}
+
+.flow-status.error {
+  border-color: var(--danger-border);
+  background: var(--danger-soft);
+  color: var(--danger);
+}
+
+.flow-status .btn {
+  margin: 10px 0 0;
+  padding: 8px 12px;
+  font-size: 13px;
+}
+
+[hidden] {
+  display: none !important;
+}
+
 /* ---- Identity ---- */
 .identity-section .section-title {
   margin-bottom: 10px;
@@ -584,7 +643,7 @@ input:focus-visible + .slider {
 .empty-state {
   text-align: center;
   padding: 22px 16px;
-  color: var(--text-faint);
+  color: var(--text-muted);
   font-size: 12.5px;
 }
 
diff --git a/popup/popup.html b/popup/popup.html
index b816efe..11da8f4 100644
--- a/popup/popup.html
+++ b/popup/popup.html
@@ -7,6 +7,13 @@
     <link rel="stylesheet" href="popup.css" />
   </head>
   <body>
+    <!-- Passkey status: what to do with the authenticator now, or what went
+         wrong and a way to try again (set by popup.js showFlowStatus) -->
+    <div id="flowStatus" class="flow-status" role="status" aria-live="polite" hidden>
+      <p id="flowStatusText"></p>
+      <button id="flowRetryBtn" class="btn btn-secondary" type="button" hidden>Try again</button>
+    </div>
+
     <!-- Setup Screen (shown when no key exists) -->
     <div id="setupScreen" class="screen" style="display: none">
       <div class="header center">
@@ -20,7 +27,7 @@
         </div>
         <h1>Welcome to Podkey</h1>
         <p class="subtitle">
-          did:nostr and Solid authentication for the decentralized web
+          One key, kept on this device, for Nostr apps and Solid pods
         </p>
       </div>
 
@@ -43,19 +50,18 @@ <h1>Welcome to Podkey</h1>
         </button>
         <details class="advanced-choice">
           <summary>Advanced: passkey identity</summary>
-          <p class="advanced-audience">For managing agents or working under compliance rules: bind your key to a FIDO2 passkey — hardware-backed, phishing-resistant, and unlocked with biometrics or a security key.</p>
+          <p class="advanced-audience">For managing agents or working under compliance rules: tie your key to a passkey — a security key such as a YubiKey, or your phone or computer's own passkey.</p>
           <button id="passkeyDerivedBtn" class="text-action" type="button">Create identity from a passkey</button>
-          <p>No passphrase. Your passkey recreates the same Nostr key. Export a backup in case the passkey is lost.</p>
+          <p>No passphrase: your passkey recreates the same key each time. You'll touch a security key twice while setting up, and it needs a PIN (your browser helps you set one). Save the backup Podkey shows you, in case the passkey is lost.</p>
         </details>
       </div>
 
       <div class="info-box">
         <div class="info-box-title">What is Podkey?</div>
         <p>
-          A browser extension for <strong>did:nostr</strong> and
-          <strong>Solid</strong> authentication. It holds your cryptographic
-          identity and signs in to Solid pods using your did:nostr identity —
-          your keys never leave this device.
+          Podkey holds your <strong>Nostr</strong> key and signs for you when a
+          site asks — posts, messages, and sign-in to <strong>Solid</strong>
+          pods. You approve each new site. Your key never leaves this device.
         </p>
       </div>
     </div>
@@ -134,15 +140,15 @@ <h1>Unlock Podkey</h1>
         </div>
         <div>
           <h2>Import private key</h2>
-          <p class="subtitle">Enter your 64-character hex private key</p>
+          <p class="subtitle">Paste your nsec or 64-character hex key</p>
         </div>
       </div>
 
       <div class="section">
-        <label for="privateKeyInput">Private key (hex)</label>
+        <label for="privateKeyInput">Private key</label>
         <textarea
           id="privateKeyInput"
-          placeholder="64-character hexadecimal private key…"
+          placeholder="nsec1… or 64 hex characters"
           rows="3"
           spellcheck="false"
           autocomplete="off"
@@ -251,7 +257,7 @@ <h1>Podkey</h1>
         </div>
 
         <div class="identity-field">
-          <div class="identity-label">Public key (npub hex)</div>
+          <div class="identity-label">Public key (hex)</div>
           <div class="identity-value" id="publicKey">Loading…</div>
         </div>
 
diff --git a/popup/popup.js b/popup/popup.js
index 7f2678d..898175f 100644
--- a/popup/popup.js
+++ b/popup/popup.js
@@ -28,19 +28,73 @@ let pendingDerivedIdentity = null;
 
 // Initialize
 document.addEventListener('DOMContentLoaded', async () => {
-  console.log('[Podkey Popup] DOMContentLoaded fired');
   await checkKeypairStatus();
   setupEventListeners();
-  console.log('[Podkey Popup] Initialization complete');
 
   // When relaunched as a dedicated passkey window (?flow=…), start the
-  // requested ceremony immediately — see runPasskeyFlow.
-  const flow = new URLSearchParams(location.search).get('flow');
-  if (flow === 'create') handleCreatePasskeyIdentity();
-  else if (flow === 'enable') handleEnablePasskeyUnlock();
-  else if (flow === 'unlock') handlePasskeyUnlock();
+  // requested ceremony — see runPasskeyFlow — but only once this window has
+  // focus. WebAuthn refuses a ceremony from an unfocused document with the
+  // same NotAllowedError as a cancel, and a window created with focused:true
+  // is often not focused yet when DOMContentLoaded fires: that race was the
+  // "passkey prompt fails straight away" snag with security keys.
+  const handler = FLOW_HANDLERS[new URLSearchParams(location.search).get('flow')];
+  if (handler) {
+    showFlowStatus('Getting your passkey ready…');
+    await whenFocused();
+    handler();
+  }
 });
 
+const FLOW_HANDLERS = {
+  create: () => handleCreatePasskeyIdentity(),
+  enable: () => handleEnablePasskeyUnlock(),
+  unlock: () => handlePasskeyUnlock()
+};
+
+/** Resolve once this document has focus (at once if it already has). */
+function whenFocused() {
+  if (document.hasFocus()) return Promise.resolve();
+  return new Promise(resolve => window.addEventListener('focus', () => resolve(), { once: true }));
+}
+
+/**
+ * The passkey status line at the top of the window: what to do with the
+ * authenticator now, or what went wrong with a way to try again. Replaces
+ * alert() for ceremonies, which stacked a modal on top of the browser's own
+ * passkey dialog and left a dead window behind after a failure.
+ */
+function showFlowStatus(text, { error = false, retry = null } = {}) {
+  const box = document.getElementById('flowStatus');
+  document.getElementById('flowStatusText').textContent = text;
+  box.classList.toggle('error', error);
+  box.hidden = false;
+  const btn = document.getElementById('flowRetryBtn');
+  btn.hidden = !retry;
+  btn.onclick = retry ? () => { btn.hidden = true; retry(); } : null;
+}
+
+function hideFlowStatus() {
+  document.getElementById('flowStatus').hidden = true;
+}
+
+/** Whether this page runs in one of Podkey's own popup windows, not the toolbar popup. */
+async function inOwnWindow() {
+  try {
+    return (await chrome.windows.getCurrent()).type === 'popup';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * A window Podkey opened only so the person could unlock (the background's
+ * unlock prompt, or a passkey relaunch) has done its job once the key is
+ * unlocked: close it and hand focus back to the site that asked.
+ */
+async function closeIfUnlockWindow() {
+  if (await inOwnWindow()) setTimeout(() => window.close(), 700);
+}
+
 /**
  * Run a WebAuthn ceremony in a context that survives losing focus. The
  * toolbar action popup is destroyed on blur — and the platform authenticator
@@ -50,19 +104,15 @@ document.addEventListener('DOMContentLoaded', async () => {
  * let ?flow= restart the ceremony there.
  */
 async function runPasskeyFlow(flow, handler) {
-  let inOwnWindow = false;
-  try {
-    inOwnWindow = (await chrome.windows.getCurrent()).type === 'popup';
-  } catch { /* fall through: treat as action popup and relaunch */ }
-  if (inOwnWindow) {
+  if (await inOwnWindow()) {
     await handler();
     return;
   }
   await chrome.windows.create({
     url: chrome.runtime.getURL(`popup/popup.html?flow=${flow}`),
     type: 'popup',
-    width: 400,
-    height: 560,
+    width: 420,
+    height: 620,
     focused: true
   });
   window.close();
@@ -72,7 +122,6 @@ async function runPasskeyFlow(flow, handler) {
  * Check if keypair exists and show appropriate screen
  */
 async function checkKeypairStatus() {
-  console.log('[Podkey Popup] Checking keypair status...');
   try {
     const response = await chrome.runtime.sendMessage({ type: 'GET_KEYPAIR_STATUS' });
     if (DEBUG) console.log('[Podkey Popup] Keypair status response:', response);
@@ -97,13 +146,9 @@ async function checkKeypairStatus() {
  * Show setup screen
  */
 function showSetupScreen() {
-  console.log('[Podkey Popup] Showing setup screen');
   hideAllScreens();
-  const setupScreen = document.getElementById('setupScreen');
-  console.log('[Podkey Popup] Setup screen element:', setupScreen);
-  setupScreen.style.display = 'block';
+  document.getElementById('setupScreen').style.display = 'block';
   currentScreen = 'setup';
-  console.log('[Podkey Popup] Setup screen display set to block');
 }
 
 async function getPasskeyConfig() {
@@ -200,7 +245,6 @@ function hideAllScreens() {
  * Setup event listeners
  */
 function setupEventListeners() {
-  console.log('[Podkey Popup] Setting up event listeners');
   // Setup screen
   document.getElementById('generateBtn').addEventListener('click', () => showGenerateScreen());
   document.getElementById('importBtn').addEventListener('click', () => showImportScreen());
@@ -247,12 +291,15 @@ function setupEventListeners() {
 
 async function registerPrfPasskey(label) {
   const prfSalt = newPasskeySalt();
-  const { credentialId } = await createPasskey(prfSalt, label);
+  showFlowStatus('Step 1 of 2: register a passkey. With a security key, insert it, enter its PIN if asked, and touch it.');
+  const { credentialId, transports } = await createPasskey(prfSalt, label);
   // Key material comes from a get() assertion — the operation every future
   // unlock performs — so what we derive or wrap now is exactly what the
   // passkey will reproduce later. (Second prompt is the cost of that proof.)
-  const prfOutput = await getPasskeyPrf(credentialId, prfSalt);
-  return { credentialId, prfOutput, prfSalt };
+  showFlowStatus('Step 2 of 2: confirm the same passkey once more. Touch your security key again.');
+  const prfOutput = await getPasskeyPrf(credentialId, prfSalt, transports);
+  hideFlowStatus();
+  return { credentialId, transports, prfOutput, prfSalt };
 }
 
 async function handleCreatePasskeyIdentity() {
@@ -264,7 +311,7 @@ async function handleCreatePasskeyIdentity() {
   try {
     btn.disabled = true;
     btn.textContent = 'Creating passkey…';
-    const { credentialId, prfOutput, prfSalt } = await registerPrfPasskey('Podkey Nostr identity');
+    const { credentialId, transports, prfOutput, prfSalt } = await registerPrfPasskey('Podkey Nostr identity');
     const derivationSalt = newPasskeySalt();
     const privateKey = await deriveNostrKey(prfOutput, derivationSalt);
     // Persist nothing yet: the identity only comes into existence once the
@@ -272,13 +319,13 @@ async function handleCreatePasskeyIdentity() {
     pendingDerivedIdentity = {
       privateKey,
       config: {
-        v: 1, mode: 'derived', credentialId,
+        v: 1, mode: 'derived', credentialId, transports,
         prfSalt: toBase64Url(prfSalt), derivationSalt: toBase64Url(derivationSalt)
       }
     };
     showBackupScreen(privateKey);
   } catch (error) {
-    alert(error.message || 'Could not create a passkey identity.');
+    showFlowStatus(error.message || 'Could not create a passkey identity.', { error: true, retry: handleCreatePasskeyIdentity });
   } finally {
     btn.disabled = false;
     btn.textContent = 'Create identity from a passkey';
@@ -345,14 +392,18 @@ async function handleEnablePasskeyUnlock() {
     btn.textContent = 'Waiting…';
     const { podkey_private_key: privateKey } = await chrome.storage.session.get(['podkey_private_key']);
     if (!privateKey) throw new Error('Unlock Podkey before setting up passkey unlock');
-    const { credentialId, prfOutput, prfSalt } = await registerPrfPasskey('Podkey unlock');
+    const { credentialId, transports, prfOutput, prfSalt } = await registerPrfPasskey('Podkey unlock');
     const wrapped = await wrapPrivateKey(privateKey, prfOutput);
     await chrome.storage.local.set({ [PASSKEY_CONFIG_KEY]: {
-      v: 1, mode: 'wrapped', credentialId, prfSalt: toBase64Url(prfSalt), wrapped
+      v: 1, mode: 'wrapped', credentialId, transports, prfSalt: toBase64Url(prfSalt), wrapped
     } });
     await showMainScreen(await chrome.runtime.sendMessage({ type: 'GET_KEYPAIR_STATUS' }));
+    showFlowStatus('Passkey unlock is ready. Next time, unlock with your passkey instead of your passphrase.');
   } catch (error) {
-    alert(error.message || 'Could not enable passkey unlock.');
+    showFlowStatus(error.message || 'Could not set up passkey unlock.', { error: true, retry: handleEnablePasskeyUnlock });
+    // showMainScreen restores the label on success; on failure put it back here
+    const config = await getPasskeyConfig();
+    btn.textContent = config ? 'Replace' : 'Set up';
   } finally {
     btn.disabled = false;
   }
@@ -362,18 +413,21 @@ async function handlePasskeyUnlock() {
   const btn = document.getElementById('passkeyUnlockBtn');
   try {
     btn.disabled = true;
-    btn.textContent = 'Waiting for passkey…';
+    btn.textContent = 'Waiting for your passkey…';
     const config = await getPasskeyConfig();
-    if (!config) throw new Error('No passkey is configured');
-    const prfOutput = await getPasskeyPrf(config.credentialId, fromBase64Url(config.prfSalt));
+    if (!config) throw new Error('No passkey is set up on this browser');
+    showFlowStatus('Use your passkey. With a security key, insert it, enter its PIN if asked, and touch it.');
+    const prfOutput = await getPasskeyPrf(config.credentialId, fromBase64Url(config.prfSalt), config.transports);
     const privateKey = config.mode === 'derived'
       ? await deriveNostrKey(prfOutput, fromBase64Url(config.derivationSalt))
       : await unwrapPrivateKey(config.wrapped, prfOutput);
     const response = await chrome.runtime.sendMessage({ type: 'SET_SESSION_KEY', privateKey });
     if (response?.error) throw new Error(response.error);
+    showFlowStatus('Unlocked.');
     await showMainScreen(response);
+    await closeIfUnlockWindow();
   } catch (error) {
-    alert(error.message || 'Passkey unlock failed.');
+    showFlowStatus(error.message || 'Passkey unlock failed.', { error: true, retry: handlePasskeyUnlock });
   } finally {
     btn.disabled = false;
     btn.textContent = 'Unlock with passkey';
@@ -452,6 +506,7 @@ async function handleUnlock() {
       publicKey: response.publicKey,
       did: response.did
     });
+    await closeIfUnlockWindow();
   } catch (error) {
     // 'Incorrect passphrase' from the background — keep it on-screen to retry.
     alert(error.message || 'Unlock failed.');
@@ -575,11 +630,9 @@ async function handleAutoSignToggle(event) {
  */
 async function handleExport() {
   const confirmed = confirm(
-    '⚠️ WARNING ⚠️\n\n' +
-    'You are about to reveal your private key.\n\n' +
-    'NEVER share this with anyone!\n' +
-    'Anyone with your private key can control your identity.\n\n' +
-    'Continue?'
+    'Show your private key?\n\n' +
+    'Anyone who sees it can act as you, everywhere you use this identity. ' +
+    'Only continue if you are saving a backup somewhere private.'
   );
 
   if (!confirmed) return;
@@ -597,8 +650,8 @@ async function handleExport() {
       return;
     }
 
-    // Show private key
-    prompt('Your Private Key (keep this safe!):', privateKey);
+    // nsec is the form other Nostr apps (and Podkey's own import) accept.
+    prompt('Your private key (nsec). Keep it private:', hexToNsec(privateKey));
   } catch (error) {
     alert('Error exporting key: ' + error.message);
   }

From a03a36e1c1727f14cf8b8f0a6b80cef667f85783 Mon Sep 17 00:00:00 2001
From: Claude Code <github@thedreamlab.uk>
Date: Thu, 24 Sep 2026 16:26:02 +0000
Subject: [PATCH 3/5] feat: sidestr browser signer
 (window.nostr.sidestr.signTransaction)

Implements sidestr/spec proposals/browser-signer.md: any page on any
sidestr chain can ask Podkey to sign a spend without ever holding the key.

- window.nostr.sidestr { version: 1, name, signTransaction({ chain, tx }) };
  refusals carry code: rejected, unsupported, not-yours, invalid, unavailable
- the spend window (popup/spend.*) reads the chain from its id alone
  (announcement -> the signer's mirror -> every block validated), refuses
  mainnet parents and rules it cannot run, pins each chain's signer on first
  spend and refuses a different one, and signs only mature unspent coins
  paying 5120<own key>
- it computes every sighash itself (BIP 341 / unified by parent family) and
  shows recipients (npub, profile name when found), what comes back, the fee
  and the total; assets are read under SPEC 12 (the rule where a chain names
  it, the holders' view where not) and a spend that destroys or burns needs
  an explicit tick
- every spend asks, whatever trust the origin has; the key stays in the
  background, which signs the window's sighashes once per request
- the engine (bitcoin-desktop/schema v0.0.27, sidestr/spec 373d3eb,
  sidestr/explorer db5a04e) is vendored by scripts/vendor-sidestr.js with a
  SHA-256 per file; the explorer points at the vendored copies and the EVM
  rule is stubbed, because MV3 forbids remote code
- provider: request timers are cleared on answer; spends wait 5 minutes
- 0.0.9

Co-Authored-By: jjohare <github@thedreamlab.uk>
---
 manifest.json                                 |    4 +-
 package.json                                  |    2 +-
 popup/spend.css                               |  338 ++++++
 popup/spend.html                              |  136 +++
 popup/spend.js                                |  286 +++++
 scripts/vendor-sidestr.js                     |  170 +++
 src/background.js                             |   64 +-
 src/crypto.js                                 |   29 +
 src/injected.js                               |   10 +-
 src/keyformat.js                              |   16 +
 src/nostr-provider.js                         |   53 +-
 src/sidestr/core.js                           |  253 +++++
 src/sidestr/request.js                        |   33 +
 src/sidestr/spends.js                         |   86 ++
 test/content-whitelist.test.js                |   26 +
 test/fixtures/sidestr-dreamlab.chain.json     |    1 +
 test/keyformat.test.js                        |   10 +
 test/provider-surface.test.js                 |   43 +-
 test/sidestr-core.test.js                     |  188 +++
 test/sidestr-spends.test.js                   |  115 ++
 test/sidestr-vendor.test.js                   |   57 +
 vendor/sidestr/PINS.json                      |   68 ++
 vendor/sidestr/explorer/LICENSE               |  661 +++++++++++
 vendor/sidestr/explorer/explorer.mjs          |  114 ++
 vendor/sidestr/schema/LICENSE                 |  661 +++++++++++
 vendor/sidestr/schema/codec/blocks.js         |  383 +++++++
 vendor/sidestr/schema/codec/codec.js          |  364 ++++++
 vendor/sidestr/schema/codec/hash.js           |  295 +++++
 vendor/sidestr/schema/codec/headers.js        |  223 ++++
 vendor/sidestr/schema/codec/interpreter.js    |  939 +++++++++++++++
 vendor/sidestr/schema/codec/kernel.js         |   31 +
 vendor/sidestr/schema/codec/nostr.js          |  124 ++
 vendor/sidestr/schema/codec/overlay.js        |   50 +
 .../schema/codec/overlays/knots-blake2b.js    |   66 ++
 vendor/sidestr/schema/codec/pow/blake2b.js    |   87 ++
 .../schema/codec/pow/knots-header-v2.js       |   69 ++
 vendor/sidestr/schema/codec/script.js         |  246 ++++
 vendor/sidestr/schema/codec/secp256k1.js      |  237 ++++
 vendor/sidestr/schema/schema/chain.jsonld     |  474 ++++++++
 vendor/sidestr/schema/schema/core.jsonld      |  329 ++++++
 .../schema/overlays/knots-blake2b.jsonld      |  240 ++++
 vendor/sidestr/schema/schema/proof.jsonld     |  102 ++
 vendor/sidestr/schema/schema/script.jsonld    | 1004 +++++++++++++++++
 vendor/sidestr/schema/schema/validate.jsonld  |  344 ++++++
 vendor/sidestr/spec/LICENSE                   |  661 +++++++++++
 vendor/sidestr/spec/siding/lib/announce.mjs   |   67 ++
 vendor/sidestr/spec/siding/lib/block.mjs      |  122 ++
 vendor/sidestr/spec/siding/lib/federation.mjs |   68 ++
 vendor/sidestr/spec/siding/lib/overlay.mjs    |  122 ++
 .../spec/siding/lib/overlays/assets.mjs       |   76 ++
 .../sidestr/spec/siding/lib/overlays/evm.mjs  |    9 +
 .../spec/siding/lib/overlays/index.mjs        |   16 +
 .../sidestr/spec/siding/lib/overlays/pool.mjs |   64 ++
 vendor/sidestr/spec/siding/lib/parents.mjs    |   29 +
 vendor/sidestr/spec/siding/lib/records.mjs    |   33 +
 vendor/sidestr/spec/siding/lib/txsign.mjs     |   20 +
 56 files changed, 10299 insertions(+), 19 deletions(-)
 create mode 100644 popup/spend.css
 create mode 100644 popup/spend.html
 create mode 100644 popup/spend.js
 create mode 100644 scripts/vendor-sidestr.js
 create mode 100644 src/sidestr/core.js
 create mode 100644 src/sidestr/request.js
 create mode 100644 src/sidestr/spends.js
 create mode 100644 test/fixtures/sidestr-dreamlab.chain.json
 create mode 100644 test/sidestr-core.test.js
 create mode 100644 test/sidestr-spends.test.js
 create mode 100644 test/sidestr-vendor.test.js
 create mode 100644 vendor/sidestr/PINS.json
 create mode 100644 vendor/sidestr/explorer/LICENSE
 create mode 100644 vendor/sidestr/explorer/explorer.mjs
 create mode 100644 vendor/sidestr/schema/LICENSE
 create mode 100644 vendor/sidestr/schema/codec/blocks.js
 create mode 100644 vendor/sidestr/schema/codec/codec.js
 create mode 100644 vendor/sidestr/schema/codec/hash.js
 create mode 100644 vendor/sidestr/schema/codec/headers.js
 create mode 100644 vendor/sidestr/schema/codec/interpreter.js
 create mode 100644 vendor/sidestr/schema/codec/kernel.js
 create mode 100644 vendor/sidestr/schema/codec/nostr.js
 create mode 100644 vendor/sidestr/schema/codec/overlay.js
 create mode 100644 vendor/sidestr/schema/codec/overlays/knots-blake2b.js
 create mode 100644 vendor/sidestr/schema/codec/pow/blake2b.js
 create mode 100644 vendor/sidestr/schema/codec/pow/knots-header-v2.js
 create mode 100644 vendor/sidestr/schema/codec/script.js
 create mode 100644 vendor/sidestr/schema/codec/secp256k1.js
 create mode 100644 vendor/sidestr/schema/schema/chain.jsonld
 create mode 100644 vendor/sidestr/schema/schema/core.jsonld
 create mode 100644 vendor/sidestr/schema/schema/overlays/knots-blake2b.jsonld
 create mode 100644 vendor/sidestr/schema/schema/proof.jsonld
 create mode 100644 vendor/sidestr/schema/schema/script.jsonld
 create mode 100644 vendor/sidestr/schema/schema/validate.jsonld
 create mode 100644 vendor/sidestr/spec/LICENSE
 create mode 100644 vendor/sidestr/spec/siding/lib/announce.mjs
 create mode 100644 vendor/sidestr/spec/siding/lib/block.mjs
 create mode 100644 vendor/sidestr/spec/siding/lib/federation.mjs
 create mode 100644 vendor/sidestr/spec/siding/lib/overlay.mjs
 create mode 100644 vendor/sidestr/spec/siding/lib/overlays/assets.mjs
 create mode 100644 vendor/sidestr/spec/siding/lib/overlays/evm.mjs
 create mode 100644 vendor/sidestr/spec/siding/lib/overlays/index.mjs
 create mode 100644 vendor/sidestr/spec/siding/lib/overlays/pool.mjs
 create mode 100644 vendor/sidestr/spec/siding/lib/parents.mjs
 create mode 100644 vendor/sidestr/spec/siding/lib/records.mjs
 create mode 100644 vendor/sidestr/spec/siding/lib/txsign.mjs

diff --git a/manifest.json b/manifest.json
index 0754b3f..76625aa 100644
--- a/manifest.json
+++ b/manifest.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Podkey",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "description": "Nostr (NIP-07) signer and Solid (NIP-98) login. One did:nostr key, encrypted on your device.",
   "content_security_policy": {
     "extension_pages": "script-src 'self'; object-src 'self'"
@@ -52,4 +52,4 @@
       ]
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/package.json b/package.json
index d5c12fb..99c2569 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "podkey",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "description": "did:nostr and Solid authentication extension - NIP-07 provider for decentralized identity",
   "main": "src/index.js",
   "type": "module",
diff --git a/popup/spend.css b/popup/spend.css
new file mode 100644
index 0000000..5ad80bd
--- /dev/null
+++ b/popup/spend.css
@@ -0,0 +1,338 @@
+/**
+ * Podkey - sidestr spend window
+ * Builds on popup.css (tokens) and approve.css (header, origin, buttons,
+ * countdown). The question the layout answers first: what leaves my wallet,
+ * and where does it go.
+ */
+
+body {
+  width: 440px;
+}
+
+.spend [hidden] {
+  display: none !important;
+}
+
+.spend-card {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 12px 14px;
+  margin-bottom: 10px;
+}
+
+.spend-card.compact {
+  padding: 8px 14px;
+}
+
+.spend-eyebrow {
+  font-size: 11px;
+  font-weight: 600;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  color: var(--text-muted);
+  margin-bottom: 8px;
+}
+
+.spend-hint {
+  font-size: 11.5px;
+  color: var(--text-muted);
+  line-height: 1.45;
+  margin: 8px 0 10px;
+}
+
+/* ---- Loading steps ---- */
+.steps {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+
+.step {
+  position: relative;
+  padding: 5px 0 5px 24px;
+  font-size: 13px;
+  color: var(--text-faint);
+}
+
+.step::before {
+  content: '';
+  position: absolute;
+  left: 2px;
+  top: 8px;
+  width: 12px;
+  height: 12px;
+  border-radius: 50%;
+  border: 2px solid var(--border-strong);
+}
+
+.step.active {
+  color: var(--text);
+}
+
+.step.active::before {
+  border-color: var(--accent);
+  border-right-color: transparent;
+  animation: spin 0.8s linear infinite;
+}
+
+.step.done {
+  color: var(--text-muted);
+}
+
+.step.done::before {
+  border-color: var(--safe);
+  background: var(--safe);
+}
+
+@keyframes spin {
+  to { transform: rotate(360deg); }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .step.active::before { animation: none; }
+}
+
+/* ---- Chain ---- */
+.chain-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+}
+
+.chain-id {
+  font-family: var(--mono);
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--text);
+  overflow-wrap: anywhere;
+}
+
+.pill {
+  flex: none;
+  font-size: 10.5px;
+  font-weight: 600;
+  padding: 2px 8px;
+  border-radius: 999px;
+  background: var(--surface-inset);
+  border: 1px solid var(--border);
+  color: var(--text-muted);
+  white-space: nowrap;
+}
+
+.pill.safe {
+  background: var(--safe-soft);
+  border-color: var(--safe-border);
+  color: var(--safe);
+}
+
+.pill.warn {
+  background: var(--warn-soft);
+  border-color: var(--warn-border);
+  color: var(--warn);
+}
+
+.chain-check {
+  font-size: 12px;
+  color: var(--safe);
+  margin-top: 6px;
+}
+
+.chain-signer {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  flex-wrap: wrap;
+  font-size: 11.5px;
+  color: var(--text-muted);
+  margin-top: 4px;
+}
+
+.chain-signer code {
+  font-family: var(--mono);
+  color: var(--text);
+}
+
+/* ---- Rows ---- */
+.rows {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+
+.rows li {
+  display: flex;
+  justify-content: space-between;
+  gap: 12px;
+  padding: 8px 0;
+  border-top: 1px solid var(--border);
+}
+
+.rows li:first-child {
+  border-top: none;
+  padding-top: 0;
+}
+
+.who {
+  min-width: 0;
+}
+
+.who-name {
+  font-size: 13.5px;
+  font-weight: 600;
+  color: var(--text);
+  overflow-wrap: anywhere;
+}
+
+.who-sub {
+  font-family: var(--mono);
+  font-size: 11px;
+  color: var(--text-muted);
+  overflow-wrap: anywhere;
+  margin-top: 2px;
+}
+
+.amounts {
+  flex: none;
+  text-align: right;
+}
+
+.amount-main {
+  font-size: 14px;
+  font-weight: 700;
+  color: var(--text);
+  white-space: nowrap;
+}
+
+.amount-sub {
+  font-size: 11.5px;
+  color: var(--text-muted);
+  white-space: nowrap;
+  margin-top: 2px;
+}
+
+.row-line {
+  display: flex;
+  justify-content: space-between;
+  gap: 12px;
+  padding: 4px 0;
+  font-size: 13px;
+}
+
+.row-label {
+  color: var(--text-muted);
+}
+
+.row-amount {
+  text-align: right;
+  color: var(--text);
+  font-weight: 600;
+}
+
+.row-line.total {
+  border-top: 1px solid var(--border);
+  margin-top: 4px;
+  padding-top: 8px;
+}
+
+.row-line.total .row-label {
+  color: var(--text);
+  font-weight: 600;
+}
+
+.row-line.total .row-amount {
+  font-size: 14px;
+  font-weight: 700;
+}
+
+/* ---- Warnings ---- */
+.warn-box {
+  background: var(--danger-soft);
+  border: 1px solid var(--danger-border);
+  border-radius: var(--radius);
+  padding: 10px 14px;
+  margin-bottom: 10px;
+  color: var(--danger);
+  font-size: 12.5px;
+  line-height: 1.45;
+}
+
+.warn-box ul {
+  margin: 0;
+  padding-left: 18px;
+}
+
+.ack {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-top: 8px;
+  font-size: 12.5px;
+  font-weight: 600;
+  color: var(--text);
+  cursor: pointer;
+}
+
+/* ---- Details ---- */
+.spend-details {
+  font-size: 12px;
+  color: var(--text-muted);
+  margin-bottom: 10px;
+}
+
+.spend-details summary {
+  cursor: pointer;
+  padding: 4px 0;
+}
+
+.spend-details dl {
+  margin: 6px 0 0;
+}
+
+.spend-details dt {
+  font-weight: 600;
+  margin-top: 6px;
+}
+
+.spend-details dd {
+  margin: 2px 0 0;
+}
+
+.spend-details code,
+.plain li {
+  font-family: var(--mono);
+  font-size: 11px;
+  overflow-wrap: anywhere;
+}
+
+.plain {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+
+/* ---- Outcomes ---- */
+.failure {
+  border-color: var(--danger-border);
+}
+
+.failure-title {
+  font-size: 14px;
+  font-weight: 700;
+  color: var(--text);
+  margin-bottom: 6px;
+}
+
+.failure-text {
+  font-size: 12.5px;
+  color: var(--text-muted);
+  line-height: 1.45;
+  margin: 0 0 8px;
+  overflow-wrap: anywhere;
+}
+
+.signed {
+  border-color: var(--safe-border);
+  background: var(--safe-soft);
+}
diff --git a/popup/spend.html b/popup/spend.html
new file mode 100644
index 0000000..a3317fb
--- /dev/null
+++ b/popup/spend.html
@@ -0,0 +1,136 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Podkey — Spend request</title>
+    <link rel="stylesheet" href="popup.css" />
+    <link rel="stylesheet" href="approve.css" />
+    <link rel="stylesheet" href="spend.css" />
+  </head>
+  <body>
+    <main class="approve spend">
+      <div class="approve-head">
+        <div class="approve-shield" aria-hidden="true">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+            <rect x="2" y="6" width="20" height="14" rx="2" />
+            <path d="M16 13h2" />
+            <path d="M2 10h20" />
+          </svg>
+        </div>
+        <div>
+          <div class="approve-title">Spend request</div>
+          <div class="approve-sub">Nothing leaves your wallet until you sign</div>
+        </div>
+      </div>
+
+      <section class="origin-block">
+        <div class="origin-eyebrow">Requested by</div>
+        <code class="origin-badge" id="origin">…</code>
+      </section>
+
+      <!-- 1. Podkey reads the chain itself -->
+      <section id="loading" class="spend-card" aria-live="polite">
+        <div class="spend-eyebrow">Podkey is checking <span id="loadingChain">the chain</span> itself</div>
+        <ol class="steps">
+          <li id="stepFind" class="step">Finding the chain and its signer</li>
+          <li id="stepCheck" class="step">Checking every block</li>
+          <li id="stepReview" class="step">Reading the spend against your coins</li>
+        </ol>
+        <p class="spend-hint">The site only sent the transaction. Everything below comes from Podkey's own reading of the chain.</p>
+      </section>
+
+      <!-- 2. The spend, as Podkey read it -->
+      <section id="review" hidden>
+        <div class="spend-card chain-card">
+          <div class="chain-row">
+            <code class="chain-id" id="chainId"></code>
+            <span class="pill" id="network"></span>
+          </div>
+          <div class="chain-check" id="chainCheck"></div>
+          <div class="chain-signer">
+            <span>Signer</span> <code id="signer"></code>
+            <span class="pill" id="signerPin"></span>
+          </div>
+        </div>
+
+        <div class="spend-card">
+          <div class="spend-eyebrow">Sending</div>
+          <ul class="rows" id="sending"></ul>
+        </div>
+
+        <div class="spend-card compact" id="backCard" hidden>
+          <div class="row-line">
+            <span class="row-label">Back to you</span>
+            <span class="row-amount" id="back"></span>
+          </div>
+        </div>
+
+        <div class="spend-card compact">
+          <div class="row-line">
+            <span class="row-label">Network fee</span>
+            <span class="row-amount" id="fee"></span>
+          </div>
+          <div class="row-line total">
+            <span class="row-label">Leaves your wallet</span>
+            <span class="row-amount" id="total"></span>
+          </div>
+        </div>
+
+        <p class="spend-hint" id="assetNote" hidden></p>
+
+        <div class="warn-box" id="warnings" hidden role="alert">
+          <ul id="warningList"></ul>
+          <label class="ack" id="ackRow" hidden>
+            <input type="checkbox" id="ack" />
+            <span>I understand, sign anyway</span>
+          </label>
+        </div>
+
+        <details class="spend-details">
+          <summary>Details</summary>
+          <dl>
+            <dt>Transaction id</dt><dd><code id="txid"></code></dd>
+            <dt>Your coins spent</dt><dd><ul class="plain" id="inputs"></ul></dd>
+            <dt>Asset records</dt><dd><ul class="plain" id="records"></ul></dd>
+            <dt>Mirror</dt><dd><code id="mirror"></code></dd>
+          </dl>
+        </details>
+
+        <div class="btn-row">
+          <button class="btn btn-deny" id="reject" type="button" autofocus>Reject</button>
+          <button class="btn btn-approve" id="sign" type="button" disabled>Sign</button>
+        </div>
+      </section>
+
+      <!-- 3. Podkey will not sign this -->
+      <section id="failure" class="spend-card failure" hidden role="alert">
+        <div class="failure-title" id="failureTitle">Podkey can't sign this</div>
+        <p class="failure-text" id="failureText"></p>
+        <div id="forgetRow" hidden>
+          <p class="spend-hint">Only do this if the chain's operator told you its signer changed. Podkey will then trust whichever signer announces this chain next.</p>
+          <label class="ack"><input type="checkbox" id="forgetAck" /><span>The operator told me the signer changed</span></label>
+          <button class="btn btn-deny" id="forget" type="button" disabled>Forget the old signer</button>
+        </div>
+        <div class="btn-row">
+          <button class="btn btn-deny" id="close" type="button">Close</button>
+        </div>
+      </section>
+
+      <section id="signed" class="spend-card signed" hidden aria-live="polite">
+        <div class="failure-title">Signed</div>
+        <p class="failure-text">The site now sends it to the chain.</p>
+      </section>
+
+      <div class="countdown" id="countdownWrap">
+        <div class="countdown-text">
+          Closes in <strong id="countdown">4:00</strong>
+        </div>
+        <div class="timeout-bar">
+          <div class="timeout-bar-inner" id="timeoutBar"></div>
+        </div>
+      </div>
+    </main>
+    <script type="module" src="spend.js"></script>
+  </body>
+</html>
diff --git a/popup/spend.js b/popup/spend.js
new file mode 100644
index 0000000..4e0eb21
--- /dev/null
+++ b/popup/spend.js
@@ -0,0 +1,286 @@
+/**
+ * Podkey - sidestr spend window (sidestr/spec proposals/browser-signer.md)
+ *
+ * Opened by the background for one spend request. Reads and validates the
+ * chain itself, reviews the page's transaction against the person's own
+ * coins, shows what leaves the wallet and where it goes, and asks. On Sign it
+ * sends the sighashes it computed to the background, which holds the key,
+ * then checks the signatures and hands the signed transaction back.
+ *
+ * Everything shown that came from a page or a relay is written with
+ * textContent, never innerHTML.
+ */
+
+import * as core from '../src/sidestr/core.js';
+
+const PINS_KEY = 'podkey_sidestr_signers';
+const PROFILE_KIND = 0;
+const $ = (id) => document.getElementById(id);
+const id = new URLSearchParams(location.search).get('id');
+
+const send = async (message) => {
+  const r = await chrome.runtime.sendMessage(message);
+  if (r && r.error) throw Object.assign(new Error(r.error), { code: r.code });
+  return r;
+};
+
+// ---- outcome, exactly once ------------------------------------------------
+
+let finished = false;
+function finishWith (outcome) {
+  if (finished) return;
+  finished = true;
+  clearInterval(keepalive);
+  send({ type: 'SIDESTR_DONE', id, ...outcome }).catch(() => {});
+}
+// Closing the window is a rejection (the background also sees the window go).
+window.addEventListener('beforeunload', () => finishWith({ error: { code: 'rejected', message: 'You closed the spend window' } }));
+// Keep the service worker awake while the person reads.
+const keepalive = setInterval(() => send({ type: 'SIDESTR_KEEPALIVE', id }).catch(() => {}), 20_000);
+
+// ---- small formatters -----------------------------------------------------
+
+const sats = (n) => `${n.toLocaleString('en-GB')} sat${n === 1 ? '' : 's'}`;
+const short = (s, head = 12, tail = 6) => (s.length > head + tail + 1 ? `${s.slice(0, head)}…${s.slice(-tail)}` : s);
+const assetText = (a) => `${core.formatAsset(a.amount, a.decimals)} ${a.ticker}`;
+function el (tag, cls, text) { const e = document.createElement(tag); if (cls) e.className = cls; if (text != null) e.textContent = text; return e; }
+function sumAssets (lists) {
+  const m = new Map();
+  for (const a of lists.flat()) { const k = a.asset; const cur = m.get(k); m.set(k, cur ? { ...cur, amount: cur.amount + a.amount } : { ...a }); }
+  return [...m.values()];
+}
+
+// ---- steps ----------------------------------------------------------------
+
+function step (which) {
+  const order = ['stepFind', 'stepCheck', 'stepReview'];
+  const at = order.indexOf(which);
+  order.forEach((s, i) => { $(s).className = `step${i < at ? ' done' : i === at ? ' active' : ''}`; });
+}
+
+// ---- countdown --------------------------------------------------------------
+
+let counting = false;
+function startCountdown (expiresAt) {
+  if (counting) return;
+  counting = true;
+  const total = Math.max(1, expiresAt - Date.now());
+  const tick = () => {
+    if (finished) return;
+    const left = Math.max(0, expiresAt - Date.now());
+    const s = Math.ceil(left / 1000);
+    $('countdown').textContent = `${Math.floor(s / 60)}:${String(s % 60).padStart(2, '0')}`;
+    $('timeoutBar').style.width = `${((left / total) * 100).toFixed(2)}%`;
+    $('timeoutBar').classList.toggle('urgent', s <= 20);
+    if (left <= 0) { finishWith({ error: { code: 'rejected', message: 'The spend window timed out' } }); window.close(); return; }
+    setTimeout(tick, 250);
+  };
+  tick();
+}
+
+// ---- names, from each key's own profile (kind 0) --------------------------
+
+// Best effort and never blocking: a name is the key's own claim, so the npub
+// stays on screen beside it.
+function fetchNames (pubkeys, lib, onName) {
+  if (!pubkeys.length) return;
+  const want = new Set(pubkeys); const best = new Map();
+  for (const url of core.RELAYS) {
+    let ws; try { ws = new WebSocket(url); } catch { continue; }
+    const stop = setTimeout(() => { try { ws.close(); } catch { /* already closed */ } }, 3000);
+    ws.onopen = () => ws.send(JSON.stringify(['REQ', 'n', { kinds: [PROFILE_KIND], authors: [...want] }]));
+    ws.onmessage = (m) => {
+      let msg; try { msg = JSON.parse(m.data); } catch { return; }
+      if (msg[0] === 'EOSE') { clearTimeout(stop); try { ws.close(); } catch { /* already closed */ } return; }
+      const ev = msg[0] === 'EVENT' ? msg[2] : null;
+      if (!ev || ev.kind !== PROFILE_KIND || !want.has(ev.pubkey)) return;
+      let ok = false; try { ok = lib.nostr.verifyNostrEvent(ev); } catch { /* malformed: not ok */ }
+      if (!ok || (best.get(ev.pubkey)?.created_at ?? 0) >= ev.created_at) return;
+      best.set(ev.pubkey, ev);
+      let p; try { p = JSON.parse(ev.content); } catch { return; }
+      // drop control characters and the invisible and bidi marks a name could hide behind
+      // eslint-disable-next-line no-control-regex
+      const name = String(p?.display_name || p?.name || '').replace(/[\u0000-\u001f\u200b-\u200f\u202a-\u202e]/g, '').trim().slice(0, 48);
+      if (name) onName(ev.pubkey, name);
+    };
+    ws.onerror = () => {};
+  }
+}
+
+// ---- review ---------------------------------------------------------------
+
+function render ({ req, opened, reviewed, pinned, lib }) {
+  const { ex, signer, parent, mirror, mirrorNote } = opened;
+  $('loading').hidden = true;
+  $('review').hidden = false;
+
+  $('chainId').textContent = ex.chain.id;
+  $('network').textContent = parent.mainnet ? parent.label : `Test coins · ${parent.label}`;
+  $('chainCheck').textContent = `✓ ${(ex.tip().height + 1).toLocaleString('en-GB')} blocks checked by Podkey · ${mirrorNote}`;
+  $('signer').textContent = short(signer, 8, 8);
+  $('signer').title = signer;
+  const pin = $('signerPin');
+  if (pinned) { pin.textContent = 'same as before'; pin.className = 'pill safe'; }
+  else { pin.textContent = 'first spend here: Podkey will remember it'; pin.className = 'pill warn'; }
+
+  // sending
+  const list = $('sending'); list.replaceChildren();
+  const nameSlots = new Map();
+  const others = reviewed.outputs.filter((o) => o.kind !== 'change' && o.kind !== 'asset-record');
+  if (!others.length) list.append(el('li', 'who-sub', 'Nothing goes to anyone else: this only rearranges your own coins.'));
+  for (const o of others) {
+    const li = el('li'); const who = el('div', 'who'); const amounts = el('div', 'amounts');
+    if (o.kind === 'key') {
+      const name = el('div', 'who-name', short(o.npub, 14, 8)); name.title = o.npub;
+      const sub = el('div', 'who-sub', o.npub); sub.hidden = true;
+      who.append(name, sub);
+      if (!nameSlots.has(o.pubkey)) nameSlots.set(o.pubkey, []);
+      nameSlots.get(o.pubkey).push({ name, sub });
+    } else if (o.kind === 'script') {
+      who.append(el('div', 'who-name', o.address ? short(o.address, 16, 8) : 'A script'), el('div', 'who-sub', o.address ?? o.script));
+    } else if (o.kind === 'pegout') {
+      who.append(el('div', 'who-name', 'Peg-out to the parent chain'), el('div', 'who-sub', o.to));
+    } else if (o.kind === 'burn') {
+      who.append(el('div', 'who-name', 'Burned'), el('div', 'who-sub', o.text ?? o.script));
+    } else {
+      who.append(el('div', 'who-name', 'Note on the chain'), el('div', 'who-sub', o.text ?? o.script));
+    }
+    if (o.assets.length) {
+      amounts.append(el('div', 'amount-main', o.assets.map(assetText).join(' + ')));
+      if (o.value) amounts.append(el('div', 'amount-sub', `+ ${sats(o.value)}`));
+    } else if (o.value || o.kind !== 'record') {
+      amounts.append(el('div', 'amount-main', sats(o.value)));
+    }
+    li.append(who, amounts); list.append(li);
+  }
+  fetchNames([...nameSlots.keys()], lib, (pubkey, nm) => {
+    for (const { name, sub } of nameSlots.get(pubkey) ?? []) { name.textContent = nm; sub.hidden = false; }
+  });
+
+  // back to you
+  const change = reviewed.outputs.filter((o) => o.kind === 'change');
+  if (change.length) {
+    const back = change.reduce((s, o) => s + o.value, 0);
+    const assetsBack = sumAssets(change.map((o) => o.assets));
+    $('back').textContent = [sats(back), ...assetsBack.map(assetText)].join(' + ');
+    $('backCard').hidden = false;
+  }
+
+  // fee and total
+  $('fee').textContent = sats(reviewed.fee);
+  const leavingSats = reviewed.inSum - change.reduce((s, o) => s + o.value, 0);
+  const leavingAssets = sumAssets([...others.map((o) => o.assets), reviewed.destroyed.map((d) => ({ ...d, ...labelOf(reviewed, d.asset) }))]);
+  $('total').textContent = [...leavingAssets.map(assetText), sats(leavingSats)].join(' + ');
+
+  if (reviewed.inputs.some((i) => i.carries.length) || others.some((o) => o.assets.length)) {
+    $('assetNote').hidden = false;
+    $('assetNote').textContent = reviewed.assetMode === 'rule'
+      ? `${ex.chain.id} enforces its assets: every node checks these amounts.`
+      : `Assets on ${ex.chain.id} are kept by their holders' records; the chain itself does not enforce them. Podkey read them from every block.`;
+  }
+
+  // warnings: anything that destroys or burns needs an explicit tick
+  const severe = reviewed.warnings.filter((w) => ['destroys', 'breaks', 'burn', 'pegout'].includes(w.kind));
+  if (reviewed.warnings.length) {
+    $('warnings').hidden = false;
+    $('warningList').replaceChildren(...reviewed.warnings.map((w) => el('li', null, w.text)));
+    $('ackRow').hidden = !severe.length;
+  }
+
+  // details
+  $('txid').textContent = reviewed.txid;
+  $('inputs').replaceChildren(...reviewed.inputs.map((i) => el('li', null, `${short(i.key, 16, 4)} · ${sats(i.value)}${i.carries.length ? ` · ${i.carries.map(assetText).join(', ')}` : ''}`)));
+  const recs = reviewed.outputs.filter((o) => o.kind === 'asset-record');
+  $('records').replaceChildren(...(recs.length ? recs.map((o) => el('li', null, o.text)) : [el('li', null, 'none')]));
+  $('mirror').textContent = mirror;
+
+  const sign = $('sign');
+  const ready = () => { sign.disabled = severe.length > 0 && !$('ack').checked; };
+  $('ack').addEventListener('change', ready); ready();
+  sign.addEventListener('click', () => doSign({ req, opened, reviewed, pinned, lib }));
+}
+
+function labelOf (reviewed, asset) {
+  const found = [...reviewed.outputs.flatMap((o) => o.assets), ...reviewed.inputs.flatMap((i) => i.carries)].find((a) => a.asset === asset);
+  return found ? { ticker: found.ticker, decimals: found.decimals } : { ticker: `${asset.slice(0, 8)}…`, decimals: 0 };
+}
+
+async function doSign ({ req, opened, reviewed, pinned, lib }) {
+  $('sign').disabled = true; $('reject').disabled = true;
+  $('sign').textContent = 'Signing…';
+  try {
+    const { signatures } = await send({ type: 'SIDESTR_SIGN_DIGESTS', id, digests: reviewed.sighashes.map((s) => s.digest) });
+    const result = core.finish({ ex: opened.ex, lib, reviewed, signatures, pub: req.pub });
+    if (!pinned) {
+      const pins = (await chrome.storage.local.get(PINS_KEY))[PINS_KEY] ?? {};
+      pins[req.chain] = opened.signer;
+      await chrome.storage.local.set({ [PINS_KEY]: pins });
+    }
+    finishWith({ result });
+    $('review').hidden = true; $('countdownWrap').hidden = true; $('signed').hidden = false;
+    setTimeout(() => window.close(), 1200);
+  } catch (e) {
+    fail(e);
+  }
+}
+
+// ---- failure --------------------------------------------------------------
+
+const TITLES = {
+  'not-yours': 'This spends coins that are not yours',
+  unsupported: 'Podkey does not sign for this chain',
+  invalid: 'This is not a spend Podkey can read',
+  unavailable: 'Podkey could not check this spend',
+  rejected: 'Spend rejected'
+};
+
+function fail (e) {
+  const code = core.CODES.includes(e?.code) ? e.code : 'unavailable';
+  const message = e?.message || String(e);
+  $('loading').hidden = true; $('review').hidden = true; $('failure').hidden = false;
+  $('failureTitle').textContent = TITLES[code];
+  $('failureText').textContent = message;
+  $('forgetRow').hidden = !(code === 'unsupported' && /different signer/.test(message));
+  $('close').onclick = () => { finishWith({ error: { code, message } }); window.close(); };
+}
+
+$('forgetAck').addEventListener('change', () => { $('forget').disabled = !$('forgetAck').checked; });
+$('forget').addEventListener('click', async () => {
+  const req = await send({ type: 'SIDESTR_REQUEST', id });
+  const pins = (await chrome.storage.local.get(PINS_KEY))[PINS_KEY] ?? {};
+  delete pins[req.chain];
+  await chrome.storage.local.set({ [PINS_KEY]: pins });
+  $('failure').hidden = true; $('loading').hidden = false;
+  main();
+});
+
+$('reject').addEventListener('click', () => {
+  finishWith({ error: { code: 'rejected', message: 'You rejected the spend' } });
+  window.close();
+});
+
+// ---- main -----------------------------------------------------------------
+
+async function main () {
+  try {
+    const req = await send({ type: 'SIDESTR_REQUEST', id });
+    $('origin').textContent = req.origin;
+    $('loadingChain').textContent = req.chain;
+    startCountdown(req.expiresAt);
+    step('stepFind');
+    const lib = await core.loadLib();
+    const pinned = ((await chrome.storage.local.get(PINS_KEY))[PINS_KEY] ?? {})[req.chain] ?? null;
+    const opened = await core.openChain({
+      lib, chainId: req.chain, pinned,
+      onProgress: (m) => { if (/^Checking/.test(m)) step('stepCheck'); }
+    });
+    step('stepReview');
+    const view = core.assetView(opened.ex, lib);
+    const reviewed = core.review({ ex: opened.ex, lib, view, pub: req.pub, txHex: req.tx });
+    render({ req, opened, reviewed, pinned, lib });
+  } catch (e) {
+    fail(e);
+  }
+}
+
+main();
diff --git a/scripts/vendor-sidestr.js b/scripts/vendor-sidestr.js
new file mode 100644
index 0000000..5f57ede
--- /dev/null
+++ b/scripts/vendor-sidestr.js
@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+/**
+ * Vendor the sidestr engine into vendor/sidestr/ from pinned upstream commits.
+ *
+ * A Manifest V3 extension may not run code it fetches from the network, and
+ * the sidestr explorer and wallet load their engine from jsdelivr at run time.
+ * The spend window (popup/spend.html) runs the same engine, so Podkey carries
+ * pinned copies of exactly the modules it imports, and nothing else:
+ *
+ *   bitcoin-desktop/schema   the kernel (codec) and its JSON-LD documents
+ *   sidestr/spec             siding/lib: parents, overlays, records, signing
+ *   sidestr/explorer         explorer.mjs: reads and validates a chain
+ *
+ * Two patches, both recorded in vendor/sidestr/PINS.json:
+ *   - explorer.mjs: its default engine locations point at the vendored copies
+ *     instead of jsdelivr, so nothing is ever imported from the network;
+ *   - siding/lib/overlays/evm.mjs: replaced by a stub, because the EVM rule
+ *     imports ethereumjs from jsdelivr when it starts. A chain that names the
+ *     rule is refused as `unsupported` until the rule is vendored too.
+ *
+ * PINS.json records a SHA-256 per file; test/sidestr-vendor.test.js checks
+ * the tree against it. Run: `node scripts/vendor-sidestr.js` (needs git), optionally with
+ * `--from <name>=<local clone>` per pin to read an already-reviewed clone instead of fetching.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync, readdirSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, posix, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+const out = join(root, 'vendor', 'sidestr');
+
+export const PINS = [
+  {
+    name: 'schema',
+    repo: 'https://github.com/bitcoin-desktop/schema',
+    tag: 'v0.0.27',
+    commit: 'b8cbf6337c7450fe14ddc5bce00c7280059aab5d',
+    // what explorer.mjs imports from `${cdn}` (and the BLAKE2b parent's overlay)
+    entries: ['codec/kernel.js', 'codec/hash.js', 'codec/nostr.js', 'codec/secp256k1.js', 'codec/interpreter.js', 'codec/overlays/knots-blake2b.js'],
+    documents: ['schema/core.jsonld', 'schema/proof.jsonld', 'schema/script.jsonld', 'schema/chain.jsonld', 'schema/validate.jsonld', 'schema/overlays/knots-blake2b.jsonld'],
+    licence: 'LICENSE'
+  },
+  {
+    name: 'spec',
+    repo: 'https://github.com/sidestr/spec',
+    commit: '373d3eb6accd163f418e8a813052f1516a942bb3',
+    // what explorer.mjs imports from `${sidestr}`, plus what the spend window uses
+    entries: ['siding/lib/parents.mjs', 'siding/lib/overlay.mjs', 'siding/lib/overlays/index.mjs', 'siding/lib/txsign.mjs', 'siding/lib/announce.mjs', 'siding/lib/records.mjs', 'siding/lib/overlays/assets.mjs'],
+    documents: [],
+    licence: 'LICENSE'
+  },
+  {
+    name: 'explorer',
+    repo: 'https://github.com/sidestr/explorer',
+    commit: 'db5a04e756243f9a73cba11b083d715c2ee3b327',
+    entries: ['explorer.mjs'],
+    documents: [],
+    licence: 'LICENSE'
+  }
+];
+
+const EVM_STUB = `// Podkey stub for siding/lib/overlays/evm.mjs. The EVM rule imports ethereumjs
+// from jsdelivr when it starts, and a Manifest V3 extension may not run code
+// from the network, so a chain that names the rule is refused as unsupported
+// until the rule is vendored too. See scripts/vendor-sidestr.js.
+export function evmOverlay (chain) {
+  const e = new Error(\`\${chain?.id ?? 'this chain'} names the evm rule, which Podkey cannot run yet\`);
+  e.code = 'unsupported';
+  throw e;
+}
+`;
+
+// relative module specifiers a file imports: static `from '…'` and `import('…')` with a literal
+const importsOf = (src) => [...src.matchAll(/(?:from\s*|import\s*\(\s*)['"](\.{1,2}\/[^'"]+)['"]/g)].map((m) => m[1]);
+
+// A repo holding the pinned commit: a local clone named with `--from <name>=<path>` (it must
+// contain the commit), else a shallow fetch of just that commit. Files are always read from the
+// commit object with `git show`, never from a working tree, so a local clone's edits cannot leak in.
+function openPin (pin, from) {
+  const local = from[pin.name];
+  const dir = local ?? mkdtempSync(join(tmpdir(), `podkey-${pin.name}-`));
+  const git = (...args) => execFileSync('git', args, { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 1 << 26 }).toString();
+  if (!local) { git('init', '-q'); git('fetch', '-q', '--depth', '1', pin.repo, pin.commit); }
+  const found = git('rev-parse', '--verify', `${pin.commit}^{commit}`).trim();
+  if (found !== pin.commit) throw new Error(`${pin.name}: ${dir} resolves ${found}, pinned ${pin.commit}`);
+  return {
+    read: (file) => git('show', `${pin.commit}:${file}`),
+    has: (file) => { try { git('cat-file', '-e', `${pin.commit}:${file}`); return true; } catch { return false; } },
+    close: () => { if (!local) rmSync(dir, { recursive: true, force: true }); }
+  };
+}
+
+// the entries and every module they import, transitively, as repo-relative posix paths
+function closure (repo, entries) {
+  const seen = new Set(); const queue = [...entries];
+  while (queue.length) {
+    const file = queue.shift(); if (seen.has(file)) continue;
+    if (!repo.has(file)) throw new Error(`missing ${file}`);
+    seen.add(file);
+    for (const spec of importsOf(repo.read(file))) queue.push(posix.normalize(posix.join(posix.dirname(file), spec)));
+  }
+  return [...seen].sort();
+}
+
+function patch (pin, file, text) {
+  if (pin.name === 'explorer' && file === 'explorer.mjs') {
+    const cdn = "export const CDN = 'https://cdn.jsdelivr.net/gh/bitcoin-desktop/schema@v0.0.27';";
+    const side = /export const SIDESTR = 'https:\/\/cdn\.jsdelivr\.net\/gh\/sidestr\/spec@[0-9a-f]{40}\/siding\/lib';/;
+    if (!text.includes(cdn) || !side.test(text)) throw new Error('explorer.mjs: the engine locations moved; review the patch');
+    return {
+      text: text
+        .replace(cdn, "export const CDN = new URL('../schema', import.meta.url).href; // Podkey: the vendored engine, never the network")
+        .replace(side, "export const SIDESTR = new URL('../spec/siding/lib', import.meta.url).href; // Podkey: the vendored lib"),
+      note: 'engine locations point at the vendored copies instead of jsdelivr'
+    };
+  }
+  if (pin.name === 'spec' && file === 'siding/lib/overlays/evm.mjs') {
+    if (!/export function evmOverlay\(/.test(text)) throw new Error('evm.mjs: evmOverlay moved; review the stub');
+    return { text: EVM_STUB, note: 'stub: the EVM rule imports ethereumjs from the network at start' };
+  }
+  return { text, note: null };
+}
+
+const sha256 = (s) => createHash('sha256').update(s).digest('hex');
+
+// every file under vendor/sidestr except PINS.json, as posix paths relative to it
+export function listVendored (base = out) {
+  const files = [];
+  const walk = (d) => { for (const e of readdirSync(d, { withFileTypes: true })) { const p = join(d, e.name); if (e.isDirectory()) walk(p); else files.push(relative(base, p).split('\\').join('/')); } };
+  if (existsSync(base)) walk(base);
+  return files.filter((f) => f !== 'PINS.json').sort();
+}
+
+function main (argv) {
+  const from = {};
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] !== '--from') throw new Error(`unknown argument ${argv[i]}; usage: vendor-sidestr.js [--from <name>=<git dir>]...`);
+    const [name, dir] = String(argv[++i] ?? '').split('=');
+    if (!PINS.some((p) => p.name === name) || !dir) throw new Error(`--from takes <name>=<dir>, name one of ${PINS.map((p) => p.name).join(', ')}`);
+    from[name] = dir;
+  }
+  rmSync(out, { recursive: true, force: true });
+  const record = { note: 'Generated by scripts/vendor-sidestr.js. Do not edit by hand.', pins: [] };
+  for (const pin of PINS) {
+    const repo = openPin(pin, from);
+    try {
+      const files = [...closure(repo, pin.entries), ...pin.documents, pin.licence];
+      const entry = { name: pin.name, repo: pin.repo, commit: pin.commit, ...(pin.tag ? { tag: pin.tag } : {}), files: {}, patched: {} };
+      for (const file of files) {
+        const { text, note } = patch(pin, file, repo.read(file));
+        const dest = join(out, pin.name, file);
+        mkdirSync(dirname(dest), { recursive: true });
+        writeFileSync(dest, text);
+        entry.files[file] = sha256(text);
+        if (note) entry.patched[file] = note;
+      }
+      record.pins.push(entry);
+      console.log(`${pin.name}@${pin.commit.slice(0, 7)}: ${files.length} files`);
+    } finally {
+      repo.close();
+    }
+  }
+  writeFileSync(join(out, 'PINS.json'), JSON.stringify(record, null, 2) + '\n');
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) main(process.argv.slice(2));
diff --git a/src/background.js b/src/background.js
index bcbcac1..5d8593c 100644
--- a/src/background.js
+++ b/src/background.js
@@ -3,7 +3,8 @@
  * Coordinates key management, signing, and Solid auto-auth
  */
 
-import { generateKeypair, signEvent, getPublicKey } from './crypto.js';
+import { generateKeypair, signEvent, getPublicKey, signSighashes } from './crypto.js';
+import { createSpends } from './sidestr/spends.js';
 import {
   getConversationKey,
   encrypt as nip44Encrypt,
@@ -66,8 +67,9 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
       sendResponse(result);
     })
     .catch(error => {
-      console.error('[Podkey] Error handling message:', message.type, error);
-      sendResponse({ error: error.message });
+      // A refused spend is an answer, not a fault: only log the unexpected.
+      if (!error?.code) console.error('[Podkey] Error handling message:', message.type, error);
+      sendResponse({ error: error.message, ...(typeof error?.code === 'string' ? { code: error.code } : {}) });
     });
 
   return true; // Async response
@@ -94,7 +96,12 @@ const EXTENSION_UI_ONLY_TYPES = new Set([
   'UNLOCK_VAULT',
   'LOCK_VAULT',
   'SET_SESSION_KEY',
-  'GET_KEYPAIR_STATUS'
+  'GET_KEYPAIR_STATUS',
+  // the sidestr spend window's side of a spend (src/sidestr/spends.js)
+  'SIDESTR_REQUEST',
+  'SIDESTR_SIGN_DIGESTS',
+  'SIDESTR_DONE',
+  'SIDESTR_KEEPALIVE'
 ]);
 
 function isExtensionUiSender (sender) {
@@ -149,6 +156,23 @@ async function handleMessage (message, sender) {
     case 'NIP44_GET_CONVERSATION_KEY':
       return await handleNip44GetConversationKey(message.pubkey, origin);
 
+    case 'SIDESTR_SIGN_TRANSACTION':
+      return await spends.request({ chain: message.chain, tx: message.tx }, pageOrigin(sender, origin));
+
+    case 'SIDESTR_REQUEST':
+      return spends.describe(message.id);
+
+    case 'SIDESTR_SIGN_DIGESTS':
+      return await spends.signDigests(message.id, message.digests);
+
+    case 'SIDESTR_DONE':
+      spends.done(message.id, { result: message.result, error: message.error });
+      return { ok: true };
+
+    case 'SIDESTR_KEEPALIVE':
+      // the spend window pings while it is open, so the worker outlives a slow decision
+      return { ok: spends.pending.has(message.id) };
+
     case 'CREATE_NIP98_AUTH_HEADER':
       return await createNip98AuthHeader(
         message.url,
@@ -162,6 +186,38 @@ async function handleMessage (message, sender) {
   }
 }
 
+/**
+ * sidestr spends (sidestr/spec proposals/browser-signer.md). Each one opens the
+ * spend window, which reads the chain itself and shows the spend; the key stays
+ * here and signs only the sighashes that window computed, once, after the
+ * person confirms. See src/sidestr/spends.js.
+ */
+const spends = createSpends({
+  ensureUnlocked: () => ensureUnlocked(),
+  getKeypair: () => getKeypair(),
+  signSighashes,
+  openWindow: (id) => new Promise((resolve, reject) => {
+    chrome.windows.create({
+      url: `popup/spend.html?${new URLSearchParams({ id })}`,
+      type: 'popup',
+      width: 440,
+      height: 720,
+      focused: true
+    }, (w) => (chrome.runtime.lastError ? reject(new Error(chrome.runtime.lastError.message)) : resolve(w?.id ?? null)));
+  })
+});
+
+// Closing the spend window rejects the spend. (Guarded: the unit tests' chrome stub has no windows API.)
+chrome.windows?.onRemoved?.addListener((windowId) => spends.windowClosed(windowId));
+
+// The origin shown for a spend is the one Chrome reports for the sending
+// frame, not anything the page wrote into the message.
+function pageOrigin (sender, claimed) {
+  if (sender?.origin && sender.origin !== 'null') return sender.origin;
+  try { if (sender?.url) return new URL(sender.url).origin; } catch { /* not a URL: fall back */ }
+  return claimed;
+}
+
 /**
  * Coalesce concurrent unlock requests behind a SINGLE passphrase prompt.
  *
diff --git a/src/crypto.js b/src/crypto.js
index 297fe24..a73526c 100644
--- a/src/crypto.js
+++ b/src/crypto.js
@@ -96,6 +96,35 @@ export async function signEvent (event, privateKeyHex) {
   };
 }
 
+/**
+ * BIP 340 signatures over sidestr key-path sighashes.
+ *
+ * Deliberately NOT a page-facing "sign these 32 bytes" call: a signature over
+ * arbitrary bytes is also a signature over any event id. Only the background's
+ * SIDESTR_SIGN_DIGESTS path calls this, for digests the spend window computed
+ * itself from Podkey's own reading of the chain, once per approved request.
+ * Every signature is self-verified before it leaves, as signEvent does.
+ * @param {string[]} digestsHex - 64-char hex sighashes
+ * @param {string} privateKeyHex - 64-char hex private key
+ * @returns {string[]} 128-char hex signatures, in order
+ */
+export function signSighashes (digestsHex, privateKeyHex) {
+  validatePrivateKey(privateKeyHex);
+  const privateKeyBytes = hexToBytes(privateKeyHex);
+  const pubkeyBytes = hexToBytes(getPublicKey(privateKeyHex));
+  return digestsHex.map((digestHex) => {
+    if (typeof digestHex !== 'string' || !/^[0-9a-f]{64}$/.test(digestHex)) {
+      throw new Error('A sighash is 32 bytes of lowercase hex');
+    }
+    const digest = hexToBytes(digestHex);
+    const signature = schnorr.sign(digest, privateKeyBytes);
+    if (!schnorr.verify(signature, digest, pubkeyBytes)) {
+      throw new Error('Signature self-verification failed');
+    }
+    return bytesToHex(signature);
+  });
+}
+
 /**
  * Verify a signed Nostr event
  * @param {object} event - Signed event
diff --git a/src/injected.js b/src/injected.js
index d8b0cdc..6363f93 100644
--- a/src/injected.js
+++ b/src/injected.js
@@ -108,7 +108,8 @@ const ALLOWED_TYPES = new Set([
   'GET_PUBLIC_KEY',
   'SIGN_EVENT',
   'NIP44_ENCRYPT',
-  'NIP44_DECRYPT'
+  'NIP44_DECRYPT',
+  'SIDESTR_SIGN_TRANSACTION'
 ]);
 
 // Listen for requests from the injected script (NIP-07 relay)
@@ -133,6 +134,10 @@ window.addEventListener('podkey-request', async (event) => {
     if (data.pubkey) safeData.pubkey = String(data.pubkey);
     if (data.plaintext !== undefined) safeData.plaintext = String(data.plaintext || '');
     if (data.ciphertext !== undefined) safeData.ciphertext = String(data.ciphertext);
+  } else if (type === 'SIDESTR_SIGN_TRANSACTION') {
+    // Shape only; the background checks both and the spend window checks the rest.
+    safeData.chain = typeof data.chain === 'string' ? data.chain : '';
+    safeData.tx = typeof data.tx === 'string' ? data.tx : '';
   }
 
   try {
@@ -159,7 +164,8 @@ window.addEventListener('podkey-request', async (event) => {
       window.dispatchEvent(new CustomEvent('podkey-response', {
         detail: {
           id,
-          error: response.error
+          error: response.error,
+          ...(typeof response.code === 'string' ? { code: response.code } : {})
         }
       }));
       return;
diff --git a/src/keyformat.js b/src/keyformat.js
index c37701e..fe0b153 100644
--- a/src/keyformat.js
+++ b/src/keyformat.js
@@ -162,6 +162,22 @@ export function hexToNsec (hex) {
   return bech32Encode('nsec', convertBits(bytes, 8, 5, true));
 }
 
+/**
+ * Encode a 64-char hex x-only public key as its NIP-19 `npub1…` form. The
+ * sidestr spend window shows a coin that pays `OP_1 <key>` as the Nostr
+ * identity it is, since that is how people know each other.
+ * @param {string} hex 64-char hex public key
+ * @returns {string} npub1… bech32 string
+ */
+export function hexToNpub (hex) {
+  if (typeof hex !== 'string' || !/^[0-9a-fA-F]{64}$/.test(hex)) {
+    throw new Error('Invalid key');
+  }
+  const bytes = [];
+  for (let i = 0; i < 64; i += 2) bytes.push(parseInt(hex.slice(i, i + 2), 16));
+  return bech32Encode('npub', convertBits(bytes, 8, 5, true));
+}
+
 /**
  * Normalise a pasted private key into canonical 64-char lowercase hex, accepting
  * either raw hex or an `nsec1…` bech32 key. The nsec form is converted inline so
diff --git a/src/nostr-provider.js b/src/nostr-provider.js
index 6cab005..93cfc27 100644
--- a/src/nostr-provider.js
+++ b/src/nostr-provider.js
@@ -94,25 +94,63 @@
           ciphertext
         });
       }
-    }
+    },
+
+    /**
+     * sidestr spends (sidestr/spec proposals/browser-signer.md). Podkey reads
+     * and validates the chain itself, shows the spend in its own window and
+     * asks every time; the page supplies only the chain id and the
+     * transaction. Rejections carry `code`: rejected, unsupported, not-yours,
+     * invalid or unavailable.
+     */
+    sidestr: Object.freeze({
+      version: 1,
+      // what a page calls this signer in its own copy ("Podkey will show you this spend")
+      name: 'Podkey',
+
+      /**
+       * @param {{chain: string, tx: string}} request - chain id and the
+       *   transaction as hex (any witness is ignored and replaced)
+       * @returns {Promise<{tx: string, txid: string}>} the signed transaction
+       */
+      signTransaction: async (request) => {
+        if (!request || typeof request !== 'object') {
+          throw Object.assign(new Error('signTransaction takes { chain, tx }'), { code: 'invalid' });
+        }
+        return sendMessageToExtension({
+          type: 'SIDESTR_SIGN_TRANSACTION',
+          chain: request.chain,
+          tx: request.tx
+        }, SPEND_TIMEOUT_MS);
+      }
+    })
   };
 
+  // A spend waits for Podkey to read the chain and for the person to decide,
+  // so it gets longer than the 30 seconds other requests do. Podkey's own
+  // window closes itself before this.
+  const SPEND_TIMEOUT_MS = 5 * 60 * 1000;
+
   /**
    * Send message to extension background script
    * @param {object} message - Message to send
    * @returns {Promise<any>} Response from extension
    */
-  async function sendMessageToExtension (message) {
+  async function sendMessageToExtension (message, timeoutMs = 30000) {
     return new Promise((resolve, reject) => {
       // Create custom event to communicate with content script
       const eventId = Math.random().toString(36).substring(7);
 
+      let timer = null;
       const handler = (event) => {
         if (event.detail.id === eventId) {
           window.removeEventListener('podkey-response', handler);
+          clearTimeout(timer);
 
           if (event.detail.error) {
-            reject(new Error(event.detail.error));
+            const error = new Error(event.detail.error);
+            if (event.detail.code) error.code = event.detail.code;
+            reject(error);
           } else {
             resolve(event.detail.result);
           }
@@ -129,11 +167,12 @@
         }
       }));
 
-      // Timeout after 30 seconds
-      setTimeout(() => {
+      // Cleared when the answer arrives, so a spend's five-minute wait does
+      // not outlive it.
+      timer = setTimeout(() => {
         window.removeEventListener('podkey-response', handler);
-        reject(new Error('Podkey request timeout'));
-      }, 30000);
+        reject(Object.assign(new Error('Podkey request timeout'), { code: 'unavailable' }));
+      }, timeoutMs);
     });
   }
 
diff --git a/src/sidestr/core.js b/src/sidestr/core.js
new file mode 100644
index 0000000..b184988
--- /dev/null
+++ b/src/sidestr/core.js
@@ -0,0 +1,253 @@
+/**
+ * Podkey - sidestr browser signer core (proposals/browser-signer.md in sidestr/spec)
+ *
+ * Everything the spend window decides, with no DOM and no chrome.* so Node can
+ * test it: open a chain from its id alone, read what the person's coins carry,
+ * review an unsigned transaction against the chain Podkey validated itself,
+ * and assemble the signed result. The page supplies only the chain id and the
+ * transaction; every coin, amount, asset and sighash here comes from Podkey's
+ * own reading of the chain.
+ *
+ * The engine is the one the sidestr explorer and wallet run, vendored under
+ * vendor/sidestr/ (scripts/vendor-sidestr.js): an extension may not load code
+ * from the network.
+ */
+
+import { hexToNpub } from '../keyformat.js';
+import { SpendError } from './request.js';
+
+export { CODES, SpendError, checkRequest, MAX_TX_HEX } from './request.js';
+
+/** A fee at or above this many sats, or above the sats a plain payment sends, is flagged. */
+export const LARGE_FEE = 5_000;
+
+/** The relays sidestr's wallet asks for tip announcements (SPEC 11). */
+export const RELAYS = ['wss://nos.lol', 'wss://relay.damus.io', 'wss://relay.primal.net', 'wss://nostr.mom', 'wss://nostr.oxtr.dev'];
+
+/**
+ * Load the vendored engine. `base` is the vendor/sidestr/ directory as a URL
+ * (the extension's own files in the spend window, file: URLs in tests).
+ */
+export async function loadLib (base = new URL('../../vendor/sidestr/', import.meta.url)) {
+  const at = (p) => new URL(p, base).href;
+  const [explorer, announce, txsign, records, assets, parents, nostr, secp] = await Promise.all([
+    import(at('explorer/explorer.mjs')),
+    import(at('spec/siding/lib/announce.mjs')),
+    import(at('spec/siding/lib/txsign.mjs')),
+    import(at('spec/siding/lib/records.mjs')),
+    import(at('spec/siding/lib/overlays/assets.mjs')),
+    import(at('spec/siding/lib/parents.mjs')),
+    import(at('schema/codec/nostr.js')),
+    import(at('schema/codec/secp256k1.js'))
+  ]);
+  return { explorer, announce, txsign, records, assets, parents, nostr, secp };
+}
+
+/**
+ * Open a chain from its id, as SPEC 11 says, and validate every block.
+ *
+ * `pinned` is the signer Podkey settled on the first time this person spent on
+ * this chain, or null. A chain id is a name, not a proof: with a pin only that
+ * signer's announcements count, and an announcement for the same id by anyone
+ * else is refused rather than followed.
+ *
+ * @returns {Promise<{ex, signer, announced, mirror, parent, mirrorNote}>}
+ */
+export async function openChain ({ lib, chainId, pinned = null, relays = RELAYS, fetchJson, loadJson, onProgress = () => {} }) {
+  const { announce, explorer, parents, nostr } = lib;
+  const verify = nostr.verifyNostrEvent;
+  onProgress(`Asking ${relays.length} relays where ${chainId} is`);
+  let found;
+  try {
+    found = await announce.findChain({ relays, chainId, verify, signer: pinned ?? undefined, ...(fetchJson ? { fetchJson } : {}) });
+  } catch (e) {
+    if (pinned) {
+      // nothing from the pinned signer: say so plainly if someone else now announces this id
+      let other = null;
+      try { other = await announce.fetchLatestTip({ relays, chainId, verify }); } catch { /* no other announcement either */ }
+      if (other && other.pubkey !== pinned) {
+        throw new SpendError('unsupported', `${chainId} is now announced by a different signer (${other.pubkey.slice(0, 12)}…) than the one you first spent with (${pinned.slice(0, 12)}…). Podkey will not follow it.`);
+      }
+    }
+    throw new SpendError('unavailable', `Could not find ${chainId}: ${e.message}`);
+  }
+  let parent;
+  try { parent = parents.resolveParent(found.chain.parent); } catch (e) { throw new SpendError('unsupported', e.message); }
+  if (parent.mainnet) throw new SpendError('unsupported', `${chainId} sits beside ${parent.label}. Podkey signs only for chains beside test networks for now.`);
+
+  onProgress(`Checking every block of ${chainId}`);
+  const ex = new explorer.Explorer(found.mirror, loadJson ? { loadJson } : {});
+  try {
+    await ex.open();
+  } catch (e) {
+    if (e.code === 'unsupported' || /names rule|rule needs/.test(e.message)) throw new SpendError('unsupported', e.message);
+    throw new SpendError('unavailable', `Could not read ${chainId} from ${found.mirror}: ${e.message}`);
+  }
+  if (ex.chain.id !== chainId || ex.chain.signer !== found.tip.pubkey) {
+    throw new SpendError('unavailable', `The mirror ${found.mirror} does not serve ${chainId} as its signer announced it.`);
+  }
+  const bad = ex.blocks.find((b) => b && b.verdict && b.verdict.ok === false);
+  if (bad) throw new SpendError('unavailable', `Block ${bad.height} of ${chainId} failed validation; Podkey will not sign against it.`);
+  const tip = ex.tip();
+  const judged = announce.judgeMirror({ announced: found.tip, height: tip.height, headerHex: ex.headerHex(tip.height) });
+  if (judged.ok === false) throw new SpendError('unavailable', `The mirror contradicts ${chainId}'s signer: ${judged.note}`);
+  return { ex, signer: found.tip.pubkey, announced: found.tip, mirror: found.mirror, parent, mirrorNote: judged.note };
+}
+
+const outpoint = (inp) => `${inp.prevout.txid}:${inp.prevout.vout}`;
+
+/**
+ * What each unspent output carries (SPEC 12). On a chain that names the
+ * `assets` rule this is the rule's own state. On one that names no rules it is
+ * the holders' reading of the same records: a transaction that breaks the rule
+ * keeps its spends and carries nothing, so what it tried to move is destroyed
+ * (the view sidestr-core's AssetView takes, so the two agree).
+ */
+export function assetView (ex, lib) {
+  const { assets } = lib;
+  if (ex.rules?.assets) {
+    const r = ex.rules.assets;
+    return { mode: 'rule', carried: r.carried, issued: r.issued, check: r.check, CarryView: assets.CarryView };
+  }
+  const ov = assets.assetsOverlay(ex.chain);
+  for (let h = 0; h < ex.blocks.length; h++) {
+    const b = ex.blocks[h];
+    if (!b?.block) throw new SpendError('unavailable', `Block ${h} is not in memory; the asset view needs every block.`);
+    const view = new assets.CarryView(ov.carried);
+    b.block.transactions.forEach((tx, i) => {
+      if (i === 0) return; // a coinbase carries nothing
+      const txid = b.txids[i];
+      const r = ov.check(tx, txid, view);
+      if (!r.ok) { for (const inp of tx.inputs) view.spend(outpoint(inp)); return; }
+      if (r.issue) ov.issued.set(txid, { ticker: r.issue.ticker, decimals: r.issue.decimals, height: h });
+    });
+    for (const [k, v] of view.temp) if (!view.spent.has(k)) ov.carried.set(k, v);
+    for (const k of view.spent.keys()) ov.carried.delete(k);
+  }
+  return { mode: 'view', carried: ov.carried, issued: ov.issued, check: ov.check, CarryView: assets.CarryView };
+}
+
+const addAll = (into, from) => { for (const [a, n] of from ?? []) into.set(a, (into.get(a) ?? 0) + n); return into; };
+
+/** An asset amount in its own units, e.g. 1.50 for 150 at 2 decimals. */
+export function formatAsset (amount, decimals = 0) {
+  if (!decimals) return amount.toLocaleString('en-GB');
+  const s = String(amount).padStart(decimals + 1, '0');
+  const whole = Number(s.slice(0, -decimals)).toLocaleString('en-GB');
+  return `${whole}.${s.slice(-decimals)}`;
+}
+
+/**
+ * Review an unsigned transaction for `pub` against the validated chain.
+ *
+ * Refuses (`not-yours`) any input that is not an unspent, mature coin in
+ * Podkey's own set paying `5120‖pub`, and (`invalid`) anything it cannot read
+ * or that the chain's own asset rule would refuse. Returns what the window
+ * shows and the sighashes to sign, computed here from Podkey's own prevouts.
+ */
+export function review ({ ex, lib, view, pub, txHex }) {
+  const { txsign, records, explorer } = lib;
+  const k = ex.k;
+  if (!/^[0-9a-f]{64}$/.test(pub)) throw new SpendError('unavailable', 'No public key');
+  const me = `5120${pub}`;
+  let tx;
+  try { tx = k.codec.decode('Transaction', txHex); } catch (e) { throw new SpendError('invalid', `Not a transaction: ${e.message}`); }
+  if (!tx?.inputs?.length || !tx?.outputs?.length) throw new SpendError('invalid', 'A transaction needs inputs and outputs');
+  tx.witness = []; // any witness the page sent is ignored and replaced
+  const txid = k.codec.txid(tx);
+
+  const tip = ex.tip().height; const maturity = k.params.coinbaseMaturity;
+  const seen = new Set(); const coins = [];
+  for (const inp of tx.inputs) {
+    const key = outpoint(inp);
+    if (seen.has(key)) throw new SpendError('invalid', `Input ${key.slice(0, 12)}… is spent twice`);
+    seen.add(key);
+    const c = ex.utxo.get(key);
+    if (!c) throw new SpendError('not-yours', `Input ${key.slice(0, 12)}… is not an unspent coin on ${ex.chain.id} (spent, unconfirmed or never made)`);
+    if (c.output.scriptPubKey !== me) throw new SpendError('not-yours', `Input ${key.slice(0, 12)}… is not your coin`);
+    if (c.coinbase && tip + 1 - c.height < maturity) throw new SpendError('not-yours', `Input ${key.slice(0, 12)}… is a block reward that is not mature yet`);
+    coins.push({ key, value: c.output.value, carries: view.carried.get(key) ?? null });
+  }
+  const prevouts = coins.map((c) => ({ value: c.value, scriptPubKey: me }));
+  const inSum = coins.reduce((s, c) => s + c.value, 0);
+  const outSum = tx.outputs.reduce((s, o) => s + o.value, 0);
+  const fee = inSum - outSum;
+  if (fee < 0) throw new SpendError('invalid', 'The outputs spend more than the inputs hold');
+
+  // assets: what the inputs carry, what the tallies assign, and what is destroyed
+  const r = view.check(tx, txid, new view.CarryView(view.carried));
+  const inCarry = new Map(); for (const c of coins) addAll(inCarry, c.carries);
+  if (!r.ok && view.mode === 'rule') throw new SpendError('invalid', `${ex.chain.id} would refuse this transaction: ${r.error}`);
+  const assigned = new Map(); if (r.ok) for (const m of r.out.values()) addAll(assigned, m);
+  const destroyed = [];
+  for (const [asset, n] of inCarry) { const left = n - (assigned.get(asset) ?? 0); if (left > 0) destroyed.push({ asset, amount: left }); }
+  const label = (asset) => {
+    const i = view.issued.get(asset) ?? (r.ok && r.issue && asset === txid ? r.issue : null);
+    return { asset, ticker: i?.ticker ?? `${asset.slice(0, 8)}…`, decimals: i?.decimals ?? 0 };
+  };
+
+  const hrp = ex.chain.addressPrefix;
+  const outputs = tx.outputs.map((o, vout) => {
+    const spk = o.scriptPubKey; const carries = r.ok ? (r.out.get(vout) ?? null) : null;
+    const assetsOut = carries ? [...carries].map(([asset, amount]) => ({ ...label(asset), amount })) : [];
+    const base = { vout, value: o.value, script: spk, assets: assetsOut };
+    if (spk === me) return { ...base, kind: 'change' };
+    if (spk.startsWith('6a')) {
+      const text = records.recordText(spk);
+      if (text?.startsWith('pegout:')) return { ...base, kind: 'pegout', text, to: text.slice(7) };
+      if (text && /^(issue|tally|pool):/.test(text)) return { ...base, kind: 'asset-record', text };
+      return { ...base, kind: o.value > 0 ? 'burn' : 'record', text };
+    }
+    const key = /^5120([0-9a-f]{64})$/.exec(spk);
+    const address = explorer.scriptToAddress(spk, hrp);
+    if (key) return { ...base, kind: 'key', pubkey: key[1], npub: hexToNpub(key[1]), address };
+    return { ...base, kind: 'script', address };
+  });
+
+  const toOthers = outputs.filter((o) => o.kind === 'key' || o.kind === 'script').reduce((s, o) => s + o.value, 0);
+  const warnings = [];
+  for (const d of destroyed) {
+    const l = label(d.asset);
+    warnings.push({ kind: 'destroys', text: `This destroys ${formatAsset(d.amount, l.decimals)} ${l.ticker} that your coins carry.`, ...l, amount: d.amount });
+  }
+  if (!r.ok) warnings.push({ kind: 'breaks', text: `This breaks the asset rule (${r.error}), so everything your coins carry is destroyed.` });
+  for (const o of outputs) {
+    if (o.kind === 'burn') warnings.push({ kind: 'burn', text: `Output ${o.vout} burns ${o.value.toLocaleString('en-GB')} sats for good.` });
+    if (o.kind === 'pegout') warnings.push({ kind: 'pegout', text: `Output ${o.vout} is a peg-out: ${o.value.toLocaleString('en-GB')} sats burn here and are owed on the parent chain.` });
+  }
+  // Against the sats sent only when no asset goes with them: an asset rides on a
+  // few hundred sats of carrier, and a normal fee is not "more than it sends".
+  const sendsAssets = outputs.some((o) => (o.kind === 'key' || o.kind === 'script') && o.assets.length);
+  if (fee >= LARGE_FEE || (!sendsAssets && toOthers > 0 && fee > toOthers)) warnings.push({ kind: 'fee', text: `The fee is ${fee.toLocaleString('en-GB')} sats${toOthers > 0 ? `, more than the ${toOthers.toLocaleString('en-GB')} sats this sends` : ''}.` });
+
+  const sighashes = tx.inputs.map((_, i) => {
+    const { m, ht } = txsign.keyPathSighash({ k, hash: ex.hash }, tx, i, prevouts);
+    return { digest: ex.hash.bytesToHex(m), ht };
+  });
+
+  return {
+    tx, txid, prevouts, fee, inSum, outSum, toOthers,
+    inputs: coins.map((c) => ({ ...c, carries: c.carries ? [...c.carries].map(([asset, amount]) => ({ ...label(asset), amount })) : [] })),
+    outputs, destroyed, warnings, sighashes,
+    assetMode: view.mode
+  };
+}
+
+/**
+ * Put the signatures on and check them as a validator would. `signatures` are
+ * 64-byte BIP 340 signatures as hex, one per input, over the review's digests.
+ * @returns {{ tx: string, txid: string }}
+ */
+export function finish ({ ex, lib, reviewed, signatures, pub }) {
+  const { txsign } = lib; const k = ex.k;
+  if (!Array.isArray(signatures) || signatures.length !== reviewed.sighashes.length || !signatures.every((s) => /^[0-9a-f]{128}$/.test(s))) {
+    throw new SpendError('unavailable', 'The key did not return one signature per input');
+  }
+  const tx = { ...reviewed.tx, witness: signatures.map((s, i) => [s + reviewed.sighashes[i].ht.toString(16).padStart(2, '0')]) };
+  if (!txsign.verifyKeyPath({ k, hash: ex.hash, secp: lib.secp }, tx, reviewed.prevouts, pub)) {
+    throw new SpendError('unavailable', 'A signature did not verify; nothing was returned');
+  }
+  const txid = k.codec.txid(tx);
+  if (txid !== reviewed.txid) throw new SpendError('unavailable', 'Signing changed the transaction id; nothing was returned');
+  return { tx: k.codec.encodeHex('Transaction', tx), txid };
+}
diff --git a/src/sidestr/request.js b/src/sidestr/request.js
new file mode 100644
index 0000000..6ca2dc8
--- /dev/null
+++ b/src/sidestr/request.js
@@ -0,0 +1,33 @@
+/**
+ * Podkey - the shape of a sidestr spend request (sidestr/spec proposals/browser-signer.md)
+ *
+ * Shared by the background service worker, which checks a page's request
+ * before opening the spend window, and by the window itself. No imports, so
+ * the service worker bundle stays free of the chain engine.
+ */
+
+/** Error codes the page sees, per the proposal. */
+export const CODES = ['rejected', 'unsupported', 'not-yours', 'invalid', 'unavailable'];
+
+/** An error with one of CODES, for the page. */
+export class SpendError extends Error {
+  constructor (code, message) {
+    super(message);
+    this.name = 'SpendError';
+    this.code = CODES.includes(code) ? code : 'unavailable';
+  }
+}
+
+const CHAIN_ID = /^sidestr:[a-z0-9][a-z0-9._-]{0,63}$/;
+const HEX = /^(?:[0-9a-f]{2})+$/;
+/** The largest transaction a page may ask about, in hex characters (200 kB). */
+export const MAX_TX_HEX = 400_000;
+
+/** Check a request's shape before anything is fetched. Throws a SpendError. */
+export function checkRequest ({ chain, tx } = {}) {
+  if (typeof chain !== 'string' || !CHAIN_ID.test(chain)) throw new SpendError('invalid', 'chain must be a sidestr chain id, such as sidestr:dreamlab');
+  if (typeof tx !== 'string') throw new SpendError('invalid', 'tx must be the transaction as hex');
+  const hex = tx.trim().toLowerCase();
+  if (!hex || hex.length > MAX_TX_HEX || !HEX.test(hex)) throw new SpendError('invalid', 'tx must be the transaction as hex, at most 200 kB');
+  return { chain, tx: hex };
+}
diff --git a/src/sidestr/spends.js b/src/sidestr/spends.js
new file mode 100644
index 0000000..05e136e
--- /dev/null
+++ b/src/sidestr/spends.js
@@ -0,0 +1,86 @@
+/**
+ * Podkey - the life of one sidestr spend request, in the background
+ *
+ * A page asks (SIDESTR_SIGN_TRANSACTION). The background checks the request's
+ * shape, makes sure the key is unlocked, and opens the spend window
+ * (popup/spend.html), which reads and validates the chain, reviews the
+ * transaction and shows it. The window asks for the request
+ * (SIDESTR_REQUEST), for signatures over the sighashes it computed
+ * (SIDESTR_SIGN_DIGESTS, once) and reports the outcome (SIDESTR_DONE). The
+ * key never leaves the background; the window never sees it.
+ *
+ * Every spend opens the window: trust given to an origin for events does not
+ * extend to spends. Closing the window rejects; so does silence.
+ *
+ * Dependencies are passed in so Node can test this without chrome.*.
+ */
+
+import { SpendError, checkRequest } from './request.js';
+
+/** The window closes itself with a rejection after this long. */
+export const SPEND_WINDOW_MS = 4 * 60 * 1000;
+/** At most this many inputs are signed in one request. */
+export const MAX_INPUTS = 500;
+
+export function createSpends ({ ensureUnlocked, getKeypair, signSighashes, openWindow, now = () => Date.now(), setTimer = setTimeout, clearTimer = clearTimeout, randomId = () => crypto.randomUUID() }) {
+  const pending = new Map(); // id -> { origin, chain, tx, pub, windowId, signed, settle }
+
+  function settle (id, outcome) {
+    const p = pending.get(id); if (!p) return false;
+    pending.delete(id); clearTimer(p.timer); p.settle(outcome); return true;
+  }
+
+  /** From a page, via the content script. Resolves { tx, txid } or rejects with a SpendError. */
+  async function request ({ chain, tx }, origin) {
+    const req = checkRequest({ chain, tx });
+    if (typeof origin !== 'string' || !origin) throw new SpendError('invalid', 'No origin for this request');
+    try { await ensureUnlocked(); } catch (e) { throw new SpendError('unavailable', e.message); }
+    const keypair = await getKeypair();
+    if (!keypair || !/^[0-9a-f]{64}$/.test(keypair.publicKey ?? '')) throw new SpendError('unavailable', 'No key in Podkey');
+    const id = randomId();
+    return new Promise((resolve, reject) => {
+      const entry = {
+        origin, chain: req.chain, tx: req.tx, pub: keypair.publicKey, windowId: null, signed: false, opened: now(),
+        settle: (o) => (o.error ? reject(o.error) : resolve(o.result))
+      };
+      entry.timer = setTimer(() => settle(id, { error: new SpendError('rejected', 'The spend window timed out') }), SPEND_WINDOW_MS + 15_000);
+      pending.set(id, entry);
+      Promise.resolve(openWindow(id)).then((windowId) => { if (pending.has(id)) entry.windowId = windowId ?? null; })
+        .catch((e) => settle(id, { error: new SpendError('unavailable', `Could not open the spend window: ${e.message}`) }));
+    });
+  }
+
+  /** From the spend window: what it is to review. */
+  function describe (id) {
+    const p = pending.get(id); if (!p) throw new SpendError('unavailable', 'This spend request is no longer open');
+    return { origin: p.origin, chain: p.chain, tx: p.tx, pub: p.pub, expiresAt: p.opened + SPEND_WINDOW_MS };
+  }
+
+  /** From the spend window, after the person confirmed: sign its sighashes, once. */
+  async function signDigests (id, digests) {
+    const p = pending.get(id); if (!p) throw new SpendError('unavailable', 'This spend request is no longer open');
+    if (p.signed) throw new SpendError('invalid', 'This spend has already been signed');
+    if (!Array.isArray(digests) || digests.length < 1 || digests.length > MAX_INPUTS) throw new SpendError('invalid', 'One sighash per input');
+    p.signed = true;
+    const keypair = await getKeypair();
+    if (!keypair || keypair.publicKey !== p.pub) throw new SpendError('unavailable', 'The key changed while the spend was open');
+    return { signatures: signSighashes(digests, keypair.privateKey) };
+  }
+
+  /** From the spend window: the outcome. `result` is { tx, txid }; `error` is { code, message }. */
+  function done (id, { result, error } = {}) {
+    if (result && typeof result.tx === 'string' && /^[0-9a-f]{64}$/.test(result.txid ?? '')) {
+      const p = pending.get(id);
+      if (!p?.signed) return settle(id, { error: new SpendError('unavailable', 'A result arrived for a spend that was never signed') });
+      return settle(id, { result: { tx: result.tx, txid: result.txid } });
+    }
+    return settle(id, { error: new SpendError(error?.code ?? 'rejected', error?.message ?? 'You rejected the spend') });
+  }
+
+  /** A window closed: a spend still open in it is rejected. */
+  function windowClosed (windowId) {
+    for (const [id, p] of pending) if (p.windowId !== null && p.windowId === windowId) settle(id, { error: new SpendError('rejected', 'The spend window was closed') });
+  }
+
+  return { request, describe, signDigests, done, windowClosed, pending };
+}
diff --git a/test/content-whitelist.test.js b/test/content-whitelist.test.js
index 229b680..5238b7b 100644
--- a/test/content-whitelist.test.js
+++ b/test/content-whitelist.test.js
@@ -39,6 +39,7 @@ before(async () => {
         forwarded.push(message);
         if (message.type === 'GET_PUBLIC_KEY') return 'a'.repeat(64);
         if (message.type === 'SIGN_EVENT') return { ...message.event, id: 'i'.repeat(64), sig: 's'.repeat(128) };
+        if (message.type === 'SIDESTR_SIGN_TRANSACTION' && message.tx === 'refuse') return { error: 'Input is not your coin', code: 'not-yours' };
         return 'OK';
       },
       lastError: null
@@ -139,4 +140,29 @@ describe('content-script field stripping (only safe fields forwarded)', () => {
     assert.equal(typeof msg.pubkey, 'string');
     assert.equal(typeof msg.plaintext, 'string');
   });
+
+  it('SIDESTR_SIGN_TRANSACTION forwards only chain + tx (as strings) + origin', async () => {
+    await request({ type: 'SIDESTR_SIGN_TRANSACTION', chain: 'sidestr:dreamlab', tx: '0200', digests: ['aa'], pub: 'x' });
+    const msg = forwarded[0];
+    assert.deepEqual(Object.keys(msg).sort(), ['chain', 'origin', 'tx', 'type']);
+    assert.equal(msg.chain, 'sidestr:dreamlab');
+    assert.equal(msg.tx, '0200');
+    await request({ type: 'SIDESTR_SIGN_TRANSACTION', chain: { evil: 1 }, tx: 7 });
+    assert.equal(forwarded[1].chain, '');
+    assert.equal(forwarded[1].tx, '');
+  });
+
+  it('passes a refusal code back to the page', async () => {
+    const res = await request({ type: 'SIDESTR_SIGN_TRANSACTION', chain: 'sidestr:dreamlab', tx: 'refuse' });
+    assert.equal(res.error, 'Input is not your coin');
+    assert.equal(res.code, 'not-yours');
+  });
+
+  it('never forwards the spend window\'s own message types from a page', async () => {
+    for (const type of ['SIDESTR_REQUEST', 'SIDESTR_SIGN_DIGESTS', 'SIDESTR_DONE', 'SIDESTR_KEEPALIVE']) {
+      const res = await request({ type, digests: ['00'.repeat(32)] });
+      assert.equal(res.error, 'Unknown request type');
+    }
+    assert.equal(forwarded.length, 0);
+  });
 });
diff --git a/test/fixtures/sidestr-dreamlab.chain.json b/test/fixtures/sidestr-dreamlab.chain.json
new file mode 100644
index 0000000..a8c17e2
--- /dev/null
+++ b/test/fixtures/sidestr-dreamlab.chain.json
@@ -0,0 +1 @@
+{"id":"sidestr:dreamlab","name":"dreamlab","parent":"tbtc4","comment":"DreamLab root chain (agentbox PRD-024, ADR-2101, ADR-2103), made 2026-09-22 beside Bitcoin testnet4 on the estate's own node. Research stage: level 1, one signer, depth 0. Coins carry no value. Mainnet parents are behind the P21 owner-and-legal gate.","challenge":"51207092810a05359b29acfa1f884d0e1a8e0290309e1133198b0f059447a4c76d62","powLimit":"7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff","addressPrefix":"drm","magic":"d981eab1","pegConfirmations":6,"refundBlocks":10000,"pegoutBlocks":144,"pegoutMin":10000,"minFeeRate":1,"genesisTime":1790076686,"pegs":[],"signer":"7092810a05359b29acfa1f884d0e1a8e0290309e1133198b0f059447a4c76d62","genesisHash":"4db37517728bd509c0cb96ee5a2e3e2a77f9e965a092e9f67948b413d453dbc0","depth":0,"containment":{"parent":"tbtc4","currencyPin":"tbtc","cashOut":false,"pegConfirmations":6,"refundBlocks":10000,"protocolProfile":"sidestr/0.0.2"},"containmentDigest":"sha256:3b7c0af3e96b26bbad83cbb093f9783b10e181343df5f438d7f3d618aa81cef5"}
\ No newline at end of file
diff --git a/test/keyformat.test.js b/test/keyformat.test.js
index da5bbb7..084d725 100644
--- a/test/keyformat.test.js
+++ b/test/keyformat.test.js
@@ -69,3 +69,13 @@ test('hexToNsec rejects non-hex and wrong-length input', () => {
   assert.throws(() => hexToNsec('zz' + HEX.slice(2)), /Invalid key/);
   assert.throws(() => hexToNsec(null), /Invalid key/);
 });
+
+test('hexToNpub encodes the NIP-19 test vector', async () => {
+  const { hexToNpub } = await import('../src/keyformat.js');
+  assert.equal(hexToNpub('3bf0c63fcb93463407af97a5e5ee64fa883d107ef9e558472c4eb9aaaefa459d'), 'npub180cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsyjh6w6');
+});
+
+test('hexToNpub refuses anything but 64 hex characters', async () => {
+  const { hexToNpub } = await import('../src/keyformat.js');
+  assert.throws(() => hexToNpub('xyz'), /Invalid key/);
+});
diff --git a/test/provider-surface.test.js b/test/provider-surface.test.js
index dd307b6..9862346 100644
--- a/test/provider-surface.test.js
+++ b/test/provider-surface.test.js
@@ -3,7 +3,8 @@
  *
  * The provider must advertise ONLY what it implements, so that page-side
  * feature-detection is truthful:
- *   - exposes getPublicKey, signEvent, nip44.{encrypt,decrypt}
+ *   - exposes getPublicKey, signEvent, nip44.{encrypt,decrypt}, and
+ *     sidestr.signTransaction (sidestr/spec proposals/browser-signer.md)
  *   - does NOT expose nip04 (deprecated, unauthenticated; not shipped)
  *   - does NOT expose getRelays (Podkey holds no relay list)
  *
@@ -30,8 +31,16 @@ before(async () => {
 });
 
 describe('provider surface (honest feature-detection)', () => {
-  it('exposes exactly getPublicKey, signEvent and nip44', () => {
-    assert.deepEqual(Object.keys(nostr).sort(), ['getPublicKey', 'nip44', 'signEvent']);
+  it('exposes exactly getPublicKey, signEvent, nip44 and sidestr', () => {
+    assert.deepEqual(Object.keys(nostr).sort(), ['getPublicKey', 'nip44', 'sidestr', 'signEvent']);
+  });
+
+  it('sidestr is frozen, version 1, named, and offers only signTransaction', () => {
+    assert.equal(Object.isFrozen(nostr.sidestr), true);
+    assert.equal(nostr.sidestr.version, 1);
+    assert.equal(nostr.sidestr.name, 'Podkey');
+    assert.deepEqual(Object.keys(nostr.sidestr).sort(), ['name', 'signTransaction', 'version']);
+    assert.equal(typeof nostr.sidestr.signTransaction, 'function');
   });
 
   it('exposes nip44.encrypt and nip44.decrypt as functions', () => {
@@ -143,6 +152,34 @@ describe('provider request wiring (podkey-request CustomEvent)', () => {
     assert.equal(await resP, 'plaintext-out');
   });
 
+  it('sidestr.signTransaction dispatches SIDESTR_SIGN_TRANSACTION with chain + tx only', async () => {
+    const reqP = captureRequest(() => ({ tx: 'ab', txid: 'c'.repeat(64) }));
+    const resP = nostr.sidestr.signTransaction({ chain: 'sidestr:dreamlab', tx: '0200', extra: 'dropped' });
+    const req = await reqP;
+    assert.equal(req.type, 'SIDESTR_SIGN_TRANSACTION');
+    assert.equal(req.chain, 'sidestr:dreamlab');
+    assert.equal(req.tx, '0200');
+    assert.equal('extra' in req, false);
+    assert.deepEqual(await resP, { tx: 'ab', txid: 'c'.repeat(64) });
+  });
+
+  it('sidestr.signTransaction rejects a non-object request with code invalid', async () => {
+    await assert.rejects(() => nostr.sidestr.signTransaction(null), (e) => e.code === 'invalid');
+  });
+
+  it('a refused spend reaches the page with its code', async () => {
+    const handler = (e) => {
+      global.window.removeEventListener('podkey-request', handler);
+      queueMicrotask(() => {
+        global.window.dispatchEvent(new CustomEvent('podkey-response', {
+          detail: { id: e.detail.id, error: 'You rejected the spend', code: 'rejected' }
+        }));
+      });
+    };
+    global.window.addEventListener('podkey-request', handler);
+    await assert.rejects(() => nostr.sidestr.signTransaction({ chain: 'sidestr:x', tx: '00' }), (e) => e.code === 'rejected' && /rejected the spend/.test(e.message));
+  });
+
   it('propagates a background error back to the caller as a rejection', async () => {
     const handler = (e) => {
       global.window.removeEventListener('podkey-request', handler);
diff --git a/test/sidestr-core.test.js b/test/sidestr-core.test.js
new file mode 100644
index 0000000..f57cc24
--- /dev/null
+++ b/test/sidestr-core.test.js
@@ -0,0 +1,188 @@
+/**
+ * Tests for the sidestr spend window's core (src/sidestr/core.js), offline,
+ * against the real vendored engine: the kernel decodes and hashes, the spec
+ * lib computes BIP 341 sighashes and checks signatures, and the assets rule
+ * reads records. Only the chain's block history is synthetic.
+ *
+ * What is proved: a spend of the person's own coins reviews, signs through
+ * Podkey's own signing path, and verifies as a validator would; anything else
+ * is refused with the proposal's codes; a transaction that would destroy an
+ * asset its inputs carry says so.
+ */
+
+import { describe, it, before } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import * as secp256k1 from '@noble/secp256k1';
+import * as core from '../src/sidestr/core.js';
+import { signSighashes, getPublicKey } from '../src/crypto.js';
+
+const loadJson = async (u) => JSON.parse(await readFile(new URL(u), 'utf8'));
+const chain = JSON.parse(await readFile(new URL('./fixtures/sidestr-dreamlab.chain.json', import.meta.url), 'utf8'));
+
+let lib, engine;
+const hex = (b) => Buffer.from(b).toString('hex');
+const secret = hex(secp256k1.utils.randomSecretKey());
+const pub = getPublicKey(secret);
+const me = `5120${pub}`;
+const stranger = `5120${'ab'.repeat(32)}`;
+
+/** A fake explorer: the real kernel over a synthetic, already-validated history. */
+function makeEx ({ utxo = [], blocks = [], height = 200, rules = { overlays: [], assets: null } } = {}) {
+  return {
+    k: engine.k, hash: engine.hash, chain, rules,
+    utxo: new Map(utxo),
+    blocks,
+    tip: () => ({ height })
+  };
+}
+const coin = (value, script = me, { height = 10, coinbase = false } = {}) => ({ output: { value, scriptPubKey: script }, height, coinbase, outpoint: {} });
+const input = (txid, vout = 0) => ({ prevout: { txid, vout }, scriptSig: '', sequence: 0xfffffffd });
+const T = (n) => String(n).repeat(64).slice(0, 64);
+const encode = (tx) => engine.k.codec.encodeHex('Transaction', { version: 2, lockTime: 0, witness: [], ...tx });
+const emptyView = () => core.assetView(makeEx(), lib);
+
+before(async () => {
+  lib = await core.loadLib();
+  engine = await lib.explorer.loadEngine(chain, { loadJson });
+});
+
+describe('checkRequest', () => {
+  it('takes a chain id and hex, lower-casing the hex', () => {
+    assert.deepEqual(core.checkRequest({ chain: 'sidestr:dreamlab', tx: 'AB00' }), { chain: 'sidestr:dreamlab', tx: 'ab00' });
+  });
+  it('refuses a bad chain id, odd or non-hex tx, and oversized tx as invalid', () => {
+    for (const bad of [{ chain: 'dreamlab', tx: '00' }, { chain: 'sidestr:', tx: '00' }, { chain: 'sidestr:x', tx: '0' }, { chain: 'sidestr:x', tx: 'zz' }, { chain: 'sidestr:x', tx: '00'.repeat(core.MAX_TX_HEX) }, {}]) {
+      assert.throws(() => core.checkRequest(bad), (e) => e.code === 'invalid');
+    }
+  });
+});
+
+describe('review and finish: the whole signing path', () => {
+  it('reviews a spend of your own coin, signs it with Podkey\'s key, and it verifies', () => {
+    const ex = makeEx({ utxo: [[`${T(1)}:0`, coin(10_000)]] });
+    const txHex = encode({ inputs: [input(T(1))], outputs: [{ value: 3_000, scriptPubKey: stranger }, { value: 6_800, scriptPubKey: me }] });
+    const r = core.review({ ex, lib, view: emptyView(), pub, txHex });
+    assert.equal(r.fee, 200);
+    assert.deepEqual(r.outputs.map((o) => o.kind), ['key', 'change']);
+    assert.match(r.outputs[0].npub, /^npub1/);
+    assert.equal(r.toOthers, 3_000);
+    assert.equal(r.warnings.length, 0);
+    assert.equal(r.sighashes.length, 1);
+    assert.equal(r.sighashes[0].ht, 0x01, 'beside stock Bitcoin: BIP 341, SIGHASH_ALL');
+
+    const signatures = signSighashes(r.sighashes.map((s) => s.digest), secret);
+    const out = core.finish({ ex, lib, reviewed: r, signatures, pub });
+    assert.equal(out.txid, r.txid, 'a witness does not change the txid');
+    const signed = engine.k.codec.decode('Transaction', out.tx);
+    assert.equal(signed.witness[0][0].length, 130, '64-byte signature plus the hash type');
+    // an independent implementation (the engine's own secp256k1) agrees
+    assert.equal(lib.txsign.verifyKeyPath({ k: engine.k, hash: engine.hash, secp: lib.secp }, signed, r.prevouts, pub), true);
+  });
+
+  it('replaces any witness the page sent', () => {
+    const ex = makeEx({ utxo: [[`${T(1)}:0`, coin(10_000)]] });
+    const txHex = encode({ inputs: [input(T(1))], outputs: [{ value: 9_000, scriptPubKey: stranger }], witness: [['ff'.repeat(65)]] });
+    const r = core.review({ ex, lib, view: emptyView(), pub, txHex });
+    assert.deepEqual(r.tx.witness, []);
+  });
+
+  it('refuses a signature that is not over the reviewed sighash', () => {
+    const ex = makeEx({ utxo: [[`${T(1)}:0`, coin(10_000)]] });
+    const r = core.review({ ex, lib, view: emptyView(), pub, txHex: encode({ inputs: [input(T(1))], outputs: [{ value: 9_000, scriptPubKey: stranger }] }) });
+    const wrong = signSighashes(['00'.repeat(32)], secret);
+    assert.throws(() => core.finish({ ex, lib, reviewed: r, signatures: wrong, pub }), /did not verify/);
+    assert.throws(() => core.finish({ ex, lib, reviewed: r, signatures: [], pub }), /one signature per input/);
+  });
+});
+
+describe('review refuses what is not yours', () => {
+  const view = () => emptyView();
+  it('a coin paying someone else', () => {
+    const ex = makeEx({ utxo: [[`${T(1)}:0`, coin(10_000, stranger)]] });
+    assert.throws(() => core.review({ ex, lib, view: view(), pub, txHex: encode({ inputs: [input(T(1))], outputs: [{ value: 9_000, scriptPubKey: me }] }) }), (e) => e.code === 'not-yours');
+  });
+  it('a coin Podkey cannot see (spent, unconfirmed or invented)', () => {
+    const ex = makeEx();
+    assert.throws(() => core.review({ ex, lib, view: view(), pub, txHex: encode({ inputs: [input(T(2))], outputs: [{ value: 1, scriptPubKey: me }] }) }), (e) => e.code === 'not-yours');
+  });
+  it('an immature block reward', () => {
+    const ex = makeEx({ utxo: [[`${T(1)}:0`, coin(10_000, me, { height: 150, coinbase: true })]], height: 200 });
+    assert.throws(() => core.review({ ex, lib, view: view(), pub, txHex: encode({ inputs: [input(T(1))], outputs: [{ value: 9_000, scriptPubKey: me }] }) }), (e) => e.code === 'not-yours' && /not mature/.test(e.message));
+  });
+  it('the same coin twice, outputs over inputs, and junk as invalid', () => {
+    const ex = makeEx({ utxo: [[`${T(1)}:0`, coin(10_000)]] });
+    assert.throws(() => core.review({ ex, lib, view: view(), pub, txHex: encode({ inputs: [input(T(1)), input(T(1))], outputs: [{ value: 1, scriptPubKey: me }] }) }), (e) => e.code === 'invalid');
+    assert.throws(() => core.review({ ex, lib, view: view(), pub, txHex: encode({ inputs: [input(T(1))], outputs: [{ value: 20_000, scriptPubKey: me }] }) }), (e) => e.code === 'invalid');
+    assert.throws(() => core.review({ ex, lib, view: view(), pub, txHex: 'deadbeef' }), (e) => e.code === 'invalid');
+  });
+});
+
+describe('warnings', () => {
+  it('a burn, a peg-out and a large fee are all flagged', () => {
+    const ex = makeEx({ utxo: [[`${T(1)}:0`, coin(50_000)]] });
+    const pegout = lib.records.recordScript(`pegout:${'00'.repeat(2)}14${'11'.repeat(20)}`);
+    const txHex = encode({ inputs: [input(T(1))], outputs: [{ value: 10_000, scriptPubKey: pegout }, { value: 1_000, scriptPubKey: lib.records.recordScript('gone') }, { value: 100, scriptPubKey: stranger }] });
+    const r = core.review({ ex, lib, view: emptyView(), pub, txHex });
+    assert.deepEqual(r.warnings.map((w) => w.kind).sort(), ['burn', 'fee', 'pegout']);
+  });
+});
+
+describe('assets (SPEC 12)', () => {
+  // history: an issue of 1000 DREAM onto one of my coins, then a transfer that
+  // breaks the rule (assigns more than it carries), whose outputs must carry nothing
+  function history () {
+    const issue = { version: 2, lockTime: 0, witness: [], inputs: [input(T(5))], outputs: [{ value: 330, scriptPubKey: me }, { value: 0, scriptPubKey: lib.records.recordScript('issue:DREAM:0') }, { value: 0, scriptPubKey: lib.records.recordScript('tally:self:0=1000') }] };
+    const issueId = engine.k.codec.txid(issue);
+    const other = { version: 2, lockTime: 0, witness: [], inputs: [input(T(6))], outputs: [{ value: 330, scriptPubKey: me }, { value: 0, scriptPubKey: lib.records.recordScript(`tally:${issueId}:0=5`) }] };
+    const otherId = engine.k.codec.txid(other);
+    const blocks = [{ block: { transactions: [{}, issue] }, txids: ['cb0', issueId] }, { block: { transactions: [{}, other] }, txids: ['cb1', otherId] }];
+    const utxo = [[`${issueId}:0`, coin(330)], [`${otherId}:0`, coin(330)], [`${T(7)}:0`, coin(20_000)]];
+    return { ex: makeEx({ utxo, blocks }), issueId, otherId };
+  }
+
+  it('the holders\' view reads the issue and refuses to create from nothing', () => {
+    const { ex, issueId, otherId } = history();
+    const view = core.assetView(ex, lib);
+    assert.equal(view.mode, 'view');
+    assert.equal(view.issued.get(issueId).ticker, 'DREAM');
+    assert.equal(view.carried.get(`${issueId}:0`).get(issueId), 1000);
+    assert.equal(view.carried.has(`${otherId}:0`), false, 'a transaction that breaks the rule carries nothing');
+  });
+
+  it('a transfer that tallies DREAM onward shows it, with nothing destroyed', () => {
+    const { ex, issueId } = history();
+    const view = core.assetView(ex, lib);
+    const txHex = encode({ inputs: [input(issueId), input(T(7))], outputs: [{ value: 330, scriptPubKey: stranger }, { value: 330, scriptPubKey: me }, { value: 0, scriptPubKey: lib.records.recordScript(`tally:${issueId}:0=100,1=900`) }, { value: 19_000, scriptPubKey: me }] });
+    const r = core.review({ ex, lib, view, pub, txHex });
+    assert.deepEqual(r.outputs[0].assets.map((a) => [a.ticker, a.amount]), [['DREAM', 100]]);
+    assert.deepEqual(r.outputs[1].assets.map((a) => [a.ticker, a.amount]), [['DREAM', 900]]);
+    assert.equal(r.destroyed.length, 0);
+    assert.equal(r.warnings.length, 0);
+  });
+
+  it('a "sats only" spend that sweeps a DREAM coin is flagged as destroying it', () => {
+    const { ex, issueId } = history();
+    const view = core.assetView(ex, lib);
+    const txHex = encode({ inputs: [input(issueId), input(T(7))], outputs: [{ value: 20_000, scriptPubKey: stranger }] });
+    const r = core.review({ ex, lib, view, pub, txHex });
+    assert.deepEqual(r.destroyed, [{ asset: issueId, amount: 1000 }]);
+    assert.ok(r.warnings.some((w) => w.kind === 'destroys' && /1,000 DREAM/.test(w.text)));
+  });
+
+  it('on a chain that enforces the rule, a breaking transaction is refused as invalid', () => {
+    const { ex, issueId } = history();
+    const view = core.assetView(ex, lib);
+    const enforced = { ...view, mode: 'rule' };
+    const txHex = encode({ inputs: [input(issueId)], outputs: [{ value: 330, scriptPubKey: stranger }, { value: 0, scriptPubKey: lib.records.recordScript(`tally:${issueId}:0=5000`) }] });
+    assert.throws(() => core.review({ ex, lib, view: enforced, pub, txHex }), (e) => e.code === 'invalid');
+  });
+});
+
+describe('formatAsset', () => {
+  it('formats whole and decimal units', () => {
+    assert.equal(core.formatAsset(1_000_000, 0), '1,000,000');
+    assert.equal(core.formatAsset(150, 2), '1.50');
+    assert.equal(core.formatAsset(5, 2), '0.05');
+  });
+});
diff --git a/test/sidestr-spends.test.js b/test/sidestr-spends.test.js
new file mode 100644
index 0000000..be0f086
--- /dev/null
+++ b/test/sidestr-spends.test.js
@@ -0,0 +1,115 @@
+/**
+ * Tests for the background's side of a sidestr spend (src/sidestr/spends.js):
+ * the request opens the window, the window signs once, the outcome resolves
+ * the page's promise, and closing, silence or a locked key reject it.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { createSpends, SPEND_WINDOW_MS } from '../src/sidestr/spends.js';
+
+const PUB = 'a'.repeat(64);
+const REQ = { chain: 'sidestr:dreamlab', tx: '0200' };
+
+function harness ({ locked = false, key = { publicKey: PUB, privateKey: 'b'.repeat(64) } } = {}) {
+  const timers = []; const opened = []; let n = 0;
+  const signed = [];
+  const spends = createSpends({
+    ensureUnlocked: async () => { if (locked) throw new Error('Podkey is locked'); },
+    getKeypair: async () => key,
+    signSighashes: (digests, priv) => { signed.push({ digests, priv }); return digests.map(() => 'c'.repeat(128)); },
+    openWindow: async (id) => { opened.push(id); return 42; },
+    setTimer: (fn, ms) => { timers.push({ fn, ms }); return timers.length; },
+    clearTimer: () => {},
+    randomId: () => `id-${++n}`
+  });
+  const tick = () => new Promise((resolve) => setImmediate(resolve));
+  return { spends, timers, opened, signed, tick };
+}
+
+describe('sidestr spends', () => {
+  it('opens the window and resolves with the signed transaction after one signing', async () => {
+    const h = harness();
+    const p = h.spends.request(REQ, 'https://forum.example');
+    await h.tick();
+    assert.deepEqual(h.opened, ['id-1']);
+    const d = h.spends.describe('id-1');
+    assert.equal(d.origin, 'https://forum.example');
+    assert.equal(d.pub, PUB);
+    assert.ok(d.expiresAt > Date.now() && d.expiresAt <= Date.now() + SPEND_WINDOW_MS);
+    const { signatures } = await h.spends.signDigests('id-1', ['d'.repeat(64)]);
+    assert.equal(signatures.length, 1);
+    await assert.rejects(() => h.spends.signDigests('id-1', ['d'.repeat(64)]), /already been signed/);
+    h.spends.done('id-1', { result: { tx: 'ff', txid: 'e'.repeat(64) } });
+    assert.deepEqual(await p, { tx: 'ff', txid: 'e'.repeat(64) });
+    assert.equal(h.spends.pending.size, 0);
+  });
+
+  it('refuses a result for a spend that was never signed', async () => {
+    const h = harness();
+    const p = h.spends.request(REQ, 'https://x.example');
+    await h.tick();
+    h.spends.done('id-1', { result: { tx: 'ff', txid: 'e'.repeat(64) } });
+    await assert.rejects(p, (e) => e.code === 'unavailable');
+  });
+
+  it('a rejection in the window reaches the page with its code', async () => {
+    const h = harness();
+    const p = h.spends.request(REQ, 'https://x.example');
+    await h.tick();
+    h.spends.done('id-1', { error: { code: 'rejected', message: 'You rejected the spend' } });
+    await assert.rejects(p, (e) => e.code === 'rejected' && /rejected the spend/.test(e.message));
+  });
+
+  it('closing the window rejects', async () => {
+    const h = harness();
+    const p = h.spends.request(REQ, 'https://x.example');
+    await h.tick();
+    h.spends.windowClosed(7); // another window: nothing happens
+    assert.equal(h.spends.pending.size, 1);
+    h.spends.windowClosed(42);
+    await assert.rejects(p, (e) => e.code === 'rejected');
+  });
+
+  it('silence rejects when the timer fires', async () => {
+    const h = harness();
+    const p = h.spends.request(REQ, 'https://x.example');
+    await h.tick();
+    assert.ok(h.timers[0].ms > SPEND_WINDOW_MS);
+    h.timers[0].fn();
+    await assert.rejects(p, (e) => e.code === 'rejected' && /timed out/.test(e.message));
+  });
+
+  it('checks the request before opening anything', async () => {
+    const h = harness();
+    await assert.rejects(() => h.spends.request({ chain: 'nope', tx: '00' }, 'https://x.example'), (e) => e.code === 'invalid');
+    await assert.rejects(() => h.spends.request(REQ, ''), (e) => e.code === 'invalid');
+    assert.equal(h.opened.length, 0);
+  });
+
+  it('a locked key is unavailable, and no window opens', async () => {
+    const h = harness({ locked: true });
+    await assert.rejects(() => h.spends.request(REQ, 'https://x.example'), (e) => e.code === 'unavailable');
+    assert.equal(h.opened.length, 0);
+  });
+
+  it('refuses to sign if the key changed while the window was open', async () => {
+    const h = harness();
+    const p = h.spends.request(REQ, 'https://x.example');
+    await h.tick();
+    h.spends.pending.get('id-1').pub = 'f'.repeat(64);
+    await assert.rejects(() => h.spends.signDigests('id-1', ['d'.repeat(64)]), /key changed/);
+    assert.equal(h.signed.length, 0);
+    h.spends.windowClosed(42);
+    await assert.rejects(p);
+  });
+
+  it('refuses an empty or oversized digest list', async () => {
+    const h = harness();
+    const p = h.spends.request(REQ, 'https://x.example');
+    await h.tick();
+    await assert.rejects(() => h.spends.signDigests('id-1', []), (e) => e.code === 'invalid');
+    h.spends.windowClosed(42);
+    await assert.rejects(p);
+  });
+});
diff --git a/test/sidestr-vendor.test.js b/test/sidestr-vendor.test.js
new file mode 100644
index 0000000..60f65f0
--- /dev/null
+++ b/test/sidestr-vendor.test.js
@@ -0,0 +1,57 @@
+/**
+ * The vendored sidestr engine (vendor/sidestr/) is exactly what
+ * scripts/vendor-sidestr.js wrote from the pinned commits: every file's
+ * SHA-256 matches PINS.json, nothing unrecorded is present, and no vendored
+ * module imports code from the network (Manifest V3 forbids it).
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { listVendored, PINS } from '../scripts/vendor-sidestr.js';
+
+const base = join(dirname(fileURLToPath(import.meta.url)), '..', 'vendor', 'sidestr');
+const record = JSON.parse(readFileSync(join(base, 'PINS.json'), 'utf8'));
+
+describe('vendored sidestr engine', () => {
+  it('records the pins the script names', () => {
+    assert.deepEqual(record.pins.map((p) => [p.name, p.commit]), PINS.map((p) => [p.name, p.commit]));
+  });
+
+  it('every file matches its recorded SHA-256, and nothing else is present', () => {
+    const recorded = [];
+    for (const pin of record.pins) {
+      for (const [file, sum] of Object.entries(pin.files)) {
+        const path = `${pin.name}/${file}`; recorded.push(path);
+        const actual = createHash('sha256').update(readFileSync(join(base, path), 'utf8')).digest('hex');
+        assert.equal(actual, sum, `${path} changed since it was vendored`);
+      }
+    }
+    assert.deepEqual(listVendored(base), recorded.sort());
+  });
+
+  it('records the two patches', () => {
+    const patched = record.pins.flatMap((p) => Object.keys(p.patched).map((f) => `${p.name}/${f}`)).sort();
+    assert.deepEqual(patched, ['explorer/explorer.mjs', 'spec/siding/lib/overlays/evm.mjs']);
+  });
+
+  it('no vendored module imports, fetches or evaluates code from the network', () => {
+    for (const path of listVendored(base).filter((f) => /\.m?js$/.test(f))) {
+      const src = readFileSync(join(base, path), 'utf8');
+      assert.doesNotMatch(src, /import\s*\(\s*[`'"]https?:/, `${path} imports from the network`);
+      assert.doesNotMatch(src, /from\s*['"]https?:/, `${path} imports from the network`);
+      assert.doesNotMatch(src, /new Function|\beval\(/, `${path} evaluates strings`);
+    }
+  });
+
+  it('the explorer defaults to the vendored engine, and the EVM rule refuses as unsupported', async () => {
+    const explorer = await import('../vendor/sidestr/explorer/explorer.mjs');
+    assert.match(explorer.CDN, /^file:.*\/vendor\/sidestr\/schema$/);
+    assert.match(explorer.SIDESTR, /^file:.*\/vendor\/sidestr\/spec\/siding\/lib$/);
+    const { evmOverlay } = await import('../vendor/sidestr/spec/siding/lib/overlays/evm.mjs');
+    assert.throws(() => evmOverlay({ id: 'sidestr:x' }), (e) => e.code === 'unsupported');
+  });
+});
diff --git a/vendor/sidestr/PINS.json b/vendor/sidestr/PINS.json
new file mode 100644
index 0000000..4dfa000
--- /dev/null
+++ b/vendor/sidestr/PINS.json
@@ -0,0 +1,68 @@
+{
+  "note": "Generated by scripts/vendor-sidestr.js. Do not edit by hand.",
+  "pins": [
+    {
+      "name": "schema",
+      "repo": "https://github.com/bitcoin-desktop/schema",
+      "commit": "b8cbf6337c7450fe14ddc5bce00c7280059aab5d",
+      "tag": "v0.0.27",
+      "files": {
+        "codec/blocks.js": "ec8e943cf27bdf34a9c97c6d742a2a6ecddf07121c65d433031560422a487649",
+        "codec/codec.js": "4c6ecc0cc159e9e16134391e68cef9ab6d3fc5ab8fa59ca5c9004ff6786efdf8",
+        "codec/hash.js": "79af401550a274dbe49a32530595feaf0c43b830587fab2034f3afb1fe09420f",
+        "codec/headers.js": "68898ce77a8a8abb6fda73d82c42eb462959a321298e6b7716cb6ac5e19ac431",
+        "codec/interpreter.js": "445149e7f3b972844fe33b9d3f60adb8387f220351dbd3394f0a79a8dd73aba0",
+        "codec/kernel.js": "632bb850628e095b289def04642a85fa98007f99e6ebf50d43fb24bcd46fbac8",
+        "codec/nostr.js": "edec8be7e884cbc1b05b0d9b38b1725bc2e86179cdfed3ed0fc05bed0cf4be14",
+        "codec/overlay.js": "3e09ea8aa80a2ec8641f0cb06f693c7624b54a9943c2222ebf658e75cc53dd59",
+        "codec/overlays/knots-blake2b.js": "7036bece208c01db6b102d2fc04d74c113a487d904b3678df493fae6653be57a",
+        "codec/pow/blake2b.js": "154583b7b6a9d8a604a5d7e83a2ab82d32b9009fa7be478e5143d56c34abd06b",
+        "codec/pow/knots-header-v2.js": "669086796668ac1018abef6aba961ded316a4d55270cf5280d4c89d15360a033",
+        "codec/script.js": "df05394e0fc765b647d2b1b9dbf091809926125cbbe5ba84f607b84e5dc4644b",
+        "codec/secp256k1.js": "bd3a6b034024978f9dd8923685567ce2834ed9631119f0d3b410e6d2efb41e14",
+        "schema/core.jsonld": "fb5f3e2b984bfaa36eee6d5e6a6a191c3865cc09cadb4ffee16fae76a54e6ef5",
+        "schema/proof.jsonld": "0defcdc32d7421d1440628681027564a7e5590f62d351cc5f075b6cd57c4d1e0",
+        "schema/script.jsonld": "c3a28b41ceae1c1f83288fe1755d1550989e5c5a3e51f1bf8c729a6e42db73a8",
+        "schema/chain.jsonld": "ccbdb40f9ffd72c0686c6303ab8899f79f6c651735bdfcef431af6c23efec821",
+        "schema/validate.jsonld": "4eb6792d4330397631d14dc4a8734ddb28fdd2459a3f98fc2bf822596a95bfb0",
+        "schema/overlays/knots-blake2b.jsonld": "b5b76b03a8b1159b4dd304a9b3b65b9a5891204f81fa0b26e4b42692d0a2022e",
+        "LICENSE": "0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0"
+      },
+      "patched": {}
+    },
+    {
+      "name": "spec",
+      "repo": "https://github.com/sidestr/spec",
+      "commit": "373d3eb6accd163f418e8a813052f1516a942bb3",
+      "files": {
+        "siding/lib/announce.mjs": "67a4e18d13eaa234fb4e9ddb5c3a275140fb33055e60e1d4150e4b0f23b12862",
+        "siding/lib/block.mjs": "3f9de6866080ff788aab6e898be7744c12988636f9137ec1eeddcfa66d57ca48",
+        "siding/lib/federation.mjs": "6fe5da6b5ea78473a8c49cd53414e2334714debfc580301a27c8ef9f29450c04",
+        "siding/lib/overlay.mjs": "d0bea820231a1ff252df9025b9b7a067a1263fc0047bf24d3f20364654b86b89",
+        "siding/lib/overlays/assets.mjs": "66fb734043e67ef2aee501f60ed60ebd3a9484588454e340ca3edbe5597515c6",
+        "siding/lib/overlays/evm.mjs": "59947b6681033f4bab2ec0500bd0ae2ab789f0bde261f31c1abb279d6dd36119",
+        "siding/lib/overlays/index.mjs": "58cccd190238b349c6f7815aefe1e2c4a337e8e770b060e06710824e8700f834",
+        "siding/lib/overlays/pool.mjs": "c86584bac7f4ff9c6af41f76dd6abd52c0a9e49bce23c9a5df218729377a0f04",
+        "siding/lib/parents.mjs": "a5e697a61e25c32a0df66def2809bac284247c777d5fa32647c08cfd249548ca",
+        "siding/lib/records.mjs": "8afa474cf154d8db6442a269deb30a83e67e8cc36e295c03c47a67c0c934ccca",
+        "siding/lib/txsign.mjs": "5f2af06056e30e6c0997c917ba05bfcce305b947a80df1c242a6b04931039875",
+        "LICENSE": "0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0"
+      },
+      "patched": {
+        "siding/lib/overlays/evm.mjs": "stub: the EVM rule imports ethereumjs from the network at start"
+      }
+    },
+    {
+      "name": "explorer",
+      "repo": "https://github.com/sidestr/explorer",
+      "commit": "db5a04e756243f9a73cba11b083d715c2ee3b327",
+      "files": {
+        "explorer.mjs": "17828f9a0205aa254afc3bda5b94a8faec90213146a4310882581bb3e8a2fb26",
+        "LICENSE": "0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0"
+      },
+      "patched": {
+        "explorer.mjs": "engine locations point at the vendored copies instead of jsdelivr"
+      }
+    }
+  ]
+}
diff --git a/vendor/sidestr/explorer/LICENSE b/vendor/sidestr/explorer/LICENSE
new file mode 100644
index 0000000..be3f7b2
--- /dev/null
+++ b/vendor/sidestr/explorer/LICENSE
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
diff --git a/vendor/sidestr/explorer/explorer.mjs b/vendor/sidestr/explorer/explorer.mjs
new file mode 100644
index 0000000..dc744e2
--- /dev/null
+++ b/vendor/sidestr/explorer/explorer.mjs
@@ -0,0 +1,114 @@
+// Reads a sidestr chain from a mirror (chain.json, blocks.json, blocks.dat with Range) and validates
+// every block with the engine in memory: headers, structure including the block signature, and
+// context against a UTXO set it builds itself. No key, no submit, no DOM: index.html renders this.
+export const CDN = new URL('../schema', import.meta.url).href; // Podkey: the vendored engine, never the network
+export const SIDESTR = new URL('../spec/siding/lib', import.meta.url).href; // Podkey: the vendored lib
+
+const CHARSET = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';
+const polymod = (values) => { const G = [0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3]; let chk = 1; for (const v of values) { const top = chk >>> 25; chk = ((chk & 0x1ffffff) << 5) ^ v; for (let i = 0; i < 5; i++) if ((top >>> i) & 1) chk ^= G[i]; } return chk >>> 0; };
+const hrpExpand = (hrp) => { const out = []; for (const c of hrp) out.push(c.charCodeAt(0) >>> 5); out.push(0); for (const c of hrp) out.push(c.charCodeAt(0) & 31); return out; };
+const toWords = (bytes) => { const out = []; let acc = 0, bits = 0; for (const b of bytes) { acc = (acc << 8) | b; bits += 8; while (bits >= 5) { bits -= 5; out.push((acc >>> bits) & 31); } } if (bits) out.push((acc << (5 - bits)) & 31); return out; };
+const unhex = (h) => Uint8Array.from(h.match(/../g) ?? [], (x) => parseInt(x, 16));
+export function scriptToAddress(spk, hrp) {
+  const m = /^(00|5[1-9a-f]|60)([0-9a-f]{2})([0-9a-f]+)$/i.exec(spk); if (!m) return null;
+  const version = m[1] === '00' ? 0 : parseInt(m[1], 16) - 0x50, len = parseInt(m[2], 16), program = m[3];
+  if (program.length !== len * 2 || len < 2 || len > 40) return null;
+  const words = [version, ...toWords(unhex(program))]; const pm = polymod([...hrpExpand(hrp), ...words, 0, 0, 0, 0, 0, 0]) ^ (version === 0 ? 1 : 0x2bc830a3);
+  const chk = []; for (let i = 0; i < 6; i++) chk.push((pm >>> (5 * (5 - i))) & 31);
+  return hrp + '1' + [...words, ...chk].map((w) => CHARSET[w]).join('');
+}
+export function addressToScript(addr, hrp) {
+  const s = addr.toLowerCase(); if (!s.startsWith(hrp + '1')) return null;
+  const data = [...s.slice(hrp.length + 1)].map((c) => CHARSET.indexOf(c)); if (data.some((d) => d < 0) || data.length < 7) return null;
+  const words = data.slice(0, -6), version = words[0]; const bytes = []; let acc = 0, bits = 0;
+  for (const w of words.slice(1)) { acc = (acc << 5) | w; bits += 5; while (bits >= 8) { bits -= 8; bytes.push((acc >>> bits) & 255); } }
+  const prog = bytes.map((b) => b.toString(16).padStart(2, '0')).join(''); const op = version === 0 ? '00' : (0x50 + version).toString(16);
+  return op + (bytes.length).toString(16).padStart(2, '0') + prog;
+}
+export const opReturnText = (spk) => { const m = /^6a(?:4c)?([0-9a-f]{2})([0-9a-f]*)$/i.exec(spk); if (!m) return null; const b = unhex(m[2]); const t = new TextDecoder().decode(b); return /^[\x20-\x7e]+$/.test(t) ? t : null; };
+
+// `opts` lets a test point at local checkouts: { cdn, sidestr, loadJson(url) }
+export async function loadEngine(chain, opts = {}) {
+  const cdn = opts.cdn ?? CDN, side = opts.sidestr ?? SIDESTR, j = opts.loadJson ?? (async (u) => (await fetch(u)).json());
+  const [{ createKernel }, { resolveParent }, { sidestrOverlay }, hash, nostr, { rulesFor }, secp] = await Promise.all([import(`${cdn}/codec/kernel.js`), import(`${side}/parents.mjs`), import(`${side}/overlay.mjs`), import(`${cdn}/codec/hash.js`), import(`${cdn}/codec/nostr.js`), import(`${side}/overlays/index.mjs`), import(`${cdn}/codec/secp256k1.js`)]);
+  const jj = (p) => j(`${cdn}/${p}`); const rules = rulesFor(chain); // SPEC 12: the rules the document names, or a refusal
+  const parent = resolveParent(chain.parent); const overlays = [sidestrOverlay(chain, { hash, secp }), ...rules.overlays]; // SPEC 3.2: the header format follows the parent
+  if (parent.family === 'blake2b') { const { knotsBlake2b } = await import(`${cdn}/codec/overlays/knots-blake2b.js`); overlays.unshift(knotsBlake2b(await jj('schema/overlays/knots-blake2b.jsonld'))); }
+  const k = createKernel({ core: await jj('schema/core.jsonld'), proof: await jj('schema/proof.jsonld'), script: await jj('schema/script.jsonld'), chain: await jj('schema/chain.jsonld'), validate: await jj('schema/validate.jsonld'),
+    network: chain.id, overlays }); // secp: a federated document's challenge is checked against its signers
+  if (rules.evm) await rules.evm.init(); // the evm rule fetches ethereumjs (from jsdelivr in a page) only on a chain that names it
+  return { k, hash, nostr, rules, parent };
+}
+
+// the chain as a model: blocks in order, each validated, plus indexes for the page
+// bumped when a saved state could be wrong: 2 after the concurrent-refresh fix (a v1 cache may hold duplicated history)
+export const CACHE_VERSION = 2;
+export class Explorer {
+  // opts.store: { get(key), set(key, value), delete(key) } (strings; sync or async), e.g. localStorage. With a store the
+  // validated state (coins, per-script history, the last 11 headers) is saved at the tip and a later open resumes from it,
+  // validating only the blocks since. The cache is dropped when the mirror's block at that height has another hash (a chain
+  // reset) or the chain names rules (their state is not cached yet). `fromCache` is the height resumed from, else null.
+  constructor(mirror, opts = {}) { this.opts = opts; this.mirror = mirror.replace(/\/$/, ''); this.blocks = []; this.txs = new Map(); this.utxo = new Map(); this.byScript = new Map(); this.headers = []; this.store = opts.store ?? null; this.fromCache = null; }
+  get cacheKey() { return `sidestr:state:${this.chain?.id}`; }
+  get cacheable() { return !!(this.store && this.chain && !(this.rules?.overlays?.length)); }
+  async clearCache() { if (this.store && this.chain) await this.store.delete?.(this.cacheKey); }
+  async #restore(index) {
+    let c; try { const raw = await this.store.get(this.cacheKey); c = raw ? JSON.parse(raw) : null; } catch { c = null; }
+    if (!c || c.v !== CACHE_VERSION || c.chain !== this.chain.id) { if (c) await this.clearCache(); return; } // an older cache format is dropped, not read
+    const e = index.blocks[c.height]; if (!e || e.hash !== c.hash) { await this.clearCache(); return; } // the chain is not the one the cache saw
+    this.utxo = new Map(c.utxo); this.byScript = new Map(c.byScript); for (const [h, hex] of c.headers) this.headers[h] = this.k.codec.decode('BlockHeader', hex);
+    this.blocks.length = c.height + 1; this.blocks[c.height] = { height: c.height, hash: c.hash, time: c.time, cached: true, verdict: { ok: true, cached: true } }; this.fromCache = c.height;
+  }
+  async #save() {
+    const tip = this.tip(); if (!tip) return; const headers = []; for (let h = Math.max(0, tip.height - 10); h <= tip.height; h++) if (this.headers[h]) headers.push([h, this.k.codec.encodeHex('BlockHeader', this.headers[h])]);
+    try { await this.store.set(this.cacheKey, JSON.stringify({ v: CACHE_VERSION, chain: this.chain.id, height: tip.height, hash: tip.hash, time: tip.time, utxo: [...this.utxo], byScript: [...this.byScript], headers })); } catch {}
+  }
+  async open() {
+    this.chain = await (await fetch(`${this.mirror}/chain.json`, { cache: 'no-store' })).json();
+    const { k, hash, nostr, rules, parent } = await loadEngine(this.chain, this.opts); this.k = k; this.hash = hash; this.nostr = nostr; this.rules = rules; this.parent = parent;
+    return this.refresh();
+  }
+  // one refresh at a time: a second caller waits for the first and gets its result, so a block is never applied twice
+  refresh() { if (!this._refreshing) this._refreshing = this.#refresh().finally(() => { this._refreshing = null; }); return this._refreshing; }
+  async #refresh() {
+    const index = await (await fetch(`${this.mirror}/blocks.json`, { cache: 'no-store' })).json();
+    if (this.blocks.length === 0 && this.cacheable) await this.#restore(index);
+    const pending = index.blocks.filter((e) => e.height > this.blocks.length - 1);
+    const fetched = new Map();
+    for (let i = 0; i < pending.length; i += 16) await Promise.all(pending.slice(i, i + 16).map(async (e) => {
+      const r = await fetch(`${this.mirror}/blocks.dat`, { headers: { range: `bytes=${e.offset + 8}-${e.offset + 8 + e.size - 1}` }, cache: 'no-store' });
+      fetched.set(e.height, new Uint8Array(await r.arrayBuffer()));
+    }));
+    for (const e of pending) await this.#apply(e, fetched.get(e.height));
+    this.index = index; if (pending.length && this.cacheable) await this.#save(); return this;
+  }
+  async #apply(entry, bytes) {
+    const { k } = this; const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+    const block = k.codec.decode('Block', hex); const h = entry.height; const hash = k.codec.blockHash(block.header);
+    let verdict = { ok: true, failed: [], skipped: [] };
+    // the evm rule executes before the kernel's checks and leaves the verdict the sync rule reads (proposals/evm.md)
+    if (this.rules?.evm) { if (h === 0) { this.rules.evm.roots.set(0, this.rules.evm.roots.get(-1)); this.rules.evm.blocks.set(0, { hashes: [], root: '0x' + this.rules.evm.roots.get(-1) }); } else { const v = await this.rules.evm.prepare(block, h, k.codec); if (!v.ok) verdict.evm = v.error; } }
+    if (h > 0) {
+      const [hv] = k.headers.validateChain([block.header], { startHeight: h, prevContext: this.headers.slice(Math.max(0, h - 11), h).filter(Boolean), now: Math.floor(Date.now() / 1000) + 7200 });
+      const s = k.blocks.validateBlockStructure(block); const c = k.blocks.validateBlockContext(block, { height: h, utxo: this.utxo, mtp: k.headers.medianTimePast(this.headers.slice(Math.max(0, h - 11), h)) });
+      for (const r of [...hv.results, ...s.results, ...c.results]) { if (r.ok === false) verdict.failed.push(r.rule); if (r.ok === null) verdict.skipped.push(r.rule); }
+      verdict.ok = verdict.failed.length === 0 && hash === entry.hash && block.header.prevBlockHash === this.blocks[h - 1].hash;
+    }
+    // fees and the spend index, from the coins as they are before this block
+    let fees = 0; const spends = [];
+    block.transactions.forEach((tx, i) => { if (i === 0) return; let inSum = 0; for (const inp of tx.inputs) { const key = `${inp.prevout.txid}:${inp.prevout.vout}`; const coin = this.utxo.get(key); if (coin) { inSum += coin.output.value; spends.push([key, coin, k.codec.txid(tx)]); } } fees += inSum - tx.outputs.reduce((s, o) => s + o.value, 0); });
+    k.blocks.applyBlock(this.utxo, block, h);
+    const txids = block.transactions.map((tx) => k.codec.txid(tx));
+    const rec = { height: h, hash, time: block.header.time, size: bytes.length, txs: txids.length, fees, verdict, block, txids, coinbaseValue: block.transactions[0].outputs.reduce((s, o) => s + o.value, 0) };
+    this.blocks[h] = rec; this.headers[h] = block.header;
+    block.transactions.forEach((tx, i) => { const txid = txids[i]; this.txs.set(txid, { tx, txid, height: h, coinbase: i === 0, fee: i === 0 ? null : (() => { let s = 0; for (const inp of tx.inputs) { const c = spends.find((x) => x[2] === txid && x[0] === `${inp.prevout.txid}:${inp.prevout.vout}`); if (c) s += c[1].output.value; } return s - tx.outputs.reduce((a, o) => a + o.value, 0); })() });
+      tx.outputs.forEach((o, vout) => { if (o.scriptPubKey.startsWith('6a')) return; const a = this.byScript.get(o.scriptPubKey) ?? { received: 0, spent: 0, outputs: [] }; a.received += o.value; a.outputs.push({ txid, vout, value: o.value, height: h }); this.byScript.set(o.scriptPubKey, a); }); });
+    for (const [key, coin, txid] of spends) { const a = this.byScript.get(coin.output.scriptPubKey); if (a) { a.spent += coin.output.value; a.spends = a.spends ?? []; a.spends.push({ key, txid, value: coin.output.value, height: h }); } }
+  }
+  tip() { return this.blocks[this.blocks.length - 1]; }
+  headerHex(h) { return this.headers[h] ? this.k.codec.encodeHex('BlockHeader', this.headers[h]) : null; }
+  supply() { let s = 0; for (const c of this.utxo.values()) s += c.output.value; return s; }
+  balance(spk) { let s = 0; for (const c of this.utxo.values()) if (c.output.scriptPubKey === spk) s += c.output.value; return s; }
+  address(spk) { return scriptToAddress(spk, this.chain.addressPrefix) ?? spk; }
+  block(ref) { return /^\d+$/.test(ref) ? this.blocks[Number(ref)] : this.blocks.find((b) => b.hash === ref); }
+}
diff --git a/vendor/sidestr/schema/LICENSE b/vendor/sidestr/schema/LICENSE
new file mode 100644
index 0000000..be3f7b2
--- /dev/null
+++ b/vendor/sidestr/schema/LICENSE
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
diff --git a/vendor/sidestr/schema/codec/blocks.js b/vendor/sidestr/schema/codec/blocks.js
new file mode 100644
index 0000000..3f2d6b4
--- /dev/null
+++ b/vendor/sidestr/schema/codec/blocks.js
@@ -0,0 +1,383 @@
+// Schema-driven block engine: the `transaction`, `block`, and `block-context`
+// phases from schema/validate.jsonld, plus UTXO window evolution — a pruned
+// node in miniature.
+//
+// Outcomes follow the established convention: true (pass), false (fail with
+// the rule's errorCode), null (skipped — context unavailable or, for rules
+// with an activationParam, height below the deployment's activation).
+// Skipping is the honest pruned-node tradeoff: an input spending a coin
+// created before the window can only be checked if its transaction is
+// supplied via `external`.
+//
+// Out of scope, deliberately: witness/signature script execution.
+
+import { dsha256, bytesToHex, hexToBytes } from './hash.js';
+import { ScriptEngine } from './script.js';
+import { ScriptInterpreter } from './interpreter.js';
+
+const NULL_TXID = '0'.repeat(64);
+const keyOf = (prevout) => `${prevout.txid}:${prevout.vout}`;
+
+export const isCoinbase = (tx) =>
+  tx.inputs.length === 1
+  && tx.inputs[0].prevout.txid === NULL_TXID
+  && tx.inputs[0].prevout.vout === 0xffffffff;
+
+export class BlockEngine {
+  constructor(codec, params, ruleSets, scriptEngine = null, interpreter = null) {
+    this.codec = codec;
+    this.params = params;
+    this.ruleSets = ruleSets; // {transaction, block, blockContext}
+    this.scriptEngine = scriptEngine; // needed by the sigop rule
+    this.interpreter = interpreter;   // needed by the scripts rule
+
+    const sumOut = (tx) => tx.outputs.reduce((s, o) => s + o.value, 0);
+
+    this.txChecks = {
+      'btc:rule-tx-inputs-nonempty': ({ tx }) => tx.inputs.length > 0,
+      'btc:rule-tx-outputs-nonempty': ({ tx }) => tx.outputs.length > 0,
+      'btc:rule-tx-size': ({ tx }) => this.codec.txWeight(tx) <= params.maxBlockWeight,
+      'btc:rule-tx-output-values': ({ tx }) =>
+        tx.outputs.every((o) => o.value >= 0 && o.value <= params.maxMoney)
+        && sumOut(tx) <= params.maxMoney,
+      'btc:rule-tx-inputs-unique': ({ tx }) =>
+        new Set(tx.inputs.map((i) => keyOf(i.prevout))).size === tx.inputs.length,
+      'btc:rule-tx-prevouts': ({ tx, coinbase }) => coinbase
+        ? isCoinbase(tx)
+        : tx.inputs.every((i) => i.prevout.txid !== NULL_TXID),
+      'btc:rule-tx-coinbase-script': ({ tx, coinbase }) => {
+        if (!coinbase) return null;
+        const len = tx.inputs[0].scriptSig.length / 2;
+        return len >= 2 && len <= 100;
+      },
+    };
+
+    this.blockChecks = {
+      'btc:rule-block-coinbase-first': ({ block }) =>
+        block.transactions.length > 0 && isCoinbase(block.transactions[0]),
+      'btc:rule-block-coinbase-single': ({ block }) =>
+        block.transactions.slice(1).every((tx) => !isCoinbase(tx)),
+      'btc:rule-block-merkle-root': ({ block, txids }) =>
+        this.codec.merkleRoot(txids) === block.header.merkleRoot,
+      'btc:rule-block-tx-duplicates': ({ txids }) => new Set(txids).size === txids.length,
+      'btc:rule-block-weight': ({ block }) => this.blockWeight(block) <= params.maxBlockWeight,
+      'btc:rule-block-sigops': ({ block }) => {
+        if (!this.scriptEngine) return null;
+        const sigops = block.transactions.reduce((s, tx) =>
+          s + tx.inputs.reduce((a, i) => a + this.legacySigOps(i.scriptSig), 0)
+            + tx.outputs.reduce((a, o) => a + this.legacySigOps(o.scriptPubKey), 0), 0);
+        return 4 * sigops <= params.maxBlockSigopsCost;
+      },
+      'btc:rule-block-transactions': ({ block }) =>
+        block.transactions.every((tx, i) => this.validateTransaction(tx, i === 0).ok),
+    };
+
+    this.contextChecks = {
+      'btc:rule-blockctx-bip34-height': ({ block, height }) =>
+        this.bip34Height(block.transactions[0]) === height,
+      // definite violations (double spend, nonexistent vout) fail even in a
+      // pruned window; out-of-window coins whose unspent-ness can't be
+      // verified make the rule skip — that is the pruning tradeoff
+      'btc:rule-blockctx-inputs-available': ({ spending }) =>
+        spending.missing.length > 0 ? false
+          : spending.valueUnresolved > 0 || spending.unverified > 0 ? null : true,
+      'btc:rule-blockctx-fees': ({ spending }) =>
+        spending.deficits.length > 0 ? false
+          : spending.valueUnresolved > 0 ? null : true,
+      // lockTime 0 and the all-final-sequences escape need no context; a
+      // time-based lockTime needs median-time-past, which a caller may lack
+      'btc:rule-blockctx-finality': ({ block, height, mtp }) => {
+        let unknown = false;
+        for (const tx of block.transactions) {
+          if (tx.lockTime === 0) continue;
+          if (tx.inputs.every((i) => i.sequence === 0xffffffff)) continue;
+          if (tx.lockTime < 500000000) {
+            if (tx.lockTime >= height) return false;
+          } else if (mtp == null) unknown = true;
+          else if (tx.lockTime >= mtp) return false;
+        }
+        return unknown ? null : true;
+      },
+      'btc:rule-blockctx-coinbase-maturity': ({ spending }) =>
+        spending.premature.length > 0 ? false
+          : spending.maturityUnknown > 0 ? null : true,
+      // BIP68/112 relative lock-time: definite violations fail; height-based
+      // locks on out-of-window coins and all time-based locks skip honestly
+      'btc:rule-blockctx-sequence-locks': ({ spending }) =>
+        spending.seqlockViolations.length > 0 ? false
+          : spending.seqlockUnknown > 0 ? null : true,
+      // real script + signature verification of every resolvable input;
+      // pruned-away prevouts and taproot inputs skip honestly
+      'btc:rule-blockctx-scripts': ({ spending, height }) => {
+        if (!this.interpreter) return null;
+        // Knots' unified opt-in sighash applies from the height the chain's
+        // unifiedSighashParam names (the BLAKE2b fork height); before it, and
+        // on chains without the parameter, an opted-in signature reads legacy.
+        const usp = this.params.unifiedSighashParam;
+        const unifiedSighash = !!usp && height != null && height >= this.params[usp];
+        let unsupported = 0;
+        const byTx = new Map();
+        for (const ri of spending.resolvedInputs) {
+          if (!byTx.has(ri.tx)) byTx.set(ri.tx, new Map());
+          byTx.get(ri.tx).set(ri.inIndex, ri.prevout);
+        }
+        for (const [tx, resolved] of byTx) {
+          // taproot sighash commits to every input's prevout, so the full
+          // array is only available when the whole tx resolved
+          const allPrevouts = resolved.size === tx.inputs.length
+            ? tx.inputs.map((_, i) => resolved.get(i)) : null;
+          for (const [inIndex, prevout] of resolved) {
+            const v = this.interpreter.verifyInput(tx, inIndex, prevout, allPrevouts, null, { unifiedSighash });
+            if (v.ok === false) return false;
+            if (v.ok === null) unsupported++;
+          }
+        }
+        return (spending.valueUnresolved > 0 || unsupported > 0) ? null : true;
+      },
+      'btc:rule-blockctx-coinbase-amount': ({ block, height, spending }) =>
+        spending.valueUnresolved > 0 ? null
+          : block.transactions[0].outputs.reduce((s, o) => s + o.value, 0)
+            <= this.subsidy(height) + spending.fees,
+      'btc:rule-blockctx-witness-commitment': ({ block }) => {
+        const hasWitness = block.transactions.some((tx) => tx.witness?.some((s) => s.length > 0));
+        if (!hasWitness) return null;
+        const commitment = this.witnessCommitment(block.transactions[0]);
+        if (!commitment) return false;
+        return commitment === this.witnessCommitmentHash(block);
+      },
+    };
+  }
+
+  static fromSchemas(codec, chainSchema, validateSchema, scriptSchema = null, network = 'btc:mainnet') {
+    const params = chainSchema['@graph'].find((n) => n['@id'] === network);
+    if (!params) throw new Error(`unknown network: ${network}`);
+    codec.setChainParams?.(params); // variants + PoW hash follow the chain
+    const set = (phase) => validateSchema['@graph'].find((n) => n['@type'] === 'RuleSet' && n.phase === phase);
+    const scriptEngine = scriptSchema
+      ? ScriptEngine.fromSchemas(scriptSchema, chainSchema, network)
+      : null;
+    const limits = scriptSchema?.['@graph'].find((n) => n['@id'] === 'btc:scriptLimits');
+    const interpreter = scriptEngine
+      ? new ScriptInterpreter(codec, scriptEngine, limits)
+      : null;
+    return new BlockEngine(codec, params, {
+      transaction: set('transaction'),
+      block: set('block'),
+      blockContext: set('block-context'),
+    }, scriptEngine, interpreter);
+  }
+
+  // Legacy signature-operation count (Bitcoin Core's GetSigOpCount with
+  // fAccurate=false): CHECKSIG(VERIFY) counts 1, CHECKMULTISIG(VERIFY) 20.
+  legacySigOps(scriptHex) {
+    let n = 0;
+    for (const op of this.scriptEngine.parse(scriptHex)) {
+      if (op.name === 'OP_CHECKSIG' || op.name === 'OP_CHECKSIGVERIFY') n += 1;
+      else if (op.name === 'OP_CHECKMULTISIG' || op.name === 'OP_CHECKMULTISIGVERIFY') n += 20;
+    }
+    return n;
+  }
+
+  // ---- consensus arithmetic ----
+
+  subsidy(height) {
+    const halvings = Math.floor(height / this.params.halvingInterval);
+    return halvings >= 64 ? 0 : Math.floor(this.params.initialSubsidy / 2 ** halvings);
+  }
+
+  blockWeight(block) {
+    const total = this.codec.encode('Block', block).length;
+    const legacy = block.transactions.reduce(
+      (s, tx) => s + this.codec.encode('Transaction', tx, { legacy: true }).length,
+      this.codec.encode('BlockHeader', block.header).length + this.#varintSize(block.transactions.length));
+    return 3 * legacy + total;
+  }
+
+  #varintSize(n) { return n < 0xfd ? 1 : n <= 0xffff ? 3 : n <= 0xffffffff ? 5 : 9; }
+
+  // BIP 34: the height encoded as a script-number push at the start of the
+  // coinbase scriptSig. Returns null if unparseable.
+  bip34Height(coinbaseTx) {
+    const script = hexToBytes(coinbaseTx.inputs[0].scriptSig);
+    const op = script[0];
+    if (op === undefined) return null;
+    // Heights 1-16 use the minimal push OP_1..OP_16 (0x51..0x60), a single
+    // opcode byte rather than a length-prefixed push. Core's `CScript() << height`
+    // encodes them this way, so BIP34 requires exactly this on those blocks.
+    if (op >= 0x51 && op <= 0x60) return op - 0x50;
+    // Otherwise a length-prefixed little-endian scriptnum push (1..5 data bytes).
+    const len = op;
+    if (len < 1 || len > 5 || script.length < 1 + len) return null;
+    let n = 0;
+    for (let i = len; i >= 1; i--) n = n * 256 + script[i];
+    return n;
+  }
+
+  // The witness commitment carried in a coinbase output: the last output
+  // whose scriptPubKey starts OP_RETURN 0x24 0xaa21a9ed; returns the 32-byte
+  // commitment hex, or null.
+  witnessCommitment(coinbaseTx) {
+    for (let i = coinbaseTx.outputs.length - 1; i >= 0; i--) {
+      const spk = coinbaseTx.outputs[i].scriptPubKey;
+      if (spk.startsWith('6a24aa21a9ed') && spk.length >= 12 + 64) {
+        return spk.slice(12, 12 + 64);
+      }
+    }
+    return null;
+  }
+
+  // dsha256(witness merkle root || witness reserved value). The coinbase
+  // wtxid is defined as all zeros; the reserved value comes from the
+  // coinbase's own witness stack (usually 32 zero bytes).
+  witnessCommitmentHash(block) {
+    const wtxids = block.transactions.map((tx, i) =>
+      i === 0 ? NULL_TXID : this.codec.wtxid(tx));
+    const root = hexToBytes(this.codec.merkleRoot(wtxids)).reverse();
+    const reserved = hexToBytes(block.transactions[0].witness?.[0]?.[0] ?? '00'.repeat(32));
+    const cat = new Uint8Array(64);
+    cat.set(root); cat.set(reserved, 32);
+    return bytesToHex(dsha256(cat));
+  }
+
+  // ---- ruleset execution ----
+
+  // Overlay rules bind their checks here, by phase: {transaction, block, blockContext}.
+  registerChecks({ transaction = {}, block = {}, blockContext = {} } = {}) {
+    Object.assign(this.txChecks, transaction);
+    Object.assign(this.blockChecks, block);
+    Object.assign(this.contextChecks, blockContext);
+  }
+
+  #run(ruleSet, checks, ctx) {
+    const results = ruleSet.rules.map((rule) => {
+      let outcome;
+      const check = checks[rule['@id']];
+      if (!check) throw new Error(`no check registered for ${rule['@id']}`);
+      if (rule.activationParam && ctx.height != null
+          && ctx.height < this.params[rule.activationParam]) {
+        outcome = null; // not yet activated at this height
+      } else {
+        outcome = check(ctx);
+      }
+      return {
+        rule: rule['@id'],
+        label: rule.label,
+        ok: outcome,
+        error: outcome === false ? rule.errorCode : null,
+      };
+    });
+    return { ok: results.every((r) => r.ok !== false), results };
+  }
+
+  validateTransaction(tx, coinbase = false) {
+    return this.#run(this.ruleSets.transaction, this.txChecks, { tx, coinbase });
+  }
+
+  validateBlockStructure(block) {
+    const txids = block.transactions.map((tx) => this.codec.txid(tx));
+    return this.#run(this.ruleSets.block, this.blockChecks, { block, txids });
+  }
+
+  // Walk the block's transactions in order, resolving each input against
+  // (1) coins created earlier in the window or block — availability proven,
+  // (2) externally supplied prevout transactions — value known, unspent-ness
+  //     unverifiable in a pruned window ("unverified"),
+  // (3) nothing — "valueUnresolved".
+  // Definite violations land in `missing` (double spend within the window
+  // or block, or a vout that does not exist on a known transaction).
+  // Does not mutate utxo.
+  #resolveSpending(block, utxo, external, height) {
+    const spentHere = new Set();
+    const createdHere = new Map();
+    let fees = 0, valueUnresolved = 0, unverified = 0, maturityUnknown = 0, seqlockUnknown = 0;
+    const missing = [], deficits = [], premature = [], resolvedInputs = [], seqlockViolations = [];
+    // BIP68 nSequence fields
+    const SEQ_DISABLE = 0x80000000, SEQ_TYPE = 0x00400000, SEQ_MASK = 0x0000ffff;
+
+    block.transactions.forEach((tx, i) => {
+      const txid = this.codec.txid(tx);
+      if (i > 0) {
+        let inSum = 0, valuesOk = true;
+        tx.inputs.forEach((inp, inIndex) => {
+          const key = keyOf(inp.prevout);
+          if (spentHere.has(key)) {
+            missing.push(key); valuesOk = false;
+          } else {
+            let coinHeight = null;
+            const coin = createdHere.get(key) ?? utxo.get(key);
+            if (coin) {
+              inSum += coin.output.value;
+              resolvedInputs.push({ tx, inIndex, prevout: coin.output });
+              coinHeight = coin.height;
+              if (coin.coinbase && height - coin.height < this.params.coinbaseMaturity) {
+                premature.push(key);
+              }
+            } else {
+              const ext = external.get(inp.prevout.txid);
+              const out = ext?.outputs[inp.prevout.vout];
+              if (out) {
+                inSum += out.value; unverified++;
+                resolvedInputs.push({ tx, inIndex, prevout: out });
+                // out-of-window coin: creation height (and coinbase-ness) unknown
+                if (isCoinbase(ext)) maturityUnknown++;
+              } else if (ext) { missing.push(key); valuesOk = false; }
+              else { valueUnresolved++; valuesOk = false; }
+            }
+            // BIP68 relative lock-time: only for v2 txs with the disable flag clear
+            if (tx.version >= 2 && (inp.sequence & SEQ_DISABLE) === 0) {
+              const value = inp.sequence & SEQ_MASK;
+              if (value > 0) {
+                if (inp.sequence & SEQ_TYPE) seqlockUnknown++;   // time-based: no per-coin MTP in this context
+                else if (coinHeight == null) seqlockUnknown++;   // height-based but coin height unknown
+                else if (height < coinHeight + value) seqlockViolations.push(key);
+              }
+            }
+          }
+          spentHere.add(key);
+        });
+        const outSum = tx.outputs.reduce((s, o) => s + o.value, 0);
+        if (valuesOk) {
+          if (inSum < outSum) deficits.push(txid);
+          else fees += inSum - outSum;
+        }
+      }
+      tx.outputs.forEach((output, vout) => {
+        if (!output.scriptPubKey.startsWith('6a')) {
+          createdHere.set(`${txid}:${vout}`, { output, coinbase: i === 0, height });
+        }
+      });
+    });
+    return { fees, missing, deficits, premature, valueUnresolved, unverified, maturityUnknown,
+      seqlockViolations, seqlockUnknown, resolvedInputs };
+  }
+
+  validateBlockContext(block, { height, utxo = new Map(), external = new Map(), mtp = null }) {
+    const spending = this.#resolveSpending(block, utxo, external, height);
+    const verdict = this.#run(this.ruleSets.blockContext, this.contextChecks,
+      { block, height, spending, mtp });
+    return { ...verdict, spending };
+  }
+
+  // Apply a fully-validated block to the UTXO window map (mutates).
+  // Returns {created, spent} counts.
+  applyBlock(utxo, block, height) {
+    let created = 0, spent = 0;
+    block.transactions.forEach((tx, i) => {
+      if (i > 0) {
+        for (const inp of tx.inputs) {
+          if (utxo.delete(keyOf(inp.prevout))) spent++;
+        }
+      }
+      const txid = this.codec.txid(tx);
+      tx.outputs.forEach((output, vout) => {
+        if (!output.scriptPubKey.startsWith('6a')) { // unspendable: not a coin
+          utxo.set(`${txid}:${vout}`, {
+            outpoint: { txid, vout }, output, height, coinbase: i === 0,
+          });
+          created++;
+        }
+      });
+    });
+    return { created, spent };
+  }
+}
diff --git a/vendor/sidestr/schema/codec/codec.js b/vendor/sidestr/schema/codec/codec.js
new file mode 100644
index 0000000..3c5bf77
--- /dev/null
+++ b/vendor/sidestr/schema/codec/codec.js
@@ -0,0 +1,364 @@
+// Schema-driven Bitcoin codec.
+//
+// The codec contains no per-type serialization logic: it walks the ordered
+// `fields` lists in the JSON-LD schema and interprets each field's wireType.
+// Two genuine special cases of the protocol are handled by named wire rules
+// rather than hardcoded types:
+//   - presentIf "segwit": on decode, segwit serialization is detected by the
+//     0x00 marker byte (a legacy transaction cannot have zero inputs); on
+//     encode, by the presence of a non-empty `witness` array.
+//   - wireType "witness": the witness vector carries no count prefix; its
+//     length equals the number of inputs already decoded.
+//
+// Hashes (hash256) and scripts (varbytes) are represented as hex strings in
+// instances; hash256 values use display order (byte-reversed), as in every
+// explorer and RPC interface. Satoshi amounts (i64le) are plain numbers —
+// the maximum supply (2.1e15 sats) is well inside Number.MAX_SAFE_INTEGER.
+
+import { dsha256, bytesToHex, hexToBytes, reverseHex } from './hash.js';
+
+const shortId = (id) => id.replace(/^btc:/, '').replace(/^.*\//, '');
+
+class Reader {
+  constructor(bytes) {
+    this.bytes = bytes;
+    this.dv = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    this.pos = 0;
+  }
+  peek() { return this.bytes[this.pos]; }
+  take(n) {
+    if (this.pos + n > this.bytes.length) throw new Error('unexpected end of data');
+    const out = this.bytes.subarray(this.pos, this.pos + n);
+    this.pos += n;
+    return out;
+  }
+  u8() { return this.take(1)[0]; }
+  u16le() { const v = this.dv.getUint16(this.pos, true); this.pos += 2; return v; }
+  u16be() { const v = this.dv.getUint16(this.pos, false); this.pos += 2; return v; }
+  u64le() {
+    const v = this.dv.getBigUint64(this.pos, true); this.pos += 8;
+    return v <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(v) : v.toString();
+  }
+  u32le() { const v = this.dv.getUint32(this.pos, true); this.pos += 4; return v; }
+  i32le() { const v = this.dv.getInt32(this.pos, true); this.pos += 4; return v; }
+  i64le() { const v = this.dv.getBigInt64(this.pos, true); this.pos += 8; return Number(v); }
+  varint() {
+    const first = this.u8();
+    if (first < 0xfd) return first;
+    if (first === 0xfd) return this.u16le();
+    if (first === 0xfe) return this.u32le();
+    const v = this.dv.getBigUint64(this.pos, true); this.pos += 8;
+    return Number(v);
+  }
+}
+
+class Writer {
+  constructor() { this.chunks = []; }
+  bytes(b) { this.chunks.push(b); }
+  u8(v) { this.bytes(Uint8Array.of(v)); }
+  u16le(v) { const b = new Uint8Array(2); new DataView(b.buffer).setUint16(0, v, true); this.bytes(b); }
+  u16be(v) { const b = new Uint8Array(2); new DataView(b.buffer).setUint16(0, v, false); this.bytes(b); }
+  u64le(v) { const b = new Uint8Array(8); new DataView(b.buffer).setBigUint64(0, BigInt(v), true); this.bytes(b); }
+  u32le(v) { const b = new Uint8Array(4); new DataView(b.buffer).setUint32(0, v, true); this.bytes(b); }
+  i32le(v) { const b = new Uint8Array(4); new DataView(b.buffer).setInt32(0, v, true); this.bytes(b); }
+  i64le(v) { const b = new Uint8Array(8); new DataView(b.buffer).setBigInt64(0, BigInt(v), true); this.bytes(b); }
+  varint(v) {
+    if (v < 0xfd) this.u8(v);
+    else if (v <= 0xffff) { this.u8(0xfd); this.u16le(v); }
+    else if (v <= 0xffffffff) { this.u8(0xfe); this.u32le(v); }
+    else { this.u8(0xff); const b = new Uint8Array(8); new DataView(b.buffer).setBigUint64(0, BigInt(v), true); this.bytes(b); }
+  }
+  out() {
+    const len = this.chunks.reduce((n, c) => n + c.length, 0);
+    const all = new Uint8Array(len);
+    let p = 0;
+    for (const c of this.chunks) { all.set(c, p); p += c.length; }
+    return all;
+  }
+}
+
+export class Codec {
+  constructor(...schemas) {
+    this.types = new Map();
+    for (const schema of schemas) {
+      for (const node of schema['@graph'] ?? []) {
+        if (node['@type'] === 'ConsensusStruct') this.types.set(shortId(node['@id']), node);
+      }
+    }
+    // Chain binding (see setChainParams): a chain may declare struct variants
+    // and the proof-of-work hash. Unbound, the codec knows exactly the base
+    // structures and SHA256d — Bitcoin, byte for byte.
+    this.chain = null;
+    this.powHashes = new Map([['sha256d', (bytes) => reverseHex(dsha256(bytes))]]);
+    this.derived = new Map(); // struct @id -> fn(obj) returning derived fields (never serialized)
+  }
+
+  // Register derived fields for a structure: computed from its consensus
+  // fields after decode, ignored by encode. The base registers none.
+  registerDerived(structId, fn) { this.derived.set(structId, fn); }
+
+  // Bind the codec to a chain's NetworkParams node. Variants and the PoW hash
+  // are looked up from it; nothing else in the codec changes. Misconfiguration
+  // fails here, at bind time, not later inside decode or checkProofOfWork.
+  setChainParams(params) {
+    if (params) {
+      const name = params.powHash ?? 'sha256d';
+      if (!this.powHashes.has(name)) throw new Error(`${params['@id']}: proof-of-work hash not registered: ${name}`);
+      for (const [base, variants] of Object.entries(params.structVariants ?? {})) {
+        if (!this.types.has(shortId(base))) throw new Error(`${params['@id']}: structVariants for unknown ${base}`);
+        for (const v of variants) {
+          if (!v?.when?.field || !v.struct) throw new Error(`${params['@id']}: variant of ${base} needs when.field and struct`);
+          if (!this.types.has(shortId(v.struct))) throw new Error(`${params['@id']}: variant struct unknown: ${v.struct}`);
+          const hasBit = v.when.bit !== undefined, hasEq = v.when.equals !== undefined;
+          if (hasBit === hasEq) throw new Error(`${params['@id']}: variant of ${base} needs exactly one of when.bit / when.equals`);
+          if (hasBit && !(Number.isInteger(v.when.bit) && v.when.bit >= 0 && v.when.bit <= 31)) {
+            throw new Error(`${params['@id']}: when.bit must be an integer in 0..31`);
+          }
+        }
+      }
+    }
+    this.chain = params ?? null;
+  }
+
+  // Register a proof-of-work hash by the name a chain's `powHash` uses.
+  // fn(encodedHeaderBytes, headerObject) -> display-order hex.
+  registerPowHash(name, fn) { this.powHashes.set(name, fn); }
+
+  // A chain may declare, per base structure, variants selected by a predicate
+  // on a leading field: `structVariants: { "btc:BlockHeader": [ { when: {field, bit|equals}, struct } ] }`.
+  // The predicate is evaluated on the raw wire value when decoding and on the
+  // object's field when encoding, so both directions agree. The bit test is
+  // on the unsigned view, so `bit: 31` works for an i32le field too.
+  #variants(def) { return this.chain?.structVariants?.[def['@id']] ?? null; }
+  #predicate(when, value) {
+    if (value === undefined) return false;
+    if (when.bit !== undefined) return ((value >>> 0) & (2 ** when.bit)) !== 0;
+    return value === when.equals;
+  }
+  #pickVariant(def, r) {
+    const variants = this.#variants(def);
+    if (!variants) return null;
+    const start = r.pos;
+    const seen = Object.create(null); // field labels come from overlays: no prototype surprises
+    for (const f of def.fields) {
+      seen[f.label] = this.#readField(f, r, seen);
+      const hit = variants.find((v) => v.when.field === f.label && this.#predicate(v.when, seen[f.label]));
+      if (hit) { r.pos = start; return hit; }
+      if (variants.every((v) => Object.hasOwn(seen, v.when.field))) break;
+    }
+    r.pos = start;
+    return null;
+  }
+  #pickVariantForObject(def, obj) {
+    const variants = this.#variants(def);
+    return variants?.find((v) => this.#predicate(v.when, obj[v.when.field])) ?? null;
+  }
+
+  def(typeName) {
+    const def = this.types.get(typeName);
+    if (!def) throw new Error(`unknown type: ${typeName}`);
+    return def;
+  }
+
+  // ---- decode ----
+
+  decode(typeName, bytesOrHex, opts = {}) {
+    const bytes = typeof bytesOrHex === 'string' ? hexToBytes(bytesOrHex) : bytesOrHex;
+    const r = new Reader(bytes);
+    const obj = this.#readStruct(typeName, r, opts);
+    if (r.pos !== bytes.length) throw new Error(`${bytes.length - r.pos} trailing bytes after ${typeName}`);
+    return obj;
+  }
+
+  #readStruct(typeName, r, opts = {}) {
+    const def = this.def(typeName);
+    const variant = this.#pickVariant(def, r);
+    if (variant) return this.#readStruct(shortId(variant.struct), r, opts);
+    const obj = {};
+    let segwit = opts.legacy ? false : null;
+    for (const f of def.fields) {
+      if (f.presentIf === 'segwit') {
+        if (segwit === null) segwit = r.peek() === 0x00;
+        if (!segwit) continue;
+      }
+      if (f.optionalTrailing && r.pos >= r.bytes.length) continue;
+      const v = this.#readField(f, r, obj);
+      if (f.constValue !== undefined) {
+        if (v !== f.constValue) throw new Error(`${typeName}.${f.label}: expected ${f.constValue}, got ${v}`);
+        continue; // marker/flag are serialization artifacts, not data
+      }
+      obj[f.label] = v;
+    }
+    const derive = this.derived.get(def['@id']);
+    if (!derive) return obj;
+    const extra = derive(obj);
+    for (const k of Object.keys(extra)) {
+      if (def.fields.some((f) => f.label === k)) throw new Error(`${def['@id']}: derived field ${k} collides with a consensus field`);
+    }
+    return Object.assign(obj, extra);
+  }
+
+  #readField(f, r, obj) {
+    switch (f.wireType) {
+      case 'u8': return r.u8();
+      case 'u16le': return r.u16le();
+      case 'u16be': return r.u16be();
+      case 'u32le': return r.u32le();
+      case 'i32le': return r.i32le();
+      case 'i64le': return r.i64le();
+      case 'u64le': return r.u64le();
+      case 'varint': return r.varint();
+      case 'hash256': return reverseHex(r.take(32));
+      case 'varbytes': return bytesToHex(r.take(r.varint()));
+      case 'bytes': return bytesToHex(r.take(f.wireSize));
+      case 'ascii': {
+        const raw = r.take(f.wireSize);
+        let end = raw.length;
+        while (end > 0 && raw[end - 1] === 0) end--;
+        return new TextDecoder().decode(raw.subarray(0, end));
+      }
+      case 'varstr': return new TextDecoder().decode(r.take(r.varint()));
+      case 'struct': return this.#readStruct(shortId(f.structType), r);
+      case 'vec': {
+        const n = r.varint();
+        const out = [];
+        for (let i = 0; i < n; i++) out.push(this.#readItem(f.itemType, r));
+        return out;
+      }
+      case 'witness': {
+        const out = [];
+        for (let i = 0; i < obj.inputs.length; i++) {
+          const items = r.varint();
+          const stack = [];
+          for (let j = 0; j < items; j++) stack.push(bytesToHex(r.take(r.varint())));
+          out.push(stack);
+        }
+        return out;
+      }
+      default: throw new Error(`unknown wireType: ${f.wireType}`);
+    }
+  }
+
+  #readItem(itemType, r) {
+    if (itemType === 'varbytes') return bytesToHex(r.take(r.varint()));
+    if (itemType === 'hash256') return reverseHex(r.take(32));
+    return this.#readStruct(shortId(itemType), r);
+  }
+
+  // ---- encode ----
+
+  encode(typeName, obj, opts = {}) {
+    const w = new Writer();
+    this.#writeStruct(typeName, obj, w, opts);
+    return w.out();
+  }
+
+  encodeHex(typeName, obj, opts = {}) { return bytesToHex(this.encode(typeName, obj, opts)); }
+
+  #writeStruct(typeName, obj, w, opts = {}) {
+    const def = this.def(typeName);
+    const variant = this.#pickVariantForObject(def, obj);
+    if (variant) return this.#writeStruct(shortId(variant.struct), obj, w, opts);
+    const segwit = !opts.legacy && Array.isArray(obj.witness) && obj.witness.some((s) => s.length > 0);
+    for (const f of def.fields) {
+      if (f.presentIf === 'segwit' && !segwit) continue;
+      if (f.optionalTrailing && obj[f.label] === undefined) continue;
+      this.#writeField(f, f.constValue !== undefined ? f.constValue : obj[f.label], w);
+    }
+  }
+
+  #writeField(f, v, w) {
+    switch (f.wireType) {
+      case 'u8': return w.u8(v);
+      case 'u16le': return w.u16le(v);
+      case 'u16be': return w.u16be(v);
+      case 'u32le': return w.u32le(v);
+      case 'i32le': return w.i32le(v);
+      case 'i64le': return w.i64le(v);
+      case 'u64le': return w.u64le(v);
+      case 'varint': return w.varint(v);
+      case 'hash256': return w.bytes(hexToBytes(v).reverse());
+      case 'bytes': {
+        const b = hexToBytes(v);
+        if (b.length !== f.wireSize) throw new Error(`${f.label}: expected ${f.wireSize} bytes`);
+        return w.bytes(b);
+      }
+      case 'ascii': {
+        const b = new Uint8Array(f.wireSize);
+        b.set(new TextEncoder().encode(v).subarray(0, f.wireSize));
+        return w.bytes(b);
+      }
+      case 'varstr': {
+        const b = new TextEncoder().encode(v);
+        w.varint(b.length);
+        return w.bytes(b);
+      }
+      case 'varbytes': { const b = hexToBytes(v); w.varint(b.length); return w.bytes(b); }
+      case 'struct': return this.#writeStruct(shortId(f.structType), v, w);
+      case 'vec': {
+        w.varint(v.length);
+        for (const item of v) this.#writeItem(f.itemType, item, w);
+        return;
+      }
+      case 'witness': {
+        for (const stack of v) {
+          w.varint(stack.length);
+          for (const item of stack) { const b = hexToBytes(item); w.varint(b.length); w.bytes(b); }
+        }
+        return;
+      }
+      default: throw new Error(`unknown wireType: ${f.wireType}`);
+    }
+  }
+
+  #writeItem(itemType, v, w) {
+    if (itemType === 'varbytes') { const b = hexToBytes(v); w.varint(b.length); return w.bytes(b); }
+    if (itemType === 'hash256') return w.bytes(hexToBytes(v).reverse());
+    return this.#writeStruct(shortId(itemType), v, w);
+  }
+
+  // ---- derived fields (implementations of the schema's `derivation` formulas) ----
+
+  txid(tx) { return reverseHex(dsha256(this.encode('Transaction', tx, { legacy: true }))); }
+  wtxid(tx) { return reverseHex(dsha256(this.encode('Transaction', tx))); }
+  // The chain's proof-of-work hash over the encoded header (default SHA256d).
+  blockHash(header) {
+    const name = this.chain?.powHash ?? 'sha256d';
+    const fn = this.powHashes.get(name);
+    if (!fn) throw new Error(`proof-of-work hash not registered: ${name}`);
+    return fn(this.encode('BlockHeader', header), header);
+  }
+  txSize(tx) { return this.encode('Transaction', tx).length; }
+  txWeight(tx) {
+    return 3 * this.encode('Transaction', tx, { legacy: true }).length + this.encode('Transaction', tx).length;
+  }
+  txVsize(tx) { return Math.ceil(this.txWeight(tx) / 4); }
+
+  // Merkle root over display-order txids (BIP 98 duplicate-last for odd levels).
+  merkleRoot(txids) {
+    let level = txids.map((id) => hexToBytes(id).reverse());
+    while (level.length > 1) {
+      const next = [];
+      for (let i = 0; i < level.length; i += 2) {
+        const a = level[i];
+        const b = level[i + 1] ?? a;
+        const cat = new Uint8Array(64);
+        cat.set(a); cat.set(b, 32);
+        next.push(dsha256(cat));
+      }
+      level = next;
+    }
+    return reverseHex(level[0]);
+  }
+
+  // Expand compact nBits to a 256-bit target (as BigInt).
+  expandCompact(bits) {
+    const exponent = bits >>> 24;
+    const mantissa = BigInt(bits & 0x007fffff);
+    return exponent <= 3 ? mantissa >> (8n * BigInt(3 - exponent)) : mantissa << (8n * BigInt(exponent - 3));
+  }
+
+  checkProofOfWork(header) {
+    return BigInt('0x' + this.blockHash(header)) <= this.expandCompact(header.bits);
+  }
+}
diff --git a/vendor/sidestr/schema/codec/hash.js b/vendor/sidestr/schema/codec/hash.js
new file mode 100644
index 0000000..947f37b
--- /dev/null
+++ b/vendor/sidestr/schema/codec/hash.js
@@ -0,0 +1,295 @@
+// Pure-JS SHA-256 and Bitcoin hash helpers. Zero dependencies, works in
+// browsers and Node alike. Operates on Uint8Array.
+
+const K = new Uint32Array([
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+
+const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+
+// Optional SHA-256 backend (e.g. native node:crypto / WebCrypto / WASM) injected
+// by performance-sensitive callers; null = the pure-JS path below. Keeps this
+// module zero-dependency: the engine never imports an accelerated hasher, the
+// caller supplies one. Must return a 32-byte Uint8Array byte-identical to the
+// pure-JS implementation (callers gate on a consensus-equivalence proof).
+let __sha256Backend = null;
+export function setSha256Backend(fn) { __sha256Backend = fn; }
+
+export function sha256(data) {
+  if (__sha256Backend) return __sha256Backend(data);
+  const len = data.length;
+  const bitLen = len * 8;
+  const padded = new Uint8Array((((len + 8) >> 6) + 1) << 6);
+  padded.set(data);
+  padded[len] = 0x80;
+  const dv = new DataView(padded.buffer);
+  dv.setUint32(padded.length - 8, Math.floor(bitLen / 0x100000000));
+  dv.setUint32(padded.length - 4, bitLen >>> 0);
+
+  const h = new Uint32Array([
+    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+    0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+  ]);
+  const w = new Uint32Array(64);
+
+  for (let off = 0; off < padded.length; off += 64) {
+    for (let i = 0; i < 16; i++) w[i] = dv.getUint32(off + i * 4);
+    for (let i = 16; i < 64; i++) {
+      const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+      const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+      w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;
+    }
+    let [a, b, c, d, e, f, g, hh] = h;
+    for (let i = 0; i < 64; i++) {
+      const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+      const ch = (e & f) ^ (~e & g);
+      const t1 = (hh + S1 + ch + K[i] + w[i]) >>> 0;
+      const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+      const maj = (a & b) ^ (a & c) ^ (b & c);
+      const t2 = (S0 + maj) >>> 0;
+      hh = g; g = f; f = e; e = (d + t1) >>> 0;
+      d = c; c = b; b = a; a = (t1 + t2) >>> 0;
+    }
+    h[0] = (h[0] + a) >>> 0; h[1] = (h[1] + b) >>> 0;
+    h[2] = (h[2] + c) >>> 0; h[3] = (h[3] + d) >>> 0;
+    h[4] = (h[4] + e) >>> 0; h[5] = (h[5] + f) >>> 0;
+    h[6] = (h[6] + g) >>> 0; h[7] = (h[7] + hh) >>> 0;
+  }
+
+  const out = new Uint8Array(32);
+  const ov = new DataView(out.buffer);
+  for (let i = 0; i < 8; i++) ov.setUint32(i * 4, h[i]);
+  return out;
+}
+
+// Bitcoin's hash function: double SHA-256.
+export const dsha256 = (data) => sha256(sha256(data));
+
+export function bytesToHex(bytes) {
+  let s = '';
+  for (const b of bytes) s += b.toString(16).padStart(2, '0');
+  return s;
+}
+
+export function hexToBytes(hex) {
+  if (hex.length % 2) throw new Error('odd-length hex');
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.substr(i * 2, 2), 16);
+  return out;
+}
+
+// Internal byte order -> display order (and vice versa).
+export const reverseHex = (bytes) => bytesToHex(Uint8Array.from(bytes).reverse());
+
+// ---- SHA-1 (needed only for OP_SHA1) ----
+export function sha1(data) {
+  const len = data.length, bitLen = len * 8;
+  const padded = new Uint8Array((((len + 8) >> 6) + 1) << 6);
+  padded.set(data); padded[len] = 0x80;
+  const dv = new DataView(padded.buffer);
+  dv.setUint32(padded.length - 8, Math.floor(bitLen / 0x100000000));
+  dv.setUint32(padded.length - 4, bitLen >>> 0);
+  const h = new Uint32Array([0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0]);
+  const w = new Uint32Array(80);
+  const rol = (x, n) => (x << n) | (x >>> (32 - n));
+  for (let off = 0; off < padded.length; off += 64) {
+    for (let i = 0; i < 16; i++) w[i] = dv.getUint32(off + i * 4);
+    for (let i = 16; i < 80; i++) w[i] = rol(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);
+    let [a, b, c, d, e] = h;
+    for (let i = 0; i < 80; i++) {
+      const [f, k] = i < 20 ? [(b & c) | (~b & d), 0x5a827999]
+        : i < 40 ? [b ^ c ^ d, 0x6ed9eba1]
+        : i < 60 ? [(b & c) | (b & d) | (c & d), 0x8f1bbcdc]
+        : [b ^ c ^ d, 0xca62c1d6];
+      const t = (rol(a, 5) + f + e + k + w[i]) >>> 0;
+      e = d; d = c; c = rol(b, 30); b = a; a = t;
+    }
+    h[0] = (h[0] + a) >>> 0; h[1] = (h[1] + b) >>> 0; h[2] = (h[2] + c) >>> 0;
+    h[3] = (h[3] + d) >>> 0; h[4] = (h[4] + e) >>> 0;
+  }
+  const out = new Uint8Array(20);
+  const ov = new DataView(out.buffer);
+  for (let i = 0; i < 5; i++) ov.setUint32(i * 4, h[i]);
+  return out;
+}
+
+// ---- RIPEMD-160 (OP_RIPEMD160, and OP_HASH160 = ripemd160(sha256(x))) ----
+const RL = [
+  0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,
+  7,4,13,1,10,6,15,3,12,0,9,5,2,14,11,8,
+  3,10,14,4,9,15,8,1,2,7,0,6,13,11,5,12,
+  1,9,11,10,0,8,12,4,13,3,7,15,14,5,6,2,
+  4,0,5,9,7,12,2,10,14,1,3,8,11,6,15,13];
+const RR = [
+  5,14,7,0,9,2,11,4,13,6,15,8,1,10,3,12,
+  6,11,3,7,0,13,5,10,14,15,8,12,4,9,1,2,
+  15,5,1,3,7,14,6,9,11,8,12,2,10,0,4,13,
+  8,6,4,1,3,11,15,0,5,12,2,13,9,7,10,14,
+  12,15,10,4,1,5,8,7,6,2,13,14,0,3,9,11];
+const SL = [
+  11,14,15,12,5,8,7,9,11,13,14,15,6,7,9,8,
+  7,6,8,13,11,9,7,15,7,12,15,9,11,7,13,12,
+  11,13,6,7,14,9,13,15,14,8,13,6,5,12,7,5,
+  11,12,14,15,14,15,9,8,9,14,5,6,8,6,5,12,
+  9,15,5,11,6,8,13,12,5,12,13,14,11,8,5,6];
+const SR = [
+  8,9,9,11,13,15,15,5,7,7,8,11,14,14,12,6,
+  9,13,15,7,12,8,9,11,7,7,12,7,6,15,13,11,
+  9,7,15,11,8,6,6,14,12,13,5,14,13,13,7,5,
+  15,5,8,11,14,14,6,14,6,9,12,9,12,5,15,8,
+  8,5,12,9,12,5,14,6,8,13,6,5,15,13,11,11];
+
+export function ripemd160(data) {
+  const len = data.length, bitLen = len * 8;
+  const padded = new Uint8Array((((len + 8) >> 6) + 1) << 6);
+  padded.set(data); padded[len] = 0x80;
+  const dv = new DataView(padded.buffer);
+  dv.setUint32(padded.length - 8, bitLen >>> 0, true);          // little-endian length
+  dv.setUint32(padded.length - 4, Math.floor(bitLen / 0x100000000), true);
+  const h = new Uint32Array([0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0]);
+  const rol = (x, n) => ((x << n) | (x >>> (32 - n))) >>> 0;
+  const F = [
+    (x, y, z) => x ^ y ^ z,
+    (x, y, z) => (x & y) | (~x & z),
+    (x, y, z) => (x | ~y) ^ z,
+    (x, y, z) => (x & z) | (y & ~z),
+    (x, y, z) => x ^ (y | ~z),
+  ];
+  const KL = [0, 0x5a827999, 0x6ed9eba1, 0x8f1bbcdc, 0xa953fd4e];
+  const KR = [0x50a28be6, 0x5c4dd124, 0x6d703ef3, 0x7a6d76e9, 0];
+  for (let off = 0; off < padded.length; off += 64) {
+    const x = new Uint32Array(16);
+    for (let i = 0; i < 16; i++) x[i] = dv.getUint32(off + i * 4, true);
+    let [al, bl, cl, dl, el] = h;
+    let [ar, br, cr, dr, er] = h;
+    for (let j = 0; j < 80; j++) {
+      const round = j >> 4;
+      let t = (al + F[round](bl, cl, dl) + x[RL[j]] + KL[round]) >>> 0;
+      t = (rol(t, SL[j]) + el) >>> 0;
+      al = el; el = dl; dl = rol(cl, 10); cl = bl; bl = t;
+      t = (ar + F[4 - round](br, cr, dr) + x[RR[j]] + KR[round]) >>> 0;
+      t = (rol(t, SR[j]) + er) >>> 0;
+      ar = er; er = dr; dr = rol(cr, 10); cr = br; br = t;
+    }
+    const t = (h[1] + cl + dr) >>> 0;
+    h[1] = (h[2] + dl + er) >>> 0;
+    h[2] = (h[3] + el + ar) >>> 0;
+    h[3] = (h[4] + al + br) >>> 0;
+    h[4] = (h[0] + bl + cr) >>> 0;
+    h[0] = t;
+  }
+  const out = new Uint8Array(20);
+  const ov = new DataView(out.buffer);
+  for (let i = 0; i < 5; i++) ov.setUint32(i * 4, h[i], true);
+  return out;
+}
+
+export const hash160 = (data) => ripemd160(sha256(data));
+
+// BIP 340 tagged hash: sha256(sha256(tag) || sha256(tag) || msg).
+const tagMidstates = new Map();
+export function taggedHash(tag, ...chunks) {
+  let pre = tagMidstates.get(tag);
+  if (!pre) {
+    const th = sha256(new TextEncoder().encode(tag));
+    pre = new Uint8Array(64); pre.set(th); pre.set(th, 32);
+    tagMidstates.set(tag, pre);
+  }
+  const len = chunks.reduce((s, c) => s + c.length, 64);
+  const buf = new Uint8Array(len);
+  buf.set(pre);
+  let p = 64;
+  for (const c of chunks) { buf.set(c, p); p += c.length; }
+  return sha256(buf);
+}
+
+// ---- SHA-512 + HMAC-SHA512 (BIP 32 key derivation) ----
+// Round constants are the fractional parts of cube/square roots of the
+// first primes — generated here with integer Newton iterations rather
+// than hardcoding 80 magic numbers.
+const M64 = (1n << 64n) - 1n;
+
+function primes(n) {
+  const out = [];
+  for (let c = 2; out.length < n; c++) {
+    if (out.every((p) => c % p)) out.push(c);
+  }
+  return out;
+}
+function isqrt(n) {
+  let x = n, y = (x + 1n) >> 1n;
+  while (y < x) { x = y; y = (x + n / x) >> 1n; }
+  return x;
+}
+function icbrt(n) {
+  let x = 1n << BigInt(Math.ceil(n.toString(2).length / 3) + 1);
+  for (;;) {
+    const y = (2n * x + n / (x * x)) / 3n;
+    if (y >= x) return x;
+    x = y;
+  }
+}
+const P80 = primes(80).map(BigInt);
+const K512 = P80.map((p) => icbrt(p << 192n) & M64);
+const H512 = P80.slice(0, 8).map((p) => isqrt(p << 128n) & M64);
+
+const rotr64 = (x, n) => ((x >> n) | (x << (64n - n))) & M64;
+
+export function sha512(data) {
+  const len = data.length;
+  const padded = new Uint8Array((((len + 16) >> 7) + 1) << 7);
+  padded.set(data);
+  padded[len] = 0x80;
+  const dv = new DataView(padded.buffer);
+  const bitLen = BigInt(len) * 8n;
+  dv.setBigUint64(padded.length - 8, bitLen & M64);
+  dv.setBigUint64(padded.length - 16, bitLen >> 64n);
+
+  const h = [...H512];
+  const w = new Array(80);
+  for (let off = 0; off < padded.length; off += 128) {
+    for (let i = 0; i < 16; i++) w[i] = dv.getBigUint64(off + i * 8);
+    for (let i = 16; i < 80; i++) {
+      const s0 = rotr64(w[i - 15], 1n) ^ rotr64(w[i - 15], 8n) ^ (w[i - 15] >> 7n);
+      const s1 = rotr64(w[i - 2], 19n) ^ rotr64(w[i - 2], 61n) ^ (w[i - 2] >> 6n);
+      w[i] = (w[i - 16] + s0 + w[i - 7] + s1) & M64;
+    }
+    let [a, b, c, d, e, f, g, hh] = h;
+    for (let i = 0; i < 80; i++) {
+      const S1 = rotr64(e, 14n) ^ rotr64(e, 18n) ^ rotr64(e, 41n);
+      const ch = (e & f) ^ (~e & g & M64);
+      const t1 = (hh + S1 + ch + K512[i] + w[i]) & M64;
+      const S0 = rotr64(a, 28n) ^ rotr64(a, 34n) ^ rotr64(a, 39n);
+      const maj = (a & b) ^ (a & c) ^ (b & c);
+      const t2 = (S0 + maj) & M64;
+      hh = g; g = f; f = e; e = (d + t1) & M64;
+      d = c; c = b; b = a; a = (t1 + t2) & M64;
+    }
+    h[0] = (h[0] + a) & M64; h[1] = (h[1] + b) & M64; h[2] = (h[2] + c) & M64; h[3] = (h[3] + d) & M64;
+    h[4] = (h[4] + e) & M64; h[5] = (h[5] + f) & M64; h[6] = (h[6] + g) & M64; h[7] = (h[7] + hh) & M64;
+  }
+  const out = new Uint8Array(64);
+  const ov = new DataView(out.buffer);
+  for (let i = 0; i < 8; i++) ov.setBigUint64(i * 8, h[i]);
+  return out;
+}
+
+export function hmacSha512(key, data) {
+  if (key.length > 128) key = sha512(key);
+  const ipad = new Uint8Array(128 + data.length);
+  const opad = new Uint8Array(128 + 64);
+  for (let i = 0; i < 128; i++) {
+    ipad[i] = (key[i] ?? 0) ^ 0x36;
+    opad[i] = (key[i] ?? 0) ^ 0x5c;
+  }
+  ipad.set(data, 128);
+  opad.set(sha512(ipad), 128);
+  return sha512(opad);
+}
diff --git a/vendor/sidestr/schema/codec/headers.js b/vendor/sidestr/schema/codec/headers.js
new file mode 100644
index 0000000..04f93a2
--- /dev/null
+++ b/vendor/sidestr/schema/codec/headers.js
@@ -0,0 +1,223 @@
+// Schema-driven header chain engine.
+//
+// Executes the `header` phase ruleset from schema/validate.jsonld against
+// decoded BlockHeader objects, with network parameters from schema/chain.jsonld.
+// Rule order, identity, and error codes come from the schema; this file holds
+// only the pure check implementations the rule IDs bind to (Hornet-style:
+// one invariant per rule, no side effects, typed errors).
+//
+// A check returns true (pass), false (fail -> the rule's errorCode), or
+// null (insufficient context to evaluate; reported as skipped).
+
+export class HeaderEngine {
+  constructor(codec, params, ruleSet) {
+    this.codec = codec;
+    this.params = params;
+    this.ruleSet = ruleSet;
+    this.powLimit = BigInt('0x' + params.powLimit);
+    this.interval = params.difficultyAdjustmentInterval;
+    // Consensus-critical chain params are validated here, once, so a typo or a
+    // malformed overlay fails at construction rather than changing verdicts.
+    const id = params['@id'] ?? params.name ?? 'chain';
+    if (params.retargetSeed !== undefined && !['first', 'last'].includes(params.retargetSeed)) {
+      throw new Error(`${id}: retargetSeed must be 'first' or 'last', got ${JSON.stringify(params.retargetSeed)}`);
+    }
+    if (params.targetAdjustments !== undefined) {
+      if (!Array.isArray(params.targetAdjustments)) throw new Error(`${id}: targetAdjustments must be an array of {height, shiftLeft}`);
+      for (const a of params.targetAdjustments) {
+        if (!Number.isInteger(a?.height) || a.height < 0 || !Number.isInteger(a?.shiftLeft) || a.shiftLeft < 0 || a.shiftLeft > 255) {
+          throw new Error(`${id}: targetAdjustments entries need an integer height >= 0 and shiftLeft in 0..255, got ${JSON.stringify(a)}`);
+        }
+      }
+    }
+
+    this.checks = {
+      'btc:rule-header-prev-link': (ctx) =>
+        ctx.prev == null ? null : ctx.header.prevBlockHash === this.codec.blockHash(ctx.prev),
+      'btc:rule-header-pow': (ctx) =>
+        this.codec.checkProofOfWork(ctx.header),
+      'btc:rule-header-difficulty': (ctx) => {
+        if (ctx.prev == null) return null;
+        const expected = this.expectedBits(ctx.prev, ctx.height - 1, ctx.epochFirst,
+          { header: ctx.header, chainAt: ctx.chainAt });
+        return expected == null ? null : ctx.header.bits === expected;
+      },
+      'btc:rule-header-mtp': (ctx) => {
+        // a window truncated by storage limits (e.g. just after a sync
+        // checkpoint) yields a wrong median — skip rather than misjudge
+        const need = Math.min(11, ctx.height ?? 11);
+        if (!ctx.mtpWindow || ctx.mtpWindow.length < need) return null;
+        return ctx.header.time > this.medianTimePast(ctx.mtpWindow);
+      },
+      'btc:rule-header-time-future': (ctx) =>
+        ctx.now == null ? null : ctx.header.time <= ctx.now + this.params.maxFutureBlockTime,
+      'btc:rule-header-timewarp': (ctx) => {
+        if (!this.params.timewarpFix) return null;
+        if (ctx.height == null || ctx.prev == null) return null;
+        if (ctx.height % this.interval !== 0) return true; // only epoch-first blocks
+        return ctx.header.time >= ctx.prev.time - this.params.maxTimewarp;
+      },
+      'btc:rule-header-version': (ctx) => {
+        if (ctx.height == null) return null;
+        const p = this.params;
+        const min = ctx.height >= p.bip65Height ? 4
+          : ctx.height >= p.bip66Height ? 3
+          : ctx.height >= p.bip34Height ? 2 : 1;
+        return ctx.header.version >= min;
+      },
+    };
+  }
+
+  static fromSchemas(codec, chainSchema, validateSchema, network = 'btc:mainnet') {
+    const params = chainSchema['@graph'].find((n) => n['@id'] === network);
+    if (!params) throw new Error(`unknown network: ${network}`);
+    codec.setChainParams?.(params); // variants + PoW hash follow the chain
+    const ruleSet = validateSchema['@graph'].find((n) => n['@type'] === 'RuleSet' && n.phase === 'header');
+    return new HeaderEngine(codec, params, ruleSet);
+  }
+
+  // ---- consensus arithmetic ----
+
+  // Expected work to find a block at this target: 2^256 / (target + 1).
+  work(header) {
+    return (1n << 256n) / (this.codec.expandCompact(header.bits) + 1n);
+  }
+
+  // Median of the last (up to) 11 block timestamps.
+  medianTimePast(window) {
+    const times = window.slice(-11).map((h) => h.time).sort((a, b) => a - b);
+    return times[times.length >> 1];
+  }
+
+  // Compact-encode a 256-bit target (inverse of expandCompact), matching
+  // Bitcoin Core's arith_uint256::GetCompact mantissa truncation.
+  compactFromTarget(target) {
+    let size = Math.ceil(target.toString(16).length / 2);
+    let compact = size <= 3
+      ? Number(target << (8n * BigInt(3 - size)))
+      : Number(target >> (8n * BigInt(size - 3)));
+    if (compact & 0x800000) { compact >>= 8; size++; }
+    return (compact | (size << 24)) >>> 0;
+  }
+
+  // The bits required of the block following `prev` at height prevHeight.
+  // Within an epoch: unchanged — except on min-difficulty networks, where a
+  // 20-minute gap permits powLimit bits and otherwise the difficulty is that
+  // of the last real-difficulty block (the walk-back needs opts.chainAt; if
+  // unavailable, returns null to skip honestly). At a boundary: retargeted
+  // from the previous epoch's timespan, based on the epoch-first block's
+  // bits under BIP 94 (timewarpFix) and the last block's otherwise.
+  expectedBits(prev, prevHeight, epochFirst, opts = {}) {
+    if (this.params.powNoRetargeting) return prev.bits;
+    const height = prevHeight + 1;
+    const boundary = height % this.interval === 0;
+    if (!boundary && this.params.allowMinDifficultyBlocks) {
+      const powBits = this.compactFromTarget(this.powLimit);
+      if (opts.header && opts.header.time > prev.time + 2 * this.params.targetSpacing) {
+        return powBits; // the minimum-difficulty exception: no adjustment applies (Core returns here)
+      }
+      let h = prevHeight, hdr = prev;
+      while (h % this.interval !== 0 && hdr.bits === powBits) {
+        const back = opts.chainAt?.(h - 1);
+        if (!back) return null; // walk-back context exhausted
+        h--; hdr = back;
+      }
+      return this.adjustAt(height, hdr.bits);
+    }
+    if (!boundary) return this.adjustAt(height, prev.bits);
+    if (epochFirst == null) return null;
+    // Retarget seed: Bitcoin scales the last block's bits; BIP 94 (testnet4)
+    // the first block of the period's, so a min-difficulty last block cannot
+    // reset the difficulty. Explicit as `retargetSeed`, defaulting from timewarpFix.
+    const seed = this.params.retargetSeed ?? (this.params.timewarpFix ? 'first' : 'last');
+    const base = seed === 'first' ? epochFirst.bits : prev.bits;
+    return this.adjustAt(height, this.retarget(epochFirst.time, prev.time, base));
+  }
+
+  // A chain may declare one-off target adjustments, `targetAdjustments:
+  // [{ height, shiftLeft }]`: at exactly that height the expected target is
+  // eased by 2^shiftLeft, clamped at powLimit (a proof-of-work change's first
+  // block, e.g. Knots' ApplyBlake2bTargetShift). Absent on Bitcoin chains.
+  adjustAt(height, bits) {
+    const adj = this.params.targetAdjustments?.find((a) => a.height === height);
+    if (!adj || bits == null) return bits;
+    const target = this.codec.expandCompact(bits);
+    const shifted = target > (this.powLimit >> BigInt(adj.shiftLeft)) ? this.powLimit : target << BigInt(adj.shiftLeft);
+    return this.compactFromTarget(shifted);
+  }
+
+  retarget(firstTime, lastTime, baseBits) {
+    const span = this.params.targetTimespan;
+    const actual = Math.max(span / 4, Math.min(lastTime - firstTime, span * 4));
+    let target = this.codec.expandCompact(baseBits) * BigInt(actual) / BigInt(span);
+    if (target > this.powLimit) target = this.powLimit;
+    return this.compactFromTarget(target);
+  }
+
+  // ---- ruleset execution ----
+
+  // Overlay rules bind their checks here, keyed by rule @id.
+  registerChecks(map) { Object.assign(this.checks, map); }
+
+  validateHeader(ctx) {
+    const results = this.ruleSet.rules.map((rule) => {
+      const check = this.checks[rule['@id']];
+      if (!check) throw new Error(`no check registered for ${rule['@id']}`);
+      const gated = rule.activationParam && ctx.height != null && ctx.height < this.params[rule.activationParam];
+      const outcome = gated ? null : check(ctx);
+      return {
+        rule: rule['@id'],
+        label: rule.label,
+        ok: outcome,
+        error: outcome === false ? rule.errorCode : null,
+      };
+    });
+    return { ok: results.every((r) => r.ok !== false), results };
+  }
+
+  // Validate consecutive headers starting at startHeight.
+  //   prevContext: up to 11 decoded headers immediately preceding headers[0]
+  //   epochFirsts: {height: header} for epoch-first headers needed at
+  //                retarget boundaries that fall before the window
+  //   now: unix time for the future-time rule (null to skip)
+  validateChain(headers, { startHeight, prevContext = [], epochFirsts = {}, now = null, ...extra }) {
+    const all = [...prevContext, ...headers];
+    const firstIndex = prevContext.length;
+    const heightOf = (i) => startHeight - prevContext.length + i;
+    let chainWork = 0n;
+
+    return headers.map((header, k) => {
+      const i = firstIndex + k;
+      const height = startHeight + k;
+      const boundaryFirst = height % this.interval === 0 ? height - this.interval : null;
+      const inWindow = boundaryFirst != null && boundaryFirst >= heightOf(0)
+        ? all[boundaryFirst - heightOf(0)]
+        : null;
+      const chainAt = (h) => {
+        const idx = h - heightOf(0);
+        if (idx >= 0 && idx < i) return all[idx];
+        return epochFirsts[h] ?? extra.chainAt?.(h) ?? null;
+      };
+      const ctx = {
+        header,
+        height,
+        prev: i > 0 ? all[i - 1] : null,
+        mtpWindow: all.slice(Math.max(0, i - 11), i),
+        epochFirst: inWindow ?? epochFirsts[boundaryFirst]
+          ?? (boundaryFirst != null ? extra.chainAt?.(boundaryFirst) : null) ?? null,
+        chainAt,
+        now,
+      };
+      const verdict = this.validateHeader(ctx);
+      chainWork += this.work(header);
+      return {
+        height,
+        hash: this.codec.blockHash(header),
+        time: header.time,
+        bits: header.bits,
+        chainWork,
+        ...verdict,
+      };
+    });
+  }
+}
diff --git a/vendor/sidestr/schema/codec/interpreter.js b/vendor/sidestr/schema/codec/interpreter.js
new file mode 100644
index 0000000..06103be
--- /dev/null
+++ b/vendor/sidestr/schema/codec/interpreter.js
@@ -0,0 +1,939 @@
+// Bitcoin script interpreter, Hornet-style: each opcode is a self-contained
+// handler (contrast Bitcoin Core's ~1,500-line EvalScript), keyed by the
+// opcode names of the schema's Opcode enumeration, with execution limits
+// taken from the schema's scriptLimits instance.
+//
+// Supported spend paths: p2pk, p2pkh, bare multisig, p2sh (including
+// wrapped segwit), p2wpkh, p2wsh — with legacy and BIP 143 sighash and
+// real ECDSA verification. OP_CODESEPARATOR truncates the legacy/segwit-v0
+// sighash scriptCode at the last executed separator (Core's pbegincodehash).
+// verifyInput follows Core's VerifyScript, including the BIP 141 structural
+// rules (witness program shape and length, malleated scriptSig, unexpected
+// witness, 520-byte witness elements). Unknown witness versions return
+// ok:null rather than Core's "success", by design.
+// Legacy (pre-segwit) sighash follows Core exactly: every OP_CODESEPARATOR is
+// dropped from the serialized scriptCode, and CHECKSIG/CHECKMULTISIG first
+// FindAndDelete the signature push(es) from it (SCRIPT_VERIFY_CONST_SCRIPTCODE
+// turns both into failures). Known simplification, accepted for now: the
+// tapscript codeseparator position (BIP 342) is not yet committed in the
+// BIP 341 message.
+
+import { sha256, dsha256, sha1, ripemd160, hash160, bytesToHex, hexToBytes, taggedHash } from './hash.js';
+import { parsePubkey, parseDerSignature, verifyEcdsa, verifySchnorr, checkTapTweak, N } from './secp256k1.js';
+
+class ScriptError extends Error {}
+const fail = (msg) => { throw new ScriptError(msg); };
+
+// CScriptNum: little-endian, sign bit in the high bit of the last byte.
+export function numDecode(bytes, maxLen = 4, requireMinimal = false) {
+  if (bytes.length > maxLen) fail('scriptnum overflow');
+  // BIP 62 minimal scriptnum (SCRIPT_VERIFY_MINIMALDATA): no trailing zero
+  // byte unless it sets the sign bit of the previous byte.
+  if (requireMinimal && bytes.length > 0
+      && (bytes[bytes.length - 1] & 0x7f) === 0
+      && (bytes.length <= 1 || (bytes[bytes.length - 2] & 0x80) === 0)) {
+    fail('non-minimal scriptnum');
+  }
+  if (bytes.length === 0) return 0;
+  let n = 0;
+  for (let i = 0; i < bytes.length; i++) n += bytes[i] * 2 ** (8 * i);
+  if (bytes[bytes.length - 1] & 0x80) n = -(n - 2 ** (8 * bytes.length - 1));
+  return n;
+}
+
+export function numEncode(n) {
+  if (n === 0) return new Uint8Array(0);
+  const neg = n < 0;
+  let abs = Math.abs(n);
+  const bytes = [];
+  while (abs > 0) { bytes.push(abs % 256); abs = Math.floor(abs / 256); }
+  if (bytes[bytes.length - 1] & 0x80) bytes.push(neg ? 0x80 : 0x00);
+  else if (neg) bytes[bytes.length - 1] |= 0x80;
+  return Uint8Array.from(bytes);
+}
+
+const truthy = (bytes) => {
+  for (let i = 0; i < bytes.length; i++) {
+    if (bytes[i] !== 0) return !(i === bytes.length - 1 && bytes[i] === 0x80); // negative zero
+  }
+  return false;
+};
+const boolBytes = (b) => (b ? Uint8Array.of(1) : new Uint8Array(0));
+const eq = (a, b) => a.length === b.length && a.every((v, i) => v === b[i]);
+// BIP 141 IsWitnessProgram: 4..42 bytes, OP_0 or OP_1..OP_16, then a single
+// direct push of exactly the rest. A PUSHDATA-encoded program is not a program.
+function witnessProgram(scriptHex) {
+  const b = hexToBytes(scriptHex);
+  if (b.length < 4 || b.length > 42) return null;
+  if (b[0] !== 0x00 && (b[0] < 0x51 || b[0] > 0x60)) return null;
+  if (b[1] + 2 !== b.length) return null;
+  return { version: b[0] === 0x00 ? 0 : b[0] - 0x50, program: bytesToHex(b.subarray(2)) };
+}
+// Core's SigVersion::BASE: the pre-segwit sighash rules (callers that omit
+// sigVersion get legacy semantics throughout this file).
+const isLegacy = (sigVersion) => sigVersion !== 'witnessV0' && sigVersion !== 'tapscript';
+
+// ---- byte-level script walking, for the two legacy-sighash quirks ----
+// End offset of the op starting at `pos`, or -1 when the push is truncated
+// (Core's CScript::GetOp failing).
+function opEnd(bytes, pos) {
+  const op = bytes[pos];
+  let len = 0, hdr = 1;
+  if (op < 0x4c) len = op;
+  else if (op === 0x4c) { if (pos + 2 > bytes.length) return -1; len = bytes[pos + 1]; hdr = 2; }
+  else if (op === 0x4d) { if (pos + 3 > bytes.length) return -1; len = bytes[pos + 1] | (bytes[pos + 2] << 8); hdr = 3; }
+  else if (op === 0x4e) { if (pos + 5 > bytes.length) return -1; len = (bytes[pos + 1] | (bytes[pos + 2] << 8) | (bytes[pos + 3] << 16) | (bytes[pos + 4] << 24)) >>> 0; hdr = 5; }
+  const end = pos + hdr + len;
+  return end > bytes.length ? -1 : end;
+}
+// CScript() << vector: the push encoding Core uses for a signature element.
+function pushEncode(data) {
+  const n = data.length;
+  const head = n < 0x4c ? [n] : n <= 0xff ? [0x4c, n] : n <= 0xffff ? [0x4d, n & 0xff, n >> 8]
+    : [0x4e, n & 0xff, (n >> 8) & 0xff, (n >> 16) & 0xff, (n >>> 24) & 0xff];
+  return Uint8Array.from([...head, ...data]);
+}
+// Core's FindAndDelete: at every opcode boundary, delete each consecutive
+// occurrence of `needle`; returns {script, found}.
+export function findAndDelete(script, needle) {
+  if (!needle.length) return { script, found: 0 };
+  const out = []; let found = 0, pc = 0, pc2 = 0;
+  do {
+    for (let i = pc2; i < pc; i++) out.push(script[i]);
+    while (script.length - pc >= needle.length && eq(script.subarray(pc, pc + needle.length), needle)) { pc += needle.length; found++; }
+    pc2 = pc;
+    if (pc >= script.length) break;
+    pc = opEnd(script, pc);
+  } while (pc !== -1);
+  if (!found) return { script, found: 0 };
+  for (let i = pc2; i < script.length; i++) out.push(script[i]);
+  return { script: Uint8Array.from(out), found };
+}
+// Core's CTransactionSignatureSerializer::SerializeScriptCode: the legacy
+// sighash commits to scriptCode with every OP_CODESEPARATOR removed. On a
+// malformed trailing push (GetOp fails) the remainder is emitted verbatim.
+// (Core also keeps the pre-strip length in the size prefix in that case; a
+// scriptCode ending in a truncated push cannot execute to completion, so the
+// resulting digest never decides validity and the difference is not modelled.)
+export function stripCodeSeparators(script) {
+  const out = []; let pc = 0;
+  while (pc < script.length) {
+    const end = opEnd(script, pc);
+    if (end === -1) { for (let i = pc; i < script.length; i++) out.push(script[i]); break; }
+    if (script[pc] !== 0xab) for (let i = pc; i < end; i++) out.push(script[i]);
+    pc = end;
+  }
+  return Uint8Array.from(out);
+}
+
+// Bitcoin CompactSize (1/3/5/9 bytes), matching the codec's varint writer.
+// Used for the script-length prefix in the BIP341 TapLeaf hash; tapscripts can
+// exceed 65,535 bytes (large inscriptions), so the 0xfe 4-byte case is required.
+export function compactSize(n) {
+  if (n < 0xfd) return Uint8Array.of(n);
+  if (n <= 0xffff) return Uint8Array.of(0xfd, n & 0xff, (n >>> 8) & 0xff);
+  if (n <= 0xffffffff) return Uint8Array.of(0xfe, n & 0xff, (n >>> 8) & 0xff, (n >>> 16) & 0xff, (n >>> 24) & 0xff);
+  const b = new Uint8Array(9); b[0] = 0xff; new DataView(b.buffer).setBigUint64(1, BigInt(n), true); return b;
+}
+
+const DEFAULT_LIMITS = {
+  maxScriptSize: 10000, maxScriptElementSize: 520,
+  maxOpsPerScript: 201, maxStackSize: 1000, maxMultisigKeys: 20,
+};
+
+// BIP 62 minimal-push (SCRIPT_VERIFY_MINIMALDATA): a data push must use the
+// shortest possible encoding. `code` is the push opcode actually used.
+function minimalPushOk(code, dataHex) {
+  const len = dataHex.length / 2;
+  if (len === 0) return code === 0x00;                 // must be OP_0
+  if (len === 1) {
+    const b = parseInt(dataHex.slice(0, 2), 16);
+    if (b >= 1 && b <= 16) return false;               // must be OP_1..OP_16
+    if (b === 0x81) return false;                       // must be OP_1NEGATE
+    return code === 0x01;                               // else a direct 1-byte push
+  }
+  if (len <= 75) return code === len;                   // direct push
+  if (len <= 255) return code === 0x4c;                 // OP_PUSHDATA1
+  if (len <= 65535) return code === 0x4d;               // OP_PUSHDATA2
+  return true;
+}
+
+// ---- signature/pubkey encoding rules, gated by verification flags ----
+// (sig includes its trailing 1-byte hashtype.)
+// BIP 66 strict DER:
+function isValidDerSig(sig) {
+  const len = sig.length;
+  if (len < 9 || len > 73) return false;
+  if (sig[0] !== 0x30 || sig[1] !== len - 3 || sig[2] !== 0x02) return false;
+  const lenR = sig[3];
+  if (5 + lenR >= len) return false;
+  const lenS = sig[5 + lenR];
+  if (lenR + lenS + 7 !== len) return false;
+  if (lenR === 0 || (sig[4] & 0x80)) return false;
+  if (lenR > 1 && sig[4] === 0x00 && !(sig[5] & 0x80)) return false;
+  if (sig[lenR + 4] !== 0x02 || lenS === 0 || (sig[lenR + 6] & 0x80)) return false;
+  if (lenS > 1 && sig[lenR + 6] === 0x00 && !(sig[lenR + 7] & 0x80)) return false;
+  return true;
+}
+// BIP 62 low-S:
+function isLowDerSig(sig) {
+  const p = parseDerSignature(sig.subarray(0, sig.length - 1));
+  return !!p && p.s <= N / 2n;
+}
+// STRICTENC defined hashtype (SIGHASH_ALL/NONE/SINGLE, optionally ANYONECANPAY);
+// where the unified sighash applies, SIGHASH_UNIFIED (0x20) is a defined bit too.
+function isDefinedHashtype(sig, unified = false) {
+  let ht = sig[sig.length - 1] & ~0x80;
+  if (unified) ht &= ~SIGHASH_UNIFIED;
+  return ht >= 1 && ht <= 3;
+}
+
+// Bitcoin Knots' unified opt-in signature hash (doc/unified-sighash.md in
+// v29.4.1.knots20260508): one message for every script type, selected per
+// signature by this bit in the hash type byte. Active from the chain's
+// `unifiedSighashParam` height (the BLAKE2b fork height on the Knots chains).
+export const SIGHASH_UNIFIED = 0x20;
+// Thrown when an opted-in signature is met without every input's prevout:
+// the message commits to all spent amounts and scripts, so it is honestly
+// unverifiable rather than wrong. verifyInput turns it into ok: null.
+class NeedsPrevouts extends Error {}
+// STRICTENC pubkey: compressed (33, 0x02/0x03) or uncompressed (65, 0x04):
+function isPubKeyEnc(pub) {
+  return (pub.length === 33 && (pub[0] === 0x02 || pub[0] === 0x03))
+      || (pub.length === 65 && pub[0] === 0x04);
+}
+
+export class ScriptInterpreter {
+  constructor(codec, scriptEngine, limits = DEFAULT_LIMITS) {
+    this.codec = codec;
+    this.scriptEngine = scriptEngine;
+    this.limits = limits;
+    this.handlers = this.#buildHandlers();
+    // Per-transaction sighash midstate cache (BIP143/BIP341 hashPrevouts,
+    // hashSequence, hashOutputs, etc. depend only on the whole tx, not the input
+    // being signed). Without this, a tx with n segwit/taproot inputs recomputes
+    // these O(n)-sized hashes n times = O(n^2); a 1,400-input consolidation then
+    // takes ~minutes. Keyed by the tx object (WeakMap) so it clears itself.
+    this._sigCache = new WeakMap();
+  }
+
+  #txCache(tx) {
+    let c = this._sigCache.get(tx);
+    if (!c) { c = {}; this._sigCache.set(tx, c); }
+    return c;
+  }
+
+  // ---- sighash ----
+
+  sighashLegacy(tx, inIndex, scriptCodeHex, hashType) {
+    scriptCodeHex = bytesToHex(stripCodeSeparators(hexToBytes(scriptCodeHex)));
+    const anyone = hashType & 0x80;
+    const base = hashType & 0x1f;
+    if (base === 3 && inIndex >= tx.outputs.length) {
+      // historical SIGHASH_SINGLE bug: the "hash" is the number 1
+      const one = new Uint8Array(32); one[0] = 1;
+      return one;
+    }
+    const inputs = (anyone ? [tx.inputs[inIndex]] : tx.inputs).map((inp, i) => ({
+      ...inp,
+      scriptSig: (anyone || i === inIndex) ? scriptCodeHex : '',
+      sequence: (!anyone && (base === 2 || base === 3) && i !== inIndex) ? 0 : inp.sequence,
+    }));
+    const outputs = base === 2 ? []
+      : base === 3 ? tx.outputs.slice(0, inIndex + 1).map((o, i) =>
+          i < inIndex ? { value: -1, scriptPubKey: '' } : o)
+      : tx.outputs;
+    const ser = this.codec.encode('Transaction',
+      { version: tx.version, inputs, outputs, lockTime: tx.lockTime }, { legacy: true });
+    const buf = new Uint8Array(ser.length + 4);
+    buf.set(ser);
+    new DataView(buf.buffer).setUint32(ser.length, hashType, true);
+    return dsha256(buf);
+  }
+
+  sighashWitnessV0(tx, inIndex, scriptCodeHex, amount, hashType) {
+    const anyone = hashType & 0x80;
+    const base = hashType & 0x1f;
+    const zero = new Uint8Array(32);
+    const w = [];
+    const push = (b) => w.push(b);
+    const u32 = (v) => { const b = new Uint8Array(4); new DataView(b.buffer).setUint32(0, v, true); return b; };
+    const i64 = (v) => { const b = new Uint8Array(8); new DataView(b.buffer).setBigInt64(0, BigInt(v), true); return b; };
+    const outpoint = (inp) => {
+      const b = new Uint8Array(36);
+      b.set(hexToBytes(inp.prevout.txid).reverse());
+      b.set(u32(inp.prevout.vout), 32);
+      return b;
+    };
+    const cat = (arrs) => {
+      const out = new Uint8Array(arrs.reduce((s, a) => s + a.length, 0));
+      let p = 0; for (const a of arrs) { out.set(a, p); p += a.length; }
+      return out;
+    };
+    const serOut = (o) => this.codec.encode('TransactionOutput', o);
+    // These three depend only on the whole tx — memoize per tx (see #txCache).
+    const C = this.#txCache(tx);
+    const hashPrevouts = anyone ? zero : (C.wPrevouts ??= dsha256(cat(tx.inputs.map(outpoint))));
+    const hashSequence = (anyone || base === 2 || base === 3) ? zero
+      : (C.wSequence ??= dsha256(cat(tx.inputs.map((i) => u32(i.sequence)))));
+    const hashOutputs = (base !== 2 && base !== 3) ? (C.wOutputs ??= dsha256(cat(tx.outputs.map(serOut))))
+      : (base === 3 && inIndex < tx.outputs.length) ? dsha256(serOut(tx.outputs[inIndex]))
+      : zero;
+    const script = hexToBytes(scriptCodeHex);
+    const scriptLen = script.length < 0xfd ? Uint8Array.of(script.length)
+      : cat([Uint8Array.of(0xfd), new Uint8Array(new Uint16Array([script.length]).buffer)]);
+    push(u32(tx.version)); push(hashPrevouts); push(hashSequence);
+    push(outpoint(tx.inputs[inIndex]));
+    push(scriptLen); push(script);
+    push(i64(amount));
+    push(u32(tx.inputs[inIndex].sequence));
+    push(hashOutputs);
+    push(u32(tx.lockTime)); push(u32(hashType));
+    return dsha256(cat(w));
+  }
+
+  // BIP 341 signature message. Single SHA-256 hashing throughout (not double),
+  // wrapped in the TapSighash tag. Commits to every input's amount AND
+  // scriptPubKey — hence `prevouts` is the full per-input array.
+  sighashTaproot(tx, inIndex, prevouts, hashType, { annex = null, leafHash = null, codeSepPos = 0xffffffff } = {}) {
+    if (![0x00, 0x01, 0x02, 0x03, 0x81, 0x82, 0x83].includes(hashType)) fail('invalid taproot sighash type');
+    const anyone = hashType & 0x80;
+    const base = hashType & 0x03; // 0 = DEFAULT (ALL semantics)
+    const u8 = (v) => Uint8Array.of(v);
+    const u32 = (v) => { const b = new Uint8Array(4); new DataView(b.buffer).setUint32(0, v, true); return b; };
+    const i64 = (v) => { const b = new Uint8Array(8); new DataView(b.buffer).setBigInt64(0, BigInt(v), true); return b; };
+    const varbytes = (bytes) => {
+      if (bytes.length >= 0xfd) fail('oversized script in sighash');
+      const b = new Uint8Array(1 + bytes.length); b[0] = bytes.length; b.set(bytes, 1);
+      return b;
+    };
+    const cat = (arrs) => {
+      const out = new Uint8Array(arrs.reduce((s, a) => s + a.length, 0));
+      let p = 0; for (const a of arrs) { out.set(a, p); p += a.length; }
+      return out;
+    };
+    const outpoint = (inp) => cat([hexToBytes(inp.prevout.txid).reverse(), u32(inp.prevout.vout)]);
+
+    // sha_prevouts/amounts/scriptpubkeys/sequences/outputs depend only on the
+    // whole tx (+ its prevout set, identical across inputs) — memoize per tx.
+    const C = this.#txCache(tx);
+    const parts = [u8(0x00), u8(hashType), u32(tx.version), u32(tx.lockTime)];
+    if (!anyone) {
+      parts.push(C.tPrevouts ??= sha256(cat(tx.inputs.map(outpoint))));
+      parts.push(C.tAmounts ??= sha256(cat(prevouts.map((p) => i64(p.value)))));
+      parts.push(C.tScriptpubkeys ??= sha256(cat(prevouts.map((p) => varbytes(hexToBytes(p.scriptPubKey))))));
+      parts.push(C.tSequences ??= sha256(cat(tx.inputs.map((i) => u32(i.sequence)))));
+    }
+    if (base !== 2 && base !== 3) {
+      parts.push(C.tOutputs ??= sha256(cat(tx.outputs.map((o) => this.codec.encode('TransactionOutput', o)))));
+    }
+    parts.push(u8((leafHash ? 2 : 0) + (annex ? 1 : 0))); // spend_type
+    if (anyone) {
+      parts.push(outpoint(tx.inputs[inIndex]), i64(prevouts[inIndex].value),
+        varbytes(hexToBytes(prevouts[inIndex].scriptPubKey)), u32(tx.inputs[inIndex].sequence));
+    } else {
+      parts.push(u32(inIndex));
+    }
+    if (annex) parts.push(sha256(varbytes(annex)));
+    if (base === 3) {
+      if (inIndex >= tx.outputs.length) fail('sighash single without matching output');
+      parts.push(sha256(this.codec.encode('TransactionOutput', tx.outputs[inIndex])));
+    }
+    if (leafHash) parts.push(leafHash, u8(0x00), u32(codeSepPos));
+    return taggedHash('TapSighash', cat(parts));
+  }
+
+  // Knots' unified sighash: BIP 341's layout with a script-type byte in place
+  // of the spend type, single SHA-256 aggregates, TaggedHash("UnifiedSighash").
+  // scriptType 0 = bare/P2SH (scriptCode after FindAndDelete and the last
+  // executed OP_CODESEPARATOR, as the legacy rules use it, OP_CODESEPARATORs
+  // kept), 1 = witness v0 (BIP 143 scriptCode), 2 = taproot key path,
+  // 3 = tapscript (leafHash, key version 0, codeseparator position).
+  sighashUnified(tx, inIndex, prevouts, hashType, scriptType,
+      { scriptCodeHex = null, annex = null, leafHash = null, codeSepPos = 0xffffffff } = {}) {
+    if (!(hashType & SIGHASH_UNIFIED)) fail('unified sighash without SIGHASH_UNIFIED');
+    if (!prevouts || prevouts.length !== tx.inputs.length) throw new NeedsPrevouts('unified sighash needs every input prevout');
+    const taproot = scriptType === 2 || scriptType === 3;
+    const outputType = hashType & 0x1f;
+    if (taproot) { // BIP 341's reading: undefined bytes are refused at consensus
+      if (hashType & ~(0x1f | 0x80 | SIGHASH_UNIFIED)) fail('invalid taproot sighash type');
+      if (outputType < 1 || outputType > 3) fail('invalid taproot sighash type');
+    }
+    const anyone = hashType & 0x80;
+    const u8 = (v) => Uint8Array.of(v);
+    const u32 = (v) => { const b = new Uint8Array(4); new DataView(b.buffer).setUint32(0, v, true); return b; };
+    const i64 = (v) => { const b = new Uint8Array(8); new DataView(b.buffer).setBigInt64(0, BigInt(v), true); return b; };
+    const cat = (arrs) => {
+      const out = new Uint8Array(arrs.reduce((s, a) => s + a.length, 0));
+      let p = 0; for (const a of arrs) { out.set(a, p); p += a.length; }
+      return out;
+    };
+    const varbytes = (bytes) => cat([compactSize(bytes.length), bytes]);
+    const outpoint = (inp) => cat([hexToBytes(inp.prevout.txid).reverse(), u32(inp.prevout.vout)]);
+    const serOut = (o) => this.codec.encode('TransactionOutput', o);
+    const C = this.#txCache(tx);
+    const parts = [u8(0x00), u8(hashType & 0xff), u32(tx.version), u32(tx.lockTime), u8(0x00)];
+    if (!anyone) {
+      parts.push(C.tPrevouts ??= sha256(cat(tx.inputs.map(outpoint))));
+      parts.push(C.tAmounts ??= sha256(cat(prevouts.map((p) => i64(p.value)))));
+      parts.push(C.tScriptpubkeys ??= sha256(cat(prevouts.map((p) => varbytes(hexToBytes(p.scriptPubKey))))));
+      parts.push(C.tSequences ??= sha256(cat(tx.inputs.map((i) => u32(i.sequence)))));
+    }
+    if (outputType !== 2 && outputType !== 3) parts.push(C.tOutputs ??= sha256(cat(tx.outputs.map(serOut))));
+    parts.push(u8(scriptType));
+    if (anyone) parts.push(outpoint(tx.inputs[inIndex]), serOut(prevouts[inIndex]), u32(tx.inputs[inIndex].sequence));
+    else parts.push(u32(inIndex));
+    if (!taproot) {
+      if (scriptCodeHex == null) fail('unified sighash needs scriptCode');
+      parts.push(varbytes(hexToBytes(scriptCodeHex)));
+    } else {
+      parts.push(u8(annex ? 1 : 0));
+      if (annex) parts.push(sha256(varbytes(annex)));
+    }
+    if (outputType === 3) {
+      if (inIndex >= tx.outputs.length) fail('sighash single without matching output');
+      parts.push(sha256(serOut(tx.outputs[inIndex])));
+    }
+    if (scriptType === 3) {
+      if (!leafHash) fail('unified tapscript sighash needs the leaf hash');
+      parts.push(leafHash, u8(0x00), u32(codeSepPos));
+    }
+    return taggedHash('UnifiedSighash', cat(parts));
+  }
+
+  // Tapscript signature check (BIP 342): an empty signature pushes false;
+  // a non-empty INVALID signature fails the whole script; a non-32-byte
+  // public key is an "unknown key type" and succeeds (upgrade hook).
+  #checkSigTapscript(sigBytes, pubBytes, ctx) {
+    if (pubBytes.length === 0) fail('empty pubkey');
+    if (sigBytes.length === 0) return false;
+    if (ctx.budget) { ctx.budget.n -= 50; if (ctx.budget.n < 0) fail('sigops budget exceeded'); }
+    if (pubBytes.length !== 32) return true; // unknown pubkey type
+    let hashType = 0x00, sig = sigBytes;
+    if (sigBytes.length === 65) {
+      hashType = sigBytes[64];
+      if (hashType === 0x00) fail('explicit SIGHASH_DEFAULT in 65-byte signature');
+      sig = sigBytes.subarray(0, 64);
+    } else if (sigBytes.length !== 64) fail('bad schnorr signature size');
+    const tail = { annex: ctx.annex, leafHash: ctx.leafHash, codeSepPos: ctx.codeSepPos ?? 0xffffffff };
+    const msg = (ctx.unified && (hashType & SIGHASH_UNIFIED))
+      ? this.sighashUnified(ctx.tx, ctx.inIndex, ctx.prevouts, hashType, 3, tail)
+      : this.sighashTaproot(ctx.tx, ctx.inIndex, ctx.prevouts, hashType, tail);
+    if (!verifySchnorr(msg, sig, pubBytes)) fail('invalid schnorr signature');
+    return true;
+  }
+
+  #checkSig(sigBytes, pubBytes, ctx) {
+    if (ctx.sigVersion === 'tapscript') return this.#checkSigTapscript(sigBytes, pubBytes, ctx);
+    const f = ctx.flags;
+    // scriptCode is truncated to start after the last executed OP_CODESEPARATOR
+    let scriptCode = ctx.codeSepOffset ? ctx.scriptCode.slice(ctx.codeSepOffset * 2) : ctx.scriptCode;
+    // Legacy only, and before any encoding check (Core's order): the signature
+    // push is deleted from scriptCode. An empty signature is the push OP_0, so
+    // it deletes OP_0 opcodes too, which CONST_SCRIPTCODE then rejects.
+    // (CHECKMULTISIG deletes every signature up front and sets _sigsDeleted.)
+    if (isLegacy(ctx.sigVersion) && !ctx._sigsDeleted) {
+      const { script, found } = findAndDelete(hexToBytes(scriptCode), pushEncode(sigBytes));
+      if (found && f?.has('CONST_SCRIPTCODE')) fail('SIG_FINDANDDELETE');
+      if (found) scriptCode = bytesToHex(script);
+    }
+    if (f && sigBytes.length > 0) {
+      if ((f.has('DERSIG') || f.has('LOW_S') || f.has('STRICTENC')) && !isValidDerSig(sigBytes)) fail('non-DER signature');
+      if (f.has('LOW_S') && !isLowDerSig(sigBytes)) fail('high-S signature');
+      if (f.has('STRICTENC') && !isDefinedHashtype(sigBytes, ctx.unified)) fail('undefined hashtype');
+    }
+    if (f?.has('STRICTENC') && !isPubKeyEnc(pubBytes)) fail('bad pubkey encoding');
+    // BIP 143: witness v0 pubkeys must be compressed under WITNESS_PUBKEYTYPE
+    if (ctx.sigVersion === 'witnessV0' && f?.has('WITNESS_PUBKEYTYPE')
+        && !(pubBytes.length === 33 && (pubBytes[0] === 0x02 || pubBytes[0] === 0x03))) {
+      fail('WITNESS_PUBKEYTYPE');
+    }
+    if (sigBytes.length === 0) return false;
+    const hashType = sigBytes[sigBytes.length - 1];
+    const sig = parseDerSignature(sigBytes.subarray(0, sigBytes.length - 1));
+    const pub = parsePubkey(pubBytes);
+    if (!sig || !pub) return false;
+    const witnessV0 = ctx.sigVersion === 'witnessV0';
+    const hash = (ctx.unified && (hashType & SIGHASH_UNIFIED))
+      ? this.sighashUnified(ctx.tx, ctx.inIndex, ctx.prevouts, hashType, witnessV0 ? 1 : 0, { scriptCodeHex: scriptCode })
+      : witnessV0
+        ? this.sighashWitnessV0(ctx.tx, ctx.inIndex, scriptCode, ctx.amount, hashType)
+        : this.sighashLegacy(ctx.tx, ctx.inIndex, scriptCode, hashType);
+    return verifyEcdsa(hash, sig, pub);
+  }
+
+  // ---- opcode handlers ----
+
+  #buildHandlers() {
+    const L = this.limits;
+    const pop = (s) => { if (!s.length) fail('stack underflow'); return s.pop(); };
+    const peek = (s, n = 1) => { if (s.length < n) fail('stack underflow'); return s[s.length - n]; };
+    const num = (s) => numDecode(pop(s), 4, this.requireMinimalNum);
+    const pushNum = (s, n) => s.push(numEncode(n));
+    const unary = (f) => (s) => pushNum(s, f(num(s)));
+    const binary = (f) => (s) => { const b = num(s), a = num(s); pushNum(s, f(a, b)); };
+    const binBool = (f) => (s) => { const b = num(s), a = num(s); s.push(boolBytes(f(a, b))); };
+    const hashOp = (f) => (s) => s.push(f(pop(s)));
+
+    const h = {
+      OP_0: (s) => s.push(new Uint8Array(0)),
+      OP_1NEGATE: (s) => pushNum(s, -1),
+      OP_NOP: () => {},
+      // Legacy/segwit-v0: the sighash scriptCode begins after the last *executed*
+      // OP_CODESEPARATOR (Core's pbegincodehash). Only updated when executing, so
+      // a separator inside an untaken IF branch has no effect.
+      OP_CODESEPARATOR: (s, ctx, exec, op) => {
+        if (isLegacy(ctx.sigVersion) && ctx.flags?.has('CONST_SCRIPTCODE')) fail('OP_CODESEPARATOR under CONST_SCRIPTCODE');
+        ctx.codeSepOffset = op.at + 1;
+        ctx.codeSepPos = ctx.opPos;
+      },
+      OP_IF: (s, ctx, exec, _, executing) => {
+        let f = false;
+        if (executing) {
+          const v = pop(s);
+          if ((ctx.sigVersion === 'tapscript'
+               || (ctx.sigVersion === 'witnessV0' && ctx.flags?.has('MINIMALIF')))
+              && !(v.length === 0 || (v.length === 1 && v[0] === 1))) {
+            fail('minimal IF'); // BIP 342 (tapscript) / SCRIPT_VERIFY_MINIMALIF (witness v0)
+          }
+          f = truthy(v);
+        }
+        exec.push(f);
+      },
+      OP_NOTIF: (s, ctx, exec, _, executing) => {
+        let f = false;
+        if (executing) {
+          const v = pop(s);
+          if ((ctx.sigVersion === 'tapscript'
+               || (ctx.sigVersion === 'witnessV0' && ctx.flags?.has('MINIMALIF')))
+              && !(v.length === 0 || (v.length === 1 && v[0] === 1))) {
+            fail('minimal IF');
+          }
+          f = !truthy(v);
+        }
+        exec.push(f);
+      },
+      OP_ELSE: (s, ctx, exec) => {
+        if (!exec.length) fail('unbalanced ELSE');
+        exec[exec.length - 1] = !exec[exec.length - 1];
+      },
+      OP_ENDIF: (s, ctx, exec) => {
+        if (!exec.length) fail('unbalanced ENDIF');
+        exec.pop();
+      },
+      OP_VERIFY: (s) => { if (!truthy(pop(s))) fail('verify failed'); },
+      OP_RETURN: () => fail('op_return'),
+
+      OP_TOALTSTACK: (s, ctx) => ctx.alt.push(pop(s)),
+      OP_FROMALTSTACK: (s, ctx) => { if (!ctx.alt.length) fail('alt underflow'); s.push(ctx.alt.pop()); },
+      OP_2DROP: (s) => { pop(s); pop(s); },
+      OP_2DUP: (s) => { const a = peek(s, 2), b = peek(s, 1); s.push(a, b); },
+      OP_3DUP: (s) => { const a = peek(s, 3), b = peek(s, 2), c = peek(s, 1); s.push(a, b, c); },
+      OP_2OVER: (s) => { const a = peek(s, 4), b = peek(s, 3); s.push(a, b); },
+      OP_2ROT: (s) => { if (s.length < 6) fail('stack underflow'); s.push(...s.splice(s.length - 6, 2)); },
+      OP_2SWAP: (s) => { if (s.length < 4) fail('stack underflow'); s.push(...s.splice(s.length - 4, 2)); },
+      OP_IFDUP: (s) => { if (truthy(peek(s))) s.push(peek(s)); },
+      OP_DEPTH: (s) => pushNum(s, s.length),
+      OP_DROP: (s) => pop(s),
+      OP_DUP: (s) => s.push(peek(s)),
+      OP_NIP: (s) => { const t = pop(s); pop(s); s.push(t); },
+      OP_OVER: (s) => s.push(peek(s, 2)),
+      OP_PICK: (s) => { const n = num(s); if (n < 0 || n >= s.length) fail('pick range'); s.push(s[s.length - 1 - n]); },
+      OP_ROLL: (s) => { const n = num(s); if (n < 0 || n >= s.length) fail('roll range'); s.push(s.splice(s.length - 1 - n, 1)[0]); },
+      OP_ROT: (s) => { if (s.length < 3) fail('stack underflow'); s.push(s.splice(s.length - 3, 1)[0]); },
+      OP_SWAP: (s) => { if (s.length < 2) fail('stack underflow'); s.push(s.splice(s.length - 2, 1)[0]); },
+      OP_TUCK: (s) => { if (s.length < 2) fail('stack underflow'); s.splice(s.length - 2, 0, peek(s)); },
+      OP_SIZE: (s) => pushNum(s, peek(s).length),
+
+      OP_EQUAL: (s) => s.push(boolBytes(eq(pop(s), pop(s)))),
+      OP_EQUALVERIFY: (s) => { if (!eq(pop(s), pop(s))) fail('equalverify'); },
+
+      OP_1ADD: unary((a) => a + 1), OP_1SUB: unary((a) => a - 1),
+      OP_NEGATE: unary((a) => -a), OP_ABS: unary(Math.abs),
+      OP_NOT: (s) => s.push(boolBytes(num(s) === 0)),
+      OP_0NOTEQUAL: (s) => s.push(boolBytes(num(s) !== 0)),
+      OP_ADD: binary((a, b) => a + b), OP_SUB: binary((a, b) => a - b),
+      OP_BOOLAND: binBool((a, b) => a !== 0 && b !== 0),
+      OP_BOOLOR: binBool((a, b) => a !== 0 || b !== 0),
+      OP_NUMEQUAL: binBool((a, b) => a === b),
+      OP_NUMEQUALVERIFY: (s) => { const b = num(s), a = num(s); if (a !== b) fail('numequalverify'); },
+      OP_NUMNOTEQUAL: binBool((a, b) => a !== b),
+      OP_LESSTHAN: binBool((a, b) => a < b),
+      OP_GREATERTHAN: binBool((a, b) => a > b),
+      OP_LESSTHANOREQUAL: binBool((a, b) => a <= b),
+      OP_GREATERTHANOREQUAL: binBool((a, b) => a >= b),
+      OP_MIN: binary(Math.min), OP_MAX: binary(Math.max),
+      OP_WITHIN: (s) => { const max = num(s), min = num(s), x = num(s); s.push(boolBytes(x >= min && x < max)); },
+
+      OP_RIPEMD160: hashOp(ripemd160), OP_SHA1: hashOp(sha1),
+      OP_SHA256: hashOp(sha256), OP_HASH160: hashOp(hash160), OP_HASH256: hashOp(dsha256),
+
+      OP_CHECKSIG: (s, ctx) => {
+        const pub = pop(s), sig = pop(s);
+        const ok = this.#checkSig(sig, pub, ctx);
+        if (!ok && sig.length > 0 && ctx.flags?.has('NULLFAIL')) fail('NULLFAIL');
+        s.push(boolBytes(ok));
+      },
+      OP_CHECKSIGVERIFY: (s, ctx) => {
+        const pub = pop(s), sig = pop(s);
+        const ok = this.#checkSig(sig, pub, ctx);
+        if (!ok && sig.length > 0 && ctx.flags?.has('NULLFAIL')) fail('NULLFAIL');
+        if (!ok) fail('checksigverify');
+      },
+      OP_CHECKMULTISIG: (s, ctx) => {
+        if (ctx.sigVersion === 'tapscript') fail('CHECKMULTISIG disabled in tapscript');
+        s.push(boolBytes(this.#checkMultisig(s, ctx)));
+      },
+      OP_CHECKMULTISIGVERIFY: (s, ctx) => {
+        if (ctx.sigVersion === 'tapscript') fail('CHECKMULTISIG disabled in tapscript');
+        if (!this.#checkMultisig(s, ctx)) fail('checkmultisigverify');
+      },
+      OP_CHECKSIGADD: (s, ctx) => {
+        if (ctx.sigVersion !== 'tapscript') fail('CHECKSIGADD outside tapscript');
+        const pub = pop(s);
+        const n = numDecode(pop(s));
+        const sig = pop(s);
+        s.push(numEncode(n + (this.#checkSigTapscript(sig, pub, ctx) ? 1 : 0)));
+      },
+
+      // BIP 65 / BIP 112 are flag-gated in Core: without the flag the opcode is
+      // the pre-softfork NOP2 / NOP3 (a plain no-op, not "discouraged"). With
+      // no flag set at all (null/undefined, the block-validation default) both
+      // stay enforced, matching the P2SH gate; a flag set that omits them
+      // turns them off.
+      OP_CHECKLOCKTIMEVERIFY: (s, ctx) => {
+        if (ctx.flags != null && !ctx.flags.has('CHECKLOCKTIMEVERIFY')) return;
+        const n = numDecode(peek(s), 5);
+        if (n < 0) fail('negative locktime');
+        const sameKind = (n < 500000000) === (ctx.tx.lockTime < 500000000);
+        if (!sameKind || n > ctx.tx.lockTime) fail('unsatisfied locktime');
+        if (ctx.tx.inputs[ctx.inIndex].sequence === 0xffffffff) fail('final sequence');
+      },
+      OP_CHECKSEQUENCEVERIFY: (s, ctx) => {
+        if (ctx.flags != null && !ctx.flags.has('CHECKSEQUENCEVERIFY')) return;
+        const n = numDecode(peek(s), 5);
+        if (n < 0) fail('negative sequence');
+        if (n & (1 << 31)) return; // disable flag: behaves as NOP
+        const seq = ctx.tx.inputs[ctx.inIndex].sequence;
+        if (ctx.tx.version < 2) fail('csv pre-v2');
+        if (seq & 0x80000000) fail('sequence disable flag set');
+        const typeMask = 1 << 22, valueMask = 0xffff;
+        if ((n & typeMask) !== (seq & typeMask)) fail('sequence type mismatch');
+        if ((n & valueMask) > (seq & valueMask)) fail('unsatisfied sequence');
+      },
+    };
+    for (let i = 1; i <= 16; i++) h[`OP_${i}`] = ((v) => (s) => pushNum(s, v))(i);
+    // OP_NOP1, OP_NOP4..OP_NOP10 are upgradable no-ops; rejected under
+    // SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS. (NOP2/NOP3 are CLTV/CSV.)
+    for (let i = 1; i <= 10; i++) h[`OP_NOP${i}`] = (s, ctx) => {
+      if (ctx.flags?.has('DISCOURAGE_UPGRADABLE_NOPS')) fail('upgradable NOP');
+    };
+    return h;
+  }
+
+  #checkMultisig(s, ctx) {
+    const pop = () => { if (!s.length) fail('stack underflow'); return s.pop(); };
+    const n = numDecode(pop(), 4, this.requireMinimalNum);
+    if (n < 0 || n > this.limits.maxMultisigKeys) fail('pubkey count');
+    ctx._extraOps = (ctx._extraOps || 0) + n; // CHECKMULTISIG adds its key count to the op limit
+    const pubs = [];
+    for (let i = 0; i < n; i++) pubs.push(pop());
+    const m = numDecode(pop(), 4, this.requireMinimalNum);
+    if (m < 0 || m > n) fail('sig count');
+    const sigs = [];
+    for (let i = 0; i < m; i++) sigs.push(pop());
+    const dummy = pop(); // the historical extra-pop dummy
+    if (ctx.flags?.has('NULLDUMMY') && dummy.length !== 0) fail('NULLDUMMY');
+    // sigs and pubs are in stack-pop order (top first) — Core evaluates in
+    // exactly this order, checking the current pair's encoding before the
+    // not-enough-keys early-exit, so a later invalid key/sig may never be
+    // reached. (No reverse: matching is order-preserving for valid cases.)
+    let sigCtx = ctx;
+    if (isLegacy(ctx.sigVersion)) {
+      // Legacy: every signature is FindAndDelete'd from scriptCode before any is checked
+      let code = hexToBytes(ctx.codeSepOffset ? ctx.scriptCode.slice(ctx.codeSepOffset * 2) : ctx.scriptCode);
+      for (const sg of sigs) {
+        const { script, found } = findAndDelete(code, pushEncode(sg));
+        if (found && ctx.flags?.has('CONST_SCRIPTCODE')) fail('SIG_FINDANDDELETE');
+        code = script;
+      }
+      sigCtx = { ...ctx, scriptCode: bytesToHex(code), codeSepOffset: 0, _sigsDeleted: true };
+    }
+    let isig = 0, ikey = 0, success = true;
+    while (success && isig < sigs.length) {
+      if (this.#checkSig(sigs[isig], pubs[ikey], sigCtx)) isig++;
+      ikey++;
+      if (sigs.length - isig > pubs.length - ikey) success = false;
+    }
+    const ok = success && isig === sigs.length;
+    // BIP 146: a failed multisig requires every signature to be empty
+    if (!ok && ctx.flags?.has('NULLFAIL')) {
+      for (const sg of sigs) if (sg.length > 0) fail('NULLFAIL');
+    }
+    return ok;
+  }
+
+  // ---- execution ----
+
+  // Execute one script against a stack. ctx: {tx, inIndex, scriptCode,
+  // amount, sigVersion, alt}. Returns {ok, error?}; stack is mutated.
+  execute(scriptHex, stack, ctx = {}) {
+    try {
+      // BIP342: tapscript has no per-script size limit. The legacy 10kB
+      // MAX_SCRIPT_SIZE does not apply; a tapscript's size is bounded only by the
+      // transaction/block weight limit (it has to fit in a block).
+      if (ctx.sigVersion !== 'tapscript' && scriptHex.length / 2 > this.limits.maxScriptSize) fail('script too large');
+      ctx.alt = ctx.alt ?? [];
+      ctx.scriptCode = ctx.scriptCode ?? scriptHex;
+      ctx.codeSepOffset = 0;          // bytes before the last executed OP_CODESEPARATOR; reset per script run
+      ctx.codeSepPos = 0xffffffff;    // BIP 342: opcode position of the last executed OP_CODESEPARATOR, none yet
+      this.requireMinimalNum = !!ctx.flags?.has('MINIMALDATA'); // for the shared num() helper
+
+      const ops = this.scriptEngine.parse(scriptHex);
+      if (ctx.sigVersion === 'tapscript') {
+        // BIP 342: OP_SUCCESSx is decided at parse time, before execution
+        for (const op of ops) {
+          if (op.error) fail(op.error);
+          if (op.data == null && this.#isOpSuccess(op.code)) return { ok: true, opSuccess: true };
+        }
+      }
+      const exec = [];
+      let opCount = 0, opPos = 0;
+      for (const op of ops) {
+        if (op.error) fail(op.error);
+        ctx.opPos = opPos++; // Core's opcode_pos: every opcode read counts, pushes included
+        const executing = exec.every(Boolean);
+        if (op.data != null) {
+          if (op.data.length / 2 > this.limits.maxScriptElementSize) fail('push too large');
+          if (executing) {
+            if (ctx.flags?.has('MINIMALDATA') && !minimalPushOk(op.code, op.data)) fail('non-minimal data push');
+            stack.push(hexToBytes(op.data));
+          }
+          continue;
+        }
+        // BIP342: tapscript removes the 201-non-push-opcode-per-script limit
+        // entirely (there is no opcode-count cap). Signature-checking cost is
+        // instead bounded separately by the per-input sigops budget.
+        if (ctx.sigVersion !== 'tapscript' && op.code > 0x60 && ++opCount > this.limits.maxOpsPerScript) fail('op count');
+        if (this.#isDisabled(op.name)) fail(`disabled opcode ${op.name}`);
+        const isBranch = ['OP_IF', 'OP_NOTIF', 'OP_ELSE', 'OP_ENDIF'].includes(op.name);
+        if (!executing && !isBranch) continue;
+        const handler = this.handlers[op.name];
+        if (!handler) fail(`bad opcode ${op.name}`);
+        handler(stack, ctx, exec, op, executing);
+        if (ctx._extraOps) { // CHECKMULTISIG key count, counted after the op runs
+          opCount += ctx._extraOps; ctx._extraOps = 0;
+          if (opCount > this.limits.maxOpsPerScript) fail('op count');
+        }
+        if (stack.length + ctx.alt.length > this.limits.maxStackSize) fail('stack size');
+      }
+      if (exec.length) fail('unbalanced conditional');
+      return { ok: true };
+    } catch (e) {
+      if (e instanceof ScriptError) return { ok: false, error: e.message };
+      throw e;
+    }
+  }
+
+  #isDisabled(name) {
+    return ['OP_CAT', 'OP_SUBSTR', 'OP_LEFT', 'OP_RIGHT', 'OP_INVERT', 'OP_AND', 'OP_OR',
+      'OP_XOR', 'OP_2MUL', 'OP_2DIV', 'OP_MUL', 'OP_DIV', 'OP_MOD', 'OP_LSHIFT', 'OP_RSHIFT',
+      'OP_VERIF', 'OP_VERNOTIF'].includes(name);
+  }
+
+  // BIP 342 OP_SUCCESSx set: these byte values make a tapscript
+  // unconditionally valid, reserving them for future upgrades.
+  #isOpSuccess(code) {
+    return code === 80 || code === 98
+      || (code >= 126 && code <= 129) || (code >= 131 && code <= 134)
+      || code === 137 || code === 138 || code === 141 || code === 142
+      || (code >= 149 && code <= 153) || (code >= 187 && code <= 254);
+  }
+
+
+  // Core's VerifyWitnessProgram. `isP2SH` matters for v1: a P2SH-wrapped
+  // 32-byte v1 program is not taproot (BIP 341) and falls through as unknown.
+  #verifyWitnessProgram(tx, inIndex, version, programHex, amount, flags, isP2SH, allPrevouts, unified = false) {
+    const extra = { prevouts: allPrevouts, unified };
+    const witness = (tx.witness?.[inIndex] ?? []).map(hexToBytes);
+    if (version === 0) {
+      if (programHex.length === 64) { // BIP 141 P2WSH
+        if (!witness.length) return { ok: false, error: 'WITNESS_PROGRAM_WITNESS_EMPTY' };
+        const witnessScript = witness.pop();
+        if (bytesToHex(sha256(witnessScript)) !== programHex) return { ok: false, error: 'WITNESS_PROGRAM_MISMATCH' };
+        return this.#executeWitnessScript(witness, bytesToHex(witnessScript), tx, inIndex, amount, flags, extra);
+      }
+      if (programHex.length === 40) { // BIP 141 P2WPKH
+        if (witness.length !== 2) return { ok: false, error: 'WITNESS_PROGRAM_MISMATCH' };
+        return this.#executeWitnessScript(witness, '76a914' + programHex + '88ac', tx, inIndex, amount, flags, extra);
+      }
+      return { ok: false, error: 'WITNESS_PROGRAM_WRONG_LENGTH' };
+    }
+    if (version === 1 && programHex.length === 64 && !isP2SH) { // BIP 341 taproot
+      if (flags && !flags.has('TAPROOT')) return { ok: true }; // not enabled: anyone-can-spend, as in Core
+      if (!allPrevouts) return { ok: null, reason: 'taproot needs every input prevout resolved' };
+      return this.#verifyTaproot(tx, inIndex, allPrevouts, flags, unified);
+    }
+    // BIP 431 pay-to-anchor: Core accepts OP_1 <0x4e73> with an empty witness
+    // outright, bare (not P2SH-wrapped), even under DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM.
+    if (version === 1 && programHex === '4e73' && !isP2SH && witness.length === 0) return { ok: true, path: 'anchor' };
+    if (flags?.has('DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM')) return { ok: false, error: 'DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM' };
+    // Core returns success here (future soft-fork compatibility); we decline
+    // to vouch for rules we do not know rather than claim they passed.
+    return { ok: null, reason: 'unknown witness version' };
+  }
+
+  // Core's ExecuteWitnessScript for witness v0: 520-byte cap on every initial
+  // stack element, evaluate, exactly one truthy element must remain.
+  #executeWitnessScript(stack, scriptHex, tx, inIndex, amount, flags, extra = {}) {
+    for (const el of stack) if (el.length > this.limits.maxScriptElementSize) return { ok: false, error: 'PUSH_SIZE' };
+    const st = stack.map((w) => Uint8Array.from(w));
+    const r = this.execute(scriptHex, st, { tx, inIndex, amount, sigVersion: 'witnessV0', scriptCode: scriptHex, flags, ...extra });
+    if (!r.ok) return r;
+    if (st.length !== 1) return { ok: false, error: 'CLEANSTACK' };
+    return truthy(st[0]) ? { ok: true } : { ok: false, error: 'EVAL_FALSE' };
+  }
+
+  // BIP 341 taproot spend verification: key path (one Schnorr signature
+  // with the tweaked output key) or script path (reveal a leaf script and
+  // a control block proving its commitment, then execute as tapscript).
+  #verifyTaproot(tx, inIndex, prevouts, flags = null, unified = false) {
+    const program = hexToBytes(prevouts[inIndex].scriptPubKey.slice(4));
+    const witness = (tx.witness?.[inIndex] ?? []).map(hexToBytes);
+    if (!witness.length) return { ok: false, error: 'empty taproot witness' };
+
+    // total serialized witness size, for the tapscript sigops budget
+    const witnessSize = witness.reduce((s, w) =>
+      s + w.length + (w.length < 0xfd ? 1 : w.length <= 0xffff ? 3 : 5), 1);
+
+    let annex = null;
+    if (witness.length >= 2 && witness[witness.length - 1][0] === 0x50) annex = witness.pop();
+
+    if (witness.length === 1) { // key path
+      const raw = witness[0];
+      let hashType = 0x00, sig = raw;
+      if (raw.length === 65) {
+        hashType = raw[64];
+        if (hashType === 0x00) return { ok: false, error: 'explicit SIGHASH_DEFAULT in 65-byte signature' };
+        sig = raw.subarray(0, 64);
+      } else if (raw.length !== 64) return { ok: false, error: 'bad key-path signature size' };
+      try {
+        const msg = (unified && (hashType & SIGHASH_UNIFIED))
+          ? this.sighashUnified(tx, inIndex, prevouts, hashType, 2, { annex })
+          : this.sighashTaproot(tx, inIndex, prevouts, hashType, { annex });
+        return verifySchnorr(msg, sig, program)
+          ? { ok: true, path: 'key' } : { ok: false, error: 'invalid key-path schnorr signature' };
+      } catch (e) {
+        if (e instanceof ScriptError) return { ok: false, error: e.message };
+        throw e;
+      }
+    }
+
+    // script path
+    const control = witness.pop();
+    const script = witness.pop();
+    if (control.length < 33 || (control.length - 33) % 32 !== 0 || control.length > 33 + 32 * 128) {
+      return { ok: false, error: 'bad control block size' };
+    }
+    const leafVersion = control[0] & 0xfe;
+    const parity = control[0] & 0x01;
+    const internalKey = control.subarray(1, 33);
+    const leafHash = taggedHash('TapLeaf', Uint8Array.of(leafVersion), compactSize(script.length), script);
+    let k = leafHash;
+    for (let i = 33; i < control.length; i += 32) {
+      const e = control.subarray(i, i + 32);
+      const less = bytesToHex(k) < bytesToHex(e);
+      k = less ? taggedHash('TapBranch', k, e) : taggedHash('TapBranch', e, k);
+    }
+    if (!checkTapTweak(internalKey, k, program, parity)) {
+      return { ok: false, error: 'control block commitment mismatch' };
+    }
+    if (leafVersion !== 0xc0) return { ok: null, reason: 'unknown tapleaf version', path: 'script' };
+
+    const stack = witness; // remaining items are the initial stack
+    const scriptHex = bytesToHex(script);
+    const ctx = {
+      tx, inIndex, prevouts, amount: prevouts[inIndex].value,
+      sigVersion: 'tapscript', leafHash, annex, budget: { n: 50 + witnessSize }, flags, unified,
+    };
+    const r = this.execute(scriptHex, stack, ctx);
+    if (!r.ok) return { ...r, path: 'script' };
+    if (r.opSuccess) return { ok: true, path: 'script' };
+    return (stack.length === 1 && truthy(stack[0]))
+      ? { ok: true, path: 'script' } : { ok: false, error: 'tapscript evaluated false', path: 'script' };
+  }
+
+  // Verify one input against its prevout. For taproot, `allPrevouts` (one
+  // {value, scriptPubKey} per input, in order) is required because the
+  // BIP 341 sighash commits to all of them. Returns {ok: true|false|null};
+  // null = honestly unverifiable (missing prevouts / future versions).
+  // `unifiedSighash`: whether Knots' unified opt-in sighash applies (the block
+  // is at or past the chain's activation height); an opted-in signature is
+  // then verified against that message, and needs `allPrevouts` like taproot.
+  verifyInput(tx, inIndex, prevout, allPrevouts = null, flags = null, { unifiedSighash = false } = {}) {
+    try {
+      return this.#verifyInput(tx, inIndex, prevout, allPrevouts, flags, unifiedSighash);
+    } catch (e) {
+      if (e instanceof NeedsPrevouts) return { ok: null, reason: 'unified sighash needs every input prevout resolved', type: this.scriptEngine.classify(prevout.scriptPubKey).type };
+      throw e;
+    }
+  }
+
+  #verifyInput(tx, inIndex, prevout, allPrevouts, flags, unified) {
+    // Core's VerifyScript, in its order: scriptSig then scriptPubKey on one
+    // stack; bare witness program; P2SH (redeem script, then a wrapped witness
+    // program); CLEANSTACK; unexpected witness. P2SH and segwit are only active
+    // under their flags; legacy callers (flags=null) keep both on, and a P2SH-
+    // or witness-shaped scriptPubKey runs as a plain script when they are off.
+    const spk = prevout.scriptPubKey;
+    let type = this.scriptEngine.classify(spk).type;
+    const input = tx.inputs[inIndex];
+    const ctx = { tx, inIndex, amount: prevout.value, sigVersion: 'legacy', flags, prevouts: allPrevouts, unified };
+    const p2shActive = flags === null || flags.has('P2SH');
+    const witnessActive = flags === null || flags.has('WITNESS');
+    const pushOnly = this.scriptEngine.parse(input.scriptSig).every((o) => o.code <= 0x60);
+    if (flags?.has('SIGPUSHONLY') && !pushOnly) return { ok: false, error: 'SIG_PUSHONLY', type };
+
+    let stack = [];
+    let r = this.execute(input.scriptSig, stack, { ...ctx, scriptCode: input.scriptSig });
+    if (!r.ok) return { ...r, type };
+    const stackCopy = p2shActive ? stack.slice() : null;
+    r = this.execute(spk, stack, { ...ctx, scriptCode: spk });
+    if (!r.ok) return { ...r, type };
+    if (!stack.length || !truthy(stack[stack.length - 1])) return { ok: false, error: 'EVAL_FALSE', type };
+
+    let hadWitness = false, witnessResult = {};
+    const bare = witnessActive ? witnessProgram(spk) : null;
+    if (bare) {
+      hadWitness = true;
+      if (input.scriptSig.length) return { ok: false, error: 'WITNESS_MALLEATED', type };
+      const w = this.#verifyWitnessProgram(tx, inIndex, bare.version, bare.program, prevout.value, flags, false, allPrevouts, unified);
+      if (w.ok !== true) return { ...w, type };
+      witnessResult = w; // keeps e.g. the taproot `path`
+      stack = [Uint8Array.of(1)]; // Core's stack.resize(1): one element, so the CLEANSTACK check below passes
+    } else if (p2shActive && type === 'p2sh') {
+      if (!pushOnly) return { ok: false, error: 'SIG_PUSHONLY', type };
+      stack = stackCopy; // the stack as scriptSig left it; its top is the redeem script
+      const redeem = stack.pop();
+      const redeemHex = bytesToHex(redeem);
+      const redeemType = this.scriptEngine.classify(redeemHex).type;
+      type = `p2sh-${redeemType}`;
+      r = this.execute(redeemHex, stack, { ...ctx, scriptCode: redeemHex });
+      if (!r.ok) return { ...r, type };
+      if (!stack.length || !truthy(stack[stack.length - 1])) return { ok: false, error: 'EVAL_FALSE', type };
+      const wrapped = witnessActive ? witnessProgram(redeemHex) : null;
+      if (wrapped) {
+        hadWitness = true;
+        // the scriptSig must be exactly one push of the redeem script
+        if (input.scriptSig !== bytesToHex(pushEncode(redeem))) return { ok: false, error: 'WITNESS_MALLEATED_P2SH', type };
+        const w = this.#verifyWitnessProgram(tx, inIndex, wrapped.version, wrapped.program, prevout.value, flags, true, allPrevouts, unified);
+        if (w.ok !== true) return { ...w, type };
+        witnessResult = w;
+        stack = [Uint8Array.of(1)];
+      }
+    }
+    if (flags?.has('CLEANSTACK') && stack.length !== 1) return { ok: false, error: 'CLEANSTACK', type };
+    if (witnessActive && !hadWitness && (tx.witness?.[inIndex] ?? []).length) return { ok: false, error: 'WITNESS_UNEXPECTED', type };
+    return { ...witnessResult, ok: true, type };
+  }
+}
diff --git a/vendor/sidestr/schema/codec/kernel.js b/vendor/sidestr/schema/codec/kernel.js
new file mode 100644
index 0000000..6cf89c5
--- /dev/null
+++ b/vendor/sidestr/schema/codec/kernel.js
@@ -0,0 +1,31 @@
+// One entry point that wires the schema-driven engines for a network, with
+// optional overlays (see overlay.js). An overlay is { graph, install?, installChecks? }:
+//   graph                  its JSON-LD (chains, structs, rules)
+//   install(codec)         runs before the chain is bound: proof-of-work hashes, derived fields
+//   installChecks(engines) runs after the engines exist: the checks behind its rules
+// With no overlays this is exactly the hand wiring the tests and apps have always done.
+import { Codec } from './codec.js';
+import { ScriptEngine } from './script.js';
+import { ScriptInterpreter } from './interpreter.js';
+import { HeaderEngine } from './headers.js';
+import { BlockEngine } from './blocks.js';
+import { mergeSchemas } from './overlay.js';
+
+export function createKernel({ core, proof, script, chain, validate, network = 'btc:mainnet', overlays = [] }) {
+  const graphs = overlays.map((o) => o.graph);
+  const chainG = mergeSchemas(chain, ...graphs);
+  const validateG = mergeSchemas(validate, ...graphs);
+  const net = chainG['@graph'].find((n) => n['@id'] === network);
+  if (!net) throw new Error(`unknown network: ${network}`);
+  if (net.extends) throw new Error(`${network} extends unknown ${net.extends}`);
+  const codec = new Codec(core, proof, ...graphs);
+  for (const o of overlays) o.install?.(codec); // PoW hashes, derived fields — before the chain is bound
+  const headers = HeaderEngine.fromSchemas(codec, chainG, validateG, network);
+  const scriptEngine = script ? ScriptEngine.fromSchemas(script, chainG, network) : null;
+  const limits = script?.['@graph'].find((n) => n['@id'] === 'btc:scriptLimits');
+  const interpreter = scriptEngine ? new ScriptInterpreter(codec, scriptEngine, limits) : null;
+  const blocks = BlockEngine.fromSchemas(codec, chainG, validateG, script, network);
+  const engines = { codec, headers, blocks, script: scriptEngine, interpreter, network, params: headers.params, schemas: { chain: chainG, validate: validateG } };
+  for (const o of overlays) o.installChecks?.(engines);
+  return engines;
+}
diff --git a/vendor/sidestr/schema/codec/nostr.js b/vendor/sidestr/schema/codec/nostr.js
new file mode 100644
index 0000000..a63bd7e
--- /dev/null
+++ b/vendor/sidestr/schema/codec/nostr.js
@@ -0,0 +1,124 @@
+// A LightNode header source backed by the NIP-333 live stream: kind-33333
+// parameterized replaceable events carrying the newest 12 headers, one
+// stream per network (d = network code). See https://nip-333.github.io/.
+//
+// READ-ONLY by design: this module verifies events (NIP-01 id hash plus
+// BIP-340 signature, using our own verifier) and never signs anything —
+// publishing lives outside the schema. The publisher key is a filter, not
+// a security boundary: headers from here pass the same LightNode
+// validation rules as headers from any other source.
+//
+// Within its 12-header window the source serves both LightNode contracts:
+// headersAfter(tipHash) for syncP2p-style tip following, and
+// tipHeight()/headersRange() so the divergence cross-check can use it.
+
+import { sha256, hexToBytes, bytesToHex } from './hash.js';
+import { verifySchnorr } from './secp256k1.js';
+
+const HEADER_HEX = 160; // 80 bytes
+const KIND = 33333;
+
+// NIP-01: id is the sha256 of the canonical serialization; sig is BIP-340
+// over the id. Returns true iff both hold.
+export function verifyNostrEvent(event) {
+  const serial = JSON.stringify([
+    0, event.pubkey, event.created_at, event.kind, event.tags, event.content,
+  ]);
+  if (bytesToHex(sha256(new TextEncoder().encode(serial))) !== event.id) return false;
+  return verifySchnorr(hexToBytes(event.id), hexToBytes(event.sig), hexToBytes(event.pubkey));
+}
+
+export class NostrSource {
+  constructor({ relays, pubkey, network, codec, verifySig = true, timeoutMs = 8000 }) {
+    if (!relays?.length) throw new Error('NostrSource needs at least one relay');
+    this.relays = relays;
+    this.pubkey = pubkey;
+    this.network = network; // NIP-333 code: btc | tbtc3 | tbtc4
+    this.codec = codec;
+    this.verifySig = verifySig;
+    this.timeoutMs = timeoutMs;
+    this.base = `nostr://${network}`;
+    this.lastEvent = null; // newest accepted event, for callers that care
+  }
+
+  // newest matching event from one relay; null on miss/timeout/junk
+  #fetchFrom(url) {
+    return new Promise((resolve) => {
+      let ws;
+      const done = (v) => { clearTimeout(timer); try { ws?.close(); } catch { /* closing */ } resolve(v); };
+      const timer = setTimeout(() => done(null), this.timeoutMs);
+      try { ws = new WebSocket(url); } catch { return done(null); }
+      ws.binaryType = 'arraybuffer';
+      let newest = null;
+      ws.onopen = () => ws.send(JSON.stringify(['REQ', 'nostr-source',
+        { kinds: [KIND], authors: [this.pubkey], '#d': [this.network], limit: 1 }]));
+      ws.onmessage = (ev) => {
+        const m = JSON.parse(typeof ev.data === 'string' ? ev.data : new TextDecoder().decode(ev.data));
+        if (m[0] === 'EVENT') {
+          const e = m[2];
+          // never trust relay filtering — re-check everything ourselves
+          const d = e.tags?.find((t) => t[0] === 'd')?.[1];
+          if (e.kind === KIND && e.pubkey === this.pubkey && d === this.network
+              && (!newest || e.created_at > newest.created_at)) newest = e;
+        } else if (m[0] === 'EOSE') done(newest);
+      };
+      ws.onerror = () => done(newest);
+      ws.onclose = () => done(newest);
+    });
+  }
+
+  // newest event across all relays, signature-checked; throws if nothing usable
+  async #fetchEvent() {
+    const events = (await Promise.all(this.relays.map((r) => this.#fetchFrom(r)))).filter(Boolean);
+    const ok = this.verifySig ? events.filter((e) => verifyNostrEvent(e)) : events;
+    if (!ok.length) throw new Error(`${this.base}: no valid event on ${this.relays.length} relay(s)`);
+    this.lastEvent = ok.reduce((a, b) => (b.created_at > a.created_at ? b : a));
+    return this.lastEvent;
+  }
+
+  // the event's 12 headers as [{hex, hash, prevBlockHash}], ascending
+  #window(event) {
+    const c = event.content ?? '';
+    if (!/^[0-9a-f]+$/.test(c) || c.length % HEADER_HEX !== 0 || !c.length) {
+      throw new Error(`${this.base}: malformed event content`);
+    }
+    const out = [];
+    for (let i = 0; i < c.length / HEADER_HEX; i++) {
+      const hex = c.slice(i * HEADER_HEX, (i + 1) * HEADER_HEX);
+      const header = this.codec.decode('BlockHeader', hex);
+      out.push({ hex, hash: this.codec.blockHash(header), prevBlockHash: header.prevBlockHash });
+    }
+    return out;
+  }
+
+  #tip(event) {
+    const tip = parseInt(event.tags.find((t) => t[0] === 'tip')?.[1] ?? '', 10);
+    if (!Number.isFinite(tip)) throw new Error(`${this.base}: event has no tip tag`);
+    return tip;
+  }
+
+  // headers strictly after tipHash, [] if we can't connect to it — the
+  // window only reaches 12 back, so a node further behind needs another
+  // source (or the NIP's u-tag bulk channels) first.
+  async headersAfter(tipHash) {
+    const w = this.#window(await this.#fetchEvent());
+    if (w[0].prevBlockHash === tipHash) return w.map((h) => h.hex);
+    const i = w.findIndex((h) => h.hash === tipHash);
+    return i < 0 ? [] : w.slice(i + 1).map((h) => h.hex);
+  }
+
+  async tipHeight() { return this.#tip(await this.#fetchEvent()); }
+
+  // serve heights inside the window; throw outside it (the cross-check
+  // treats an unreachable source as not-divergence, which is honest)
+  async headersRange(start, count) {
+    const event = await this.#fetchEvent();
+    const w = this.#window(event);
+    const tip = this.#tip(event);
+    const first = tip - w.length + 1;
+    if (start < first || start + count - 1 > tip) {
+      throw new Error(`${this.base}: heights ${start}..${start + count - 1} outside window ${first}..${tip}`);
+    }
+    return w.slice(start - first, start - first + count).map((h) => h.hex);
+  }
+}
diff --git a/vendor/sidestr/schema/codec/overlay.js b/vendor/sidestr/schema/codec/overlay.js
new file mode 100644
index 0000000..eb432e3
--- /dev/null
+++ b/vendor/sidestr/schema/codec/overlay.js
@@ -0,0 +1,50 @@
+// Schema overlays: a chain, a structure or a rule that is not part of the
+// Bitcoin model arrives as another JSON-LD graph and is merged in *additively*.
+// An overlay may only add nodes; redefining an `@id` that already exists is an
+// error, so the base model cannot be edited by an overlay, only extended.
+// A node may `extends` an earlier node: missing keys are copied from it, so a
+// forked chain declares just what differs from the chain it forked.
+//
+// An overlay is one graph spanning modules (chains, structs, rules), while the
+// base model is several documents, so a merge into one document leaves
+// references it cannot see (an `extends` or `ruleSet` that lives in another
+// document) untouched for the merge that can. Only a reference that resolves
+// to the wrong kind of node is an error here; a chain that never resolved its
+// `extends` is refused by createKernel.
+export function mergeSchemas(base, ...overlays) {
+  const graph = [];
+  const byId = new Map();
+  const add = (node, origin) => {
+    const id = node['@id'];
+    if (id && byId.has(id)) throw new Error(`overlay ${origin} redefines ${id}`);
+    const parent = node.extends ? byId.get(node.extends) : null;
+    if (parent) {
+      const { extends: _, ...own } = node;
+      node = { ...parent, ...own, '@id': id };
+    }
+    if (id) byId.set(id, node);
+    graph.push(node);
+  };
+  for (const node of base['@graph'] ?? []) add(node, 'base');
+  overlays.forEach((o, i) => { for (const node of o['@graph'] ?? []) add(node, o['@id'] ?? `#${i + 1}`); });
+  // A ValidationRule node with `ruleSet` joins that set (appended, in overlay
+  // order). The set node is cloned first so the base graph is never mutated.
+  for (const node of graph.slice()) {
+    if (node['@type'] !== 'ValidationRule' || !node.ruleSet) continue;
+    const set = byId.get(node.ruleSet);
+    if (!set) continue; // lives in another document
+    if (set['@type'] !== 'RuleSet') throw new Error(`${node['@id']}: ruleSet ${node.ruleSet} is not a RuleSet`);
+    if (!set.__overlayClone) {
+      const clone = { ...set, rules: [...(set.rules ?? [])] };
+      Object.defineProperty(clone, '__overlayClone', { value: true, enumerable: false });
+      graph[graph.indexOf(set)] = clone; byId.set(set['@id'], clone);
+    }
+    byId.get(node.ruleSet).rules.push(node);
+  }
+  // JSON-LD contexts: a base file references its context by string; overlays
+  // add prefixes as objects. Keep both as an array of contexts (valid JSON-LD)
+  // rather than merging a string into an object.
+  const contexts = [base['@context'], ...overlays.map((o) => o['@context'])].filter((c) => c != null);
+  const context = contexts.length === 1 ? contexts[0] : contexts;
+  return { ...base, '@context': context, '@graph': graph };
+}
diff --git a/vendor/sidestr/schema/codec/overlays/knots-blake2b.js b/vendor/sidestr/schema/codec/overlays/knots-blake2b.js
new file mode 100644
index 0000000..7818110
--- /dev/null
+++ b/vendor/sidestr/schema/codec/overlays/knots-blake2b.js
@@ -0,0 +1,66 @@
+// Code half of the Bitcoin Knots BLAKE2b overlay (data half:
+// schema/overlays/knots-blake2b.jsonld). Installs the proof-of-work hash, the
+// derived `time` of a v2 header, and the checks behind the overlay's rules.
+// Semantics follow Knots v29.4.1 validation.cpp; error codes are Knots'.
+import { registerKnotsBlake2b, headerTime, isHeaderV2 } from '../pow/knots-header-v2.js';
+import { hexToBytes } from '../hash.js';
+
+export const REDUCED_DATA_MAX_BLOCK_WEIGHT = 800000;
+
+// RDTS applies to exactly the blocks from the fork height until the parent's
+// median-time-past reaches the expiry (Consensus::Params::RdtsActiveAt).
+export const rdtsActiveAt = (params, height, mtpPrev) =>
+  height >= params.blake2bHeight && mtpPrev < params.rdtsExpiryTime;
+
+const containsBytes = (hay, needle) => {
+  if (!needle.length) return true;
+  outer: for (let i = 0; i + needle.length <= hay.length; i++) {
+    for (let j = 0; j < needle.length; j++) if (hay[i + j] !== needle[j]) continue outer;
+    return true;
+  }
+  return false;
+};
+
+export function headerChecks(params) {
+  return {
+    // CheckBlockHeader: a v2 header's committed height must be at/after the fork
+    'knots:rule-header-v1-until-fork': ({ header }) => !isHeaderV2(header) || header.height >= params.blake2bHeight,
+    // ContextualCheckBlockHeader: from the fork height every header is v2
+    'knots:rule-header-v2-from-fork': ({ header, height }) => height == null ? null : (height < params.blake2bHeight || isHeaderV2(header)),
+    'knots:rule-header-height': ({ header, height }) => !isHeaderV2(header) ? true : height == null ? null : header.height === height,
+    'knots:rule-header-flags-reserved': ({ header }) => !isHeaderV2(header) || (header.flags & 0xc0) === 0,
+  };
+}
+
+export function blockChecks(params, engine) {
+  const headline = params.blake2bHeadline ? new TextEncoder().encode(params.blake2bHeadline) : new Uint8Array(0);
+  return {
+    block: {
+      'knots:rule-block-txcount': ({ block }) => !isHeaderV2(block.header) || block.header.txCount === block.transactions.length,
+      'knots:rule-block-headline': ({ block }) => {
+        if (!isHeaderV2(block.header) || block.header.height !== params.blake2bHeight) return true;
+        const cb = block.transactions[0];
+        return !!cb && containsBytes(hexToBytes(cb.inputs[0].scriptSig), headline);
+      },
+    },
+    blockContext: {
+      'knots:rule-blockctx-weight-rdts': ({ block, height, mtp }) => {
+        if (height == null || mtp == null) return null;
+        return !rdtsActiveAt(params, height, mtp) || engine.blockWeight(block) <= REDUCED_DATA_MAX_BLOCK_WEIGHT;
+      },
+    },
+  };
+}
+
+// createKernel overlay object; `graph` is supplied by the caller (the JSON-LD).
+export const knotsBlake2b = (graph) => ({
+  graph,
+  install(codec) {
+    registerKnotsBlake2b(codec);
+    codec.registerDerived('knots:BlockHeaderV2', (h) => ({ time: headerTime(h) }));
+  },
+  installChecks({ headers, blocks, params }) {
+    headers.registerChecks(headerChecks(params));
+    blocks.registerChecks(blockChecks(params, blocks));
+  },
+});
diff --git a/vendor/sidestr/schema/codec/pow/blake2b.js b/vendor/sidestr/schema/codec/pow/blake2b.js
new file mode 100644
index 0000000..131b780
--- /dev/null
+++ b/vendor/sidestr/schema/codec/pow/blake2b.js
@@ -0,0 +1,87 @@
+// Pure-JS BLAKE2b (RFC 7693), unkeyed, arbitrary output length 1..64.
+// 64-bit words are held as [lo, hi] uint32 pairs so this runs anywhere.
+// The Knots hardfork uses blake2b_nokey(out, 32, in, len) — note that a
+// 32-byte digest is NOT a truncated blake2b-512: the output length is mixed
+// into the parameter block, so the IV differs. Hence this implementation.
+
+const IV = new Uint32Array([
+  0xf3bcc908, 0x6a09e667, 0x84caa73b, 0xbb67ae85, 0xfe94f82b, 0x3c6ef372, 0x5f1d36f1, 0xa54ff53a,
+  0xade682d1, 0x510e527f, 0x2b3e6c1f, 0x9b05688c, 0xfb41bd6b, 0x1f83d9ab, 0x137e2179, 0x5be0cd19,
+]);
+const SIGMA = [
+  [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15],
+  [14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3],
+  [11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4],
+  [7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8],
+  [9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13],
+  [2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9],
+  [12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11],
+  [13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10],
+  [6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5],
+  [10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0],
+  [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15],
+  [14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3],
+].flat().map((x) => x * 2);
+
+const v = new Uint32Array(32), m = new Uint32Array(32);
+
+function add64AA(a, b) { // v[a] += v[b]
+  const o0 = v[a] + v[b]; let o1 = v[a + 1] + v[b + 1]; if (o0 >= 0x100000000) o1++;
+  v[a] = o0; v[a + 1] = o1;
+}
+function add64AC(a, b0, b1) { // v[a] += (b0, b1)
+  let o0 = v[a] + b0; if (b0 < 0) o0 += 0x100000000;
+  let o1 = v[a + 1] + b1; if (o0 >= 0x100000000) o1++;
+  v[a] = o0; v[a + 1] = o1;
+}
+function G(a, b, c, d, ix, iy) {
+  const x0 = m[ix], x1 = m[ix + 1], y0 = m[iy], y1 = m[iy + 1];
+  add64AA(a, b); add64AC(a, x0, x1);
+  let xor0 = v[d] ^ v[a], xor1 = v[d + 1] ^ v[a + 1];
+  v[d] = xor1; v[d + 1] = xor0;                                             // rotr 32
+  add64AA(c, d);
+  xor0 = v[b] ^ v[c]; xor1 = v[b + 1] ^ v[c + 1];
+  v[b] = (xor0 >>> 24) ^ (xor1 << 8); v[b + 1] = (xor1 >>> 24) ^ (xor0 << 8); // rotr 24
+  add64AA(a, b); add64AC(a, y0, y1);
+  xor0 = v[d] ^ v[a]; xor1 = v[d + 1] ^ v[a + 1];
+  v[d] = (xor0 >>> 16) ^ (xor1 << 16); v[d + 1] = (xor1 >>> 16) ^ (xor0 << 16); // rotr 16
+  add64AA(c, d);
+  xor0 = v[b] ^ v[c]; xor1 = v[b + 1] ^ v[c + 1];
+  v[b] = (xor1 >>> 31) ^ (xor0 << 1); v[b + 1] = (xor0 >>> 31) ^ (xor1 << 1); // rotr 63
+}
+
+function compress(ctx, last) {
+  for (let i = 0; i < 16; i++) { v[i] = ctx.h[i]; v[i + 16] = IV[i]; }
+  v[24] ^= ctx.t; v[25] ^= ctx.t / 0x100000000;
+  if (last) { v[28] = ~v[28]; v[29] = ~v[29]; }
+  const b = ctx.b;
+  for (let i = 0; i < 32; i++) m[i] = b[4 * i] ^ (b[4 * i + 1] << 8) ^ (b[4 * i + 2] << 16) ^ (b[4 * i + 3] << 24);
+  for (let r = 0; r < 12; r++) {
+    const s = r * 16;
+    G(0, 8, 16, 24, SIGMA[s + 0], SIGMA[s + 1]);
+    G(2, 10, 18, 26, SIGMA[s + 2], SIGMA[s + 3]);
+    G(4, 12, 20, 28, SIGMA[s + 4], SIGMA[s + 5]);
+    G(6, 14, 22, 30, SIGMA[s + 6], SIGMA[s + 7]);
+    G(0, 10, 20, 30, SIGMA[s + 8], SIGMA[s + 9]);
+    G(2, 12, 22, 24, SIGMA[s + 10], SIGMA[s + 11]);
+    G(4, 14, 16, 26, SIGMA[s + 12], SIGMA[s + 13]);
+    G(6, 8, 18, 28, SIGMA[s + 14], SIGMA[s + 15]);
+  }
+  for (let i = 0; i < 16; i++) ctx.h[i] ^= v[i] ^ v[i + 16];
+}
+
+export function blake2b(input, outlen = 32) {
+  if (!(outlen > 0 && outlen <= 64)) throw new Error('blake2b: outlen must be 1..64');
+  const ctx = { h: new Uint32Array(IV), b: new Uint8Array(128), c: 0, t: 0, outlen };
+  ctx.h[0] ^= 0x01010000 ^ outlen; // parameter block: digest_length, key_length=0, fanout=1, depth=1
+  for (let i = 0; i < input.length; i++) {
+    if (ctx.c === 128) { ctx.t += ctx.c; compress(ctx, false); ctx.c = 0; }
+    ctx.b[ctx.c++] = input[i];
+  }
+  ctx.t += ctx.c;
+  while (ctx.c < 128) ctx.b[ctx.c++] = 0;
+  compress(ctx, true);
+  const out = new Uint8Array(outlen);
+  for (let i = 0; i < outlen; i++) out[i] = ctx.h[i >> 2] >> (8 * (i & 3));
+  return out;
+}
diff --git a/vendor/sidestr/schema/codec/pow/knots-header-v2.js b/vendor/sidestr/schema/codec/pow/knots-header-v2.js
new file mode 100644
index 0000000..a1bfb39
--- /dev/null
+++ b/vendor/sidestr/schema/codec/pow/knots-header-v2.js
@@ -0,0 +1,69 @@
+// Bitcoin Knots BLAKE2b proof of work for the v2 block header (v29.4.1,
+// src/primitives/block.cpp CBlockHeader::GetHash). Operates on the object the
+// codec decodes for knots:BlockHeaderV2 (see schema/overlays/knots-blake2b.jsonld):
+// hashes in display order, 16-byte fields in wire order, `version` raw.
+//
+//   h1  = tagged("Bitcoin block header 1", version‖prev‖height‖merkle‖time‖0‖bits‖txCount(u32)‖flags‖clearBits‖sha256tag(xorKey))
+//   h2  = tagged("Merge-mining hook", h1 ‖ 0¹⁶ ‖ 0¹⁶ ‖ mmRhs)
+//   b1  = blake2b-256(0³² ‖ h2 ‖ extranonce)
+//   b2  = blake2b-256(profile-dependent layout of prevHidden/h2, nonces, b1)
+//   hash = b2 XOR mask(xorKey, clearBits)          (display-order bytes)
+import { taggedHash, bytesToHex, hexToBytes } from '../hash.js';
+import { blake2b } from './blake2b.js';
+
+export const VERSION_HEADER_V2_FLAG = 0x80000000;
+export const FLAG_USE_TIME_OFFSET = 4;
+export const POW_HASH_NAME = 'knots:blake2b-v2';
+
+const rev = (b) => Uint8Array.from(b).reverse();
+const u32 = (n) => { const b = new Uint8Array(4); new DataView(b.buffer).setUint32(0, n >>> 0, true); return b; };
+const cat = (...parts) => { const out = new Uint8Array(parts.reduce((s, p) => s + p.length, 0)); let o = 0; for (const p of parts) { out.set(p, o); o += p.length; } return out; };
+
+export const isHeaderV2 = (h) => ((h.version >>> 0) & VERSION_HEADER_V2_FLAG) !== 0;
+// Consensus block time: the wire time plus the offset when the flag says so.
+export const headerTime = (h) => (h.flags & FLAG_USE_TIME_OFFSET) ? (h.timeOnWire + h.timeOffset) >>> 0 : h.timeOnWire;
+
+export function hashHeaderV2Detailed(h) {
+  const xorKeyWire = hexToBytes(h.xorKey);
+  const prevDisplay = hexToBytes(h.prevBlockHash);          // hashPrevBlock.ReversedBytes()
+  const xorKeyHash = taggedHash('Bitcoin block hash PoW XOR key', xorKeyWire);
+  const mask = new Uint8Array(32);
+  if (xorKeyWire.some((x) => x !== 0)) {
+    mask.set(taggedHash('Bitcoin block hash PoW XOR mask', xorKeyWire));
+    const clearBytes = h.xorKeyMaskClearBits >> 3;
+    mask.fill(0, 0, clearBytes);
+    if (clearBytes < 32) mask[clearBytes] &= 0xff >> (h.xorKeyMaskClearBits & 7);
+  }
+  const prevHidden = taggedHash('Bitcoin prevblock header, hashed', prevDisplay);
+  const h1 = taggedHash('Bitcoin block header 1', cat(
+    u32(h.version), prevDisplay, u32(h.height), rev(hexToBytes(h.merkleRoot)), u32(h.timeOnWire),
+    Uint8Array.of(0), u32(h.bits), u32(h.txCount), Uint8Array.of(h.flags, h.xorKeyMaskClearBits), xorKeyHash,
+  ));
+  const zeros16 = new Uint8Array(16);
+  const h2 = taggedHash('Merge-mining hook', cat(h1, zeros16, zeros16, rev(hexToBytes(h.mmRhs))));
+  const b1 = blake2b(cat(u32(0), h2, hexToBytes(h.extranonce)), 32);
+  const nonces = [u32(h.nonce), u32(h.nonce2), u32(h.timeOffset), u32(h.nonce3)];
+  let asicInput;
+  switch (h.flags & 3) {
+    case 0: { const p = Uint8Array.from(prevHidden); p.fill(0, 0, 6); asicInput = cat(p, ...nonces, b1); break; }
+    case 1: asicInput = cat(u32(h.nonce), u32(h.nonce2), u32(h.nonce3), u32(h.timeOffset), b1, h2); break;
+    case 2: asicInput = cat(new Uint8Array(48), h2, ...nonces, b1); break;
+    default: asicInput = cat(new Uint8Array(80), h2, ...nonces, b1); break;
+  }
+  const b2 = blake2b(asicInput, 32);
+  const hash = b2.map((x, i) => x ^ mask[i]);
+  return {
+    xorKeyHash: bytesToHex(xorKeyHash), h1: bytesToHex(h1), h2: bytesToHex(h2),
+    blake2b1: bytesToHex(b1), blake2b2: bytesToHex(b2), mask: bytesToHex(mask),
+    asicProfile: h.flags & 3, asicInput: bytesToHex(asicInput), blockHash: bytesToHex(hash),
+  };
+}
+export const hashHeaderV2 = (h) => hashHeaderV2Detailed(h).blockHash;
+
+// Register the chain's PoW hash on a codec. A v1 (80-byte) header on these
+// chains — the pre-fork history — is still SHA256d.
+export function registerKnotsBlake2b(codec) {
+  const sha256d = codec.powHashes.get('sha256d');
+  codec.registerPowHash(POW_HASH_NAME, (bytes, header) => isHeaderV2(header) ? hashHeaderV2(header) : sha256d(bytes));
+  return codec;
+}
diff --git a/vendor/sidestr/schema/codec/script.js b/vendor/sidestr/schema/codec/script.js
new file mode 100644
index 0000000..ffd98ae
--- /dev/null
+++ b/vendor/sidestr/schema/codec/script.js
@@ -0,0 +1,246 @@
+// Schema-driven script engine.
+//
+// Opcode names come from the Opcode enumeration and classification templates
+// from the ScriptType enumeration in schema/script.jsonld; address encoding
+// is parameterized by NetworkParams (schema/chain.jsonld). This file holds
+// only the mechanics: byte walking, template matching, base58check and
+// bech32/bech32m encoding.
+
+import { dsha256, bytesToHex, hexToBytes } from './hash.js';
+
+const B58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+const B32 = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';
+
+function base58check(versionByte, payload) {
+  const data = new Uint8Array(1 + payload.length + 4);
+  data[0] = versionByte;
+  data.set(payload, 1);
+  data.set(dsha256(data.subarray(0, 1 + payload.length)).subarray(0, 4), 1 + payload.length);
+  let n = 0n;
+  for (const b of data) n = (n << 8n) | BigInt(b);
+  let out = '';
+  while (n > 0n) { out = B58[Number(n % 58n)] + out; n /= 58n; }
+  for (const b of data) { if (b !== 0) break; out = '1' + out; }
+  return out;
+}
+
+function bech32Polymod(values) {
+  const GEN = [0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3];
+  let chk = 1;
+  for (const v of values) {
+    const top = chk >>> 25;
+    chk = ((chk & 0x1ffffff) << 5) ^ v;
+    for (let i = 0; i < 5; i++) if ((top >>> i) & 1) chk ^= GEN[i];
+  }
+  return chk >>> 0;
+}
+
+function bech32Encode(hrp, witnessVersion, program, constant) {
+  const data = [witnessVersion];
+  let acc = 0, bits = 0;
+  for (const b of program) {
+    acc = (acc << 8) | b; bits += 8;
+    while (bits >= 5) { bits -= 5; data.push((acc >>> bits) & 31); }
+  }
+  if (bits > 0) data.push((acc << (5 - bits)) & 31);
+  const hrpExp = [...[...hrp].map((c) => c.charCodeAt(0) >>> 5), 0, ...[...hrp].map((c) => c.charCodeAt(0) & 31)];
+  const polymod = bech32Polymod([...hrpExp, ...data, 0, 0, 0, 0, 0, 0]) ^ constant;
+  const checksum = Array.from({ length: 6 }, (_, i) => (polymod >>> (5 * (5 - i))) & 31);
+  return hrp + '1' + [...data, ...checksum].map((d) => B32[d]).join('');
+}
+
+export class ScriptEngine {
+  constructor(opcodeEnum, scriptTypeEnum, params) {
+    this.params = params;
+    this.byCode = new Map(opcodeEnum.members.map((m) => [m.code, m.name]));
+    this.byName = new Map(opcodeEnum.members.map((m) => [m.name, m.code]));
+    this.scriptTypes = scriptTypeEnum.members;
+  }
+
+  static fromSchemas(scriptSchema, chainSchema, network = 'btc:mainnet') {
+    const node = (id) => scriptSchema['@graph'].find((n) => n['@id'] === id);
+    return new ScriptEngine(node('btc:Opcode'), node('btc:ScriptType'),
+      chainSchema['@graph'].find((n) => n['@id'] === network));
+  }
+
+  // hex -> [{code, name, data?}]; data (hex) present for pushes.
+  // A malformed tail yields a final op with `error` set rather than a throw.
+  parse(hex) {
+    const bytes = hexToBytes(hex);
+    const ops = [];
+    let i = 0;
+    while (i < bytes.length) {
+      const at = i;                     // byte offset of this opcode (OP_CODESEPARATOR scriptCode truncation needs it)
+      const code = bytes[i++];
+      let len = null;
+      if (code >= 0x01 && code <= 0x4b) len = code;
+      else if (code === 0x4c) { len = bytes[i]; i += 1; }
+      else if (code === 0x4d) { len = bytes[i] | (bytes[i + 1] << 8); i += 2; }
+      // >>> 0: the 4-byte length is unsigned. Without it, JS's `<< 24` makes a
+      // high-bit length negative, which slips past the bounds check below and
+      // sends `i` negative, looping into undefined bytes (crashes on malformed
+      // coinbase scriptSig data). See bitcoin-desktop/schema#62.
+      else if (code === 0x4e) { len = (bytes[i] | (bytes[i + 1] << 8) | (bytes[i + 2] << 16) | (bytes[i + 3] << 24)) >>> 0; i += 4; }
+      if (len === null) {
+        ops.push({ code, name: this.byCode.get(code) ?? `OP_UNKNOWN_0x${code.toString(16).padStart(2, '0')}`, at });
+        continue;
+      }
+      // Truncated if the length prefix itself overran the end (i > length, len
+      // undefined/0), the declared push runs past the end, or len isn't finite.
+      if (len == null || Number.isNaN(len) || i > bytes.length || i + len > bytes.length) {
+        ops.push({ code, name: 'OP_PUSH', error: 'truncated push', at });
+        break;
+      }
+      const name = code <= 0x4b ? `OP_PUSHBYTES_${code}` : this.byCode.get(code);
+      ops.push({ code, name, data: bytesToHex(bytes.subarray(i, i + len)), at });
+      i += len;
+    }
+    return ops;
+  }
+
+  asm(hex) {
+    return this.parse(hex).map((op) => op.error ? `[${op.error}]` : op.data ?? op.name).join(' ');
+  }
+
+  // Match one ScriptType template ("OP_DUP OP_HASH160 <20> ..."): <n> matches
+  // a *direct* push (opcode 0x01..0x4b) of exactly n bytes, <a|b> of either
+  // length. A PUSHDATA1/2/4 carrying the same bytes does not match, exactly as
+  // in Core (IsPayToScriptHash / IsWitnessProgram / the Solver templates check
+  // the byte layout): BIP 16 treats "HASH160 PUSHDATA1 <20> EQUAL" as a bare
+  // script, not P2SH.
+  #matchTemplate(template, ops) {
+    const tokens = template.split(' ');
+    if (tokens.length !== ops.length) return false;
+    return tokens.every((tok, i) => {
+      const op = ops[i];
+      if (tok.startsWith('<')) {
+        if (op.data == null || op.code > 0x4b) return false;
+        return tok.slice(1, -1).split('|').some((n) => op.data.length === 2 * Number(n));
+      }
+      return op.name === tok && op.data == null;
+    });
+  }
+
+  #isSmallInt(op) { return op.code === 0x00 || (op.code >= 0x51 && op.code <= 0x60); }
+  #smallInt(op) { return op.code === 0x00 ? 0 : op.code - 0x50; }
+
+  #matchSpecial(kind, ops) {
+    switch (kind) {
+      case 'nulldata':
+        return ops.length >= 1 && ops[0].name === 'OP_RETURN';
+      case 'multisig': {
+        if (ops.length < 4 || ops.at(-1).name !== 'OP_CHECKMULTISIG') return false;
+        const [m, n] = [ops[0], ops.at(-2)];
+        if (!this.#isSmallInt(m) || !this.#isSmallInt(n)) return false;
+        const keys = ops.slice(1, -2);
+        return keys.length === this.#smallInt(n) && this.#smallInt(m) >= 1
+          && this.#smallInt(m) <= this.#smallInt(n)
+          && keys.every((k) => k.data && (k.data.length === 66 || k.data.length === 130));
+      }
+      case 'witness-unknown': {
+        if (ops.length !== 2 || !ops[1].data || ops[1].code > 0x4b) return false;
+        const v = ops[0].code;
+        const len = ops[1].data.length / 2;
+        return v >= 0x52 && v <= 0x60 && len >= 2 && len <= 40;
+      }
+      case 'anchor': // BIP 431: exactly OP_1 PUSH2 0x4e73
+        return ops.length === 2 && ops[0].name === 'OP_1' && ops[1].code === 2 && ops[1].data === '4e73';
+      case 'fallback':
+        return true;
+      default:
+        return false;
+    }
+  }
+
+  address(type, ops) {
+    const enc = type.addressEncoding;
+    if (!enc) return null;
+    const pushes = ops.filter((op) => op.data != null);
+    const payload = hexToBytes(pushes[Number(enc.payload.split(':')[1])].data);
+    if (enc.encoding === 'base58check') return base58check(this.params[enc.versionParam], payload);
+    const witnessVersion = enc.witnessVersion ?? this.#smallInt(ops[0]);
+    const constant = enc.encoding === 'bech32' ? 1 : 0x2bc830a3;
+    return bech32Encode(this.params.bech32Hrp, witnessVersion, payload, constant);
+  }
+
+  // hex -> {type, address|null, asm}
+  classify(hex) {
+    const ops = this.parse(hex);
+    const broken = ops.some((op) => op.error);
+    for (const t of this.scriptTypes) {
+      const matched = !broken && (t.template
+        ? this.#matchTemplate(t.template, ops)
+        : this.#matchSpecial(t.special, ops));
+      if (matched || (broken && t.special === 'fallback')) {
+        return { type: t.name, address: matched ? this.address(t, ops) : null, asm: this.asm(hex) };
+      }
+    }
+    return { type: 'nonstandard', address: null, asm: this.asm(hex) };
+  }
+}
+
+// ---- address decoding (the inverse of the encoders above) ----
+
+export function base58checkDecode(str) {
+  let n = 0n;
+  for (const ch of str) {
+    const v = B58.indexOf(ch);
+    if (v < 0) return null;
+    n = n * 58n + BigInt(v);
+  }
+  const bytes = [];
+  while (n > 0n) { bytes.unshift(Number(n & 0xffn)); n >>= 8n; }
+  for (const ch of str) { if (ch !== '1') break; bytes.unshift(0); }
+  if (bytes.length < 5) return null;
+  const data = Uint8Array.from(bytes);
+  const payload = data.subarray(0, data.length - 4);
+  const check = dsha256(payload).subarray(0, 4);
+  if (!check.every((b, i) => b === data[data.length - 4 + i])) return null;
+  return { version: payload[0], payload: payload.subarray(1) };
+}
+
+export function bech32Decode(addr) {
+  const lower = addr.toLowerCase();
+  if (addr !== lower && addr !== addr.toUpperCase()) return null;
+  const sep = lower.lastIndexOf('1');
+  if (sep < 1 || sep + 7 > lower.length) return null;
+  const hrp = lower.slice(0, sep);
+  const data = [...lower.slice(sep + 1)].map((c) => B32.indexOf(c));
+  if (data.includes(-1)) return null;
+  const hrpExp = [...[...hrp].map((c) => c.charCodeAt(0) >>> 5), 0, ...[...hrp].map((c) => c.charCodeAt(0) & 31)];
+  const polymod = bech32Polymod([...hrpExp, ...data]);
+  const encoding = polymod === 1 ? 'bech32' : polymod === 0x2bc830a3 ? 'bech32m' : null;
+  if (!encoding) return null;
+  const values = data.slice(0, -6);
+  const witnessVersion = values[0];
+  let acc = 0, bits = 0;
+  const program = [];
+  for (const v of values.slice(1)) {
+    acc = (acc << 5) | v; bits += 5;
+    while (bits >= 8) { bits -= 8; program.push((acc >>> bits) & 0xff); }
+  }
+  if (bits >= 5 || ((acc << (8 - bits)) & 0xff)) return null;
+  return { hrp, witnessVersion, program: Uint8Array.from(program), encoding };
+}
+
+// address -> scriptPubKey hex for the given NetworkParams, or null.
+export function addressToScript(address, params) {
+  const b32 = bech32Decode(address);
+  if (b32) {
+    if (b32.hrp !== params.bech32Hrp) return null;
+    const { witnessVersion: v, program, encoding } = b32;
+    if (v < 0 || v > 16 || program.length < 2 || program.length > 40) return null;
+    if (v === 0 && (encoding !== 'bech32' || (program.length !== 20 && program.length !== 32))) return null;
+    if (v > 0 && encoding !== 'bech32m') return null;
+    const opcode = v === 0 ? 0 : 0x50 + v;
+    return opcode.toString(16).padStart(2, '0')
+      + program.length.toString(16).padStart(2, '0') + bytesToHex(program);
+  }
+  const b58 = base58checkDecode(address);
+  if (b58 && b58.payload.length === 20) {
+    const h = bytesToHex(b58.payload);
+    if (b58.version === params.p2pkhVersion) return '76a914' + h + '88ac';
+    if (b58.version === params.p2shVersion) return 'a914' + h + '87';
+  }
+  return null;
+}
diff --git a/vendor/sidestr/schema/codec/secp256k1.js b/vendor/sidestr/schema/codec/secp256k1.js
new file mode 100644
index 0000000..a06da3d
--- /dev/null
+++ b/vendor/sidestr/schema/codec/secp256k1.js
@@ -0,0 +1,237 @@
+// Zero-dependency ECDSA *verification* over secp256k1, in BigInt arithmetic.
+// Verification only — no signing, no private keys, and no constant-time
+// requirements. Jacobian coordinates avoid a field inversion per step.
+
+const P = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2fn;
+export const N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;
+const GX = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798n;
+const GY = 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8n;
+
+const mod = (a, m = P) => ((a % m) + m) % m;
+
+function modpow(b, e, m) {
+  let r = 1n; b = mod(b, m);
+  while (e > 0n) {
+    if (e & 1n) r = (r * b) % m;
+    b = (b * b) % m;
+    e >>= 1n;
+  }
+  return r;
+}
+const inv = (a, m) => modpow(a, m - 2n, m); // m prime (Fermat)
+
+// Jacobian point ops; null = point at infinity.
+function jDouble(p) {
+  if (!p) return null;
+  const [X, Y, Z] = p;
+  if (Y === 0n) return null;
+  const S = mod(4n * X * Y * Y);
+  const M = mod(3n * X * X); // a = 0 for secp256k1
+  const X2 = mod(M * M - 2n * S);
+  const Y2 = mod(M * (S - X2) - 8n * Y * Y * Y * Y);
+  return [X2, Y2, mod(2n * Y * Z)];
+}
+
+function jAdd(p, q) {
+  if (!p) return q;
+  if (!q) return p;
+  const [X1, Y1, Z1] = p, [X2, Y2, Z2] = q;
+  const Z1Z1 = mod(Z1 * Z1), Z2Z2 = mod(Z2 * Z2);
+  const U1 = mod(X1 * Z2Z2), U2 = mod(X2 * Z1Z1);
+  const S1 = mod(Y1 * Z2 * Z2Z2), S2 = mod(Y2 * Z1 * Z1Z1);
+  if (U1 === U2) return S1 === S2 ? jDouble(p) : null;
+  const H = mod(U2 - U1);
+  const R = mod(S2 - S1);
+  const HH = mod(H * H), HHH = mod(H * HH);
+  const X3 = mod(R * R - HHH - 2n * U1 * HH);
+  const Y3 = mod(R * (U1 * HH - X3) - S1 * HHH);
+  return [X3, Y3, mod(H * Z1 * Z2)];
+}
+
+function jMul(p, k) {
+  let acc = null, addend = p;
+  while (k > 0n) {
+    if (k & 1n) acc = jAdd(acc, addend);
+    addend = jDouble(addend);
+    k >>= 1n;
+  }
+  return acc;
+}
+
+const toAffineX = (p) => {
+  const zi = inv(p[2], P);
+  return mod(p[0] * zi * zi);
+};
+
+const bytesToBig = (bytes) => {
+  let n = 0n;
+  for (const b of bytes) n = (n << 8n) | BigInt(b);
+  return n;
+};
+
+// 33-byte compressed (02/03) or 65-byte uncompressed (04) SEC1 public key
+// -> affine point, or null if not on the curve.
+export function parsePubkey(bytes) {
+  // 0x04 uncompressed; 0x06/0x07 hybrid (valid pre-STRICTENC, y given explicitly)
+  if (bytes.length === 65 && (bytes[0] === 0x04 || bytes[0] === 0x06 || bytes[0] === 0x07)) {
+    const x = bytesToBig(bytes.subarray(1, 33));
+    const y = bytesToBig(bytes.subarray(33, 65));
+    if (mod(y * y) !== mod(x * x * x + 7n)) return null;
+    return [x, y];
+  }
+  if (bytes.length === 33 && (bytes[0] === 0x02 || bytes[0] === 0x03)) {
+    const x = bytesToBig(bytes.subarray(1));
+    if (x >= P) return null;
+    let y = modpow(mod(x * x * x + 7n), (P + 1n) / 4n, P);
+    if (mod(y * y) !== mod(x * x * x + 7n)) return null;
+    if ((y & 1n) !== BigInt(bytes[0] & 1)) y = P - y;
+    return [x, y];
+  }
+  return null;
+}
+
+// Lenient DER (r, s) parsing — pre-BIP66 chain data is not always minimally
+// encoded, and verification of historical blocks must accept it.
+export function parseDerSignature(bytes) {
+  try {
+    if (bytes[0] !== 0x30) return null;
+    let i = 2;
+    if (bytes[i] !== 0x02) return null;
+    const rLen = bytes[i + 1];
+    const r = bytesToBig(bytes.subarray(i + 2, i + 2 + rLen));
+    i += 2 + rLen;
+    if (bytes[i] !== 0x02) return null;
+    const sLen = bytes[i + 1];
+    const s = bytesToBig(bytes.subarray(i + 2, i + 2 + sLen));
+    return { r, s };
+  } catch {
+    return null;
+  }
+}
+
+// Optional verify backend (e.g. WASM libsecp256k1) injected by performance-
+// sensitive callers; null = the pure-JS path. Keeps this module zero-dependency:
+// the engine never imports a WASM lib, the caller supplies one.
+let __verifyBackend = null;
+export function setVerifyBackend(b) { __verifyBackend = b; }
+
+// ECDSA verify: signature (parsed r,s) over a 32-byte message hash with an
+// affine public key point.
+export function verifyEcdsa(msgHash, sig, pubkey) {
+  if (__verifyBackend) return __verifyBackend.ecdsa(msgHash, sig, pubkey);
+  const { r, s } = sig;
+  if (r <= 0n || r >= N || s <= 0n || s >= N) return false;
+  const e = mod(bytesToBig(msgHash), N);
+  const w = inv(s, N);
+  const u1 = mod(e * w, N);
+  const u2 = mod(r * w, N);
+  const G = [GX, GY, 1n];
+  const Q = [pubkey[0], pubkey[1], 1n];
+  const R = jAdd(jMul(G, u1), jMul(Q, u2));
+  if (!R) return false;
+  return mod(toAffineX(R), N) === r;
+}
+
+// ---- BIP 340 Schnorr verification ----
+
+import { taggedHash } from './hash.js';
+
+const bigToBytes = (n) => {
+  const out = new Uint8Array(32);
+  for (let i = 31; i >= 0; i--) { out[i] = Number(n & 0xffn); n >>= 8n; }
+  return out;
+};
+
+// Lift an x-only key to the even-y curve point, or null.
+export function liftX(xBytes) {
+  const x = bytesToBig(xBytes);
+  if (x >= P) return null;
+  const c = mod(x * x * x + 7n);
+  const y = modpow(c, (P + 1n) / 4n, P);
+  if (mod(y * y) !== c) return null;
+  return [x, (y & 1n) === 0n ? y : P - y];
+}
+
+export function verifySchnorr(msg32, sig64, pubkey32) {
+  if (__verifyBackend) return __verifyBackend.schnorr(msg32, sig64, pubkey32);
+  if (sig64.length !== 64 || pubkey32.length !== 32) return false;
+  const Ppoint = liftX(pubkey32);
+  if (!Ppoint) return false;
+  const r = bytesToBig(sig64.subarray(0, 32));
+  const s = bytesToBig(sig64.subarray(32));
+  if (r >= P || s >= N) return false;
+  const e = mod(bytesToBig(taggedHash('BIP0340/challenge',
+    sig64.subarray(0, 32), pubkey32, msg32)), N);
+  // R = s*G - e*P
+  const G = [GX, GY, 1n];
+  const R = jAdd(jMul(G, s), jMul([Ppoint[0], Ppoint[1], 1n], mod(N - e, N)));
+  if (!R) return false;
+  const zi = inv(R[2], P);
+  const ax = mod(R[0] * zi * zi);
+  const ay = mod(R[1] * zi * zi * zi);
+  return (ay & 1n) === 0n && ax === r;
+}
+
+// Verify a taproot output-key commitment: outputKey == lift_x(internalKey) + t*G
+// with the given y-parity, where t = taggedHash("TapTweak", internalKey || merkleRoot).
+export function checkTapTweak(internalKey32, merkleRoot, outputKey32, parity) {
+  const Pp = liftX(internalKey32);
+  if (!Pp) return false;
+  const t = bytesToBig(taggedHash('TapTweak',
+    internalKey32, ...(merkleRoot ? [merkleRoot] : [])));
+  if (t >= N) return false;
+  const G = [GX, GY, 1n];
+  const Q = jAdd([Pp[0], Pp[1], 1n], jMul(G, t));
+  if (!Q) return false;
+  const zi = inv(Q[2], P);
+  const qx = mod(Q[0] * zi * zi);
+  const qy = mod(Q[1] * zi * zi * zi);
+  return qx === bytesToBig(outputKey32) && Number(qy & 1n) === parity;
+}
+
+// ---- BIP 32 public derivation + BIP 86 output keys ----
+
+function compress(point) {
+  const out = new Uint8Array(33);
+  out[0] = (point[1] & 1n) === 0n ? 0x02 : 0x03;
+  out.set(bigToBytes(point[0]), 1);
+  return out;
+}
+
+// Compressed public key for a 32-byte scalar — pure public curve math
+// (the schema stays verify-only: no signing, nonces, or key generation).
+export function publicKeyFromPrivate(priv32) {
+  const d = bytesToBig(priv32);
+  if (d <= 0n || d >= N) return null;
+  const Q = jMul([GX, GY, 1n], d);
+  if (!Q) return null;
+  const zi = inv(Q[2], P);
+  return compress([mod(Q[0] * zi * zi), mod(Q[1] * zi * zi * zi)]);
+}
+
+// CKDpub child key: point(IL) + Kpar. Returns compressed bytes or null on
+// the (negligible-probability) invalid cases BIP 32 says to skip.
+export function ckdPubKey(parentPub33, il32) {
+  const il = bytesToBig(il32);
+  if (il >= N) return null;
+  const K = parsePubkey(parentPub33);
+  if (!K) return null;
+  const child = jAdd(jMul([GX, GY, 1n], il), [K[0], K[1], 1n]);
+  if (!child) return null;
+  const zi = inv(child[2], P);
+  return compress([mod(child[0] * zi * zi), mod(child[1] * zi * zi * zi)]);
+}
+
+// BIP 341/86 output key: x-only internal key tweaked by the (optional)
+// merkle root. Returns the 32-byte x-only output key, or null.
+export function tapOutputKey(internalKey32, merkleRoot = null) {
+  const Pp = liftX(internalKey32);
+  if (!Pp) return null;
+  const t = bytesToBig(taggedHash('TapTweak',
+    internalKey32, ...(merkleRoot ? [merkleRoot] : [])));
+  if (t >= N) return null;
+  const Q = jAdd([Pp[0], Pp[1], 1n], jMul([GX, GY, 1n], t));
+  if (!Q) return null;
+  const zi = inv(Q[2], P);
+  return bigToBytes(mod(Q[0] * zi * zi));
+}
diff --git a/vendor/sidestr/schema/schema/chain.jsonld b/vendor/sidestr/schema/schema/chain.jsonld
new file mode 100644
index 0000000..0c03fbb
--- /dev/null
+++ b/vendor/sidestr/schema/schema/chain.jsonld
@@ -0,0 +1,474 @@
+{
+  "@context": "../context.jsonld",
+  "@graph": [
+    {
+      "@id": "btc:chain",
+      "@type": "Module",
+      "label": "chain",
+      "version": "0.0.13",
+      "comment": "Chain-contextual structures: state that depends on which chain you are following and where its tip is. Nothing in this module is covered by proof-of-work; it parameterizes and indexes the consensus structures defined in core.",
+      "layer": "context"
+    },
+    {
+      "@id": "btc:NetworkParams",
+      "@type": "ContextStruct",
+      "module": "btc:chain",
+      "label": "NetworkParams",
+      "comment": "Consensus parameters of a Bitcoin network deployment. These are constants agreed by convention at network genesis, not serialized data.",
+      "fields": [
+        {
+          "property": "btc:networkName",
+          "label": "name",
+          "valueType": "string",
+          "comment": "Human name of the network."
+        },
+        {
+          "property": "btc:magic",
+          "label": "magic",
+          "valueType": "hex",
+          "comment": "Four magic bytes prefixing every P2P message on this network."
+        },
+        {
+          "property": "btc:genesisHash",
+          "label": "genesisHash",
+          "valueType": "hash",
+          "comment": "Hash of the network's genesis block header."
+        },
+        {
+          "property": "btc:powLimit",
+          "label": "powLimit",
+          "valueType": "hex",
+          "comment": "Maximum (easiest) allowed proof-of-work target, as a 256-bit value."
+        },
+        {
+          "property": "btc:targetTimespan",
+          "label": "targetTimespan",
+          "valueType": "u32",
+          "comment": "Difficulty retarget period in seconds: two weeks (1,209,600)."
+        },
+        {
+          "property": "btc:targetSpacing",
+          "label": "targetSpacing",
+          "valueType": "u32",
+          "comment": "Target interval between blocks in seconds: ten minutes (600)."
+        },
+        {
+          "property": "btc:difficultyAdjustmentInterval",
+          "label": "difficultyAdjustmentInterval",
+          "valueType": "u32",
+          "comment": "Blocks per difficulty epoch: targetTimespan / targetSpacing = 2016."
+        },
+        {
+          "property": "btc:maxFutureBlockTime",
+          "label": "maxFutureBlockTime",
+          "valueType": "u32",
+          "comment": "Maximum seconds a block timestamp may be ahead of network-adjusted time: 7200 (2 hours)."
+        },
+        {
+          "property": "btc:halvingInterval",
+          "label": "halvingInterval",
+          "valueType": "u32",
+          "comment": "Blocks between block-subsidy halvings: 210,000."
+        },
+        {
+          "property": "btc:port",
+          "label": "port",
+          "valueType": "u16",
+          "comment": "Default P2P TCP port."
+        },
+        {
+          "property": "btc:p2pkhVersion",
+          "label": "p2pkhVersion",
+          "valueType": "u8",
+          "comment": "Base58Check version byte for pay-to-public-key-hash addresses."
+        },
+        {
+          "property": "btc:p2shVersion",
+          "label": "p2shVersion",
+          "valueType": "u8",
+          "comment": "Base58Check version byte for pay-to-script-hash addresses."
+        },
+        {
+          "property": "btc:bech32Hrp",
+          "label": "bech32Hrp",
+          "valueType": "string",
+          "comment": "Human-readable part of bech32/bech32m segwit addresses (BIP 173/350)."
+        },
+        {
+          "property": "btc:maxMoney",
+          "label": "maxMoney",
+          "valueType": "i64",
+          "comment": "Maximum total supply in satoshis: 21,000,000 BTC."
+        },
+        {
+          "property": "btc:initialSubsidy",
+          "label": "initialSubsidy",
+          "valueType": "i64",
+          "comment": "Block subsidy at genesis in satoshis: 50 BTC, halving every halvingInterval blocks."
+        },
+        {
+          "property": "btc:maxBlockWeight",
+          "label": "maxBlockWeight",
+          "valueType": "u32",
+          "comment": "Consensus block weight limit (BIP 141): 4,000,000 weight units."
+        },
+        {
+          "property": "btc:bip34Height",
+          "label": "bip34Height",
+          "valueType": "u32",
+          "comment": "Buried deployment: height from which coinbase scripts must encode the block height (BIP 34)."
+        },
+        {
+          "property": "btc:bip65Height",
+          "label": "bip65Height",
+          "valueType": "u32",
+          "comment": "Buried deployment: OP_CHECKLOCKTIMEVERIFY activation height (BIP 65)."
+        },
+        {
+          "property": "btc:bip66Height",
+          "label": "bip66Height",
+          "valueType": "u32",
+          "comment": "Buried deployment: strict DER signatures activation height (BIP 66)."
+        },
+        {
+          "property": "btc:csvHeight",
+          "label": "csvHeight",
+          "valueType": "u32",
+          "comment": "Buried deployment: OP_CHECKSEQUENCEVERIFY / relative lock-time activation height (BIP 68/112/113)."
+        },
+        {
+          "property": "btc:segwitHeight",
+          "label": "segwitHeight",
+          "valueType": "u32",
+          "comment": "Buried deployment: segregated witness activation height (BIP 141/143/147)."
+        },
+        {
+          "property": "btc:maxBlockSigopsCost",
+          "label": "maxBlockSigopsCost",
+          "valueType": "u32",
+          "comment": "Consensus limit on signature-operation cost per block: 80,000 (legacy sigops count 4x)."
+        },
+        {
+          "property": "btc:coinbaseMaturity",
+          "label": "coinbaseMaturity",
+          "valueType": "u32",
+          "comment": "Confirmations before a coinbase output may be spent: 100."
+        },
+        {
+          "property": "btc:powNoRetargeting",
+          "label": "powNoRetargeting",
+          "valueType": "bool",
+          "comment": "Whether difficulty retargeting is disabled (regtest only)."
+        },
+        {
+          "property": "btc:allowMinDifficultyBlocks",
+          "label": "allowMinDifficultyBlocks",
+          "valueType": "bool",
+          "comment": "Testnet rule: a block whose timestamp exceeds the previous block's by more than 2x targetSpacing may be mined at powLimit difficulty; otherwise difficulty is that of the last non-minimum-difficulty block of the epoch."
+        },
+        {
+          "property": "btc:timewarpFix",
+          "label": "timewarpFix",
+          "valueType": "bool",
+          "comment": "BIP 94 (testnet4): retargets compute from the epoch-first block's bits, and the first block of each epoch may not be timestamped more than maxTimewarp before its predecessor."
+        },
+        {
+          "property": "btc:retargetSeed",
+          "label": "retargetSeed",
+          "valueType": "string",
+          "comment": "Which block's bits the period retarget scales: 'last' (Bitcoin) or 'first' (BIP 94: the first block of the period, so a min-difficulty last block cannot reset difficulty). Defaults from timewarpFix."
+        },
+        {
+          "property": "btc:targetAdjustments",
+          "label": "targetAdjustments",
+          "valueType": "array",
+          "comment": "One-off target adjustments, [{height, shiftLeft}]: at exactly that height the expected target is eased by 2^shiftLeft, clamped at powLimit \u2014 the first block of a proof-of-work change. Absent on Bitcoin chains."
+        },
+        {
+          "property": "btc:maxTimewarp",
+          "label": "maxTimewarp",
+          "valueType": "u32",
+          "comment": "BIP 94: maximum seconds an epoch-first block may lag its predecessor: 600."
+        },
+        {
+          "property": "btc:xpubVersion",
+          "label": "xpubVersion",
+          "valueType": "u32",
+          "comment": "Serialization version of extended public keys (BIP 32): 0x0488b21e (xpub) on mainnet, 0x043587cf (tpub) on test networks."
+        }
+      ]
+    },
+    {
+      "@id": "btc:mainnet",
+      "@type": "btc:NetworkParams",
+      "label": "mainnet",
+      "comment": "The Bitcoin mainnet, live since 2009-01-03.",
+      "name": "mainnet",
+      "magic": "f9beb4d9",
+      "genesisHash": "000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f",
+      "powLimit": "00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "targetTimespan": 1209600,
+      "targetSpacing": 600,
+      "difficultyAdjustmentInterval": 2016,
+      "maxFutureBlockTime": 7200,
+      "halvingInterval": 210000,
+      "port": 8333,
+      "p2pkhVersion": 0,
+      "p2shVersion": 5,
+      "bech32Hrp": "bc",
+      "maxMoney": 2100000000000000,
+      "initialSubsidy": 5000000000,
+      "maxBlockWeight": 4000000,
+      "bip34Height": 227931,
+      "bip65Height": 388381,
+      "bip66Height": 363725,
+      "csvHeight": 419328,
+      "segwitHeight": 481824,
+      "maxBlockSigopsCost": 80000,
+      "coinbaseMaturity": 100,
+      "xpubVersion": 76067358
+    },
+    {
+      "@id": "btc:Coin",
+      "@type": "ContextStruct",
+      "module": "btc:chain",
+      "label": "Coin",
+      "comment": "An entry in the UTXO set: an unspent transaction output together with the chain context needed to validate its spending. The UTXO set is the complete state of bitcoin ownership; a pruned node keeps it (or a window of its evolution) while discarding old block data.",
+      "fields": [
+        {
+          "property": "btc:outpoint",
+          "label": "outpoint",
+          "valueType": "OutPoint",
+          "comment": "The txid:vout identifying this output."
+        },
+        {
+          "property": "btc:output",
+          "label": "output",
+          "valueType": "TransactionOutput",
+          "comment": "The output itself: value and scriptPubKey."
+        },
+        {
+          "property": "btc:height",
+          "label": "height",
+          "valueType": "u32",
+          "comment": "Height of the block that created this coin."
+        },
+        {
+          "property": "btc:coinbase",
+          "label": "coinbase",
+          "valueType": "bool",
+          "comment": "Whether the coin is a coinbase output; coinbase coins are spendable only after 100 confirmations (maturity)."
+        }
+      ]
+    },
+    {
+      "@id": "btc:testnet",
+      "@type": "btc:NetworkParams",
+      "label": "testnet",
+      "comment": "Testnet3: the long-running public test network. Coins are worthless by design. Allows minimum-difficulty blocks after a 20-minute gap.",
+      "name": "testnet",
+      "magic": "0b110907",
+      "genesisHash": "000000000933ea01ad0ee984209779baaec3ced90fa3f408719526f8d77f4943",
+      "powLimit": "00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "targetTimespan": 1209600,
+      "targetSpacing": 600,
+      "difficultyAdjustmentInterval": 2016,
+      "maxFutureBlockTime": 7200,
+      "halvingInterval": 210000,
+      "port": 18333,
+      "p2pkhVersion": 111,
+      "p2shVersion": 196,
+      "bech32Hrp": "tb",
+      "maxMoney": 2100000000000000,
+      "initialSubsidy": 5000000000,
+      "maxBlockWeight": 4000000,
+      "bip34Height": 21111,
+      "bip65Height": 581885,
+      "bip66Height": 330776,
+      "csvHeight": 770112,
+      "segwitHeight": 834624,
+      "maxBlockSigopsCost": 80000,
+      "coinbaseMaturity": 100,
+      "allowMinDifficultyBlocks": true,
+      "xpubVersion": 70617039
+    },
+    {
+      "@id": "btc:testnet4",
+      "@type": "btc:NetworkParams",
+      "label": "testnet4",
+      "comment": "Testnet4 (BIP 94, live since 2024): a reset public test network with the timewarp fix and epoch-first retargeting; keeps the 20-minute minimum-difficulty exception.",
+      "name": "testnet4",
+      "magic": "1c163f28",
+      "genesisHash": "00000000da84f2bafbbc53dee25a72ae507ff4914b867c565be350b0da8bf043",
+      "powLimit": "00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "targetTimespan": 1209600,
+      "targetSpacing": 600,
+      "difficultyAdjustmentInterval": 2016,
+      "maxFutureBlockTime": 7200,
+      "halvingInterval": 210000,
+      "port": 48333,
+      "p2pkhVersion": 111,
+      "p2shVersion": 196,
+      "bech32Hrp": "tb",
+      "maxMoney": 2100000000000000,
+      "initialSubsidy": 5000000000,
+      "maxBlockWeight": 4000000,
+      "bip34Height": 1,
+      "bip65Height": 1,
+      "bip66Height": 1,
+      "csvHeight": 1,
+      "segwitHeight": 1,
+      "maxBlockSigopsCost": 80000,
+      "coinbaseMaturity": 100,
+      "allowMinDifficultyBlocks": true,
+      "timewarpFix": true,
+      "maxTimewarp": 600,
+      "xpubVersion": 70617039,
+      "retargetSeed": "first"
+    },
+    {
+      "@id": "btc:signet",
+      "@type": "btc:NetworkParams",
+      "label": "signet",
+      "comment": "Signet (default global signet): blocks additionally require a signature from the network's signers; proof-of-work is easy.",
+      "name": "signet",
+      "magic": "0a03cf40",
+      "genesisHash": "00000008819873e925422c1ff0f99f7cc9bbb232af63a077a480a3633bee1ef6",
+      "powLimit": "00000377ae000000000000000000000000000000000000000000000000000000",
+      "targetTimespan": 1209600,
+      "targetSpacing": 600,
+      "difficultyAdjustmentInterval": 2016,
+      "maxFutureBlockTime": 7200,
+      "halvingInterval": 210000,
+      "port": 38333,
+      "p2pkhVersion": 111,
+      "p2shVersion": 196,
+      "bech32Hrp": "tb",
+      "maxMoney": 2100000000000000,
+      "initialSubsidy": 5000000000,
+      "maxBlockWeight": 4000000,
+      "bip34Height": 1,
+      "bip65Height": 1,
+      "bip66Height": 1,
+      "csvHeight": 1,
+      "segwitHeight": 1,
+      "maxBlockSigopsCost": 80000,
+      "coinbaseMaturity": 100,
+      "xpubVersion": 70617039
+    },
+    {
+      "@id": "btc:regtest",
+      "@type": "btc:NetworkParams",
+      "label": "regtest",
+      "comment": "Regression-test network: trivial proof-of-work (and no retargeting), local-only, for development. Subsidy halves every 150 blocks.",
+      "name": "regtest",
+      "magic": "fabfb5da",
+      "genesisHash": "0f9188f13cb7b2c71f2a335e3a4fc328bf5beb436012afca590b1a11466e2206",
+      "powLimit": "7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "targetTimespan": 1209600,
+      "targetSpacing": 600,
+      "difficultyAdjustmentInterval": 2016,
+      "maxFutureBlockTime": 7200,
+      "halvingInterval": 150,
+      "port": 18444,
+      "p2pkhVersion": 111,
+      "p2shVersion": 196,
+      "bech32Hrp": "bcrt",
+      "maxMoney": 2100000000000000,
+      "initialSubsidy": 5000000000,
+      "maxBlockWeight": 4000000,
+      "bip34Height": 1,
+      "bip65Height": 1,
+      "bip66Height": 1,
+      "csvHeight": 1,
+      "segwitHeight": 0,
+      "maxBlockSigopsCost": 80000,
+      "coinbaseMaturity": 100,
+      "powNoRetargeting": true,
+      "xpubVersion": 70617039
+    },
+    {
+      "@id": "btc:Checkpoint",
+      "@type": "ContextStruct",
+      "module": "btc:chain",
+      "label": "Checkpoint",
+      "comment": "An AssumeValid-style sync anchor: a known-good header at a retarget boundary from which a light client syncs forward. Trust-minimized by reproducibility \u2014 anyone with a node can verify the hash \u2014 and chosen at epoch boundaries so all subsequent retarget context is within the synced range.",
+      "fields": [
+        {
+          "property": "btc:checkpointNetwork",
+          "label": "network",
+          "valueType": "NetworkParams",
+          "comment": "Which network the checkpoint anchors."
+        },
+        {
+          "property": "btc:height",
+          "label": "height",
+          "valueType": "u32",
+          "comment": "Block height (a multiple of the retarget interval)."
+        },
+        {
+          "property": "btc:hash",
+          "label": "hash",
+          "valueType": "hash",
+          "comment": "The block hash."
+        },
+        {
+          "property": "btc:rawHeader",
+          "label": "rawHeader",
+          "valueType": "hex",
+          "comment": "The 80-byte header, so the chain can be extended without any fetch."
+        },
+        {
+          "property": "btc:contextHeaders",
+          "label": "contextHeaders",
+          "valueType": "hex",
+          "comment": "The ten headers immediately preceding the checkpoint, so median-time-past is fully decidable from the first synced header."
+        }
+      ]
+    },
+    {
+      "@id": "btc:mainnetCheckpoint",
+      "@type": "btc:Checkpoint",
+      "label": "mainnetCheckpoint",
+      "comment": "Mainnet sync anchor (retarget boundary, 2026-05).",
+      "network": "btc:mainnet",
+      "height": 951552,
+      "rawHeader": "046021200d794080a57a498c0d80e681de3e443488359077dd9501000000000000000000d52087be6c9a811306bd2da144e60e868ec93fb7803748fa7f62a701458987989a6a196a8f0602176f9614b2",
+      "hash": "00000000000000000001b472f1922f86148c8286609fb14be39e12b8bd14bb64",
+      "contextHeaders": [
+        "00e00320329170c306507e7241468b278022f409b1ba286c558f000000000000000000002b6aec9c94d018c8d4fda8b4ac3f8e94a33cfaa0af3ed1baf7e27978cd2fc90f7155196a790f02177f886517",
+        "0000003a1bda7e2a9b1b280b965d9c97282dd68f4c9c1730633e01000000000000000000969c0239f766df46e9d6fa46d47966ce25be7b8ff9a5b891c2a430cc84abb094cf58196a790f0217cdd4173b",
+        "00a00120f0002c1bd21454e92465a2e7cb685ce31fdbedb402030100000000000000000053a16d2a4a3cf97a66b924cbfa111d3191334cadd109670cc3b86f9660eb40c3525a196a790f021758e40d8e",
+        "00200520e234e1802bf8a13c1f36b42bfbf0f9402dc578d27d4300000000000000000000a7840a32bf37022e05f85e5fcc6a1aa3cdba6e6fbe00a9b2358a684a13160a552c5d196a790f021712e104ab",
+        "0000ff3f694ec45318e78a395db6c92479f87a02d5471538ff4a0100000000000000000088b2c3f67ece6204c627a90c7c3407e8116d1e0aa0901a9bf7d25b469d378bf93b61196a790f0217184b87f4",
+        "0000003cfafb792e6bfda2b9c1c2038e70bbfb5db00107fc9c33000000000000000000005b77567da023d144627900af2530970994973356e70e563782d2e3f1810ec2ac3c60196a790f0217231ab498",
+        "00403b224db1673e13cbfceadf0e779c8836a0b6ca2a1c5ee0e6000000000000000000006d02ba1190a57e3ac7550b53266b32ad53917b8339168ab16497c388e2989be2e961196a790f02173b04fafa",
+        "00e00020443827f43d0cb8db69ded9b5df758d128a8e1f908b1401000000000000000000cf67b5629994bc3bff35b2231de572ba1345c845dbecc3440a9603be354e25508f62196a790f0217c8f008de",
+        "0020cf2cc087b7a6c63b4efe3704246570571f1602ec6a54f4df010000000000000000006ca5a966665036584d71601f49779195dc0e0d39f8e6f80fd51dad19cc507f8ade66196a790f021791ae1370",
+        "0060012023af18bbc7d27a88edd1608079125d238ff939a98aef01000000000000000000327873f5c6eb22fc90fa130ff01dee2314b9df925ae3e78c6c754fc176a6165d7c68196a790f021798d22209"
+      ]
+    },
+    {
+      "@id": "btc:testnet4Checkpoint",
+      "@type": "btc:Checkpoint",
+      "label": "testnet4Checkpoint",
+      "comment": "Testnet4 sync anchor (retarget boundary, 2026-06).",
+      "network": "btc:testnet4",
+      "height": 137088,
+      "rawHeader": "0000f7201b5ff9ab68e80c066b16fd7164237beeeba524c9811cd13ab94325000000000076fc49b54f167d7ea3162ea421578eafd75bfdef99b818708c908c862c2daba8f6a41b6ab67603197c40888d",
+      "hash": "00000000000000021645cc90db9b1ad27156e130620a074028676fbeca049502",
+      "contextHeaders": [
+        "0020822b10c39a2aa9451222aa706721b1b66010d2566633c2178065bc51480000000000e7209e1e5df9875817dcca78e3f32621bc69b321e497ae8e8613b93feb9228ba157d1b6affff001dd80102bd",
+        "0060c62984ab117890abfdd498be9da2ae22503df220c75380f7e0d5851cf80000000000a4f2079d37205c4da3f4ebcff731185ed7580b038ae29ed22e9788b8072ca8f9c6811b6affff001d2c01a86f",
+        "0040c92dadc6694a30d208af88f438cb3d31534eaedc5b2d44c3e77e5f538f00000000008a180adf92a1997b6e8b50d54df8dff83b4d5ceae5ff64e183cd8c3ddde3a76677861b6affff001d8201c8ae",
+        "0040b82d1f702bca6dc1dd4406666dc54f57447d51e2b3ac9c93d315f2413000000000001c07b41608184dfef0ad72728e46f4902efba888dfbae9a2d0e7d3602e2b4f67288b1b6affff001d8a01550a",
+        "006031281f7e2a20e4f6d9aff5be223905c075a2516859db73d4321df8b78d00000000004442cb3ca5f694cb2ab1f90b4fc48626f4e9c93594c9166a0405a69947fc28dcd98f1b6affff001d50020eb3",
+        "0000602aab7be2beb013f0669e3fe8080e5b5f631caa1b6283ab2aa9d5680000000000004e574f4ec64c3f349c494575094c50b1900e1abe54342b2e3fa05b025a6055cf8a941b6affff001d8400f018",
+        "00a0632ec5854ca79337334f603aa86aa30b392989751014d7938277dcc0ce000000000041ebeff4da8e88193780a41f9bd1be92e1aea0b5c72e90f83f3cd5ac1e27a1d73b991b6affff001d4200d8fb",
+        "0040d7270f600bd55375dfbdb9427b408ef1e206b6b70dddf83c52ecfe97e20000000000db9067c08dbd41de36ad31e58d06935f301a49e7a3237eb365b67edc41f6b4a5ec9d1b6affff001d740263d3",
+        "0040532e071c2b4fd781b267fd6905f686362ef6be7f517b64429909e4b36d00000000009125e0b0ed6b67866520fe4eab8f6cedc4487383e4b6c97d526ee0fe4a7475d69da21b6affff001dd0025912",
+        "00c03131c3f75fe30714f2c9479bee4d4a7e654713899b96c5ae3cc2c9c5c5000000000082758b8d019959809c50dcbe4c297f396093282d320297d2e3a4533f869592864ea71b6affff001d9e00d72d"
+      ]
+    }
+  ]
+}
diff --git a/vendor/sidestr/schema/schema/core.jsonld b/vendor/sidestr/schema/schema/core.jsonld
new file mode 100644
index 0000000..fd4b249
--- /dev/null
+++ b/vendor/sidestr/schema/schema/core.jsonld
@@ -0,0 +1,329 @@
+{
+  "@context": "../context.jsonld",
+  "@graph": [
+    {
+      "@id": "btc:core",
+      "@type": "Module",
+      "label": "core",
+      "version": "0.0.2",
+      "comment": "Consensus-critical structures of the Bitcoin protocol. Every field tagged with a wireType exists in the canonical byte serialization and is covered by proof-of-work. Derived fields are computed deterministically from consensus bytes and are never serialized.",
+      "layer": "consensus"
+    },
+
+    {
+      "@id": "btc:OutPoint",
+      "@type": "ConsensusStruct",
+      "module": "btc:core",
+      "label": "OutPoint",
+      "comment": "A reference to a specific output of a previous transaction. Exactly 36 bytes on the wire.",
+      "wireSize": 36,
+      "fields": [
+        {
+          "property": "btc:txid",
+          "label": "txid",
+          "comment": "Transaction identifier of the transaction containing the output being spent. Serialized as 32 bytes in internal (little-endian) order; displayed reversed as hex.",
+          "wireType": "hash256"
+        },
+        {
+          "property": "btc:vout",
+          "label": "vout",
+          "comment": "Zero-based index of the output within the referenced transaction.",
+          "wireType": "u32le"
+        }
+      ]
+    },
+
+    {
+      "@id": "btc:TransactionInput",
+      "@type": "ConsensusStruct",
+      "module": "btc:core",
+      "label": "TransactionInput",
+      "comment": "An input of a transaction: a pointer to the coin being spent, the unlocking script, and the sequence number. A coinbase input references the null outpoint (all-zero txid, vout 0xffffffff).",
+      "fields": [
+        {
+          "property": "btc:prevout",
+          "label": "prevout",
+          "comment": "The outpoint identifying the transaction output being spent.",
+          "wireType": "struct",
+          "structType": "btc:OutPoint"
+        },
+        {
+          "property": "btc:scriptSig",
+          "label": "scriptSig",
+          "comment": "Unlocking script satisfying the conditions of the referenced output's scriptPubKey. Empty for native segwit spends. Variable length, prefixed by a CompactSize count.",
+          "wireType": "varbytes"
+        },
+        {
+          "property": "btc:sequence",
+          "label": "sequence",
+          "comment": "Sequence number. Used for relative lock-time (BIP 68) and opt-in replace-by-fee signalling (BIP 125).",
+          "wireType": "u32le",
+          "bip": [68, 125]
+        }
+      ]
+    },
+
+    {
+      "@id": "btc:TransactionOutput",
+      "@type": "ConsensusStruct",
+      "module": "btc:core",
+      "label": "TransactionOutput",
+      "comment": "An output of a transaction: an amount and the locking script that encumbers it. An unspent output (UTXO) is the fundamental unit of bitcoin ownership.",
+      "fields": [
+        {
+          "property": "btc:value",
+          "label": "value",
+          "comment": "Amount in satoshis (1 BTC = 100,000,000 satoshis). Signed 64-bit little-endian on the wire; consensus-valid range is 0 to 21,000,000 BTC.",
+          "wireType": "i64le"
+        },
+        {
+          "property": "btc:scriptPubKey",
+          "label": "scriptPubKey",
+          "comment": "Locking script defining the conditions under which this output may be spent. Variable length, prefixed by a CompactSize count.",
+          "wireType": "varbytes"
+        }
+      ]
+    },
+
+    {
+      "@id": "btc:Witness",
+      "@type": "ConsensusStruct",
+      "module": "btc:core",
+      "label": "Witness",
+      "comment": "The segregated witness for a single input: a stack of byte vectors consumed by script execution (BIP 141). On the wire each witness is a CompactSize item count followed by that many CompactSize-prefixed byte vectors. Witness data is committed to by wtxid and the witness commitment in the coinbase, but excluded from txid.",
+      "bip": [141],
+      "fields": [
+        {
+          "property": "btc:stack",
+          "label": "stack",
+          "comment": "Ordered stack items, bottom first, each an arbitrary byte vector.",
+          "wireType": "vec",
+          "itemType": "varbytes"
+        }
+      ]
+    },
+
+    {
+      "@id": "btc:Transaction",
+      "@type": "ConsensusStruct",
+      "module": "btc:core",
+      "label": "Transaction",
+      "comment": "A transfer of bitcoin value: a list of inputs spending existing outputs and a list of new outputs. Two serializations exist: legacy (txid, excludes marker/flag/witness) and full segwit (wtxid, BIP 144).",
+      "fields": [
+        {
+          "property": "btc:version",
+          "label": "version",
+          "comment": "Transaction format version. Version 2 enables BIP 68 relative lock-time semantics.",
+          "wireType": "i32le",
+          "bip": [68]
+        },
+        {
+          "property": "btc:marker",
+          "label": "marker",
+          "comment": "Segwit marker byte, always 0x00. Present only in the segwit serialization (BIP 144). Distinguishable from legacy because a legacy transaction cannot have zero inputs.",
+          "wireType": "u8",
+          "presentIf": "segwit",
+          "constValue": 0,
+          "bip": [144]
+        },
+        {
+          "property": "btc:flag",
+          "label": "flag",
+          "comment": "Segwit flag byte, currently always 0x01. Present only in the segwit serialization.",
+          "wireType": "u8",
+          "presentIf": "segwit",
+          "constValue": 1,
+          "bip": [144]
+        },
+        {
+          "property": "btc:inputs",
+          "label": "inputs",
+          "comment": "Transaction inputs, prefixed by a CompactSize count. Must be non-empty.",
+          "wireType": "vec",
+          "itemType": "btc:TransactionInput"
+        },
+        {
+          "property": "btc:outputs",
+          "label": "outputs",
+          "comment": "Transaction outputs, prefixed by a CompactSize count. Must be non-empty.",
+          "wireType": "vec",
+          "itemType": "btc:TransactionOutput"
+        },
+        {
+          "property": "btc:witness",
+          "label": "witness",
+          "comment": "One witness per input, in input order. NOT prefixed by a count: the number of witnesses equals the number of inputs. Present only in the segwit serialization.",
+          "wireType": "witness",
+          "itemType": "btc:Witness",
+          "presentIf": "segwit",
+          "bip": [141, 144]
+        },
+        {
+          "property": "btc:lockTime",
+          "label": "lockTime",
+          "comment": "Earliest time the transaction may be mined: a block height if below 500,000,000, otherwise a Unix timestamp. Only enforced if some input has a non-final sequence (BIP 65 for script-level enforcement).",
+          "wireType": "u32le",
+          "bip": [65]
+        }
+      ],
+      "derived": [
+        {
+          "property": "btc:txid",
+          "label": "txid",
+          "comment": "Transaction identifier: double-SHA256 of the legacy serialization (witness excluded), displayed byte-reversed as hex.",
+          "derivation": "reverseHex(dsha256(serializeLegacy(this)))"
+        },
+        {
+          "property": "btc:wtxid",
+          "label": "wtxid",
+          "comment": "Witness transaction identifier: double-SHA256 of the full segwit serialization. Equal to txid for transactions with no witness data.",
+          "derivation": "reverseHex(dsha256(serialize(this)))"
+        },
+        {
+          "property": "btc:size",
+          "label": "size",
+          "comment": "Size in bytes of the full serialization.",
+          "derivation": "byteLength(serialize(this))"
+        },
+        {
+          "property": "btc:weight",
+          "label": "weight",
+          "comment": "Block weight contribution (BIP 141): 3 × legacy size + full size. The consensus block limit is 4,000,000 weight units.",
+          "derivation": "3 * byteLength(serializeLegacy(this)) + byteLength(serialize(this))",
+          "bip": [141]
+        },
+        {
+          "property": "btc:vsize",
+          "label": "vsize",
+          "comment": "Virtual size in vbytes: weight / 4, rounded up. The unit used for fee rates.",
+          "derivation": "ceil(weight(this) / 4)"
+        }
+      ]
+    },
+
+    {
+      "@id": "btc:BlockHeader",
+      "@type": "ConsensusStruct",
+      "module": "btc:core",
+      "label": "BlockHeader",
+      "comment": "The 80-byte block header: the structure actually hashed for proof-of-work. A headers-only chain is sufficient to verify cumulative work and anchor SPV proofs.",
+      "wireSize": 80,
+      "fields": [
+        {
+          "property": "btc:version",
+          "label": "version",
+          "comment": "Block version. Since BIP 9, version bits signal readiness for soft forks.",
+          "wireType": "i32le",
+          "bip": [9, 34]
+        },
+        {
+          "property": "btc:prevBlockHash",
+          "label": "prevBlockHash",
+          "comment": "Hash of the previous block header, forming the chain. All zeros for the genesis block.",
+          "wireType": "hash256"
+        },
+        {
+          "property": "btc:merkleRoot",
+          "label": "merkleRoot",
+          "comment": "Root of the merkle tree over all transaction txids in the block, committing the header to the block's transactions.",
+          "wireType": "hash256"
+        },
+        {
+          "property": "btc:time",
+          "label": "time",
+          "comment": "Block timestamp as Unix time. Must be greater than the median time of the previous 11 blocks and no more than 2 hours in the future.",
+          "wireType": "u32le"
+        },
+        {
+          "property": "btc:bits",
+          "label": "bits",
+          "comment": "Compact (nBits) encoding of the proof-of-work target threshold the block hash must not exceed.",
+          "wireType": "u32le"
+        },
+        {
+          "property": "btc:nonce",
+          "label": "nonce",
+          "comment": "Arbitrary value miners vary to search for a hash satisfying the target.",
+          "wireType": "u32le"
+        }
+      ],
+      "derived": [
+        {
+          "property": "btc:hash",
+          "label": "hash",
+          "comment": "Block hash: double-SHA256 of the 80 serialized header bytes, displayed byte-reversed as hex. Must be numerically below the target encoded by bits.",
+          "derivation": "reverseHex(dsha256(serialize(this)))"
+        },
+        {
+          "property": "btc:target",
+          "label": "target",
+          "comment": "The 256-bit proof-of-work target threshold expanded from the compact bits encoding.",
+          "derivation": "expandCompact(bits)"
+        },
+        {
+          "property": "btc:work",
+          "label": "work",
+          "comment": "Expected work to find this block: 2^256 / (target + 1). Summed along a chain to determine the best (most-work) chain.",
+          "derivation": "2^256 / (target(this) + 1)"
+        }
+      ]
+    },
+
+    {
+      "@id": "btc:Block",
+      "@type": "ConsensusStruct",
+      "module": "btc:core",
+      "label": "Block",
+      "comment": "A full block: an 80-byte header followed by the block's transactions. The first transaction must be the coinbase.",
+      "fields": [
+        {
+          "property": "btc:header",
+          "label": "header",
+          "comment": "The block header.",
+          "wireType": "struct",
+          "structType": "btc:BlockHeader"
+        },
+        {
+          "property": "btc:transactions",
+          "label": "transactions",
+          "comment": "The block's transactions, prefixed by a CompactSize count. The first must be the coinbase transaction.",
+          "wireType": "vec",
+          "itemType": "btc:Transaction"
+        }
+      ],
+      "derived": [
+        {
+          "property": "btc:hash",
+          "label": "hash",
+          "comment": "The block hash, derived from the header alone.",
+          "derivation": "hash(header)"
+        },
+        {
+          "property": "btc:txCount",
+          "label": "txCount",
+          "comment": "Number of transactions in the block.",
+          "derivation": "length(transactions)"
+        },
+        {
+          "property": "btc:merkleRoot",
+          "label": "merkleRoot",
+          "comment": "Merkle root recomputed from the transactions' txids; block is invalid unless it equals header.merkleRoot.",
+          "derivation": "merkleRoot(map(transactions, txid))"
+        },
+        {
+          "property": "btc:size",
+          "label": "size",
+          "comment": "Size in bytes of the full block serialization.",
+          "derivation": "byteLength(serialize(this))"
+        },
+        {
+          "property": "btc:weight",
+          "label": "weight",
+          "comment": "Total block weight (BIP 141). Consensus limit: 4,000,000 weight units.",
+          "derivation": "sum(map(transactions, weight)) + 4 * (byteLength(serialize(header)) + byteLength(varint(txCount)))",
+          "bip": [141]
+        }
+      ]
+    }
+  ]
+}
diff --git a/vendor/sidestr/schema/schema/overlays/knots-blake2b.jsonld b/vendor/sidestr/schema/schema/overlays/knots-blake2b.jsonld
new file mode 100644
index 0000000..9c4981e
--- /dev/null
+++ b/vendor/sidestr/schema/schema/overlays/knots-blake2b.jsonld
@@ -0,0 +1,240 @@
+{
+  "@context": {
+    "knots": "https://bitcoinknots.org/ns#"
+  },
+  "@id": "knots:blake2b-overlay",
+  "comment": "Bitcoin Knots BLAKE2b hardfork (v29.4.1.knots20260508, PRs 357/359/385): a 164-byte v2 block header selected by the top bit of version, a new proof-of-work hash, the unified opt-in signature hash (SIGHASH_UNIFIED, active from the same height: unifiedSighashParam names it), and two chains forking from Bitcoin history. Additive overlay: nothing in the base model is redefined.",
+  "@graph": [
+    {
+      "@id": "knots:BlockHeaderV2",
+      "@type": "ConsensusStruct",
+      "module": "knots:blake2b",
+      "label": "BlockHeaderV2",
+      "comment": "The 164-byte header used from the BLAKE2b fork height. The first 80 bytes keep the classic layout (version with bit 31 set; the wire time may be offset). Proof of work is the BLAKE2b construction over a commitment tree of these fields, not SHA256d of the bytes.",
+      "wireSize": 164,
+      "fields": [
+        {
+          "property": "btc:version",
+          "label": "version",
+          "comment": "Raw wire version: bit 31 set marks a v2 header; the low bits carry the usual version.",
+          "wireType": "u32le"
+        },
+        {
+          "property": "btc:prevBlockHash",
+          "label": "prevBlockHash",
+          "wireType": "hash256"
+        },
+        {
+          "property": "btc:merkleRoot",
+          "label": "merkleRoot",
+          "wireType": "hash256"
+        },
+        {
+          "property": "knots:timeOnWire",
+          "label": "timeOnWire",
+          "comment": "Block time as serialized. The consensus time is timeOnWire + timeOffset when flags bit 2 is set.",
+          "wireType": "u32le"
+        },
+        {
+          "property": "btc:bits",
+          "label": "bits",
+          "wireType": "u32le"
+        },
+        {
+          "property": "btc:nonce",
+          "label": "nonce",
+          "wireType": "u32le"
+        },
+        {
+          "property": "knots:nonce2",
+          "label": "nonce2",
+          "wireType": "u32le"
+        },
+        {
+          "property": "knots:nonce3",
+          "label": "nonce3",
+          "wireType": "u32le"
+        },
+        {
+          "property": "knots:extranonce",
+          "label": "extranonce",
+          "comment": "128-bit extranonce, wire order (bitcoind's RPC shows it byte-reversed).",
+          "wireType": "bytes",
+          "wireSize": 16
+        },
+        {
+          "property": "knots:timeOffset",
+          "label": "timeOffset",
+          "wireType": "u32le"
+        },
+        {
+          "property": "knots:txCount",
+          "label": "txCount",
+          "comment": "Committed transaction count; must equal the block's transaction count.",
+          "wireType": "u16le"
+        },
+        {
+          "property": "knots:flags",
+          "label": "flags",
+          "comment": "Bits 0-1: ASIC layout profile; bit 2: time offset in use; bits 6-7 reserved for future hardforks (must be 0).",
+          "wireType": "u8"
+        },
+        {
+          "property": "knots:xorKeyMaskClearBits",
+          "label": "xorKeyMaskClearBits",
+          "wireType": "u8"
+        },
+        {
+          "property": "knots:xorKey",
+          "label": "xorKey",
+          "comment": "128-bit PoW XOR key, wire order.",
+          "wireType": "bytes",
+          "wireSize": 16
+        },
+        {
+          "property": "knots:height",
+          "label": "height",
+          "comment": "Committed height; must equal the previous header's height + 1.",
+          "wireType": "i32le"
+        },
+        {
+          "property": "knots:mmRhs",
+          "label": "mmRhs",
+          "comment": "Merge-mining hook right-hand side (reserved; all zeros so far).",
+          "wireType": "hash256"
+        }
+      ]
+    },
+    {
+      "@id": "btc:testnet4-blake2b",
+      "@type": "btc:NetworkParams",
+      "extends": "btc:testnet4",
+      "label": "testnet4-blake2b",
+      "name": "testnet4-blake2b",
+      "comment": "Bitcoin Knots' BLAKE2b fork of testnet4: shares Core's testnet4 history through 150307, then v2 headers and BLAKE2b proof of work from 150308 (2026-08-30). Keeps testnet4's 20-minute minimum-difficulty exception.",
+      "powHash": "knots:blake2b-v2",
+      "structVariants": {
+        "btc:BlockHeader": [
+          {
+            "when": {
+              "field": "version",
+              "bit": 31
+            },
+            "struct": "knots:BlockHeaderV2"
+          }
+        ]
+      },
+      "blake2bHeight": 150308,
+      "unifiedSighashParam": "blake2bHeight",
+      "rdtsExpiryTime": 1791903600,
+      "lastSharedBlock": {
+        "height": 150307,
+        "hash": "000000000017ec2251d81c8d2ca401c713e98e85196c7f660a4088a7ca57b1cc"
+      },
+      "forkBlockHash": "000000000000b9d1b7e1bb0e77215ee92c6ef7ec8f4473e23908380649e779b6",
+      "targetAdjustments": [
+        {
+          "height": 150308,
+          "shiftLeft": 20
+        }
+      ]
+    },
+    {
+      "@id": "btc:mainnet-blake2b",
+      "@type": "btc:NetworkParams",
+      "extends": "btc:mainnet",
+      "label": "mainnet-blake2b",
+      "name": "mainnet-blake2b",
+      "comment": "Bitcoin Knots' BLAKE2b hardfork chain: shares Bitcoin's history through 961631, eight Knots-only SHA256d blocks 961632-961639, then v2 headers and BLAKE2b proof of work from 961640 (2026-08-30).",
+      "powHash": "knots:blake2b-v2",
+      "structVariants": {
+        "btc:BlockHeader": [
+          {
+            "when": {
+              "field": "version",
+              "bit": 31
+            },
+            "struct": "knots:BlockHeaderV2"
+          }
+        ]
+      },
+      "blake2bHeight": 961640,
+      "unifiedSighashParam": "blake2bHeight",
+      "blake2bHeadline": "8-30 NYPost Deride And Conquer",
+      "forkBlockHash": "0000000000000050c1e5f69672f459293be14f46e5a494e7a8c8541396f18eeb",
+      "rdtsExpiryTime": 1819756800,
+      "targetAdjustments": [
+        {
+          "height": 961640,
+          "shiftLeft": 22
+        }
+      ]
+    },
+    {
+      "@id": "knots:rule-header-v1-until-fork",
+      "@type": "ValidationRule",
+      "ruleSet": "btc:HeaderRules",
+      "label": "v1-until-fork",
+      "errorCode": "bad-version-sha256d",
+      "comment": "A v2 (BLAKE2b) header may only commit to a height at or after the fork height; before it, blocks are SHA256d v1 headers.",
+      "check": "!isV2(header) || header.height >= blake2bHeight"
+    },
+    {
+      "@id": "knots:rule-header-v2-from-fork",
+      "@type": "ValidationRule",
+      "ruleSet": "btc:HeaderRules",
+      "label": "v2-from-fork",
+      "errorCode": "bad-version-blake2b",
+      "comment": "From the fork height every header must be v2 with BLAKE2b proof of work.",
+      "check": "height < blake2bHeight || isV2(header)",
+      "activationParam": "blake2bHeight"
+    },
+    {
+      "@id": "knots:rule-header-height",
+      "@type": "ValidationRule",
+      "ruleSet": "btc:HeaderRules",
+      "label": "header-height",
+      "errorCode": "bad-header-height",
+      "comment": "The height committed in a v2 header must equal the block's chain height (the previous block's height + 1). v1 headers commit no height and pass.",
+      "check": "!isV2(header) || header.height === height",
+      "activationParam": "blake2bHeight"
+    },
+    {
+      "@id": "knots:rule-header-flags-reserved",
+      "@type": "ValidationRule",
+      "ruleSet": "btc:HeaderRules",
+      "label": "flags-reserved",
+      "errorCode": "bad-flags-highbits",
+      "comment": "The top two bits of a v2 header's flags are reserved for future hardforks and must be zero.",
+      "check": "!isV2(header) || (header.flags & 0xc0) === 0",
+      "activationParam": "blake2bHeight"
+    },
+    {
+      "@id": "knots:rule-block-txcount",
+      "@type": "ValidationRule",
+      "ruleSet": "btc:BlockRules",
+      "label": "txcount",
+      "errorCode": "bad-txnlist-size",
+      "comment": "The transaction count committed in a v2 header must equal the number of transactions in the block.",
+      "check": "!isV2(block.header) || block.header.txCount === block.transactions.length"
+    },
+    {
+      "@id": "knots:rule-block-headline",
+      "@type": "ValidationRule",
+      "ruleSet": "btc:BlockRules",
+      "label": "headline",
+      "errorCode": "bad-headline",
+      "comment": "The fork block's coinbase scriptSig must contain the chain's proof-of-time headline (mainnet: '8-30 NYPost Deride And Conquer'; testnet4 sets none).",
+      "check": "block.header.height !== blake2bHeight || coinbase.scriptSig includes blake2bHeadline"
+    },
+    {
+      "@id": "knots:rule-blockctx-weight-rdts",
+      "@type": "ValidationRule",
+      "ruleSet": "btc:BlockContextRules",
+      "label": "weight-rdts",
+      "errorCode": "bad-blk-weight-reduced_data",
+      "comment": "While the ReducedData temporary softfork is active (from the fork height until the parent's median-time-past reaches rdtsExpiryTime) block weight is capped at 800,000.",
+      "check": "!rdtsActiveAt(height, mtpPrev) || weight(block) <= 800000"
+    }
+  ]
+}
diff --git a/vendor/sidestr/schema/schema/proof.jsonld b/vendor/sidestr/schema/schema/proof.jsonld
new file mode 100644
index 0000000..0d792a8
--- /dev/null
+++ b/vendor/sidestr/schema/schema/proof.jsonld
@@ -0,0 +1,102 @@
+{
+  "@context": "../context.jsonld",
+  "@graph": [
+    {
+      "@id": "btc:proof",
+      "@type": "Module",
+      "label": "proof",
+      "version": "0.0.12",
+      "comment": "Compact proofs that let a client verify facts about the chain without holding the chain: merkle inclusion proofs anchor a transaction to a header, and the header chain's proof-of-work does the rest. This is the basis of SPV (Simplified Payment Verification, described in section 8 of the Bitcoin whitepaper).",
+      "layer": "proof"
+    },
+    {
+      "@id": "btc:MerkleBlock",
+      "@type": "ConsensusStruct",
+      "module": "btc:proof",
+      "label": "MerkleBlock",
+      "comment": "A partial merkle tree proof (BIP 37): a block header plus the minimal set of hashes and traversal flags needed to prove that specific transactions are committed by the header's merkleRoot. Verifying one requires only the 80-byte header chain \u2014 no block data.",
+      "bip": [
+        37
+      ],
+      "fields": [
+        {
+          "property": "btc:header",
+          "label": "header",
+          "comment": "The block header whose merkleRoot the proof reconstructs. Its proof-of-work and chain membership are verified exactly as in headers-only sync.",
+          "wireType": "struct",
+          "structType": "btc:BlockHeader"
+        },
+        {
+          "property": "btc:txCount",
+          "label": "txCount",
+          "comment": "Total number of transactions in the block, defining the shape of the full merkle tree.",
+          "wireType": "u32le"
+        },
+        {
+          "property": "btc:hashes",
+          "label": "hashes",
+          "comment": "The pruned-branch and matched-transaction hashes, in depth-first traversal order, prefixed by a CompactSize count.",
+          "wireType": "vec",
+          "itemType": "hash256"
+        },
+        {
+          "property": "btc:flags",
+          "label": "flags",
+          "comment": "Depth-first traversal flag bits, least-significant bit of each byte first, prefixed by a CompactSize byte count. A set bit at an interior node means descend; a set bit at a leaf marks a matched transaction; a clear bit means the subtree is summarized by one hash.",
+          "wireType": "varbytes"
+        }
+      ],
+      "derived": [
+        {
+          "property": "btc:root",
+          "label": "root",
+          "comment": "The merkle root reconstructed by depth-first traversal of the partial tree. The proof is valid only if it equals header.merkleRoot.",
+          "derivation": "extractPartialMerkleTree(txCount, hashes, flags).root"
+        },
+        {
+          "property": "btc:matchedTransactions",
+          "label": "matchedTransactions",
+          "comment": "The txids the proof demonstrates inclusion for, with their positions in the block.",
+          "derivation": "extractPartialMerkleTree(txCount, hashes, flags).matches"
+        }
+      ]
+    },
+    {
+      "@id": "btc:FilterParams",
+      "@type": "ContextStruct",
+      "module": "btc:proof",
+      "label": "FilterParams",
+      "bip": 158,
+      "comment": "Parameters of a Golomb-Rice coded set filter. Items are hashed with SipHash-2-4 (keyed by the first 16 bytes of the block hash) into [0, N*M), sorted, and delta-encoded with Rice parameter P. A filter's serialization is a CompactSize item count followed by the bitstream.",
+      "fields": [
+        {
+          "property": "btc:filterType",
+          "label": "filterType",
+          "valueType": "u8",
+          "comment": "Filter type byte; 0x00 is the basic filter."
+        },
+        {
+          "property": "btc:riceParameter",
+          "label": "p",
+          "valueType": "u8",
+          "comment": "Golomb-Rice remainder bit width."
+        },
+        {
+          "property": "btc:falsePositiveModulus",
+          "label": "m",
+          "valueType": "u32",
+          "comment": "Target range multiplier; the per-item false-positive rate is 1/M."
+        }
+      ]
+    },
+    {
+      "@id": "btc:basicFilter",
+      "@type": "btc:FilterParams",
+      "label": "basicFilter",
+      "comment": "The BIP 158 basic filter: every spent prevout scriptPubKey and every created scriptPubKey (empty scripts and OP_RETURN outputs excluded). Filter headers chain as dsha256(filterHash || prevFilterHeader), giving light clients a comparable commitment across peers (BIP 157).",
+      "filterType": 0,
+      "p": 19,
+      "m": 784931
+    }
+  ]
+}
\ No newline at end of file
diff --git a/vendor/sidestr/schema/schema/script.jsonld b/vendor/sidestr/schema/schema/script.jsonld
new file mode 100644
index 0000000..29c0db5
--- /dev/null
+++ b/vendor/sidestr/schema/schema/script.jsonld
@@ -0,0 +1,1004 @@
+{
+  "@context": "../context.jsonld",
+  "@graph": [
+    {
+      "@id": "btc:script",
+      "@type": "Module",
+      "label": "script",
+      "version": "0.0.8",
+      "comment": "The Bitcoin script language surface: the opcode set, the standard output script templates with their address encodings, and signature hash types. Templates are declarative \u2014 the classifier matches them as data.",
+      "layer": "consensus"
+    },
+    {
+      "@id": "btc:Opcode",
+      "@type": "Enumeration",
+      "module": "btc:script",
+      "label": "Opcode",
+      "comment": "Every assigned script opcode. Bytes 0x01-0x4b are OP_PUSHBYTES_1..75 (push that many following bytes) and are modeled as a range rather than 75 members. Disabled opcodes make a transaction invalid if present in an executed script. Unassigned bytes above OP_CHECKSIGADD are invalid in legacy/segwit script and OP_SUCCESSx in tapscript (BIP 342).",
+      "members": [
+        {
+          "name": "OP_0",
+          "code": 0,
+          "category": "constants",
+          "comment": "Push an empty byte vector (numeric zero). Alias OP_FALSE."
+        },
+        {
+          "name": "OP_PUSHDATA1",
+          "code": 76,
+          "category": "constants",
+          "comment": "The next byte gives the number of bytes to push."
+        },
+        {
+          "name": "OP_PUSHDATA2",
+          "code": 77,
+          "category": "constants",
+          "comment": "The next two bytes (LE) give the number of bytes to push."
+        },
+        {
+          "name": "OP_PUSHDATA4",
+          "code": 78,
+          "category": "constants",
+          "comment": "The next four bytes (LE) give the number of bytes to push."
+        },
+        {
+          "name": "OP_1NEGATE",
+          "code": 79,
+          "category": "constants",
+          "comment": "Push the number -1."
+        },
+        {
+          "name": "OP_RESERVED",
+          "code": 80,
+          "category": "reserved",
+          "comment": "Reserved; transaction is invalid unless occurring in an unexecuted branch."
+        },
+        {
+          "name": "OP_1",
+          "code": 81,
+          "category": "constants",
+          "comment": "Push the number 1. Also the segwit/taproot witness version prefix."
+        },
+        {
+          "name": "OP_2",
+          "code": 82,
+          "category": "constants",
+          "comment": "Push the number 2."
+        },
+        {
+          "name": "OP_3",
+          "code": 83,
+          "category": "constants",
+          "comment": "Push the number 3."
+        },
+        {
+          "name": "OP_4",
+          "code": 84,
+          "category": "constants",
+          "comment": "Push the number 4."
+        },
+        {
+          "name": "OP_5",
+          "code": 85,
+          "category": "constants",
+          "comment": "Push the number 5."
+        },
+        {
+          "name": "OP_6",
+          "code": 86,
+          "category": "constants",
+          "comment": "Push the number 6."
+        },
+        {
+          "name": "OP_7",
+          "code": 87,
+          "category": "constants",
+          "comment": "Push the number 7."
+        },
+        {
+          "name": "OP_8",
+          "code": 88,
+          "category": "constants",
+          "comment": "Push the number 8."
+        },
+        {
+          "name": "OP_9",
+          "code": 89,
+          "category": "constants",
+          "comment": "Push the number 9."
+        },
+        {
+          "name": "OP_10",
+          "code": 90,
+          "category": "constants",
+          "comment": "Push the number 10."
+        },
+        {
+          "name": "OP_11",
+          "code": 91,
+          "category": "constants",
+          "comment": "Push the number 11."
+        },
+        {
+          "name": "OP_12",
+          "code": 92,
+          "category": "constants",
+          "comment": "Push the number 12."
+        },
+        {
+          "name": "OP_13",
+          "code": 93,
+          "category": "constants",
+          "comment": "Push the number 13."
+        },
+        {
+          "name": "OP_14",
+          "code": 94,
+          "category": "constants",
+          "comment": "Push the number 14."
+        },
+        {
+          "name": "OP_15",
+          "code": 95,
+          "category": "constants",
+          "comment": "Push the number 15."
+        },
+        {
+          "name": "OP_16",
+          "code": 96,
+          "category": "constants",
+          "comment": "Push the number 16."
+        },
+        {
+          "name": "OP_NOP",
+          "code": 97,
+          "category": "flow",
+          "comment": "Does nothing."
+        },
+        {
+          "name": "OP_VER",
+          "code": 98,
+          "category": "reserved",
+          "comment": "Reserved; invalid unless in an unexecuted branch."
+        },
+        {
+          "name": "OP_IF",
+          "code": 99,
+          "category": "flow",
+          "comment": "Execute the following statements if the top stack value is true (popped)."
+        },
+        {
+          "name": "OP_NOTIF",
+          "code": 100,
+          "category": "flow",
+          "comment": "Execute the following statements if the top stack value is false (popped)."
+        },
+        {
+          "name": "OP_VERIF",
+          "code": 101,
+          "category": "reserved",
+          "comment": "Reserved; transaction is invalid even in an unexecuted branch."
+        },
+        {
+          "name": "OP_VERNOTIF",
+          "code": 102,
+          "category": "reserved",
+          "comment": "Reserved; transaction is invalid even in an unexecuted branch."
+        },
+        {
+          "name": "OP_ELSE",
+          "code": 103,
+          "category": "flow",
+          "comment": "Execute if the preceding OP_IF/OP_NOTIF branch was not executed."
+        },
+        {
+          "name": "OP_ENDIF",
+          "code": 104,
+          "category": "flow",
+          "comment": "Ends an OP_IF/OP_NOTIF/OP_ELSE block."
+        },
+        {
+          "name": "OP_VERIFY",
+          "code": 105,
+          "category": "flow",
+          "comment": "Fail the script if the top stack value is not true; pops it."
+        },
+        {
+          "name": "OP_RETURN",
+          "code": 106,
+          "category": "flow",
+          "comment": "Fail the script immediately. Standard for provably-unspendable data-carrier outputs."
+        },
+        {
+          "name": "OP_TOALTSTACK",
+          "code": 107,
+          "category": "stack",
+          "comment": "Move the top item to the alt stack."
+        },
+        {
+          "name": "OP_FROMALTSTACK",
+          "code": 108,
+          "category": "stack",
+          "comment": "Move the top alt-stack item to the main stack."
+        },
+        {
+          "name": "OP_2DROP",
+          "code": 109,
+          "category": "stack",
+          "comment": "Drop the top two items."
+        },
+        {
+          "name": "OP_2DUP",
+          "code": 110,
+          "category": "stack",
+          "comment": "Duplicate the top two items."
+        },
+        {
+          "name": "OP_3DUP",
+          "code": 111,
+          "category": "stack",
+          "comment": "Duplicate the top three items."
+        },
+        {
+          "name": "OP_2OVER",
+          "code": 112,
+          "category": "stack",
+          "comment": "Copy the third and fourth items to the top."
+        },
+        {
+          "name": "OP_2ROT",
+          "code": 113,
+          "category": "stack",
+          "comment": "Move the fifth and sixth items to the top."
+        },
+        {
+          "name": "OP_2SWAP",
+          "code": 114,
+          "category": "stack",
+          "comment": "Swap the top two pairs of items."
+        },
+        {
+          "name": "OP_IFDUP",
+          "code": 115,
+          "category": "stack",
+          "comment": "Duplicate the top item if it is not zero."
+        },
+        {
+          "name": "OP_DEPTH",
+          "code": 116,
+          "category": "stack",
+          "comment": "Push the stack depth."
+        },
+        {
+          "name": "OP_DROP",
+          "code": 117,
+          "category": "stack",
+          "comment": "Drop the top item."
+        },
+        {
+          "name": "OP_DUP",
+          "code": 118,
+          "category": "stack",
+          "comment": "Duplicate the top item."
+        },
+        {
+          "name": "OP_NIP",
+          "code": 119,
+          "category": "stack",
+          "comment": "Remove the second item."
+        },
+        {
+          "name": "OP_OVER",
+          "code": 120,
+          "category": "stack",
+          "comment": "Copy the second item to the top."
+        },
+        {
+          "name": "OP_PICK",
+          "code": 121,
+          "category": "stack",
+          "comment": "Copy the item n back to the top (n popped)."
+        },
+        {
+          "name": "OP_ROLL",
+          "code": 122,
+          "category": "stack",
+          "comment": "Move the item n back to the top (n popped)."
+        },
+        {
+          "name": "OP_ROT",
+          "code": 123,
+          "category": "stack",
+          "comment": "Rotate the top three items."
+        },
+        {
+          "name": "OP_SWAP",
+          "code": 124,
+          "category": "stack",
+          "comment": "Swap the top two items."
+        },
+        {
+          "name": "OP_TUCK",
+          "code": 125,
+          "category": "stack",
+          "comment": "Copy the top item below the second."
+        },
+        {
+          "name": "OP_CAT",
+          "code": 126,
+          "category": "splice",
+          "comment": "Concatenate two byte vectors.",
+          "disabled": true
+        },
+        {
+          "name": "OP_SUBSTR",
+          "code": 127,
+          "category": "splice",
+          "comment": "Return a section of a byte vector.",
+          "disabled": true
+        },
+        {
+          "name": "OP_LEFT",
+          "code": 128,
+          "category": "splice",
+          "comment": "Keep only bytes left of a position.",
+          "disabled": true
+        },
+        {
+          "name": "OP_RIGHT",
+          "code": 129,
+          "category": "splice",
+          "comment": "Keep only bytes right of a position.",
+          "disabled": true
+        },
+        {
+          "name": "OP_SIZE",
+          "code": 130,
+          "category": "splice",
+          "comment": "Push the length of the top byte vector (without popping it)."
+        },
+        {
+          "name": "OP_INVERT",
+          "code": 131,
+          "category": "bitlogic",
+          "comment": "Bitwise NOT.",
+          "disabled": true
+        },
+        {
+          "name": "OP_AND",
+          "code": 132,
+          "category": "bitlogic",
+          "comment": "Bitwise AND.",
+          "disabled": true
+        },
+        {
+          "name": "OP_OR",
+          "code": 133,
+          "category": "bitlogic",
+          "comment": "Bitwise OR.",
+          "disabled": true
+        },
+        {
+          "name": "OP_XOR",
+          "code": 134,
+          "category": "bitlogic",
+          "comment": "Bitwise XOR.",
+          "disabled": true
+        },
+        {
+          "name": "OP_EQUAL",
+          "code": 135,
+          "category": "bitlogic",
+          "comment": "Push true if the top two items are exactly equal."
+        },
+        {
+          "name": "OP_EQUALVERIFY",
+          "code": 136,
+          "category": "bitlogic",
+          "comment": "OP_EQUAL then OP_VERIFY."
+        },
+        {
+          "name": "OP_RESERVED1",
+          "code": 137,
+          "category": "reserved",
+          "comment": "Reserved; invalid unless in an unexecuted branch."
+        },
+        {
+          "name": "OP_RESERVED2",
+          "code": 138,
+          "category": "reserved",
+          "comment": "Reserved; invalid unless in an unexecuted branch."
+        },
+        {
+          "name": "OP_1ADD",
+          "code": 139,
+          "category": "arithmetic",
+          "comment": "Add 1."
+        },
+        {
+          "name": "OP_1SUB",
+          "code": 140,
+          "category": "arithmetic",
+          "comment": "Subtract 1."
+        },
+        {
+          "name": "OP_2MUL",
+          "code": 141,
+          "category": "arithmetic",
+          "comment": "Multiply by 2.",
+          "disabled": true
+        },
+        {
+          "name": "OP_2DIV",
+          "code": 142,
+          "category": "arithmetic",
+          "comment": "Divide by 2.",
+          "disabled": true
+        },
+        {
+          "name": "OP_NEGATE",
+          "code": 143,
+          "category": "arithmetic",
+          "comment": "Negate."
+        },
+        {
+          "name": "OP_ABS",
+          "code": 144,
+          "category": "arithmetic",
+          "comment": "Absolute value."
+        },
+        {
+          "name": "OP_NOT",
+          "code": 145,
+          "category": "arithmetic",
+          "comment": "Push true if input is zero, else false."
+        },
+        {
+          "name": "OP_0NOTEQUAL",
+          "code": 146,
+          "category": "arithmetic",
+          "comment": "Push false if input is zero, else true."
+        },
+        {
+          "name": "OP_ADD",
+          "code": 147,
+          "category": "arithmetic",
+          "comment": "Add the top two numbers."
+        },
+        {
+          "name": "OP_SUB",
+          "code": 148,
+          "category": "arithmetic",
+          "comment": "Subtract the top number from the second."
+        },
+        {
+          "name": "OP_MUL",
+          "code": 149,
+          "category": "arithmetic",
+          "comment": "Multiply.",
+          "disabled": true
+        },
+        {
+          "name": "OP_DIV",
+          "code": 150,
+          "category": "arithmetic",
+          "comment": "Divide.",
+          "disabled": true
+        },
+        {
+          "name": "OP_MOD",
+          "code": 151,
+          "category": "arithmetic",
+          "comment": "Remainder.",
+          "disabled": true
+        },
+        {
+          "name": "OP_LSHIFT",
+          "code": 152,
+          "category": "arithmetic",
+          "comment": "Left shift.",
+          "disabled": true
+        },
+        {
+          "name": "OP_RSHIFT",
+          "code": 153,
+          "category": "arithmetic",
+          "comment": "Right shift.",
+          "disabled": true
+        },
+        {
+          "name": "OP_BOOLAND",
+          "code": 154,
+          "category": "arithmetic",
+          "comment": "Boolean AND of the top two numbers."
+        },
+        {
+          "name": "OP_BOOLOR",
+          "code": 155,
+          "category": "arithmetic",
+          "comment": "Boolean OR of the top two numbers."
+        },
+        {
+          "name": "OP_NUMEQUAL",
+          "code": 156,
+          "category": "arithmetic",
+          "comment": "Push true if the top two numbers are equal."
+        },
+        {
+          "name": "OP_NUMEQUALVERIFY",
+          "code": 157,
+          "category": "arithmetic",
+          "comment": "OP_NUMEQUAL then OP_VERIFY."
+        },
+        {
+          "name": "OP_NUMNOTEQUAL",
+          "code": 158,
+          "category": "arithmetic",
+          "comment": "Push true if the top two numbers differ."
+        },
+        {
+          "name": "OP_LESSTHAN",
+          "code": 159,
+          "category": "arithmetic",
+          "comment": "a < b."
+        },
+        {
+          "name": "OP_GREATERTHAN",
+          "code": 160,
+          "category": "arithmetic",
+          "comment": "a > b."
+        },
+        {
+          "name": "OP_LESSTHANOREQUAL",
+          "code": 161,
+          "category": "arithmetic",
+          "comment": "a <= b."
+        },
+        {
+          "name": "OP_GREATERTHANOREQUAL",
+          "code": 162,
+          "category": "arithmetic",
+          "comment": "a >= b."
+        },
+        {
+          "name": "OP_MIN",
+          "code": 163,
+          "category": "arithmetic",
+          "comment": "Lesser of two numbers."
+        },
+        {
+          "name": "OP_MAX",
+          "code": 164,
+          "category": "arithmetic",
+          "comment": "Greater of two numbers."
+        },
+        {
+          "name": "OP_WITHIN",
+          "code": 165,
+          "category": "arithmetic",
+          "comment": "True if x is within [min, max)."
+        },
+        {
+          "name": "OP_RIPEMD160",
+          "code": 166,
+          "category": "crypto",
+          "comment": "RIPEMD-160 hash of the top item."
+        },
+        {
+          "name": "OP_SHA1",
+          "code": 167,
+          "category": "crypto",
+          "comment": "SHA-1 hash of the top item."
+        },
+        {
+          "name": "OP_SHA256",
+          "code": 168,
+          "category": "crypto",
+          "comment": "SHA-256 hash of the top item."
+        },
+        {
+          "name": "OP_HASH160",
+          "code": 169,
+          "category": "crypto",
+          "comment": "SHA-256 then RIPEMD-160 \u2014 the public-key and script hash used in addresses."
+        },
+        {
+          "name": "OP_HASH256",
+          "code": 170,
+          "category": "crypto",
+          "comment": "Double SHA-256 \u2014 the block and transaction hash function."
+        },
+        {
+          "name": "OP_CODESEPARATOR",
+          "code": 171,
+          "category": "crypto",
+          "comment": "Marks the start of signed script data."
+        },
+        {
+          "name": "OP_CHECKSIG",
+          "code": 172,
+          "category": "crypto",
+          "comment": "Verify a signature against a public key and the transaction sighash."
+        },
+        {
+          "name": "OP_CHECKSIGVERIFY",
+          "code": 173,
+          "category": "crypto",
+          "comment": "OP_CHECKSIG then OP_VERIFY."
+        },
+        {
+          "name": "OP_CHECKMULTISIG",
+          "code": 174,
+          "category": "crypto",
+          "comment": "Verify m signatures against n public keys. Pops one extra item (historical off-by-one)."
+        },
+        {
+          "name": "OP_CHECKMULTISIGVERIFY",
+          "code": 175,
+          "category": "crypto",
+          "comment": "OP_CHECKMULTISIG then OP_VERIFY."
+        },
+        {
+          "name": "OP_NOP1",
+          "code": 176,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_CHECKLOCKTIMEVERIFY",
+          "code": 177,
+          "category": "locktime",
+          "comment": "Fail if the transaction lockTime is below the top stack number. Formerly OP_NOP2.",
+          "bip": 65
+        },
+        {
+          "name": "OP_CHECKSEQUENCEVERIFY",
+          "code": 178,
+          "category": "locktime",
+          "comment": "Fail if the input sequence relative lock-time is below the top stack number. Formerly OP_NOP3.",
+          "bip": 112
+        },
+        {
+          "name": "OP_NOP4",
+          "code": 179,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_NOP5",
+          "code": 180,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_NOP6",
+          "code": 181,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_NOP7",
+          "code": 182,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_NOP8",
+          "code": 183,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_NOP9",
+          "code": 184,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_NOP10",
+          "code": 185,
+          "category": "flow",
+          "comment": "Does nothing; reserved for upgrades."
+        },
+        {
+          "name": "OP_CHECKSIGADD",
+          "code": 186,
+          "category": "crypto",
+          "comment": "Tapscript batch-friendly multisig: add a signature check result to a counter.",
+          "bip": 342
+        }
+      ]
+    },
+    {
+      "@id": "btc:ScriptType",
+      "@type": "Enumeration",
+      "module": "btc:script",
+      "label": "ScriptType",
+      "comment": "Standard output script templates. <n> in a template matches a data push of exactly n bytes; <a|b> matches either length. The addressEncoding rule derives the address from the matched data pushes (payload 'push:n' is the n-th data push) and the network's parameters (base58 version bytes, bech32 HRP).",
+      "members": [
+        {
+          "name": "p2pk",
+          "comment": "Pay to public key: the original output form, used by early coinbases including the genesis block. No address form exists.",
+          "template": "<33|65> OP_CHECKSIG"
+        },
+        {
+          "name": "p2pkh",
+          "comment": "Pay to public key hash: the classic base58 '1\u2026' address.",
+          "template": "OP_DUP OP_HASH160 <20> OP_EQUALVERIFY OP_CHECKSIG",
+          "addressEncoding": {
+            "encoding": "base58check",
+            "versionParam": "p2pkhVersion",
+            "payload": "push:0"
+          }
+        },
+        {
+          "name": "p2sh",
+          "comment": "Pay to script hash (BIP 16): the spender reveals a redeem script matching the hash. Base58 '3\u2026' address.",
+          "template": "OP_HASH160 <20> OP_EQUAL",
+          "bip": 16,
+          "addressEncoding": {
+            "encoding": "base58check",
+            "versionParam": "p2shVersion",
+            "payload": "push:0"
+          }
+        },
+        {
+          "name": "p2wpkh",
+          "comment": "Native segwit v0 pay to witness public key hash (BIP 141). Bech32 'bc1q\u2026' address.",
+          "template": "OP_0 <20>",
+          "bip": [
+            141,
+            173
+          ],
+          "addressEncoding": {
+            "encoding": "bech32",
+            "witnessVersion": 0,
+            "payload": "push:0"
+          }
+        },
+        {
+          "name": "p2wsh",
+          "comment": "Native segwit v0 pay to witness script hash (BIP 141). Bech32 'bc1q\u2026' address (longer).",
+          "template": "OP_0 <32>",
+          "bip": [
+            141,
+            173
+          ],
+          "addressEncoding": {
+            "encoding": "bech32",
+            "witnessVersion": 0,
+            "payload": "push:0"
+          }
+        },
+        {
+          "name": "p2tr",
+          "comment": "Taproot (BIP 341): pay to a tweaked x-only public key. Bech32m 'bc1p\u2026' address.",
+          "template": "OP_1 <32>",
+          "bip": [
+            341,
+            350
+          ],
+          "addressEncoding": {
+            "encoding": "bech32m",
+            "witnessVersion": 1,
+            "payload": "push:0"
+          }
+        },
+        {
+          "name": "anchor",
+          "comment": "Pay-to-anchor (BIP 431): OP_1 <0x4e73>, a 2-byte witness v1 program spendable by anyone with an empty witness; the ephemeral anchor of v3 transaction packages. Bech32m 'bc1pfeessrawgf'. Standard since Core 28.",
+          "special": "anchor",
+          "bip": [
+            431
+          ],
+          "addressEncoding": {
+            "encoding": "bech32m",
+            "witnessVersion": 1,
+            "payload": "push:0"
+          }
+        },
+        {
+          "name": "multisig",
+          "comment": "Bare m-of-n multisig: OP_m <pubkey>\u2026 OP_n OP_CHECKMULTISIG. No address form.",
+          "special": "multisig"
+        },
+        {
+          "name": "nulldata",
+          "comment": "OP_RETURN data carrier: provably unspendable, excluded from the UTXO set.",
+          "special": "nulldata"
+        },
+        {
+          "name": "witness-unknown",
+          "comment": "A witness program with a version not yet assigned semantics (OP_2..OP_16 followed by a 2-40 byte push). Valid to send to; anyone-can-spend until a soft fork defines it.",
+          "special": "witness-unknown",
+          "bip": 141,
+          "addressEncoding": {
+            "encoding": "bech32m",
+            "payload": "push:0"
+          }
+        },
+        {
+          "name": "nonstandard",
+          "comment": "Any script matching no standard template. Consensus-valid but not relayed by default policy.",
+          "special": "fallback"
+        }
+      ]
+    },
+    {
+      "@id": "btc:SighashType",
+      "@type": "Enumeration",
+      "module": "btc:script",
+      "label": "SighashType",
+      "comment": "Signature hash modes controlling which parts of a transaction a signature commits to. ANYONECANPAY is a flag combinable with the base modes.",
+      "members": [
+        {
+          "name": "SIGHASH_DEFAULT",
+          "code": 0,
+          "comment": "Taproot only (BIP 341): equivalent to SIGHASH_ALL but allows the shorter 64-byte signature.",
+          "bip": 341
+        },
+        {
+          "name": "SIGHASH_ALL",
+          "code": 1,
+          "comment": "Commit to all inputs and all outputs \u2014 the default and overwhelmingly most common mode."
+        },
+        {
+          "name": "SIGHASH_NONE",
+          "code": 2,
+          "comment": "Commit to all inputs and no outputs."
+        },
+        {
+          "name": "SIGHASH_SINGLE",
+          "code": 3,
+          "comment": "Commit to all inputs and only the output with the same index as the signed input."
+        },
+        {
+          "name": "SIGHASH_ANYONECANPAY",
+          "code": 128,
+          "comment": "Flag: commit only to the signed input, allowing others to add inputs."
+        }
+      ]
+    },
+    {
+      "@id": "btc:ScriptLimits",
+      "@type": "ContextStruct",
+      "module": "btc:script",
+      "label": "ScriptLimits",
+      "comment": "Consensus limits on script execution. Enforced by the interpreter; exceeding any of them fails the script.",
+      "fields": [
+        {
+          "property": "btc:maxScriptSize",
+          "label": "maxScriptSize",
+          "valueType": "u32",
+          "comment": "Maximum script length in bytes: 10,000."
+        },
+        {
+          "property": "btc:maxScriptElementSize",
+          "label": "maxScriptElementSize",
+          "valueType": "u32",
+          "comment": "Maximum size of a stack element: 520 bytes."
+        },
+        {
+          "property": "btc:maxOpsPerScript",
+          "label": "maxOpsPerScript",
+          "valueType": "u32",
+          "comment": "Maximum non-push operations per script: 201."
+        },
+        {
+          "property": "btc:maxStackSize",
+          "label": "maxStackSize",
+          "valueType": "u32",
+          "comment": "Maximum combined main+alt stack depth: 1,000."
+        },
+        {
+          "property": "btc:maxMultisigKeys",
+          "label": "maxMultisigKeys",
+          "valueType": "u32",
+          "comment": "Maximum public keys in a CHECKMULTISIG: 20."
+        }
+      ]
+    },
+    {
+      "@id": "btc:scriptLimits",
+      "@type": "btc:ScriptLimits",
+      "label": "scriptLimits",
+      "comment": "The consensus script-execution limits.",
+      "maxScriptSize": 10000,
+      "maxScriptElementSize": 520,
+      "maxOpsPerScript": 201,
+      "maxStackSize": 1000,
+      "maxMultisigKeys": 20
+    },
+    {
+      "@id": "btc:ControlBlock",
+      "@type": "ContextStruct",
+      "module": "btc:script",
+      "label": "ControlBlock",
+      "bip": 341,
+      "comment": "The proof carried in a taproot script-path witness (as its last element, after removing any annex): it demonstrates that the revealed leaf script is committed by the output key. Length 33 + 32m bytes, m <= 128.",
+      "fields": [
+        {
+          "property": "btc:leafVersionParity",
+          "label": "leafVersionAndParity",
+          "valueType": "u8",
+          "comment": "High 7 bits: the leaf version (0xc0 = tapscript). Low bit: the y-parity of the tweaked output key."
+        },
+        {
+          "property": "btc:internalKey",
+          "label": "internalKey",
+          "valueType": "hex",
+          "comment": "The 32-byte x-only internal public key P, before tweaking."
+        },
+        {
+          "property": "btc:merklePath",
+          "label": "merklePath",
+          "valueType": "hex",
+          "comment": "Zero or more 32-byte sibling hashes; combined pairwise (lexicographically ordered) with TapBranch tagged hashes up to the merkle root, which feeds the TapTweak."
+        }
+      ]
+    },
+    {
+      "@id": "btc:TaprootConstants",
+      "@type": "ContextStruct",
+      "module": "btc:script",
+      "label": "TaprootConstants",
+      "comment": "Constants of the taproot construction (BIP 340/341/342). Tagged hashes are sha256(sha256(tag) || sha256(tag) || msg).",
+      "fields": [
+        {
+          "property": "btc:tapLeafTag",
+          "label": "tapLeafTag",
+          "valueType": "string",
+          "comment": "Tag for hashing a leaf script."
+        },
+        {
+          "property": "btc:tapBranchTag",
+          "label": "tapBranchTag",
+          "valueType": "string",
+          "comment": "Tag for combining two tree nodes."
+        },
+        {
+          "property": "btc:tapTweakTag",
+          "label": "tapTweakTag",
+          "valueType": "string",
+          "comment": "Tag for tweaking the internal key with the tree root."
+        },
+        {
+          "property": "btc:tapSighashTag",
+          "label": "tapSighashTag",
+          "valueType": "string",
+          "comment": "Tag wrapping the BIP 341 signature message."
+        },
+        {
+          "property": "btc:tapscriptLeafVersion",
+          "label": "tapscriptLeafVersion",
+          "valueType": "u8",
+          "comment": "The leaf version with defined semantics: 0xc0 (tapscript, BIP 342)."
+        },
+        {
+          "property": "btc:annexPrefix",
+          "label": "annexPrefix",
+          "valueType": "u8",
+          "comment": "A final witness element beginning 0x50 (with >= 2 elements) is the annex, reserved for future use but committed by the sighash."
+        },
+        {
+          "property": "btc:sigopsBudgetBase",
+          "label": "sigopsBudgetBase",
+          "valueType": "u32",
+          "comment": "Tapscript signature budget: 50 plus the serialized witness size; each non-empty signature check costs 50."
+        }
+      ]
+    },
+    {
+      "@id": "btc:taproot",
+      "@type": "btc:TaprootConstants",
+      "label": "taproot",
+      "comment": "The taproot constants deployed on mainnet at height 709,632.",
+      "tapLeafTag": "TapLeaf",
+      "tapBranchTag": "TapBranch",
+      "tapTweakTag": "TapTweak",
+      "tapSighashTag": "TapSighash",
+      "tapscriptLeafVersion": 192,
+      "annexPrefix": 80,
+      "sigopsBudgetBase": 50
+    }
+  ]
+}
\ No newline at end of file
diff --git a/vendor/sidestr/schema/schema/validate.jsonld b/vendor/sidestr/schema/schema/validate.jsonld
new file mode 100644
index 0000000..f6fcb3e
--- /dev/null
+++ b/vendor/sidestr/schema/schema/validate.jsonld
@@ -0,0 +1,344 @@
+{
+  "@context": "../context.jsonld",
+  "@graph": [
+    {
+      "@id": "btc:validate",
+      "@type": "Module",
+      "label": "validate",
+      "version": "0.0.13",
+      "comment": "Validation rules as data, in the spirit of Hornet Node's formal consensus specification: ordered rulesets of pure checks, each enforcing a single invariant and naming a typed error. Error codes match Bitcoin Core's reject reasons so results are comparable across implementations.",
+      "layer": "rules"
+    },
+    {
+      "@id": "btc:HeaderRules",
+      "@type": "RuleSet",
+      "module": "btc:validate",
+      "label": "HeaderRules",
+      "phase": "header",
+      "comment": "Contextual validation of a block header against its predecessor chain. Sufficient for headers-only sync: a chain passing these rules has verifiable cumulative proof-of-work.",
+      "rules": [
+        {
+          "@id": "btc:rule-header-prev-link",
+          "@type": "ValidationRule",
+          "label": "prev-link",
+          "errorCode": "bad-prevblk",
+          "comment": "The header's prevBlockHash must equal the hash of the preceding header, extending a known chain.",
+          "check": "header.prevBlockHash == hash(prev)"
+        },
+        {
+          "@id": "btc:rule-header-pow",
+          "@type": "ValidationRule",
+          "label": "proof-of-work",
+          "errorCode": "high-hash",
+          "comment": "The header's hash, interpreted as a 256-bit number, must not exceed the target encoded by its bits field.",
+          "check": "hash(header) <= expandCompact(header.bits)"
+        },
+        {
+          "@id": "btc:rule-header-difficulty",
+          "@type": "ValidationRule",
+          "label": "difficulty",
+          "errorCode": "bad-diffbits",
+          "comment": "The bits field must equal the expected target: unchanged within a difficulty epoch; at each 2016-block boundary, retargeted by the previous epoch's actual timespan (clamped to [targetTimespan/4, targetTimespan*4]), never easier than powLimit.",
+          "check": "header.bits == expectedBits(prev, prevHeight, epochFirst, params)"
+        },
+        {
+          "@id": "btc:rule-header-mtp",
+          "@type": "ValidationRule",
+          "label": "median-time-past",
+          "errorCode": "time-too-old",
+          "comment": "The header's timestamp must be strictly greater than the median timestamp of the previous 11 blocks.",
+          "check": "header.time > medianTimePast(prev11)"
+        },
+        {
+          "@id": "btc:rule-header-time-future",
+          "@type": "ValidationRule",
+          "label": "future-time",
+          "errorCode": "time-too-new",
+          "comment": "The header's timestamp must be no more than maxFutureBlockTime (2 hours) ahead of network-adjusted time.",
+          "check": "header.time <= now + params.maxFutureBlockTime"
+        },
+        {
+          "@id": "btc:rule-header-version",
+          "@type": "ValidationRule",
+          "label": "version",
+          "errorCode": "bad-version",
+          "bip": [
+            34,
+            66,
+            65
+          ],
+          "comment": "Obsolete block versions are rejected once the corresponding deployment is buried: version >= 2 from params.bip34Height, >= 3 from params.bip66Height, >= 4 from params.bip65Height.",
+          "check": "header.version >= minVersionAt(height, params)"
+        },
+        {
+          "@id": "btc:rule-header-timewarp",
+          "@type": "ValidationRule",
+          "label": "timewarp",
+          "errorCode": "time-timewarp-attack",
+          "bip": 94,
+          "comment": "On networks with the timewarp fix (testnet4), the first block of a difficulty epoch may not be timestamped more than params.maxTimewarp (600s) before its predecessor \u2014 closing the timewarp difficulty exploit. Skipped on networks without the fix.",
+          "check": "isEpochFirst(height) implies header.time >= prev.time - params.maxTimewarp"
+        }
+      ]
+    },
+    {
+      "@id": "btc:SpvRules",
+      "@type": "RuleSet",
+      "module": "btc:validate",
+      "label": "SpvRules",
+      "phase": "spv",
+      "comment": "Verification of a merkle inclusion proof (MerkleBlock). Combined with header chain validation, a proof passing these rules demonstrates a transaction's inclusion under the chain's cumulative proof-of-work without any block data.",
+      "rules": [
+        {
+          "@id": "btc:rule-spv-pow",
+          "@type": "ValidationRule",
+          "label": "proof-of-work",
+          "errorCode": "high-hash",
+          "comment": "The embedded header's hash must satisfy its own target. (Chain membership and cumulative work are established by the header phase.)",
+          "check": "hash(merkleBlock.header) <= expandCompact(merkleBlock.header.bits)"
+        },
+        {
+          "@id": "btc:rule-spv-tree",
+          "@type": "ValidationRule",
+          "label": "tree-consistency",
+          "errorCode": "bad-merkle-tree",
+          "comment": "The partial merkle tree must be well-formed: every hash and every flag bit consumed exactly once (modulo byte padding), no identical left/right branches (CVE-2012-2459), and a non-zero transaction count.",
+          "check": "extractPartialMerkleTree(merkleBlock).wellFormed"
+        },
+        {
+          "@id": "btc:rule-spv-merkle-root",
+          "@type": "ValidationRule",
+          "label": "merkle-root",
+          "errorCode": "bad-txnmrklroot",
+          "comment": "The root reconstructed from the partial tree must equal the header's merkleRoot.",
+          "check": "extractPartialMerkleTree(merkleBlock).root == merkleBlock.header.merkleRoot"
+        },
+        {
+          "@id": "btc:rule-spv-inclusion",
+          "@type": "ValidationRule",
+          "label": "inclusion",
+          "errorCode": "tx-not-included",
+          "comment": "The transaction being verified must appear among the proof's matched txids. Skipped when no target transaction is specified.",
+          "check": "txid in extractPartialMerkleTree(merkleBlock).matches"
+        }
+      ]
+    },
+    {
+      "@id": "btc:TransactionRules",
+      "@type": "RuleSet",
+      "module": "btc:validate",
+      "label": "TransactionRules",
+      "phase": "transaction",
+      "comment": "Context-free structural validation of a single transaction (Bitcoin Core's CheckTransaction). These rules need no chain state. Signature and script execution are a separate, later concern.",
+      "rules": [
+        {
+          "@id": "btc:rule-tx-inputs-nonempty",
+          "@type": "ValidationRule",
+          "label": "inputs-nonempty",
+          "errorCode": "bad-txns-vin-empty",
+          "check": "tx.inputs.length > 0"
+        },
+        {
+          "@id": "btc:rule-tx-outputs-nonempty",
+          "@type": "ValidationRule",
+          "label": "outputs-nonempty",
+          "errorCode": "bad-txns-vout-empty",
+          "check": "tx.outputs.length > 0"
+        },
+        {
+          "@id": "btc:rule-tx-size",
+          "@type": "ValidationRule",
+          "label": "size-limit",
+          "errorCode": "bad-txns-oversize",
+          "comment": "A single transaction may not exceed the block weight limit.",
+          "check": "weight(tx) <= params.maxBlockWeight"
+        },
+        {
+          "@id": "btc:rule-tx-output-values",
+          "@type": "ValidationRule",
+          "label": "output-values",
+          "errorCode": "bad-txns-vout-toolarge",
+          "comment": "Each output value must be in [0, maxMoney], and so must their sum.",
+          "check": "every(tx.outputs, 0 <= value <= params.maxMoney) && sum(tx.outputs.value) <= params.maxMoney"
+        },
+        {
+          "@id": "btc:rule-tx-inputs-unique",
+          "@type": "ValidationRule",
+          "label": "inputs-unique",
+          "errorCode": "bad-txns-inputs-duplicate",
+          "comment": "No two inputs of a transaction may spend the same outpoint.",
+          "check": "unique(tx.inputs.prevout)"
+        },
+        {
+          "@id": "btc:rule-tx-prevouts",
+          "@type": "ValidationRule",
+          "label": "prevouts",
+          "errorCode": "bad-txns-prevout-null",
+          "comment": "A coinbase has exactly one input with the null outpoint; a non-coinbase transaction must have no null outpoints.",
+          "check": "coinbase ? (tx.inputs.length == 1 && isNull(tx.inputs[0].prevout)) : none(tx.inputs, isNull(prevout))"
+        },
+        {
+          "@id": "btc:rule-tx-coinbase-script",
+          "@type": "ValidationRule",
+          "label": "coinbase-script-size",
+          "errorCode": "bad-cb-length",
+          "comment": "A coinbase scriptSig must be between 2 and 100 bytes. Skipped for non-coinbase transactions.",
+          "check": "2 <= byteLength(tx.inputs[0].scriptSig) <= 100"
+        }
+      ]
+    },
+    {
+      "@id": "btc:BlockRules",
+      "@type": "RuleSet",
+      "module": "btc:validate",
+      "label": "BlockRules",
+      "phase": "block",
+      "comment": "Context-free structural validation of a block (Bitcoin Core's CheckBlock), given that its header has already passed the header phase. Every transaction must additionally pass the transaction phase.",
+      "rules": [
+        {
+          "@id": "btc:rule-block-coinbase-first",
+          "@type": "ValidationRule",
+          "label": "coinbase-first",
+          "errorCode": "bad-cb-missing",
+          "comment": "The block must be non-empty and its first transaction must be the coinbase.",
+          "check": "block.transactions.length > 0 && isCoinbase(block.transactions[0])"
+        },
+        {
+          "@id": "btc:rule-block-coinbase-single",
+          "@type": "ValidationRule",
+          "label": "coinbase-single",
+          "errorCode": "bad-cb-multiple",
+          "comment": "No transaction after the first may be a coinbase.",
+          "check": "none(block.transactions[1..], isCoinbase)"
+        },
+        {
+          "@id": "btc:rule-block-merkle-root",
+          "@type": "ValidationRule",
+          "label": "merkle-root",
+          "errorCode": "bad-txnmrklroot",
+          "comment": "The merkle root recomputed from the transactions' txids must equal the header's.",
+          "check": "merkleRoot(map(block.transactions, txid)) == block.header.merkleRoot"
+        },
+        {
+          "@id": "btc:rule-block-tx-duplicates",
+          "@type": "ValidationRule",
+          "label": "no-duplicate-txids",
+          "errorCode": "bad-txns-duplicate",
+          "comment": "No two transactions in the block may share a txid (guards the merkle mutation of CVE-2012-2459).",
+          "check": "unique(map(block.transactions, txid))"
+        },
+        {
+          "@id": "btc:rule-block-sigops",
+          "@type": "ValidationRule",
+          "label": "sigop-limit",
+          "errorCode": "bad-blk-sigops",
+          "comment": "Total legacy signature operations (CHECKSIG counts 1, CHECKMULTISIG counts 20, over all scriptSigs and scriptPubKeys) times the witness scale factor (4) may not exceed params.maxBlockSigopsCost.",
+          "check": "4 * sum(map(block.transactions, legacySigOps)) <= params.maxBlockSigopsCost"
+        },
+        {
+          "@id": "btc:rule-block-weight",
+          "@type": "ValidationRule",
+          "label": "weight-limit",
+          "errorCode": "bad-blk-weight",
+          "check": "weight(block) <= params.maxBlockWeight"
+        },
+        {
+          "@id": "btc:rule-block-transactions",
+          "@type": "ValidationRule",
+          "label": "transactions-valid",
+          "errorCode": "bad-txns",
+          "comment": "Every transaction in the block passes the transaction phase.",
+          "check": "every(block.transactions, passes(TransactionRules))"
+        }
+      ]
+    },
+    {
+      "@id": "btc:BlockContextRules",
+      "@type": "RuleSet",
+      "module": "btc:validate",
+      "label": "BlockContextRules",
+      "phase": "block-context",
+      "comment": "Validation of a block against chain state: the UTXO set, the block's height, and activated deployments. Rules whose required context is unavailable are skipped and reported \u2014 in a pruned window, inputs spending coins created before the window can be resolved only if their transactions are provided. Witness/signature script execution is out of scope of this phase.",
+      "rules": [
+        {
+          "@id": "btc:rule-blockctx-bip34-height",
+          "@type": "ValidationRule",
+          "label": "coinbase-height",
+          "errorCode": "bad-cb-height",
+          "bip": 34,
+          "activationParam": "bip34Height",
+          "comment": "The coinbase scriptSig must begin with a push of the block height. Active from params.bip34Height.",
+          "check": "scriptNumber(firstPush(coinbase.scriptSig)) == height"
+        },
+        {
+          "@id": "btc:rule-blockctx-finality",
+          "@type": "ValidationRule",
+          "label": "tx-finality",
+          "errorCode": "bad-txns-nonfinal",
+          "bip": 113,
+          "comment": "Every transaction must be final at this block: lockTime of zero, or lockTime below the block height (if < 500,000,000) or below the median-time-past (otherwise), or all input sequences final (0xffffffff).",
+          "check": "every(block.transactions, isFinal(tx, height, medianTimePast))"
+        },
+        {
+          "@id": "btc:rule-blockctx-sequence-locks",
+          "@type": "ValidationRule",
+          "label": "sequence-locks",
+          "errorCode": "bad-txns-nonfinal",
+          "bip": [68, 112],
+          "comment": "BIP68 relative lock-time (enforced via BIP112). For a transaction of version >= 2, each input whose nSequence leaves the disable flag (bit 31) clear imposes a relative lock on the coin it spends. Height-based locks (type flag, bit 22, clear) require spendingHeight >= coinHeight + (nSequence & 0xffff). Time-based locks (bit 22 set) require (nSequence & 0xffff) << 9 seconds to have elapsed since the spent coin's median-time-past; that per-coin time context is not available to a light or pruned validator, so time-based locks are skipped honestly rather than guessed. A height-based lock whose coin height is unknown (out-of-window) is likewise skipped. Coinbase transactions and version-1 transactions are exempt.",
+          "check": "every(resolvedInputs of version>=2 txs, spendingHeight >= coinHeight + (sequence & 0xffff)) for height-based locks; time-based and out-of-window locks skip"
+        },
+        {
+          "@id": "btc:rule-blockctx-inputs-available",
+          "@type": "ValidationRule",
+          "label": "inputs-available",
+          "errorCode": "bad-txns-inputs-missingorspent",
+          "comment": "Every non-coinbase input must spend a coin that exists and is unspent at this point in the block's execution (no double spends within or across the block's transactions).",
+          "check": "every(inputs, utxo.has(prevout)) with sequential spending"
+        },
+        {
+          "@id": "btc:rule-blockctx-coinbase-maturity",
+          "@type": "ValidationRule",
+          "label": "coinbase-maturity",
+          "errorCode": "bad-txns-premature-spend-of-coinbase",
+          "comment": "A coinbase coin may be spent only at least params.coinbaseMaturity (100) blocks after its creation. In a pruned window the rule fails on a provably premature spend of a window coinbase; spends of out-of-window coinbase coins, whose height is unknowable, skip.",
+          "check": "every(spentCoinbaseCoins, height - coin.height >= params.coinbaseMaturity)"
+        },
+        {
+          "@id": "btc:rule-blockctx-fees",
+          "@type": "ValidationRule",
+          "label": "no-fee-deficit",
+          "errorCode": "bad-txns-in-belowout",
+          "comment": "For every non-coinbase transaction, the sum of input values must be at least the sum of output values.",
+          "check": "every(txs[1..], sum(inputValues) >= sum(outputValues))"
+        },
+        {
+          "@id": "btc:rule-blockctx-coinbase-amount",
+          "@type": "ValidationRule",
+          "label": "coinbase-amount",
+          "errorCode": "bad-cb-amount",
+          "comment": "The coinbase outputs may not exceed the block subsidy plus the block's total fees.",
+          "check": "sum(coinbase.outputs.value) <= subsidy(height, params) + fees(block)"
+        },
+        {
+          "@id": "btc:rule-blockctx-witness-commitment",
+          "@type": "ValidationRule",
+          "label": "witness-commitment",
+          "errorCode": "bad-witness-merkle-match",
+          "bip": 141,
+          "activationParam": "segwitHeight",
+          "comment": "If any transaction has witness data, the coinbase must carry a commitment output (OP_RETURN 0xaa21a9ed\u2026) equal to dsha256(witnessMerkleRoot || witnessReservedValue). Active from params.segwitHeight.",
+          "check": "commitment(coinbase) == dsha256(witnessMerkleRoot(block) || witnessReserved)"
+        },
+        {
+          "@id": "btc:rule-blockctx-scripts",
+          "@type": "ValidationRule",
+          "label": "scripts",
+          "errorCode": "mandatory-script-verify-flag-failed",
+          "comment": "Every resolvable non-coinbase input's unlocking script (and witness) must satisfy its prevout's locking script, with real signature verification: ECDSA for legacy/segwit-v0 paths (legacy and BIP 143 sighash) and Schnorr for taproot key and script paths (BIP 340/341/342). The only honest skips remaining are pruned-away prevouts (taproot additionally needs every input's prevout, as its sighash commits to all of them) and unknown future witness/leaf versions.",
+          "check": "every(resolvedInputs, executeScripts(input, prevout) == valid)"
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/vendor/sidestr/spec/LICENSE b/vendor/sidestr/spec/LICENSE
new file mode 100644
index 0000000..be3f7b2
--- /dev/null
+++ b/vendor/sidestr/spec/LICENSE
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
diff --git a/vendor/sidestr/spec/siding/lib/announce.mjs b/vendor/sidestr/spec/siding/lib/announce.mjs
new file mode 100644
index 0000000..1053fc0
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/announce.mjs
@@ -0,0 +1,67 @@
+// The signer's tip announcement (SPEC 11): a NIP-333 event, kind 33333, addressable by `d` =
+// chain id, content the last twelve headers, `u` tags naming mirrors that serve the block file.
+// A client that knows only a chain id asks a relay for this, takes a mirror from it, reads that
+// mirror's chain.json, and accepts the mirror when the document's signer is the event's author.
+// A mirror is then held to the announcement: same tip hash, or it is behind or lying. The `t` =
+// sidestr tag is what a directory filters on: relays index single-letter tags only.
+// Pure: browsers and Node alike. WebSocket is the platform's.
+export const TIP_KIND = 33333, TIP_HEADERS = 12;
+// a header's hex width follows the chain's parent (SPEC 3): 328 for the 164-byte v2 header beside a
+// BLAKE2b parent, 160 for the 80-byte stock header beside Bitcoin. An announcement carries at most
+// TIP_HEADERS headers, and no multiple of 160 up to 12 headers is a multiple of 328, so the width is
+// read from the content's length without knowing the parent
+export const HEADER_HEX = [328, 160];
+// at most TIP_HEADERS headers of hex: the disambiguation above holds only within that bound, and relay content is untrusted
+export const headerWidth = (content) => { if (!content.length || !/^[0-9a-f]+$/i.test(content)) return null; const w = HEADER_HEX.find((x) => content.length % x === 0); return w && content.length / w <= TIP_HEADERS ? w : null; };
+
+// pegScript: the parent output script a peg-in pays (SPEC 6), announced by the signer so a wallet can build one without asking anyone; the newest announcement wins, so it can rotate
+export function tipEvent({ events, key, chainId, headersHex, tip, mirrors = [], pegScript = null }) {
+  const start = tip - headersHex.length + 1; if (pegScript != null && !/^([0-9a-f]{2}){2,80}$/i.test(pegScript)) throw new Error('pegScript is a script of 2 to 80 bytes as hex');
+  return events.signEvent(key, { kind: TIP_KIND, tags: [['d', chainId], ['n', chainId], ['t', 'sidestr'], ['tip', String(tip)], ['alt', `sidestr headers ${start}-${tip} of ${chainId}`], ...mirrors.map((u) => ['u', u, 'mirror']), ...(pegScript ? [['peg', pegScript.toLowerCase()]] : [])], content: headersHex.join('') });
+}
+export function parseTip(ev) {
+  const tag = (n) => (ev.tags ?? []).filter((t) => t[0] === n).map((t) => t[1]);
+  const tip = Number(tag('tip')[0]); const content = String(ev.content ?? ''); const w = headerWidth(content); if (!Number.isInteger(tip) || !w) return null;
+  return { chainId: tag('d')[0], tip, mirrors: tag('u').map((u) => String(u).replace(/\/+$/, '')), headersHex: content.match(new RegExp(`.{${w}}`, 'g')) ?? [], headerBytes: w / 2, pegScript: (() => { const p = tag('peg')[0]; return p && /^([0-9a-f]{2}){2,80}$/i.test(p) ? p.toLowerCase() : null; })(), pubkey: ev.pubkey, created_at: ev.created_at, id: ev.id };
+}
+
+// the newest announcement for a chain, from any of the relays, within `timeout` ms
+export function fetchLatestTip({ relays, chainId, verify = () => true, signer, timeout = 6000 }) {
+  return new Promise((resolve) => {
+    let best = null, open = relays.length; const done = () => { if (--open <= 0) finish(); }; const finish = () => { clearTimeout(t); resolve(best); };
+    const t = setTimeout(finish, timeout);
+    for (const url of relays) {
+      let ws; try { ws = new WebSocket(url); } catch { done(); continue; }
+      ws.onopen = () => ws.send(JSON.stringify(['REQ', 'tip', { kinds: [TIP_KIND], '#d': [chainId], limit: 5 }]));
+      ws.onmessage = (m) => { let msg; try { msg = JSON.parse(typeof m.data === 'string' ? m.data : String(m.data)); } catch { return; }
+        if (msg[0] === 'EVENT' && msg[2]?.kind === TIP_KIND) { const ev = msg[2]; let ok = false; try { ok = !!verify(ev); } catch {} const p = ok && (!signer || ev.pubkey === signer) ? parseTip(ev) : null; if (p && p.chainId === chainId && (!best || p.tip > best.tip || (p.tip === best.tip && p.created_at > best.created_at))) best = { ...p, event: ev }; }
+        if (msg[0] === 'EOSE' || msg[0] === 'CLOSED') { try { ws.close(); } catch {} done(); } };
+      ws.onerror = () => {}; ws.onclose = () => done();
+    }
+  });
+}
+
+// Resolve a chain id to a mirror the chain's own signer vouches for: the announcement's author
+// must be the signer named in the mirror's chain.json. Returns { mirror, tip, chain }. A chain id
+// is a name, not a proof: with only the id, the newest announcement wins, so a client shows the
+// signer it ended up with; one that already knows the signer passes it and takes no other's.
+export async function findChain({ relays, chainId, verify, signer, fetchJson }) {
+  const t = await fetchLatestTip({ relays, chainId, verify, signer }); if (!t) throw new Error(`no announcement for ${chainId} on ${relays.length} relay(s)`);
+  return chooseMirror({ tip: t, chainId, fetchJson });
+}
+export async function chooseMirror({ tip: t, chainId, fetchJson = async (u) => (await fetch(u, { cache: 'no-store' })).json() }) {
+  const tried = [];
+  for (const m of t.mirrors) { try { const chain = await fetchJson(`${m}/chain.json`); if (chain.id === chainId && chain.signer === t.pubkey) return { mirror: m, tip: t, chain }; tried.push(`${m}: signer ${String(chain.signer).slice(0, 8)}… is not the announcer ${t.pubkey.slice(0, 8)}…`); } catch (e) { tried.push(`${m}: ${e.message}`); } }
+  throw new Error(`${chainId}: announced at tip ${t.tip} by ${t.pubkey.slice(0, 8)}… but no mirror it names checks out (${tried.join('; ') || 'no mirrors named'})`);
+}
+
+// how a mirror stands against the announcement, given the mirror's tip height and that header's
+// hex: matching, behind (the mirror has not caught up), or contradicting it (a different block,
+// or blocks the signer never announced)
+export function judgeMirror({ announced, height, headerHex }) {
+  if (!announced) return { ok: null, note: 'no announcement to compare with' };
+  if (height > announced.tip) return { ok: false, note: `the mirror is ahead of the signer's announcement (${height} > ${announced.tip})` };
+  const i = height - (announced.tip - announced.headersHex.length + 1);
+  if (i >= 0 && headerHex && headerHex !== announced.headersHex[i]) return { ok: false, note: `the mirror's block ${height} is not the one the signer announced` };
+  return { ok: true, note: height < announced.tip ? `the mirror is ${announced.tip - height} block(s) behind the announcement` : `the mirror matches the signer's announcement of ${height}` };
+}
diff --git a/vendor/sidestr/spec/siding/lib/block.mjs b/vendor/sidestr/spec/siding/lib/block.mjs
new file mode 100644
index 0000000..97dcca8
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/block.mjs
@@ -0,0 +1,122 @@
+// Blocks on a sidestr chain (SPEC 4): building, the block data that is signed, the virtual
+// transactions the challenge is evaluated against, the solution's place in the coinbase.
+const SIGNET_HEADER = 'ecc7daa2';
+const NULL32 = '00'.repeat(32);
+
+const compactSize = (n) => n < 0xfd ? [n] : n <= 0xffff ? [0xfd, n & 0xff, n >> 8] : [0xfe, n & 0xff, (n >> 8) & 0xff, (n >> 16) & 0xff, (n >>> 24) & 0xff];
+const readCompact = (b, i) => b[i] < 0xfd ? [b[i], i + 1] : b[i] === 0xfd ? [b[i + 1] | (b[i + 2] << 8), i + 3] : [b[i + 1] | (b[i + 2] << 8) | (b[i + 3] << 16) | (b[i + 4] * 2 ** 24), i + 5];
+const hex = (bytes) => Array.from(bytes, (x) => x.toString(16).padStart(2, '0')).join('');
+const unhex = (h) => Uint8Array.from(h.match(/../g) ?? [], (x) => parseInt(x, 16));
+
+// serialized script witness: count, then each item length-prefixed
+export function encodeWitness(items) { const out = [...compactSize(items.length)]; for (const it of items) { const b = unhex(it); out.push(...compactSize(b.length), ...b); } return hex(Uint8Array.from(out)); }
+export function decodeWitness(h) { const b = unhex(h); let [n, i] = readCompact(b, 0); const items = []; while (n-- > 0) { let len; [len, i] = readCompact(b, i); items.push(hex(b.slice(i, i + len))); i += len; } return items; }
+
+// the coinbase output carrying the witness commitment, and the solution push after it
+export function commitmentOutput(block) {
+  const cb = block.transactions[0]; if (!cb) return null;
+  for (let i = cb.outputs.length - 1; i >= 0; i--) { const spk = cb.outputs[i].scriptPubKey; if (spk.startsWith('6a24aa21a9ed') && spk.length >= 76) return { index: i, spk }; }
+  return null;
+}
+export function solutionOf(block) {
+  const c = commitmentOutput(block); if (!c) return null;
+  const rest = unhex(c.spk.slice(76)); if (!rest.length) return null;
+  // one push: direct (<= 75 bytes), OP_PUSHDATA1 (<= 255) or OP_PUSHDATA2 (<= 65535) as the size needs (SPEC 4)
+  let n, at; if (rest[0] > 0 && rest[0] <= 75) { n = rest[0]; at = 1; } else if (rest[0] === 0x4c && rest.length >= 2) { n = rest[1]; at = 2; } else if (rest[0] === 0x4d && rest.length >= 3) { n = rest[1] | (rest[2] << 8); at = 3; } else return null;
+  if (n === 0 || rest.length !== at + n) return null;
+  const push = hex(rest.slice(at, at + n)); if (!push.startsWith(SIGNET_HEADER)) return null;
+  return { witness: decodeWitness(push.slice(8)), stripped: c.spk.slice(0, 76), index: c.index };
+}
+export function withSolution(block, witnessItems) {
+  const c = commitmentOutput(block); if (!c) throw new Error('no witness commitment output to carry the solution');
+  const push = SIGNET_HEADER + encodeWitness(witnessItems); const len = push.length / 2; if (len > 65535) throw new Error('solution too long for one push');
+  const op = len <= 75 ? len.toString(16).padStart(2, '0') : len <= 255 ? '4c' + len.toString(16).padStart(2, '0') : '4d' + (len & 255).toString(16).padStart(2, '0') + (len >> 8).toString(16).padStart(2, '0');
+  const cb = structuredClone(block.transactions[0]); cb.outputs[c.index].scriptPubKey = c.spk.slice(0, 76) + op + push;
+  return { ...block, transactions: [cb, ...block.transactions.slice(1)] };
+}
+
+// SPEC 4: the block data is sha256 of the first 72 header bytes (version, prev, merkle root,
+// time on wire) with the merkle root recomputed over the coinbase stripped of its solution
+export function blockData({ codec, hash }, block) {
+  const c = commitmentOutput(block);
+  const cb = structuredClone(block.transactions[0]); if (c) cb.outputs[c.index].scriptPubKey = c.spk.slice(0, 76);
+  const root = codec.merkleRoot([codec.txid(cb), ...block.transactions.slice(1).map((t) => codec.txid(t))]);
+  const bytes = codec.encode('BlockHeader', { ...block.header, merkleRoot: root }).slice(0, 72);
+  return hash.bytesToHex(hash.sha256(bytes));
+}
+
+// BIP 325's shape: a virtual output paying the challenge, spent by a virtual transaction whose
+// input carries the solution; the block data sits in to_spend's scriptSig
+export function virtualTxs({ codec }, data, challenge, witness = []) {
+  const toSpend = { version: 0, inputs: [{ prevout: { txid: NULL32, vout: 0xffffffff }, scriptSig: '0020' + data, sequence: 0 }], outputs: [{ value: 0, scriptPubKey: challenge }], lockTime: 0 };
+  const prevout = { value: 0, scriptPubKey: challenge };
+  const toSign = { version: 0, inputs: [{ prevout: { txid: codec.txid(toSpend), vout: 0 }, scriptSig: '', sequence: 0 }], outputs: [{ value: 0, scriptPubKey: '6a' }], lockTime: 0, witness: [witness] };
+  return { toSpend, toSign, prevout };
+}
+
+// height push for the coinbase (BIP 34), then a marker
+const heightPush = (h) => { const out = []; let n = h; while (n > 0) { out.push(n & 0xff); n >>>= 8; } if (out.length && out[out.length - 1] & 0x80) out.push(0); if (!out.length) return '00'; return hex(Uint8Array.from([out.length, ...out])); };
+// the height a coinbase scriptSig pushes first (BIP 34): the inverse of heightPush. A scriptSig
+// that does not start with a height push is refused, never read as height 0: beside a stock
+// parent the coinbase is the only place the height is written.
+export function coinbaseHeight(coinbase) {
+  const sig = coinbase?.inputs?.[0]?.scriptSig ?? ''; if (!sig.length || sig.length % 2 || !/^[0-9a-f]*$/i.test(sig)) throw new Error('coinbase scriptSig is not a hex script');
+  const b = unhex(sig); const n = b[0];
+  if (n === 0) return 0; if (n >= 0x51 && n <= 0x60) return n - 0x50; // OP_0, OP_1..OP_16
+  if (n > 75 || n < 1 || b.length < 1 + n) throw new Error('coinbase scriptSig does not start with a height push');
+  if (n > 1 && b[n] === 0 && !(b[n - 1] & 0x80)) throw new Error('coinbase height push is not minimal'); // a padding byte only after a high bit
+  if (b[n] & 0x80) throw new Error('coinbase height push is negative'); // BIP34: a ScriptNum; the top bit of the last byte is the sign
+  let h = 0; for (let i = n; i >= 1; i--) h = h * 256 + b[i]; return h;
+}
+// a block's height: the v2 header carries it; the stock header does not, so the coinbase says
+export function blockHeight(block) { return block.header.height ?? coinbaseHeight(block.transactions[0]); }
+
+// an unsigned block on `prev` with these transactions; outputs: the coinbase's, then the witness
+// commitment (the solution is appended by signBlock). The header's shape follows the parent's
+// family (SPEC 3.2, parents.mjs): the 164-byte v2 header with its BLAKE2b fields beside a BLAKE2b
+// parent, the stock 80-byte header, version with bit 31 clear, beside stock Bitcoin.
+export function buildBlock({ k, hash, parent = null }, { height, prev, time, transactions, outputs, bits, marker = 'sidestr' }) {
+  const wtxids = [NULL32, ...transactions.map((t) => k.codec.wtxid(t))];
+  const root = hash.hexToBytes(k.codec.merkleRoot(wtxids)).reverse(); const cat = new Uint8Array(64); cat.set(root);
+  const commitment = hash.bytesToHex(hash.dsha256(cat));
+  const tag = hash.bytesToHex(new TextEncoder().encode(marker));
+  const coinbase = { version: 2, inputs: [{ prevout: { txid: NULL32, vout: 0xffffffff }, scriptSig: heightPush(height) + (tag.length / 2).toString(16).padStart(2, '0') + tag, sequence: 0xffffffff }],
+    outputs: [...outputs, { value: 0, scriptPubKey: '6a24aa21a9ed' + commitment }], witness: [[NULL32]], lockTime: 0 };
+  const txs = [coinbase, ...transactions];
+  const merkleRoot = k.codec.merkleRoot(txs.map((t) => k.codec.txid(t)));
+  const family = parent?.family ?? (k.params?.powHash === 'knots:blake2b-v2' ? 'blake2b' : 'stock');
+  const header = family === 'blake2b'
+    ? { version: 0xa0000000, prevBlockHash: prev, merkleRoot, timeOnWire: time, bits, nonce: 0, nonce2: 0, nonce3: 0,
+        extranonce: '00'.repeat(16), timeOffset: 0, txCount: txs.length, flags: 0, xorKeyMaskClearBits: 0, xorKey: '00'.repeat(16), height, mmRhs: NULL32 }
+    : { version: 0x20000000, prevBlockHash: prev, merkleRoot, time, bits, nonce: 0 };
+  return { header, transactions: txs };
+}
+
+// sign with the challenge key (key path, no tweak: the challenge is 5120‖pubkey), then satisfy
+// the proof of work
+// what a block signature signs: the taproot sighash of the virtual transaction, for the key path
+// (level 1) or for a leaf of the challenge (level 2: `leafHash` of the multi_a leaf)
+export function blockSigHash({ k, hash, interpreter }, block, challenge, leafHash = null) {
+  const data = blockData({ codec: k.codec, hash }, block);
+  const { toSign, prevout } = virtualTxs({ codec: k.codec }, data, challenge);
+  let msg = interpreter.sighashTaproot(toSign, 0, [prevout], 0x00, leafHash ? { leafHash } : {}); if (typeof msg === 'string') msg = hash.hexToBytes(msg);
+  return msg;
+}
+// a block with its witness in place: the solution appended, the merkle root recomputed, the header
+// nonce found for powLimit
+export function sealBlock({ k }, block, witnessItems) {
+  let signed = withSolution(block, witnessItems);
+  signed.header = { ...signed.header, merkleRoot: k.codec.merkleRoot(signed.transactions.map((t) => k.codec.txid(t))) };
+  const target = k.codec.expandCompact(signed.header.bits);
+  for (let nonce = 0; nonce < 0xffffffff; nonce++) { signed.header.nonce = nonce; if (BigInt('0x' + k.codec.blockHash(signed.header)) <= target) break; }
+  return signed;
+}
+export function signBlock({ k, hash, interpreter, schnorrSign }, block, challenge, privHex) {
+  const msg = blockSigHash({ k, hash, interpreter }, block, challenge);
+  const sig = hash.bytesToHex(schnorrSign(msg, privHex));
+  let signed = withSolution(block, [sig]);
+  signed.header = { ...signed.header, merkleRoot: k.codec.merkleRoot(signed.transactions.map((t) => k.codec.txid(t))) };
+  const target = k.codec.expandCompact(signed.header.bits);
+  for (let nonce = 0; nonce < 0xffffffff; nonce++) { signed.header.nonce = nonce; if (BigInt('0x' + k.codec.blockHash(signed.header)) <= target) break; }
+  return signed;
+}
diff --git a/vendor/sidestr/spec/siding/lib/federation.mjs b/vendor/sidestr/spec/siding/lib/federation.mjs
new file mode 100644
index 0000000..7663d99
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/federation.mjs
@@ -0,0 +1,68 @@
+// Level 2 (proposals/level-2.md): a chain with n signers and a threshold k. The challenge is a
+// taproot output whose internal key is provably unspendable (the BIP 341 NUMS point tweaked by
+// the chain id) and whose single leaf is multi_a(k, pk_1 … pk_n). A block's solution is the
+// script-path witness: n signature slots in leaf order (empty for a signer who did not sign),
+// the leaf script, the control block. Pure: browsers and Node alike.
+import { blockSigHash, sealBlock } from './block.mjs';
+export const NUMS_X = '50929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0'; // BIP 341's H
+const hex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
+const unhex = (h) => Uint8Array.from(h.match(/../g) ?? [], (x) => parseInt(x, 16));
+const compact = (n) => n < 0xfd ? [n] : n <= 0xffff ? [0xfd, n & 255, n >> 8] : [0xfe, n & 255, (n >> 8) & 255, (n >> 16) & 255, n >>> 24];
+
+// the internal key: H + int(tagged("sidestr/nums", chain id))·G, so it is unspendable and per chain
+export function numsKey({ hash, secp }, chainId) {
+  const t = hash.taggedHash('sidestr/nums', new TextEncoder().encode(chainId));
+  const K = secp.ckdPubKey(unhex('02' + NUMS_X), t); if (!K) throw new Error('nums derivation failed');
+  return hex(K.slice(1));
+}
+// the leaf: <pk_1> CHECKSIG <pk_2> CHECKSIGADD … <pk_n> CHECKSIGADD <k> NUMEQUAL
+export function leafScript(signers, threshold) {
+  if (!Array.isArray(signers) || signers.length < 1 || signers.length > 16) throw new Error('1 to 16 signers'); if (!(threshold >= 1 && threshold <= signers.length)) throw new Error('threshold between 1 and the number of signers');
+  for (const s of signers) if (!/^[0-9a-f]{64}$/.test(s)) throw new Error(`signer ${s} is not an x-only key`);
+  return signers.map((pk, i) => '20' + pk + (i === 0 ? 'ac' : 'ba')).join('') + (0x50 + threshold).toString(16) + '9c';
+}
+export function leafHashOf({ hash }, script) { const s = unhex(script); return hash.taggedHash('TapLeaf', Uint8Array.of(0xc0), Uint8Array.from(compact(s.length)), s); }
+// everything a document with `signers` and `threshold` implies
+export function federation({ hash, secp }, chain) {
+  const signers = chain.signers.map((s) => String(s).toLowerCase()), threshold = Number(chain.threshold);
+  const script = leafScript(signers, threshold); const leaf = leafHashOf({ hash }, script); const internal = numsKey({ hash, secp }, chain.id);
+  const out = secp.tapOutputKey(unhex(internal), leaf); if (!out) throw new Error('tap tweak failed');
+  const outputKey = hex(out); const parity = secp.liftX ? (() => { const Q = secp.liftX(out); return 0; })() : 0;
+  // the control block's parity bit is that of the output key's Y; tapOutputKey gives only x, so both are tried by the validator-side checker here
+  const challenge = '5120' + outputKey;
+  const control = (p) => (0xc0 | p).toString(16).padStart(2, '0') + internal;
+  const parityBit = secp.checkTapTweak(unhex(internal), leaf, out, 0) ? 0 : 1;
+  return { signers, threshold, script, leafHash: hex(leaf), internalKey: internal, outputKey, challenge, controlBlock: control(parityBit) };
+}
+// one signer's partial signature over a block, as hex (64 bytes: SIGHASH_DEFAULT)
+export function partialSignature({ k, hash, interpreter, schnorrSign }, block, fed, privHex) {
+  const msg = blockSigHash({ k, hash, interpreter }, block, fed.challenge, unhex(fed.leafHash));
+  return hex(schnorrSign(msg, privHex));
+}
+export function verifyPartial({ k, hash, interpreter, secp }, block, fed, pubkey, sigHex) {
+  const msg = blockSigHash({ k, hash, interpreter }, block, fed.challenge, unhex(fed.leafHash));
+  try { return secp.verifySchnorr(msg, unhex(sigHex), unhex(pubkey)) === true; } catch { return false; }
+}
+// the witness from a map pubkey -> signature: slots in reverse leaf order (pk_1's on top), then the script, then the control block
+export function assembleWitness(fed, sigs) {
+  const have = fed.signers.filter((pk) => sigs.has(pk)); if (have.length < fed.threshold) throw new Error(`${have.length} of ${fed.threshold} signatures`);
+  const chosen = new Set(have.slice(0, fed.threshold)); // exactly k: extra signatures would make NUMEQUAL fail
+  const slots = fed.signers.map((pk) => chosen.has(pk) ? sigs.get(pk) : '').reverse();
+  return [...slots, fed.script, fed.controlBlock];
+}
+// a block sealed with k of n signatures
+export function sealFederated(engine, block, fed, sigs) { return sealBlock(engine, block, assembleWitness(fed, sigs)); }
+
+// --- the peg wallet (step 6): the same k-of-n on the parent ------------------------------
+// The parent's peg output is the chain's challenge, literally: tr(<internal>, multi_a(k, …)) in a
+// node's descriptor language derives the same address. Each signer imports it with its own key
+// private (WIF), the others' public, so it can sign a PSBT that spends the peg.
+const B58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+export function wif({ hash }, privHex, { testnet = true } = {}) {
+  const p = new Uint8Array(34); p[0] = testnet ? 0xef : 0x80; p.set(unhex(privHex), 1); p[33] = 1; const c = hash.sha256(hash.sha256(p)); const all = new Uint8Array(38); all.set(p); all.set(c.subarray(0, 4), 34);
+  let n = BigInt('0x' + hex(all)), s = ''; while (n > 0n) { s = B58[Number(n % 58n)] + s; n /= 58n; } return s;
+}
+export function pegDescriptor(fed, { wifFor = null } = {}) {
+  const keys = fed.signers.map((pk) => (wifFor && wifFor(pk)) || pk);
+  return `tr(${fed.internalKey},multi_a(${fed.threshold},${keys.join(',')}))`;
+}
diff --git a/vendor/sidestr/spec/siding/lib/overlay.mjs b/vendor/sidestr/spec/siding/lib/overlay.mjs
new file mode 100644
index 0000000..14b9f69
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/overlay.mjs
@@ -0,0 +1,122 @@
+// The sidestr overlay for one chain document (SPEC 3, 4): a network beside its parent with
+// signed blocks, no subsidy, trivial proof of work and its own address prefix. Data half: the
+// network node and the signature rule joining btc:BlockRules. Code half: the check behind it.
+import { blockData, solutionOf, virtualTxs } from './block.mjs';
+import { resolveParent } from './parents.mjs';
+import { federation } from './federation.mjs';
+
+// --- peg-in claims (SPEC 6) --------------------------------------------------------------
+// A claim is two consecutive coinbase outputs: the payout, then an OP_RETURN carrying
+// `claim:<parent txid>:<vout>`. The pairing is structural, so a level-1 validator, which has no
+// parent view, can still bind each claimed amount to one outpoint; a level-2 validator checks
+// the pair against the parent. Coinbase value may exceed fees by exactly the paid claims.
+const enc = new TextEncoder(), dec = new TextDecoder();
+const toHex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
+const fromHex = (h) => Uint8Array.from(h.match(/../g) ?? [], (x) => parseInt(x, 16));
+export const outpointOf = (txid, vout) => `${txid}:${vout}`;
+export function claimMarker(txid, vout) { const d = enc.encode(`claim:${txid}:${vout}`); return '6a' + d.length.toString(16).padStart(2, '0') + toHex(d); }
+export function opReturnData(spk) { const m = /^6a(?:4c)?([0-9a-f]{2})([0-9a-f]*)$/i.exec(spk); if (!m) return null; const b = fromHex(m[2]); return parseInt(m[1], 16) === b.length ? b : null; }
+export function parseClaims(coinbase) {
+  const claims = [], errors = [];
+  coinbase.outputs.forEach((o, i) => {
+    const d = opReturnData(o.scriptPubKey); if (!d) return; let t; try { t = dec.decode(d); } catch { return; }
+    const m = /^claim:([0-9a-f]{64}):(\d{1,5})$/.exec(t); if (!m) return;
+    const payout = coinbase.outputs[i - 1];
+    if (!payout || payout.scriptPubKey.startsWith('6a') || !(payout.value > 0)) { errors.push(`claim at output ${i} has no payout before it`); return; }
+    claims.push({ index: i, txid: m[1], vout: Number(m[2]), payout: { index: i - 1, value: payout.value, scriptPubKey: payout.scriptPubKey } });
+  });
+  return { claims, errors };
+}
+
+// --- peg-outs (SPEC 7) -----------------------------------------------------------------
+// A burn is an OP_RETURN output carrying `pegout:<parent output script hex>` with a value: the
+// value leaves the supply and the peg holders owe that script that value on the parent. The
+// producer records each burn as it validates the block, by height, like claims.
+export function pegoutMarker(script) { const d = enc.encode(`pegout:${script.toLowerCase()}`); return '6a' + d.length.toString(16).padStart(2, '0') + toHex(d); }
+export function parsePegout(spk) {
+  const d = opReturnData(spk); if (!d) return null; let t; try { t = dec.decode(d); } catch { return null; }
+  const m = /^pegout:((?:[0-9a-f]{2}){2,40})$/.exec(t); return m ? m[1] : null;
+}
+export function parsePegouts(tx, txid) { const out = []; tx.outputs.forEach((o, i) => { const script = parsePegout(o.scriptPubKey); if (script) out.push({ txid, vout: i, script, value: o.value }); }); return out; }
+
+export function sidestrGraph(chain) {
+  return {
+    '@id': 'sidestr:overlay', '@context': { sidestr: 'https://sidestr.com/ns#', knots: 'https://bitcoinknots.org/ns#' },
+    '@graph': [
+      {
+        '@id': chain.id, '@type': 'btc:NetworkParams', extends: 'btc:regtest', label: chain.name, name: chain.name,
+        comment: `sidestr chain beside ${chain.parent}: Bitcoin's rules with signed blocks (SPEC 4), no subsidy, every coin a peg.`,
+        magic: chain.magic ?? 'e5d5e5d5', bech32Hrp: chain.addressPrefix, initialSubsidy: 0, halvingInterval: 210000,
+        powLimit: chain.powLimit, powNoRetargeting: true, allowMinDifficultyBlocks: false,
+        // the header format follows the parent (SPEC 3): beside a BLAKE2b parent, v2 headers from height 0, no headline, no reduced-data period; beside stock Bitcoin, stock headers
+        ...(resolveParent(chain.parent).family === 'blake2b' ? { powHash: 'knots:blake2b-v2', structVariants: { 'btc:BlockHeader': [{ when: { field: 'version', bit: 31 }, struct: 'knots:BlockHeaderV2' }] },
+          blake2bHeight: 0, blake2bHeadline: '', unifiedSighashParam: 'blake2bHeight', rdtsExpiryTime: 0 } : {}),
+        sidestrParent: chain.parent, sidestrChallenge: chain.challenge, sidestrPegConfirmations: chain.pegConfirmations ?? 6, sidestrRefundBlocks: chain.refundBlocks ?? 10000,
+        sidestrPegoutBlocks: chain.pegoutBlocks ?? 144, sidestrPegoutMin: chain.pegoutMin ?? 10000,
+      },
+      { '@id': 'sidestr:rule-pegouts', '@type': 'ValidationRule', ruleSet: 'btc:BlockContextRules', label: 'pegouts', errorCode: 'bad-pegout',
+        comment: 'A pegout:<script> OP_RETURN names a parent output script of 2 to 40 bytes and carries at least pegoutMin sats; the coinbase carries none (SPEC 7). The value leaves the supply; the peg holders owe it on the parent.' },
+      { '@id': 'sidestr:rule-claims', '@type': 'ValidationRule', ruleSet: 'btc:BlockContextRules', label: 'claims', errorCode: 'bad-claim',
+        comment: 'Each claim:<txid>:<vout> OP_RETURN in the coinbase is immediately preceded by its payout output; no outpoint is claimed twice in the block or on the chain (SPEC 6). A level-1 validator accepts what the signers claim; a level-2 validator also checks each pair against the parent.' },
+      { '@id': 'sidestr:rule-block-signature', '@type': 'ValidationRule', ruleSet: 'btc:BlockRules', label: 'block-signature', errorCode: 'bad-block-signature',
+        comment: 'The coinbase witness commitment output carries, after the commitment, a push of ecc7daa2 followed by a serialized witness that satisfies the chain challenge for the block data (SPEC 4).' },
+    ],
+  };
+}
+
+// Level 2: a document with `signers` and `threshold` names its challenge only through them; a
+// challenge that is not the derived one is a broken document. Needs the curve for the tweak.
+export function checkFederation(chain, { hash, secp }) {
+  if (!chain.signers) return null;
+  const fed = federation({ hash, secp }, chain);
+  if (chain.challenge && chain.challenge.toLowerCase() !== fed.challenge) throw new Error(`${chain.id}: challenge ${chain.challenge.slice(0, 12)}… is not the one ${chain.signers.length} signers with threshold ${chain.threshold} derive (${fed.challenge.slice(0, 12)}…)`);
+  return fed;
+}
+export const sidestrOverlay = (chain, { hash, secp = null }) => ({
+  federation: secp ? checkFederation(chain, { hash, secp }) : null,
+  graph: sidestrGraph(chain),
+  // outpoints claimed so far, by the height that claimed them. Validation is idempotent for one
+  // height (a block re-validated, or a competing block at the same height, may claim the same
+  // outpoint); a different height may not. Level 1: no reorgs, so no unwinding is needed.
+  claims: new Map(),
+  // burns seen so far: `${txid}:${vout}` -> { txid, vout, script, value, height }
+  pegouts: new Map(),
+  installChecks({ blocks, interpreter, codec, params }) {
+    const claimed = this.claims, burned = this.pegouts;
+    blocks.registerChecks({ blockContext: {
+      'sidestr:rule-pegouts': ({ block, height }) => {
+        if (block.transactions[0].outputs.some((o) => parsePegout(o.scriptPubKey))) return false;
+        const found = [];
+        for (const tx of block.transactions.slice(1)) { const txid = codec.txid(tx); for (const o of tx.outputs) { const d = opReturnData(o.scriptPubKey); if (!d) continue; let t = ''; try { t = dec.decode(d); } catch {} if (!t.startsWith('pegout:')) continue;
+          const script = parsePegout(o.scriptPubKey); if (!script || o.value < params.sidestrPegoutMin) return false; found.push({ txid, vout: tx.outputs.indexOf(o), script, value: o.value, height }); } }
+        for (const b of found) { const k = outpointOf(b.txid, b.vout); const at = burned.get(k)?.height; if (at !== undefined && at !== height) return false; burned.set(k, b); }
+        return true;
+      },
+      'sidestr:rule-claims': ({ block, height }) => {
+        const { claims, errors } = parseClaims(block.transactions[0]); if (errors.length) return false;
+        const inBlock = new Set();
+        for (const c of claims) { const op = outpointOf(c.txid, c.vout); if (inBlock.has(op)) return false; inBlock.add(op); const at = claimed.get(op); if (at !== undefined && at !== height) return false; }
+        for (const op of inBlock) claimed.set(op, height);
+        return true;
+      },
+      // the kernel's rule, plus the paid claims: coinbase value <= subsidy (0) + fees + claims
+      'btc:rule-blockctx-coinbase-amount': ({ block, height, spending }) => {
+        if (spending.valueUnresolved > 0) return null;
+        const cb = block.transactions[0]; const { claims, errors } = parseClaims(cb); if (errors.length) return false;
+        const paid = claims.reduce((s, c) => s + c.payout.value, 0);
+        return cb.outputs.reduce((s, o) => s + o.value, 0) <= blocks.subsidy(height) + spending.fees + paid;
+      },
+    } });
+    blocks.registerChecks({ block: {
+      'sidestr:rule-block-signature': ({ block }) => {
+        if (!interpreter) return null;
+        const sol = solutionOf(block);
+        if (!sol) return false;
+        const data = blockData({ codec, hash }, block);
+        const { toSign, prevout } = virtualTxs({ codec }, data, params.sidestrChallenge, sol.witness);
+        const v = interpreter.verifyInput(toSign, 0, prevout, [prevout], null);
+        return v.ok === true;
+      },
+    } });
+  },
+});
diff --git a/vendor/sidestr/spec/siding/lib/overlays/assets.mjs b/vendor/sidestr/spec/siding/lib/overlays/assets.mjs
new file mode 100644
index 0000000..bc44c7d
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/overlays/assets.mjs
@@ -0,0 +1,76 @@
+// The `assets` rule (SPEC 12.2): issued assets ride on ordinary coins by tally records; for every
+// asset, a transaction's inputs carry at least what its tallies assign, and the difference is
+// destroyed. Issuance (`issue:` with `tally:self:`) is the one creation. Share assets of pools
+// are the pool rule's to account for, so they are exempt here when a pool rule is present.
+// State beside the UTXO set: what each unspent output carries, derived from the chain on open.
+import { classify } from '../records.mjs';
+export const RULE = 'sidestr:rule-assets';
+const key = (txid, vout) => `${txid}:${vout}`;
+
+// A view over the committed map with the block's own effects on top, so a transaction can spend
+// what an earlier one in the same block created. `commit()` folds it in under a height.
+export class CarryView {
+  constructor(base) { this.base = base; this.temp = new Map(); this.spent = new Map(); }
+  get(k) { if (this.spent.has(k)) return undefined; return this.temp.has(k) ? this.temp.get(k) : this.base.get(k); }
+  set(k, v) { this.temp.set(k, v); }
+  spend(k) { const v = this.get(k); if (v) this.spent.set(k, v); }
+  before(k) { return this.spent.get(k) ?? this.get(k); } // what an outpoint carried, even if this view has spent it
+}
+
+export function assetsOverlay(chain, { pools = null } = {}) {
+  const carried = new Map();   // outpoint -> Map(asset id -> amount), for unspent tallied outputs
+  const byHeight = new Map();  // height -> { added: [outpoints], removed: [[outpoint, carry]] }, so one height re-validated is idempotent
+  const issued = new Map();    // asset id -> { ticker, decimals, height }
+  const isShare = (asset, tx, txid, cls) => !!pools && (pools.has(asset) || (asset === txid && cls.pools.some((p) => p.pool === 'self')));
+  // check one transaction against a view; returns { ok, error, out: Map(vout -> Map(asset -> amount)) } and, when ok, writes its outputs into the view
+  function check(tx, txid, view, { coinbase = false } = {}) {
+    const cls = classify(tx); const bad = (error) => ({ ok: false, error });
+    if (coinbase) return cls.issues.length || cls.tallies.length || cls.bad.length ? bad('the coinbase carries no records') : { ok: true, out: new Map() };
+    if (cls.bad.length) return bad(`malformed record: ${cls.bad[0].slice(0, 40)}`);
+    if (cls.issues.length > 1) return bad('at most one issue: per transaction');
+    const opensPool = cls.pools.some((p) => p.pool === 'self'); if (cls.issues.length && opensPool) return bad('a transaction that opens a pool does not issue');
+    // what the inputs carry, per asset
+    const inCarry = new Map();
+    for (const inp of tx.inputs) { const c = view.get(key(inp.prevout.txid, inp.prevout.vout)); if (!c) continue; for (const [a, n] of c) inCarry.set(a, (inCarry.get(a) ?? 0) + n); }
+    // what the tallies assign, per asset and per output
+    const out = new Map(), assigned = new Map(), seenAsset = new Set();
+    for (const t of cls.tallies) {
+      const asset = t.asset === 'self' ? txid : t.asset;
+      if (t.asset === 'self' && !cls.issues.length && !opensPool) return bad('tally:self without issue: or pool:self:');
+      if (seenAsset.has(asset)) return bad(`asset ${asset.slice(0, 8)}… tallied twice`); seenAsset.add(asset);
+      for (const { vout, amount } of t.assigns) {
+        const o = tx.outputs[vout]; if (!o) return bad(`tally names output ${vout}, which does not exist`); if (o.scriptPubKey.startsWith('6a')) return bad(`tally names output ${vout}, an OP_RETURN`); if (!(o.value >= 1)) return bad(`tally names output ${vout}, which has no value`);
+        if (!out.has(vout)) out.set(vout, new Map()); out.get(vout).set(asset, amount); assigned.set(asset, (assigned.get(asset) ?? 0) + amount);
+      }
+    }
+    for (const [asset, n] of assigned) {
+      if (asset === txid && cls.issues.length) continue;                 // issuance: created from nothing
+      if (isShare(asset, tx, txid, cls)) continue;                       // shares: the pool rule accounts
+      if (n > (inCarry.get(asset) ?? 0)) return bad(`assigns ${n} of ${asset.slice(0, 8)}… but carries ${inCarry.get(asset) ?? 0}`);
+    }
+    for (const inp of tx.inputs) view.spend(key(inp.prevout.txid, inp.prevout.vout)); // spent: carries nothing now
+    for (const [vout, m] of out) view.set(key(txid, vout), m);
+    return { ok: true, out, issue: cls.issues[0] ? { id: txid, ...cls.issues[0] } : null, inCarry };
+  }
+  const self = {
+    lastHeight: -1, lastView: null, // the view of the block just validated, so a later rule can read what its inputs carried
+    graph: { '@id': 'sidestr:overlay-assets', '@context': { sidestr: 'https://sidestr.com/ns#' }, '@graph': [
+      { '@id': RULE, '@type': 'ValidationRule', ruleSet: 'btc:BlockContextRules', label: 'assets', errorCode: 'bad-tally',
+        comment: 'For every asset, what a transaction\'s inputs carry is at least what its tallies assign; issue: creates; the coinbase carries no records (SPEC 12.2).' } ] },
+    carried, issued, check, CarryView,
+    // the carried amounts of an unspent output, or null
+    of(txid, vout) { return carried.get(key(txid, vout)) ?? null; },
+    installChecks({ blocks, codec }) {
+      blocks.registerChecks({ blockContext: { [RULE]: ({ block, height }) => {
+        const prev = byHeight.get(height); if (prev) { for (const k of prev.added) carried.delete(k); for (const [k, v] of prev.removed) carried.set(k, v); } // idempotent per height
+        const view = new CarryView(carried); const added = [], removed = [];
+        for (let i = 0; i < block.transactions.length; i++) { const tx = block.transactions[i]; const r = check(tx, codec.txid(tx), view, { coinbase: i === 0 }); if (!r.ok) return false; }
+        for (const [k, v] of view.temp) { carried.set(k, v); added.push(k); }
+        for (const [k, v] of view.spent) { if (carried.has(k)) { if (!view.temp.has(k)) removed.push([k, v]); carried.delete(k); } }
+        for (let i = 1; i < block.transactions.length; i++) { const tx = block.transactions[i]; const { issues } = classify(tx); if (issues[0]) issued.set(codec.txid(tx), { ...issues[0], height }); }
+        byHeight.set(height, { added, removed }); self.lastHeight = height; self.lastView = view; return true;
+      } } });
+    },
+  };
+  return self;
+}
diff --git a/vendor/sidestr/spec/siding/lib/overlays/evm.mjs b/vendor/sidestr/spec/siding/lib/overlays/evm.mjs
new file mode 100644
index 0000000..46db079
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/overlays/evm.mjs
@@ -0,0 +1,9 @@
+// Podkey stub for siding/lib/overlays/evm.mjs. The EVM rule imports ethereumjs
+// from jsdelivr when it starts, and a Manifest V3 extension may not run code
+// from the network, so a chain that names the rule is refused as unsupported
+// until the rule is vendored too. See scripts/vendor-sidestr.js.
+export function evmOverlay (chain) {
+  const e = new Error(`${chain?.id ?? 'this chain'} names the evm rule, which Podkey cannot run yet`);
+  e.code = 'unsupported';
+  throw e;
+}
diff --git a/vendor/sidestr/spec/siding/lib/overlays/index.mjs b/vendor/sidestr/spec/siding/lib/overlays/index.mjs
new file mode 100644
index 0000000..c88406d
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/overlays/index.mjs
@@ -0,0 +1,16 @@
+// The rules a chain document names (SPEC 12): `"rules": ["assets", "pool"]`. A validator without
+// one of them refuses the chain. Both Node and browsers import this.
+import { assetsOverlay } from './assets.mjs';
+import { poolOverlay } from './pool.mjs';
+import { evmOverlay } from './evm.mjs';
+import { parseClaims } from '../overlay.mjs';
+export const KNOWN = ['assets', 'pool', 'evm'];
+export function rulesFor(chain) {
+  const names = chain.rules ?? []; for (const n of names) if (!KNOWN.includes(n)) throw new Error(`chain ${chain.id} names rule "${n}", which this validator does not have`);
+  if (names.includes('pool') && !names.includes('assets')) throw new Error('the pool rule needs the assets rule');
+  const out = { overlays: [], assets: null, pool: null, evm: null }; if (!names.length) return out;
+  if (names.includes('evm')) out.evm = evmOverlay(chain, { claimsOf: (cb) => parseClaims(cb).claims.reduce((s, c) => s + c.payout.value, 0) });
+  const pools = new Map(); out.assets = assetsOverlay(chain, { pools: names.includes('pool') ? pools : null });
+  if (names.includes('pool')) out.pool = poolOverlay(chain, { assets: out.assets, pools });
+  out.overlays = [out.assets, out.pool, out.evm].filter(Boolean); return out;
+}
diff --git a/vendor/sidestr/spec/siding/lib/overlays/pool.mjs b/vendor/sidestr/spec/siding/lib/overlays/pool.mjs
new file mode 100644
index 0000000..e48c4b5
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/overlays/pool.mjs
@@ -0,0 +1,64 @@
+// The `pool` rule (SPEC 12.3): a pool is one OP_TRUE coin holding x sats and y of one asset; a
+// transaction spends at most one pool coin and leaves exactly one, as a swap (constant product,
+// 3 per 1000 on what comes in), an add or a remove (shares pro rata, rounded to the pool's favour).
+// Shares are the asset whose id is the pool id. State: pools, derived from the chain on open.
+import { classify, isqrt } from '../records.mjs';
+export const RULE = 'sidestr:rule-pool', POOL_SCRIPT = '51';
+const key = (txid, vout) => `${txid}:${vout}`;
+const B = (n) => BigInt(n);
+
+export function poolOverlay(chain, { assets, pools = new Map() }) {
+  // pools: pool id -> { asset, x, y, shares, outpoint, opened }; shared with the assets rule, which exempts share assets
+  const byOutpoint = new Map(); // pool coin outpoint -> pool id
+  const journal = new Map();   // height -> [{ id, before }] to undo a re-validated height
+  // check one transaction; `view` is the assets CarryView already holding this tx's outputs (the assets check ran first)
+  function check(tx, txid, view, { coinbase = false, apply = () => {} } = {}) {
+    const cls = classify(tx); const bad = (error) => ({ ok: false, error });
+    if (coinbase) return cls.pools.length ? bad('the coinbase carries no records') : { ok: true };
+    const spent = tx.inputs.map((i) => byOutpoint.get(key(i.prevout.txid, i.prevout.vout))).filter(Boolean);
+    if (spent.length > 1) return bad('a transaction spends at most one pool coin');
+    const opening = cls.pools.filter((p) => p.pool === 'self'), continuing = cls.pools.filter((p) => p.pool !== 'self');
+    if (cls.pools.length > 1) return bad('a transaction carries at most one pool: record');
+    if (!spent.length && !cls.pools.length) return { ok: true };
+    const carriedOn = (vout) => view.get(key(txid, vout)) ?? new Map();
+    const sharesIn = (id) => { let s = 0; for (const i of tx.inputs) { const c = view.before(key(i.prevout.txid, i.prevout.vout)); if (c?.has(id)) s += c.get(id); } return s; };
+    const sharesOut = (id) => { let s = 0; for (const [, m] of viewOutputs(view, txid, tx)) if (m.has(id)) s += m.get(id); return s; };
+    if (opening.length) {
+      if (spent.length) return bad('a transaction opens a pool or spends one, not both');
+      const { vout } = opening[0]; const o = tx.outputs[vout]; if (!o || o.scriptPubKey !== POOL_SCRIPT || !(o.value >= 1)) return bad('the pool coin is an OP_TRUE output with value');
+      const m = carriedOn(vout); if (m.size !== 1) return bad('a pool coin carries exactly one asset'); const [asset, y0] = [...m][0]; if (asset === txid) return bad('a pool does not hold its own shares');
+      const shares = isqrt(B(o.value) * B(y0)); if (B(sharesOut(txid)) !== shares) return bad(`opening tallies exactly ${shares} shares (tally:self)`);
+      return { ok: true, effect: { id: txid, asset, x: o.value, y: y0, shares: Number(shares), outpoint: key(txid, vout), opened: true } };
+    }
+    // continuing: the spent pool is recreated
+    if (!spent.length) return bad('pool: names a pool this transaction does not spend');
+    const id = spent[0], p = pools.get(id); if (!continuing.length || continuing[0].pool !== id) return bad('a spent pool coin is recreated with pool:<its id>:<vout>');
+    const { vout } = continuing[0]; const o = tx.outputs[vout]; if (!o || o.scriptPubKey !== POOL_SCRIPT || !(o.value >= 1)) return bad('the pool coin is an OP_TRUE output with value');
+    const m = carriedOn(vout); if (m.size !== 1 || !m.has(p.asset)) return bad('the pool coin carries exactly its asset'); const x = B(p.x), y = B(p.y), x2 = B(o.value), y2 = B(m.get(p.asset));
+    if (y2 < 1n) return bad('a pool is never emptied');
+    const S = B(p.shares), S2 = S - B(sharesIn(id)) + B(sharesOut(id)); if (S2 < 0n) return bad('more shares destroyed than exist');
+    let kind;
+    if (S2 === S) { const dx = x2 > x ? x2 - x : 0n, dy = y2 > y ? y2 - y : 0n; if ((1000n * x2 - 3n * dx) * (1000n * y2 - 3n * dy) < 1000000n * x * y) return bad('swap: the constant product does not hold after the fee'); kind = 'swap'; }
+    else if (S2 > S) { if (x2 < x || y2 < y) return bad('add: the pool does not shrink'); const lim = (a, b) => (a - b) * S / b; const cap = [lim(x2, x), lim(y2, y)].reduce((a, b) => a < b ? a : b); if (S2 - S > cap) return bad(`add: at most ${cap} shares for what was added`); kind = 'add'; }
+    else { if (x2 > x || y2 > y) return bad('remove: the pool does not grow'); const d = S - S2; if (x - x2 > x * d / S || y - y2 > y * d / S) return bad('remove: more than the shares\' pro-rata part'); kind = 'remove'; }
+    return { ok: true, kind, effect: { id, asset: p.asset, x: Number(x2), y: Number(y2), shares: Number(S2), outpoint: key(txid, vout), opened: p.opened } };
+  }
+  // this transaction's outputs as the view holds them (assets check wrote them)
+  function viewOutputs(view, txid, tx) { const out = []; tx.outputs.forEach((_, vout) => { const m = view.get(key(txid, vout)); if (m) out.push([vout, m]); }); return out; }
+  function apply(effect, height, log) { const before = pools.get(effect.id) ?? null; log?.push({ id: effect.id, before }); if (before) byOutpoint.delete(before.outpoint); pools.set(effect.id, { ...effect }); byOutpoint.set(effect.outpoint, effect.id); }
+  return {
+    graph: { '@id': 'sidestr:overlay-pool', '@context': { sidestr: 'https://sidestr.com/ns#' }, '@graph': [
+      { '@id': RULE, '@type': 'ValidationRule', ruleSet: 'btc:BlockContextRules', label: 'pool', errorCode: 'bad-pool',
+        comment: 'A transaction spends at most one pool coin and recreates it: a swap keeps the constant product after a fee of 3 per 1000, an add mints shares pro rata, a remove withdraws pro rata and never empties the pool (SPEC 12.3).' } ] },
+    pools, byOutpoint, journal, check, apply, // journal: height -> [{ id, before }] for every applied height, so a page can replay a pool's history (trades, adds, removes)
+    installChecks({ blocks, codec }) {
+      blocks.registerChecks({ blockContext: { [RULE]: ({ block, height }) => {
+        for (const { id, before } of (journal.get(height) ?? []).reverse()) { const cur = pools.get(id); if (cur) byOutpoint.delete(cur.outpoint); if (before) { pools.set(id, before); byOutpoint.set(before.outpoint, id); } else pools.delete(id); }
+        // the assets rule ran first for this block: its view holds this block's outputs and what the spent inputs carried
+        const view = assets.lastHeight === height && assets.lastView ? assets.lastView : new assets.CarryView(assets.carried); const log = []; journal.set(height, log);
+        for (let i = 0; i < block.transactions.length; i++) { const tx = block.transactions[i]; const r = check(tx, codec.txid(tx), view, { coinbase: i === 0 }); if (!r.ok) return false; if (r.effect) apply(r.effect, height, log); }
+        return true;
+      } } });
+    },
+  };
+}
diff --git a/vendor/sidestr/spec/siding/lib/parents.mjs b/vendor/sidestr/spec/siding/lib/parents.mjs
new file mode 100644
index 0000000..8509de2
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/parents.mjs
@@ -0,0 +1,29 @@
+// The parents a chain can sit beside (SPEC 3.2): a short alias per chain, the long kernel id it
+// resolves to, and the header family the chain inherits. Browsers and Node alike; no imports.
+// Old spellings (the kernel's long ids) stay accepted, so no running chain's document changes.
+// `mainnet` picks the key and address encodings a node expects (WIF 0x80 vs 0xef).
+export const PARENTS = {
+  btc:   { network: 'btc:mainnet',          label: 'Bitcoin mainnet',          family: 'stock',   pow: 'sha256d', mainnet: true,
+           genesis: '000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f' },
+  tbtc4: { network: 'btc:testnet4',         label: 'Bitcoin testnet4',         family: 'stock',   pow: 'sha256d', mainnet: false,
+           genesis: '00000000da84f2bafbbc53dee25a72ae507ff4914b867c565be350b0da8bf043' },
+  xbt:   { network: 'btc:mainnet-blake2b',  label: 'BLAKE2b mainnet (Knots)',  family: 'blake2b', pow: 'blake2b', mainnet: true,
+           genesis: '000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f',
+           fork: { height: 961640, hash: '0000000000000050c1e5f69672f459293be14f46e5a494e7a8c8541396f18eeb' } },
+  txbt4: { network: 'btc:testnet4-blake2b', label: 'BLAKE2b testnet4 (Knots)', family: 'blake2b', pow: 'blake2b', mainnet: false,
+           genesis: '00000000da84f2bafbbc53dee25a72ae507ff4914b867c565be350b0da8bf043',
+           fork: { height: 150308, hash: '000000000000b9d1b7e1bb0e77215ee92c6ef7ec8f4473e23908380649e779b6' } },
+  ltc:   { network: null, label: 'Litecoin mainnet', family: 'stock', pow: 'scrypt',   mainnet: true, reserved: true },
+  vtc:   { network: null, label: 'Vertcoin mainnet', family: 'stock', pow: 'verthash', mainnet: true, reserved: true },
+};
+const LONG = Object.fromEntries(Object.entries(PARENTS).filter(([, p]) => p.network).map(([a, p]) => [p.network, a]));
+
+// alias or long id → the alias; null when neither
+export function parentAlias(id) { if (typeof id !== 'string') return null; if (Object.hasOwn(PARENTS, id)) return id; return Object.hasOwn(LONG, id) ? LONG[id] : null; }
+// alias or long id → { alias, ...entry }; throws for a reserved or unknown parent
+export function resolveParent(id) {
+  const alias = parentAlias(id); if (!alias) throw new Error(`unknown parent "${id}": one of ${Object.keys(PARENTS).join(', ')} (SPEC 3.2)`);
+  const p = PARENTS[alias]; if (p.reserved) throw new Error(`parent "${alias}" (${p.label}) is reserved: no validator carries its rules yet (SPEC 3.2)`);
+  return { alias, ...p };
+}
+export const isBlake2b = (id) => resolveParent(id).family === 'blake2b';
diff --git a/vendor/sidestr/spec/siding/lib/records.mjs b/vendor/sidestr/spec/siding/lib/records.mjs
new file mode 100644
index 0000000..5155307
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/records.mjs
@@ -0,0 +1,33 @@
+// Records (SPEC 12.1): OP_RETURN outputs whose data is UTF-8 text of at most 255 bytes, a single
+// push. `issue:`, `tally:` and `pool:` are parsed here; the rules decide what they mean.
+const dec = new TextDecoder('utf-8', { fatal: true }), enc = new TextEncoder();
+const toHex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
+export const MAX_AMOUNT = 2 ** 53 - 1;
+// the text of an OP_RETURN output, or null when it is not a single push of <= 255 bytes of UTF-8
+export function recordText(spk) {
+  const m = /^6a(?:4c([0-9a-f]{2})|([0-9a-f]{2}))([0-9a-f]*)$/i.exec(spk); if (!m) return null;
+  const len = parseInt(m[1] ?? m[2], 16); if (m[2] && len > 75) return null; if (m[1] && len <= 75) return null; // minimal push only if (m[3].length !== len * 2 || len > 255) return null;
+  try { return dec.decode(Uint8Array.from(m[3].match(/../g) ?? [], (x) => parseInt(x, 16))); } catch { return null; }
+}
+export function recordScript(text) { const b = enc.encode(text); if (b.length > 255) throw new Error('a record is at most 255 bytes'); return '6a' + (b.length <= 75 ? b.length.toString(16).padStart(2, '0') : '4c' + b.length.toString(16).padStart(2, '0')) + toHex(b); }
+export const recordsOf = (tx) => tx.outputs.map((o, vout) => ({ vout, text: recordText(o.scriptPubKey) })).filter((r) => r.text !== null);
+const amount = (s) => { if (!/^[1-9]\d{0,15}$/.test(s)) return null; const n = Number(s); return n <= MAX_AMOUNT ? n : null; };
+export function parseIssue(text) { const m = /^issue:([A-Z0-9]{1,8}):([0-8])$/.exec(text); return m ? { ticker: m[1], decimals: Number(m[2]) } : null; }
+// { asset: <64 hex> | 'self', assigns: [{ vout, amount }] }, or null when malformed (a duplicate vout is malformed)
+export function parseTally(text) {
+  const m = /^tally:([0-9a-f]{64}|self):(.+)$/.exec(text); if (!m) return null; const assigns = [], seen = new Set();
+  for (const part of m[2].split(',')) { const p = /^(\d{1,5})=(\d+)$/.exec(part); if (!p) return null; const vout = Number(p[1]), a = amount(p[2]); if (a === null || seen.has(vout)) return null; seen.add(vout); assigns.push({ vout, amount: a }); }
+  return { asset: m[1], assigns };
+}
+export function parsePool(text) { const m = /^pool:([0-9a-f]{64}|self):(\d{1,5})$/.exec(text); return m ? { pool: m[1], vout: Number(m[2]) } : null; }
+// every record of a transaction, classified; `bad` lists records that look like ours but do not parse
+export function classify(tx) {
+  const out = { issues: [], tallies: [], pools: [], bad: [] };
+  for (const { vout, text } of recordsOf(tx)) {
+    if (text.startsWith('issue:')) { const r = parseIssue(text); r ? out.issues.push({ vout, ...r }) : out.bad.push(text); }
+    else if (text.startsWith('tally:')) { const r = parseTally(text); r ? out.tallies.push({ vout, ...r }) : out.bad.push(text); }
+    else if (text.startsWith('pool:')) { const r = parsePool(text); r ? out.pools.push({ vout, ...r }) : out.bad.push(text); }
+  }
+  return out;
+}
+export const isqrt = (n) => { if (n < 0n) throw new Error('isqrt of a negative'); if (n < 2n) return n; let x = BigInt(Math.floor(Math.sqrt(Number(n)))); while (x * x > n) x--; while ((x + 1n) * (x + 1n) <= n) x++; return x; };
diff --git a/vendor/sidestr/spec/siding/lib/txsign.mjs b/vendor/sidestr/spec/siding/lib/txsign.mjs
new file mode 100644
index 0000000..b91ab54
--- /dev/null
+++ b/vendor/sidestr/spec/siding/lib/txsign.mjs
@@ -0,0 +1,20 @@
+// Key-path signing for a chain's transactions. The sighash follows the parent's family (SPEC 3):
+// beside a BLAKE2b parent the kernel's params carry `unifiedSighashParam` and the unified sighash
+// is the rule; beside stock Bitcoin it is BIP 341's. Browsers and Node alike; no imports.
+export const SIGHASH_UNIFIED = 0x20;
+export const usesUnifiedSighash = (k) => k?.params?.unifiedSighashParam != null;
+// the message an input's key-path signature commits to, and the hash type byte appended to it
+export function keyPathSighash({ k, hash }, tx, i, prevouts) {
+  const unified = usesUnifiedSighash(k); const ht = 0x01 | (unified ? SIGHASH_UNIFIED : 0);
+  let m = unified ? k.interpreter.sighashUnified(tx, i, prevouts, ht, 2) : k.interpreter.sighashTaproot(tx, i, prevouts, ht);
+  if (typeof m === 'string') m = hash.hexToBytes(m); return { m, ht };
+}
+// sign every input of `tx` (all key-path spends of `key`) in place; returns tx
+export function signKeyPath({ k, hash, signer }, tx, prevouts, key) {
+  tx.witness = tx.inputs.map((_, i) => { const { m, ht } = keyPathSighash({ k, hash }, tx, i, prevouts); return [hash.bytesToHex(signer.schnorrSign(m, key)) + ht.toString(16).padStart(2, '0')]; });
+  return tx;
+}
+// our own check before publishing: every witness is a valid signature by `pub` under the chain's sighash
+export function verifyKeyPath({ k, hash, secp }, tx, prevouts, pub) {
+  return tx.inputs.every((_, i) => { const { m, ht } = keyPathSighash({ k, hash }, tx, i, prevouts); const w = tx.witness?.[i]?.[0] ?? ''; return w.length === 130 && w.endsWith(ht.toString(16).padStart(2, '0')) && secp.verifySchnorr(m, hash.hexToBytes(w.slice(0, 128)), hash.hexToBytes(pub)); });
+}

From 256e130e39005e39622232558c0c3b095adf160b Mon Sep 17 00:00:00 2001
From: Claude Code <github@thedreamlab.uk>
Date: Thu, 24 Sep 2026 16:31:55 +0000
Subject: [PATCH 4/5] fix: requests wait three minutes, so a security-key
 unlock no longer times the site out; docs for sidestr spends

- sendMessageToExtension defaults to 180 s: a request that finds Podkey
  locked waits for the unlock, and a security key's PIN and touch took longer
  than the old 30 s (the site saw a timeout although the unlock succeeded)
- the approval window is tall enough for its trust note
- README: window.nostr.sidestr.signTransaction; architecture; CHANGELOG 0.0.9

Co-Authored-By: jjohare <github@thedreamlab.uk>
---
 CHANGELOG.md          | 29 ++++++++++++++++++++++++++++-
 README.md             | 34 ++++++++++++++++++++++++++++++++++
 src/background.js     |  2 +-
 src/nostr-provider.js |  6 +++++-
 4 files changed, 68 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7dc9cdf..cb14f91 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,10 +5,37 @@ All notable changes to Podkey will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.0.9] - 2026-09-24
+
+### Added
+
+- **sidestr spends: `window.nostr.sidestr.signTransaction({ chain, tx })`.**
+  Podkey is the reference signer for sidestr's browser-signer proposal
+  (`proposals/browser-signer.md` in sidestr/spec). A page on any sidestr chain
+  asks for a spend and never holds the key. Podkey's own spend window reads the
+  chain from its id (the signer's announcement, a mirror it names, every block
+  validated), checks that every input is your own mature, unspent coin, computes
+  each sighash itself, and shows what leaves your wallet: each recipient (their
+  npub, and their profile name when found), what comes back, the fee, and any
+  asset (SPEC 12) the spend moves, destroys or burns. Destroying or burning needs
+  an explicit tick. Every spend asks, whatever the site is trusted for; the key
+  stays in the background and signs only what the window computed, once.
+  Refusals reach the page with a `code`: `rejected`, `unsupported`,
+  `not-yours`, `invalid` or `unavailable`.
+- Chains beside a test network only for now. Each chain's signer is remembered
+  on first spend and a different one is refused, since a chain id is a name,
+  not a proof.
+- The sidestr engine is vendored at pinned commits (`scripts/vendor-sidestr.js`,
+  `vendor/sidestr/PINS.json` with a SHA-256 per file): Manifest V3 forbids code
+  from the network. Chains that name the EVM rule are `unsupported` until it is
+  vendored too.
 
 ### Fixed
 
+- Requests from a page wait up to three minutes instead of 30 seconds, so a site
+  no longer times out while you unlock Podkey with a security key's PIN and
+  touch. Each request's timer is cleared when its answer arrives.
+
 - **Security keys: passkey windows no longer fail straight away.** A passkey
   window started its WebAuthn ceremony on `DOMContentLoaded`, often before the
   new window had focus, and WebAuthn refuses an unfocused document with the same
diff --git a/README.md b/README.md
index 11d5988..8165c61 100644
--- a/README.md
+++ b/README.md
@@ -118,6 +118,33 @@ const payload = await window.nostr.nip44.encrypt(peer, 'hello')
 const plaintext = await window.nostr.nip44.decrypt(peer, payload)
 ```
 
+#### `window.nostr.sidestr.signTransaction({ chain, tx })`
+
+Signs a spend on a [sidestr](https://sidestr.com) chain, per sidestr's
+[browser-signer proposal](https://github.com/sidestr/spec/blob/gh-pages/proposals/browser-signer.md).
+A sidestr coin pays `OP_1 <your key>`, so the key Podkey guards is the key that
+spends your coins. `chain` is a chain id such as `sidestr:dreamlab`; `tx` is the
+transaction as hex (any witness is ignored). It resolves `{ tx, txid }` with
+every input signed, or rejects with an `Error` whose `code` is `rejected`,
+`unsupported`, `not-yours`, `invalid` or `unavailable`.
+
+```javascript
+if (window.nostr?.sidestr?.version >= 1) {
+  const { tx, txid } = await window.nostr.sidestr.signTransaction({ chain: 'sidestr:dreamlab', tx: unsignedHex })
+  // publish `tx` as a kind 23500 event from any key: a transaction authorises itself
+}
+```
+
+The page is trusted for nothing but the request. Podkey opens its own spend
+window, reads the chain from its id (the signer's tip announcement, a mirror it
+names, every block validated), checks that every input is your own mature,
+unspent coin, computes each sighash itself, and shows what leaves your wallet:
+each recipient, what comes back, the fee, and any asset the spend moves or
+destroys. It asks every time, whatever else the site is trusted for, and signs
+only after you confirm. It takes chains beside test networks only for now, and
+remembers each chain's signer on the first spend so that a different signer
+announcing the same id is refused.
+
 ## Architecture
 
 ```
@@ -137,6 +164,13 @@ const plaintext = await window.nostr.nip44.decrypt(peer, payload)
 │  Page bridge (src/injected.js)           │
 │   injects window.nostr, relays requests  │
 │   to the worker, whitelists message types│
+│                                          │
+│  sidestr spend window (popup/spend.*,    │
+│   src/sidestr/)                          │
+│   validates the chain with the vendored  │
+│   engine (vendor/sidestr/), reviews and  │
+│   shows the spend; the worker signs its  │
+│   sighashes once, after you confirm      │
 └─────────────────────────────────────────┘
 ```
 
diff --git a/src/background.js b/src/background.js
index 5d8593c..54a27df 100644
--- a/src/background.js
+++ b/src/background.js
@@ -637,7 +637,7 @@ async function showPermissionPrompt (origin, action, eventPreview) {
       url: `popup/approve.html?${params.toString()}`,
       type: 'popup',
       width: 420,
-      height: 380,
+      height: 470, // room for the trust note without scrolling
       focused: true
     });
   });
diff --git a/src/nostr-provider.js b/src/nostr-provider.js
index 93cfc27..f34d2ff 100644
--- a/src/nostr-provider.js
+++ b/src/nostr-provider.js
@@ -136,7 +136,11 @@
    * @param {object} message - Message to send
    * @returns {Promise<any>} Response from extension
    */
-  async function sendMessageToExtension (message, timeoutMs = 30000) {
+  // Three minutes by default: a request that finds Podkey locked waits for the
+  // person to unlock it, and a security key's PIN and touch take longer than
+  // the 30 seconds this used to allow (the site saw a timeout although the
+  // unlock succeeded).
+  async function sendMessageToExtension (message, timeoutMs = 180000) {
     return new Promise((resolve, reject) => {
       // Create custom event to communicate with content script
       const eventId = Math.random().toString(36).substring(7);

From f882a1bb6c92643ced6eafc401bd8c17d2deeeea Mon Sep 17 00:00:00 2001
From: Claude Code <github@thedreamlab.uk>
Date: Thu, 24 Sep 2026 18:26:19 +0000
Subject: [PATCH 5/5] ci: package vendor/ and check the zip holds every file
 the extension loads

The spend window imports the vendored sidestr engine, so a package without
vendor/ installs but fails on the first spend. The new step reads the
manifest, the three pages and vendor/sidestr/PINS.json and fails the build on
any file missing from the zip.

Co-Authored-By: jjohare <github@thedreamlab.uk>
---
 .github/workflows/ci.yml | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 19d4dd9..eefe807 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,7 +37,28 @@ jobs:
       - name: Package extension (sideloadable unpacked zip)
         run: |
           mkdir -p dist
-          zip -r dist/podkey-extension.zip manifest.json src popup $([ -d icons ] && echo icons) -x '*.test.js'
+          # vendor/ holds the sidestr engine the spend window imports (MV3 forbids remote code)
+          zip -r dist/podkey-extension.zip manifest.json src popup vendor $([ -d icons ] && echo icons) -x '*.test.js'
+
+      - name: Check the package holds every file the extension loads
+        run: |
+          python3 - <<'PY'
+          import json, re, zipfile
+          z = set(zipfile.ZipFile('dist/podkey-extension.zip').namelist())
+          m = json.load(open('manifest.json'))
+          need = [m['background']['service_worker'], m['action']['default_popup'], *m['icons'].values()]
+          need += [f for c in m['content_scripts'] for f in c['js']]
+          need += [f for w in m.get('web_accessible_resources', []) for f in w['resources']]
+          for page in ['popup/popup.html', 'popup/approve.html', 'popup/spend.html']:
+              need += ['popup/' + r for r in re.findall(r'(?:src|href)="([^"#?:]+)"', open(page).read())]
+          # the spend window's engine: every vendored file PINS.json records
+          for pin in json.load(open('vendor/sidestr/PINS.json'))['pins']:
+              need += [f"vendor/sidestr/{pin['name']}/{f}" for f in pin['files']]
+          missing = sorted(set(need) - z)
+          if missing:
+              raise SystemExit('missing from the package: ' + ', '.join(missing))
+          print(f'package holds all {len(set(need))} files the extension loads')
+          PY
 
       - name: Upload extension artifact
         uses: actions/upload-artifact@v4