# Module BSV::Wallet::BRC29 <a id="module-BSV-Wallet-BRC29"></a>

BRC-29 payment derivation primitives. One canonical home for the protocol
identifier and the `key_id` composition used at every BRC-29 send/receive site
in the wallet.

`PROTOCOL_ID` aliases <code>BSV::Auth::AuthFetch::PAYMENT_PROTOCOL_ID</code>
rather than restating the literal +[2, '3241645161d8']+. The SDK constant
currently lives under <code>Auth::AuthFetch</code> — one consumer of BRC-29,
not its owner — and a future namespace move there is a one-line wallet change
at this seam.

`key_id` enforces byte-exact composition. A two-space typo, an NBSP, or a
control byte at any send site silently breaks key recovery on the receive
side, so the helper validates the charset (base64url subset), length (≤128
chars), and non-empty contract on both inputs before joining. Inline
+"#{prefix} #{suffix}"+ at call sites is banned by +rake brc29:guard+ — every
BRC-29 derivation must route through this method.

## Constants
### `DERIVATION_TOKEN_MAX_BYTES` <a id="constant-DERIVATION_TOKEN_MAX_BYTES"></a> <a id="DERIVATION_TOKEN_MAX_BYTES-constant"></a>
Not documented.

### `DERIVATION_TOKEN_PATTERN` <a id="constant-DERIVATION_TOKEN_PATTERN"></a> <a id="DERIVATION_TOKEN_PATTERN-constant"></a>
Not documented.

### `PROTOCOL_ID` <a id="constant-PROTOCOL_ID"></a> <a id="PROTOCOL_ID-constant"></a>
Not documented.

## Public Class Methods
### `key_id(prefix, suffix)` <a id="method-c-key_id"></a> <a id="key_id-class_method"></a>
Compose the BRC-29 `key_id` from the per-payment derivation prefix and suffix.
Returns +"#{prefix} #{suffix}"+ — a single ASCII space between the two tokens,
per the spec invoice-number format.
- **@param** `prefix` [String] BRC-29 derivation prefix
- **@param** `suffix` [String] BRC-29 derivation suffix
- **@raise** [InvalidDerivationToken] if either token is empty, exceeds
{DERIVATION_TOKEN_MAX_BYTES} bytes, or contains characters
outside the base64url subset (whitespace and control bytes
included)
- **@return** [String] the composed key_id

### `validate_derivation_token!(token, role:)` <a id="method-c-validate_derivation_token-21"></a> <a id="validate_derivation_token!-class_method"></a>
Validate a BRC-29 derivation token (prefix or suffix) against the
charset/length contract without composing a key_id. Used at untrusted
boundaries (e.g. the CLI envelope ingress) to reject adversarial values at the
boundary rather than letting them surface as InvalidDerivationToken mid-spend
later.
- **@param** `token` [String] the derivation token to validate
- **@param** `role` [String] descriptor for error messages ('prefix' /
'suffix' / 'derivation_prefix' / etc.)
- **@raise** [InvalidDerivationToken] on any contract violation