Feature Request: Add P2MR (Pay-to-Merkle-Root) support (BIP 360)

[jasonandjay]

Summary

BIP 360 introduces a new output type: Pay-to-Merkle-Root (P2MR). The BIP was merged into the official BIP repository on Feb 11, 2026 (PR bitcoin/bips#1670) with Draft status. It would be valuable for bitcoinjs-lib to add support for this new output type.

What is P2MR?

P2MR is a new SegWit version 2 output type that operates with nearly the same functionality as P2TR (Pay-to-Taproot), but with the key-path spend removed. It commits directly to the Merkle root of a script tree (tagged as "TapBranch") without including an internal public key.

Key characteristics:

• SegWit version 2 — addresses start with bc1z (mainnet)
• Script-path spend only — no key-path spend (quantum resistant against long exposure attacks)
• ScriptPubKey: OP_2 OP_PUSHBYTES_32 <32-byte merkle_root>
• Control block: [control_byte] || [32*m byte merkle_path] (no internal pubkey, 1 + 32*m bytes)
• Fully compatible with Tapscript (BIP 342) — existing tapscript programs can be used without modification
• Reuses existing tagged hashes: TapLeaf, TapBranch (same as BIP 341)

Differences from P2TR:

Aspect	P2TR (BIP 341)	P2MR (BIP 360)
SegWit version	1 (OP_1)	2 (OP_2)
Address prefix	bc1p	bc1z
Key-path spend	Yes	No
Output commitment	tweakKey(internalPubkey, merkleRoot)	taggedHash("TapBranch", merkleRoot)
Control block size	33 + 32*m bytes (includes internal pubkey)	1 + 32*m bytes (no internal pubkey)
Control block parity bit	0 or 1	Always 1
Witness (script-path)	[stack..., script, controlBlock]	Same

Suggested Implementation Scope

Based on the existing P2TR implementation in this library, P2MR support would involve:

New files:

• ts_src/payments/p2mr.ts — P2MR payment type (modeled after p2tr.ts, script-path only)

Modified files:

• ts_src/payments/index.ts — Export p2mr
• ts_src/payments/bip341.ts — Add P2MR-specific helpers (e.g., control block without internal pubkey, merkle root commitment without key tweaking)
• ts_src/address.ts — Add P2MR in toOutputScript() / fromOutputScript() (SegWit v2 → p2mr)
• ts_src/psbt/bip371.ts or new file — P2MR PSBT handling (isP2MR, finalization, signing)
• ts_src/psbt.ts — P2MR signing/finalization support
• ts_src/transaction.ts — P2MR sighash computation (if it differs from v1)

Reusable existing code:

• tapleafHash, tapBranchHash, toHashTree, findScriptPath from bip341.ts
• Tagged hash infrastructure from crypto.ts
• Bech32m encoding/decoding (already supports version ≥ 1)
• Tapscript validation logic

References

• BIP 360 Specification: https://bip360.org/bip360.html
• BIP 360 on GitHub: https://github.com/bitcoin/bips/blob/master/bip-0360.mediawiki
• BIP 360 PR: BIP 360 - Pay to Merkle Root (P2MR) bitcoin/bips#1670
• Test vectors: https://github.com/bitcoin/bips/blob/master/bip-0360/ref-impl/common/tests/data/P2MR_construction.json
• Reference implementations: Rust, Python

Additional Context

P2MR is designed as a conservative first step toward quantum resistance. While the BIP is still in Draft status and has not been activated on the Bitcoin network, early library support would:

1. Allow developers to experiment with P2MR transaction construction and validation
2. Prepare the ecosystem for potential future activation
3. Provide a foundation for future post-quantum signature integration via tapscript OP_SUCCESSx upgrades

[jasonandjay]

Maintainer triage: accepted as feature request. Scope and priority depend on broader script/output roadmap and consensus readiness. Keeping open for design tracking.