@arkade-os/sdk 0.4.34 → 0.4.36

package/dist/{chunk-XCHBQVMK.cjs → chunk-TUSGEWOX.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkFSAXPBGP_cjs = require('./chunk-FSAXPBGP.cjs');
+var chunkC6OODRWD_cjs = require('./chunk-C6OODRWD.cjs');
 var chunkGUTKJMSF_cjs = require('./chunk-GUTKJMSF.cjs');
 var chunkCMPJR3HS_cjs = require('./chunk-CMPJR3HS.cjs');
 var utils_js = require('@scure/btc-signer/utils.js');
@@ -181,7 +181,7 @@ var TreeSignerSession = class _TreeSignerSession {
     noncesByPubkey.set(base.hex.encode(myPublicKey.subarray(1)), myNonce);
     const tx = this.graph.find(txid);
     if (!tx) throw new Error(`missing tx for txid ${txid}`);
-    const cosigners = chunkFSAXPBGP_cjs.getArkPsbtFields(tx.root, 0, chunkFSAXPBGP_cjs.CosignerPublicKey).map(
+    const cosigners = chunkC6OODRWD_cjs.getArkPsbtFields(tx.root, 0, chunkC6OODRWD_cjs.CosignerPublicKey).map(
       (c) => base.hex.encode(c.key.subarray(1))
       // xonly pubkey
     );
@@ -233,7 +233,7 @@ var TreeSignerSession = class _TreeSignerSession {
     if (!aggNonce) throw new Error("missing aggregate nonce");
     const prevoutAmounts = [];
     const prevoutScripts = [];
-    const cosigners = chunkFSAXPBGP_cjs.getArkPsbtFields(g.root, 0, chunkFSAXPBGP_cjs.CosignerPublicKey).map((c) => c.key);
+    const cosigners = chunkC6OODRWD_cjs.getArkPsbtFields(g.root, 0, chunkC6OODRWD_cjs.CosignerPublicKey).map((c) => c.key);
     const { finalKey } = aggregateKeys(cosigners, true, {
       taprootTweak: this.scriptRoot
     });
@@ -980,14 +980,14 @@ var RestDelegateProvider = class {
    */
   async delegate(intent, forfeitTxs, options) {
     const url = `${this.url}/v1/delegate`;
-    const response = await fetch(url, {
+    const response = await chunkC6OODRWD_cjs.baseFetch(url, {
       method: "POST",
       headers: {
         "Content-Type": "application/json"
       },
       body: JSON.stringify({
         intent: {
-          message: chunkFSAXPBGP_cjs.Intent.encodeMessage(intent.message),
+          message: chunkC6OODRWD_cjs.Intent.encodeMessage(intent.message),
           proof: intent.proof
         },
         forfeit_txs: forfeitTxs,
@@ -995,8 +995,8 @@ var RestDelegateProvider = class {
       })
     });
     if (!response.ok) {
-      const errorText = await response.text();
-      throw new Error(`Failed to delegate: ${errorText}`);
+      const errorText2 = await response.text();
+      throw new Error(`Failed to delegate: ${errorText2}`);
     }
   }
   /**
@@ -1007,10 +1007,10 @@ var RestDelegateProvider = class {
    */
   async getDelegateInfo() {
     const url = `${this.url}/v1/delegator/info`;
-    const response = await fetch(url);
+    const response = await chunkC6OODRWD_cjs.baseFetch(url);
     if (!response.ok) {
-      const errorText = await response.text();
-      throw new Error(`Failed to get delegate info: ${errorText}`);
+      const errorText2 = await response.text();
+      throw new Error(`Failed to get delegate info: ${errorText2}`);
     }
     const data = await response.json();
     if (!isDelegateInfo(data)) {
@@ -1042,14 +1042,14 @@ var EsploraProvider = class {
   pollingInterval;
   forcePolling;
   async getCoins(address) {
-    const response = await fetch(`${this.baseUrl}/address/${address}/utxo`);
+    const response = await chunkC6OODRWD_cjs.baseFetch(`${this.baseUrl}/address/${address}/utxo`);
     if (!response.ok) {
       throw new Error(`Failed to fetch UTXOs: ${response.statusText}`);
     }
     return response.json();
   }
   async getFeeRate() {
-    const response = await fetch(`${this.baseUrl}/fee-estimates`);
+    const response = await chunkC6OODRWD_cjs.baseFetch(`${this.baseUrl}/fee-estimates`);
     if (response.status === 404) {
       return void 0;
     }
@@ -1070,7 +1070,7 @@ var EsploraProvider = class {
     }
   }
   async getTxOutspends(txid) {
-    const response = await fetch(`${this.baseUrl}/tx/${txid}/outspends`);
+    const response = await chunkC6OODRWD_cjs.baseFetch(`${this.baseUrl}/tx/${txid}/outspends`);
     if (!response.ok) {
       const error = await response.text();
       throw new Error(`Failed to get transaction outspends: ${error}`);
@@ -1078,7 +1078,7 @@ var EsploraProvider = class {
     return response.json();
   }
   async getTransactions(address) {
-    const response = await fetch(`${this.baseUrl}/address/${address}/txs`);
+    const response = await chunkC6OODRWD_cjs.baseFetch(`${this.baseUrl}/address/${address}/txs`);
     if (!response.ok) {
       const error = await response.text();
       throw new Error(`Failed to get transactions: ${error}`);
@@ -1086,7 +1086,7 @@ var EsploraProvider = class {
     return response.json();
   }
   async getTxStatus(txid) {
-    const txresponse = await fetch(`${this.baseUrl}/tx/${txid}`);
+    const txresponse = await chunkC6OODRWD_cjs.baseFetch(`${this.baseUrl}/tx/${txid}`);
     if (!txresponse.ok) {
       throw new Error(txresponse.statusText);
     }
@@ -1094,7 +1094,7 @@ var EsploraProvider = class {
     if (!tx.status.confirmed) {
       return { confirmed: false };
     }
-    const response = await fetch(`${this.baseUrl}/tx/${txid}/status`);
+    const response = await chunkC6OODRWD_cjs.baseFetch(`${this.baseUrl}/tx/${txid}/status`);
     if (!response.ok) {
       throw new Error(`Failed to get transaction status: ${response.statusText}`);
     }
@@ -1178,7 +1178,7 @@ var EsploraProvider = class {
     return stopFunc;
   }
   async getChainTip() {
-    const tipBlocks = await fetch(`${this.baseUrl}/blocks`);
+    const tipBlocks = await chunkC6OODRWD_cjs.baseFetch(`${this.baseUrl}/blocks`);
     if (!tipBlocks.ok) {
       throw new Error(`Failed to get chain tip: ${tipBlocks.statusText}`);
     }
@@ -1197,7 +1197,7 @@ var EsploraProvider = class {
     };
   }
   async broadcastPackage(parent, child) {
-    const response = await fetch(`${this.baseUrl}/txs/package`, {
+    const response = await chunkC6OODRWD_cjs.baseFetch(`${this.baseUrl}/txs/package`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json"
@@ -1211,7 +1211,7 @@ var EsploraProvider = class {
     return response.json();
   }
   async broadcastTx(tx) {
-    const response = await fetch(`${this.baseUrl}/tx`, {
+    const response = await chunkC6OODRWD_cjs.baseFetch(`${this.baseUrl}/tx`, {
       method: "POST",
       headers: {
         "Content-Type": "text/plain"
@@ -1280,7 +1280,7 @@ function buildForfeitTx(inputs, forfeitPkScript, txLocktime) {
   );
 }
 function buildForfeitTxWithOutput(inputs, output, txLocktime) {
-  const tx = new chunkFSAXPBGP_cjs.Transaction({
+  const tx = new chunkC6OODRWD_cjs.Transaction({
     version: 3,
     lockTime: txLocktime
   });
@@ -1356,7 +1356,7 @@ function validateVtxoTxGraph(graph, roundTransaction, sweepTapTreeRoot) {
       if (previousScriptKey.length !== 32) {
         throw new Error(`parent output ${childIndex} has invalid script`);
       }
-      const cosigners = chunkFSAXPBGP_cjs.getArkPsbtFields(child.root, 0, chunkFSAXPBGP_cjs.CosignerPublicKey);
+      const cosigners = chunkC6OODRWD_cjs.getArkPsbtFields(child.root, 0, chunkC6OODRWD_cjs.CosignerPublicKey);
       if (cosigners.length === 0) {
         throw ErrMissingCosignersPublicKeys;
       }
@@ -1456,7 +1456,7 @@ var Extension = class _Extension {
         `expected magic prefix ${base.hex.encode(ARKADE_MAGIC)}, got ${base.hex.encode(payload.slice(0, Math.min(payload.length, ARKADE_MAGIC.length)))}`
       );
     }
-    const reader = new chunkFSAXPBGP_cjs.BufferReader(payload.slice(ARKADE_MAGIC.length));
+    const reader = new chunkC6OODRWD_cjs.BufferReader(payload.slice(ARKADE_MAGIC.length));
     const packets = [];
     while (reader.remaining() > 0) {
       const packetType = reader.readByte();
@@ -1530,7 +1530,7 @@ var Extension = class _Extension {
    */
   getAssetPacket() {
     for (const p of this.packets) {
-      if (p instanceof chunkFSAXPBGP_cjs.Packet) {
+      if (p instanceof chunkC6OODRWD_cjs.Packet) {
         return p;
       }
     }
@@ -1538,8 +1538,8 @@ var Extension = class _Extension {
   }
 };
 function parsePacket(packetType, data) {
-  if (packetType === chunkFSAXPBGP_cjs.Packet.PACKET_TYPE) {
-    return chunkFSAXPBGP_cjs.Packet.fromBytes(data);
+  if (packetType === chunkC6OODRWD_cjs.Packet.PACKET_TYPE) {
+    return chunkC6OODRWD_cjs.Packet.fromBytes(data);
   }
   return new UnknownPacket(packetType, data);
 }
@@ -1730,7 +1730,7 @@ function createAssetPacket(assetInputs, receivers, changeReceiver) {
       const existing = inputsByAssetId.get(asset.assetId);
       inputsByAssetId.set(asset.assetId, [
         ...existing ?? [],
-        chunkFSAXPBGP_cjs.AssetInput.create(inputIndex, asset.amount)
+        chunkC6OODRWD_cjs.AssetInput.create(inputIndex, asset.amount)
       ]);
     }
   }
@@ -1742,7 +1742,7 @@ function createAssetPacket(assetInputs, receivers, changeReceiver) {
         const existing = outputsByAssetId.get(asset.assetId);
         outputsByAssetId.set(asset.assetId, [
           ...existing ?? [],
-          chunkFSAXPBGP_cjs.AssetOutput.create(outputIndex, asset.amount)
+          chunkC6OODRWD_cjs.AssetOutput.create(outputIndex, asset.amount)
         ]);
       }
     }
@@ -1753,7 +1753,7 @@ function createAssetPacket(assetInputs, receivers, changeReceiver) {
       const existing = outputsByAssetId.get(asset.assetId);
       outputsByAssetId.set(asset.assetId, [
         ...existing ?? [],
-        chunkFSAXPBGP_cjs.AssetOutput.create(outputIndex, asset.amount)
+        chunkC6OODRWD_cjs.AssetOutput.create(outputIndex, asset.amount)
       ]);
     }
   }
@@ -1762,11 +1762,11 @@ function createAssetPacket(assetInputs, receivers, changeReceiver) {
   for (const assetIdStr of allAssetIds) {
     const inputs = inputsByAssetId.get(assetIdStr);
     const outputs = outputsByAssetId.get(assetIdStr);
-    const assetId = chunkFSAXPBGP_cjs.AssetId.fromString(assetIdStr);
-    const group = chunkFSAXPBGP_cjs.AssetGroup.create(assetId, null, inputs ?? [], outputs ?? [], []);
+    const assetId = chunkC6OODRWD_cjs.AssetId.fromString(assetIdStr);
+    const group = chunkC6OODRWD_cjs.AssetGroup.create(assetId, null, inputs ?? [], outputs ?? [], []);
     groups.push(group);
   }
-  return chunkFSAXPBGP_cjs.Packet.create(groups);
+  return chunkC6OODRWD_cjs.Packet.create(groups);
 }
 function selectCoinsWithAsset(coins, assetId, requiredAmount) {
   const coinsWithAsset = coins.filter((coin) => coin.assets?.some((a) => a.assetId === assetId));
@@ -1801,6 +1801,45 @@ function selectedCoinsToAssetInputs(selectedCoins) {
   }
   return assetInputs;
 }
+function toXOnlySignerHex(pubkeyHex) {
+  const bytes = base.hex.decode(pubkeyHex);
+  if (bytes.length === 33) return base.hex.encode(bytes.slice(1));
+  if (bytes.length === 32) return base.hex.encode(bytes);
+  throw new Error(`invalid signer pubkey length: expected 32 or 33 bytes, got ${bytes.length}`);
+}
+function signerSetFromInfo(info) {
+  const active = toXOnlySignerHex(info.signerPubkey);
+  const deprecated = /* @__PURE__ */ new Map();
+  for (const signer of info.deprecatedSigners) {
+    if (!signer.pubkey) continue;
+    deprecated.set(toXOnlySignerHex(signer.pubkey), signer.cutoffDate);
+  }
+  return { active, deprecated };
+}
+function classifyAgainstSignerSet(contractServerPubKeyHex, signerSet, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  const signerPubKey = toXOnlySignerHex(contractServerPubKeyHex);
+  if (signerPubKey === signerSet.active) {
+    return { status: "CURRENT", signerPubKey };
+  }
+  if (!signerSet.deprecated.has(signerPubKey)) {
+    return { status: "UNKNOWN_SIGNER", signerPubKey };
+  }
+  const cutoffDate = signerSet.deprecated.get(signerPubKey);
+  if (cutoffDate === 0n) {
+    return { status: "DUE_NOW", signerPubKey };
+  }
+  const secondsUntilCutoff = Number(cutoffDate) - nowSeconds;
+  if (secondsUntilCutoff <= 0) {
+    return { status: "EXPIRED", signerPubKey, cutoffDate, secondsUntilCutoff };
+  }
+  return { status: "MIGRATABLE", signerPubKey, cutoffDate, secondsUntilCutoff };
+}
+function classifyContractSigner(contractServerPubKeyHex, info, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  return classifyAgainstSignerSet(contractServerPubKeyHex, signerSetFromInfo(info), nowSeconds);
+}
+function isCooperativelyMigratable(status) {
+  return status === "MIGRATABLE" || status === "DUE_NOW";
+}
 function buildOffchainTx(inputs, outputs, serverUnrollScript) {
   const MAX_OP_RETURN = 2;
   let countOpReturn = 0;
@@ -1844,7 +1883,7 @@ function buildVirtualTx(inputs, outputs) {
       }
     }
   }
-  const tx = new chunkFSAXPBGP_cjs.Transaction({
+  const tx = new chunkC6OODRWD_cjs.Transaction({
     version: 3,
     lockTime: Number(lockTime)
   });
@@ -1859,7 +1898,7 @@ function buildVirtualTx(inputs, outputs) {
       },
       tapLeafScript: [input.tapLeafScript]
     });
-    chunkFSAXPBGP_cjs.setArkPsbtField(tx, i, chunkFSAXPBGP_cjs.VtxoTaprootTree, input.tapTree);
+    chunkC6OODRWD_cjs.setArkPsbtField(tx, i, chunkC6OODRWD_cjs.VtxoTaprootTree, input.tapTree);
   }
   for (const output of outputs) {
     tx.addOutput(output);
@@ -2381,6 +2420,20 @@ function validateRecipients(recipients, dustAmount) {
 }
 
 // src/wallet/vtxo-manager.ts
+function selectPendingRecoveryOutpoints(contractsWithVtxos, signerSet, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  const out = /* @__PURE__ */ new Set();
+  for (const { contract, vtxos } of contractsWithVtxos) {
+    const serverPubKey = contract.params.serverPubKey;
+    if (!serverPubKey) continue;
+    if (classifyAgainstSignerSet(serverPubKey, signerSet, nowSeconds).status !== "EXPIRED") {
+      continue;
+    }
+    for (const v of vtxos) {
+      if (isSpendable(v) && !isRecoverable(v)) out.add(`${v.txid}:${v.vout}`);
+    }
+  }
+  return out;
+}
 function isSweepCapable(wallet) {
   return "boardingTapscript" in wallet && "onchainProvider" in wallet && "arkProvider" in wallet && "network" in wallet && "signOnchainBoardingTx" in wallet;
 }
@@ -2418,6 +2471,18 @@ function byExpiryAscending(vtxos) {
   };
   return [...vtxos].sort((a, b) => expiryKey(a) - expiryKey(b));
 }
+function capSettlementBatch(sorted, maxAmount) {
+  const batch = [];
+  let total = 0n;
+  for (const vtxo of sorted) {
+    if (batch.length >= MAX_VTXOS_PER_SETTLEMENT) break;
+    const next = total + BigInt(vtxo.value);
+    if (maxAmount >= 0n && next > maxAmount) continue;
+    batch.push(vtxo);
+    total = next;
+  }
+  return batch;
+}
 var DEFAULT_THRESHOLD_SECONDS = 259200;
 var DEFAULT_THRESHOLD_MS = DEFAULT_THRESHOLD_SECONDS * 1e3;
 var DEFAULT_RENEWAL_CONFIG = {
@@ -2427,7 +2492,8 @@ var DEFAULT_RENEWAL_CONFIG = {
 var DEFAULT_SETTLEMENT_CONFIG = {
   vtxoThreshold: DEFAULT_THRESHOLD_SECONDS,
   boardingUtxoSweep: true,
-  pollIntervalMs: 6e4
+  pollIntervalMs: 6e4,
+  deprecatedSignerMigration: true
 };
 function getRecoverableVtxos(vtxos, dustAmount) {
   return vtxos.filter((vtxo) => {
@@ -2481,6 +2547,51 @@ function getExpiringAndRecoverableVtxos(vtxos, thresholdMs, dustAmount) {
     (vtxo) => isVtxoExpiringSoon(vtxo, thresholdMs) || isRecoverable(vtxo) || isSpendable(vtxo) && isExpired(vtxo) || isSubdust(vtxo, dustAmount)
   );
 }
+function isMigrationCapable(wallet) {
+  return "arkProvider" in wallet && "arkServerPublicKey" in wallet && "onchainProvider" in wallet && typeof wallet.rotateServerSigner === "function" && typeof wallet.sendSelectedVtxosToSelf === "function" && typeof wallet.getBoardingUtxosForSigners === "function";
+}
+function classifiedToRef(c) {
+  return {
+    txid: c.vtxo.txid,
+    vout: c.vtxo.vout,
+    value: c.vtxo.value,
+    signerPubKey: c.classification.signerPubKey,
+    cutoffDate: c.classification.cutoffDate
+  };
+}
+function classifiedBoardingToRef(c) {
+  return {
+    txid: c.coin.txid,
+    vout: c.coin.vout,
+    value: c.coin.value,
+    signerPubKey: c.classification.signerPubKey,
+    cutoffDate: c.classification.cutoffDate
+  };
+}
+function mergeSignerReports(...reportLists) {
+  const bySigner = /* @__PURE__ */ new Map();
+  for (const list of reportLists) {
+    for (const r of list) {
+      const existing = bySigner.get(r.signerPubKey);
+      if (existing) {
+        existing.vtxoCount += r.vtxoCount;
+        existing.totalValue += r.totalValue;
+        existing.boardingCount += r.boardingCount;
+        existing.boardingValue += r.boardingValue;
+        existing.recoverableCount += r.recoverableCount;
+        existing.recoverableValue += r.recoverableValue;
+        existing.awaitingSweepCount += r.awaitingSweepCount;
+        existing.awaitingSweepValue += r.awaitingSweepValue;
+        if (r.nextSweepEta !== void 0) {
+          existing.nextSweepEta = existing.nextSweepEta === void 0 ? r.nextSweepEta : Math.min(existing.nextSweepEta, r.nextSweepEta);
+        }
+      } else {
+        bySigner.set(r.signerPubKey, { ...r });
+      }
+    }
+  }
+  return Array.from(bySigner.values());
+}
 var VtxoManager = class _VtxoManager {
   constructor(wallet, renewalConfig, settlementConfig) {
     this.wallet = wallet;
@@ -2496,15 +2607,9 @@ var VtxoManager = class _VtxoManager {
     } else {
       this.settlementConfig = { ...DEFAULT_SETTLEMENT_CONFIG };
     }
-    this.contractEventsSubscriptionReady = this.initializeSubscription().then(
-      (subscription) => {
-        this.contractEventsSubscription = subscription;
-        return subscription;
-      }
-    );
+    this.contractEventsSubscriptionReady = this.initializeSubscription();
   }
   settlementConfig;
-  contractEventsSubscription;
   contractEventsSubscriptionReady;
   disposePromise;
   pollTimeoutId;
@@ -2541,6 +2646,15 @@ var VtxoManager = class _VtxoManager {
   lastVtxoSpentRefreshTimestamp = 0;
   vtxoSpentRefreshPromise;
   static VTXO_SPENT_REFRESH_COOLDOWN_MS = 3e4;
+  // Cooldown/backoff for the automatic deprecated-signer migration pass.
+  // Mirrors the periodic-settle machinery so a server-side migration failure
+  // (e.g. arkd not yet accepting old-key inputs, or a closed cutoff window)
+  // backs off exponentially instead of re-submitting an identical intent on
+  // every poll. The manual migrateDeprecatedSignerVtxos() bypasses this.
+  lastMigrationTimestamp = 0;
+  consecutiveMigrationFailures = 0;
+  static MIGRATION_COOLDOWN_MS = 3e4;
+  static MIGRATION_MAX_BACKOFF_MS = 5 * 60 * 1e3;
   // ========== Recovery Methods ==========
   /**
    * Recover swept/expired virtual outputs by settling them back to the wallet's Arkade address.
@@ -2581,16 +2695,21 @@ var VtxoManager = class _VtxoManager {
     if (vtxosToRecover.length === 0) {
       throw new Error("No recoverable VTXOs found");
     }
-    if (vtxosToRecover.length > MAX_VTXOS_PER_SETTLEMENT) {
+    const info = await this.getInfoProvider()?.getInfo();
+    const vtxoMaxAmount = info?.vtxoMaxAmount ?? -1n;
+    const capped = capSettlementBatch(byValueDescending(vtxosToRecover), vtxoMaxAmount);
+    if (capped.length < vtxosToRecover.length) {
       const recoverableCount = vtxosToRecover.length;
-      const capped = byValueDescending(vtxosToRecover).slice(0, MAX_VTXOS_PER_SETTLEMENT);
       ({ vtxosToRecover, totalAmount } = getRecoverableWithSubdust(capped, dustAmount));
       if (vtxosToRecover.length === 0) {
         throw new Error(
-          `Capped recovery batch (highest-value ${MAX_VTXOS_PER_SETTLEMENT} of ${recoverableCount} recoverable VTXOs) is below the dust threshold ${dustAmount}`
+          `Capped recovery batch (highest-value subset of ${recoverableCount} recoverable VTXOs within the ${MAX_VTXOS_PER_SETTLEMENT}-input and ${vtxoMaxAmount}-sat limits) is below the dust threshold ${dustAmount}`
         );
       }
     }
+    if (info && isMigrationCapable(this.wallet)) {
+      await this.rotateForRecoverableInputs(vtxosToRecover, info);
+    }
     const arkAddress = await this.wallet.getAddress();
     return this.wallet.settle(
       {
@@ -2740,8 +2859,24 @@ var VtxoManager = class _VtxoManager {
       if (vtxos.length === 0) {
         throw new Error("No VTXOs available to renew");
       }
-      if (vtxos.length > MAX_VTXOS_PER_SETTLEMENT) {
-        vtxos = byExpiryAscending(vtxos).slice(0, MAX_VTXOS_PER_SETTLEMENT);
+      const info = await this.getInfoProvider()?.getInfo();
+      const vtxoMaxAmount = info?.vtxoMaxAmount ?? -1n;
+      const capped = capSettlementBatch(byExpiryAscending(vtxos), vtxoMaxAmount);
+      if (vtxoMaxAmount >= 0n) {
+        const oversized = vtxos.filter((vtxo) => BigInt(vtxo.value) > vtxoMaxAmount);
+        if (oversized.length > 0) {
+          console.warn(
+            `Renewal: ${oversized.length} VTXO(s) exceed the per-output limit ${vtxoMaxAmount} and cannot be renewed; they risk unilateral exit`
+          );
+        }
+      }
+      if (capped.length < vtxos.length) {
+        vtxos = capped;
+        if (vtxos.length === 0) {
+          throw new Error(
+            `No VTXOs available to renew within the per-output limit ${vtxoMaxAmount}`
+          );
+        }
       }
       const totalAmount = vtxos.reduce((sum, vtxo) => sum + vtxo.value, 0);
       const dustAmount = getDustAmount(this.wallet);
@@ -2750,6 +2885,9 @@ var VtxoManager = class _VtxoManager {
           `Total amount ${totalAmount} is below dust threshold ${dustAmount}`
         );
       }
+      if (info && isMigrationCapable(this.wallet)) {
+        await this.rotateForRecoverableInputs(vtxos, info);
+      }
       const arkAddress = await this.wallet.getAddress();
       const txid = await this.wallet.settle(
         {
@@ -2868,7 +3006,7 @@ var VtxoManager = class _VtxoManager {
         `Sweep not economical: output ${outputAmount} sats after ${fee} sats fee is below dust (${dustAmount} sats)`
       );
     }
-    const tx = new chunkFSAXPBGP_cjs.Transaction();
+    const tx = new chunkC6OODRWD_cjs.Transaction();
     for (const utxo of expiredUtxos) {
       const utxoScript = chunkCMPJR3HS_cjs.VtxoScript.decode(utxo.tapTree);
       const utxoExitLeaf = utxoScript.leaves.find(
@@ -2900,6 +3038,472 @@ var VtxoManager = class _VtxoManager {
     this.knownBoardingUtxos.add(`${txid}:0`);
     return txid;
   }
+  // ========== Deprecated-Signer Migration Methods ==========
+  /**
+   * Cooperatively migrate VTXOs minted under a now-deprecated server signer
+   * to the wallet's active-signer address. See {@link IVtxoManager}.
+   */
+  async migrateDeprecatedSignerVtxos(options) {
+    return this.migrateCore(options);
+  }
+  /**
+   * Machine-readable status of every deprecated server signer the wallet
+   * currently holds funds under (Section 6), without migrating. Covers both
+   * VTXO and boarding holdings (Section 7), merged per signer.
+   *
+   * @remarks This is no longer a pure repository/info read: surfacing boarding
+   * holdings fans out per boarding address (`getCoins` round trips) and
+   * refreshes the UTXO cache via `saveUtxos`.
+   */
+  async getDeprecatedSignerStatus() {
+    const wallet = this.requireMigrationCapableWallet();
+    const info = await wallet.arkProvider.getInfo();
+    const { reports: vtxoReports } = await this.classifyDeprecatedSignerContracts(info);
+    const { reports: boardingReports } = await this.classifyDeprecatedSignerBoarding(info);
+    return mergeSignerReports(vtxoReports, boardingReports);
+  }
+  /**
+   * Core migration routine shared by the manual API and the automatic poll
+   * pass. Fetches a fresh {@link ArkInfo}, applies a mid-session signer
+   * rotation when the wallet's own snapshot signer has been deprecated,
+   * selects spendable VTXOs under deprecated-signer contracts (cutoff-first),
+   * and settles them to the active-signer Ark address.
+   */
+  async migrateCore(options) {
+    const wallet = this.requireMigrationCapableWallet();
+    const info = await wallet.arkProvider.getInfo();
+    const signerSet = signerSetFromInfo(info);
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const walletSignerHex = base.hex.encode(wallet.arkServerPublicKey);
+    const walletClass = classifyAgainstSignerSet(walletSignerHex, signerSet, nowSeconds);
+    if (signerSet.deprecated.size === 0 && walletClass.status === "CURRENT") {
+      return { rotated: false, expired: [], signers: [] };
+    }
+    if (walletClass.status === "UNKNOWN_SIGNER") {
+      const { reports: vtxoReports2 } = await this.classifyDeprecatedSignerContracts(info);
+      const { reports: boardingReports2 } = await this.classifyDeprecatedSignerBoarding(info);
+      return {
+        rotated: false,
+        expired: [],
+        signers: mergeSignerReports(vtxoReports2, boardingReports2),
+        skipped: "unknown-wallet-signer"
+      };
+    }
+    const rotated = await this.ensureReceiveOnActiveSigner(info);
+    const {
+      reports: vtxoReports,
+      migratable: vtxoMigratable,
+      expired: vtxoExpired
+    } = await this.classifyDeprecatedSignerContracts(info);
+    const {
+      reports: boardingReports,
+      migratable: boardingMigratable,
+      expired: boardingExpired
+    } = await this.classifyDeprecatedSignerBoarding(info);
+    const reports = mergeSignerReports(vtxoReports, boardingReports);
+    const expiredRefs = [
+      ...vtxoExpired.map(classifiedToRef),
+      ...boardingExpired.map(classifiedBoardingToRef)
+    ];
+    if (vtxoMigratable.length === 0 && boardingMigratable.length === 0) {
+      return {
+        rotated,
+        expired: expiredRefs,
+        signers: reports,
+        skipped: "no-deprecated-vtxos"
+      };
+    }
+    const vtxoMaxAmount = info.vtxoMaxAmount;
+    const dustAmount = getDustAmount(this.wallet);
+    const report = {
+      rotated,
+      expired: expiredRefs,
+      signers: reports
+    };
+    if (vtxoMigratable.length > 0) {
+      report.vtxos = await this.runMigrationLeg(
+        vtxoMigratable,
+        (c) => c.vtxo.value,
+        classifiedToRef,
+        vtxoMaxAmount,
+        dustAmount,
+        "VTXO",
+        (capped) => wallet.sendSelectedVtxosToSelf(capped.map((c) => c.vtxo))
+      );
+    }
+    if (boardingMigratable.length > 0) {
+      report.boarding = await this.runMigrationLeg(
+        boardingMigratable,
+        (c) => c.coin.value,
+        classifiedBoardingToRef,
+        vtxoMaxAmount,
+        dustAmount,
+        "boarding",
+        async (capped) => {
+          const arkAddress = await this.wallet.getAddress();
+          const totalAmount = capped.reduce((sum, c) => sum + BigInt(c.coin.value), 0n);
+          return this.wallet.settle(
+            {
+              inputs: capped.map((c) => c.coin),
+              outputs: [{ address: arkAddress, amount: totalAmount }]
+            },
+            options?.eventCallback
+          );
+        }
+      );
+    }
+    return report;
+  }
+  /**
+   * Size and submit one migration leg. Filters inputs whose value alone
+   * exceeds the per-output ceiling (`vtxoMaxAmount`; `< 0` means no limit) —
+   * those can never form a ≤-ceiling output and must exit unilaterally — then
+   * caps the rest (highest-value first; bounded by {@link MAX_VTXOS_PER_SETTLEMENT}
+   * AND a gross total within `vtxoMaxAmount`), applies the protocol dust floor,
+   * and submits the capped batch through `submit`. A throw from `submit` lands
+   * in `error`; the caller's other leg still runs.
+   *
+   * Migration is mandatory and fee-exempt: every selected input moves at its
+   * full value, so the gross total IS the aggregated output amount (kept under
+   * the server ceiling by the cap). The dust floor guards the degenerate cases
+   * where every input was oversized or the whole holding sums below dust.
+   */
+  async runMigrationLeg(candidates, valueOf, toRef, vtxoMaxAmount, dustAmount, legName, submit) {
+    const oversizedRefs = [];
+    const sized = [];
+    for (const c of candidates) {
+      if (vtxoMaxAmount >= 0n && BigInt(valueOf(c)) > vtxoMaxAmount) {
+        oversizedRefs.push(toRef(c));
+      } else {
+        sized.push(c);
+      }
+    }
+    if (oversizedRefs.length > 0) {
+      console.warn(
+        `Deprecated-signer migration (${legName}): ${oversizedRefs.length} input(s) exceed the per-output limit ${vtxoMaxAmount} and cannot be migrated cooperatively; they require a unilateral exit.`
+      );
+    }
+    const oversizedField = oversizedRefs.length > 0 ? { oversized: oversizedRefs } : {};
+    const capped = capSettlementBatch(
+      byValueDescending(sized.map((c) => ({ value: valueOf(c), c }))),
+      vtxoMaxAmount
+    ).map((w) => w.c);
+    const deferred = sized.length - capped.length;
+    const totalAmount = capped.reduce((sum, c) => sum + BigInt(valueOf(c)), 0n);
+    if (totalAmount < dustAmount) {
+      const onlyOversized = sized.length === 0 && oversizedRefs.length > 0;
+      return {
+        migrated: [],
+        skipped: onlyOversized ? "oversized-only" : "below-dust",
+        ...oversizedField
+      };
+    }
+    try {
+      const txid = await submit(capped);
+      return {
+        txid,
+        migrated: capped.map(toRef),
+        ...deferred > 0 ? { deferred } : {},
+        ...oversizedField
+      };
+    } catch (e) {
+      return {
+        migrated: [],
+        error: e instanceof Error ? e.message : String(e),
+        ...oversizedField
+      };
+    }
+  }
+  /**
+   * Enumerate the wallet's `default`/`delegate` contracts, classify each
+   * against the fresh signer set, and split their spendable VTXOs into
+   * cooperatively-migratable and cutoff-expired sets while building the
+   * per-signer status report. Current-signer contracts are skipped; swept
+   * (recoverable) VTXOs are excluded from the settle sets — those follow the
+   * recovery path — but are still counted on EXPIRED report rows
+   * (`recoverableCount`) so post-cutoff funds in flight stay visible.
+   */
+  async classifyDeprecatedSignerContracts(info) {
+    const cm = await this.wallet.getContractManager();
+    const signerSet = signerSetFromInfo(info);
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const contractsWithVtxos = await cm.getContractsWithVtxos({
+      type: ["default", "delegate"]
+    });
+    const reportsBySigner = /* @__PURE__ */ new Map();
+    const migratable = [];
+    const expired = [];
+    for (const { contract, vtxos } of contractsWithVtxos) {
+      const serverPubKey = contract.params.serverPubKey;
+      if (!serverPubKey) continue;
+      const cls = classifyAgainstSignerSet(serverPubKey, signerSet, nowSeconds);
+      if (cls.status === "CURRENT") continue;
+      const recoverable = vtxos.filter((v) => isRecoverable(v));
+      const spendable = vtxos.filter((v) => isSpendable(v) && !isRecoverable(v));
+      const value = spendable.reduce((sum, v) => sum + v.value, 0);
+      let recoverableCount = 0;
+      let recoverableValue = 0;
+      let awaitingSweepCount = 0;
+      let awaitingSweepValue = 0;
+      let nextSweepEta;
+      if (cls.status === "EXPIRED") {
+        recoverableCount = recoverable.length;
+        recoverableValue = recoverable.reduce((sum, v) => sum + v.value, 0);
+        awaitingSweepCount = spendable.length;
+        awaitingSweepValue = value;
+        for (const v of spendable) {
+          const exp = v.virtualStatus.batchExpiry;
+          if (exp !== void 0 && (nextSweepEta === void 0 || exp < nextSweepEta)) {
+            nextSweepEta = exp;
+          }
+        }
+      }
+      const existing = reportsBySigner.get(cls.signerPubKey);
+      if (existing) {
+        existing.vtxoCount += spendable.length;
+        existing.totalValue += value;
+        existing.recoverableCount += recoverableCount;
+        existing.recoverableValue += recoverableValue;
+        existing.awaitingSweepCount += awaitingSweepCount;
+        existing.awaitingSweepValue += awaitingSweepValue;
+        if (nextSweepEta !== void 0) {
+          existing.nextSweepEta = existing.nextSweepEta === void 0 ? nextSweepEta : Math.min(existing.nextSweepEta, nextSweepEta);
+        }
+      } else {
+        reportsBySigner.set(cls.signerPubKey, {
+          signerPubKey: cls.signerPubKey,
+          status: cls.status,
+          cutoffDate: cls.cutoffDate,
+          secondsUntilCutoff: cls.secondsUntilCutoff,
+          vtxoCount: spendable.length,
+          totalValue: value,
+          boardingCount: 0,
+          boardingValue: 0,
+          recoverableCount,
+          recoverableValue,
+          awaitingSweepCount,
+          awaitingSweepValue,
+          nextSweepEta
+        });
+      }
+      if (isCooperativelyMigratable(cls.status)) {
+        for (const v of spendable) {
+          if (!v.virtualStatus.batchExpiry) continue;
+          migratable.push({ vtxo: v, classification: cls });
+        }
+      } else if (cls.status === "EXPIRED") {
+        for (const v of spendable) expired.push({ vtxo: v, classification: cls });
+      }
+    }
+    return {
+      reports: Array.from(reportsBySigner.values()),
+      migratable,
+      expired
+    };
+  }
+  /**
+   * Boarding sibling of {@link classifyDeprecatedSignerContracts} (Section 7):
+   * fan out over the wallet's boarding addresses (current + historical), group
+   * the on-chain UTXOs per address, classify each address's signer against the
+   * fresh signer set, and split the confirmed boarding coins into cooperatively-
+   * migratable and cutoff-expired sets while building the per-signer report.
+   *
+   * Discovery sees the active signer plus EVERY deprecated key (EXPIRED
+   * included), so expired-signer boarding is still reported; migration
+   * eligibility is gated afterwards by {@link isCooperativelyMigratable} and a
+   * per-row boarding-output CSV check — never by the fetch. Current-signer
+   * coins are classified `CURRENT` and ignored; foreign-ASP rows are excluded
+   * because their keys are not in the signer set.
+   */
+  async classifyDeprecatedSignerBoarding(info) {
+    const wallet = this.requireMigrationCapableWallet();
+    const signerSet = signerSetFromInfo(info);
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const allowed = /* @__PURE__ */ new Set([signerSet.active, ...signerSet.deprecated.keys()]);
+    const groups = await wallet.getBoardingUtxosForSigners(allowed);
+    let chainTipHeight;
+    if (groups.some((g) => g.csvTimelock.type === "blocks")) {
+      const tip = await wallet.onchainProvider.getChainTip();
+      chainTipHeight = tip.height;
+    }
+    const reportsBySigner = /* @__PURE__ */ new Map();
+    const migratable = [];
+    const expired = [];
+    for (const group of groups) {
+      const cls = classifyAgainstSignerSet(group.serverPubKey, signerSet, nowSeconds);
+      if (cls.status === "CURRENT") continue;
+      const confirmed = group.coins.filter((c) => c.status.confirmed);
+      if (confirmed.length === 0) continue;
+      const value = confirmed.reduce((sum, c) => sum + c.value, 0);
+      const existing = reportsBySigner.get(cls.signerPubKey);
+      if (existing) {
+        existing.boardingCount += confirmed.length;
+        existing.boardingValue += value;
+      } else {
+        reportsBySigner.set(cls.signerPubKey, {
+          signerPubKey: cls.signerPubKey,
+          status: cls.status,
+          cutoffDate: cls.cutoffDate,
+          secondsUntilCutoff: cls.secondsUntilCutoff,
+          vtxoCount: 0,
+          totalValue: 0,
+          boardingCount: confirmed.length,
+          boardingValue: value,
+          // Boarding UTXOs don't carry an offchain sweep lifecycle; the
+          // post-cutoff recover-on-sweep fields apply to VTXOs only and
+          // are merged in from the VTXO classifier (mergeSignerReports).
+          recoverableCount: 0,
+          recoverableValue: 0,
+          awaitingSweepCount: 0,
+          awaitingSweepValue: 0
+        });
+      }
+      for (const coin of confirmed) {
+        const boardingExpired = hasBoardingTxExpired(
+          coin,
+          group.csvTimelock,
+          chainTipHeight
+        );
+        if (isCooperativelyMigratable(cls.status) && !boardingExpired) {
+          migratable.push({ coin, classification: cls });
+        } else if (cls.status === "EXPIRED") {
+          expired.push({ coin, classification: cls });
+        }
+      }
+    }
+    return {
+      reports: Array.from(reportsBySigner.values()),
+      migratable,
+      expired
+    };
+  }
+  /**
+   * Automatic migration pass invoked from the poll loop. Self-contained:
+   * respects an exponential cooldown and logs failures rather than throwing,
+   * so a persistently failing migration backs off instead of re-submitting
+   * an identical intent every cycle.
+   */
+  async runMigrationPass() {
+    const cooldownMs = Math.min(
+      _VtxoManager.MIGRATION_COOLDOWN_MS * Math.pow(2, this.consecutiveMigrationFailures),
+      _VtxoManager.MIGRATION_MAX_BACKOFF_MS
+    );
+    if (Date.now() - this.lastMigrationTimestamp < cooldownMs) return;
+    try {
+      const report = await this.migrateCore();
+      const legError = report.vtxos?.error ?? report.boarding?.error;
+      if (legError) {
+        this.consecutiveMigrationFailures++;
+        console.error("Deprecated-signer migration leg failed:", legError);
+      } else {
+        this.consecutiveMigrationFailures = 0;
+      }
+    } catch (e) {
+      this.consecutiveMigrationFailures++;
+      console.error("Error during deprecated-signer migration:", e);
+    } finally {
+      this.lastMigrationTimestamp = Date.now();
+    }
+  }
+  /** Asserts migration capability and returns the typed wallet. */
+  requireMigrationCapableWallet() {
+    if (!isMigrationCapable(this.wallet)) {
+      throw new Error(
+        "Deprecated-signer migration requires a Wallet instance with arkProvider, arkServerPublicKey, and rotateServerSigner"
+      );
+    }
+    return this.wallet;
+  }
+  /**
+   * If the wallet's own construction-time signer snapshot has been deprecated,
+   * re-derive its receive/boarding state under the active signer so any output
+   * built afterwards commits to the active key. No-op when the snapshot is
+   * already current. Returns whether a rotation was applied. Treats an
+   * unknown-signer snapshot as "do not rotate" (caller decides).
+   *
+   * Shared by the migration pass (where the wallet's own snapshot is the thing
+   * being migrated) and the recovery/renewal/periodic-settle paths (via
+   * {@link rotateForRecoverableInputs}), so a swept old-signer VTXO recovered
+   * after cutoff re-mints under the active signer rather than re-committing to
+   * the deprecated key (Section 6 / post-cutoff). `rotateServerSigner` is
+   * idempotent and serializes itself against HD receive rotation, so repeated
+   * calls across passes are safe.
+   */
+  async ensureReceiveOnActiveSigner(info) {
+    const wallet = this.requireMigrationCapableWallet();
+    const signerSet = signerSetFromInfo(info);
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const walletClass = classifyAgainstSignerSet(
+      base.hex.encode(wallet.arkServerPublicKey),
+      signerSet,
+      nowSeconds
+    );
+    if (walletClass.status === "CURRENT" || walletClass.status === "UNKNOWN_SIGNER") {
+      return false;
+    }
+    await wallet.rotateServerSigner(base.hex.decode(info.signerPubkey), info.checkpointTapscript);
+    return true;
+  }
+  /**
+   * Rotation guard for the recovery-bearing settle paths (recover / renew /
+   * periodic settle). Pins the wallet's receive snapshot to the active signer
+   * before they build their output, but ONLY when this pass actually carries
+   * an input minted under a deprecated signer — so a routine current-signer
+   * settle on a long-lived pre-rotation instance does not eagerly rotate.
+   *
+   * Cheap in the common case: a watch-only/proxy wallet (not migration-capable)
+   * and a current/unknown wallet snapshot both short-circuit before the
+   * contract round-trip, so the only instance that pays for the input scan is
+   * the long-lived deprecated-snapshot one that genuinely needs rotating.
+   *
+   * Runs OUTSIDE any `renewalInProgress` window the caller sets, and
+   * `rotateServerSigner` does not depend on that flag, so it cannot deadlock
+   * against the receive rotator. Returns whether a rotation was applied.
+   */
+  async rotateForRecoverableInputs(inputs, info) {
+    if (!isMigrationCapable(this.wallet)) return false;
+    const signerSet = signerSetFromInfo(info);
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const walletClass = classifyAgainstSignerSet(
+      base.hex.encode(this.wallet.arkServerPublicKey),
+      signerSet,
+      nowSeconds
+    );
+    if (walletClass.status === "CURRENT" || walletClass.status === "UNKNOWN_SIGNER") {
+      return false;
+    }
+    if (!await this.anyInputUnderDeprecatedSigner(inputs, signerSet, nowSeconds)) {
+      return false;
+    }
+    return this.ensureReceiveOnActiveSigner(info);
+  }
+  /**
+   * Whether any of the given input outpoints belongs to a contract whose
+   * server signer classifies as non-`CURRENT` against the fresh signer set —
+   * i.e. a deprecated-signer (incl. EXPIRED) input. Maps outpoints to their
+   * owning contract via the ContractManager so it works on the typed
+   * {@link ExtendedVirtualCoin}/{@link ExtendedCoin} inputs the recovery paths
+   * carry (which don't expose `contractScript`).
+   */
+  async anyInputUnderDeprecatedSigner(inputs, signerSet, nowSeconds) {
+    if (inputs.length === 0) return false;
+    const wanted = new Set(inputs.map((i) => `${i.txid}:${i.vout}`));
+    const cm = await this.wallet.getContractManager();
+    const contractsWithVtxos = await cm.getContractsWithVtxos({
+      type: ["default", "delegate"]
+    });
+    for (const { contract, vtxos } of contractsWithVtxos) {
+      const serverPubKey = contract.params.serverPubKey;
+      if (!serverPubKey) continue;
+      if (classifyAgainstSignerSet(serverPubKey, signerSet, nowSeconds).status === "CURRENT") {
+        continue;
+      }
+      for (const v of vtxos) {
+        if (wanted.has(`${v.txid}:${v.vout}`)) return true;
+      }
+    }
+    return false;
+  }
   // ========== Private Helpers ==========
   /** Asserts sweep capability and returns the typed wallet. */
   getSweepWallet() {
@@ -2926,6 +3530,16 @@ var VtxoManager = class _VtxoManager {
   getArkProvider() {
     return this.getSweepWallet().arkProvider;
   }
+  /**
+   * Read-only access to the ark provider for fetching server limits. Unlike
+   * {@link getArkProvider}, this does not require full boarding-sweep
+   * capability — recovery and renewal only need it to read `vtxoMaxAmount`.
+   * Returns undefined when no provider is wired, which callers treat as
+   * "no limit".
+   */
+  getInfoProvider() {
+    return this.wallet.arkProvider;
+  }
   /** Returns the Bitcoin network configuration from the wallet. */
   getNetwork() {
     return this.getSweepWallet().network;
@@ -3030,7 +3644,7 @@ var VtxoManager = class _VtxoManager {
    * or doesn't carry the metadata.
    */
   extractSpentOutpoint(error) {
-    const ark = chunkFSAXPBGP_cjs.maybeArkError(error);
+    const ark = chunkC6OODRWD_cjs.maybeArkError(error);
     if (!ark || ark.name !== "VTXO_ALREADY_SPENT") return void 0;
     const raw = ark.metadata?.vtxo_outpoint;
     if (typeof raw !== "string") return void 0;
@@ -3127,6 +3741,10 @@ var VtxoManager = class _VtxoManager {
             }
           }
         }
+        const migrationEnabled = this.settlementConfig !== false && (this.settlementConfig?.deprecatedSignerMigration ?? DEFAULT_SETTLEMENT_CONFIG.deprecatedSignerMigration);
+        if (migrationEnabled && isMigrationCapable(this.wallet)) {
+          await this.runMigrationPass();
+        }
       });
     } catch (e) {
       hadError = true;
@@ -3195,7 +3813,8 @@ var VtxoManager = class _VtxoManager {
       return;
     }
     const dustAmount = getDustAmount(this.wallet);
-    const { fees } = await this.getArkProvider().getInfo();
+    const info = await this.getArkProvider().getInfo();
+    const { fees, vtxoMaxAmount } = info;
     const estimator = new Estimator(fees.intentFee);
     let totalAmount = 0n;
     const filteredBoarding = [];
@@ -3224,12 +3843,19 @@ var VtxoManager = class _VtxoManager {
       if (inputFee.satoshis >= v.value) {
         continue;
       }
+      const net = BigInt(v.value) - BigInt(inputFee.satoshis);
+      if (vtxoMaxAmount >= 0n && totalAmount + net > vtxoMaxAmount) {
+        continue;
+      }
       filteredVtxos.push(v);
-      totalAmount += BigInt(v.value) - BigInt(inputFee.satoshis);
+      totalAmount += net;
     }
     if (filteredBoarding.length === 0 && filteredVtxos.length === 0) {
       return;
     }
+    if (isMigrationCapable(this.wallet)) {
+      await this.rotateForRecoverableInputs([...filteredBoarding, ...filteredVtxos], info);
+    }
     const arkAddress = await this.wallet.getAddress();
     const outputFee = estimator.evalOffchainOutput({
       amount: totalAmount,
@@ -3292,7 +3918,6 @@ var VtxoManager = class _VtxoManager {
         clearTimeout(timer);
       }
       const subscription = await this.contractEventsSubscriptionReady;
-      this.contractEventsSubscription = void 0;
       subscription?.();
     })();
     return this.disposePromise;
@@ -3833,15 +4458,17 @@ async function buildTransactionHistory(vtxos, allBoardingTxs, commitmentsToIgnor
           txTime = getTxCreatedAt ? await getTxCreatedAt(vtxo.arkTxId) ?? vtxo.createdAt.getTime() + 1 : vtxo.createdAt.getTime() + 1;
         }
         const assets = subtractAssets(allSpent, changes);
-        sent.push({
-          key: { ...txKey, arkTxid: vtxo.arkTxId },
-          tag: "offchain",
-          type: "SENT" /* TxSent */,
-          amount: txAmount,
-          settled: true,
-          createdAt: txTime,
-          ...assets && { assets }
-        });
+        if (txAmount !== 0 || assets) {
+          sent.push({
+            key: { ...txKey, arkTxid: vtxo.arkTxId },
+            tag: "offchain",
+            type: "SENT" /* TxSent */,
+            amount: txAmount,
+            settled: true,
+            createdAt: txTime,
+            ...assets && { assets }
+          });
+        }
       }
       if (vtxo.settledBy && !commitmentsToIgnore.has(vtxo.settledBy) && !sent.some((s) => s.key.commitmentTxid === vtxo.settledBy)) {
         const changes = fromOldestVtxo.filter(
@@ -3928,7 +4555,7 @@ var AssetManager = class extends ReadonlyAssetManager {
     const virtualCoins = await this.wallet.getVtxos({
       withRecoverable: false
     });
-    const controlAssetRef = params.controlAssetId ? chunkFSAXPBGP_cjs.AssetRef.fromId(chunkFSAXPBGP_cjs.AssetId.fromString(params.controlAssetId)) : null;
+    const controlAssetRef = params.controlAssetId ? chunkC6OODRWD_cjs.AssetRef.fromId(chunkC6OODRWD_cjs.AssetId.fromString(params.controlAssetId)) : null;
     const coinSelection = selectVirtualCoins(virtualCoins, Number(this.wallet.dustAmount));
     let totalBtcSelected = 0n;
     const assetChanges = /* @__PURE__ */ new Map();
@@ -3941,8 +4568,8 @@ var AssetManager = class extends ReadonlyAssetManager {
       }
     }
     const groups = [];
-    const issuedAssetOutput = chunkFSAXPBGP_cjs.AssetOutput.create(0, params.amount);
-    const issuedAssetGroup = chunkFSAXPBGP_cjs.AssetGroup.create(
+    const issuedAssetOutput = chunkC6OODRWD_cjs.AssetOutput.create(0, params.amount);
+    const issuedAssetGroup = chunkC6OODRWD_cjs.AssetGroup.create(
       null,
       controlAssetRef,
       [],
@@ -3957,15 +4584,15 @@ var AssetManager = class extends ReadonlyAssetManager {
         for (const [inputIndex, assets] of assetInputs) {
           for (const asset of assets) {
             if (asset.assetId !== assetId) continue;
-            changeInputs.push(chunkFSAXPBGP_cjs.AssetInput.create(inputIndex, asset.amount));
+            changeInputs.push(chunkC6OODRWD_cjs.AssetInput.create(inputIndex, asset.amount));
           }
         }
         groups.push(
-          chunkFSAXPBGP_cjs.AssetGroup.create(
-            chunkFSAXPBGP_cjs.AssetId.fromString(assetId),
+          chunkC6OODRWD_cjs.AssetGroup.create(
+            chunkC6OODRWD_cjs.AssetId.fromString(assetId),
             null,
             changeInputs,
-            [chunkFSAXPBGP_cjs.AssetOutput.create(0, amount)],
+            [chunkC6OODRWD_cjs.AssetOutput.create(0, amount)],
             []
           )
         );
@@ -3978,7 +4605,7 @@ var AssetManager = class extends ReadonlyAssetManager {
         script: outputAddress.pkScript,
         amount: BigInt(totalBtcSelected)
       },
-      Extension.create([chunkFSAXPBGP_cjs.Packet.create(groups)]).txOut()
+      Extension.create([chunkC6OODRWD_cjs.Packet.create(groups)]).txOut()
     ];
     const { arkTxid } = await this.wallet.buildAndSubmitOffchainTx(
       coinSelection.inputs,
@@ -3986,7 +4613,7 @@ var AssetManager = class extends ReadonlyAssetManager {
     );
     return {
       arkTxId: arkTxid,
-      assetId: chunkFSAXPBGP_cjs.AssetId.create(arkTxid, 0).toString()
+      assetId: chunkC6OODRWD_cjs.AssetId.create(arkTxid, 0).toString()
     };
   }
   /**
@@ -4058,16 +4685,16 @@ var AssetManager = class extends ReadonlyAssetManager {
     for (const [inputIndex, assets] of assetInputs) {
       for (const asset of assets) {
         if (asset.assetId !== params.assetId) continue;
-        reissueInputs.push(chunkFSAXPBGP_cjs.AssetInput.create(inputIndex, asset.amount));
+        reissueInputs.push(chunkC6OODRWD_cjs.AssetInput.create(inputIndex, asset.amount));
       }
     }
     const totalAssetAmount = assetToReissueAmount + params.amount;
-    const reissueAssetIdObj = chunkFSAXPBGP_cjs.AssetId.fromString(params.assetId);
-    const reissueAssetGroup = chunkFSAXPBGP_cjs.AssetGroup.create(
+    const reissueAssetIdObj = chunkC6OODRWD_cjs.AssetId.fromString(params.assetId);
+    const reissueAssetGroup = chunkC6OODRWD_cjs.AssetGroup.create(
       reissueAssetIdObj,
       null,
       reissueInputs,
-      [chunkFSAXPBGP_cjs.AssetOutput.create(0, totalAssetAmount)],
+      [chunkC6OODRWD_cjs.AssetOutput.create(0, totalAssetAmount)],
       []
     );
     const groups = [reissueAssetGroup];
@@ -4076,15 +4703,15 @@ var AssetManager = class extends ReadonlyAssetManager {
       for (const [inputIndex, assets] of assetInputs) {
         for (const asset of assets) {
           if (asset.assetId !== assetId) continue;
-          changeInputs.push(chunkFSAXPBGP_cjs.AssetInput.create(inputIndex, asset.amount));
+          changeInputs.push(chunkC6OODRWD_cjs.AssetInput.create(inputIndex, asset.amount));
         }
       }
       groups.push(
-        chunkFSAXPBGP_cjs.AssetGroup.create(
-          chunkFSAXPBGP_cjs.AssetId.fromString(assetId),
+        chunkC6OODRWD_cjs.AssetGroup.create(
+          chunkC6OODRWD_cjs.AssetId.fromString(assetId),
           null,
           changeInputs,
-          [chunkFSAXPBGP_cjs.AssetOutput.create(0, amount)],
+          [chunkC6OODRWD_cjs.AssetOutput.create(0, amount)],
           []
         )
       );
@@ -4096,7 +4723,7 @@ var AssetManager = class extends ReadonlyAssetManager {
         script: outputAddress.pkScript,
         amount: BigInt(totalBtcSelected)
       },
-      Extension.create([chunkFSAXPBGP_cjs.Packet.create(groups)]).txOut()
+      Extension.create([chunkC6OODRWD_cjs.Packet.create(groups)]).txOut()
     ];
     const { arkTxid } = await this.wallet.buildAndSubmitOffchainTx(selectedCoins, outputs);
     return arkTxid;
@@ -4163,15 +4790,15 @@ var AssetManager = class extends ReadonlyAssetManager {
       for (const [inputIndex, assets] of assetInputs) {
         for (const asset of assets) {
           if (asset.assetId !== assetId) continue;
-          changeInputs.push(chunkFSAXPBGP_cjs.AssetInput.create(inputIndex, asset.amount));
+          changeInputs.push(chunkC6OODRWD_cjs.AssetInput.create(inputIndex, asset.amount));
         }
       }
       groups.push(
-        chunkFSAXPBGP_cjs.AssetGroup.create(
-          chunkFSAXPBGP_cjs.AssetId.fromString(assetId),
+        chunkC6OODRWD_cjs.AssetGroup.create(
+          chunkC6OODRWD_cjs.AssetId.fromString(assetId),
           null,
           changeInputs,
-          amount > 0n ? [chunkFSAXPBGP_cjs.AssetOutput.create(0, amount)] : [],
+          amount > 0n ? [chunkC6OODRWD_cjs.AssetOutput.create(0, amount)] : [],
           []
         )
       );
@@ -4183,7 +4810,7 @@ var AssetManager = class extends ReadonlyAssetManager {
         script: outputAddress.pkScript,
         amount: BigInt(totalBtcSelected)
       },
-      Extension.create([chunkFSAXPBGP_cjs.Packet.create(groups)]).txOut()
+      Extension.create([chunkC6OODRWD_cjs.Packet.create(groups)]).txOut()
     ];
     const { arkTxid } = await this.wallet.buildAndSubmitOffchainTx(selectedCoins, outputs);
     return arkTxid;
@@ -4208,7 +4835,7 @@ function castMetadata(metadata) {
     } else {
       throw new Error("Invalid metadata value type");
     }
-    md.push(chunkFSAXPBGP_cjs.Metadata.create(textEncoder.encode(key), valueBytes));
+    md.push(chunkC6OODRWD_cjs.Metadata.create(textEncoder.encode(key), valueBytes));
   }
   return md;
 }
@@ -4493,7 +5120,7 @@ async function makeSignedDelegateIntent(identity, coins, outputs, onchainOutputs
     expire_at: 0,
     cosigners_public_keys: cosignerPubKeys
   };
-  const proof = chunkFSAXPBGP_cjs.Intent.create(message, coins, outputs);
+  const proof = chunkC6OODRWD_cjs.Intent.create(message, coins, outputs);
   const signedProof = await identity.sign(proof);
   return {
     proof: base.base64.encode(signedProof.toPSBT()),
@@ -6014,6 +6641,16 @@ function isDiscoverable(handler) {
 }
 
 // src/contracts/contractWatcher.ts
+function computeReconnectDelay(attempt, baseMs, maxMs) {
+  return Math.min(baseMs * Math.pow(2, attempt - 1), maxMs);
+}
+var DEFAULT_CONTRACT_WATCHER_CONFIG = {
+  failsafePollIntervalMs: 2e4,
+  reconnectDelayMs: 1e3,
+  maxReconnectDelayMs: 5e3,
+  maxReconnectAttempts: 0
+  // unlimited
+};
 var ContractWatcher = class {
   config;
   contracts = /* @__PURE__ */ new Map();
@@ -6033,14 +6670,7 @@ var ContractWatcher = class {
    */
   constructor(config) {
     this.config = {
-      failsafePollIntervalMs: 6e4,
-      // 1 minute
-      reconnectDelayMs: 1e3,
-      // 1 second
-      maxReconnectDelayMs: 3e4,
-      // 30 seconds
-      maxReconnectAttempts: 0,
-      // unlimited
+      ...DEFAULT_CONTRACT_WATCHER_CONFIG,
       ...config
     };
   }
@@ -6233,7 +6863,7 @@ var ContractWatcher = class {
       this.connectionState = "connected";
       this.reconnectAttempts = 0;
       this.listenLoop().catch((e) => {
-        if (chunkFSAXPBGP_cjs.isEventSourceError(e)) {
+        if (chunkC6OODRWD_cjs.isEventSourceError(e)) {
           console.debug("ContractWatcher subscription disconnected; reconnecting");
         } else {
           console.error(e);
@@ -6268,8 +6898,9 @@ var ContractWatcher = class {
     }
     this.connectionState = "reconnecting";
     this.reconnectAttempts++;
-    const delay = Math.min(
-      this.config.reconnectDelayMs * Math.pow(2, this.reconnectAttempts - 1),
+    const delay = computeReconnectDelay(
+      this.reconnectAttempts,
+      this.config.reconnectDelayMs,
       this.config.maxReconnectDelayMs
     );
     this.reconnectTimeoutId = setTimeout(() => {
@@ -7640,6 +8271,22 @@ var WalletReceiveRotator = class _WalletReceiveRotator {
   async drain() {
     await this.chain.catch(() => void 0);
   }
+  /**
+   * Run `fn` on the rotator's serialization chain, so it cannot interleave
+   * with a receive `rotate()`. Used by {@link Wallet.rotateServerSigner} to
+   * serialize server-signer rotation against HD receive rotation: both
+   * rebuild and swap `offchainTapscript`, so running them concurrently could
+   * tear the wallet's visible receive state. The chain keeps advancing even
+   * if `fn` rejects (its own caller still sees the rejection).
+   */
+  runExclusive(fn) {
+    const run = this.chain.catch(() => void 0).then(fn);
+    this.chain = run.then(
+      () => void 0,
+      () => void 0
+    );
+    return run;
+  }
   /**
    * Tear down the subscription first so no late `vtxo_received` event
    * can queue work on a disposing wallet, then drain any in-flight
@@ -7997,7 +8644,6 @@ var ReadonlyWallet = class _ReadonlyWallet {
     this.network = network;
     this.onchainProvider = onchainProvider;
     this.indexerProvider = indexerProvider;
-    this.arkServerPublicKey = arkServerPublicKey;
     this.dustAmount = dustAmount;
     this.walletRepository = walletRepository;
     this.contractRepository = contractRepository;
@@ -8014,6 +8660,7 @@ var ReadonlyWallet = class _ReadonlyWallet {
     }
     this._offchainTapscript = offchainTapscript;
     this._boardingTapscript = boardingTapscript;
+    this._arkServerPublicKey = arkServerPublicKey;
     this.watcherConfig = watcherConfig;
     this._assetManager = new ReadonlyAssetManager(this.indexerProvider);
     this.walletContractTimelocks = walletContractTimelocks && walletContractTimelocks.length > 0 ? dedupeTimelocks(walletContractTimelocks) : [this.offchainTapscript.options.csvTimelock];
@@ -8022,7 +8669,6 @@ var ReadonlyWallet = class _ReadonlyWallet {
   _contractManagerInitializing;
   watcherConfig;
   _assetManager;
-  _syncVtxosInflight;
   walletContractTimelocks;
   // Outpoints ("txid:vout") committed to an in-flight settle/send. Filtered
   // from getVtxos() so concurrent callers (UI, VtxoManager auto-renewal,
@@ -8051,6 +8697,59 @@ var ReadonlyWallet = class _ReadonlyWallet {
    * it stays the index-0 baseline for their lifetime.
    */
   _boardingTapscript;
+  /**
+   * Backing field for the active server signer (x-only, 32 bytes). Read via
+   * the public {@link arkServerPublicKey} getter; written only by
+   * {@link Wallet.setArkServerPublicKeyForRotation}, the sanctioned
+   * server-signer rotation write path (analogue of `_offchainTapscript`). It
+   * is a *current value*, not a fixed constructor constant, because
+   * mid-session server-signer rotation (plan §4) swaps it when arkd rotates
+   * its active signer. Wallets that never span a rotation keep their
+   * construction-time snapshot for their lifetime.
+   */
+  _arkServerPublicKey;
+  /**
+   * x-only hex of the operator's deprecated signer keys (from
+   * `ArkInfo.deprecatedSigners`), cached for the OFFLINE read/watch paths.
+   * The boarding watch/history surfaces ({@link getBoardingAddresses},
+   * {@link getBoardingTxs}) fan out over {current} ∪ this set so a deposit at
+   * a boarding address minted under a now-rotated operator signer keeps being
+   * watched. Refreshed from the server-info snapshot at construction (via the
+   * create() factories) and on a detected signer change. Deliberately NOT
+   * consulted by the spend path — {@link getBoardingUtxos} stays
+   * current-signer-only (a deprecated-signer input in a plain settle() is
+   * rejected; old-signer recovery goes through the migration API).
+   */
+  _deprecatedSigners = /* @__PURE__ */ new Map();
+  /**
+   * Refresh the cached deprecated-signer set from a fresh server-info
+   * snapshot. Called by the create() factories at construction and by the
+   * server-info-change handler mid-session. Lenient: a malformed deprecated
+   * entry is skipped, never fatal to wallet creation.
+   */
+  refreshDeprecatedSigners(info) {
+    const next = /* @__PURE__ */ new Map();
+    for (const s of info.deprecatedSigners ?? []) {
+      if (!s.pubkey) continue;
+      try {
+        next.set(toXOnlySignerHex(s.pubkey), s.cutoffDate ?? 0n);
+      } catch (e) {
+        console.warn("Skipping malformed deprecated signer pubkey", s.pubkey, e);
+      }
+    }
+    this._deprecatedSigners = next;
+  }
+  /**
+   * The signer set the boarding WATCH/HISTORY paths fan out over: the wallet's
+   * current signer plus every cached deprecated signer. Distinct from the
+   * spend path, which is current-signer-only.
+   */
+  watchedBoardingSigners() {
+    return /* @__PURE__ */ new Set([
+      toXOnlySignerHex(base.hex.encode(this.boardingTapscript.options.serverPubKey)),
+      ...this._deprecatedSigners.keys()
+    ]);
+  }
   /**
    * Currently-active receive tapscript. Read-only from the outside;
    * mutated only via {@link Wallet.setOffchainTapscriptForRotation}
@@ -8059,6 +8758,16 @@ var ReadonlyWallet = class _ReadonlyWallet {
   get offchainTapscript() {
     return this._offchainTapscript;
   }
+  /**
+   * The wallet's current active server signer (x-only, 32 bytes). Read-only
+   * from the outside; mutated only via
+   * {@link Wallet.setArkServerPublicKeyForRotation} during mid-session
+   * server-signer rotation (plan §4). Single-valued for wallets that never
+   * span a rotation.
+   */
+  get arkServerPublicKey() {
+    return this._arkServerPublicKey;
+  }
   /**
    * The wallet's current boarding tapscript (the on-chain onboarding
    * target). Read-only from the outside; mutated only via
@@ -8111,7 +8820,7 @@ var ReadonlyWallet = class _ReadonlyWallet {
    */
   static async setupWalletConfig(config, pubKey) {
     const arkadeServerUrl = getArkadeServerUrl(config);
-    const arkProvider = config.arkProvider || new chunkFSAXPBGP_cjs.RestArkProvider(arkadeServerUrl);
+    const arkProvider = config.arkProvider || new chunkC6OODRWD_cjs.RestArkProvider(arkadeServerUrl);
     let indexerProvider = config.indexerProvider;
     if (!indexerProvider) {
       let indexerUrl = config.indexerUrl;
@@ -8128,7 +8837,7 @@ var ReadonlyWallet = class _ReadonlyWallet {
           indexerUrl = arkadeServerUrl;
         }
       }
-      indexerProvider = new chunkFSAXPBGP_cjs.RestIndexerProvider(indexerUrl);
+      indexerProvider = new chunkC6OODRWD_cjs.RestIndexerProvider(indexerUrl);
     }
     const info = await arkProvider.getInfo();
     const network = chunkCMPJR3HS_cjs.getNetwork(info.network);
@@ -8217,7 +8926,7 @@ var ReadonlyWallet = class _ReadonlyWallet {
       throw new Error("Invalid configured public key");
     }
     const setup = await _ReadonlyWallet.setupWalletConfig(config, pubkey);
-    return new _ReadonlyWallet(
+    const wallet = new _ReadonlyWallet(
       config.identity,
       setup.network,
       setup.onchainProvider,
@@ -8232,6 +8941,8 @@ var ReadonlyWallet = class _ReadonlyWallet {
       config.watcherConfig,
       setup.walletContractTimelocks
     );
+    wallet.refreshDeprecatedSigners(setup.info);
+    return wallet;
   }
   get arkAddress() {
     return this.offchainTapscript.address(this.network.hrp, this.arkServerPublicKey);
@@ -8255,10 +8966,12 @@ var ReadonlyWallet = class _ReadonlyWallet {
    * Return the wallet's combined onchain and offchain balances.
    */
   async getBalance() {
-    const [boardingUtxos, vtxos] = await Promise.all([
+    const [boardingUtxos, vtxos, pendingOutpoints] = await Promise.all([
       this.getBoardingUtxos(),
-      this.getVtxos()
+      this.getVtxos(),
+      this.pendingRecoveryOutpoints()
     ]);
+    const isPendingRecovery = (coin) => pendingOutpoints.has(`${coin.txid}:${coin.vout}`);
     let confirmed = 0;
     let unconfirmed = 0;
     for (const utxo of boardingUtxos) {
@@ -8271,11 +8984,15 @@ var ReadonlyWallet = class _ReadonlyWallet {
     let settled = 0;
     let preconfirmed = 0;
     let recoverable = 0;
-    settled = vtxos.filter((coin) => coin.virtualStatus.state === "settled").reduce((sum, coin) => sum + coin.value, 0);
-    preconfirmed = vtxos.filter((coin) => coin.virtualStatus.state === "preconfirmed").reduce((sum, coin) => sum + coin.value, 0);
+    let pendingRecovery = 0;
+    settled = vtxos.filter((coin) => coin.virtualStatus.state === "settled" && !isPendingRecovery(coin)).reduce((sum, coin) => sum + coin.value, 0);
+    preconfirmed = vtxos.filter(
+      (coin) => coin.virtualStatus.state === "preconfirmed" && !isPendingRecovery(coin)
+    ).reduce((sum, coin) => sum + coin.value, 0);
     recoverable = vtxos.filter((coin) => isSpendable(coin) && coin.virtualStatus.state === "swept").reduce((sum, coin) => sum + coin.value, 0);
+    pendingRecovery = vtxos.filter(isPendingRecovery).reduce((sum, coin) => sum + coin.value, 0);
     const totalBoarding = confirmed + unconfirmed;
-    const totalOffchain = settled + preconfirmed + recoverable;
+    const totalOffchain = settled + preconfirmed + recoverable + pendingRecovery;
     const assetBalances = /* @__PURE__ */ new Map();
     for (const vtxo of vtxos) {
       if (!isSpendable(vtxo)) continue;
@@ -8300,6 +9017,7 @@ var ReadonlyWallet = class _ReadonlyWallet {
       preconfirmed,
       available: settled + preconfirmed,
       recoverable,
+      pendingRecovery,
       total: totalBoarding + totalOffchain,
       assets
     };
@@ -8326,6 +9044,23 @@ var ReadonlyWallet = class _ReadonlyWallet {
       return !!(f.withUnrolled && vtxo.isUnrolled);
     });
   }
+  /**
+   * Outpoints of VTXOs whose deprecated signer is past its cutoff (EXPIRED) and
+   * which have not yet been swept — unspendable until they recover. Offline:
+   * classifies the repo's contracts against the cached signer set (active +
+   * {@link _deprecatedSigners}, cutoffs included). Empty fast-path when no
+   * signer is deprecated. Consumed by {@link getBalance} (the `pendingRecovery`
+   * bucket) and the send coin-selection path so neither counts nor spends them.
+   */
+  async pendingRecoveryOutpoints() {
+    if (this._deprecatedSigners.size === 0) return /* @__PURE__ */ new Set();
+    const contractManager = await this.getContractManager();
+    const contractsWithVtxos = await contractManager.getContractsWithVtxos();
+    return selectPendingRecoveryOutpoints(contractsWithVtxos, {
+      active: toXOnlySignerHex(base.hex.encode(this.offchainTapscript.options.serverPubKey)),
+      deprecated: this._deprecatedSigners
+    });
+  }
   /**
    * Return wallet transaction history derived from Arkade state and boarding transactions.
    */
@@ -8352,7 +9087,7 @@ var ReadonlyWallet = class _ReadonlyWallet {
    * surfaced (plan §6-IV); {@link getBoardingAddress} stays single-valued.
    */
   async getBoardingAddresses() {
-    const tapscripts = await this.getBoardingTapscripts();
+    const tapscripts = await this.getBoardingTapscripts(this.watchedBoardingSigners());
     return tapscripts.map((t) => t.onchainAddress(this.network));
   }
   /**
@@ -8362,7 +9097,7 @@ var ReadonlyWallet = class _ReadonlyWallet {
   async getBoardingTxs() {
     const utxos = [];
     const commitmentsToIgnore = /* @__PURE__ */ new Set();
-    const tapscripts = await this.getBoardingTapscripts();
+    const tapscripts = await this.getBoardingTapscripts(this.watchedBoardingSigners());
     const outspendCache = /* @__PURE__ */ new Map();
     for (const tapscript of tapscripts) {
       const boardingAddress = tapscript.onchainAddress(this.network);
@@ -8437,8 +9172,15 @@ var ReadonlyWallet = class _ReadonlyWallet {
    * Always includes the index-0 baseline (identity x-only key), which covers
    * the degenerate equal-delay case where the index-0 boarding row is
    * coalesced onto a `default` row and so isn't a `boarding`-typed contract.
+   *
+   * @param allowedSigners - Optional set of x-only-hex server keys whose
+   *   persisted boarding rows are included. Defaults to `{current x-only
+   *   signer}`, preserving today's current-signer-only discovery (and the
+   *   foreign-ASP guard). The deprecated-signer migration path widens this to
+   *   reach old-signer boarding addresses. The index-0 baseline and the
+   *   current display tapscript are always included regardless of the set.
    */
-  async getBoardingTapscripts() {
+  async getBoardingTapscripts(allowedSigners) {
     const byScript = /* @__PURE__ */ new Map();
     const add = (s) => byScript.set(base.hex.encode(s.pkScript), s);
     const boardingCsv = this.boardingTapscript.options.csvTimelock ?? chunkGUTKJMSF_cjs.DefaultVtxo.Script.DEFAULT_TIMELOCK;
@@ -8451,11 +9193,12 @@ var ReadonlyWallet = class _ReadonlyWallet {
     );
     add(this.boardingTapscript);
     const serverPubKeyHex = base.hex.encode(this.boardingTapscript.options.serverPubKey);
+    const allowed = allowedSigners ?? /* @__PURE__ */ new Set([toXOnlySignerHex(serverPubKeyHex)]);
     const boardingContracts = await this.contractRepository.getContracts({
       type: ["boarding"]
     });
     for (const c of boardingContracts) {
-      if (c.params.serverPubKey !== serverPubKeyHex) continue;
+      if (!allowed.has(toXOnlySignerHex(c.params.serverPubKey))) continue;
       try {
         add(chunkGUTKJMSF_cjs.BoardingContractHandler.createScript(c.params));
       } catch (e) {
@@ -8465,23 +9208,61 @@ var ReadonlyWallet = class _ReadonlyWallet {
     return [...byScript.values()];
   }
   /**
-   * Fetch and cache onchain inputs (UTXOs) received at the wallet's boarding
-   * addresses — the current address plus any historical rotated boarding
-   * addresses that still hold unspent UTXOs (plan §6-III.1). Each UTXO is
-   * annotated with the tapscript of the address it actually sits on, so the
-   * spending path forfeits / exits it with the correct per-index leaves.
+   * Fetch and cache onchain inputs (UTXOs) received at the boarding addresses
+   * of the given signer set, grouped per boarding address so the caller keeps
+   * the address↔signer association that {@link ExtendedCoin} cannot carry
+   * (it retains only the encoded leaves/tapTree the spend needs, not the
+   * `DefaultVtxo.Script` and its `serverPubKey`/CSV delay).
+   *
+   * Per group it does exactly what {@link getBoardingUtxos} does per tapscript:
+   * `getCoins` → {@link extendCoinWithTapscript} → `saveUtxos`. Offline-first:
+   * it does not call `getInfo()`; the caller supplies the allowed signer set,
+   * so the only network calls are the per-address `getCoins`.
+   *
+   * @param allowedSigners - x-only-hex server keys whose boarding addresses to
+   *   fetch (passed through to {@link getBoardingTapscripts}).
    */
-  async getBoardingUtxos() {
-    const tapscripts = await this.getBoardingTapscripts();
-    const all = [];
+  async getBoardingUtxosForSigners(allowedSigners) {
+    const tapscripts = await this.getBoardingTapscripts(allowedSigners);
+    const groups = [];
     for (const tapscript of tapscripts) {
       const address = tapscript.onchainAddress(this.network);
       const coins = await this.onchainProvider.getCoins(address);
       const utxos = coins.map((utxo) => extendCoinWithTapscript(tapscript, utxo));
       await this.walletRepository.saveUtxos(address, utxos);
-      all.push(...utxos);
+      groups.push({
+        tapscript,
+        // Normalize so the group key matches the axis/contract x-only
+        // form regardless of how the tapscript's key was stored.
+        serverPubKey: toXOnlySignerHex(base.hex.encode(tapscript.options.serverPubKey)),
+        // Per-row CSV delay decoded from THIS tapscript's exit leaf —
+        // not the wallet's current boarding timelock, which a signer
+        // rotation may have changed.
+        csvTimelock: chunkCMPJR3HS_cjs.CSVMultisigTapscript.decode(base.hex.decode(tapscript.exitScript)).params.timelock,
+        coins: utxos
+      });
     }
-    return all;
+    return groups;
+  }
+  /**
+   * Fetch and cache onchain inputs (UTXOs) received at the wallet's boarding
+   * addresses — the current address plus any historical rotated boarding
+   * addresses that still hold unspent UTXOs (plan §6-III.1). Each UTXO is
+   * annotated with the tapscript of the address it actually sits on, so the
+   * spending path forfeits / exits it with the correct per-index leaves.
+   *
+   * Current-signer only: a flatten of {@link getBoardingUtxosForSigners} over
+   * the wallet's current signer, so the two paths cannot drift. Old-signer
+   * boarding recovery goes through the deprecated-signer migration API
+   * instead (it would otherwise pull EXPIRED-signer inputs into a plain
+   * `settle()` that the server must reject).
+   */
+  async getBoardingUtxos() {
+    const currentOnly = /* @__PURE__ */ new Set([
+      toXOnlySignerHex(base.hex.encode(this.boardingTapscript.options.serverPubKey))
+    ]);
+    const groups = await this.getBoardingUtxosForSigners(currentOnly);
+    return groups.flatMap((g) => g.coins);
   }
   /**
    * Subscribe to onchain and offchain notifications for newly received funds.
@@ -8688,64 +9469,82 @@ var ReadonlyWallet = class _ReadonlyWallet {
       watcherConfig: this.watcherConfig
     });
     const baselinePubkey = await this.identity.xOnlyPublicKey();
-    for (const csvTimelock of this.walletContractTimelocks) {
-      const csvTimelockStr = chunkCMPJR3HS_cjs.timelockToSequence(csvTimelock).toString();
-      const defaultScript = new chunkGUTKJMSF_cjs.DefaultVtxo.Script({
+    const delegatePubKey = this.offchainTapscript instanceof chunkGUTKJMSF_cjs.DelegateVtxo.Script ? this.offchainTapscript.options.delegatePubKey : void 0;
+    const baselineSigners = [
+      this.offchainTapscript.options.serverPubKey,
+      ...[...this._deprecatedSigners.keys()].map((h) => base.hex.decode(h))
+    ];
+    const seenBaselineScripts = /* @__PURE__ */ new Set();
+    for (const serverPubKey of baselineSigners) {
+      for (const csvTimelock of this.walletContractTimelocks) {
+        const csvTimelockStr = chunkCMPJR3HS_cjs.timelockToSequence(csvTimelock).toString();
+        const defaultScript = new chunkGUTKJMSF_cjs.DefaultVtxo.Script({
+          pubKey: baselinePubkey,
+          serverPubKey,
+          csvTimelock
+        });
+        const defaultScriptHex = base.hex.encode(defaultScript.pkScript);
+        if (!seenBaselineScripts.has(defaultScriptHex)) {
+          seenBaselineScripts.add(defaultScriptHex);
+          await ensureWalletContract(manager, {
+            type: "default",
+            params: {
+              pubKey: base.hex.encode(defaultScript.options.pubKey),
+              serverPubKey: base.hex.encode(serverPubKey),
+              csvTimelock: csvTimelockStr
+            },
+            script: defaultScriptHex,
+            address: defaultScript.address(this.network.hrp, serverPubKey).encode(),
+            state: "active"
+          });
+        }
+        if (delegatePubKey) {
+          const delegateScript = new chunkGUTKJMSF_cjs.DelegateVtxo.Script({
+            pubKey: baselinePubkey,
+            serverPubKey,
+            delegatePubKey,
+            csvTimelock
+          });
+          const delegateScriptHex = base.hex.encode(delegateScript.pkScript);
+          if (seenBaselineScripts.has(delegateScriptHex)) continue;
+          seenBaselineScripts.add(delegateScriptHex);
+          await manager.createContract({
+            type: "delegate",
+            params: {
+              pubKey: base.hex.encode(delegateScript.options.pubKey),
+              serverPubKey: base.hex.encode(serverPubKey),
+              delegatePubKey: base.hex.encode(delegateScript.options.delegatePubKey),
+              csvTimelock: csvTimelockStr
+            },
+            script: delegateScriptHex,
+            address: delegateScript.address(this.network.hrp, serverPubKey).encode(),
+            state: "active"
+          });
+        }
+      }
+    }
+    const boardingCsvTimelock = this.boardingTapscript.options.csvTimelock ?? chunkGUTKJMSF_cjs.DefaultVtxo.Script.DEFAULT_TIMELOCK;
+    for (const serverPubKey of baselineSigners) {
+      const baselineBoarding = new chunkGUTKJMSF_cjs.DefaultVtxo.Script({
         pubKey: baselinePubkey,
-        serverPubKey: this.offchainTapscript.options.serverPubKey,
-        csvTimelock
+        serverPubKey,
+        csvTimelock: boardingCsvTimelock
       });
-      const defaultScriptHex = base.hex.encode(defaultScript.pkScript);
+      const boardingScriptHex = base.hex.encode(baselineBoarding.pkScript);
+      if (seenBaselineScripts.has(boardingScriptHex)) continue;
+      seenBaselineScripts.add(boardingScriptHex);
       await ensureWalletContract(manager, {
-        type: "default",
+        type: "boarding",
         params: {
-          pubKey: base.hex.encode(defaultScript.options.pubKey),
-          serverPubKey: base.hex.encode(defaultScript.options.serverPubKey),
-          csvTimelock: csvTimelockStr
+          pubKey: base.hex.encode(baselineBoarding.options.pubKey),
+          serverPubKey: base.hex.encode(serverPubKey),
+          csvTimelock: chunkCMPJR3HS_cjs.timelockToSequence(boardingCsvTimelock).toString()
         },
-        script: defaultScriptHex,
-        address: defaultScript.address(this.network.hrp, this.arkServerPublicKey).encode(),
+        script: boardingScriptHex,
+        address: baselineBoarding.address(this.network.hrp, serverPubKey).encode(),
         state: "active"
       });
-      if (this.offchainTapscript instanceof chunkGUTKJMSF_cjs.DelegateVtxo.Script) {
-        const delegateScript = new chunkGUTKJMSF_cjs.DelegateVtxo.Script({
-          pubKey: baselinePubkey,
-          serverPubKey: this.offchainTapscript.options.serverPubKey,
-          delegatePubKey: this.offchainTapscript.options.delegatePubKey,
-          csvTimelock
-        });
-        const delegateScriptHex = base.hex.encode(delegateScript.pkScript);
-        await manager.createContract({
-          type: "delegate",
-          params: {
-            pubKey: base.hex.encode(delegateScript.options.pubKey),
-            serverPubKey: base.hex.encode(delegateScript.options.serverPubKey),
-            delegatePubKey: base.hex.encode(delegateScript.options.delegatePubKey),
-            csvTimelock: csvTimelockStr
-          },
-          script: delegateScriptHex,
-          address: delegateScript.address(this.network.hrp, this.arkServerPublicKey).encode(),
-          state: "active"
-        });
-      }
     }
-    const boardingCsvTimelock = this.boardingTapscript.options.csvTimelock ?? chunkGUTKJMSF_cjs.DefaultVtxo.Script.DEFAULT_TIMELOCK;
-    const baselineBoarding = new chunkGUTKJMSF_cjs.DefaultVtxo.Script({
-      pubKey: baselinePubkey,
-      serverPubKey: this.boardingTapscript.options.serverPubKey,
-      csvTimelock: boardingCsvTimelock
-    });
-    await ensureWalletContract(manager, {
-      type: "boarding",
-      params: {
-        pubKey: base.hex.encode(baselineBoarding.options.pubKey),
-        serverPubKey: base.hex.encode(baselineBoarding.options.serverPubKey),
-        csvTimelock: chunkCMPJR3HS_cjs.timelockToSequence(boardingCsvTimelock).toString()
-      },
-      script: base.hex.encode(baselineBoarding.pkScript),
-      address: baselineBoarding.address(this.network.hrp, this.arkServerPublicKey).encode(),
-      state: "active"
-    });
     return manager;
   }
   /** Dispose wallet-owned managers and release background resources. */
@@ -8778,7 +9577,6 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
       walletContractTimelocks
     );
     this.arkProvider = arkProvider;
-    this.serverUnrollScript = serverUnrollScript;
     this.forfeitOutputScript = forfeitOutputScript;
     this.forfeitPubkey = forfeitPubkey;
     this.identity = identity;
@@ -8799,6 +9597,7 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
       this.settlementConfig = { ...DEFAULT_SETTLEMENT_CONFIG };
     }
     this._delegateManager = delegateProvider ? new DelegateManagerImpl(delegateProvider, arkProvider, identity) : void 0;
+    this._serverUnrollScript = serverUnrollScript;
     this._receiveRotator = receiveRotator;
     this._descriptorProvider = descriptorProvider;
     this._signerRouter = new InputSignerRouter({
@@ -8824,6 +9623,43 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
    * the contract manager is up first.
    */
   _receiveRotator;
+  /**
+   * Unsubscribe handle for the arkProvider's `onServerInfoChanged` stream
+   * (mid-session signer-rotation detection). Torn down in {@link dispose}.
+   */
+  _serverInfoUnsub;
+  /**
+   * Tail of the serialized {@link handleServerInfoChanged} chain. Each
+   * `onServerInfoChanged` event chains onto it so handlers run one at a time,
+   * and {@link dispose} awaits it so an in-flight re-derive/rotation settles
+   * before the contract manager is torn down underneath it.
+   */
+  _serverInfoInFlight = Promise.resolve();
+  /**
+   * React to a mid-session server-info change (driven by the arkProvider's
+   * `DIGEST_MISMATCH` detection). First refresh the cached deprecated-signer
+   * set so the boarding WATCH path immediately widens to the just-deprecated
+   * signer, then — only if the active signer actually changed — rotate the
+   * wallet onto it via {@link rotateServerSigner} (re-deriving the offchain +
+   * boarding display tapscripts and registering the current-signer rows).
+   * Old-signer rows stay active, so existing funds remain watched. Failures
+   * are logged, never thrown back into the provider's emit loop.
+   */
+  async handleServerInfoChanged(info) {
+    this.refreshDeprecatedSigners(info);
+    try {
+      const newActive = toXOnlySignerHex(info.signerPubkey);
+      const current = toXOnlySignerHex(base.hex.encode(this.arkServerPublicKey));
+      if (newActive !== current) {
+        await this.rotateServerSigner(
+          base.hex.decode(info.signerPubkey),
+          info.checkpointTapscript
+        );
+      }
+    } catch (e) {
+      console.warn("server-signer rotation on info change failed", e);
+    }
+  }
   _receiveRotatorInstalled = false;
   /**
    * Descriptor-aware signer used by {@link _signerRouter} to sign
@@ -8853,6 +9689,44 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
     this._boardingTapscript = tapscript;
     this.notifyBoardingRotation();
   }
+  /**
+   * @internal Sole write path for `arkServerPublicKey` after construction.
+   * Called by {@link Wallet.rotateServerSigner} once the rotated offchain and
+   * boarding contract rows have been persisted. External code must treat
+   * `arkServerPublicKey` as read-only.
+   */
+  setArkServerPublicKeyForRotation(serverPubKey) {
+    this._arkServerPublicKey = serverPubKey;
+  }
+  /**
+   * Output script for checkpoint transactions, decoded from the server's
+   * `checkpointTapscript`. Server-controlled state: pinned at construction
+   * and re-sourced from a fresh `ArkInfo` on server-signer rotation. Read it
+   * through {@link serverUnrollScript}; write it only through
+   * {@link setServerUnrollScriptForRotation}.
+   */
+  _serverUnrollScript;
+  get serverUnrollScript() {
+    return this._serverUnrollScript;
+  }
+  /**
+   * @internal Sole write path for `serverUnrollScript` after construction.
+   * Called by {@link Wallet._doRotateServerSigner} with the checkpoint script
+   * sourced from the fresh `ArkInfo` that triggered the rotation, so the send
+   * path builds checkpoints against the new server epoch. External code must
+   * treat `serverUnrollScript` as read-only.
+   */
+  setServerUnrollScriptForRotation(script) {
+    this._serverUnrollScript = script;
+  }
+  /**
+   * Serializes {@link rotateServerSigner} for static / non-HD wallets (which
+   * have no {@link WalletReceiveRotator} chain to ride). Coalesces concurrent
+   * migration passes so two callers cannot both rebuild and swap the
+   * tapscripts. HD wallets serialize on the rotator's chain instead, via
+   * {@link WalletReceiveRotator.runExclusive}.
+   */
+  _serverRotationChain = Promise.resolve();
   /**
    * Allocate and return a *fresh* on-chain boarding address, rotating the
    * wallet's current boarding tapscript to a new HD index.
@@ -8909,6 +9783,126 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
     this.setBoardingTapscriptForRotation(newBoarding);
     return newBoarding.onchainAddress(this.network);
   }
+  /**
+   * Mid-session server-signer rotation (plan §4). When arkd rotates its
+   * active signer mid-session — the case the long-lived service worker and
+   * Expo background processes that own automatic migration must handle — a
+   * wallet constructed before the rotation keeps deriving old-signer receive
+   * addresses. Building a migration output to such an address would produce a
+   * VTXO the server must reject, so the wallet must first re-derive its own
+   * receive state under the new active signer.
+   *
+   * Follows the {@link WalletReceiveRotator.rotate} write-path pattern with
+   * the server key swapped instead of the user key: build the new offchain
+   * and boarding tapscripts locally (preserving every other option),
+   * register the matching `default`/`delegate` and `boarding` contract rows
+   * through {@link ContractManager.createContract}, and only then commit the
+   * new tapscripts and server key to the wallet's visible state. The signing
+   * metadata of the current receive/boarding rows is carried onto the new
+   * rows so a rotated (descriptor-backed) receive pubkey can still sign.
+   *
+   * The old-signer contract rows are intentionally left `active` and watched
+   * — they are exactly the deprecated-signer contracts the migration pass
+   * drains. Idempotent: a no-op when the wallet already tracks `xonly`.
+   *
+   * Serialized against HD receive rotation so the two paths (both of which
+   * rebuild and swap `offchainTapscript`) cannot interleave.
+   *
+   * @internal Invoked by the {@link VtxoManager} migration pass; not part of
+   * the stable public API.
+   */
+  async rotateServerSigner(newServerPubKey, checkpointTapscript) {
+    const xonly = toXOnlyPubKey(newServerPubKey);
+    let newServerUnrollScript;
+    try {
+      newServerUnrollScript = chunkCMPJR3HS_cjs.CSVMultisigTapscript.decode(base.hex.decode(checkpointTapscript));
+    } catch (e) {
+      throw new Error("Invalid checkpointTapscript from server");
+    }
+    if (utils_js.equalBytes(xonly, this.arkServerPublicKey)) return;
+    if (this._receiveRotator) {
+      await this._receiveRotator.runExclusive(
+        () => this._doRotateServerSigner(xonly, newServerUnrollScript)
+      );
+      return;
+    }
+    const run = this._serverRotationChain.catch(() => void 0).then(() => this._doRotateServerSigner(xonly, newServerUnrollScript));
+    this._serverRotationChain = run.then(
+      () => void 0,
+      () => void 0
+    );
+    return run;
+  }
+  async _doRotateServerSigner(xonly, newServerUnrollScript) {
+    if (utils_js.equalBytes(xonly, this.arkServerPublicKey)) return;
+    const manager = await this.getContractManager();
+    const [currentOffchainRow] = await manager.getContracts({
+      script: this.defaultContractScript
+    });
+    const currentBoardingScript = base.hex.encode(this._boardingTapscript.pkScript);
+    const [currentBoardingRow] = await manager.getContracts({
+      script: currentBoardingScript
+    });
+    const newOffchain = this.offchainTapscript instanceof chunkGUTKJMSF_cjs.DelegateVtxo.Script ? new chunkGUTKJMSF_cjs.DelegateVtxo.Script({
+      ...this.offchainTapscript.options,
+      serverPubKey: xonly
+    }) : new chunkGUTKJMSF_cjs.DefaultVtxo.Script({
+      ...this.offchainTapscript.options,
+      serverPubKey: xonly
+    });
+    const newBoarding = new chunkGUTKJMSF_cjs.DefaultVtxo.Script({
+      ...this._boardingTapscript.options,
+      serverPubKey: xonly
+    });
+    const offchainCsv = chunkCMPJR3HS_cjs.timelockToSequence(newOffchain.options.csvTimelock).toString();
+    const newOffchainScript = base.hex.encode(newOffchain.pkScript);
+    const newOffchainAddress = newOffchain.address(this.network.hrp, xonly).encode();
+    if (newOffchain instanceof chunkGUTKJMSF_cjs.DelegateVtxo.Script) {
+      await manager.createContract({
+        type: "delegate",
+        params: {
+          pubKey: base.hex.encode(newOffchain.options.pubKey),
+          serverPubKey: base.hex.encode(xonly),
+          delegatePubKey: base.hex.encode(newOffchain.options.delegatePubKey),
+          csvTimelock: offchainCsv
+        },
+        script: newOffchainScript,
+        address: newOffchainAddress,
+        state: "active",
+        metadata: currentOffchainRow?.metadata
+      });
+    } else {
+      await manager.createContract({
+        type: "default",
+        params: {
+          pubKey: base.hex.encode(newOffchain.options.pubKey),
+          serverPubKey: base.hex.encode(xonly),
+          csvTimelock: offchainCsv
+        },
+        script: newOffchainScript,
+        address: newOffchainAddress,
+        state: "active",
+        metadata: currentOffchainRow?.metadata
+      });
+    }
+    const boardingCsv = newBoarding.options.csvTimelock ?? chunkGUTKJMSF_cjs.DefaultVtxo.Script.DEFAULT_TIMELOCK;
+    await manager.createContract({
+      type: "boarding",
+      params: {
+        pubKey: base.hex.encode(newBoarding.options.pubKey),
+        serverPubKey: base.hex.encode(xonly),
+        csvTimelock: chunkCMPJR3HS_cjs.timelockToSequence(boardingCsv).toString()
+      },
+      script: base.hex.encode(newBoarding.pkScript),
+      address: newBoarding.address(this.network.hrp, xonly).encode(),
+      state: "active",
+      metadata: currentBoardingRow?.metadata
+    });
+    this.setOffchainTapscriptForRotation(newOffchain);
+    this.setBoardingTapscriptForRotation(newBoarding);
+    this.setArkServerPublicKeyForRotation(xonly);
+    this.setServerUnrollScriptForRotation(newServerUnrollScript);
+  }
   /**
    * Async mutex that serializes all operations submitting VTXOs to the Arkade
    * server (`settle`, `send`, `sendBitcoin`). This prevents VtxoManager's
@@ -9069,6 +10063,9 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
   }
   async dispose() {
     await this._restoreInFlight?.catch(() => void 0);
+    this._serverInfoUnsub?.();
+    this._serverInfoUnsub = void 0;
+    await this._serverInfoInFlight?.catch(() => void 0);
     let rotatorError;
     try {
       await this._receiveRotator?.dispose();
@@ -9143,6 +10140,15 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
       boot?.rotator,
       boot?.provider
     );
+    wallet.refreshDeprecatedSigners(setup.info);
+    {
+      const ap = setup.arkProvider;
+      if (typeof ap.onServerInfoChanged === "function") {
+        wallet._serverInfoUnsub = ap.onServerInfoChanged((info) => {
+          wallet._serverInfoInFlight = wallet._serverInfoInFlight.then(() => wallet.handleServerInfoChanged(info)).catch(() => void 0);
+        });
+      }
+    }
     if (boot?.provider) {
       const resolvedBoarding = await resolveBoardingBootTapscript(
         setup.contractRepository,
@@ -9175,7 +10181,7 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
    */
   async toReadonly() {
     const readonlyIdentity = hasToReadonly(this.identity) ? await this.identity.toReadonly() : this.identity;
-    return new ReadonlyWallet(
+    const readonly = new ReadonlyWallet(
       readonlyIdentity,
       this.network,
       this.onchainProvider,
@@ -9190,6 +10196,8 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
       this.watcherConfig,
       this.walletContractTimelocks
     );
+    readonly._deprecatedSigners = new Map(this._deprecatedSigners);
+    return readonly;
   }
   /** Returns the delegate manager when delegation support is configured. */
   async getDelegateManager() {
@@ -9215,10 +10223,9 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
     if (params.selectedVtxos && params.selectedVtxos.length > 0) {
       return this._withTxLock(async () => {
         const offchainTapscript = this.offchainTapscript;
-        const arkAddress = offchainTapscript.address(
-          this.network.hrp,
-          this.arkServerPublicKey
-        );
+        const serverPubKey = this.arkServerPublicKey;
+        const serverUnrollScript = this.serverUnrollScript;
+        const arkAddress = offchainTapscript.address(this.network.hrp, serverPubKey);
         const selectedVtxoSum = params.selectedVtxos.map((v) => v.value).reduce((a, b) => a + b, 0);
         if (selectedVtxoSum < params.amount) {
           throw new Error("Selected VTXOs do not cover specified amount");
@@ -9243,25 +10250,14 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
             amount: BigInt(selected.changeAmount)
           });
         }
-        this._addPendingSpends(selected.inputs);
-        try {
-          const { arkTxid, signedCheckpointTxs } = await this.buildAndSubmitOffchainTx(
-            selected.inputs,
-            outputs
-          );
-          await this.updateDbAfterOffchainTx(
-            selected.inputs,
-            arkTxid,
-            signedCheckpointTxs,
-            params.amount,
-            selected.changeAmount,
-            selected.changeAmount > 0n ? outputs.length - 1 : 0,
-            offchainTapscript
-          );
-          return arkTxid;
-        } finally {
-          this._removePendingSpends(selected.inputs);
-        }
+        return this._submitOffchainSpend(selected.inputs, outputs, {
+          sentAmount: params.amount,
+          changeAmount: selected.changeAmount,
+          changeVout: selected.changeAmount > 0n ? outputs.length - 1 : 0,
+          offchainTapscript,
+          serverPubKey,
+          serverUnrollScript
+        });
       });
     }
     return this.send({
@@ -9291,8 +10287,11 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
         }
       }
     }
+    const offchainAddress = await this.getAddress();
+    const offchainPkScript = chunkCMPJR3HS_cjs.ArkAddress.decode(offchainAddress).pkScript;
+    const offchainOutputScript = base.hex.encode(offchainPkScript);
     if (!params) {
-      const { fees } = await this.arkProvider.getInfo();
+      const { fees, vtxoMaxAmount } = await this.arkProvider.getInfo();
       const estimator = new Estimator(fees.intentFee);
       let amount = 0;
       const exitScript = chunkCMPJR3HS_cjs.CSVMultisigTapscript.decode(
@@ -9334,20 +10333,31 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
         if (inputFee.satoshis >= vtxo.value) {
           continue;
         }
+        const net = vtxo.value - inputFee.satoshis;
+        if (vtxoMaxAmount >= 0n) {
+          const projectedAmount = BigInt(amount + net);
+          const projectedOutputFee = estimator.evalOffchainOutput({
+            amount: projectedAmount,
+            script: offchainOutputScript
+          });
+          if (projectedAmount - BigInt(projectedOutputFee.satoshis) > vtxoMaxAmount) {
+            continue;
+          }
+        }
         filteredVtxos.push(vtxo);
-        amount += vtxo.value - inputFee.satoshis;
+        amount += net;
       }
       const inputs = [...filteredBoardingUtxos, ...filteredVtxos];
       if (inputs.length === 0) {
         throw new Error("No inputs found");
       }
       const output = {
-        address: await this.getAddress(),
+        address: offchainAddress,
         amount: BigInt(amount)
       };
       const outputFee = estimator.evalOffchainOutput({
         amount: output.amount,
-        script: base.hex.encode(chunkCMPJR3HS_cjs.ArkAddress.decode(output.address).pkScript)
+        script: offchainOutputScript
       });
       output.amount -= BigInt(outputFee.satoshis);
       if (output.amount <= this.dustAmount) {
@@ -9387,8 +10397,7 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
       }
     }
     let outputAssets;
-    const destinationScript = chunkCMPJR3HS_cjs.ArkAddress.decode(await this.getAddress()).pkScript;
-    const assetOutputIndex = findDestinationOutputIndex(outputs, destinationScript);
+    const assetOutputIndex = findDestinationOutputIndex(outputs, offchainPkScript);
     if (assetInputs.size > 0) {
       if (assetOutputIndex === -1) {
         throw new Error("Cannot assign assets: no output matches the destination address");
@@ -9736,7 +10745,7 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
     try {
       return await this.arkProvider.registerIntent(intent);
     } catch (error) {
-      if (error instanceof chunkFSAXPBGP_cjs.ArkError && error.code === 0 && error.message.includes("duplicated input")) {
+      if (error instanceof chunkC6OODRWD_cjs.ArkError && error.code === 0 && error.message.includes("duplicated input")) {
         const deleteIntent = await this.makeDeleteIntentSignature(inputs);
         await this.arkProvider.deleteIntent(deleteIntent);
         return this.arkProvider.registerIntent(intent);
@@ -9752,7 +10761,7 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
       expire_at: 0,
       cosigners_public_keys: cosignerPubKeys
     };
-    const proof = chunkFSAXPBGP_cjs.Intent.create(message, coins, outputs);
+    const proof = chunkC6OODRWD_cjs.Intent.create(message, coins, outputs);
     const signedProof = await this._signerRouter.sign(proof, intentProofJobs(coins));
     return {
       proof: base.base64.encode(signedProof.toPSBT()),
@@ -9764,7 +10773,7 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
       type: "delete",
       expire_at: 0
     };
-    const proof = chunkFSAXPBGP_cjs.Intent.create(message, coins, []);
+    const proof = chunkC6OODRWD_cjs.Intent.create(message, coins, []);
     const signedProof = await this._signerRouter.sign(proof, intentProofJobs(coins));
     return {
       proof: base.base64.encode(signedProof.toPSBT()),
@@ -9776,7 +10785,7 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
       type: "get-pending-tx",
       expire_at: 0
     };
-    const proof = chunkFSAXPBGP_cjs.Intent.create(message, coins, []);
+    const proof = chunkC6OODRWD_cjs.Intent.create(message, coins, []);
     const signedProof = await this._signerRouter.sign(proof, intentProofJobs(coins));
     return {
       proof: base.base64.encode(signedProof.toPSBT()),
@@ -9927,12 +10936,16 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
       throw new Error("At least one receiver is required");
     }
     const offchainTapscript = this.offchainTapscript;
-    const outputAddress = offchainTapscript.address(this.network.hrp, this.arkServerPublicKey);
+    const serverPubKey = this.arkServerPublicKey;
+    const serverUnrollScript = this.serverUnrollScript;
+    const outputAddress = offchainTapscript.address(this.network.hrp, serverPubKey);
     const address = outputAddress.encode();
     const recipients = validateRecipients(args, Number(this.dustAmount));
-    const virtualCoins = await this.getVtxos({
+    const allVirtualCoins = await this.getVtxos({
       withRecoverable: false
     });
+    const pendingRecovery = await this.pendingRecoveryOutpoints();
+    const virtualCoins = pendingRecovery.size ? allVirtualCoins.filter((c) => !pendingRecovery.has(`${c.txid}:${c.vout}`)) : allVirtualCoins;
     const assetChanges = /* @__PURE__ */ new Map();
     let selectedCoins = [];
     let btcAmountToSelect = 0;
@@ -10054,33 +11067,128 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
       outputs.push(Extension.create([assetPacket]).txOut());
     }
     const sentAmount = recipients.reduce((sum, r) => sum + r.amount, 0);
-    this._addPendingSpends(selectedCoins);
+    return this._submitOffchainSpend(selectedCoins, outputs, {
+      sentAmount,
+      changeAmount: BigInt(changeAmount),
+      changeVout: changeReceiver ? changeIndex : 0,
+      offchainTapscript,
+      serverPubKey,
+      serverUnrollScript,
+      changeAssets: changeReceiver?.assets
+    });
+  }
+  /**
+   * Shared tail of every Ark-transaction spend path (`send`, selected-VTXO
+   * `sendBitcoin`, and {@link sendSelectedVtxosToSelf}): hide the inputs from
+   * concurrent `getVtxos()`, build+submit the offchain tx, persist the spent
+   * inputs and any wallet-owned (change / self) output, then release the
+   * pending-spend hold. Callers own coin selection, output construction, and
+   * the synchronous epoch snapshot; this owns the submit/persist sequence.
+   */
+  async _submitOffchainSpend(inputs, outputs, persist) {
+    this._addPendingSpends(inputs);
     try {
       const { arkTxid, signedCheckpointTxs } = await this.buildAndSubmitOffchainTx(
-        selectedCoins,
-        outputs
+        inputs,
+        outputs,
+        persist.serverUnrollScript
       );
       await this.updateDbAfterOffchainTx(
-        selectedCoins,
+        inputs,
         arkTxid,
         signedCheckpointTxs,
-        sentAmount,
-        BigInt(changeAmount),
-        changeReceiver ? changeIndex : 0,
-        offchainTapscript,
-        changeReceiver?.assets
+        persist.sentAmount,
+        persist.changeAmount,
+        persist.changeVout,
+        persist.offchainTapscript,
+        persist.serverPubKey,
+        persist.changeAssets,
+        persist.recordSentHistory ?? true
       );
       return arkTxid;
     } finally {
-      this._removePendingSpends(selectedCoins);
-    }
+      this._removePendingSpends(inputs);
+    }
+  }
+  /**
+   * @internal Migration primitive (deprecated-signer plan, step 1). Spend an
+   * explicit set of the wallet's own deprecated-signer VTXOs into a single
+   * full-value output on the wallet's *active* signer, through the Ark send
+   * path (not `settle`) so arkd builds checkpoints against the active server
+   * epoch. Consumed in-process by {@link VtxoManager}'s migration pass; not
+   * part of the public `IWallet` API and never accepts boarding `ExtendedCoin`
+   * inputs.
+   *
+   * The caller (`migrateCore`) must have already moved the wallet onto the
+   * active signer (`ensureReceiveOnActiveSigner`) and sized the batch (caps +
+   * dust floor); this method validates the inputs, preserves all input assets
+   * on the self output, and persists the new active-signer VTXO even though
+   * there is no separate change output. It records no `TxSent` history — the
+   * funds never leave the wallet.
+   */
+  async sendSelectedVtxosToSelf(inputs) {
+    if (inputs.length === 0) {
+      throw new Error("sendSelectedVtxosToSelf: no inputs");
+    }
+    return this._withTxLock(async () => {
+      const offchainTapscript = this.offchainTapscript;
+      const serverPubKey = this.arkServerPublicKey;
+      const serverUnrollScript = this.serverUnrollScript;
+      const arkAddress = offchainTapscript.address(this.network.hrp, serverPubKey);
+      for (const input of inputs) {
+        if (!isSpendable(input) || isRecoverable(input)) {
+          throw new Error(
+            `sendSelectedVtxosToSelf: input ${input.txid}:${input.vout} is not cooperatively spendable`
+          );
+        }
+        if (!input.virtualStatus.batchExpiry) {
+          throw new Error(
+            `sendSelectedVtxosToSelf: input ${input.txid}:${input.vout} has no batchExpiry`
+          );
+        }
+      }
+      const total = inputs.reduce((sum, c) => sum + BigInt(c.value), 0n);
+      const outputs = [
+        {
+          script: total < this.dustAmount ? arkAddress.subdustPkScript : arkAddress.pkScript,
+          amount: total
+        }
+      ];
+      const assetInputs = selectedCoinsToAssetInputs(inputs);
+      let selfAssets;
+      if (assetInputs.size > 0) {
+        const totals = /* @__PURE__ */ new Map();
+        for (const [, assets] of assetInputs) {
+          for (const a of assets) {
+            totals.set(a.assetId, (totals.get(a.assetId) ?? 0n) + a.amount);
+          }
+        }
+        selfAssets = [...totals].map(([assetId, amount]) => ({ assetId, amount }));
+        const selfReceiver = {
+          address: arkAddress.encode(),
+          assets: selfAssets
+        };
+        const packet = createAssetPacket(assetInputs, [], selfReceiver);
+        outputs.push(Extension.create([packet]).txOut());
+      }
+      return this._submitOffchainSpend(inputs, outputs, {
+        sentAmount: 0,
+        changeAmount: total,
+        changeVout: 0,
+        offchainTapscript,
+        serverPubKey,
+        changeAssets: selfAssets,
+        recordSentHistory: false,
+        serverUnrollScript
+      });
+    });
   }
   /**
    * Build an offchain transaction from the given inputs and outputs,
    * sign it, submit to the Arkade provider, and finalize.
    * @returns The Arkade transaction id and server-signed checkpoint PSBTs (for bookkeeping)
    */
-  async buildAndSubmitOffchainTx(inputs, outputs) {
+  async buildAndSubmitOffchainTx(inputs, outputs, serverUnrollScript = this.serverUnrollScript) {
     const offchainTx = buildOffchainTx(
       inputs.map((input) => {
         return {
@@ -10089,7 +11197,7 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
         };
       }),
       outputs,
-      this.serverUnrollScript
+      serverUnrollScript
     );
     const arkTxJobs = inputs.map((input, index) => ({
       index,
@@ -10163,14 +11271,14 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
     return { arkTxid, signedCheckpointTxs };
   }
   // mark virtual outputs as spent, save change outputs if any.
-  // `offchainTapscript` is the snapshot the caller captured under
-  // `_txLock` before any `await`; deriving both the change-VTXO
-  // metadata and `primaryAddress` from it here guarantees the local
-  // record matches the pkScript the server saw on the inbound
-  // transaction, even if `WalletReceiveRotator.rotate` swaps
-  // `this.offchainTapscript` mid-flight.
-  async updateDbAfterOffchainTx(inputs, arkTxid, signedCheckpointTxs, sentAmount, changeAmount, changeVout, offchainTapscript, changeAssets) {
-    const primaryAddress = offchainTapscript.address(this.network.hrp, this.arkServerPublicKey).encode();
+  // `offchainTapscript` and `serverPubKey` are the epoch snapshot the
+  // caller captured under `_txLock` before any `await`; deriving both the
+  // change-VTXO metadata and `primaryAddress` from them here guarantees the
+  // local record matches the address/pkScript the server saw on the inbound
+  // transaction, even if `rotateServerSigner` swaps `this.offchainTapscript`
+  // / `this.arkServerPublicKey` mid-flight.
+  async updateDbAfterOffchainTx(inputs, arkTxid, signedCheckpointTxs, sentAmount, changeAmount, changeVout, offchainTapscript, serverPubKey, changeAssets, recordSentHistory = true) {
+    const primaryAddress = offchainTapscript.address(this.network.hrp, serverPubKey).encode();
     try {
       const spentVtxos = [];
       const commitmentTxIds = /* @__PURE__ */ new Set();
@@ -10277,19 +11385,21 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
           [changeVtxo]
         );
       }
-      await this.walletRepository.saveTransactions(primaryAddress, [
-        {
-          key: {
-            boardingTxid: "",
-            commitmentTxid: "",
-            arkTxid
-          },
-          amount: sentAmount,
-          type: "SENT" /* TxSent */,
-          settled: false,
-          createdAt
-        }
-      ]);
+      if (recordSentHistory) {
+        await this.walletRepository.saveTransactions(primaryAddress, [
+          {
+            key: {
+              boardingTxid: "",
+              commitmentTxid: "",
+              arkTxid
+            },
+            amount: sentAmount,
+            type: "SENT" /* TxSent */,
+            settled: false,
+            createdAt
+          }
+        ]);
+      }
     } catch (e) {
       console.warn("error saving offchain tx to repository", e);
       throw e;
@@ -10580,7 +11690,7 @@ var MessageBus = class {
     this.initialized = true;
   }
   async buildServices(config) {
-    const arkProvider = new chunkFSAXPBGP_cjs.RestArkProvider(config.arkServer.url);
+    const arkProvider = new chunkC6OODRWD_cjs.RestArkProvider(config.arkServer.url);
     const storage = {
       walletRepository: this.walletRepository,
       contractRepository: this.contractRepository
@@ -11147,6 +12257,82 @@ var DelegateNotConfiguredError = class extends Error {
 };
 var DelegatorNotConfiguredError = DelegateNotConfiguredError;
 var DEFAULT_MESSAGE_TAG = "WALLET_UPDATER";
+var serializeMigrationVtxoRef = (ref) => ({
+  txid: ref.txid,
+  vout: ref.vout,
+  value: ref.value,
+  signerPubKey: ref.signerPubKey,
+  cutoffDate: ref.cutoffDate?.toString()
+});
+var deserializeMigrationVtxoRef = (ref) => ({
+  txid: ref.txid,
+  vout: ref.vout,
+  value: ref.value,
+  signerPubKey: ref.signerPubKey,
+  cutoffDate: ref.cutoffDate != null ? BigInt(ref.cutoffDate) : void 0
+});
+var serializeDeprecatedSignerReport = (report) => ({
+  signerPubKey: report.signerPubKey,
+  status: report.status,
+  cutoffDate: report.cutoffDate?.toString(),
+  secondsUntilCutoff: report.secondsUntilCutoff,
+  vtxoCount: report.vtxoCount,
+  totalValue: report.totalValue,
+  boardingCount: report.boardingCount,
+  boardingValue: report.boardingValue,
+  recoverableCount: report.recoverableCount,
+  recoverableValue: report.recoverableValue,
+  awaitingSweepCount: report.awaitingSweepCount,
+  awaitingSweepValue: report.awaitingSweepValue,
+  nextSweepEta: report.nextSweepEta
+});
+var deserializeDeprecatedSignerReport = (report) => ({
+  signerPubKey: report.signerPubKey,
+  status: report.status,
+  cutoffDate: report.cutoffDate != null ? BigInt(report.cutoffDate) : void 0,
+  secondsUntilCutoff: report.secondsUntilCutoff,
+  vtxoCount: report.vtxoCount,
+  totalValue: report.totalValue,
+  boardingCount: report.boardingCount,
+  boardingValue: report.boardingValue,
+  recoverableCount: report.recoverableCount,
+  recoverableValue: report.recoverableValue,
+  awaitingSweepCount: report.awaitingSweepCount,
+  awaitingSweepValue: report.awaitingSweepValue,
+  nextSweepEta: report.nextSweepEta
+});
+var serializeMigrationLegReport = (leg) => ({
+  txid: leg.txid,
+  migrated: leg.migrated.map(serializeMigrationVtxoRef),
+  skipped: leg.skipped,
+  deferred: leg.deferred,
+  oversized: leg.oversized?.map(serializeMigrationVtxoRef),
+  error: leg.error
+});
+var deserializeMigrationLegReport = (leg) => ({
+  txid: leg.txid,
+  migrated: leg.migrated.map(deserializeMigrationVtxoRef),
+  skipped: leg.skipped,
+  deferred: leg.deferred,
+  oversized: leg.oversized?.map(deserializeMigrationVtxoRef),
+  error: leg.error
+});
+var serializeMigrationReport = (report) => ({
+  rotated: report.rotated,
+  skipped: report.skipped,
+  vtxos: report.vtxos ? serializeMigrationLegReport(report.vtxos) : void 0,
+  boarding: report.boarding ? serializeMigrationLegReport(report.boarding) : void 0,
+  expired: report.expired.map(serializeMigrationVtxoRef),
+  signers: report.signers.map(serializeDeprecatedSignerReport)
+});
+var deserializeMigrationReport = (report) => ({
+  rotated: report.rotated,
+  skipped: report.skipped,
+  vtxos: report.vtxos ? deserializeMigrationLegReport(report.vtxos) : void 0,
+  boarding: report.boarding ? deserializeMigrationLegReport(report.boarding) : void 0,
+  expired: report.expired.map(deserializeMigrationVtxoRef),
+  signers: report.signers.map(deserializeDeprecatedSignerReport)
+});
 var WalletMessageHandler = class {
   messageTag;
   wallet;
@@ -11228,7 +12414,9 @@ var WalletMessageHandler = class {
   // page-side PING / MESSAGE_BUS_NOT_INITIALIZED path triggered by concurrent
   // short requests (GET_STATUS, GET_BALANCE, ...).
   isLongRunning(message) {
-    return message.type === "SETTLE" || message.type === "RECOVER_VTXOS" || message.type === "RENEW_VTXOS" || // HD restore walks the index range with one indexer round-trip per
+    return message.type === "SETTLE" || message.type === "RECOVER_VTXOS" || message.type === "RENEW_VTXOS" || // Migration may apply a server-signer rotation and then run a full
+    // settle, so it streams settlement events like RENEW_VTXOS.
+    message.type === "MIGRATE_DEPRECATED_SIGNER_VTXOS" || // HD restore walks the index range with one indexer round-trip per
     // step until it hits gapLimit consecutive unused indices. The bus
     // deadline must not race the scan; liveness stays covered by PING.
     message.type === "RESTORE_WALLET";
@@ -11594,6 +12782,36 @@ var WalletMessageHandler = class {
             payload: { txid }
           });
         }
+        case "MIGRATE_DEPRECATED_SIGNER_VTXOS": {
+          const wallet = this.requireWallet();
+          const vtxoManager = await wallet.getVtxoManager();
+          const report = await vtxoManager.migrateDeprecatedSignerVtxos({
+            eventCallback: (e) => {
+              this.scheduleForNextTick(
+                () => this.tagged({
+                  id,
+                  type: "MIGRATE_DEPRECATED_SIGNER_VTXOS_EVENT",
+                  payload: e
+                })
+              );
+            }
+          });
+          return this.tagged({
+            id,
+            type: "MIGRATE_DEPRECATED_SIGNER_VTXOS_SUCCESS",
+            payload: { report: serializeMigrationReport(report) }
+          });
+        }
+        case "GET_DEPRECATED_SIGNER_STATUS": {
+          const wallet = this.requireWallet();
+          const vtxoManager = await wallet.getVtxoManager();
+          const signers = await vtxoManager.getDeprecatedSignerStatus();
+          return this.tagged({
+            id,
+            type: "DEPRECATED_SIGNER_STATUS",
+            payload: { signers: signers.map(serializeDeprecatedSignerReport) }
+          });
+        }
         case "RESTORE_WALLET": {
           const wallet = this.requireWallet();
           try {
@@ -11623,13 +12841,14 @@ var WalletMessageHandler = class {
   // Wallet methods
   async handleInitWallet({ payload }) {
     const { arkServerUrl } = payload;
-    this.indexerProvider = new chunkFSAXPBGP_cjs.RestIndexerProvider(arkServerUrl);
+    this.indexerProvider = new chunkC6OODRWD_cjs.RestIndexerProvider(arkServerUrl);
     await this.onWalletInitialized();
   }
   async handleGetBalance() {
-    const [boardingUtxos, allVtxos] = await Promise.all([
+    const [boardingUtxos, allVtxos, pendingOutpoints] = await Promise.all([
       this.getAllBoardingUtxos(),
-      this.getVtxosFromRepo()
+      this.getVtxosFromRepo(),
+      this.readonlyWallet ? this.readonlyWallet.pendingRecoveryOutpoints() : Promise.resolve(/* @__PURE__ */ new Set())
     ]);
     let confirmed = 0;
     let unconfirmed = 0;
@@ -11645,8 +12864,11 @@ var WalletMessageHandler = class {
     let settled = 0;
     let preconfirmed = 0;
     let recoverable = 0;
+    let pendingRecovery = 0;
     for (const vtxo of spendableVtxos) {
-      if (vtxo.virtualStatus.state === "settled") {
+      if (pendingOutpoints.has(`${vtxo.txid}:${vtxo.vout}`)) {
+        pendingRecovery += vtxo.value;
+      } else if (vtxo.virtualStatus.state === "settled") {
         settled += vtxo.value;
       } else if (vtxo.virtualStatus.state === "preconfirmed") {
         preconfirmed += vtxo.value;
@@ -11658,7 +12880,7 @@ var WalletMessageHandler = class {
       }
     }
     const totalBoarding = confirmed + unconfirmed;
-    const totalOffchain = settled + preconfirmed + recoverable;
+    const totalOffchain = settled + preconfirmed + recoverable + pendingRecovery;
     const assetBalances = /* @__PURE__ */ new Map();
     for (const vtxo of spendableVtxos) {
       if (vtxo.assets) {
@@ -11682,6 +12904,7 @@ var WalletMessageHandler = class {
       preconfirmed,
       available: settled + preconfirmed,
       recoverable,
+      pendingRecovery,
       total: totalBoarding + totalOffchain,
       assets
     };
@@ -12067,6 +13290,7 @@ var DEFAULT_MESSAGE_TIMEOUTS = {
   GET_EXPIRING_VTXOS: 2e4,
   GET_EXPIRED_BOARDING_UTXOS: 2e4,
   GET_RECOVERABLE_BALANCE: 2e4,
+  GET_DEPRECATED_SIGNER_STATUS: 2e4,
   RELOAD_WALLET: 2e4,
   // Transactions — need more headroom.
   // SETTLE / RECOVER_VTXOS / RENEW_VTXOS go through the streaming path and
@@ -12082,6 +13306,9 @@ var DEFAULT_MESSAGE_TIMEOUTS = {
   RECOVER_VTXOS: 5e4,
   RENEW_VTXOS: 5e4,
   SWEEP_EXPIRED_BOARDING_UTXOS: 5e4,
+  // Streaming/long-running like RENEW_VTXOS (rotation + settle); the value is
+  // kept for type completeness and is never enforced as an inactivity deadline.
+  MIGRATE_DEPRECATED_SIGNER_VTXOS: 5e4,
   // RESTORE_WALLET is a streaming/long-running path (sendMessageWithEvents)
   // like SETTLE; the value here is kept for type completeness and is never
   // enforced as an inactivity deadline.
@@ -12107,6 +13334,7 @@ var DEDUPABLE_REQUEST_TYPES = /* @__PURE__ */ new Set([
   "GET_DELEGATE_INFO",
   "GET_RECOVERABLE_BALANCE",
   "GET_EXPIRED_BOARDING_UTXOS",
+  "GET_DEPRECATED_SIGNER_STATUS",
   "GET_VTXOS",
   "GET_CONTRACTS",
   "GET_CONTRACTS_WITH_VTXOS",
@@ -13229,6 +14457,42 @@ var ServiceWorkerWallet = class _ServiceWorkerWallet extends ServiceWorkerReadon
           throw new Error(`Failed to sweep expired boarding utxos: ${e}`);
         }
       },
+      async migrateDeprecatedSignerVtxos(options) {
+        const message = {
+          tag: messageTag,
+          type: "MIGRATE_DEPRECATED_SIGNER_VTXOS",
+          id: getRandomId()
+        };
+        try {
+          const response = await wallet.sendMessageWithEvents(
+            message,
+            (resp) => options?.eventCallback?.(
+              resp.payload
+            ),
+            (resp) => resp.type === "MIGRATE_DEPRECATED_SIGNER_VTXOS_SUCCESS"
+          );
+          return deserializeMigrationReport(
+            response.payload.report
+          );
+        } catch (e) {
+          throw new Error(`Failed to migrate deprecated-signer vtxos: ${e}`);
+        }
+      },
+      async getDeprecatedSignerStatus() {
+        const message = {
+          tag: messageTag,
+          type: "GET_DEPRECATED_SIGNER_STATUS",
+          id: getRandomId()
+        };
+        try {
+          const response = await wallet.sendMessage(message);
+          return response.payload.signers.map(
+            deserializeDeprecatedSignerReport
+          );
+        } catch (e) {
+          throw new Error(`Failed to get deprecated-signer status: ${e}`);
+        }
+      },
       async dispose() {
         return;
       }
@@ -13368,7 +14632,7 @@ var OnchainWallet = class _OnchainWallet {
     if (!inputs) {
       throw new Error("Fee estimation failed");
     }
-    let tx = new chunkFSAXPBGP_cjs.Transaction();
+    let tx = new chunkC6OODRWD_cjs.Transaction();
     for (const input of inputs) {
       tx.addInput({
         txid: input.txid,
@@ -13399,7 +14663,7 @@ var OnchainWallet = class _OnchainWallet {
    */
   async bumpP2A(parent) {
     const parentVsize = parent.vsize;
-    let child = new chunkFSAXPBGP_cjs.Transaction({
+    let child = new chunkC6OODRWD_cjs.Transaction({
       version: 3,
       allowLegacyWitnessUtxo: true
     });
@@ -14134,13 +15398,19 @@ function isHeaderSubscribeResult(v) {
   const obj = v;
   return typeof obj.height === "number" && typeof obj.hex === "string";
 }
+function errorText(err) {
+  if (typeof err === "string") return err;
+  if (err && typeof err === "object") {
+    const e = err;
+    return [e.message, e.str].filter((v) => typeof v === "string").join(" ");
+  }
+  return "";
+}
 function isMissingHeightError(err) {
-  const msg = err instanceof Error ? err.message : typeof err === "string" ? err : "";
-  return msg.toLowerCase().includes("missingheight");
+  return errorText(err).toLowerCase().includes("missingheight");
 }
 function isTxNotInBlockError(err) {
-  const msg = err instanceof Error ? err.message : typeof err === "string" ? err : "";
-  const normalized = msg.toLowerCase();
+  const normalized = errorText(err).toLowerCase();
   return normalized.includes("not yet in a block") || normalized.includes("not in a block") || normalized.includes("not in block") || normalized.includes("no confirmed transaction");
 }
 function childTxidFromHex(txHex) {
@@ -14156,7 +15426,7 @@ exports.BIP322 = void 0;
   async function sign2(message, identity, network) {
     const xOnlyPubKey = await identity.xOnlyPublicKey();
     const payment = btcSigner.p2tr(xOnlyPubKey, void 0, network);
-    const toSpend = chunkFSAXPBGP_cjs.craftToSpendTx(message, payment.script, TAG_BIP322);
+    const toSpend = chunkC6OODRWD_cjs.craftToSpendTx(message, payment.script, TAG_BIP322);
     const toSign = craftBIP322ToSignP2TR(toSpend, payment.script, xOnlyPubKey);
     const signed = await identity.sign(toSign, [0]);
     signed.finalizeIdx(0);
@@ -14214,7 +15484,7 @@ function verifyP2TR(message, witnessItems, pkScript, pubkey) {
   if (sighashType !== btcSigner.SigHash.DEFAULT && sighashType !== btcSigner.SigHash.ALL) {
     return false;
   }
-  const toSpend = chunkFSAXPBGP_cjs.craftToSpendTx(message, pkScript, TAG_BIP322);
+  const toSpend = chunkC6OODRWD_cjs.craftToSpendTx(message, pkScript, TAG_BIP322);
   const toSign = craftBIP322ToSignP2TR(toSpend, pkScript, pubkey);
   const sighash = toSign.preimageWitnessV1(0, [pkScript], sighashType, [0n]);
   const rawSig = sig.length === 65 ? sig.subarray(0, 64) : sig;
@@ -14235,7 +15505,7 @@ function verifyP2WPKH(message, witnessItems, pkScript, addressHash) {
   }
   const sighashType = sigWithHash[sigWithHash.length - 1];
   const derSig = sigWithHash.subarray(0, sigWithHash.length - 1);
-  const toSpend = chunkFSAXPBGP_cjs.craftToSpendTx(message, pkScript, TAG_BIP322);
+  const toSpend = chunkC6OODRWD_cjs.craftToSpendTx(message, pkScript, TAG_BIP322);
   const toSign = craftBIP322ToSignSimple(toSpend, pkScript);
   const scriptCode = btcSigner.OutScript.encode({ type: "pkh", hash: addressHash });
   const sighash = toSign.preimageWitnessV0(0, scriptCode, sighashType, 0n);
@@ -14288,7 +15558,7 @@ function encodeCompactSize(n) {
   return buf;
 }
 function craftBIP322ToSignP2TR(toSpend, pkScript, tapInternalKey) {
-  const tx = new chunkFSAXPBGP_cjs.Transaction({ version: 0 });
+  const tx = new chunkC6OODRWD_cjs.Transaction({ version: 0 });
   tx.addInput({
     txid: toSpend.id,
     index: 0,
@@ -14302,12 +15572,12 @@ function craftBIP322ToSignP2TR(toSpend, pkScript, tapInternalKey) {
   });
   tx.addOutput({
     amount: 0n,
-    script: chunkFSAXPBGP_cjs.OP_RETURN_EMPTY_PKSCRIPT
+    script: chunkC6OODRWD_cjs.OP_RETURN_EMPTY_PKSCRIPT
   });
   return tx;
 }
 function craftBIP322ToSignSimple(toSpend, pkScript) {
-  const tx = new chunkFSAXPBGP_cjs.Transaction({ version: 0 });
+  const tx = new chunkC6OODRWD_cjs.Transaction({ version: 0 });
   tx.addInput({
     txid: toSpend.id,
     index: 0,
@@ -14319,7 +15589,7 @@ function craftBIP322ToSignSimple(toSpend, pkScript) {
   });
   tx.addOutput({
     amount: 0n,
-    script: chunkFSAXPBGP_cjs.OP_RETURN_EMPTY_PKSCRIPT
+    script: chunkC6OODRWD_cjs.OP_RETURN_EMPTY_PKSCRIPT
   });
   return tx;
 }
@@ -14380,7 +15650,7 @@ exports.Unroll = void 0;
       if (virtualTxs.txs.length === 0) {
         throw new Error(`Tx ${nextTxToBroadcast.txid} not found`);
       }
-      const tx = chunkFSAXPBGP_cjs.Transaction.fromPSBT(base.base64.decode(virtualTxs.txs[0]));
+      const tx = chunkC6OODRWD_cjs.Transaction.fromPSBT(base.base64.decode(virtualTxs.txs[0]));
       if (nextTxToBroadcast.type === "INDEXER_CHAINED_TX_TYPE_TREE" /* TREE */) {
         const input = tx.getInput(0);
         if (!input) {
@@ -14480,7 +15750,7 @@ async function prepareUnrollTransaction(wallet, vtxoTxIds, outputAddress) {
       btcSigner.TaprootControlBlock.encode(spendingLeaf[0]).length
     );
   }
-  const tx = new chunkFSAXPBGP_cjs.Transaction({ version: 2 });
+  const tx = new chunkC6OODRWD_cjs.Transaction({ version: 2 });
   for (const input of inputs) {
     tx.addInput(input);
   }
@@ -14656,6 +15926,8 @@ exports.WalletRepositoryImpl = WalletRepositoryImpl;
 exports.WsElectrumChainSource = WsElectrumChainSource;
 exports.buildForfeitTx = buildForfeitTx;
 exports.buildOffchainTx = buildOffchainTx;
+exports.classifyAgainstSignerSet = classifyAgainstSignerSet;
+exports.classifyContractSigner = classifyContractSigner;
 exports.closeDatabase = closeDatabase;
 exports.combineTapscriptSigs = combineTapscriptSigs;
 exports.contractFromArkContract = contractFromArkContract;
@@ -14671,6 +15943,7 @@ exports.getRandomId = getRandomId;
 exports.hasBoardingTxExpired = hasBoardingTxExpired;
 exports.isArkContract = isArkContract;
 exports.isBatchSignable = isBatchSignable;
+exports.isCooperativelyMigratable = isCooperativelyMigratable;
 exports.isDiscoverable = isDiscoverable;
 exports.isExpired = isExpired;
 exports.isRecoverable = isRecoverable;
@@ -14689,10 +15962,12 @@ exports.serializeAssets = serializeAssets;
 exports.serializeUtxo = serializeUtxo;
 exports.serializeVtxo = serializeVtxo;
 exports.setupServiceWorker = setupServiceWorker;
+exports.signerSetFromInfo = signerSetFromInfo;
+exports.toXOnlySignerHex = toXOnlySignerHex;
 exports.validateConnectorsTxGraph = validateConnectorsTxGraph;
 exports.validateVtxoTxGraph = validateVtxoTxGraph;
 exports.verifyTapscriptSignatures = verifyTapscriptSignatures;
 exports.waitForIncomingFunds = waitForIncomingFunds;
 exports.warnAndFilterVtxosForScript = warnAndFilterVtxosForScript;
-//# sourceMappingURL=chunk-XCHBQVMK.cjs.map
-//# sourceMappingURL=chunk-XCHBQVMK.cjs.map
+//# sourceMappingURL=chunk-TUSGEWOX.cjs.map
+//# sourceMappingURL=chunk-TUSGEWOX.cjs.map