@arkade-os/sdk 0.4.67 → 0.4.69

package/dist/{chunk-AEWJU6NZ.js → chunk-TA7XLEP2.js}

@@ -1,6 +1,6 @@
-import { AssetId, AssetGroup, AssetInput, AssetOutput, Metadata, Packet, BufferReader, BufferWriter, AssetRef, RestIndexerProvider } from './chunk-X3VEMUVV.js';
-import { witnessRefToBytes, validateProgram, toASM, stringifyArtifact, serializeArkadeContractParams, resolveAsm, parseArtifact, getOpcodeValue, getOpcodeName, fromASM, deserializeArkadeContractParams, computeArkadeScriptPublicKey, bytesToASM, asmToBytes, arkadeWitnessHash, arkadeScriptHash, SUPPORTED_PROGRAM_VERSION, OPCODE_VALUES, OPCODE_NAMES, bignum_exports, ArkadeScript, ArkadeProgramScript, ARKADE_OPS, ARKADE_OPCODE_VALUES, ARKADE_OPCODE_NAMES, ARKADE_OPCODES, ARKADE_OP, toXOnly, inputName, contractHandlers, isMainnetDescriptor, descriptorIsOurs, deriveDescriptorLeafPubKey, deriveDescriptorLeafCompressedPubKey, parseHDDescriptor, identityDescriptor, DefaultVtxo, speculativeReceiveMetadata, DelegateVtxo, WALLET_RECEIVE_SOURCE, BoardingContractHandler } from './chunk-6TAQF6EV.js';
-import { VtxoScript, Transaction, isRecoverable, CSVMultisigTapscript, DEFAULT_NETWORK, resolveEmulatorPubkey, hasTerminalSpend, getNormalizedVtxos, setArkPsbtField, PrevArkTxField, ConditionWitness, craftToSpendTx, ArkAddress, isVirtualCoin, getArkPsbtFields, CosignerPublicKey, ServerResponseMismatchError, OP_RETURN_EMPTY_PKSCRIPT, canSweepOnchain, sequenceToTimelock, decodeTapscript, scriptFromTapLeafScript, CLTVMultisigTapscript, VtxoTaprootTree, timelockToSequence, baseFetch, Intent, rateGate, DEFAULT_NETWORK_NAME, normalizeVtxo, getSequence, toBatchExpiry, maybeArkError, isArkError, ArkErrorName, toOffchainInputFeeParams, canRecoverOnchain, getNetwork, MultisigTapscript, isEventSourceError, isEventSourceUnavailableError, isRetryableProviderError, getAllNormalizedVtxos, DEFAULT_PAGE_SIZE, RestArkProvider, toVirtualStatus, ArkError, TapTreeCoder, resolveTimeHeight, canSpendOffchain, parseLegacyExpiry, isExpired, PrevoutTxField, DEFAULT_ARKADE_SERVER_URL, ProviderUnavailableError, networks as networks$1, isPastExpiry, fetchVtxoCreatedAtByTxid } from './chunk-3WIWNE4P.js';
+import { AssetId, AssetGroup, AssetInput, AssetOutput, Metadata, Packet, BufferReader, BufferWriter, AssetRef, RestIndexerProvider } from './chunk-YG7T6LI3.js';
+import { witnessRefToBytes, validateProgram, toASM, stringifyArtifact, serializeArkadeContractParams, resolveAsm, parseArtifact, getOpcodeValue, getOpcodeName, fromASM, deserializeArkadeContractParams, computeArkadeScriptPublicKey, bytesToASM, asmToBytes, arkadeWitnessHash, arkadeScriptHash, SUPPORTED_PROGRAM_VERSION, OPCODE_VALUES, OPCODE_NAMES, bignum_exports, ArkadeScript, ArkadeProgramScript, ARKADE_OPS, ARKADE_OPCODE_VALUES, ARKADE_OPCODE_NAMES, ARKADE_OPCODES, ARKADE_OP, toXOnly, inputName, contractHandlers, isMainnetDescriptor, descriptorIsOurs, deriveDescriptorLeafPubKey, deriveDescriptorLeafCompressedPubKey, parseHDDescriptor, identityDescriptor, DefaultVtxo, speculativeReceiveMetadata, DelegateVtxo, WALLET_RECEIVE_SOURCE, BoardingContractHandler } from './chunk-2PPL3O7Z.js';
+import { VtxoScript, Transaction, isRecoverable, CSVMultisigTapscript, DEFAULT_NETWORK, resolveEmulatorPubkey, hasTerminalSpend, getNormalizedVtxos, setArkPsbtField, PrevArkTxField, ConditionWitness, craftToSpendTx, ArkAddress, isVirtualCoin, getArkPsbtFields, CosignerPublicKey, ServerResponseMismatchError, OP_RETURN_EMPTY_PKSCRIPT, canSweepOnchain, sequenceToTimelock, decodeTapscript, scriptFromTapLeafScript, CLTVMultisigTapscript, VtxoTaprootTree, timelockToSequence, assertAllowedSighashTypes, baseFetch, Intent, rateGate, DEFAULT_NETWORK_NAME, formatSighash, normalizeVtxo, getSequence, toBatchExpiry, maybeArkError, isArkError, ArkErrorName, toOffchainInputFeeParams, canRecoverOnchain, getNetwork, MultisigTapscript, isEventSourceError, isEventSourceUnavailableError, isRetryableProviderError, getAllNormalizedVtxos, DEFAULT_PAGE_SIZE, RestArkProvider, toVirtualStatus, ArkError, TapTreeCoder, resolveTimeHeight, canSpendOffchain, parseLegacyExpiry, isExpired, PrevoutTxField, DEFAULT_ARKADE_SERVER_URL, ProviderUnavailableError, networks as networks$1, isPastExpiry, fetchVtxoCreatedAtByTxid } from './chunk-L5SCQYHF.js';
 import { __export } from './chunk-NSBPE2FW.js';
 import { sha256 as sha256$1, equalBytes, hash160, sha256x2, concatBytes, randomPrivateKeyBytes, pubECDSA, pubSchnorr } from '@scure/btc-signer/utils.js';
 import { SigHash, Script, OP, OutScript, Address, RawWitness, p2tr, p2wpkh, TaprootControlBlock, DEFAULT_SEQUENCE, Transaction as Transaction$2 } from '@scure/btc-signer';
@@ -272,7 +272,7 @@ function getPrevOutput(finalKey, graph, sharedOutputAmount, tx) {
     script: pkScript
   };
 }
-var ALL_SIGHASH = Object.values(SigHash).filter((x) => typeof x === "number");
+var ALLOWED_SIGHASH = [SigHash.DEFAULT, SigHash.ALL, SigHash.ALL_ANYONECANPAY];
 var SingleKey = class _SingleKey {
   key;
   constructor(key) {
@@ -301,8 +301,9 @@ var SingleKey = class _SingleKey {
   async sign(tx, inputIndexes) {
     const txCpy = tx.clone();
     if (!inputIndexes) {
+      assertAllowedSighashTypes(txCpy, ALLOWED_SIGHASH);
       try {
-        if (!txCpy.sign(this.key, ALL_SIGHASH)) {
+        if (!txCpy.sign(this.key, ALLOWED_SIGHASH)) {
           throw new Error("Failed to sign transaction");
         }
       } catch (e) {
@@ -313,7 +314,7 @@ var SingleKey = class _SingleKey {
       return txCpy;
     }
     for (const inputIndex of inputIndexes) {
-      if (!txCpy.signIdx(this.key, inputIndex, ALL_SIGHASH)) {
+      if (!txCpy.signIdx(this.key, inputIndex, ALLOWED_SIGHASH)) {
         throw new Error(`Failed to sign input #${inputIndex}`);
       }
     }
@@ -378,7 +379,7 @@ var ReadonlySingleKey = class _ReadonlySingleKey {
     return Promise.resolve(this.publicKey);
   }
 };
-var ALL_SIGHASH2 = Object.values(SigHash).filter((x) => typeof x === "number");
+var ALLOWED_SIGHASH2 = [SigHash.DEFAULT, SigHash.ALL, SigHash.ALL_ANYONECANPAY];
 var seedBytes = /* @__PURE__ */ new WeakMap();
 var mnemonicMeta = /* @__PURE__ */ new WeakMap();
 var SeedIdentity = class _SeedIdentity {
@@ -581,8 +582,9 @@ var SeedIdentity = class _SeedIdentity {
   signTxWithKey(tx, key, inputIndexes) {
     const txCpy = tx.clone();
     if (!inputIndexes) {
+      assertAllowedSighashTypes(txCpy, ALLOWED_SIGHASH2);
       try {
-        if (!txCpy.sign(key, ALL_SIGHASH2)) {
+        if (!txCpy.sign(key, ALLOWED_SIGHASH2)) {
           throw new Error("Failed to sign transaction");
         }
       } catch (e) {
@@ -592,7 +594,7 @@ var SeedIdentity = class _SeedIdentity {
       }
     } else {
       for (const idx of inputIndexes) {
-        if (!txCpy.signIdx(key, idx, ALL_SIGHASH2)) {
+        if (!txCpy.signIdx(key, idx, ALLOWED_SIGHASH2)) {
           throw new Error(`Failed to sign input #${idx}`);
         }
       }
@@ -1647,6 +1649,16 @@ var EsploraProvider = class {
   baseUrl;
   pollingInterval;
   forcePolling;
+  /**
+   * Live {@link watchAddresses} subscriptions, keyed by their address set.
+   *
+   * Concurrent watchers over the same addresses share one transport, so a
+   * caller that opens watchers in a loop — or leaks them by abandoning
+   * {@link waitForIncomingFunds} — costs one entry in a `Set` rather than
+   * another WebSocket plus another full-history polling loop. Entries are
+   * dropped once their last subscriber stops.
+   */
+  addressWatches = /* @__PURE__ */ new Map();
   async getCoins(address) {
     const response = await baseFetch(`${this.baseUrl}/address/${address}/utxo`);
     if (!response.ok) {
@@ -1691,6 +1703,18 @@ var EsploraProvider = class {
     }
     return response.json();
   }
+  /**
+   * Activity counts for an address, without its transactions — orders of
+   * magnitude smaller than `/address/{addr}/txs`, which is what makes it
+   * usable as a change probe for the polling fallback.
+   */
+  async getAddressStats(address) {
+    const response = await baseFetch(`${this.baseUrl}/address/${address}`);
+    if (!response.ok) {
+      throw new Error(`Failed to get address stats: ${response.statusText}`);
+    }
+    return response.json();
+  }
   async getRawTransaction(txid) {
     const response = await baseFetch(`${this.baseUrl}/tx/${txid}/hex`);
     if (!response.ok) {
@@ -1722,50 +1746,227 @@ var EsploraProvider = class {
       blockHeight: data.block_height
     };
   }
+  /**
+   * Watch a set of addresses over the explorer's WebSocket, degrading to HTTP
+   * polling whenever the socket is unavailable and returning to the socket as
+   * soon as it can be re-established.
+   *
+   * Concurrent calls covering the same address set share one transport. The
+   * returned function releases **this** subscription only; the transport is
+   * torn down when the last subscriber releases it. Calling it more than once
+   * is a no-op.
+   *
+   * @param addresses - Addresses to monitor; order is not significant
+   * @param callback - Invoked with transactions seen after the watch started
+   * @returns A function releasing this subscription
+   * @remarks
+   * The HTTP fallback fetches full address history per address per cycle,
+   * which is dramatically more expensive than the socket — so callers should
+   * release watches they no longer need rather than relying on sharing.
+   * @see {@link waitForIncomingFunds} for the cancellation-aware wallet-level helper
+   */
   async watchAddresses(addresses, callback) {
-    let intervalId = null;
+    const key = [...addresses].sort().join("\0");
+    let watch = this.addressWatches.get(key);
+    if (!watch) {
+      watch = this.createAddressWatch(addresses, () => this.addressWatches.delete(key));
+      this.addressWatches.set(key, watch);
+    }
+    const subscriber = { callback };
+    watch.subscribers.add(subscriber);
+    const shared = watch;
+    await shared.started;
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      shared.subscribers.delete(subscriber);
+      if (shared.subscribers.size === 0) shared.teardown();
+    };
+  }
+  /**
+   * Bring up one shared address watch: a WebSocket subscription where the
+   * explorer supports it, degrading to HTTP polling when it doesn't.
+   *
+   * @param addresses - Addresses this watch covers
+   * @param onTeardown - Invoked when the watch retires, to drop the registry entry
+   */
+  createAddressWatch(addresses, onTeardown) {
+    const subscribers = /* @__PURE__ */ new Set();
     const wsUrl = this.baseUrl.replace(/^http(s)?:/, "ws$1:") + "/v1/ws";
-    const poll = async () => {
-      const getAllTxs = async () => {
-        const txArrays = await Promise.all(
-          addresses.map((address) => this.getTransactions(address))
-        );
-        return txArrays.flat();
+    let stopped = false;
+    let timer = null;
+    let pollStarted = false;
+    let ws = null;
+    let reconnectTimer = null;
+    let reconnectFailures = 0;
+    let pollSession = 0;
+    const emit = (txs) => {
+      if (stopped || txs.length === 0) return;
+      for (const subscriber of [...subscribers]) {
+        try {
+          subscriber.callback(txs);
+        } catch (error) {
+          console.error("Address watch subscriber threw:", error);
+        }
+      }
+    };
+    const txKey2 = (tx) => `${tx.txid}_${tx.status.block_time}`;
+    const getAllTxs = async () => {
+      const txArrays = await Promise.all(
+        addresses.map((address) => this.getTransactions(address))
+      );
+      return txArrays.flat();
+    };
+    const seen = /* @__PURE__ */ new Set();
+    let baselined = false;
+    let anchorHeight;
+    const baseline = (async () => {
+      const [history, tip] = await Promise.allSettled([getAllTxs(), this.getChainTip()]);
+      if (history.status === "fulfilled") {
+        for (const tx of history.value) seen.add(txKey2(tx));
+        baselined = true;
+        return;
+      }
+      console.warn(
+        "Could not baseline watched addresses; the first poll pass will establish it instead:",
+        history.reason
+      );
+      if (tip.status === "fulfilled") anchorHeight = tip.value.height;
+    })();
+    const report = (txs) => {
+      const fresh = [];
+      for (const tx of txs) {
+        const key = txKey2(tx);
+        if (seen.has(key)) continue;
+        seen.add(key);
+        fresh.push(tx);
+      }
+      if (fresh.length === 0) return;
+      emit(fresh);
+    };
+    const startPolling = async () => {
+      if (stopped || pollStarted) return;
+      pollStarted = true;
+      console.warn(
+        `Esplora websocket unavailable (${wsUrl}); falling back to HTTP polling every ${this.pollingInterval}ms for ${addresses.length} address(es) while retrying the socket`
+      );
+      let failures = 0;
+      const activityFingerprint = async () => {
+        try {
+          const stats = await Promise.all(
+            addresses.map((address) => this.getAddressStats(address))
+          );
+          const counted = (activity) => typeof activity?.tx_count === "number" && typeof activity.funded_txo_count === "number" && typeof activity.spent_txo_count === "number";
+          const usable = stats.every(
+            (s) => counted(s?.chain_stats) && counted(s?.mempool_stats)
+          );
+          if (!usable) return void 0;
+          if (stats.some((s) => s.mempool_stats.tx_count > 0)) return void 0;
+          return stats.map(
+            ({ chain_stats: chain }) => `${chain.tx_count}:${chain.funded_txo_count}:${chain.spent_txo_count}`
+          ).join(",");
+        } catch {
+          return void 0;
+        }
+      };
+      let lastFingerprint;
+      const session = pollSession;
+      const isCurrentLoop = () => !stopped && session === pollSession;
+      const schedule = () => {
+        if (!isCurrentLoop()) return;
+        timer = setTimeout(tick, this.pollingInterval * 2 ** failures);
       };
-      const initialTxs = await getAllTxs();
-      const txKey2 = (tx) => `${tx.txid}_${tx.status.block_time}`;
-      const existingTxs = new Set(initialTxs.map(txKey2));
-      intervalId = setInterval(async () => {
+      const tick = async () => {
         try {
+          const fingerprint = await activityFingerprint();
+          if (!isCurrentLoop()) return;
+          if (fingerprint !== void 0 && fingerprint === lastFingerprint) {
+            failures = 0;
+            schedule();
+            return;
+          }
           const currentTxs = await getAllTxs();
-          const newTxs = currentTxs.filter((tx) => !existingTxs.has(txKey2(tx)));
-          if (newTxs.length > 0) {
-            newTxs.forEach((tx) => existingTxs.add(txKey2(tx)));
-            callback(newTxs);
+          if (!isCurrentLoop()) return;
+          lastFingerprint = fingerprint;
+          if (baselined) {
+            report(currentTxs);
+          } else if (anchorHeight !== void 0) {
+            const arrivedAfterStart = (tx) => !tx.status.confirmed || tx.status.block_height === void 0 || tx.status.block_height > anchorHeight;
+            for (const tx of currentTxs) {
+              if (!arrivedAfterStart(tx)) seen.add(txKey2(tx));
+            }
+            baselined = true;
+            report(currentTxs);
+          } else {
+            console.warn(
+              `Esplora address watch established its baseline late for ${addresses.length} address(es); deposits arriving before now may not have been reported`
+            );
+            for (const tx of currentTxs) seen.add(txKey2(tx));
+            baselined = true;
           }
+          failures = 0;
         } catch (error) {
-          console.error("Error in polling mechanism:", error);
+          failures = Math.min(failures + 1, MAX_POLL_BACKOFF_EXPONENT);
+          console.error("Error polling watched addresses:", error);
         }
-      }, this.pollingInterval);
+        schedule();
+      };
+      await baseline;
+      if (!isCurrentLoop()) return;
+      await tick();
     };
-    let ws = null;
-    const stopFunc = () => {
-      if (ws) ws.close();
-      if (intervalId) clearInterval(intervalId);
+    const stopPolling = () => {
+      pollSession++;
+      if (timer) {
+        clearTimeout(timer);
+        timer = null;
+      }
+      pollStarted = false;
     };
-    if (this.forcePolling) {
-      await poll();
-      return stopFunc;
-    }
-    try {
-      ws = new WebSocket(wsUrl);
-      ws.addEventListener("open", () => {
+    const handleSocketFailure = () => {
+      if (stopped) return Promise.resolve();
+      scheduleReconnect();
+      return startPolling();
+    };
+    const scheduleReconnect = () => {
+      if (stopped || reconnectTimer !== null) return;
+      const delay = RECONNECT_BASE_DELAY_MS * 2 ** Math.min(reconnectFailures, MAX_RECONNECT_BACKOFF_EXPONENT);
+      reconnectFailures++;
+      reconnectTimer = setTimeout(() => {
+        reconnectTimer = null;
+        connect();
+      }, delay);
+    };
+    const connect = () => {
+      if (stopped) return Promise.resolve();
+      const previous = ws;
+      ws = null;
+      if (previous) {
+        try {
+          previous.close();
+        } catch {
+        }
+      }
+      let socket;
+      try {
+        socket = new WebSocket(wsUrl);
+      } catch {
+        return handleSocketFailure();
+      }
+      ws = socket;
+      const isCurrent = () => !stopped && ws === socket;
+      socket.addEventListener("open", () => {
+        if (!isCurrent()) return;
+        reconnectFailures = 0;
         const subscribeMsg = {
           "track-addresses": addresses
         };
-        ws.send(JSON.stringify(subscribeMsg));
+        socket.send(JSON.stringify(subscribeMsg));
+        stopPolling();
       });
-      ws.addEventListener("message", (event) => {
+      socket.addEventListener("message", (event) => {
+        if (!isCurrent()) return;
         try {
           const newTxs = [];
           const message = JSON.parse(event.data.toString());
@@ -1777,19 +1978,42 @@ var EsploraProvider = class {
               newTxs.push(...aux[address][type].filter(isExplorerTransaction));
             }
           }
-          if (newTxs.length > 0) callback(newTxs);
+          report(newTxs);
         } catch (error) {
           console.error("Failed to process WebSocket message:", error);
         }
       });
-      ws.addEventListener("error", async () => {
-        await poll();
+      socket.addEventListener("error", () => {
+        if (isCurrent()) void handleSocketFailure();
       });
-    } catch {
-      if (intervalId) clearInterval(intervalId);
-      await poll();
-    }
-    return stopFunc;
+      socket.addEventListener("close", () => {
+        if (isCurrent()) void handleSocketFailure();
+      });
+      return Promise.resolve();
+    };
+    const teardown = () => {
+      if (stopped) return;
+      stopped = true;
+      onTeardown();
+      if (timer) {
+        clearTimeout(timer);
+        timer = null;
+      }
+      if (reconnectTimer !== null) {
+        clearTimeout(reconnectTimer);
+        reconnectTimer = null;
+      }
+      if (ws) {
+        try {
+          ws.close();
+        } catch {
+        }
+        ws = null;
+      }
+      subscribers.clear();
+    };
+    const started = this.forcePolling ? startPolling() : connect().then(() => baseline);
+    return { subscribers, teardown, started };
   }
   async getChainTip() {
     const tipBlocks = await baseFetch(`${this.baseUrl}/blocks`);
@@ -1806,6 +2030,8 @@ var EsploraProvider = class {
     const hash = tip[0].id;
     return {
       height: tip[0].height,
+      // `mediantime`, never `timestamp`: the latter is the header's own
+      // `nTime`, and this field is specified as MTP.
       time: tip[0].mediantime,
       hash
     };
@@ -1871,6 +2097,9 @@ var isExplorerTransaction = (tx) => {
     (vout) => typeof vout.scriptpubkey_address === "string" && typeof vout.value === "number"
   ) && typeof tx.status === "object" && typeof tx.status.confirmed === "boolean";
 };
+var MAX_POLL_BACKOFF_EXPONENT = 4;
+var RECONNECT_BASE_DELAY_MS = 1e3;
+var MAX_RECONNECT_BACKOFF_EXPONENT = 5;
 var getVarIntSize = (n) => {
   if (n < 253) return 1;
   if (n <= 65535) return 3;
@@ -3085,9 +3314,6 @@ function hasBoardingTxExpired(coin, boardingTimelock, chainTipHeight) {
   const blockTime = BigInt(Math.floor(coin.status.block_time));
   return blockTime + boardingTimelock.value <= now;
 }
-function formatSighash(type) {
-  return `0x${type.toString(16).padStart(2, "0")}`;
-}
 function verifyTapscriptSignatures(tx, inputIndex, requiredSigners, excludePubkeys = [], allowedSighashTypes = [SigHash.DEFAULT], expectedLeafHash) {
   const input = tx.getInput(inputIndex);
   const prevoutScripts = [];
@@ -3305,6 +3531,15 @@ async function submitOffchainTx(provider, offchainTx, signer, hooks, options) {
   assertSubmittedArkTxid(response, signedArkTx, "submitTx");
   const { arkTxid, signedCheckpointTxs } = response;
   const matched = matchServerCheckpoints(signedCheckpointTxs, offchainTx.checkpoints, "submitTx");
+  matched.forEach(({ server }, index) => {
+    try {
+      assertAllowedSighashTypes(server);
+    } catch (error) {
+      throw new ServerResponseMismatchError(
+        `submitTx checkpoint ${index}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  });
   const verify = options?.verifyServerSignatures;
   if (verify) {
     if (response.finalArkTx === void 0) {
@@ -3906,6 +4141,7 @@ function getRecoverableWithSubdust(vtxos, dustAmount, now) {
   };
 }
 function isVtxoExpiringSoon(vtxo, thresholdMs) {
+  if (vtxo.isUnrolled) return false;
   const realThresholdMs = thresholdMs <= 100 ? DEFAULT_THRESHOLD_MS : thresholdMs;
   const expiresAt = normalizeVtxo(vtxo).expiresAt;
   if (expiresAt === void 0) return false;
@@ -3916,7 +4152,9 @@ function isVtxoExpiringSoon(vtxo, thresholdMs) {
 }
 function getExpiringAndRecoverableVtxos(vtxos, thresholdMs, dustAmount, now) {
   return vtxos.filter(
-    (vtxo) => isVtxoExpiringSoon(vtxo, thresholdMs) || canRecoverOnchain(vtxo, now) || isSubdust(vtxo, dustAmount)
+    // The leading exclusion covers the `isSubdust` arm too, which is a value
+    // property and would otherwise re-admit an exited coin on its own.
+    (vtxo) => !vtxo.isUnrolled && (isVtxoExpiringSoon(vtxo, thresholdMs) || canRecoverOnchain(vtxo, now) || isSubdust(vtxo, dustAmount))
   );
 }
 function isMigrationCapable(wallet) {
@@ -6448,6 +6686,13 @@ var TxTree = class {
     if (nbOfInputs !== 1) {
       throw new Error(`unexpected number of inputs: ${nbOfInputs}, expected 1`);
     }
+    if (this.root.lockTime !== 0) {
+      throw new Error(`unexpected locktime: ${this.root.lockTime}, expected 0`);
+    }
+    const sequence = this.root.getInput(0).sequence;
+    if (sequence !== void 0 && sequence !== DEFAULT_SEQUENCE) {
+      throw new Error(`unexpected sequence: ${sequence}, expected ${DEFAULT_SEQUENCE}`);
+    }
     if (this.children.size > nbOfOutputs - 1) {
       throw new Error(
         `unexpected number of children: ${this.children.size}, expected maximum ${nbOfOutputs - 1}`
@@ -12079,6 +12324,7 @@ function filterSnapshotVtxos(snapshot, filter, pendingSpendOutpoints) {
   });
 }
 var PENDING_RECOVERY_REASON = "is past its operator signer's rotation cutoff \u2014 the operator will not co-sign it until it recovers";
+var UNROLLED_REASON = "was unilaterally exited and lives onchain \u2014 `Unroll.completeUnroll` is the only spend that reaches it";
 function omittedOutpoints(before, after) {
   if (before.length === after.length) return /* @__PURE__ */ new Set();
   const kept = new Set(after.map((vtxo) => `${vtxo.txid}:${vtxo.vout}`));
@@ -12651,6 +12897,13 @@ var ReadonlyWallet = class _ReadonlyWallet {
         "is locked by an in-flight settlement intent"
       )
     ]);
+    if (!filter?.withUnrolled) {
+      logExcludedVtxos(
+        "getSpendableVtxos",
+        snapshot.flatMap((contract) => contract.vtxos).filter((vtxo) => vtxo.isUnrolled && !hasTerminalSpend(vtxo)),
+        [() => UNROLLED_REASON]
+      );
+    }
     return unlocked;
   }
   /**
@@ -15203,9 +15456,11 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
           seen.add(pendingTx.arkTxid);
           batchPending.push(pendingTx.arkTxid);
           try {
-            const checkpointTxs = pendingTx.signedCheckpointTxs.map(
-              (c) => Transaction$2.fromPSBT(base64.decode(c))
-            );
+            const checkpointTxs = pendingTx.signedCheckpointTxs.map((c) => {
+              const tx = Transaction$2.fromPSBT(base64.decode(c));
+              assertAllowedSighashTypes(tx);
+              return tx;
+            });
             assertCheckpointsMatchInputs(
               checkpointTxs,
               checkpointInputs,
@@ -15373,7 +15628,9 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
     const myPkScript = ArkAddress.decode(await this.getAddress()).pkScript;
     let { spendable, unclaimed } = this.classifyCashVtxos(vtxos);
     let swept = 0;
-    const drainable = vtxos.filter((vtxo) => !isSubdust(vtxo, this.dustAmount));
+    const drainable = vtxos.filter(
+      (vtxo) => !isSubdust(vtxo, this.dustAmount) && !vtxo.isUnrolled
+    );
     if (drainable.length > 0) {
       let drained = { count: 0, swept: 0, claimed: /* @__PURE__ */ new Set() };
       try {
@@ -15533,9 +15790,11 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
     const unrollCandidates = this.checkpointUnrollCandidates(await this.arkProvider.getInfo());
     for (const pendingTx of pendingTxs) {
       try {
-        const checkpointTxs = pendingTx.signedCheckpointTxs.map(
-          (checkpoint) => Transaction$2.fromPSBT(base64.decode(checkpoint))
-        );
+        const checkpointTxs = pendingTx.signedCheckpointTxs.map((checkpoint) => {
+          const tx = Transaction$2.fromPSBT(base64.decode(checkpoint));
+          assertAllowedSighashTypes(tx);
+          return tx;
+        });
         assertCheckpointsMatchInputs(
           checkpointTxs,
           inputs.map((input) => ({
@@ -16246,19 +16505,53 @@ function selectVirtualCoins(coins, targetAmount) {
     changeAmount
   };
 }
-async function waitForIncomingFunds(wallet) {
+var AbortError = class extends Error {
+  constructor(message = "Operation aborted") {
+    super(message);
+    this.name = "AbortError";
+  }
+};
+function abortReason(signal) {
+  const { reason } = signal;
+  if (reason instanceof Error) return reason;
+  return new AbortError(typeof reason === "string" ? reason : void 0);
+}
+async function waitForIncomingFunds(wallet, options) {
+  const { signal, timeoutMs } = options ?? {};
+  if (signal?.aborted) throw abortReason(signal);
   let stopFunc;
   let settled = false;
-  return new Promise((resolve) => {
+  let timeoutId;
+  let onAbort;
+  return new Promise((resolve, reject) => {
+    const settle = (deliver) => {
+      if (settled) return;
+      settled = true;
+      if (timeoutId !== void 0) clearTimeout(timeoutId);
+      if (onAbort) signal?.removeEventListener("abort", onAbort);
+      stopFunc?.();
+      deliver();
+    };
+    const cancel = (reason) => settle(() => reject(reason));
+    if (signal) {
+      onAbort = () => cancel(abortReason(signal));
+      signal.addEventListener("abort", onAbort);
+    }
+    if (timeoutMs !== void 0) {
+      timeoutId = setTimeout(
+        () => cancel(new AbortError(`waitForIncomingFunds timed out after ${timeoutMs}ms`)),
+        timeoutMs
+      );
+    }
     wallet.notifyIncomingFunds((funds) => {
       const hasFunds = funds.type === "utxo" ? funds.coins.length > 0 : funds.newVtxos.length > 0;
       if (settled || !hasFunds) return;
-      settled = true;
-      resolve(funds);
-      stopFunc?.();
+      settle(() => resolve(funds));
     }).then((stop) => {
       stopFunc = stop;
       if (settled) stop();
+    }).catch((error) => {
+      cancel(error);
     });
   });
 }
@@ -20088,6 +20381,7 @@ var ListUnspentMethod = "blockchain.scripthash.listunspent";
 var MISSING_TRANSACTION = "missingtransaction";
 var MAX_FETCH_TRANSACTIONS_ATTEMPTS = 5;
 var BLOCK_HEADER_SIZE = 80;
+var MTP_WINDOW = 11;
 function parseBlockHeader(headerHex) {
   const headerBytes = hex.decode(headerHex);
   if (headerBytes.length !== BLOCK_HEADER_SIZE) {
@@ -20394,6 +20688,8 @@ var ElectrumOnchainProvider = class {
   ws;
   network;
   chain;
+  mtpCache;
+  mtpInflight;
   async getCoins(address) {
     const script = this.encodeAddress(address);
     const scriptHash = toScriptHash(script);
@@ -20649,15 +20945,58 @@ var ElectrumOnchainProvider = class {
       blockTime
     };
   }
+  /** `time` is median-time-past, per {@link OnchainProvider.getChainTip};
+   *  Electrum serves raw headers and no MTP, so it is computed here. */
   async getChainTip() {
     const tip = await this.chain.subscribeHeaders();
     const { hash, timestamp } = parseBlockHeader(tip.hex);
     return {
       height: tip.height,
-      time: timestamp,
+      time: await this.medianTimePast(tip.height, timestamp, hash),
       hash
     };
   }
+  /**
+   * Consensus's `GetMedianTimePast`, ending at and including `height`.
+   *
+   * Cached per tip HASH, not height: this runs on every balance read, and
+   * hashing means a reorg at the same height recomputes rather than serving
+   * the orphaned chain's median.
+   */
+  async medianTimePast(height, tipTime, hash) {
+    if (this.mtpCache?.hash === hash) return this.mtpCache.mtp;
+    if (this.mtpInflight?.hash === hash) return this.mtpInflight.mtp;
+    const mtp = this.readMedianTimePast(height, tipTime, hash).finally(() => {
+      this.mtpInflight = void 0;
+    });
+    this.mtpInflight = { hash, mtp };
+    return mtp;
+  }
+  /** Degrades to the tip's `nTime` rather than throwing — a caller that
+   *  cannot read the tip at all is worse off. */
+  async readMedianTimePast(height, tipTime, hash) {
+    const heights = [];
+    for (let h = height - 1; h >= 0 && heights.length < MTP_WINDOW - 1; h--) heights.push(h);
+    if (heights.length === 0) return tipTime;
+    let timestamps;
+    try {
+      const headers = await this.chain.fetchBlockHeaders(heights);
+      timestamps = [
+        tipTime,
+        ...headers.map((header) => parseBlockHeader(header.hex).timestamp)
+      ];
+    } catch (e) {
+      console.warn(
+        "Failed to fetch the median-time-past window; using the tip's own time",
+        e
+      );
+      return tipTime;
+    }
+    timestamps.sort((a, b) => a - b);
+    const mtp = timestamps[Math.floor(timestamps.length / 2)];
+    this.mtpCache = { hash, mtp };
+    return mtp;
+  }
   async watchAddresses(addresses, eventCallback) {
     const scripts = addresses.map((addr) => this.encodeAddress(addr));
     const scriptHashes = scripts.map(toScriptHash);
@@ -22834,6 +23173,10 @@ var ArkadeContract = class _ArkadeContract {
    * When a `contractManager` is configured and this contract is registered,
    * reads the repository-backed state (offline-first, kept fresh by the
    * contract watcher). Otherwise falls back to a direct indexer query.
+   *
+   * Both branches refuse a spent or unilaterally exited output. They are not
+   * otherwise interchangeable: the fallback asks `spendableOnly`, which also
+   * drops swept coins — the manager branch keeps those.
    */
   async getUtxos() {
     const manager = this.client.contractManager;
@@ -22854,7 +23197,7 @@ var ArkadeContract = class _ArkadeContract {
       scripts: [scriptHex],
       spendableOnly: true
     });
-    return vtxos;
+    return vtxos.filter((v) => !hasTerminalSpend(v) && !v.isUnrolled);
   }
   /** Total spendable balance (requires an indexer). */
   async getBalance() {
@@ -23472,6 +23815,6 @@ function createDefaultPaymentRouter(wallet) {
   (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
 */
 
-export { ARKADE_MAGIC, ARKADE_SALTED_PREIMAGE_TAG, ARKADE_SWAP_PREIMAGE_TAG, ActivityRegistry, AmbiguousRouteError, ArkNote, ArkadeCash, ArkadeCashCreateError, AssetManager, BIP21, BIP21Error, BIP322, BLOCKED_UPGRADE_TIMEOUT_MS, Batch, CachingArkProvider, ChainedTxType, ConnectionDisposedError, ContractManager, ContractRepositoryImpl, ContractWatcher, DB_VERSION, DEFAULT_MESSAGE_TIMEOUTS, DEFAULT_MIN_BATCH_EXPIRY_SECONDS, DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, DatabaseUpgradeBlockedError, DelegateManagerImpl, DelegateNotConfiguredError, DelegatorManagerImpl, DelegatorNotConfiguredError, DescriptorIdentity, DescriptorSigningProviderMissingError, DustChangeError, ELECTRUM_TCP_HOST, ELECTRUM_WS_URL, ESPLORA_URL, ElectrumOnchainProvider, EmulatorPacket, EsploraProvider, Estimator, Extension, ExtensionNotFoundError, ForeignDescriptorError, HDDescriptorProvider, INTENT_TERMINAL_STATES, InMemoryContractRepository, InMemoryIntentRepository, InMemoryVirtualTxRepository, InMemoryWalletRepository, IndexedDBContractRepository, IndexedDBIntentRepository, IndexedDBVirtualTxRepository, IndexedDBWalletRepository, MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD, MESSAGE_BUS_INITIALIZING, MESSAGE_BUS_NOT_INITIALIZED, MIGRATION_KEY, MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, MessageBus, MessageBusInitializingError, MessageBusNotInitializedError, MissingSigningDescriptorError, MnemonicIdentity, OnchainWallet, P2A, PaymentRouter, PrevTxUnavailableError, REGTEST_MIN_BATCH_EXPIRY_SECONDS, REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, Ramps, ReadonlyAssetManager, ReadonlyDescriptorIdentity, ReadonlySingleKey, ReadonlyWallet, ReadonlyWalletError, RestDelegateProvider, RestDelegatorProvider, RestEmulatorProvider, SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, SeedIdentity, ServiceWorkerReadonlyWallet, ServiceWorkerTimeoutError, ServiceWorkerWallet, SingleKey, TxTree, TxType, TxWeightEstimator, UnannotatableInputError, UnilateralExit, UnknownPacket, Unroll, VtxoManager, Wallet2 as Wallet, WalletCannotAllocateAddressError, WalletCannotSignError, WalletMessageHandler, WalletNotInitializedError, WalletRepositoryImpl, WsElectrumChainSource, adoptContractDescriptor, arkRail, arkTarget, arkade_exports, assertFinalCommitmentMatchesValidated, assertIntentIdUnique, assertSendableAmount, assertSubmittedArkTxid, assertValidBatchExpiry, assertValidServerUnrollScript, assetMintResolver, attachPrevArkTxs, attachPrevoutTxs, awaitTransaction, boardingResolver, btcTarget, buildForfeitTx, buildOffchainTx, buildPreimageMessage, buildSaltedPreimageMessage, claimWithPreimageIdentity, classifyAgainstSignerSet, classifyContractSigner, closeDatabase, collabExitResolver, combineTapscriptSigs, contractFromArkContract, contractFromArkContractWithAddress, contractPreimage, contractSigner, createAssetPacket, createDefaultActivityRegistry, createDefaultPaymentRouter, createExitChainResolver, createManagedConnection, decodeArkContract, defaultBatchExpiryPolicy, defaultCheckpointExitDelayPolicy, deleteByIndex, deserializeAssets, deserializeExitPackage, deserializeUtxo, deserializeVtxo, encodeArkContract, exitObserverFor, extendVirtualCoinForContract, extractArkProviderUrl, gateExclusion, gatedContracts, getAllByIndexValues, getMigrationStatus, getRandomId, hasBoardingTxExpired, hasCandidates, intentMatchesFilter, intentPageBounds, invoiceTarget, isAddressAllocationCapable, isArkContract, isBatchSignable, isBtcAddress, isContractGenericallySpendable, isCooperativelyMigratable, isDeterministicSigner, isDiscoverable, isHDAllocationCapable, isHDDeterministicSignCapable, isHDWalletCapable, isLightningInvoice, isLnurl, isMessageBusInitializingError, isMessageBusNotInitializedError, isPerArtifactDescriptor, isSigningIdentity, isSubdust, isTerminalIntentState, isValidArkAddress, isVtxoExpiringSoon, isVtxoForScript, isWatchedContract, logExcludedVtxos, makeHandle, matchServerCheckpoints, mergeChainedTxType, migrateWalletRepository, notifyExitObserved, onchainRail, openDatabase, outpointExclusion, outpointReasons, promisifyRequest, provisionClaimSecret, provisionRefundKey, requiresMigration, resolveBatchExpiryPolicy, resolveCheckpointExitDelayPolicy, resolveDescriptorSigner, resolvePrevTxs, resolveSendAmount, rollbackMigration, saveVtxosForContract, scriptFromArkAddress, selectCoinsWithAsset, selectVirtualCoins, serializeAssets, serializeExitPackage, serializeUtxo, serializeVtxo, setupServiceWorker, signAndSubmitOffchainTx, signerSetFromInfo, signingDescriptorIndex, strictSigningDescriptorIndex, toXOnlySignerHex, tryResolveSendAmount, validateBatchRecipients, validateConnectorsTxGraph, validateVtxoTxGraph, verifyTapscriptSignatures, waitForIncomingFunds, warnAndFilterVtxosForScript, withPrevTxs };
-//# sourceMappingURL=chunk-AEWJU6NZ.js.map
-//# sourceMappingURL=chunk-AEWJU6NZ.js.map
+export { ARKADE_MAGIC, ARKADE_SALTED_PREIMAGE_TAG, ARKADE_SWAP_PREIMAGE_TAG, AbortError, ActivityRegistry, AmbiguousRouteError, ArkNote, ArkadeCash, ArkadeCashCreateError, AssetManager, BIP21, BIP21Error, BIP322, BLOCKED_UPGRADE_TIMEOUT_MS, Batch, CachingArkProvider, ChainedTxType, ConnectionDisposedError, ContractManager, ContractRepositoryImpl, ContractWatcher, DB_VERSION, DEFAULT_MESSAGE_TIMEOUTS, DEFAULT_MIN_BATCH_EXPIRY_SECONDS, DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, DatabaseUpgradeBlockedError, DelegateManagerImpl, DelegateNotConfiguredError, DelegatorManagerImpl, DelegatorNotConfiguredError, DescriptorIdentity, DescriptorSigningProviderMissingError, DustChangeError, ELECTRUM_TCP_HOST, ELECTRUM_WS_URL, ESPLORA_URL, ElectrumOnchainProvider, EmulatorPacket, EsploraProvider, Estimator, Extension, ExtensionNotFoundError, ForeignDescriptorError, HDDescriptorProvider, INTENT_TERMINAL_STATES, InMemoryContractRepository, InMemoryIntentRepository, InMemoryVirtualTxRepository, InMemoryWalletRepository, IndexedDBContractRepository, IndexedDBIntentRepository, IndexedDBVirtualTxRepository, IndexedDBWalletRepository, MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD, MESSAGE_BUS_INITIALIZING, MESSAGE_BUS_NOT_INITIALIZED, MIGRATION_KEY, MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, MessageBus, MessageBusInitializingError, MessageBusNotInitializedError, MissingSigningDescriptorError, MnemonicIdentity, OnchainWallet, P2A, PaymentRouter, PrevTxUnavailableError, REGTEST_MIN_BATCH_EXPIRY_SECONDS, REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, Ramps, ReadonlyAssetManager, ReadonlyDescriptorIdentity, ReadonlySingleKey, ReadonlyWallet, ReadonlyWalletError, RestDelegateProvider, RestDelegatorProvider, RestEmulatorProvider, SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, SeedIdentity, ServiceWorkerReadonlyWallet, ServiceWorkerTimeoutError, ServiceWorkerWallet, SingleKey, TxTree, TxType, TxWeightEstimator, UnannotatableInputError, UnilateralExit, UnknownPacket, Unroll, VtxoManager, Wallet2 as Wallet, WalletCannotAllocateAddressError, WalletCannotSignError, WalletMessageHandler, WalletNotInitializedError, WalletRepositoryImpl, WsElectrumChainSource, adoptContractDescriptor, arkRail, arkTarget, arkade_exports, assertFinalCommitmentMatchesValidated, assertIntentIdUnique, assertSendableAmount, assertSubmittedArkTxid, assertValidBatchExpiry, assertValidServerUnrollScript, assetMintResolver, attachPrevArkTxs, attachPrevoutTxs, awaitTransaction, boardingResolver, btcTarget, buildForfeitTx, buildOffchainTx, buildPreimageMessage, buildSaltedPreimageMessage, claimWithPreimageIdentity, classifyAgainstSignerSet, classifyContractSigner, closeDatabase, collabExitResolver, combineTapscriptSigs, contractFromArkContract, contractFromArkContractWithAddress, contractPreimage, contractSigner, createAssetPacket, createDefaultActivityRegistry, createDefaultPaymentRouter, createExitChainResolver, createManagedConnection, decodeArkContract, defaultBatchExpiryPolicy, defaultCheckpointExitDelayPolicy, deleteByIndex, deserializeAssets, deserializeExitPackage, deserializeUtxo, deserializeVtxo, encodeArkContract, exitObserverFor, extendVirtualCoinForContract, extractArkProviderUrl, gateExclusion, gatedContracts, getAllByIndexValues, getMigrationStatus, getRandomId, hasBoardingTxExpired, hasCandidates, intentMatchesFilter, intentPageBounds, invoiceTarget, isAddressAllocationCapable, isArkContract, isBatchSignable, isBtcAddress, isContractGenericallySpendable, isCooperativelyMigratable, isDeterministicSigner, isDiscoverable, isHDAllocationCapable, isHDDeterministicSignCapable, isHDWalletCapable, isLightningInvoice, isLnurl, isMessageBusInitializingError, isMessageBusNotInitializedError, isPerArtifactDescriptor, isSigningIdentity, isSubdust, isTerminalIntentState, isValidArkAddress, isVtxoExpiringSoon, isVtxoForScript, isWatchedContract, logExcludedVtxos, makeHandle, matchServerCheckpoints, mergeChainedTxType, migrateWalletRepository, notifyExitObserved, onchainRail, openDatabase, outpointExclusion, outpointReasons, promisifyRequest, provisionClaimSecret, provisionRefundKey, requiresMigration, resolveBatchExpiryPolicy, resolveCheckpointExitDelayPolicy, resolveDescriptorSigner, resolvePrevTxs, resolveSendAmount, rollbackMigration, saveVtxosForContract, scriptFromArkAddress, selectCoinsWithAsset, selectVirtualCoins, serializeAssets, serializeExitPackage, serializeUtxo, serializeVtxo, setupServiceWorker, signAndSubmitOffchainTx, signerSetFromInfo, signingDescriptorIndex, strictSigningDescriptorIndex, toXOnlySignerHex, tryResolveSendAmount, validateBatchRecipients, validateConnectorsTxGraph, validateVtxoTxGraph, verifyTapscriptSignatures, waitForIncomingFunds, warnAndFilterVtxosForScript, withPrevTxs };
+//# sourceMappingURL=chunk-TA7XLEP2.js.map
+//# sourceMappingURL=chunk-TA7XLEP2.js.map