@arkade-os/sdk 0.4.72 → 0.4.74

package/dist/{chunk-BHLYB44A.js → chunk-ZTGTQP2W.js}

@@ -1,6 +1,6 @@
-import { AssetId, AssetGroup, AssetInput, AssetOutput, Metadata, Packet, BufferReader, BufferWriter, AssetRef, RestIndexerProvider } from './chunk-IGER5FPC.js';
-import { witnessRefToBytes, validateProgram, toASM, stringifyArtifact, serializeArkadeContractParams, resolveAsm, parseArtifact, getOpcodeValue, getOpcodeName, fromASM, deserializeArkadeContractParams, computeArkadeScriptPublicKey, bytesToASM, asmToBytes, arkadeWitnessHash, arkadeScriptHash, SUPPORTED_PROGRAM_VERSION, OPCODE_VALUES, OPCODE_NAMES, bignum_exports, ArkadeScript, ArkadeProgramScript, ARKADE_OPS, ARKADE_OPCODE_VALUES, ARKADE_OPCODE_NAMES, ARKADE_OPCODES, ARKADE_OP, toXOnly, inputName, contractHandlers, isMainnetDescriptor, descriptorIsOurs, deriveDescriptorLeafPubKey, deriveDescriptorLeafCompressedPubKey, parseHDDescriptor, identityDescriptor, DefaultVtxo, speculativeReceiveMetadata, DelegateVtxo, WALLET_RECEIVE_SOURCE, BoardingContractHandler } from './chunk-CB6QPAO5.js';
-import { VtxoScript, Transaction, isRecoverable, CSVMultisigTapscript, DEFAULT_NETWORK, resolveEmulatorPubkey, hasTerminalSpend, getNormalizedVtxos, setArkPsbtField, PrevArkTxField, ConditionWitness, craftToSpendTx, ArkAddress, isVirtualCoin, getArkPsbtFields, CosignerPublicKey, ServerResponseMismatchError, OP_RETURN_EMPTY_PKSCRIPT, canSweepOnchain, sequenceToTimelock, decodeTapscript, scriptFromTapLeafScript, CLTVMultisigTapscript, VtxoTaprootTree, timelockToSequence, assertAllowedSighashTypes, baseFetch, Intent, rateGate, DEFAULT_NETWORK_NAME, formatSighash, normalizeVtxo, getSequence, toBatchExpiry, maybeArkError, isArkError, ArkErrorName, toOffchainInputFeeParams, canRecoverOnchain, getNetwork, MultisigTapscript, isEventSourceError, isEventSourceUnavailableError, getAllNormalizedVtxos, isPastExpiry, isRetryableProviderError, DEFAULT_PAGE_SIZE, RestArkProvider, toVirtualStatus, ArkError, TapTreeCoder, resolveTimeHeight, canSpendOffchain, parseLegacyExpiry, isExpired, PrevoutTxField, fetchVtxoCreatedAtByTxid, DEFAULT_ARKADE_SERVER_URL, ProviderUnavailableError, networks as networks$1 } from './chunk-5GQFYVWP.js';
+import { AssetId, AssetGroup, AssetInput, AssetOutput, Metadata, Packet, BufferReader, BufferWriter, AssetRef, RestIndexerProvider } from './chunk-X5BPARRD.js';
+import { witnessRefToBytes, validateProgram, toASM, stringifyArtifact, serializeArkadeContractParams, resolveAsm, parseArtifact, getOpcodeValue, getOpcodeName, fromASM, deserializeArkadeContractParams, computeArkadeScriptPublicKey, bytesToASM, asmToBytes, arkadeWitnessHash, arkadeScriptHash, SUPPORTED_PROGRAM_VERSION, OPCODE_VALUES, OPCODE_NAMES, bignum_exports, ArkadeScript, ArkadeProgramScript, ARKADE_OPS, ARKADE_OPCODE_VALUES, ARKADE_OPCODE_NAMES, ARKADE_OPCODES, ARKADE_OP, toXOnly, inputName, contractHandlers, isMainnetDescriptor, descriptorIsOurs, deriveDescriptorLeafPubKey, deriveDescriptorLeafCompressedPubKey, parseHDDescriptor, identityDescriptor, DefaultVtxo, speculativeReceiveMetadata, DelegateVtxo, WALLET_RECEIVE_SOURCE, BoardingContractHandler } from './chunk-LGB65ZCO.js';
+import { VtxoScript, Transaction, isRecoverable, CSVMultisigTapscript, DEFAULT_NETWORK, resolveEmulatorPubkey, hasTerminalSpend, getNormalizedVtxos, setArkPsbtField, PrevArkTxField, ConditionWitness, craftToSpendTx, ArkAddress, isVirtualCoin, getArkPsbtFields, CosignerPublicKey, ServerResponseMismatchError, OP_RETURN_EMPTY_PKSCRIPT, canSweepOnchain, sequenceToTimelock, decodeTapscript, scriptFromTapLeafScript, CLTVMultisigTapscript, VtxoTaprootTree, timelockToSequence, assertAllowedSighashTypes, baseFetch, Intent, rateGate, DEFAULT_NETWORK_NAME, formatSighash, normalizeVtxo, getSequence, toBatchExpiry, maybeArkError, isArkError, ArkErrorName, toOffchainInputFeeParams, canRecoverOnchain, getNetwork, MultisigTapscript, isEventSourceError, isEventSourceUnavailableError, getAllNormalizedVtxos, isPastExpiry, isRetryableProviderError, DEFAULT_PAGE_SIZE, RestArkProvider, toVirtualStatus, ArkError, TapTreeCoder, resolveTimeHeight, canSpendOffchain, parseLegacyExpiry, isExpired, PrevoutTxField, fetchVtxoCreatedAtByTxid, DEFAULT_ARKADE_SERVER_URL, ProviderUnavailableError, networks as networks$1 } from './chunk-WJVOFYTQ.js';
 import { __export } from './chunk-NSBPE2FW.js';
 import { sha256 as sha256$1, equalBytes, hash160, sha256x2, concatBytes, randomPrivateKeyBytes, pubECDSA, pubSchnorr } from '@scure/btc-signer/utils.js';
 import { SigHash, Script, OP, OutScript, Address, RawWitness, p2tr, p2wpkh, TaprootControlBlock, DEFAULT_SEQUENCE, Transaction as Transaction$2 } from '@scure/btc-signer';
@@ -2698,6 +2698,12 @@ var ErrOnchainOutputNotFound = (address) => new ServerResponseMismatchError(`onc
 var ErrUnvalidatedOffchainOutput = (address) => new ServerResponseMismatchError(
   `offchain output ${address} cannot be validated: virtual output tree signing did not run`
 );
+var ErrIntentOutputNotFound = (index, kind) => new ServerResponseMismatchError(
+  `${kind} output ${index} of the intent proof is not present in what the server built`
+);
+var ErrUnvalidatedIntentOutput = (index) => new ServerResponseMismatchError(
+  `offchain output ${index} of the intent proof cannot be validated: virtual output tree signing did not run`
+);
 var ErrInvalidOnchainOutputAmount = (address) => new Error(`invalid onchain output amount: ${address}`);
 var ErrInvalidOnchainOutputAssets = (address) => new Error(`onchain output ${address} cannot have assets`);
 var ErrInvalidOffchainOutputAmount = (address) => new Error(`invalid offchain output ${address}, missing amount`);
@@ -2734,6 +2740,74 @@ function validateBatchRecipientsWithoutTree(commitmentTx, recipients, network) {
     throw ErrUnvalidatedOffchainOutput(recipient.address);
   }
 }
+function declaredIntentOutputs(signedProof, onchainOutputIndexes) {
+  const proof = Transaction.fromPSBT(base64.decode(signedProof));
+  const onchain = new Set(onchainOutputIndexes);
+  const declared = [];
+  for (let i = 0; i < proof.outputsLength; i++) {
+    const output = proof.getOutput(i);
+    if (!output?.script || output.script.length === 0 || !output.amount) continue;
+    declared.push({
+      index: i,
+      script: output.script,
+      amount: output.amount,
+      onchain: onchain.has(i)
+    });
+  }
+  return declared;
+}
+function validateBatchAgainstIntent(commitmentTx, vtxoTreeLeaves, declared) {
+  const usedOnchain = /* @__PURE__ */ new Set();
+  const usedLeaf = /* @__PURE__ */ new Set();
+  for (const output of declared) {
+    if (output.onchain) {
+      if (!takeOnchainOutput(commitmentTx, output, usedOnchain)) {
+        throw ErrIntentOutputNotFound(output.index, "onchain");
+      }
+      continue;
+    }
+    if (!takeLeafOutput(vtxoTreeLeaves, output, usedLeaf)) {
+      throw ErrIntentOutputNotFound(output.index, "offchain");
+    }
+  }
+}
+function validateBatchAgainstIntentWithoutTree(commitmentTx, declared) {
+  const usedOnchain = /* @__PURE__ */ new Set();
+  for (const output of declared) {
+    if (!output.onchain) {
+      throw ErrUnvalidatedIntentOutput(output.index);
+    }
+    if (!takeOnchainOutput(commitmentTx, output, usedOnchain)) {
+      throw ErrIntentOutputNotFound(output.index, "onchain");
+    }
+  }
+}
+function takeOnchainOutput(commitmentTx, declared, used) {
+  for (let i = 0; i < commitmentTx.outputsLength; i++) {
+    if (used.has(i)) continue;
+    const output = commitmentTx.getOutput(i);
+    if (!output?.script || output.amount !== declared.amount) continue;
+    if (!equalBytes(output.script, declared.script)) continue;
+    used.add(i);
+    return true;
+  }
+  return false;
+}
+function takeLeafOutput(leaves, declared, used) {
+  for (let leafIdx = 0; leafIdx < leaves.length; leafIdx++) {
+    const leaf = leaves[leafIdx];
+    for (let i = 0; i < leaf.outputsLength; i++) {
+      const key = `${leafIdx}:${i}`;
+      if (used.has(key)) continue;
+      const output = leaf.getOutput(i);
+      if (!output?.script || output.amount !== declared.amount) continue;
+      if (!equalBytes(output.script, declared.script)) continue;
+      used.add(key);
+      return true;
+    }
+  }
+  return false;
+}
 function validateOnchainRecipient(commitmentTx, recipient, network, usedOutputs) {
   const addr = Address(network).decode(recipient.address);
   const expectedPkScript = OutScript.encode(addr);
@@ -3496,21 +3570,38 @@ function assertSubmittedArkTxid(response, signedArkTx, context) {
     );
   }
 }
-function assertServerSignedLeaf(serverTx, localTx, inputIndex, serverPubkeyHex, context) {
+function assertServerSignedLeaf(serverTx, localTx, inputIndex, serverPubkeys, context) {
   const leaf = localTx.getInput(inputIndex).tapLeafScript?.[0];
   if (!leaf) {
     throw new Error(
       `${context}: input ${inputIndex} carries no spend leaf to verify the server signature against`
     );
   }
+  const script = scriptFromTapLeafScript(leaf);
+  let leafPubkeys;
+  try {
+    leafPubkeys = decodeTapscript(script).params.pubkeys.map(
+      (key) => hex.encode(toXOnly(key, "leaf key"))
+    );
+  } catch (error) {
+    throw new ServerResponseMismatchError(
+      `${context}: input ${inputIndex} spend leaf cannot be decoded (${error instanceof Error ? error.message : String(error)})`
+    );
+  }
+  const signer = leafPubkeys.find((key) => serverPubkeys.has(key));
+  if (!signer) {
+    throw new ServerResponseMismatchError(
+      `${context}: input ${inputIndex} spend leaf names no signer key the server advertises`
+    );
+  }
   try {
     verifyTapscriptSignatures(
       serverTx,
       inputIndex,
-      [serverPubkeyHex],
+      [signer],
       void 0,
       void 0,
-      tapLeafHash(scriptFromTapLeafScript(leaf))
+      tapLeafHash(script)
     );
   } catch (error) {
     throw new ServerResponseMismatchError(
@@ -3584,24 +3675,22 @@ async function submitOffchainTx(provider, offchainTx, signer, hooks, options) {
       );
     }
     const finalArkTx = Transaction.fromPSBT(base64.decode(response.finalArkTx));
-    const serverPubkeyHex = hex.encode(toXOnly(verify.serverPubkey, "server key"));
+    const serverPubkeys = new Set(
+      [verify.serverPubkey, ...verify.deprecatedServerPubkeys ?? []].map(
+        (key) => hex.encode(toXOnly(key, "server key"))
+      )
+    );
     for (let i = 0; i < offchainTx.arkTx.inputsLength; i++) {
       assertServerSignedLeaf(
         finalArkTx,
         offchainTx.arkTx,
         i,
-        serverPubkeyHex,
+        serverPubkeys,
         "submitTx ark tx"
       );
     }
     matched.forEach(
-      ({ server, local }, index) => assertServerSignedLeaf(
-        server,
-        local,
-        0,
-        serverPubkeyHex,
-        `submitTx checkpoint ${index}`
-      )
+      ({ server, local }, index) => assertServerSignedLeaf(server, local, 0, serverPubkeys, `submitTx checkpoint ${index}`)
     );
   }
   let finalCheckpoints;
@@ -7638,12 +7727,7 @@ async function delegate(identity, delegateProvider, arkInfo, delegateInfo, vtxos
     if (!expiryTimestamp || expiryTimestamp === Number.MAX_SAFE_INTEGER) {
       delegateAt = new Date(Date.now() + 1 * 60 * 1e3);
     } else {
-      const remainingTimeMs = expiryTimestamp - Date.now();
-      if (remainingTimeMs <= 0) {
-        delegateAt = new Date(Date.now() + 1 * 60 * 1e3);
-      } else {
-        delegateAt = new Date(expiryTimestamp - remainingTimeMs * 0.1);
-      }
+      delegateAt = defaultDelegateAt(expiryTimestamp, arkInfo.sessionDuration);
     }
   }
   const { fees, dust, forfeitAddress, network } = arkInfo;
@@ -7803,6 +7887,14 @@ async function makeSignedDelegateIntent(identity, coins, outputs, onchainOutputs
     message
   };
 }
+function defaultDelegateAt(expiryTimestamp, sessionDurationSeconds, now = Date.now()) {
+  const remainingTimeMs = expiryTimestamp - now;
+  if (remainingTimeMs <= 0) return new Date(now + 6e4);
+  const sessionLeadMs = Number(sessionDurationSeconds * 1000n);
+  const leadTimeMs = Math.max(remainingTimeMs * 0.1, sessionLeadMs);
+  const delegateAt = expiryTimestamp - leadTimeMs;
+  return new Date(delegateAt > now ? delegateAt : now + 2e3);
+}
 function findDestinationOutputIndex(outputs, destinationScript) {
   return outputs.findIndex((o) => o.script && equalBytes(o.script, destinationScript));
 }
@@ -8918,23 +9010,32 @@ var ContractWatcher = class {
   }
   /** @see IContractManager.watchScript for the delivery and filter contract. */
   async addWatchedScript(script, options) {
-    const existing = this.watchedScripts.get(script);
-    if (existing) {
-      if (options?.label !== void 0) existing.label = options.label;
-      return;
+    const added = [];
+    for (const one of Array.isArray(script) ? script : [script]) {
+      const existing = this.watchedScripts.get(one);
+      if (existing) {
+        if (options?.label !== void 0) existing.label = options.label;
+        continue;
+      }
+      this.watchedScripts.set(one, {
+        label: options?.label,
+        lastKnownVtxos: /* @__PURE__ */ new Map()
+      });
+      added.push(one);
     }
-    this.watchedScripts.set(script, {
-      label: options?.label,
-      lastKnownVtxos: /* @__PURE__ */ new Map()
-    });
-    if (this.isWatching) {
-      await this.pollWatchedScripts([script]);
+    if (added.length === 0 || !this.isWatching) return;
+    await this.withCoalescedSubscription(async () => {
+      await this.pollWatchedScripts(added);
       await this.tryUpdateSubscription();
-    }
+    });
   }
   /** Stop watching a script added by {@link addWatchedScript}. */
   async removeWatchedScript(script) {
-    if (!this.watchedScripts.delete(script)) return;
+    let removed = false;
+    for (const one of Array.isArray(script) ? script : [script]) {
+      if (this.watchedScripts.delete(one)) removed = true;
+    }
+    if (!removed) return;
     if (this.isWatching) {
       await this.tryUpdateSubscription();
     }
@@ -15370,6 +15471,7 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
     const connectorsLeaves = connectorsGraph?.leaves() || [];
     for (const input of inputs) {
       if (!isVirtualCoin(input)) {
+        let matched = false;
         for (let i = 0; i < settlementPsbt.inputsLength; i++) {
           const settlementInput = settlementPsbt.getInput(i);
           if (!settlementInput.txid || settlementInput.index === void 0) {
@@ -15396,8 +15498,14 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
             throw new Error(await this.unsignableBoardingInputError(input, script));
           }
           hasBoardingUtxos = true;
+          matched = true;
           break;
         }
+        if (!matched && !(input instanceof ArkNote)) {
+          throw new Error(
+            `boarding input ${input.txid}:${input.vout} is not an input of the commitment tx`
+          );
+        }
         continue;
       }
       if (canRecoverOnchain(input, { timestamp: /* @__PURE__ */ new Date() }) || isSubdust({ value: input.value }, this.dustAmount)) {
@@ -16538,18 +16646,33 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
         this.inputSigningJobsFromWitnessUtxos(checkpoint)
       )
     };
-    return submitOffchainTx(this.arkProvider, offchainTx, signer, {
-      // Mark pending before submitting — if we crash between submit and
-      // finalize, the next init recovers via finalizePendingTxs.
-      beforeSubmit: () => this.setPendingTxFlag(true),
-      afterFinalize: async () => {
-        try {
-          await this.setPendingTxFlag(false);
-        } catch (error) {
-          console.error("Failed to clear pending tx flag:", error);
+    return submitOffchainTx(
+      this.arkProvider,
+      offchainTx,
+      signer,
+      {
+        // Mark pending before submitting — if we crash between submit and
+        // finalize, the next init recovers via finalizePendingTxs.
+        beforeSubmit: () => this.setPendingTxFlag(true),
+        afterFinalize: async () => {
+          try {
+            await this.setPendingTxFlag(false);
+          } catch (error) {
+            console.error("Failed to clear pending tx flag:", error);
+          }
+        }
+      },
+      {
+        // Deprecated keys too: a vtxo built before a rotation is still
+        // spent under the signer its leaf names.
+        verifyServerSignatures: {
+          serverPubkey: this._arkServerPublicKey,
+          deprecatedServerPubkeys: [...this._deprecatedSigners.keys()].map(
+            (h) => hex.decode(h)
+          )
         }
       }
-    });
+    );
   }
   // mark virtual outputs as spent, save change outputs if any.
   // `offchainTapscript` and `serverPubKey` are the epoch snapshot the
@@ -17492,6 +17615,23 @@ function offboardDestinationScript(destinationAddress) {
   }
   throw new Error(`Failed to decode destination address: ${destinationAddress}`);
 }
+var CHANGE_FEE_MAX_ROUNDS = 8;
+function settleChangeAgainstFee(change, feeOn) {
+  let net = change;
+  for (let i = 0; i < CHANGE_FEE_MAX_ROUNDS; i++) {
+    const next = change - feeOn(net > 0n ? net : 0n);
+    if (next === net) return net > 0n ? net : 0n;
+    net = next;
+  }
+  throw new Error(
+    `change fee does not settle after ${CHANGE_FEE_MAX_ROUNDS} rounds (${change} sats of change); settle the full balance instead`
+  );
+}
+function reportUngatedInputs(wallet, inputs) {
+  if (!("logUngatedInputs" in wallet)) return;
+  const logger = wallet;
+  void logger.logUngatedInputs("Ramps.offboard({ vtxos })", inputs);
+}
 var Ramps = class {
   /**
    * Create convenience wrappers for onboarding and offboarding flows.
@@ -17545,6 +17685,19 @@ var Ramps = class {
       }
       change = totalAmount - amount;
     }
+    let boardingAddress;
+    if (change > 0n) {
+      boardingAddress = await this.wallet.getBoardingAddress();
+      const changeScript = hex.encode(offboardDestinationScript(boardingAddress));
+      change = settleChangeAgainstFee(
+        change,
+        (amt) => BigInt(estimator.evalOnchainOutput({ amount: amt, script: changeScript }).satoshis)
+      );
+      const dustAmount = getDustAmount(this.wallet);
+      if (change > 0n && change < dustAmount) {
+        throw new DustChangeError(change, dustAmount);
+      }
+    }
     amount = amount ?? totalAmount;
     const offchainAddress = await this.wallet.getAddress();
     const offchainAddr = ArkAddress.decode(offchainAddress);
@@ -17566,7 +17719,6 @@ var Ramps = class {
       }
     ];
     if (change > 0n) {
-      const boardingAddress = await this.wallet.getBoardingAddress();
       outputs.push({
         address: boardingAddress,
         amount: change
@@ -17587,6 +17739,10 @@ var Ramps = class {
    * @param feeInfo - The fee info to deduct from the offboard amount.
    * @param amount - The amount to offboard. If not provided, the total amount of virtual outputs will be offboarded.
    * @param eventCallback - Optional callback that receives settlement events
+   * @param vtxos - Specific virtual outputs to spend, mirroring {@link onboard}'s
+   * `boardingUtxos`. Omitted, every spendable one is spent — merging the whole
+   * off-chain balance into a single change output. Taken as given like
+   * `settle({ inputs })`: an `amount` these cannot cover is an error, not a top-up.
    * @returns The Arkade transaction id created by settlement
    * @throws Error if no virtual outputs remain after fee deduction or the destination address cannot be decoded
    * @see IWallet.getSpendableVtxos
@@ -17598,8 +17754,10 @@ var Ramps = class {
    * await ramps.offboard('bc1q...', feeInfo);
    * ```
    */
-  async offboard(destinationAddress, feeInfo, amount, eventCallback) {
-    const vtxos = await this.wallet.getSpendableVtxos({
+  async offboard(destinationAddress, feeInfo, amount, eventCallback, vtxos) {
+    const named = vtxos !== void 0;
+    if (vtxos) reportUngatedInputs(this.wallet, vtxos);
+    vtxos ??= await this.wallet.getSpendableVtxos({
       withRecoverable: true,
       withUnrolled: false
     });
@@ -17609,6 +17767,11 @@ var Ramps = class {
     for (const vtxo of vtxos) {
       const inputFee = estimator.evalOffchainInput(toOffchainInputFeeParams(vtxo));
       if (inputFee.satoshis >= vtxo.value) {
+        if (named) {
+          throw new Error(
+            `selected vtxo ${vtxo.txid}:${vtxo.vout} costs ${inputFee.satoshis} sats to spend and is worth ${vtxo.value} \u2014 drop it from the selection`
+          );
+        }
         continue;
       }
       filteredVtxos.push(vtxo);
@@ -17624,6 +17787,15 @@ var Ramps = class {
       }
       change = totalAmount - amount;
     }
+    let changeAddress;
+    if (change > 0n) {
+      changeAddress = await this.wallet.getAddress();
+      const changeScript = hex.encode(ArkAddress.decode(changeAddress).pkScript);
+      change = settleChangeAgainstFee(
+        change,
+        (amount2) => BigInt(estimator.evalOffchainOutput({ amount: amount2, script: changeScript }).satoshis)
+      );
+    }
     const dustAmount = getDustAmount(this.wallet);
     if (change > 0n && change < dustAmount) {
       throw new DustChangeError(change, dustAmount);
@@ -17647,7 +17819,7 @@ var Ramps = class {
       }
     ];
     if (change > 0n) {
-      const offchainAddress = await this.wallet.getAddress();
+      const offchainAddress = changeAddress;
       outputs.push({
         address: offchainAddress,
         amount: change
@@ -23238,6 +23410,12 @@ function createArkadeBatchHandler(intentId, inputs, signer, signedProof, message
       validateVtxoTxGraph(vtxoTree, commitmentTx, sweepTapTreeRoot);
       if (recipients && recipients.length > 0) {
         validateBatchRecipients(commitmentTx, vtxoTree.leaves(), recipients, network);
+      } else {
+        validateBatchAgainstIntent(
+          commitmentTx,
+          vtxoTree.leaves(),
+          declaredIntentOutputs(signedProof, message.onchain_output_indexes)
+        );
       }
       const sharedOutput = commitmentTx.getOutput(0);
       if (!sharedOutput?.amount) {
@@ -23272,8 +23450,15 @@ function createArkadeBatchHandler(intentId, inputs, signer, signedProof, message
         validatedCommitmentTxid,
         "arkade batch finalization"
       );
-      if (!validatedCommitmentTxid && recipients && recipients.length > 0) {
-        validateBatchRecipientsWithoutTree(commitmentPsbt, recipients, network);
+      if (!validatedCommitmentTxid) {
+        if (recipients && recipients.length > 0) {
+          validateBatchRecipientsWithoutTree(commitmentPsbt, recipients, network);
+        } else {
+          validateBatchAgainstIntentWithoutTree(
+            commitmentPsbt,
+            declaredIntentOutputs(signedProof, message.onchain_output_indexes)
+          );
+        }
       }
       const signedForfeits = [];
       let connectorIndex = 0;
@@ -24032,6 +24217,16 @@ function assertNoAssets(railId, req) {
     );
   }
 }
+function selectionOf(req) {
+  return req.selectedVtxos;
+}
+function assertNoSelection(railId, req) {
+  if (selectionOf(req) !== void 0) {
+    throw new Error(
+      `${railId}: cannot spend a caller-chosen input set (selectedVtxos) \u2014 this rail does not choose the coins it spends`
+    );
+  }
+}
 function resolveAssetAmount(railId, req) {
   const assets = assetsOf(req);
   if (assets.length !== 1) {
@@ -24175,13 +24370,17 @@ function arkRail() {
       const address = arkTarget(req.raw);
       assertNoAssets("ark", req);
       const amt = resolveSendAmount("ark", req.raw, req.amount);
+      const selectedVtxos = selectionOf(req);
       return {
         railId: "ark",
         amount: amt,
         fee: 0,
         total: amt,
         send: async () => makeHandle("ark", async (emit) => {
-          const txid = await ctx.wallet.send({ address, amount: amt });
+          const txid = selectedVtxos ? await ctx.wallet.send({
+            recipients: [{ address, amount: amt }],
+            selectedVtxos
+          }) : await ctx.wallet.send({ address, amount: amt });
           const result = { railId: "ark", txid };
           emit({ status: "settled", result });
           return result;
@@ -24204,6 +24403,7 @@ function arkAssetRail() {
       const asset = resolveAssetAmount("ark-asset", req);
       if (req.amount !== void 0) assertSendableAmount("ark-asset", req.amount);
       const carrier = tryResolveSendAmount(req.raw, req.amount) ?? ASSET_CARRIER_SATS;
+      const selectedVtxos = selectionOf(req);
       return {
         railId: "ark-asset",
         amount: carrier,
@@ -24211,11 +24411,8 @@ function arkAssetRail() {
         total: carrier,
         assets: { delivered: asset, spent: asset },
         send: async () => makeHandle("ark-asset", async (emit) => {
-          const txid = await ctx.wallet.send({
-            address,
-            amount: carrier,
-            assets: [asset]
-          });
+          const recipient = { address, amount: carrier, assets: [asset] };
+          const txid = selectedVtxos ? await ctx.wallet.send({ recipients: [recipient], selectedVtxos }) : await ctx.wallet.send(recipient);
           const result = { railId: "ark-asset", txid };
           emit({ status: "settled", result });
           return result;
@@ -24237,6 +24434,13 @@ function grossUpOffboard(net, feeInfo, script) {
   }
   return { gross, fee: gross - net };
 }
+function offchainInputFees(vtxos, fees) {
+  const estimator = new Estimator(fees?.intentFee ?? {});
+  return vtxos.reduce(
+    (total, vtxo) => total + estimator.evalOffchainInput(toOffchainInputFeeParams(vtxo)).satoshis,
+    0
+  );
+}
 function onchainRail(deps) {
   if (typeof deps?.feeInfo !== "function") {
     throw new Error("onchain rail: a feeInfo source is required");
@@ -24253,17 +24457,22 @@ function onchainRail(deps) {
       const fees = await deps.feeInfo();
       const script = hex.encode(offboardDestinationScript(address));
       const { gross, fee } = grossUpOffboard(amt, fees, script);
+      const selectedVtxos = selectionOf(req);
+      const inputFee = selectedVtxos ? offchainInputFees(selectedVtxos, fees) : 0;
       return {
         railId: "onchain",
         amount: amt,
-        fee,
-        total: gross,
+        fee: fee + inputFee,
+        total: gross + inputFee,
         send: async () => makeHandle("onchain", async (emit) => {
-          const txid = await new Ramps(ctx.wallet).offboard(
+          const ramps = new Ramps(ctx.wallet);
+          const txid = selectedVtxos ? await ramps.offboard(
             address,
             fees,
-            BigInt(gross)
-          );
+            BigInt(gross),
+            void 0,
+            selectedVtxos
+          ) : await ramps.offboard(address, fees, BigInt(gross));
           const result = { railId: "onchain", txid };
           emit({ status: "settled", result });
           return result;
@@ -24286,6 +24495,6 @@ function createDefaultPaymentRouter(wallet) {
   (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
 */
 
-export { ARKADE_MAGIC, ARKADE_SALTED_PREIMAGE_TAG, ARKADE_SWAP_PREIMAGE_TAG, ASSET_CARRIER_SATS, AbortError, ActivityRegistry, AmbiguousRouteError, ArkNote, ArkadeCash, ArkadeCashCreateError, AssetManager, BIP21, BIP21Error, BIP322, BLOCKED_UPGRADE_TIMEOUT_MS, Batch, CachingArkProvider, ChainedTxType, ConnectionDisposedError, ContractManager, ContractRepositoryImpl, ContractWatcher, DB_VERSION, DEFAULT_MESSAGE_TIMEOUTS, DEFAULT_MIN_BATCH_EXPIRY_SECONDS, DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, DatabaseUpgradeBlockedError, DelegateManagerImpl, DelegateNotConfiguredError, DelegatorManagerImpl, DelegatorNotConfiguredError, DescriptorIdentity, DescriptorSigningProviderMissingError, DustChangeError, ELECTRUM_TCP_HOST, ELECTRUM_WS_URL, ESPLORA_URL, ElectrumOnchainProvider, EmulatorPacket, EsploraProvider, Estimator, Extension, ExtensionNotFoundError, ForeignDescriptorError, HDDescriptorProvider, INTENT_TERMINAL_STATES, InMemoryContractRepository, InMemoryIntentRepository, InMemoryVirtualTxRepository, InMemoryWalletRepository, IndexedDBContractRepository, IndexedDBIntentRepository, IndexedDBVirtualTxRepository, IndexedDBWalletRepository, MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD, MESSAGE_BUS_INITIALIZING, MESSAGE_BUS_NOT_INITIALIZED, MIGRATION_KEY, MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, MessageBus, MessageBusInitializingError, MessageBusNotInitializedError, MissingSigningDescriptorError, MnemonicIdentity, OnchainWallet, P2A, PaymentRouter, PrevTxUnavailableError, REGTEST_MIN_BATCH_EXPIRY_SECONDS, REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, Ramps, ReadonlyAssetManager, ReadonlyDescriptorIdentity, ReadonlySingleKey, ReadonlyWallet, ReadonlyWalletError, RestDelegateProvider, RestDelegatorProvider, RestEmulatorProvider, SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, SeedIdentity, ServiceWorkerReadonlyWallet, ServiceWorkerTimeoutError, ServiceWorkerWallet, SingleKey, TxTree, TxType, TxWeightEstimator, UnannotatableInputError, UnilateralExit, UnknownPacket, Unroll, VtxoManager, Wallet2 as Wallet, WalletCannotAllocateAddressError, WalletCannotSignError, WalletMessageHandler, WalletNotInitializedError, WalletRepositoryImpl, WsElectrumChainSource, adoptContractDescriptor, arkAssetRail, arkRail, arkTarget, arkade_exports, assertFinalCommitmentMatchesValidated, assertIntentIdUnique, assertNoAssets, assertSendableAmount, assertSubmittedArkTxid, assertValidBatchExpiry, assertValidServerUnrollScript, assetMintResolver, assetsOf, attachPrevArkTxs, attachPrevoutTxs, awaitTransaction, boardingResolver, btcTarget, buildForfeitTx, buildOffchainTx, buildPreimageMessage, buildSaltedPreimageMessage, claimWithPreimageIdentity, classifyAgainstSignerSet, classifyContractSigner, closeDatabase, collabExitResolver, combineTapscriptSigs, contractFromArkContract, contractFromArkContractWithAddress, contractPreimage, contractSigner, createAssetPacket, createDefaultActivityRegistry, createDefaultPaymentRouter, createExitChainResolver, createManagedConnection, decodeArkContract, defaultBatchExpiryPolicy, defaultCheckpointExitDelayPolicy, deleteByIndex, deserializeAssets, deserializeExitPackage, deserializeUtxo, deserializeVtxo, encodeArkContract, exitObserverFor, extendVirtualCoinForContract, extractArkProviderUrl, gateExclusion, gatedContracts, getAllByIndexValues, getMigrationStatus, getRandomId, hasBoardingTxExpired, hasCandidates, intentMatchesFilter, intentPageBounds, invoiceTarget, isAddressAllocationCapable, isArkContract, isBatchSignable, isBtcAddress, isContractGenericallySpendable, isContractVtxoEvent, isCooperativelyMigratable, isDeterministicSigner, isDiscoverable, isHDAllocationCapable, isHDDeterministicSignCapable, isHDWalletCapable, isLightningInvoice, isLnurl, isMessageBusInitializingError, isMessageBusNotInitializedError, isPerArtifactDescriptor, isSigningIdentity, isSubdust, isTerminalIntentState, isValidArkAddress, isVtxoExpiringSoon, isVtxoForScript, isWatchedContract, logExcludedVtxos, makeHandle, matchServerCheckpoints, mergeChainedTxType, migrateWalletRepository, notifyExitObserved, onchainRail, openDatabase, outpointExclusion, outpointReasons, promisifyRequest, provisionClaimSecret, provisionRefundKey, registerWalletRestoreHook, requiresMigration, resolveAssetAmount, resolveBatchExpiryPolicy, resolveCheckpointExitDelayPolicy, resolveDescriptorSigner, resolvePrevTxs, resolveSendAmount, rollbackMigration, saveVtxosForContract, scriptFromArkAddress, selectCoinsWithAsset, selectVirtualCoins, serializeAssets, serializeExitPackage, serializeUtxo, serializeVtxo, setupServiceWorker, signAndSubmitOffchainTx, signerSetFromInfo, signingDescriptorIndex, strictSigningDescriptorIndex, toXOnlySignerHex, tryResolveSendAmount, validateBatchRecipients, validateConnectorsTxGraph, validateVtxoTxGraph, verifyTapscriptSignatures, waitForIncomingFunds, walletFeeSource, warnAndFilterVtxosForScript, withPrevTxs };
-//# sourceMappingURL=chunk-BHLYB44A.js.map
-//# sourceMappingURL=chunk-BHLYB44A.js.map
+export { ARKADE_MAGIC, ARKADE_SALTED_PREIMAGE_TAG, ARKADE_SWAP_PREIMAGE_TAG, ASSET_CARRIER_SATS, AbortError, ActivityRegistry, AmbiguousRouteError, ArkNote, ArkadeCash, ArkadeCashCreateError, AssetManager, BIP21, BIP21Error, BIP322, BLOCKED_UPGRADE_TIMEOUT_MS, Batch, CachingArkProvider, ChainedTxType, ConnectionDisposedError, ContractManager, ContractRepositoryImpl, ContractWatcher, DB_VERSION, DEFAULT_MESSAGE_TIMEOUTS, DEFAULT_MIN_BATCH_EXPIRY_SECONDS, DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, DatabaseUpgradeBlockedError, DelegateManagerImpl, DelegateNotConfiguredError, DelegatorManagerImpl, DelegatorNotConfiguredError, DescriptorIdentity, DescriptorSigningProviderMissingError, DustChangeError, ELECTRUM_TCP_HOST, ELECTRUM_WS_URL, ESPLORA_URL, ElectrumOnchainProvider, EmulatorPacket, EsploraProvider, Estimator, Extension, ExtensionNotFoundError, ForeignDescriptorError, HDDescriptorProvider, INTENT_TERMINAL_STATES, InMemoryContractRepository, InMemoryIntentRepository, InMemoryVirtualTxRepository, InMemoryWalletRepository, IndexedDBContractRepository, IndexedDBIntentRepository, IndexedDBVirtualTxRepository, IndexedDBWalletRepository, MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD, MESSAGE_BUS_INITIALIZING, MESSAGE_BUS_NOT_INITIALIZED, MIGRATION_KEY, MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, MessageBus, MessageBusInitializingError, MessageBusNotInitializedError, MissingSigningDescriptorError, MnemonicIdentity, OnchainWallet, P2A, PaymentRouter, PrevTxUnavailableError, REGTEST_MIN_BATCH_EXPIRY_SECONDS, REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, Ramps, ReadonlyAssetManager, ReadonlyDescriptorIdentity, ReadonlySingleKey, ReadonlyWallet, ReadonlyWalletError, RestDelegateProvider, RestDelegatorProvider, RestEmulatorProvider, SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, SeedIdentity, ServiceWorkerReadonlyWallet, ServiceWorkerTimeoutError, ServiceWorkerWallet, SingleKey, TxTree, TxType, TxWeightEstimator, UnannotatableInputError, UnilateralExit, UnknownPacket, Unroll, VtxoManager, Wallet2 as Wallet, WalletCannotAllocateAddressError, WalletCannotSignError, WalletMessageHandler, WalletNotInitializedError, WalletRepositoryImpl, WsElectrumChainSource, adoptContractDescriptor, arkAssetRail, arkRail, arkTarget, arkade_exports, assertFinalCommitmentMatchesValidated, assertIntentIdUnique, assertNoAssets, assertNoSelection, assertSendableAmount, assertSubmittedArkTxid, assertValidBatchExpiry, assertValidServerUnrollScript, assetMintResolver, assetsOf, attachPrevArkTxs, attachPrevoutTxs, awaitTransaction, boardingResolver, btcTarget, buildForfeitTx, buildOffchainTx, buildPreimageMessage, buildSaltedPreimageMessage, claimWithPreimageIdentity, classifyAgainstSignerSet, classifyContractSigner, closeDatabase, collabExitResolver, combineTapscriptSigs, contractFromArkContract, contractFromArkContractWithAddress, contractPreimage, contractSigner, createAssetPacket, createDefaultActivityRegistry, createDefaultPaymentRouter, createExitChainResolver, createManagedConnection, decodeArkContract, defaultBatchExpiryPolicy, defaultCheckpointExitDelayPolicy, deleteByIndex, deserializeAssets, deserializeExitPackage, deserializeUtxo, deserializeVtxo, encodeArkContract, exitObserverFor, extendVirtualCoinForContract, extractArkProviderUrl, gateExclusion, gatedContracts, getAllByIndexValues, getMigrationStatus, getRandomId, hasBoardingTxExpired, hasCandidates, intentMatchesFilter, intentPageBounds, invoiceTarget, isAddressAllocationCapable, isArkContract, isBatchSignable, isBtcAddress, isContractGenericallySpendable, isContractVtxoEvent, isCooperativelyMigratable, isDeterministicSigner, isDiscoverable, isHDAllocationCapable, isHDDeterministicSignCapable, isHDWalletCapable, isLightningInvoice, isLnurl, isMessageBusInitializingError, isMessageBusNotInitializedError, isPerArtifactDescriptor, isSigningIdentity, isSubdust, isTerminalIntentState, isValidArkAddress, isVtxoExpiringSoon, isVtxoForScript, isWatchedContract, logExcludedVtxos, makeHandle, matchServerCheckpoints, mergeChainedTxType, migrateWalletRepository, notifyExitObserved, onchainRail, openDatabase, outpointExclusion, outpointReasons, promisifyRequest, provisionClaimSecret, provisionRefundKey, registerWalletRestoreHook, requiresMigration, resolveAssetAmount, resolveBatchExpiryPolicy, resolveCheckpointExitDelayPolicy, resolveDescriptorSigner, resolvePrevTxs, resolveSendAmount, rollbackMigration, saveVtxosForContract, scriptFromArkAddress, selectCoinsWithAsset, selectVirtualCoins, selectionOf, serializeAssets, serializeExitPackage, serializeUtxo, serializeVtxo, setupServiceWorker, signAndSubmitOffchainTx, signerSetFromInfo, signingDescriptorIndex, strictSigningDescriptorIndex, toXOnlySignerHex, tryResolveSendAmount, validateBatchRecipients, validateConnectorsTxGraph, validateVtxoTxGraph, verifyTapscriptSignatures, waitForIncomingFunds, walletFeeSource, warnAndFilterVtxosForScript, withPrevTxs };
+//# sourceMappingURL=chunk-ZTGTQP2W.js.map
+//# sourceMappingURL=chunk-ZTGTQP2W.js.map