@arkade-os/sdk 0.4.74 → 0.4.75

package/dist/{chunk-ZTGTQP2W.js → chunk-FTLPTF3R.js}

@@ -1,6 +1,6 @@
-import { AssetId, AssetGroup, AssetInput, AssetOutput, Metadata, Packet, BufferReader, BufferWriter, AssetRef, RestIndexerProvider } from './chunk-X5BPARRD.js';
-import { witnessRefToBytes, validateProgram, toASM, stringifyArtifact, serializeArkadeContractParams, resolveAsm, parseArtifact, getOpcodeValue, getOpcodeName, fromASM, deserializeArkadeContractParams, computeArkadeScriptPublicKey, bytesToASM, asmToBytes, arkadeWitnessHash, arkadeScriptHash, SUPPORTED_PROGRAM_VERSION, OPCODE_VALUES, OPCODE_NAMES, bignum_exports, ArkadeScript, ArkadeProgramScript, ARKADE_OPS, ARKADE_OPCODE_VALUES, ARKADE_OPCODE_NAMES, ARKADE_OPCODES, ARKADE_OP, toXOnly, inputName, contractHandlers, isMainnetDescriptor, descriptorIsOurs, deriveDescriptorLeafPubKey, deriveDescriptorLeafCompressedPubKey, parseHDDescriptor, identityDescriptor, DefaultVtxo, speculativeReceiveMetadata, DelegateVtxo, WALLET_RECEIVE_SOURCE, BoardingContractHandler } from './chunk-LGB65ZCO.js';
-import { VtxoScript, Transaction, isRecoverable, CSVMultisigTapscript, DEFAULT_NETWORK, resolveEmulatorPubkey, hasTerminalSpend, getNormalizedVtxos, setArkPsbtField, PrevArkTxField, ConditionWitness, craftToSpendTx, ArkAddress, isVirtualCoin, getArkPsbtFields, CosignerPublicKey, ServerResponseMismatchError, OP_RETURN_EMPTY_PKSCRIPT, canSweepOnchain, sequenceToTimelock, decodeTapscript, scriptFromTapLeafScript, CLTVMultisigTapscript, VtxoTaprootTree, timelockToSequence, assertAllowedSighashTypes, baseFetch, Intent, rateGate, DEFAULT_NETWORK_NAME, formatSighash, normalizeVtxo, getSequence, toBatchExpiry, maybeArkError, isArkError, ArkErrorName, toOffchainInputFeeParams, canRecoverOnchain, getNetwork, MultisigTapscript, isEventSourceError, isEventSourceUnavailableError, getAllNormalizedVtxos, isPastExpiry, isRetryableProviderError, DEFAULT_PAGE_SIZE, RestArkProvider, toVirtualStatus, ArkError, TapTreeCoder, resolveTimeHeight, canSpendOffchain, parseLegacyExpiry, isExpired, PrevoutTxField, fetchVtxoCreatedAtByTxid, DEFAULT_ARKADE_SERVER_URL, ProviderUnavailableError, networks as networks$1 } from './chunk-WJVOFYTQ.js';
+import { AssetId, AssetGroup, AssetInput, AssetOutput, Metadata, Packet, BufferReader, BufferWriter, AssetRef, RestIndexerProvider } from './chunk-PS564TAU.js';
+import { witnessRefToBytes, validateProgram, toASM, stringifyArtifact, serializeArkadeContractParams, resolveAsm, parseArtifact, getOpcodeValue, getOpcodeName, fromASM, deserializeArkadeContractParams, computeArkadeScriptPublicKey, bytesToASM, asmToBytes, arkadeWitnessHash, arkadeScriptHash, SUPPORTED_PROGRAM_VERSION, OPCODE_VALUES, OPCODE_NAMES, bignum_exports, ArkadeScript, ArkadeProgramScript, ARKADE_OPS, ARKADE_OPCODE_VALUES, ARKADE_OPCODE_NAMES, ARKADE_OPCODES, ARKADE_OP, toXOnly, inputName, contractHandlers, isMainnetDescriptor, descriptorIsOurs, deriveDescriptorLeafPubKey, deriveDescriptorLeafCompressedPubKey, parseHDDescriptor, identityDescriptor, DefaultVtxo, speculativeReceiveMetadata, DelegateVtxo, WALLET_RECEIVE_SOURCE, BoardingContractHandler } from './chunk-4GLSOP6L.js';
+import { VtxoScript, Transaction, isRecoverable, CSVMultisigTapscript, networks, getNetwork, DEFAULT_NETWORK, resolveEmulatorPubkey, hasTerminalSpend, getNormalizedVtxos, setArkPsbtField, PrevArkTxField, ConditionWitness, craftToSpendTx, ArkAddress, isVirtualCoin, getArkPsbtFields, CosignerPublicKey, ServerResponseMismatchError, OP_RETURN_EMPTY_PKSCRIPT, canSweepOnchain, sequenceToTimelock, decodeTapscript, scriptFromTapLeafScript, CLTVMultisigTapscript, VtxoTaprootTree, timelockToSequence, assertAllowedSighashTypes, baseFetch, Intent, rateGate, DEFAULT_NETWORK_NAME, formatSighash, normalizeVtxo, getSequence, toBatchExpiry, maybeArkError, isArkError, ArkErrorName, toOffchainInputFeeParams, canRecoverOnchain, MultisigTapscript, isEventSourceError, isEventSourceUnavailableError, getAllNormalizedVtxos, isPastExpiry, isRetryableProviderError, DEFAULT_PAGE_SIZE, RestArkProvider, toVirtualStatus, ArkError, TapTreeCoder, resolveTimeHeight, canSpendOffchain, parseLegacyExpiry, isExpired, PrevoutTxField, fetchVtxoCreatedAtByTxid, DEFAULT_ARKADE_SERVER_URL, ProviderUnavailableError } from './chunk-UKFA7NVE.js';
 import { __export } from './chunk-NSBPE2FW.js';
 import { sha256 as sha256$1, equalBytes, hash160, sha256x2, concatBytes, randomPrivateKeyBytes, pubECDSA, pubSchnorr } from '@scure/btc-signer/utils.js';
 import { SigHash, Script, OP, OutScript, Address, RawWitness, p2tr, p2wpkh, TaprootControlBlock, DEFAULT_SEQUENCE, Transaction as Transaction$2 } from '@scure/btc-signer';
@@ -13,7 +13,7 @@ import { Script as Script$1 } from '@scure/btc-signer/script.js';
 import { Transaction as Transaction$1, SigHash as SigHash$1 } from '@scure/btc-signer/transaction.js';
 import { mnemonicToSeedSync, validateMnemonic } from '@scure/bip39';
 import { wordlist } from '@scure/bip39/wordlists/english.js';
-import { networks, scriptExpressions, HDKey, expand } from '@bitcoinerlab/descriptors-scure';
+import { networks as networks$1, scriptExpressions, HDKey, expand } from '@bitcoinerlab/descriptors-scure';
 import { tapLeafHash } from '@scure/btc-signer/payment.js';
 import { Environment } from '@marcbachmann/cel-js';
 
@@ -410,9 +410,9 @@ var SeedIdentity = class _SeedIdentity {
     let network;
     if ("descriptor" in opts && typeof opts.descriptor === "string") {
       descriptor = opts.descriptor;
-      network = isMainnetDescriptor(descriptor) ? networks.bitcoin : networks.testnet;
+      network = isMainnetDescriptor(descriptor) ? networks$1.bitcoin : networks$1.testnet;
     } else {
-      network = opts.isMainnet ?? true ? networks.bitcoin : networks.testnet;
+      network = opts.isMainnet ?? true ? networks$1.bitcoin : networks$1.testnet;
       descriptor = scriptExpressions.trBIP32({
         masterNode: HDKey.fromMasterSeed(seed, network.bip32),
         network,
@@ -557,7 +557,7 @@ var SeedIdentity = class _SeedIdentity {
   }
   // ── internal helpers ─────────────────────────────────────────────
   derivePrivateKeyForDescriptor(descriptor) {
-    const network = isMainnetDescriptor(descriptor) ? networks.bitcoin : networks.testnet;
+    const network = isMainnetDescriptor(descriptor) ? networks$1.bitcoin : networks$1.testnet;
     const expansion = expand({ descriptor, network });
     if (expansion.isRanged) {
       throw new Error(
@@ -644,7 +644,7 @@ var ReadonlyDescriptorIdentity = class _ReadonlyDescriptorIdentity {
    */
   descriptor;
   constructor(descriptor) {
-    const network = isMainnetDescriptor(descriptor) ? networks.bitcoin : networks.testnet;
+    const network = isMainnetDescriptor(descriptor) ? networks$1.bitcoin : networks$1.testnet;
     let expansion;
     try {
       expansion = expand({ descriptor, network, index: 0 });
@@ -8687,15 +8687,74 @@ async function getVtxosForContract(repo, contract) {
   const vtxos = repo.getVtxosForScript ? await repo.getVtxosForScript(contract.script) : filterVtxosForScript(await repo.getVtxos(contract.address), contract.script);
   return vtxos.map(normalizeVtxo);
 }
-async function saveVtxosForContract(repo, contract, vtxos) {
-  if (repo.saveVtxosForScript) {
-    return repo.saveVtxosForScript(
-      { script: contract.script, address: contract.address },
-      vtxos
-    );
+function hasRecordedSpend(vtxo) {
+  return vtxo.isSpent === true && (!!vtxo.spentBy || !!vtxo.arkTxId || !!vtxo.settledBy);
+}
+var RECORDED_SPEND_TTL_MS = 6e4;
+var recordedSpends = /* @__PURE__ */ new WeakMap();
+function registryFor(repo) {
+  const existing = recordedSpends.get(repo);
+  if (existing) return existing;
+  const created = /* @__PURE__ */ new Map();
+  recordedSpends.set(repo, created);
+  return created;
+}
+var writeChains = /* @__PURE__ */ new WeakMap();
+function inVtxoWriteOrder(repo, fn) {
+  const prev = writeChains.get(repo) ?? Promise.resolve();
+  const run = prev.then(fn, fn);
+  writeChains.set(
+    repo,
+    run.catch(() => {
+    })
+  );
+  return run;
+}
+function applyRecordedSpends(repo, vtxos) {
+  const registry = registryFor(repo);
+  const now = Date.now();
+  for (const [key, spend] of registry) {
+    if (now - spend.at >= RECORDED_SPEND_TTL_MS) registry.delete(key);
+  }
+  for (const incoming of vtxos) {
+    const key = vtxoOutpoint(incoming);
+    if (!hasRecordedSpend(incoming) || registry.has(key)) continue;
+    registry.set(key, {
+      at: now,
+      spentBy: incoming.spentBy,
+      arkTxId: incoming.arkTxId,
+      settledBy: incoming.settledBy
+    });
   }
-  validateVtxosForScript(vtxos, contract.script, "saveVtxosForContract");
-  return repo.saveVtxos(contract.address, vtxos);
+  if (registry.size === 0) return vtxos;
+  return vtxos.map((incoming) => {
+    if (hasRecordedSpend(incoming)) return incoming;
+    const spent = registry.get(vtxoOutpoint(incoming));
+    if (!spent) return incoming;
+    const spentBy = incoming.spentBy || spent.spentBy;
+    const arkTxId = incoming.arkTxId || spent.arkTxId;
+    const settledBy = incoming.settledBy || spent.settledBy;
+    return {
+      ...incoming,
+      isSpent: true,
+      ...spentBy ? { spentBy } : {},
+      ...arkTxId ? { arkTxId } : {},
+      ...settledBy ? { settledBy } : {}
+    };
+  });
+}
+async function saveVtxosForContract(repo, contract, vtxos) {
+  return inVtxoWriteOrder(repo, async () => {
+    const rows = applyRecordedSpends(repo, vtxos);
+    if (repo.saveVtxosForScript) {
+      return repo.saveVtxosForScript(
+        { script: contract.script, address: contract.address },
+        rows
+      );
+    }
+    validateVtxosForScript(rows, contract.script, "saveVtxosForContract");
+    return repo.saveVtxos(contract.address, rows);
+  });
 }
 
 // src/repositories/inMemory/walletRepository.ts
@@ -9788,7 +9847,21 @@ var ContractManager = class _ContractManager {
   }
   markSyncOnline() {
     this.lastSyncedAt = Date.now();
-    this.syncDegradedReason = this.annotationDegradedReason();
+    this.syncDegradedReason = this.syncGapReason();
+  }
+  /**
+   * Why a sync that just succeeded still has not covered everything it should
+   * have. Both reasons outlive the sync that failed to cover them, so neither
+   * is discharged by the next one succeeding — which is the point: a wallet
+   * that reported itself current while the look-ahead band sat behind the
+   * watermark, or while a contract could not be annotated, would be claiming
+   * coverage it never had. `getSyncState()` is the channel apps already watch.
+   */
+  syncGapReason() {
+    const annotations = this.annotationDegradedReason();
+    const owedRefill = this.lookAheadRefillOwed ? "the look-ahead band is behind the allocation watermark, so a funded address inside it is not being watched yet" : void 0;
+    const reasons = [annotations, owedRefill].filter((r) => r !== void 0);
+    return reasons.length === 0 ? void 0 : reasons.join("; ");
   }
   /** Contracts a sync could not annotate, as `script → reason`. */
   annotationFailures = /* @__PURE__ */ new Map();
@@ -9822,7 +9895,13 @@ var ContractManager = class _ContractManager {
     for (const contract of contracts) {
       await this.watcher.addContract(contract);
     }
-    await this.scheduleLookAheadDrain();
+    try {
+      await this.scheduleLookAheadDrain();
+    } catch (err) {
+      if (!isRetryableProviderError(err)) throw err;
+      this.lookAheadRefillOwed = true;
+      this.markSyncDegraded(err);
+    }
     try {
       await this.reconcileWatched();
       this.markSyncOnline();
@@ -10746,7 +10825,13 @@ var ContractManager = class _ContractManager {
       if (contract) {
         await saveVtxosForContract(this.config.walletRepository, contract, addressVtxos);
       } else {
-        await this.config.walletRepository.saveVtxos(address, addressVtxos);
+        await inVtxoWriteOrder(
+          this.config.walletRepository,
+          async () => this.config.walletRepository.saveVtxos(
+            address,
+            applyRecordedSpends(this.config.walletRepository, addressVtxos)
+          )
+        );
       }
     }
   }
@@ -11974,7 +12059,7 @@ var HDDescriptorProvider = class _HDDescriptorProvider {
    */
   materializeDescriptorAt(index) {
     const descriptor = this.identity.descriptor;
-    const network = isMainnetDescriptor(descriptor) ? networks.bitcoin : networks.testnet;
+    const network = isMainnetDescriptor(descriptor) ? networks$1.bitcoin : networks$1.testnet;
     const expansion = expand({ descriptor, network, index });
     const keyInfo = expansion.expansionMap?.["@0"];
     if (!keyInfo?.keyExpression) {
@@ -12525,8 +12610,9 @@ var InputSignerRouter = class {
   async classify(jobs) {
     const identityIndexes = [];
     const descriptorGroups = /* @__PURE__ */ new Map();
+    const unknownIndexes = [];
     if (jobs.length === 0) {
-      return { identityIndexes, descriptorGroups };
+      return { identityIndexes, descriptorGroups, unknownIndexes };
     }
     const distinctScripts = Array.from(new Set(jobs.map((j) => hex.encode(j.lookupScript))));
     const contracts = await this.deps.contractRepository.getContracts({
@@ -12546,6 +12632,8 @@ var InputSignerRouter = class {
       if (!contract) {
         if (scriptHex === boardingScriptHex) {
           identityIndexes.push(job.index);
+        } else {
+          unknownIndexes.push(job.index);
         }
         continue;
       }
@@ -12572,7 +12660,7 @@ var InputSignerRouter = class {
         descriptorGroups.set(descriptor, [job.index]);
       }
     }
-    return { identityIndexes, descriptorGroups };
+    return { identityIndexes, descriptorGroups, unknownIndexes };
   }
   /**
    * Returns `true` when every signable input across all `jobSets` resolves
@@ -12594,12 +12682,13 @@ var InputSignerRouter = class {
     const plan = await this.classify(jobSets.flat());
     return plan.descriptorGroups.size === 0;
   }
-  async sign(tx, jobs) {
+  async sign(tx, jobs, opts) {
     if (jobs.length === 0) return tx;
-    const { identityIndexes, descriptorGroups } = await this.classify(jobs);
+    const { identityIndexes, descriptorGroups, unknownIndexes } = await this.classify(jobs);
+    const identitySignIndexes = opts?.onUnknownScript === "sign" ? [...identityIndexes, ...unknownIndexes] : identityIndexes;
     let signed = tx;
-    if (identityIndexes.length > 0) {
-      signed = await this.deps.identity.sign(signed, identityIndexes);
+    if (identitySignIndexes.length > 0) {
+      signed = await this.deps.identity.sign(signed, identitySignIndexes);
     }
     if (descriptorGroups.size > 0) {
       if (!this.deps.descriptorProvider) {
@@ -13626,23 +13715,26 @@ var ReadonlyWallet = class _ReadonlyWallet {
    */
   async getBoardingUtxosForSigners(allowedSigners) {
     const tapscripts = await this.getBoardingTapscripts(allowedSigners);
-    const groups = [];
-    for (const tapscript of tapscripts) {
-      const address = tapscript.onchainAddress(this.network);
-      const coins = await this.onchainProvider.getCoins(address);
-      const utxos = coins.map((utxo) => extendCoinWithTapscript(tapscript, utxo));
-      await this.walletRepository.saveUtxos(address, utxos);
-      groups.push({
-        tapscript,
-        // Normalize so the group key matches the axis/contract x-only
-        // form regardless of how the tapscript's key was stored.
-        serverPubKey: toXOnlySignerHex(hex.encode(tapscript.options.serverPubKey)),
-        // Per-row CSV delay decoded from THIS tapscript's exit leaf —
-        // not the wallet's current boarding timelock, which a signer
-        // rotation may have changed.
-        csvTimelock: CSVMultisigTapscript.decode(hex.decode(tapscript.exitScript)).params.timelock,
-        coins: utxos
-      });
+    const addresses = tapscripts.map((tapscript) => tapscript.onchainAddress(this.network));
+    const groups = await Promise.all(
+      tapscripts.map(async (tapscript, i) => {
+        const coins = await this.onchainProvider.getCoins(addresses[i]);
+        const utxos = coins.map((utxo) => extendCoinWithTapscript(tapscript, utxo));
+        return {
+          tapscript,
+          // Normalize so the group key matches the axis/contract x-only
+          // form regardless of how the tapscript's key was stored.
+          serverPubKey: toXOnlySignerHex(hex.encode(tapscript.options.serverPubKey)),
+          // Per-row CSV delay decoded from THIS tapscript's exit leaf —
+          // not the wallet's current boarding timelock, which a signer
+          // rotation may have changed.
+          csvTimelock: CSVMultisigTapscript.decode(hex.decode(tapscript.exitScript)).params.timelock,
+          coins: utxos
+        };
+      })
+    );
+    for (const [i, group] of groups.entries()) {
+      await this.walletRepository.saveUtxos(addresses[i], group.coins);
     }
     return groups;
   }
@@ -15738,15 +15830,16 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
       console.error(`Failed to persist intent ${intentTxId} (state=${state})`, e);
     }
   }
-  /**
-   * @internal Sign an on-chain boarding exit / sweep transaction, routing
-   * each input to the correct key by its `witnessUtxo.script`: the identity
-   * for index-0 / static boarding, the per-index descriptor for a rotated
-   * boarding UTXO (plan §6-III.3). Used by
-   * {@link VtxoManager.sweepExpiredBoardingUtxos}; without it, the
-   * unilateral exit of a rotated boarding UTXO would be signed with the
-   * wrong (index-0) key and rejected.
-   */
+  async signInputsByWitnessScript(tx) {
+    const signed = await this._signerRouter.sign(
+      tx,
+      this.inputSigningJobsFromWitnessUtxos(tx),
+      {
+        onUnknownScript: "sign"
+      }
+    );
+    return signed;
+  }
   async signOnchainBoardingTx(tx) {
     const signed = await this._signerRouter.sign(tx, this.inputSigningJobsFromWitnessUtxos(tx));
     return signed;
@@ -17596,6 +17689,18 @@ var DustChangeError = class extends Error {
     this.dustAmount = dustAmount;
   }
 };
+var OversizedChangeError = class extends Error {
+  change;
+  maxAmount;
+  constructor(change, maxAmount) {
+    super(
+      `change ${change} sats is above the server's ${maxAmount} sat per-output ceiling; exit more of the balance, or split it into smaller VTXOs first`
+    );
+    this.name = "OversizedChangeError";
+    this.change = change;
+    this.maxAmount = maxAmount;
+  }
+};
 var offboardNetworkNames = [
   "bitcoin",
   "regtest",
@@ -17606,7 +17711,7 @@ var offboardNetworkNames = [
 function offboardDestinationScript(destinationAddress) {
   for (const networkName of offboardNetworkNames) {
     try {
-      const network = networks$1[networkName];
+      const network = networks[networkName];
       const addr = Address(network).decode(destinationAddress);
       return OutScript.encode(addr);
     } catch {
@@ -17627,11 +17732,50 @@ function settleChangeAgainstFee(change, feeOn) {
     `change fee does not settle after ${CHANGE_FEE_MAX_ROUNDS} rounds (${change} sats of change); settle the full balance instead`
   );
 }
+function changeAfterOutputFee(left, feeOn) {
+  if (left <= 0n) return { change: 0n, fee: 0n };
+  const change = settleChangeAgainstFee(left, feeOn);
+  return { change, fee: left - change };
+}
 function reportUngatedInputs(wallet, inputs) {
   if (!("logUngatedInputs" in wallet)) return;
   const logger = wallet;
   void logger.logUngatedInputs("Ramps.offboard({ vtxos })", inputs);
 }
+function filterOffboardInputs(vtxos, feeInfo, named) {
+  const estimator = new Estimator(feeInfo?.intentFee ?? {});
+  const inputs = [];
+  let subtotal = 0n;
+  for (const vtxo of vtxos) {
+    const inputFee = estimator.evalOffchainInput(toOffchainInputFeeParams(vtxo));
+    if (inputFee.satoshis >= vtxo.value) {
+      if (named) {
+        throw new Error(
+          `selected vtxo ${vtxo.txid}:${vtxo.vout} costs ${inputFee.satoshis} sats to spend and is worth ${vtxo.value} \u2014 drop it from the selection`
+        );
+      }
+      continue;
+    }
+    inputs.push(vtxo);
+    subtotal += BigInt(vtxo.value) - BigInt(inputFee.satoshis);
+  }
+  if (inputs.length === 0) {
+    throw new Error("No vtxos available after deducting fees");
+  }
+  return { inputs, subtotal };
+}
+async function serverVtxoMaxAmount(wallet) {
+  const provider = wallet.arkProvider;
+  if (!provider) return void 0;
+  return (await provider.getInfo()).vtxoMaxAmount;
+}
+function assertChangeSettleable(change, dustAmount, maxAmount) {
+  if (change === 0n) return;
+  if (change < dustAmount) throw new DustChangeError(change, dustAmount);
+  if (maxAmount !== void 0 && maxAmount >= 0n && change > maxAmount) {
+    throw new OversizedChangeError(change, maxAmount);
+  }
+}
 var Ramps = class {
   /**
    * Create convenience wrappers for onboarding and offboarding flows.
@@ -17757,81 +17901,87 @@ var Ramps = class {
   async offboard(destinationAddress, feeInfo, amount, eventCallback, vtxos) {
     const named = vtxos !== void 0;
     if (vtxos) reportUngatedInputs(this.wallet, vtxos);
-    vtxos ??= await this.wallet.getSpendableVtxos({
+    const spendable = vtxos ?? await this.wallet.getSpendableVtxos({
       withRecoverable: true,
       withUnrolled: false
     });
     const estimator = new Estimator(feeInfo?.intentFee ?? {});
-    const filteredVtxos = [];
-    let totalAmount = 0n;
-    for (const vtxo of vtxos) {
-      const inputFee = estimator.evalOffchainInput(toOffchainInputFeeParams(vtxo));
-      if (inputFee.satoshis >= vtxo.value) {
-        if (named) {
-          throw new Error(
-            `selected vtxo ${vtxo.txid}:${vtxo.vout} costs ${inputFee.satoshis} sats to spend and is worth ${vtxo.value} \u2014 drop it from the selection`
-          );
-        }
-        continue;
-      }
-      filteredVtxos.push(vtxo);
-      totalAmount += BigInt(vtxo.value) - BigInt(inputFee.satoshis);
-    }
-    if (filteredVtxos.length === 0) {
-      throw new Error("No vtxos available after deducting fees");
-    }
-    let change = 0n;
-    if (amount) {
-      if (amount > totalAmount) {
-        throw new Error("Amount is greater than total amount of vtxos after fees");
-      }
-      change = totalAmount - amount;
-    }
-    let changeAddress;
-    if (change > 0n) {
-      changeAddress = await this.wallet.getAddress();
-      const changeScript = hex.encode(ArkAddress.decode(changeAddress).pkScript);
-      change = settleChangeAgainstFee(
-        change,
-        (amount2) => BigInt(estimator.evalOffchainOutput({ amount: amount2, script: changeScript }).satoshis)
-      );
-    }
-    const dustAmount = getDustAmount(this.wallet);
-    if (change > 0n && change < dustAmount) {
-      throw new DustChangeError(change, dustAmount);
-    }
-    amount = amount ?? totalAmount;
-    const destinationScript = offboardDestinationScript(destinationAddress);
+    const { inputs, subtotal } = filterOffboardInputs(spendable, feeInfo, named);
+    if (amount && amount > subtotal) {
+      throw new Error("Amount is greater than total amount of vtxos after fees");
+    }
+    const handed = amount || subtotal;
+    const { change, changeAddress } = await this.fundChange(
+      amount ? subtotal - handed : 0n,
+      estimator
+    );
     const outputFee = estimator.evalOnchainOutput({
-      amount,
-      script: hex.encode(destinationScript)
+      amount: handed,
+      script: hex.encode(offboardDestinationScript(destinationAddress))
     });
-    if (BigInt(outputFee.satoshis) > amount) {
+    if (BigInt(outputFee.satoshis) > handed) {
       throw new Error(
-        `can't deduct fees from offboard amount (${outputFee.satoshis} > ${amount})`
+        `can't deduct fees from offboard amount (${outputFee.satoshis} > ${handed})`
       );
     }
-    amount -= BigInt(outputFee.satoshis);
     const outputs = [
-      {
-        address: destinationAddress,
-        amount
-      }
+      { address: destinationAddress, amount: handed - BigInt(outputFee.satoshis) }
     ];
-    if (change > 0n) {
-      const offchainAddress = changeAddress;
-      outputs.push({
-        address: offchainAddress,
-        amount: change
-      });
+    if (change > 0n) outputs.push({ address: changeAddress, amount: change });
+    return this.wallet.settle({ inputs, outputs }, eventCallback);
+  }
+  /**
+   * Collaboratively exit with the DESTINATION paid exactly `amount`, pricing the
+   * fee on that output rather than on a grossed-up figure. {@link offboard} keeps
+   * the other anchor, which needs `g - fee(g) = amount` solved — impossible for
+   * a program charging the whole output.
+   */
+  async offboardExact(params) {
+    const { destinationAddress, feeInfo, amount, eventCallback, vtxos } = params;
+    if (amount <= 0n) {
+      throw new Error(`offboard amount must be positive, got ${amount}`);
     }
-    return this.wallet.settle(
-      {
-        inputs: filteredVtxos,
-        outputs
-      },
-      eventCallback
+    const named = vtxos !== void 0;
+    if (vtxos) reportUngatedInputs(this.wallet, vtxos);
+    const spendable = vtxos ?? await this.wallet.getSpendableVtxos({
+      withRecoverable: true,
+      withUnrolled: false
+    });
+    const estimator = new Estimator(feeInfo?.intentFee ?? {});
+    const { inputs, subtotal } = filterOffboardInputs(spendable, feeInfo, named);
+    const outputFee = BigInt(
+      estimator.evalOnchainOutput({
+        amount,
+        script: hex.encode(offboardDestinationScript(destinationAddress))
+      }).satoshis
     );
+    const needed = amount + outputFee;
+    if (needed > subtotal) {
+      throw new Error(
+        `selected vtxos net ${subtotal} sats, ${needed} needed to deliver ${amount} exactly (${amount} + a ${outputFee} sat exit fee)`
+      );
+    }
+    const { change, changeAddress } = await this.fundChange(subtotal - needed, estimator);
+    const outputs = [{ address: destinationAddress, amount }];
+    if (change > 0n) outputs.push({ address: changeAddress, amount: change });
+    return this.wallet.settle({ inputs, outputs }, eventCallback);
+  }
+  /** Fund the change output: pay its own fee, then judge it against both
+   *  server-side bounds. `0n` in is `0n` out — no change output at all. */
+  async fundChange(left, estimator) {
+    if (left <= 0n) return { change: 0n };
+    const changeAddress = await this.wallet.getAddress();
+    const changeScript = hex.encode(ArkAddress.decode(changeAddress).pkScript);
+    const { change } = changeAfterOutputFee(
+      left,
+      (amount) => BigInt(estimator.evalOffchainOutput({ amount, script: changeScript }).satoshis)
+    );
+    assertChangeSettleable(
+      change,
+      getDustAmount(this.wallet),
+      await serverVtxoMaxAmount(this.wallet)
+    );
+    return { change, changeAddress };
   }
 };
 
@@ -22539,7 +22689,7 @@ function sweepFeeFor(path, outputAddress, network, feeRate) {
   return Number(estimator.vsize().fee(BigInt(Math.ceil(feeRate))));
 }
 async function buildSignedSweep(params) {
-  const { vtxo, path, outputAddress, feeRate, network, identity } = params;
+  const { vtxo, path, outputAddress, feeRate, network, identity, signer } = params;
   const fee = sweepFeeFor(path, outputAddress, network, feeRate);
   const sendAmount = BigInt(vtxo.value) - BigInt(fee);
   if (sendAmount < BigInt(DUST_AMOUNT)) {
@@ -22557,7 +22707,7 @@ async function buildSignedSweep(params) {
     sighashType: SigHash.DEFAULT
   });
   tx.addOutputAddress(outputAddress, sendAmount, network);
-  const signed = await identity.sign(tx);
+  const signed = signer ? await signer(tx) : await identity.sign(tx);
   if (!path.extraWitness || path.extraWitness.length === 0) {
     signed.finalize();
     return { tx: signed, fee };
@@ -23109,7 +23259,8 @@ async function prepare(opts) {
         outputAddress: opts.sweepAddress,
         feeRate,
         network: wallet.network,
-        identity: wallet.identity
+        identity: wallet.identity,
+        signer: (tx2) => wallet.signInputsByWitnessScript(tx2)
       });
       activeOutpoints.add(outpoint);
       sweepSteps.push({
@@ -23600,7 +23751,7 @@ var Arkade = class _Arkade {
     const info = await opts.arkade.getInfo();
     const serverKey = toXOnly(hex.decode(info.signerPubkey), "ark signer key");
     const checkpoint = CSVMultisigTapscript.decode(hex.decode(info.checkpointTapscript));
-    const network = opts.network ?? DEFAULT_NETWORK;
+    const network = opts.network ?? (Object.hasOwn(networks, info.network) ? getNetwork(info.network) : DEFAULT_NETWORK);
     let emulatorKey;
     if (opts.emulator) {
       emulatorKey = hex.decode(resolveEmulatorPubkey(network, opts.emulatorPubkey));
@@ -24422,18 +24573,6 @@ function arkAssetRail() {
   };
 }
 var walletFeeSource = (wallet) => async () => (await wallet.arkProvider.getInfo()).fees;
-var GROSS_UP_MAX_ROUNDS = 8;
-function grossUpOffboard(net, feeInfo, script) {
-  const estimator = new Estimator(feeInfo?.intentFee ?? {});
-  const feeAt = (amount) => estimator.evalOnchainOutput({ amount: BigInt(amount), script }).satoshis;
-  let gross = net;
-  for (let i = 0; i < GROSS_UP_MAX_ROUNDS; i++) {
-    const next = net + feeAt(gross);
-    if (next === gross) break;
-    gross = next;
-  }
-  return { gross, fee: gross - net };
-}
 function offchainInputFees(vtxos, fees) {
   const estimator = new Estimator(fees?.intentFee ?? {});
   return vtxos.reduce(
@@ -24441,6 +24580,18 @@ function offchainInputFees(vtxos, fees) {
     0
   );
 }
+async function changeOutputFee(wallet, inputs, needed, fees) {
+  const estimator = new Estimator(fees?.intentFee ?? {});
+  const net = inputs.reduce(
+    (total, vtxo) => total + BigInt(vtxo.value) - BigInt(estimator.evalOffchainInput(toOffchainInputFeeParams(vtxo)).satoshis),
+    0n
+  );
+  const script = hex.encode(ArkAddress.decode(await wallet.getAddress()).pkScript);
+  return changeAfterOutputFee(
+    net - needed,
+    (amount) => BigInt(estimator.evalOffchainOutput({ amount, script }).satoshis)
+  ).fee;
+}
 function onchainRail(deps) {
   if (typeof deps?.feeInfo !== "function") {
     throw new Error("onchain rail: a feeInfo source is required");
@@ -24456,23 +24607,34 @@ function onchainRail(deps) {
       const amt = resolveSendAmount("onchain", req.raw, req.amount);
       const fees = await deps.feeInfo();
       const script = hex.encode(offboardDestinationScript(address));
-      const { gross, fee } = grossUpOffboard(amt, fees, script);
+      const exitFee = Number(
+        new Estimator(fees?.intentFee ?? {}).evalOnchainOutput({
+          amount: BigInt(amt),
+          script
+        }).satoshis
+      );
       const selectedVtxos = selectionOf(req);
       const inputFee = selectedVtxos ? offchainInputFees(selectedVtxos, fees) : 0;
+      const changeFee = selectedVtxos ? await changeOutputFee(
+        ctx.wallet,
+        selectedVtxos,
+        BigInt(amt) + BigInt(exitFee),
+        fees
+      ) : 0n;
       return {
         railId: "onchain",
         amount: amt,
-        fee: fee + inputFee,
-        total: gross + inputFee,
+        fee: exitFee + inputFee + Number(changeFee),
+        total: amt + exitFee + inputFee + Number(changeFee),
         send: async () => makeHandle("onchain", async (emit) => {
           const ramps = new Ramps(ctx.wallet);
-          const txid = selectedVtxos ? await ramps.offboard(
-            address,
-            fees,
-            BigInt(gross),
-            void 0,
-            selectedVtxos
-          ) : await ramps.offboard(address, fees, BigInt(gross));
+          const txid = await ramps.offboardExact({
+            destinationAddress: address,
+            feeInfo: fees,
+            amount: BigInt(amt),
+            // Omitted, not undefined: an empty set covers nothing.
+            ...selectedVtxos ? { vtxos: selectedVtxos } : {}
+          });
           const result = { railId: "onchain", txid };
           emit({ status: "settled", result });
           return result;
@@ -24495,6 +24657,6 @@ function createDefaultPaymentRouter(wallet) {
   (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
 */
 
-export { ARKADE_MAGIC, ARKADE_SALTED_PREIMAGE_TAG, ARKADE_SWAP_PREIMAGE_TAG, ASSET_CARRIER_SATS, AbortError, ActivityRegistry, AmbiguousRouteError, ArkNote, ArkadeCash, ArkadeCashCreateError, AssetManager, BIP21, BIP21Error, BIP322, BLOCKED_UPGRADE_TIMEOUT_MS, Batch, CachingArkProvider, ChainedTxType, ConnectionDisposedError, ContractManager, ContractRepositoryImpl, ContractWatcher, DB_VERSION, DEFAULT_MESSAGE_TIMEOUTS, DEFAULT_MIN_BATCH_EXPIRY_SECONDS, DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, DatabaseUpgradeBlockedError, DelegateManagerImpl, DelegateNotConfiguredError, DelegatorManagerImpl, DelegatorNotConfiguredError, DescriptorIdentity, DescriptorSigningProviderMissingError, DustChangeError, ELECTRUM_TCP_HOST, ELECTRUM_WS_URL, ESPLORA_URL, ElectrumOnchainProvider, EmulatorPacket, EsploraProvider, Estimator, Extension, ExtensionNotFoundError, ForeignDescriptorError, HDDescriptorProvider, INTENT_TERMINAL_STATES, InMemoryContractRepository, InMemoryIntentRepository, InMemoryVirtualTxRepository, InMemoryWalletRepository, IndexedDBContractRepository, IndexedDBIntentRepository, IndexedDBVirtualTxRepository, IndexedDBWalletRepository, MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD, MESSAGE_BUS_INITIALIZING, MESSAGE_BUS_NOT_INITIALIZED, MIGRATION_KEY, MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, MessageBus, MessageBusInitializingError, MessageBusNotInitializedError, MissingSigningDescriptorError, MnemonicIdentity, OnchainWallet, P2A, PaymentRouter, PrevTxUnavailableError, REGTEST_MIN_BATCH_EXPIRY_SECONDS, REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, Ramps, ReadonlyAssetManager, ReadonlyDescriptorIdentity, ReadonlySingleKey, ReadonlyWallet, ReadonlyWalletError, RestDelegateProvider, RestDelegatorProvider, RestEmulatorProvider, SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, SeedIdentity, ServiceWorkerReadonlyWallet, ServiceWorkerTimeoutError, ServiceWorkerWallet, SingleKey, TxTree, TxType, TxWeightEstimator, UnannotatableInputError, UnilateralExit, UnknownPacket, Unroll, VtxoManager, Wallet2 as Wallet, WalletCannotAllocateAddressError, WalletCannotSignError, WalletMessageHandler, WalletNotInitializedError, WalletRepositoryImpl, WsElectrumChainSource, adoptContractDescriptor, arkAssetRail, arkRail, arkTarget, arkade_exports, assertFinalCommitmentMatchesValidated, assertIntentIdUnique, assertNoAssets, assertNoSelection, assertSendableAmount, assertSubmittedArkTxid, assertValidBatchExpiry, assertValidServerUnrollScript, assetMintResolver, assetsOf, attachPrevArkTxs, attachPrevoutTxs, awaitTransaction, boardingResolver, btcTarget, buildForfeitTx, buildOffchainTx, buildPreimageMessage, buildSaltedPreimageMessage, claimWithPreimageIdentity, classifyAgainstSignerSet, classifyContractSigner, closeDatabase, collabExitResolver, combineTapscriptSigs, contractFromArkContract, contractFromArkContractWithAddress, contractPreimage, contractSigner, createAssetPacket, createDefaultActivityRegistry, createDefaultPaymentRouter, createExitChainResolver, createManagedConnection, decodeArkContract, defaultBatchExpiryPolicy, defaultCheckpointExitDelayPolicy, deleteByIndex, deserializeAssets, deserializeExitPackage, deserializeUtxo, deserializeVtxo, encodeArkContract, exitObserverFor, extendVirtualCoinForContract, extractArkProviderUrl, gateExclusion, gatedContracts, getAllByIndexValues, getMigrationStatus, getRandomId, hasBoardingTxExpired, hasCandidates, intentMatchesFilter, intentPageBounds, invoiceTarget, isAddressAllocationCapable, isArkContract, isBatchSignable, isBtcAddress, isContractGenericallySpendable, isContractVtxoEvent, isCooperativelyMigratable, isDeterministicSigner, isDiscoverable, isHDAllocationCapable, isHDDeterministicSignCapable, isHDWalletCapable, isLightningInvoice, isLnurl, isMessageBusInitializingError, isMessageBusNotInitializedError, isPerArtifactDescriptor, isSigningIdentity, isSubdust, isTerminalIntentState, isValidArkAddress, isVtxoExpiringSoon, isVtxoForScript, isWatchedContract, logExcludedVtxos, makeHandle, matchServerCheckpoints, mergeChainedTxType, migrateWalletRepository, notifyExitObserved, onchainRail, openDatabase, outpointExclusion, outpointReasons, promisifyRequest, provisionClaimSecret, provisionRefundKey, registerWalletRestoreHook, requiresMigration, resolveAssetAmount, resolveBatchExpiryPolicy, resolveCheckpointExitDelayPolicy, resolveDescriptorSigner, resolvePrevTxs, resolveSendAmount, rollbackMigration, saveVtxosForContract, scriptFromArkAddress, selectCoinsWithAsset, selectVirtualCoins, selectionOf, serializeAssets, serializeExitPackage, serializeUtxo, serializeVtxo, setupServiceWorker, signAndSubmitOffchainTx, signerSetFromInfo, signingDescriptorIndex, strictSigningDescriptorIndex, toXOnlySignerHex, tryResolveSendAmount, validateBatchRecipients, validateConnectorsTxGraph, validateVtxoTxGraph, verifyTapscriptSignatures, waitForIncomingFunds, walletFeeSource, warnAndFilterVtxosForScript, withPrevTxs };
-//# sourceMappingURL=chunk-ZTGTQP2W.js.map
-//# sourceMappingURL=chunk-ZTGTQP2W.js.map
+export { ARKADE_MAGIC, ARKADE_SALTED_PREIMAGE_TAG, ARKADE_SWAP_PREIMAGE_TAG, ASSET_CARRIER_SATS, AbortError, ActivityRegistry, AmbiguousRouteError, ArkNote, ArkadeCash, ArkadeCashCreateError, AssetManager, BIP21, BIP21Error, BIP322, BLOCKED_UPGRADE_TIMEOUT_MS, Batch, CachingArkProvider, ChainedTxType, ConnectionDisposedError, ContractManager, ContractRepositoryImpl, ContractWatcher, DB_VERSION, DEFAULT_MESSAGE_TIMEOUTS, DEFAULT_MIN_BATCH_EXPIRY_SECONDS, DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, DatabaseUpgradeBlockedError, DelegateManagerImpl, DelegateNotConfiguredError, DelegatorManagerImpl, DelegatorNotConfiguredError, DescriptorIdentity, DescriptorSigningProviderMissingError, DustChangeError, ELECTRUM_TCP_HOST, ELECTRUM_WS_URL, ESPLORA_URL, ElectrumOnchainProvider, EmulatorPacket, EsploraProvider, Estimator, Extension, ExtensionNotFoundError, ForeignDescriptorError, HDDescriptorProvider, INTENT_TERMINAL_STATES, InMemoryContractRepository, InMemoryIntentRepository, InMemoryVirtualTxRepository, InMemoryWalletRepository, IndexedDBContractRepository, IndexedDBIntentRepository, IndexedDBVirtualTxRepository, IndexedDBWalletRepository, MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD, MESSAGE_BUS_INITIALIZING, MESSAGE_BUS_NOT_INITIALIZED, MIGRATION_KEY, MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, MessageBus, MessageBusInitializingError, MessageBusNotInitializedError, MissingSigningDescriptorError, MnemonicIdentity, OnchainWallet, OversizedChangeError, P2A, PaymentRouter, PrevTxUnavailableError, REGTEST_MIN_BATCH_EXPIRY_SECONDS, REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, Ramps, ReadonlyAssetManager, ReadonlyDescriptorIdentity, ReadonlySingleKey, ReadonlyWallet, ReadonlyWalletError, RestDelegateProvider, RestDelegatorProvider, RestEmulatorProvider, SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, SeedIdentity, ServiceWorkerReadonlyWallet, ServiceWorkerTimeoutError, ServiceWorkerWallet, SingleKey, TxTree, TxType, TxWeightEstimator, UnannotatableInputError, UnilateralExit, UnknownPacket, Unroll, VtxoManager, Wallet2 as Wallet, WalletCannotAllocateAddressError, WalletCannotSignError, WalletMessageHandler, WalletNotInitializedError, WalletRepositoryImpl, WsElectrumChainSource, adoptContractDescriptor, arkAssetRail, arkRail, arkTarget, arkade_exports, assertFinalCommitmentMatchesValidated, assertIntentIdUnique, assertNoAssets, assertNoSelection, assertSendableAmount, assertSubmittedArkTxid, assertValidBatchExpiry, assertValidServerUnrollScript, assetMintResolver, assetsOf, attachPrevArkTxs, attachPrevoutTxs, awaitTransaction, boardingResolver, btcTarget, buildForfeitTx, buildOffchainTx, buildPreimageMessage, buildSaltedPreimageMessage, claimWithPreimageIdentity, classifyAgainstSignerSet, classifyContractSigner, closeDatabase, collabExitResolver, combineTapscriptSigs, contractFromArkContract, contractFromArkContractWithAddress, contractPreimage, contractSigner, createAssetPacket, createDefaultActivityRegistry, createDefaultPaymentRouter, createExitChainResolver, createManagedConnection, decodeArkContract, defaultBatchExpiryPolicy, defaultCheckpointExitDelayPolicy, deleteByIndex, deserializeAssets, deserializeExitPackage, deserializeUtxo, deserializeVtxo, encodeArkContract, exitObserverFor, extendVirtualCoinForContract, extractArkProviderUrl, gateExclusion, gatedContracts, getAllByIndexValues, getMigrationStatus, getRandomId, hasBoardingTxExpired, hasCandidates, intentMatchesFilter, intentPageBounds, invoiceTarget, isAddressAllocationCapable, isArkContract, isBatchSignable, isBtcAddress, isContractGenericallySpendable, isContractVtxoEvent, isCooperativelyMigratable, isDeterministicSigner, isDiscoverable, isHDAllocationCapable, isHDDeterministicSignCapable, isHDWalletCapable, isLightningInvoice, isLnurl, isMessageBusInitializingError, isMessageBusNotInitializedError, isPerArtifactDescriptor, isSigningIdentity, isSubdust, isTerminalIntentState, isValidArkAddress, isVtxoExpiringSoon, isVtxoForScript, isWatchedContract, logExcludedVtxos, makeHandle, matchServerCheckpoints, mergeChainedTxType, migrateWalletRepository, notifyExitObserved, onchainRail, openDatabase, outpointExclusion, outpointReasons, promisifyRequest, provisionClaimSecret, provisionRefundKey, registerWalletRestoreHook, requiresMigration, resolveAssetAmount, resolveBatchExpiryPolicy, resolveCheckpointExitDelayPolicy, resolveDescriptorSigner, resolvePrevTxs, resolveSendAmount, rollbackMigration, saveVtxosForContract, scriptFromArkAddress, selectCoinsWithAsset, selectVirtualCoins, selectionOf, serializeAssets, serializeExitPackage, serializeUtxo, serializeVtxo, setupServiceWorker, signAndSubmitOffchainTx, signerSetFromInfo, signingDescriptorIndex, strictSigningDescriptorIndex, toXOnlySignerHex, tryResolveSendAmount, validateBatchRecipients, validateConnectorsTxGraph, validateVtxoTxGraph, verifyTapscriptSignatures, waitForIncomingFunds, walletFeeSource, warnAndFilterVtxosForScript, withPrevTxs };
+//# sourceMappingURL=chunk-FTLPTF3R.js.map
+//# sourceMappingURL=chunk-FTLPTF3R.js.map