@arkade-os/sdk 0.5.0-rc.7 → 0.5.0-rc.9

package/README.md

@@ -1371,6 +1371,35 @@ const swWallet = await ServiceWorkerWallet.setup({
 
 Raise it when the external issuer is expected to burn more than `N` consecutive addresses without any of them being paid — every index in such a run is a miss, and the funded one sits past the band. When that happens the funds are invisible until a `restore()` whose `gapLimit` is large enough to cross the run (`wallet.restore({ gapLimit: 200 })`); a default restore closes its gap window before reaching the funded index. Keep the value modest: the band adds up to `2N + 1` indices × the candidate matrix (typically 1-4 scripts each) to the wallet's subscription.
 
+#### Restoring plugin state
+
+`wallet.restore()` is the explicit imported-wallet recovery boundary. It first restores the
+wallet's own addresses, contracts, history, and balances, then runs every restore hook registered
+for that wallet instance. `Wallet` and `ServiceWorkerWallet` both follow this ordering, and
+concurrent calls coalesce until the hooks finish.
+
+```typescript
+import { registerWalletRestoreHook } from '@arkade-os/sdk'
+
+const unregister = registerWalletRestoreHook(wallet, {
+  id: 'my-plugin',
+  restore: async (restoredWallet) => {
+    await rebuildPluginState(await restoredWallet.getTransactionHistory())
+  },
+})
+
+await wallet.restore()
+```
+
+Registering the same `id` again replaces that hook without changing its position. A run uses a
+stable snapshot, attempts every hook in registration order, and throws an `AggregateError` after
+all failures have been collected. If core recovery fails, hooks do not run. The returned function
+removes only that exact registration and is safe to call more than once.
+
+Hooks do not run during `Wallet.create()`, `ServiceWorkerWallet.setup()`, or ordinary startup. A
+plugin should register before an application calls `restore()` and keep its normal incremental
+reconciliation for state that arrives later.
+
 For advanced use cases, you can access the ContractManager directly to register external contracts:
 
 ```typescript

package/dist/adapters/expo.cjs

@@ -1,18 +1,18 @@
 'use strict';
 
-var chunkXIPWLWPU_cjs = require('../chunk-XIPWLWPU.cjs');
-require('../chunk-XOT73T36.cjs');
-require('../chunk-GLLBSULU.cjs');
+var chunk7OL2P5TV_cjs = require('../chunk-7OL2P5TV.cjs');
+require('../chunk-V4JZOFYT.cjs');
+require('../chunk-VTXMC4N7.cjs');
 
 
 
 Object.defineProperty(exports, "ExpoArkProvider", {
   enumerable: true,
-  get: function () { return chunkXIPWLWPU_cjs.ExpoArkProvider; }
+  get: function () { return chunk7OL2P5TV_cjs.ExpoArkProvider; }
 });
 Object.defineProperty(exports, "ExpoIndexerProvider", {
   enumerable: true,
-  get: function () { return chunkXIPWLWPU_cjs.ExpoIndexerProvider; }
+  get: function () { return chunk7OL2P5TV_cjs.ExpoIndexerProvider; }
 });
 //# sourceMappingURL=expo.cjs.map
 //# sourceMappingURL=expo.cjs.map

package/dist/adapters/expo.d.cts

@@ -1,5 +1,5 @@
-import { q as RestArkProvider, n as SettlementEvent, T as TxNotificationEvent, r as RestIndexerProvider, s as SubscriptionResponse } from '../index-F-X4BWxi.cjs';
-export { t as ArkProvider, u as IndexerProvider } from '../index-F-X4BWxi.cjs';
+import { q as RestArkProvider, n as SettlementEvent, T as TxNotificationEvent, r as RestIndexerProvider, s as SubscriptionResponse } from '../index-BIL9boGL.cjs';
+export { t as ArkProvider, u as IndexerProvider } from '../index-BIL9boGL.cjs';
 import '@scure/btc-signer/utils.js';
 import '@scure/btc-signer/transaction.js';
 import '@scure/btc-signer';

package/dist/adapters/expo.d.ts

@@ -1,5 +1,5 @@
-import { q as RestArkProvider, n as SettlementEvent, T as TxNotificationEvent, r as RestIndexerProvider, s as SubscriptionResponse } from '../index-F-X4BWxi.js';
-export { t as ArkProvider, u as IndexerProvider } from '../index-F-X4BWxi.js';
+import { q as RestArkProvider, n as SettlementEvent, T as TxNotificationEvent, r as RestIndexerProvider, s as SubscriptionResponse } from '../index-BIL9boGL.js';
+export { t as ArkProvider, u as IndexerProvider } from '../index-BIL9boGL.js';
 import '@scure/btc-signer/utils.js';
 import '@scure/btc-signer/transaction.js';
 import '@scure/btc-signer';

package/dist/adapters/expo.js

@@ -1,5 +1,5 @@
-export { ExpoArkProvider, ExpoIndexerProvider } from '../chunk-4MB3Z33G.js';
-import '../chunk-2JU54RGB.js';
-import '../chunk-H7KLBU6G.js';
+export { ExpoArkProvider, ExpoIndexerProvider } from '../chunk-FQCMEAWN.js';
+import '../chunk-J2K7WWMJ.js';
+import '../chunk-JFZBKPSV.js';
 //# sourceMappingURL=expo.js.map
 //# sourceMappingURL=expo.js.map

package/dist/{asyncStorageTaskQueue-BHOhjFiF.d.cts → asyncStorageTaskQueue-ChKX-D51.d.cts}

@@ -1,4 +1,4 @@
-import { a as TaskQueue, b as TaskItem, c as TaskResult } from './taskRunner-CDCz7MTW.cjs';
+import { a as TaskQueue, c as TaskItem, d as TaskResult } from './taskRunner-DxpSuKmh.cjs';
 
 /**
  * Minimal async key-value storage interface.

package/dist/{asyncStorageTaskQueue-BedBOEpT.d.ts → asyncStorageTaskQueue-DZYrAWN8.d.ts}

@@ -1,4 +1,4 @@
-import { a as TaskQueue, b as TaskItem, c as TaskResult } from './taskRunner-BdU_d__J.js';
+import { a as TaskQueue, c as TaskItem, d as TaskResult } from './taskRunner-Cu4uO1to.js';
 
 /**
  * Minimal async key-value storage interface.

package/dist/{chunk-7B2QAHQU.js → chunk-3TCWQPAC.js}

@@ -1,6 +1,6 @@
-import { AssetId, AssetGroup, AssetInput, AssetOutput, Metadata, Packet, BufferReader, BufferWriter, AssetRef, RestIndexerProvider } from './chunk-2JU54RGB.js';
-import { witnessRefToBytes, validateProgram, toASM, stringifyArtifact, serializeArkadeContractParams, resolveAsm, parseArtifact, getOpcodeValue, getOpcodeName, fromASM, deserializeArkadeContractParams, computeArkadeScriptPublicKey, bytesToASM, asmToBytes, arkadeWitnessHash, arkadeScriptHash, SUPPORTED_PROGRAM_VERSION, OPCODE_VALUES, OPCODE_NAMES, bignum_exports, ArkadeScript, ArkadeProgramScript, ARKADE_OPS, ARKADE_OPCODE_VALUES, ARKADE_OPCODE_NAMES, ARKADE_OPCODES, ARKADE_OP, toXOnly, inputName, contractHandlers, isMainnetDescriptor, descriptorIsOurs, deriveDescriptorLeafPubKey, deriveDescriptorLeafCompressedPubKey, parseHDDescriptor, identityDescriptor, DefaultVtxo, speculativeReceiveMetadata, DelegateVtxo, WALLET_RECEIVE_SOURCE, BoardingContractHandler } from './chunk-L6MGV7ZA.js';
-import { VtxoScript, __export, Transaction, isVirtualCoin, canRecoverOnchain, CSVMultisigTapscript, DEFAULT_NETWORK, resolveEmulatorPubkey, hasTerminalSpend, getNormalizedVtxos, setArkPsbtField, PrevArkTxField, ConditionWitness, craftToSpendTx, ArkAddress, ServerResponseMismatchError, getArkPsbtFields, CosignerPublicKey, OP_RETURN_EMPTY_PKSCRIPT, canSweepOnchain, sequenceToTimelock, decodeTapscript, scriptFromTapLeafScript, CLTVMultisigTapscript, VtxoTaprootTree, timelockToSequence, normalizeVtxo, assertAllowedSighashTypes, baseFetch, Intent, rateGate, DEFAULT_NETWORK_NAME, formatSighash, getSequence, maybeArkError, isArkError, ArkErrorName, toOffchainInputFeeParams, getNetwork, MultisigTapscript, isEventSourceError, isEventSourceUnavailableError, getAllNormalizedVtxos, isPastExpiry, isRetryableProviderError, DEFAULT_PAGE_SIZE, RestArkProvider, DEFAULT_ARKADE_SERVER_URL, networkFromArkadeInfo, ArkError, TapTreeCoder, resolveTimeHeight, canSpendOffchain, INFO_FETCH_TIMEOUT_MS, PrevoutTxField, fetchVtxoCreatedAtByTxid, EXPIRY_MIN_PLAUSIBLE_MS, ProviderUnavailableError, networks as networks$1 } from './chunk-H7KLBU6G.js';
+import { AssetId, AssetGroup, AssetInput, AssetOutput, Metadata, Packet, BufferReader, BufferWriter, AssetRef, RestIndexerProvider } from './chunk-J2K7WWMJ.js';
+import { witnessRefToBytes, validateProgram, toASM, stringifyArtifact, serializeArkadeContractParams, resolveAsm, parseArtifact, getOpcodeValue, getOpcodeName, fromASM, deserializeArkadeContractParams, computeArkadeScriptPublicKey, bytesToASM, asmToBytes, arkadeWitnessHash, arkadeScriptHash, SUPPORTED_PROGRAM_VERSION, OPCODE_VALUES, OPCODE_NAMES, bignum_exports, ArkadeScript, ArkadeProgramScript, ARKADE_OPS, ARKADE_OPCODE_VALUES, ARKADE_OPCODE_NAMES, ARKADE_OPCODES, ARKADE_OP, toXOnly, inputName, contractHandlers, isMainnetDescriptor, descriptorIsOurs, deriveDescriptorLeafPubKey, deriveDescriptorLeafCompressedPubKey, parseHDDescriptor, identityDescriptor, DefaultVtxo, speculativeReceiveMetadata, DelegateVtxo, WALLET_RECEIVE_SOURCE, BoardingContractHandler } from './chunk-R4KRWX7R.js';
+import { VtxoScript, __export, Transaction, canRecoverOnchain, CSVMultisigTapscript, DEFAULT_NETWORK, resolveEmulatorPubkey, hasTerminalSpend, getNormalizedVtxos, setArkPsbtField, PrevArkTxField, ConditionWitness, craftToSpendTx, ArkAddress, isVirtualCoin, getArkPsbtFields, CosignerPublicKey, ServerResponseMismatchError, OP_RETURN_EMPTY_PKSCRIPT, canSweepOnchain, sequenceToTimelock, decodeTapscript, scriptFromTapLeafScript, CLTVMultisigTapscript, VtxoTaprootTree, timelockToSequence, assertAllowedSighashTypes, baseFetch, Intent, rateGate, DEFAULT_NETWORK_NAME, formatSighash, normalizeVtxo, getSequence, maybeArkError, isArkError, ArkErrorName, toOffchainInputFeeParams, getNetwork, MultisigTapscript, isEventSourceError, isEventSourceUnavailableError, getAllNormalizedVtxos, isPastExpiry, isRetryableProviderError, DEFAULT_PAGE_SIZE, RestArkProvider, DEFAULT_ARKADE_SERVER_URL, networkFromArkadeInfo, ArkError, TapTreeCoder, resolveTimeHeight, canSpendOffchain, INFO_FETCH_TIMEOUT_MS, PrevoutTxField, fetchVtxoCreatedAtByTxid, EXPIRY_MIN_PLAUSIBLE_MS, ProviderUnavailableError, networks as networks$1 } from './chunk-JFZBKPSV.js';
 import { sha256 as sha256$1, equalBytes, hash160, sha256x2, concatBytes, randomPrivateKeyBytes, pubECDSA, pubSchnorr } from '@scure/btc-signer/utils.js';
 import { SigHash, Script, OP, OutScript, Address, RawWitness, p2tr, p2wpkh, TaprootControlBlock, DEFAULT_SEQUENCE, Transaction as Transaction$2 } from '@scure/btc-signer';
 import { hex, base58, base64, bech32m } from '@scure/base';
@@ -2657,6 +2657,12 @@ var ErrOnchainOutputNotFound = (address) => new ServerResponseMismatchError(`onc
 var ErrUnvalidatedOffchainOutput = (address) => new ServerResponseMismatchError(
   `offchain output ${address} cannot be validated: virtual output tree signing did not run`
 );
+var ErrIntentOutputNotFound = (index, kind) => new ServerResponseMismatchError(
+  `${kind} output ${index} of the intent proof is not present in what the server built`
+);
+var ErrUnvalidatedIntentOutput = (index) => new ServerResponseMismatchError(
+  `offchain output ${index} of the intent proof cannot be validated: virtual output tree signing did not run`
+);
 var ErrInvalidOnchainOutputAmount = (address) => new Error(`invalid onchain output amount: ${address}`);
 var ErrInvalidOnchainOutputAssets = (address) => new Error(`onchain output ${address} cannot have assets`);
 var ErrInvalidOffchainOutputAmount = (address) => new Error(`invalid offchain output ${address}, missing amount`);
@@ -2693,6 +2699,74 @@ function validateBatchRecipientsWithoutTree(commitmentTx, recipients, network) {
     throw ErrUnvalidatedOffchainOutput(recipient.address);
   }
 }
+function declaredIntentOutputs(signedProof, onchainOutputIndexes) {
+  const proof = Transaction.fromPSBT(base64.decode(signedProof));
+  const onchain = new Set(onchainOutputIndexes);
+  const declared = [];
+  for (let i = 0; i < proof.outputsLength; i++) {
+    const output = proof.getOutput(i);
+    if (!output?.script || output.script.length === 0 || !output.amount) continue;
+    declared.push({
+      index: i,
+      script: output.script,
+      amount: output.amount,
+      onchain: onchain.has(i)
+    });
+  }
+  return declared;
+}
+function validateBatchAgainstIntent(commitmentTx, vtxoTreeLeaves, declared) {
+  const usedOnchain = /* @__PURE__ */ new Set();
+  const usedLeaf = /* @__PURE__ */ new Set();
+  for (const output of declared) {
+    if (output.onchain) {
+      if (!takeOnchainOutput(commitmentTx, output, usedOnchain)) {
+        throw ErrIntentOutputNotFound(output.index, "onchain");
+      }
+      continue;
+    }
+    if (!takeLeafOutput(vtxoTreeLeaves, output, usedLeaf)) {
+      throw ErrIntentOutputNotFound(output.index, "offchain");
+    }
+  }
+}
+function validateBatchAgainstIntentWithoutTree(commitmentTx, declared) {
+  const usedOnchain = /* @__PURE__ */ new Set();
+  for (const output of declared) {
+    if (!output.onchain) {
+      throw ErrUnvalidatedIntentOutput(output.index);
+    }
+    if (!takeOnchainOutput(commitmentTx, output, usedOnchain)) {
+      throw ErrIntentOutputNotFound(output.index, "onchain");
+    }
+  }
+}
+function takeOnchainOutput(commitmentTx, declared, used) {
+  for (let i = 0; i < commitmentTx.outputsLength; i++) {
+    if (used.has(i)) continue;
+    const output = commitmentTx.getOutput(i);
+    if (!output?.script || output.amount !== declared.amount) continue;
+    if (!equalBytes(output.script, declared.script)) continue;
+    used.add(i);
+    return true;
+  }
+  return false;
+}
+function takeLeafOutput(leaves, declared, used) {
+  for (let leafIdx = 0; leafIdx < leaves.length; leafIdx++) {
+    const leaf = leaves[leafIdx];
+    for (let i = 0; i < leaf.outputsLength; i++) {
+      const key = `${leafIdx}:${i}`;
+      if (used.has(key)) continue;
+      const output = leaf.getOutput(i);
+      if (!output?.script || output.amount !== declared.amount) continue;
+      if (!equalBytes(output.script, declared.script)) continue;
+      used.add(key);
+      return true;
+    }
+  }
+  return false;
+}
 function validateOnchainRecipient(commitmentTx, recipient, network, usedOutputs) {
   const addr = Address(network).decode(recipient.address);
   const expectedPkScript = OutScript.encode(addr);
@@ -2942,6 +3016,39 @@ function createDefaultActivityRegistry() {
   return registry;
 }
 
+// src/wallet/restoreHooks.ts
+var restoreHooks = /* @__PURE__ */ new WeakMap();
+function registerWalletRestoreHook(wallet, hook) {
+  const hooks = restoreHooks.get(wallet) ?? [];
+  const entry = { ...hook };
+  const existing = hooks.findIndex(({ id }) => id === hook.id);
+  if (existing === -1) hooks.push(entry);
+  else hooks[existing] = entry;
+  restoreHooks.set(wallet, hooks);
+  return () => {
+    const current = restoreHooks.get(wallet);
+    if (!current) return;
+    const index = current.indexOf(entry);
+    if (index === -1) return;
+    current.splice(index, 1);
+    if (current.length === 0) restoreHooks.delete(wallet);
+  };
+}
+async function runWalletRestoreHooks(wallet) {
+  const snapshot = [...restoreHooks.get(wallet) ?? []];
+  const errors = [];
+  for (const hook of snapshot) {
+    try {
+      await hook.restore(wallet);
+    } catch (error) {
+      errors.push(error);
+    }
+  }
+  if (errors.length > 0) {
+    throw new AggregateError(errors, "Wallet restore hooks failed");
+  }
+}
+
 // src/wallet/index.ts
 var TxType = /* @__PURE__ */ ((TxType2) => {
   TxType2["TxSent"] = "SENT";
@@ -3422,21 +3529,38 @@ function assertSubmittedArkTxid(response, signedArkTx, context) {
     );
   }
 }
-function assertServerSignedLeaf(serverTx, localTx, inputIndex, serverPubkeyHex, context) {
+function assertServerSignedLeaf(serverTx, localTx, inputIndex, serverPubkeys, context) {
   const leaf = localTx.getInput(inputIndex).tapLeafScript?.[0];
   if (!leaf) {
     throw new Error(
       `${context}: input ${inputIndex} carries no spend leaf to verify the server signature against`
     );
   }
+  const script = scriptFromTapLeafScript(leaf);
+  let leafPubkeys;
+  try {
+    leafPubkeys = decodeTapscript(script).params.pubkeys.map(
+      (key) => hex.encode(toXOnly(key, "leaf key"))
+    );
+  } catch (error) {
+    throw new ServerResponseMismatchError(
+      `${context}: input ${inputIndex} spend leaf cannot be decoded (${error instanceof Error ? error.message : String(error)})`
+    );
+  }
+  const signer = leafPubkeys.find((key) => serverPubkeys.has(key));
+  if (!signer) {
+    throw new ServerResponseMismatchError(
+      `${context}: input ${inputIndex} spend leaf names no signer key the server advertises`
+    );
+  }
   try {
     verifyTapscriptSignatures(
       serverTx,
       inputIndex,
-      [serverPubkeyHex],
+      [signer],
       void 0,
       void 0,
-      tapLeafHash(scriptFromTapLeafScript(leaf))
+      tapLeafHash(script)
     );
   } catch (error) {
     throw new ServerResponseMismatchError(
@@ -3510,24 +3634,22 @@ async function submitOffchainTx(provider, offchainTx, signer, hooks, options) {
       );
     }
     const finalArkTx = Transaction.fromPSBT(base64.decode(response.finalArkTx));
-    const serverPubkeyHex = hex.encode(toXOnly(verify.serverPubkey, "server key"));
+    const serverPubkeys = new Set(
+      [verify.serverPubkey, ...verify.deprecatedServerPubkeys ?? []].map(
+        (key) => hex.encode(toXOnly(key, "server key"))
+      )
+    );
     for (let i = 0; i < offchainTx.arkTx.inputsLength; i++) {
       assertServerSignedLeaf(
         finalArkTx,
         offchainTx.arkTx,
         i,
-        serverPubkeyHex,
+        serverPubkeys,
         "submitTx ark tx"
       );
     }
     matched.forEach(
-      ({ server, local }, index) => assertServerSignedLeaf(
-        server,
-        local,
-        0,
-        serverPubkeyHex,
-        `submitTx checkpoint ${index}`
-      )
+      ({ server, local }, index) => assertServerSignedLeaf(server, local, 0, serverPubkeys, `submitTx checkpoint ${index}`)
     );
   }
   let finalCheckpoints;
@@ -7550,12 +7672,7 @@ async function delegate(identity, delegateProvider, arkInfo, delegateInfo, vtxos
     if (!expiryTimestamp || expiryTimestamp === Number.MAX_SAFE_INTEGER) {
       delegateAt = new Date(Date.now() + 1 * 60 * 1e3);
     } else {
-      const remainingTimeMs = expiryTimestamp - Date.now();
-      if (remainingTimeMs <= 0) {
-        delegateAt = new Date(Date.now() + 1 * 60 * 1e3);
-      } else {
-        delegateAt = new Date(expiryTimestamp - remainingTimeMs * 0.1);
-      }
+      delegateAt = defaultDelegateAt(expiryTimestamp, arkInfo.sessionDuration);
     }
   }
   const { fees, dust, forfeitAddress, network } = arkInfo;
@@ -7715,6 +7832,14 @@ async function makeSignedDelegateIntent(identity, coins, outputs, onchainOutputs
     message
   };
 }
+function defaultDelegateAt(expiryTimestamp, sessionDurationSeconds, now = Date.now()) {
+  const remainingTimeMs = expiryTimestamp - now;
+  if (remainingTimeMs <= 0) return new Date(now + 6e4);
+  const sessionLeadMs = Number(sessionDurationSeconds * 1000n);
+  const leadTimeMs = Math.max(remainingTimeMs * 0.1, sessionLeadMs);
+  const delegateAt = expiryTimestamp - leadTimeMs;
+  return new Date(delegateAt > now ? delegateAt : now + 2e3);
+}
 function findDestinationOutputIndex(outputs, destinationScript) {
   return outputs.findIndex((o) => o.script && equalBytes(o.script, destinationScript));
 }
@@ -9114,13 +9239,14 @@ var ContractWatcher = class {
     try {
       const vtxosMap = await this.getContractVtxos({
         contractScripts,
-        includeSpent: false
-        // only spendable ones!
+        includeSpent: true
       });
       for (const contractScript of contractScripts) {
         const state = this.contracts.get(contractScript);
         if (!state) continue;
-        const currentVtxos = vtxosMap.get(contractScript) || [];
+        const known = vtxosMap.get(contractScript) || [];
+        const knownByKey = new Map(known.map((v) => [`${v.txid}:${v.vout}`, v]));
+        const currentVtxos = known.filter((v) => !v.isSpent);
         const currentKeys = new Set(currentVtxos.map((v) => `${v.txid}:${v.vout}`));
         const newVtxos = [];
         for (const vtxo of currentVtxos) {
@@ -9133,7 +9259,7 @@ var ContractWatcher = class {
         const spentVtxos = [];
         for (const [key, vtxo] of state.lastKnownVtxos) {
           if (!currentKeys.has(key)) {
-            spentVtxos.push(vtxo);
+            spentVtxos.push(knownByKey.get(key) ?? vtxo);
             state.lastKnownVtxos.delete(key);
           }
         }
@@ -9887,6 +10013,41 @@ var ContractManager = class _ContractManager {
     }
     return contract;
   }
+  /**
+   * `createContract`'s step order, fetch batched: persist all, hydrate once,
+   * then watch. Hydrating first keeps it equivalent — the watcher seeds from
+   * the repository, so an unhydrated row reads as all-new. A part-way failure
+   * still watches what it wrote; a retry reports those rows as existing.
+   */
+  async createContracts(paramsList) {
+    if (paramsList.length === 0) return [];
+    return this.watcher.withCoalescedSubscription(async () => {
+      const upserted = [];
+      try {
+        for (const params of paramsList) upserted.push(await this.upsertContract(params));
+      } catch (err) {
+        for (const u of upserted) {
+          if (!u.persisted) continue;
+          await this.watcher.addContract(u.contract).catch(
+            (e) => console.error(`ContractManager: ${u.contract.script} left dark`, e)
+          );
+        }
+        throw err;
+      }
+      const fresh = upserted.filter((u) => u.persisted).map((u) => u.contract);
+      if (fresh.length > 0) {
+        try {
+          await this.fetchContractVxosFromIndexer(fresh);
+          this.markSyncOnline();
+        } catch (err) {
+          if (!isRetryableProviderError(err)) throw err;
+          this.markSyncDegraded(err);
+        }
+        for (const contract of fresh) await this.watcher.addContract(contract);
+      }
+      return upserted.map((u) => u.contract);
+    });
+  }
   /**
    * Lightweight variant of {@link createContract} for batch discovery
    * paths (currently: {@link scanContracts}). Validates, dedupes, persists,
@@ -14320,7 +14481,10 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
         `restore: gapLimit must be a positive integer (got ${String(opts?.gapLimit)})`
       );
     }
-    this._restoreInFlight = this._runRestore(gapLimit).finally(() => {
+    this._restoreInFlight = (async () => {
+      await this._runRestore(gapLimit);
+      await runWalletRestoreHooks(this);
+    })().finally(() => {
       this._restoreInFlight = void 0;
     });
     return this._restoreInFlight;
@@ -14933,6 +15097,7 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
     const connectorsLeaves = connectorsGraph?.leaves() || [];
     for (const input of inputs) {
       if (!isVirtualCoin(input)) {
+        let matched = false;
         for (let i = 0; i < settlementPsbt.inputsLength; i++) {
           const settlementInput = settlementPsbt.getInput(i);
           if (!settlementInput.txid || settlementInput.index === void 0) {
@@ -14959,8 +15124,14 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
             throw new Error(await this.unsignableBoardingInputError(input, script));
           }
           hasBoardingUtxos = true;
+          matched = true;
           break;
         }
+        if (!matched && !(input instanceof ArkNote)) {
+          throw new Error(
+            `boarding input ${input.txid}:${input.vout} is not an input of the commitment tx`
+          );
+        }
         continue;
       }
       if (canRecoverOnchain(input, { timestamp: /* @__PURE__ */ new Date() }) || isSubdust({ value: input.value }, this.dustAmount)) {
@@ -16101,18 +16272,33 @@ var Wallet2 = class _Wallet extends ReadonlyWallet {
         this.inputSigningJobsFromWitnessUtxos(checkpoint)
       )
     };
-    return submitOffchainTx(this.arkProvider, offchainTx, signer, {
-      // Mark pending before submitting — if we crash between submit and
-      // finalize, the next init recovers via finalizePendingTxs.
-      beforeSubmit: () => this.setPendingTxFlag(true),
-      afterFinalize: async () => {
-        try {
-          await this.setPendingTxFlag(false);
-        } catch (error) {
-          console.error("Failed to clear pending tx flag:", error);
+    return submitOffchainTx(
+      this.arkProvider,
+      offchainTx,
+      signer,
+      {
+        // Mark pending before submitting — if we crash between submit and
+        // finalize, the next init recovers via finalizePendingTxs.
+        beforeSubmit: () => this.setPendingTxFlag(true),
+        afterFinalize: async () => {
+          try {
+            await this.setPendingTxFlag(false);
+          } catch (error) {
+            console.error("Failed to clear pending tx flag:", error);
+          }
+        }
+      },
+      {
+        // Deprecated keys too: a vtxo built before a rotation is still
+        // spent under the signer its leaf names.
+        verifyServerSignatures: {
+          serverPubkey: this._arkServerPublicKey,
+          deprecatedServerPubkeys: [...this._deprecatedSigners.keys()].map(
+            (h) => hex.decode(h)
+          )
         }
       }
-    });
+    );
   }
   // mark virtual outputs as spent, save change outputs if any.
   // `offchainTapscript` and `serverPubKey` are the epoch snapshot the
@@ -19622,6 +19808,7 @@ var ServiceWorkerWallet = class _ServiceWorkerWallet extends ServiceWorkerReadon
   identity;
   _assetManager;
   hasDelegate;
+  _restoreInFlight;
   get assetManager() {
     return this._assetManager;
   }
@@ -19892,6 +20079,16 @@ var ServiceWorkerWallet = class _ServiceWorkerWallet extends ServiceWorkerReadon
    * reconstructed here so callers can inspect `.errors`.
    */
   async restore(opts) {
+    if (this._restoreInFlight) return this._restoreInFlight;
+    this._restoreInFlight = (async () => {
+      await this._restoreWorkerWallet(opts);
+      await runWalletRestoreHooks(this);
+    })().finally(() => {
+      this._restoreInFlight = void 0;
+    });
+    return this._restoreInFlight;
+  }
+  async _restoreWorkerWallet(opts) {
     const message = {
       id: getRandomId(),
       tag: this.messageTag,
@@ -22864,6 +23061,12 @@ function createArkadeBatchHandler(intentId, inputs, signer, signedProof, message
       validateVtxoTxGraph(vtxoTree, commitmentTx, sweepTapTreeRoot);
       if (recipients && recipients.length > 0) {
         validateBatchRecipients(commitmentTx, vtxoTree.leaves(), recipients, network);
+      } else {
+        validateBatchAgainstIntent(
+          commitmentTx,
+          vtxoTree.leaves(),
+          declaredIntentOutputs(signedProof, message.onchain_output_indexes)
+        );
       }
       const sharedOutput = commitmentTx.getOutput(0);
       if (!sharedOutput?.amount) {
@@ -22898,8 +23101,15 @@ function createArkadeBatchHandler(intentId, inputs, signer, signedProof, message
         validatedCommitmentTxid,
         "arkade batch finalization"
       );
-      if (!validatedCommitmentTxid && recipients && recipients.length > 0) {
-        validateBatchRecipientsWithoutTree(commitmentPsbt, recipients, network);
+      if (!validatedCommitmentTxid) {
+        if (recipients && recipients.length > 0) {
+          validateBatchRecipientsWithoutTree(commitmentPsbt, recipients, network);
+        } else {
+          validateBatchAgainstIntentWithoutTree(
+            commitmentPsbt,
+            declaredIntentOutputs(signedProof, message.onchain_output_indexes)
+          );
+        }
       }
       const signedForfeits = [];
       let connectorIndex = 0;
@@ -23919,6 +24129,6 @@ function createDefaultPaymentRouter(wallet) {
   (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
 */
 
-export { ARKADE_MAGIC, ARKADE_SALTED_PREIMAGE_TAG, ARKADE_SWAP_PREIMAGE_TAG, ASSET_CARRIER_SATS, AbortError, ActivityRegistry, AmbiguousRouteError, ArkNote, ArkadeCash, ArkadeCashCreateError, AssetManager, BIP21, BIP21Error, BIP322, BLOCKED_UPGRADE_TIMEOUT_MS, Batch, CachingArkProvider, ChainedTxType, ConnectionDisposedError, ContractManager, ContractWatcher, DEFAULT_MESSAGE_TIMEOUTS, DEFAULT_MIN_BATCH_EXPIRY_SECONDS, DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, DatabaseUpgradeBlockedError, DelegateManagerImpl, DelegateNotConfiguredError, DescriptorIdentity, DescriptorSigningProviderMissingError, DustChangeError, ELECTRUM_TCP_HOST, ELECTRUM_WS_URL, ESPLORA_URL, ElectrumOnchainProvider, EmulatorPacket, EsploraProvider, Estimator, Extension, ExtensionNotFoundError, ForeignDescriptorError, HDDescriptorProvider, INTENT_TERMINAL_STATES, InMemoryContractRepository, InMemoryIntentRepository, InMemoryVirtualTxRepository, InMemoryWalletRepository, IndexedDBContractRepository, IndexedDBIntentRepository, IndexedDBVirtualTxRepository, IndexedDBWalletRepository, MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD, MESSAGE_BUS_INITIALIZING, MESSAGE_BUS_NOT_INITIALIZED, MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, MessageBus, MessageBusInitializingError, MessageBusNotInitializedError, MissingSigningDescriptorError, MnemonicIdentity, OnchainWallet, P2A, PaymentRouter, PrevTxUnavailableError, REGTEST_MIN_BATCH_EXPIRY_SECONDS, REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, Ramps, ReadonlyAssetManager, ReadonlyDescriptorIdentity, ReadonlySingleKey, ReadonlyWallet, ReadonlyWalletError, RestDelegateProvider, RestEmulatorProvider, SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, SeedIdentity, ServiceWorkerReadonlyWallet, ServiceWorkerTimeoutError, ServiceWorkerWallet, SingleKey, TxTree, TxType, TxWeightEstimator, UnannotatableInputError, UnilateralExit, UnknownPacket, Unroll, VtxoManager, Wallet2 as Wallet, WalletCannotAllocateAddressError, WalletCannotSignError, WalletMessageHandler, WalletNotInitializedError, WsElectrumChainSource, adoptContractDescriptor, arkAssetRail, arkRail, arkTarget, arkade_exports, assertFinalCommitmentMatchesValidated, assertIntentIdUnique, assertNoAssets, assertRecipientArkadeAddress, assertSendableAmount, assertSubmittedArkTxid, assertValidBatchExpiry, assertValidServerUnrollScript, assetMintResolver, assetsOf, attachPrevArkTxs, attachPrevoutTxs, awaitTransaction, boardingResolver, btcTarget, buildForfeitTx, buildOffchainTx, buildPreimageMessage, buildSaltedPreimageMessage, claimWithPreimageIdentity, classifyAgainstSignerSet, classifyContractSigner, closeDatabase, collabExitResolver, combineTapscriptSigs, contractFromArkContract, contractFromArkContractWithAddress, contractPreimage, contractSigner, createAssetPacket, createDefaultActivityRegistry, createDefaultPaymentRouter, createExitChainResolver, createManagedConnection, decodeArkContract, defaultBatchExpiryPolicy, defaultCheckpointExitDelayPolicy, deleteByIndex, deserializeAssets, deserializeExitPackage, deserializeUtxo, deserializeVtxo, encodeArkContract, exitObserverFor, extendVirtualCoinForContract, extractArkProviderUrl, gateExclusion, gatedContracts, getAllByIndexValues, getRandomId, hasBoardingTxExpired, hasCandidates, intentMatchesFilter, intentPageBounds, invoiceTarget, isAddressAllocationCapable, isArkContract, isBatchSignable, isBtcAddress, isContractGenericallySpendable, isContractVtxoEvent, isCooperativelyMigratable, isDeterministicSigner, isDiscoverable, isHDAllocationCapable, isHDDeterministicSignCapable, isHDWalletCapable, isLightningInvoice, isLnurl, isMessageBusInitializingError, isMessageBusNotInitializedError, isPerArtifactDescriptor, isSigningIdentity, isSubdust, isTerminalIntentState, isValidArkAddress, isVtxoExpiringSoon, isVtxoForScript, isWatchedContract, legacyVtxoFacts, logExcludedVtxos, makeHandle, matchServerCheckpoints, mergeChainedTxType, notifyExitObserved, onchainRail, openDatabase, outpointExclusion, outpointReasons, promisifyRequest, provisionClaimSecret, provisionRefundKey, resolveAssetAmount, resolveBatchExpiryPolicy, resolveCheckpointExitDelayPolicy, resolveDescriptorSigner, resolvePrevTxs, resolveSendAmount, saveVtxosForContract, scriptFromArkAddress, selectCoinsWithAsset, selectVirtualCoins, serializeAssets, serializeExitPackage, serializeUtxo, serializeVtxo, setupServiceWorker, signAndSubmitOffchainTx, signerSetFromInfo, signingDescriptorIndex, strictSigningDescriptorIndex, toXOnlySignerHex, tryResolveSendAmount, validateBatchRecipients, validateConnectorsTxGraph, validateVtxoTxGraph, verifyTapscriptSignatures, waitForIncomingFunds, walletFeeSource, warnAndFilterVtxosForScript, withPrevTxs };
-//# sourceMappingURL=chunk-7B2QAHQU.js.map
-//# sourceMappingURL=chunk-7B2QAHQU.js.map
+export { ARKADE_MAGIC, ARKADE_SALTED_PREIMAGE_TAG, ARKADE_SWAP_PREIMAGE_TAG, ASSET_CARRIER_SATS, AbortError, ActivityRegistry, AmbiguousRouteError, ArkNote, ArkadeCash, ArkadeCashCreateError, AssetManager, BIP21, BIP21Error, BIP322, BLOCKED_UPGRADE_TIMEOUT_MS, Batch, CachingArkProvider, ChainedTxType, ConnectionDisposedError, ContractManager, ContractWatcher, DEFAULT_MESSAGE_TIMEOUTS, DEFAULT_MIN_BATCH_EXPIRY_SECONDS, DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, DatabaseUpgradeBlockedError, DelegateManagerImpl, DelegateNotConfiguredError, DescriptorIdentity, DescriptorSigningProviderMissingError, DustChangeError, ELECTRUM_TCP_HOST, ELECTRUM_WS_URL, ESPLORA_URL, ElectrumOnchainProvider, EmulatorPacket, EsploraProvider, Estimator, Extension, ExtensionNotFoundError, ForeignDescriptorError, HDDescriptorProvider, INTENT_TERMINAL_STATES, InMemoryContractRepository, InMemoryIntentRepository, InMemoryVirtualTxRepository, InMemoryWalletRepository, IndexedDBContractRepository, IndexedDBIntentRepository, IndexedDBVirtualTxRepository, IndexedDBWalletRepository, MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD, MESSAGE_BUS_INITIALIZING, MESSAGE_BUS_NOT_INITIALIZED, MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, MessageBus, MessageBusInitializingError, MessageBusNotInitializedError, MissingSigningDescriptorError, MnemonicIdentity, OnchainWallet, P2A, PaymentRouter, PrevTxUnavailableError, REGTEST_MIN_BATCH_EXPIRY_SECONDS, REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, Ramps, ReadonlyAssetManager, ReadonlyDescriptorIdentity, ReadonlySingleKey, ReadonlyWallet, ReadonlyWalletError, RestDelegateProvider, RestEmulatorProvider, SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS, SeedIdentity, ServiceWorkerReadonlyWallet, ServiceWorkerTimeoutError, ServiceWorkerWallet, SingleKey, TxTree, TxType, TxWeightEstimator, UnannotatableInputError, UnilateralExit, UnknownPacket, Unroll, VtxoManager, Wallet2 as Wallet, WalletCannotAllocateAddressError, WalletCannotSignError, WalletMessageHandler, WalletNotInitializedError, WsElectrumChainSource, adoptContractDescriptor, arkAssetRail, arkRail, arkTarget, arkade_exports, assertFinalCommitmentMatchesValidated, assertIntentIdUnique, assertNoAssets, assertRecipientArkadeAddress, assertSendableAmount, assertSubmittedArkTxid, assertValidBatchExpiry, assertValidServerUnrollScript, assetMintResolver, assetsOf, attachPrevArkTxs, attachPrevoutTxs, awaitTransaction, boardingResolver, btcTarget, buildForfeitTx, buildOffchainTx, buildPreimageMessage, buildSaltedPreimageMessage, claimWithPreimageIdentity, classifyAgainstSignerSet, classifyContractSigner, closeDatabase, collabExitResolver, combineTapscriptSigs, contractFromArkContract, contractFromArkContractWithAddress, contractPreimage, contractSigner, createAssetPacket, createDefaultActivityRegistry, createDefaultPaymentRouter, createExitChainResolver, createManagedConnection, decodeArkContract, defaultBatchExpiryPolicy, defaultCheckpointExitDelayPolicy, deleteByIndex, deserializeAssets, deserializeExitPackage, deserializeUtxo, deserializeVtxo, encodeArkContract, exitObserverFor, extendVirtualCoinForContract, extractArkProviderUrl, gateExclusion, gatedContracts, getAllByIndexValues, getRandomId, hasBoardingTxExpired, hasCandidates, intentMatchesFilter, intentPageBounds, invoiceTarget, isAddressAllocationCapable, isArkContract, isBatchSignable, isBtcAddress, isContractGenericallySpendable, isContractVtxoEvent, isCooperativelyMigratable, isDeterministicSigner, isDiscoverable, isHDAllocationCapable, isHDDeterministicSignCapable, isHDWalletCapable, isLightningInvoice, isLnurl, isMessageBusInitializingError, isMessageBusNotInitializedError, isPerArtifactDescriptor, isSigningIdentity, isSubdust, isTerminalIntentState, isValidArkAddress, isVtxoExpiringSoon, isVtxoForScript, isWatchedContract, legacyVtxoFacts, logExcludedVtxos, makeHandle, matchServerCheckpoints, mergeChainedTxType, notifyExitObserved, onchainRail, openDatabase, outpointExclusion, outpointReasons, promisifyRequest, provisionClaimSecret, provisionRefundKey, registerWalletRestoreHook, resolveAssetAmount, resolveBatchExpiryPolicy, resolveCheckpointExitDelayPolicy, resolveDescriptorSigner, resolvePrevTxs, resolveSendAmount, saveVtxosForContract, scriptFromArkAddress, selectCoinsWithAsset, selectVirtualCoins, serializeAssets, serializeExitPackage, serializeUtxo, serializeVtxo, setupServiceWorker, signAndSubmitOffchainTx, signerSetFromInfo, signingDescriptorIndex, strictSigningDescriptorIndex, toXOnlySignerHex, tryResolveSendAmount, validateBatchRecipients, validateConnectorsTxGraph, validateVtxoTxGraph, verifyTapscriptSignatures, waitForIncomingFunds, walletFeeSource, warnAndFilterVtxosForScript, withPrevTxs };
+//# sourceMappingURL=chunk-3TCWQPAC.js.map
+//# sourceMappingURL=chunk-3TCWQPAC.js.map