@arkade-os/swap 0.0.12 → 0.1.0-rc.1

package/dist/index.js

@@ -14,6 +14,7 @@ import {
   MIN_HEADROOM_SECONDS,
   ONCHAIN_BTC,
   ONCHAIN_CLAIM_MARGIN_SECONDS,
+  ONCHAIN_CLAIM_VSIZE,
   ONCHAIN_DUST_SATS,
   ONCHAIN_ORDER_MARGIN_SECONDS,
   ONCHAIN_RECEIVE_PAIR,
@@ -39,10 +40,12 @@ import {
   deriveOnchainSend,
   extractPreimage,
   httpTransport,
+  l1NetworkFromArk,
   l1ScriptForAddress,
+  lightningReceiveContract,
   lightningReceiveRequest,
+  lightningSendContract,
   lightningSendRequest,
-  lightningSendVtxoScript,
   lockupContractParams,
   newPreimage,
   newRfqId,
@@ -51,7 +54,6 @@ import {
   onchainReceiveRequest,
   onchainSendRequest,
   paymentHashOf,
-  receiveVtxoScript,
   registerLockupContract,
   relayTransport,
   requestLightningReceive,
@@ -65,22 +67,20 @@ import {
   unilateralRefundWithoutReceiverDelay,
   verifyLockupAddress,
   verifyReceiveInvoice
-} from "./chunk-XXWOODUE.js";
+} from "./chunk-OEKSNYJW.js";
 import {
   InMemoryAssetSwapRepository,
   marketsCacheKey
-} from "./chunk-6ZUS47GA.js";
+} from "./chunk-U7VWWTL6.js";
 
 // src/offer.ts
 import { hex as hex2 } from "@scure/base";
 import { concatBytes } from "@scure/btc-signer/utils.js";
 import {
   ArkAddress,
-  RestArkProvider,
-  RestIndexerProvider,
   arkade,
   asset,
-  getNetwork,
+  networkFromArkadeInfo,
   resolveEmulatorPubkey,
   toXOnlySignerHex
 } from "@arkade-os/sdk";
@@ -244,9 +244,9 @@ var addAssetSwap = async (repository, swap) => {
   const swaps = await getAssetSwapsOrThrow(repository);
   if (swaps.some((s) => s.id === swap.id)) return swaps;
   await saveSwapOrThrow(repository, swap);
-  const at = swaps.findIndex((s) => byNewest(swap, s) <= 0);
+  const at2 = swaps.findIndex((s) => byNewest(swap, s) <= 0);
   const merged = [...swaps];
-  merged.splice(at === -1 ? merged.length : at, 0, swap);
+  merged.splice(at2 === -1 ? merged.length : at2, 0, swap);
   return merged;
 };
 var updateAssetSwap = async (repository, id, changes) => {
@@ -346,7 +346,7 @@ function withExitClosure(program, exit) {
     }
   };
 }
-function swapProgramBinding(offer, serverPubkey) {
+function swapProgramBinding(offer, operatorPubkey) {
   if (offer.makerPkScript.length !== FIELDS.makerPkScript.width) {
     throw new Error("makerPkScript is not a 34-byte taproot scriptPubKey");
   }
@@ -358,7 +358,7 @@ function swapProgramBinding(offer, serverPubkey) {
     args: {
       makerWP: offer.makerPkScript.subarray(2),
       wantAmount: offer.wantAmount,
-      server: serverPubkey,
+      server: operatorPubkey,
       user: offer.makerPublicKey,
       // internal byte order
       ...offer.wantAsset && {
@@ -368,14 +368,14 @@ function swapProgramBinding(offer, serverPubkey) {
       ...offer.exitDelay && { exitDelay: offer.exitDelay.value }
     },
     keys: {
-      serverKey: serverPubkey,
+      serverKey: operatorPubkey,
       userKey: offer.makerPublicKey,
       emulatorKey: offer.emulatorPubkey
     }
   };
 }
-function offerVtxoScript(offer, serverPubkey) {
-  const { program, args, keys } = swapProgramBinding(offer, serverPubkey);
+function offerContract(offer, operatorPubkey) {
+  const { program, args, keys } = swapProgramBinding(offer, operatorPubkey);
   return new arkade.ArkadeProgramScript(program, args, keys);
 }
 var OFFER_PACKET_TYPE = 3;
@@ -489,14 +489,14 @@ function decodeOffer(data) {
       throw new Error(`missing/invalid ${name}`);
     }
   }
-  const need = (name) => {
+  const need2 = (name) => {
     const v = fields[name];
     const len = FIELDS[name].width;
     if (!v || len !== void 0 && v.length !== len)
       throw new Error(`missing/invalid ${name}`);
     return v;
   };
-  const amount = need("wantAmount");
+  const amount = need2("wantAmount");
   if (Boolean(fields.wantAsset) === Boolean(fields.offerAsset)) {
     throw new Error("offer must carry exactly one of wantAsset or offerAsset");
   }
@@ -513,13 +513,13 @@ function decodeOffer(data) {
     throw new Error("offer must carry both ratioNum and ratioDen, or neither");
   }
   return {
-    swapPkScript: need("swapPkScript"),
+    swapPkScript: need2("swapPkScript"),
     wantAmount: readU64(amount),
     ...fields.wantAsset && { wantAsset: asset.AssetId.fromBytes(fields.wantAsset) },
     ...fields.offerAsset && { offerAsset: asset.AssetId.fromBytes(fields.offerAsset) },
-    makerPkScript: need("makerPkScript"),
-    makerPublicKey: need("makerPublicKey"),
-    emulatorPubkey: need("emulatorPubkey"),
+    makerPkScript: need2("makerPkScript"),
+    makerPublicKey: need2("makerPublicKey"),
+    emulatorPubkey: need2("emulatorPubkey"),
     ...ratioNum !== void 0 && { ratioNum },
     ...ratioDen !== void 0 && { ratioDen },
     ...fields.exitTimelock && { exitDelay: decodeExitDelay(fields.exitTimelock) }
@@ -532,17 +532,21 @@ function decodeExitDelay(value) {
 }
 var OFFER_CONTRACT_LABEL = "Arkade swap offer";
 var OFFER_CONTRACT_KIND = "asset-swap-offer";
-async function registerOfferContract(wallet, arkServerUrl, network, binding, serverPubkey, expectedPkScript) {
-  const { program, args, keys } = swapProgramBinding(binding, serverPubkey);
+async function registerOfferContract(wallet, info, binding, operatorPubkey, expectedPkScript) {
+  const { program, args, keys } = swapProgramBinding(binding, operatorPubkey);
   const contractManager = await wallet.getContractManager();
   const client = await arkade.Arkade.connect({
-    arkade: new RestArkProvider(arkServerUrl),
-    indexer: new RestIndexerProvider(arkServerUrl),
+    // Registration derives and persists; it never broadcasts and never
+    // reads UTXOs, so the only thing the client needs off the server is the
+    // info the caller already resolved. Handing that back — rather than a
+    // provider built from a URL — is what lets `createOffer` take just a
+    // wallet, and spares a second `/v1/info` round-trip.
+    arkade: { getInfo: async () => info },
     identity: wallet.identity,
     // without this the row's `address` would be derived against the SDK's
     // default network while its script is right — a row that disagrees with
     // the address the user is about to fund
-    network: getNetwork(network),
+    network: networkFromArkadeInfo(info),
     contractManager
   });
   const contract = new arkade.ArkadeContract(client, program, args, keys);
@@ -563,17 +567,21 @@ function serverExitDelay(delay) {
   }
   return assertExitDelay({ value: delay, type: delay < BigInt(512) ? "blocks" : "seconds" });
 }
-async function createOffer(wallet, arkServerUrl, params) {
+async function createOffer(wallet, params) {
   if (Boolean(params.wantAsset) === Boolean(params.offerAsset)) {
     throw new Error("set exactly one of wantAsset (BTC->asset) or offerAsset (asset->BTC)");
   }
   const [info, makerAddress, makerPublicKey] = await Promise.all([
-    new RestArkProvider(arkServerUrl).getInfo(),
+    // requireLive: this info binds signerPubkey into the covenant — a
+    // snapshot could derive an address the operator no longer co-signs
+    // for, so an unreachable operator fails the call instead (fail closed,
+    // the same behaviour the pre-#734 caller-held provider had)
+    wallet.getArkadeInfo({ requireLive: true }),
     wallet.getAddress(),
     wallet.identity.xOnlyPublicKey()
   ]);
-  const serverPubKey = hex2.decode(toXOnlySignerHex(info.signerPubkey));
-  const network = getNetwork(info.network);
+  const operatorPubKey = hex2.decode(toXOnlySignerHex(info.signerPubkey));
+  const network = networkFromArkadeInfo(info);
   const emuKey = hex2.decode(
     toXOnlySignerHex(resolveEmulatorPubkey(network, params.emulatorPubkey))
   );
@@ -589,33 +597,77 @@ async function createOffer(wallet, arkServerUrl, params) {
     // an offer that then fails to encode. @see assertExitDelay
     exitDelay: params.noExit ? void 0 : params.exitDelay ? assertExitDelay(params.exitDelay) : serverExitDelay(info.unilateralExitDelay)
   };
-  const script = offerVtxoScript(binding, serverPubKey);
+  const script = offerContract(binding, operatorPubKey);
   const offer = { ...binding, swapPkScript: script.pkScript };
-  await registerOfferContract(
-    wallet,
-    arkServerUrl,
-    info.network,
-    binding,
-    serverPubKey,
-    script.pkScript
-  );
+  await registerOfferContract(wallet, info, binding, operatorPubKey, script.pkScript);
   const payload = encodeOffer(offer);
   return {
     offerHex: hex2.encode(payload),
     extension: { type: OFFER_PACKET_TYPE, payload },
-    // VtxoScript.address owns address construction; assembling an ArkAddress
+    // the contract's .address() builds the address; assembling an ArkAddress
     // from tweakedPublicKey here would silently miss any future step it gains
-    address: script.address(network.hrp, serverPubKey).encode(),
+    address: script.address(network.hrp, operatorPubKey).encode(),
     swapPkScript: script.pkScript
   };
 }
-async function cancelOffer(wallet, arkServerUrl, offerHex, opts) {
+async function cancelOffer(wallet, offerHex, opts) {
   const { repository, fundingTxid, swapAddress } = opts;
+  const prepared = await prepareOfferCancel(wallet, offerHex, {
+    ...fundingTxid === void 0 ? {} : { fundingTxid },
+    ...swapAddress === void 0 ? {} : { swapAddress }
+  });
+  const swapId = fundingTxid ?? prepared.vtxo.txid;
+  const hasLocalRecord = (await getAssetSwapsOrThrow(repository)).some((s) => s.id === swapId);
+  if (hasLocalRecord) await updateAssetSwap(repository, swapId, { status: "cancelling" });
+  const txid = await prepared.send();
+  if (hasLocalRecord) {
+    const { persisted, swaps } = await updateAssetSwapBestEffort(repository, swapId, {
+      status: "cancelled",
+      spentTxid: txid
+    });
+    if (persisted) {
+      const contractManager = await wallet.getContractManager();
+      await retireOfferContract(
+        contractManager,
+        swaps,
+        hex2.encode(prepared.offer.swapPkScript)
+      );
+    }
+  }
+  return txid;
+}
+var OFFER_COVENANT_MISMATCH = "rebuilt covenant does not match the offer's swapPkScript";
+var NoSpendableDepositError = class extends Error {
+  name = "NoSpendableDepositError";
+  constructor(options) {
+    super("no spendable VTXO at the swap address", options);
+  }
+};
+var OfferCovenantMismatchError = class extends Error {
+  constructor(swapPkScript, options) {
+    super(
+      `${OFFER_COVENANT_MISMATCH} \u2014 the operator signing key pinned by the rebuild does not reproduce the funded covenant; the signing key has likely rotated since funding (pass swapAddress, the funded address, to pin the original key), or the record is corrupt`,
+      options
+    );
+    this.swapPkScript = swapPkScript;
+  }
+  swapPkScript;
+  name = "OfferCovenantMismatchError";
+};
+async function prepareOfferCancel(wallet, offerHex, opts) {
+  const { fundingTxid, swapAddress } = opts;
   const offer = decodeOffer(hex2.decode(offerHex));
-  const contractManager = await wallet.getContractManager();
+  const [contractManager, info, reader, broadcaster] = await Promise.all([
+    wallet.getContractManager(),
+    wallet.getArkadeInfo({ requireLive: true }),
+    wallet.getArkadeReader(),
+    wallet.getArkadeBroadcaster()
+  ]);
   const client = await arkade.Arkade.connect({
-    arkade: new RestArkProvider(arkServerUrl),
-    indexer: new RestIndexerProvider(arkServerUrl),
+    // info the wallet already holds, plus its broadcast pair — the shape
+    // `ArkadeServerProvider` describes, without a second `/v1/info`
+    arkade: { getInfo: async () => info, ...broadcaster },
+    indexer: reader,
     identity: wallet.identity,
     // registered offers resolve their VTXOs from the contract repository
     // instead of a direct indexer query; the indexer above stays as the
@@ -629,9 +681,7 @@ async function cancelOffer(wallet, arkServerUrl, offerHex, opts) {
   const { program, args, keys } = swapProgramBinding(offer, operatorPubkey);
   const rebuilt = new arkade.ArkadeProgramScript(program, args, keys);
   if (hex2.encode(rebuilt.pkScript) !== hex2.encode(offer.swapPkScript)) {
-    throw new Error(
-      "rebuilt covenant does not match the offer's swapPkScript \u2014 the server signing key has likely rotated since funding; pass swapAddress (the funded address) to pin the original key"
-    );
+    throw new OfferCovenantMismatchError(hex2.encode(offer.swapPkScript));
   }
   const contract = new arkade.ArkadeContract(client, program, args, keys);
   const [vtxos, makerAddress] = await Promise.all([contract.getUtxos(), wallet.getAddress()]);
@@ -641,7 +691,7 @@ async function cancelOffer(wallet, arkServerUrl, offerHex, opts) {
     );
   }
   const vtxo = fundingTxid ? vtxos.find((v) => v.txid === fundingTxid) : vtxos[0];
-  if (!vtxo) throw new Error("no spendable VTXO at the swap address");
+  if (!vtxo) throw new NoSpendableDepositError();
   const makerPkScript = ArkAddress.decode(makerAddress).pkScript;
   const cancel = contract.functions.cancel().from({ txid: vtxo.txid, vout: vtxo.vout, value: vtxo.value }).to(makerPkScript, BigInt(vtxo.value));
   for (const a of vtxo.assets ?? []) {
@@ -651,20 +701,11 @@ async function cancelOffer(wallet, arkServerUrl, offerHex, opts) {
       outputs: [{ vout: 0, amount: BigInt(a.amount) }]
     });
   }
-  const swapId = fundingTxid ?? vtxo.txid;
-  const hasLocalRecord = (await getAssetSwapsOrThrow(repository)).some((s) => s.id === swapId);
-  if (hasLocalRecord) await updateAssetSwap(repository, swapId, { status: "cancelling" });
-  const { txid } = await cancel.send();
-  if (hasLocalRecord) {
-    const { persisted, swaps } = await updateAssetSwapBestEffort(repository, swapId, {
-      status: "cancelled",
-      spentTxid: txid
-    });
-    if (persisted) {
-      await retireOfferContract(contractManager, swaps, hex2.encode(offer.swapPkScript));
-    }
-  }
-  return txid;
+  return {
+    offer,
+    vtxo: { txid: vtxo.txid, vout: vtxo.vout, value: vtxo.value },
+    send: async () => (await cancel.send()).txid
+  };
 }
 
 // src/markets.ts
@@ -803,9 +844,10 @@ import {
   promisifyRequest
 } from "@arkade-os/sdk";
 var DEFAULT_DB_NAME = "arkade-intents";
-var DB_VERSION = 2;
+var DB_VERSION = 3;
 var STORE_SWAPS = "swaps";
 var STORE_RFQ_SWAPS = "rfqSwaps";
+var STORE_SWAP_RECORDS = "swapRecords";
 var STORE_SCANNED = "scannedTxids";
 var STORE_MARKETS = "markets";
 var STORES = [
@@ -813,6 +855,11 @@ var STORES = [
   // v2. Separate from `swaps` rather than sharing it: the two record types
   // have different keys and no consumer wants them interleaved.
   [STORE_RFQ_SWAPS, { keyPath: "rfqId" }],
+  // v3. The v2 client's accept records, keyed by quote id. Its own store for
+  // the same reason, plus one more: the v1 read path drops a row carrying
+  // neither `offerHex` nor `paymentHash`, so sharing `swaps` would pin the
+  // v2 shape to a v1 predicate.
+  [STORE_SWAP_RECORDS, { keyPath: "id" }],
   [STORE_SCANNED],
   [STORE_MARKETS]
 ];
@@ -824,7 +871,7 @@ function initDatabase(db, oldVersion, transaction) {
   }
 }
 var IndexedDbAssetSwapRepository = class {
-  version = 4;
+  version = 5;
   connection;
   constructor(dbName = DEFAULT_DB_NAME) {
     this.connection = createManagedConnection(dbName, DB_VERSION, initDatabase);
@@ -868,6 +915,22 @@ var IndexedDbAssetSwapRepository = class {
       store.delete(rfqId);
     });
   }
+  async saveSwapRecord(record) {
+    await this.write(STORE_SWAP_RECORDS, (store) => {
+      store.put(record);
+    });
+  }
+  async getSwapRecord(id) {
+    return promisifyRequest((await this.readStore(STORE_SWAP_RECORDS)).get(id));
+  }
+  async getAllSwapRecords() {
+    return promisifyRequest((await this.readStore(STORE_SWAP_RECORDS)).getAll());
+  }
+  async removeSwapRecord(id) {
+    await this.write(STORE_SWAP_RECORDS, (store) => {
+      store.delete(id);
+    });
+  }
   async getScannedTxids() {
     const keys = await promisifyRequest((await this.readStore(STORE_SCANNED)).getAllKeys());
     return new Set(keys);
@@ -974,6 +1037,14 @@ var parseSigner = (value) => {
   }
   return { signingDescriptor };
 };
+var parsePayoutAddress = (value, kind) => {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(
+      `this ${kind} record's claim destination is unusable: expected an Arkade address, got ${JSON.stringify(value)}`
+    );
+  }
+  return value;
+};
 var parseHashlock = (value) => {
   const raw = value ?? {};
   const hashlock = {
@@ -1019,6 +1090,11 @@ var rfqClaimSecretOf = (record) => {
     );
   }
 };
+var rfqClaimDestinationOf = (record) => {
+  const handler = rfqCorridorHandlers.getOrThrow(record.kind);
+  if (!handler.claimDestination) return void 0;
+  return parsePayoutAddress(handler.claimDestination(record.profile), record.kind);
+};
 
 // src/rfqCorridors.ts
 var LightningSendCorridor = {
@@ -1038,7 +1114,7 @@ var LightningReceiveCorridor = {
     const receive = swap;
     return {
       expectedAmount: receive.expectedAmount,
-      ...receive.claimArkTxid ? { claimArkTxid: receive.claimArkTxid } : {}
+      ...receive.claimTxid ? { claimTxid: receive.claimTxid } : {}
     };
   },
   hydrate(profile) {
@@ -1048,13 +1124,16 @@ var LightningReceiveCorridor = {
     return {
       ...hydrateHashlock(profile),
       expectedAmount: profile.expectedAmount,
-      ...profile.claimArkTxid ? { claimArkTxid: profile.claimArkTxid } : {}
+      ...profile.claimTxid ? { claimTxid: profile.claimTxid } : {}
     };
   },
   // We are the claimant here, so the preimage material on the hashlock is
   // ours to use.
   claimSecret: (profile) => ({ ...profile.signer, ...profile.hashlock }),
-  activityTxids: (profile) => profile.claimArkTxid ? [profile.claimArkTxid] : []
+  // The other half of claiming: where it pays. Written once at request time
+  // and left alone by `project` above, so this hands back what was stored.
+  claimDestination: (profile) => profile.payoutAddress,
+  activityTxids: (profile) => profile.claimTxid ? [profile.claimTxid] : []
 };
 function onchainSendProfile(result) {
   return {
@@ -1142,14 +1221,34 @@ var isRfqSwapTerminal = (state) => RFQ_SWAP_TERMINAL_STATES.includes(state);
 
 // src/rfqRecord.ts
 var RFQ_SWAP_RETENTION_SECONDS = 30 * 24 * 60 * 60;
+function renameLegacyClaimTxid(profile) {
+  const { claimArkTxid, ...rest } = profile;
+  return { ...rest, claimTxid: rest.claimTxid ?? claimArkTxid };
+}
+function normalizeRfqSwapRecord(record) {
+  const { fundingArkTxid, refundArkTxid, lockupSpendArkTxids, ...rest } = record;
+  const legacyClaim = record.kind === "lightning_receive" && record.profile.claimArkTxid !== void 0;
+  if (!fundingArkTxid && !refundArkTxid && !lockupSpendArkTxids && !legacyClaim) return record;
+  const fundingTxid = rest.fundingTxid ?? fundingArkTxid;
+  const refundTxid = rest.refundTxid ?? refundArkTxid;
+  const lockupSpendTxids = rest.lockupSpendTxids ?? lockupSpendArkTxids;
+  return {
+    ...rest,
+    ...fundingTxid ? { fundingTxid } : {},
+    ...refundTxid ? { refundTxid } : {},
+    ...lockupSpendTxids?.length ? { lockupSpendTxids } : {},
+    ...legacyClaim ? { profile: renameLegacyClaimTxid(record.profile) } : {}
+  };
+}
 var managerState = (swap) => ({
   rfqId: swap.rfqId,
   state: swap.state,
   createdAt: swap.createdAt,
   updatedAt: swap.updatedAt,
-  ...swap.refundArkTxid ? { refundArkTxid: swap.refundArkTxid } : {},
-  ...swap.lockupSpendArkTxids?.length ? { lockupSpendArkTxids: [...swap.lockupSpendArkTxids] } : {},
+  ...swap.refundTxid ? { refundTxid: swap.refundTxid } : {},
+  ...swap.lockupSpendTxids?.length ? { lockupSpendTxids: [...swap.lockupSpendTxids] } : {},
   ...swap.failure ? { failure: swap.failure } : {},
+  ...swap.claimFailure ? { claimFailure: swap.claimFailure } : {},
   ...swap.blockedReason ? { blockedReason: swap.blockedReason } : {}
 });
 function assertSameSwap(origin, swap) {
@@ -1179,27 +1278,30 @@ function createRfqSwapRecord(origin, swap) {
 }
 function updateRfqSwapRecord(record, swap) {
   assertSameSwap(record, swap);
+  const stored = normalizeRfqSwapRecord(record);
   const {
-    refundArkTxid: _refundArkTxid,
-    lockupSpendArkTxids: _lockupSpendArkTxids,
+    refundTxid: _refundTxid,
+    lockupSpendTxids: _lockupSpendTxids,
     failure: _failure,
+    claimFailure: _claimFailure,
     blockedReason: _blockedReason,
     ...origin
-  } = record;
-  const handler = rfqCorridorHandlers.getOrThrow(record.kind);
+  } = stored;
+  const handler = rfqCorridorHandlers.getOrThrow(stored.kind);
   return {
     ...origin,
     ...managerState(swap),
-    profile: { ...record.profile, ...handler.project(swap) }
+    profile: { ...stored.profile, ...handler.project(swap) }
   };
 }
 function rfqSwapOriginOf(record) {
+  const stored = normalizeRfqSwapRecord(record);
   return {
-    kind: record.kind,
-    lockupAddress: record.lockupAddress,
-    profile: { ...record.profile },
-    ...record.amount !== void 0 ? { amount: record.amount } : {},
-    ...record.fundingArkTxid ? { fundingArkTxid: record.fundingArkTxid } : {}
+    kind: stored.kind,
+    lockupAddress: stored.lockupAddress,
+    profile: { ...stored.profile },
+    ...stored.amount !== void 0 ? { amount: stored.amount } : {},
+    ...stored.fundingTxid ? { fundingTxid: stored.fundingTxid } : {}
   };
 }
 function lockupScript(params, lockupAddress) {
@@ -1213,27 +1315,29 @@ function lockupScript(params, lockupAddress) {
   return script;
 }
 function rebuildRfqSwap(record, params) {
-  const script = lockupScript(params, record.lockupAddress);
+  const stored = normalizeRfqSwapRecord(record);
+  const script = lockupScript(params, stored.lockupAddress);
   const common = {
-    rfqId: record.rfqId,
-    state: record.state,
+    rfqId: stored.rfqId,
+    state: stored.state,
     lockupPkScript: script.pkScript,
-    lockup: { script, address: record.lockupAddress },
+    lockup: { script, address: stored.lockupAddress },
     // From the covenant, which binds it: the record's own copy would be a
     // second source for the deadline the refund is gated on.
     refundLocktime: Number(script.options.refundLocktime),
-    createdAt: record.createdAt,
-    updatedAt: record.updatedAt,
-    ...record.refundArkTxid ? { refundArkTxid: record.refundArkTxid } : {},
-    ...record.lockupSpendArkTxids?.length ? { lockupSpendArkTxids: [...record.lockupSpendArkTxids] } : {},
-    ...record.failure ? { failure: record.failure } : {},
-    ...record.blockedReason ? { blockedReason: record.blockedReason } : {}
+    createdAt: stored.createdAt,
+    updatedAt: stored.updatedAt,
+    ...stored.refundTxid ? { refundTxid: stored.refundTxid } : {},
+    ...stored.lockupSpendTxids?.length ? { lockupSpendTxids: [...stored.lockupSpendTxids] } : {},
+    ...stored.failure ? { failure: stored.failure } : {},
+    ...stored.claimFailure ? { claimFailure: stored.claimFailure } : {},
+    ...stored.blockedReason ? { blockedReason: stored.blockedReason } : {}
   };
-  const handler = rfqCorridorHandlers.getOrThrow(record.kind);
+  const handler = rfqCorridorHandlers.getOrThrow(stored.kind);
   return {
     ...common,
-    kind: record.kind,
-    ...handler.hydrate(record.profile, { lockup: script })
+    kind: stored.kind,
+    ...handler.hydrate(stored.profile, { lockup: script })
   };
 }
 function shouldRetainRfqSwap(record, now) {
@@ -1274,10 +1378,10 @@ async function fetchParsedTxs(indexer, txids) {
 var unscannedSwapCandidates = (txs, existingIds, scanned) => txs.filter(
   (tx) => tx.type === "sent" && tx.redeemTxid && !existingIds.has(tx.redeemTxid) && !scanned.has(tx.redeemTxid)
 );
-function classifySpend(offer, serverPubkey, spendTx, deposit) {
+function classifySpend(offer, operatorPubkey, spendTx, deposit) {
   let leaves;
   try {
-    const script = offerVtxoScript(offer, serverPubkey);
+    const script = offerContract(offer, operatorPubkey);
     if (hex5.encode(script.pkScript) !== hex5.encode(offer.swapPkScript)) return "indeterminate";
     leaves = {
       // both routes that hand the deposit back; `exit` is absent on an
@@ -1301,15 +1405,15 @@ function classifySpend(offer, serverPubkey, spendTx, deposit) {
   return "indeterminate";
 }
 var spendTxidsOf = (vtxo) => [vtxo.spentBy, vtxo.arkTxId].filter((id) => Boolean(id));
-function classifyDepositSpend(offer, serverPubkey, spendTxs, deposit) {
+function classifyDepositSpend(offer, operatorPubkey, spendTxs, deposit) {
   for (const tx of spendTxs) {
-    const kind = classifySpend(offer, serverPubkey, tx, deposit);
+    const kind = classifySpend(offer, operatorPubkey, tx, deposit);
     if (kind !== "indeterminate") return kind;
   }
   return "indeterminate";
 }
 async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
-  const { serverPubkey, scanned = /* @__PURE__ */ new Set() } = opts;
+  const { operatorPubkey, scanned = /* @__PURE__ */ new Set() } = opts;
   const candidates = unscannedSwapCandidates(txs, existingIds, scanned);
   if (candidates.length === 0) return { restored: [], scannedTxids: [] };
   const byTxid = new Map(candidates.map((tx) => [tx.redeemTxid, tx]));
@@ -1378,7 +1482,7 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
     if (state === "swept") status = "recoverable";
     else if (state === "spent") {
       const spendTxs = spendTxidsOf(vtxo).map((id) => spendTxByTxid.get(id)).filter((tx) => tx !== void 0);
-      const kind = classifyDepositSpend(offer, serverPubkey, spendTxs, {
+      const kind = classifyDepositSpend(offer, operatorPubkey, spendTxs, {
         txid: vtxo.txid,
         vout: vtxo.vout
       });
@@ -1395,7 +1499,7 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
       fromAmount,
       toAmount: offer.wantAmount.toString(),
       // ponytail(arkade-os/ts-sdk#680): empty address makes cancel fall back
-      // to the current server key; store the funded address if server-key
+      // to the current operator key; store the funded address if operator-key
       // rotations become real (cancelOffer now at least diagnoses the
       // mismatch instead of reporting a missing VTXO)
       swapAddress: "",
@@ -1417,10 +1521,13 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
 import { base64 as base642, hex as hex6 } from "@scure/base";
 import {
   ArkAddress as ArkAddress3,
-  RestIndexerProvider as RestIndexerProvider3,
   Transaction as Transaction2
 } from "@arkade-os/sdk";
 var TERMINAL = ["fulfilled", "cancelled", "recoverable"];
+var assetSwapSource = (repository) => ({
+  list: () => getAssetSwaps(repository),
+  apply: async (swap, changes) => updateAssetSwapBestEffort(repository, swap.id, changes)
+});
 function spendUpdate(swap, spend) {
   if (TERMINAL.includes(swap.status)) return void 0;
   if (spend.kind === "indeterminate") return void 0;
@@ -1434,13 +1541,20 @@ function spendUpdate(swap, spend) {
 }
 async function watchOfferSwaps({
   wallet,
-  arkServerUrl,
   repository,
+  source,
   onUpdate
 }) {
-  const manager = await wallet.getContractManager();
-  const serverPubkey = ArkAddress3.decode(await wallet.getAddress()).serverPubKey;
-  const indexer = new RestIndexerProvider3(arkServerUrl);
+  if (!source && !repository) {
+    throw new Error("watchOfferSwaps needs either a record source or a repository");
+  }
+  const records = source ?? assetSwapSource(repository);
+  const [manager, address, indexer] = await Promise.all([
+    wallet.getContractManager(),
+    wallet.getAddress(),
+    wallet.getArkadeReader()
+  ]);
+  const operatorPubkey = ArkAddress3.decode(address).serverPubKey;
   let queue = Promise.resolve();
   const enqueue = (task) => {
     queue = queue.then(task).catch(() => {
@@ -1454,7 +1568,7 @@ async function watchOfferSwaps({
       const { txs } = await indexer.getVirtualTxs(candidates);
       return classifyDepositSpend(
         decodeOffer(hex6.decode(swap.offerHex)),
-        serverPubkey,
+        operatorPubkey,
         txs.map((psbt) => Transaction2.fromPSBT(base642.decode(psbt))),
         { txid: vtxo.txid, vout: vtxo.vout }
       );
@@ -1467,20 +1581,16 @@ async function watchOfferSwaps({
     for (const vtxo of event.vtxos) {
       const spentTxid = vtxo.arkTxId || vtxo.spentBy;
       if (!spentTxid) continue;
-      const swap = (await getAssetSwaps(repository)).find(
+      const swap = (await records.list()).find(
         (s) => s.fundingTxid === vtxo.txid && s.swapPkScript === event.contractScript
       );
       if (!swap) continue;
       const kind = await classify(swap, vtxo, spentTxid);
       const changes = spendUpdate(swap, { txid: spentTxid, kind, at: event.timestamp });
       if (!changes) continue;
-      const { persisted, swaps } = await updateAssetSwapBestEffort(
-        repository,
-        swap.id,
-        changes
-      );
+      const { persisted, swaps } = await records.apply(swap, changes);
       if (!persisted) continue;
-      onUpdate?.({ ...swap, ...changes });
+      onUpdate?.(swaps.find((s) => s.id === swap.id) ?? swap);
       if (changes.status && RETIRABLE.includes(changes.status)) {
         await retireOfferContract(manager, swaps, event.contractScript);
       }
@@ -1616,7 +1726,7 @@ function solverOnchainRail(deps) {
       }
       const negotiated = await deps.connect(
         rendezvous,
-        (transport) => requestOnchainSend(ctx.wallet, deps.arkServerUrl, transport, {
+        (transport) => requestOnchainSend(ctx.wallet, transport, {
           amount,
           amountSide: "to",
           payoutPubkey: deps.payoutPubkey,
@@ -1729,7 +1839,7 @@ function solverLightningRail(deps) {
       }
       const negotiated = await deps.connect(
         rendezvous,
-        (transport) => requestLightningSend(ctx.wallet, deps.arkServerUrl, transport, {
+        (transport) => requestLightningSend(ctx.wallet, transport, {
           invoice: facts,
           ...deps.emulatorPubkey ? { emulatorPubkey: deps.emulatorPubkey } : {}
         })
@@ -1782,6 +1892,440 @@ function solverLightningRail(deps) {
   };
 }
 
+// src/payment/lightning.ts
+import { invoiceTarget as invoiceTarget2 } from "@arkade-os/sdk";
+
+// src/payment/swapRail.ts
+import { makeHandle as makeHandle3 } from "@arkade-os/sdk";
+
+// src/client/errors.ts
+var AmbiguousDestination = class extends Error {
+  constructor(destination, detail) {
+    super(`cannot route ${JSON.stringify(destination)}: ${detail}`);
+    this.destination = destination;
+  }
+  destination;
+  name = "AmbiguousDestination";
+};
+var UnsupportedRoute = class extends Error {
+  name = "UnsupportedRoute";
+  give;
+  take;
+  constructor(detail, corridors = {}) {
+    super(`unsupported route: ${detail}`);
+    this.give = corridors.give;
+    this.take = corridors.take;
+  }
+};
+var DiscoverySnapshotUnavailable = class extends Error {
+  constructor(network, detail) {
+    super(`cannot resolve on ${network} offline: ${detail}`);
+    this.network = network;
+  }
+  network;
+  name = "DiscoverySnapshotUnavailable";
+};
+var AmountMismatch = class extends Error {
+  constructor(sources) {
+    super(`exactly one amount may be pinned; got ${sources[0]} and ${sources[1]}`);
+    this.sources = sources;
+  }
+  sources;
+  name = "AmountMismatch";
+};
+var AmountEncodingUnsupported = class extends Error {
+  constructor(field, value, detail, options) {
+    super(`${field}: ${detail}`, options);
+    this.field = field;
+    this.value = value;
+  }
+  field;
+  value;
+  name = "AmountEncodingUnsupported";
+};
+var QuoteVerificationFailed = class extends Error {
+  constructor(check, expected, actual, options) {
+    super(`quote failed the ${check} check \u2014 refusing to fund`, options);
+    this.check = check;
+    this.expected = expected;
+    this.actual = actual;
+  }
+  check;
+  name = "QuoteVerificationFailed";
+  expected;
+  actual;
+};
+var QuoteExpired = class extends Error {
+  constructor(quoteId, expiresAt, now) {
+    super(`quote ${quoteId} expired at ${expiresAt}, ${now - expiresAt} ago`);
+    this.quoteId = quoteId;
+    this.expiresAt = expiresAt;
+    this.now = now;
+  }
+  quoteId;
+  expiresAt;
+  now;
+  name = "QuoteExpired";
+};
+var MaxFeeExceeded = class extends Error {
+  constructor(quoteId, asset3, fee, maxFee) {
+    super(`fee ${fee} of ${asset3} exceeds the ${maxFee} ceiling`);
+    this.quoteId = quoteId;
+    this.asset = asset3;
+    this.fee = fee;
+    this.maxFee = maxFee;
+  }
+  quoteId;
+  asset;
+  fee;
+  maxFee;
+  name = "MaxFeeExceeded";
+};
+var InsufficientFunds = class extends Error {
+  constructor(asset3, required, available) {
+    super(
+      `funding needs ${required} of ${asset3}` + (available === void 0 ? "" : `, wallet holds ${available}`)
+    );
+    this.asset = asset3;
+    this.required = required;
+    this.available = available;
+  }
+  asset;
+  required;
+  name = "InsufficientFunds";
+  available;
+};
+var AcceptConflict = class extends Error {
+  constructor(quoteId, swapId, fields) {
+    super(`accept ${quoteId} conflicts with swap ${swapId} on ${fields.join(", ")}`);
+    this.quoteId = quoteId;
+    this.swapId = swapId;
+    this.fields = fields;
+  }
+  quoteId;
+  swapId;
+  fields;
+  name = "AcceptConflict";
+};
+var ClientDisposed = class extends Error {
+  constructor(method) {
+    super(`${method}() called after the client was disposed`);
+    this.method = method;
+  }
+  method;
+  name = "ClientDisposed";
+};
+var NotCancellable = class extends Error {
+  constructor(swapId) {
+    super(`swap ${swapId} is not a cancellable asset swap`);
+    this.swapId = swapId;
+  }
+  swapId;
+  name = "NotCancellable";
+};
+var InconsistentRoute = class extends Error {
+  constructor(asset3, destination) {
+    super(`destination ${JSON.stringify(destination)} is not on ${asset3}'s chain`);
+    this.asset = asset3;
+    this.destination = destination;
+  }
+  asset;
+  destination;
+  name = "InconsistentRoute";
+};
+var OperatorUnreachable = class extends Error {
+  name = "OperatorUnreachable";
+  constructor(detail, options) {
+    super(`cannot derive a covenant: ${detail}`, options);
+  }
+};
+var MissingCorridorDep = class extends Error {
+  constructor(corridor, dep) {
+    super(`the ${corridor} corridor has no ${dep}`);
+    this.corridor = corridor;
+    this.dep = dep;
+  }
+  corridor;
+  dep;
+  name = "MissingCorridorDep";
+};
+var SWAP_ERRORS = {
+  AmbiguousDestination,
+  UnsupportedRoute,
+  DiscoverySnapshotUnavailable,
+  AmountMismatch,
+  AmountEncodingUnsupported,
+  QuoteVerificationFailed,
+  SwapRefusal,
+  QuoteExpired,
+  MaxFeeExceeded,
+  InsufficientFunds,
+  AcceptConflict,
+  ClientDisposed,
+  NotCancellable,
+  InconsistentRoute,
+  OperatorUnreachable,
+  MissingCorridorDep
+};
+var SWAP_ERROR_NAMES = Object.keys(SWAP_ERRORS);
+function isSwapError(e, name) {
+  if (!(e instanceof Error)) return false;
+  const table = SWAP_ERRORS;
+  const ctor = table[e.name];
+  if (ctor === void 0 || !(e instanceof ctor)) return false;
+  return name === void 0 || e.name === name;
+}
+
+// src/client/sats.ts
+var satsOf = (value, field) => {
+  if (value < 0n || value > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new AmountEncodingUnsupported(
+      field,
+      `${value}`,
+      "outside the non-negative safe-integer window core's payment amounts are numbers in"
+    );
+  }
+  return Number(value);
+};
+
+// src/payment/status.ts
+var PAYMENT_STATUS = {
+  /** Persisted, funding not broadcast. */
+  accepted: "pending",
+  funding: "pending",
+  /** The lockup is funded. Nothing has emitted `"sent"` in core since the
+   *  `onchain-swap` rail left with `packages/boltz-swap`. */
+  funded: "sent",
+  /** Asset swaps only: an unfilled offer. */
+  open: "pending",
+  /** Asset swaps only. */
+  filled: "settled",
+  /** The trader's L1 claim on `arkade -> onchain`. */
+  claimed: "settled",
+  /** Terminal success on `arkade -> lightning`: the solver's hash-verified
+   *  spend IS the invoice being paid. */
+  paid: "settled",
+  cancelling: "pending",
+  /** Value returned, and the router has no non-loss terminal to say so with. */
+  cancelled: "failed",
+  /** Terminal HERE, not at `refunded` — see the module docblock. */
+  refunding: "failed",
+  /** The trader's value came back. Reaches `onUpdate`, not the handle. */
+  refunded: "failed",
+  /** The solver reclaimed a receive-leg lockup: a loss, and not `refunded`. */
+  lapsed: "failed",
+  /** Never retried silently; `client.recover` drives it. */
+  needs_recovery: "failed",
+  failed: "failed"
+};
+var paymentStatusOf = (outcome) => PAYMENT_STATUS[outcome];
+var isTerminalStatus = (status) => status === "settled" || status === "failed";
+
+// src/payment/swapRail.ts
+var SwapPaymentFailedError = class extends Error {
+  constructor(railId, outcome, swap) {
+    super(
+      `${railId}: swap ${swap.id} ended ${outcome}` + (swap.failure === void 0 ? "" : `: ${swap.failure}`) + (swap.blockedReason === void 0 ? "" : ` (${swap.blockedReason})`)
+    );
+    this.railId = railId;
+    this.outcome = outcome;
+    this.swap = swap;
+  }
+  railId;
+  outcome;
+  swap;
+  name = "SwapPaymentFailedError";
+};
+var unroutable = (error) => isSwapError(error, "UnsupportedRoute") || isSwapError(error, "AmbiguousDestination");
+var railAvailable = async (client, input) => {
+  try {
+    return (await client.resolve(input)).eligible > 0;
+  } catch (error) {
+    if (unroutable(error)) return false;
+    throw error;
+  }
+};
+var receiverExact = (railId, parts) => {
+  if (parts.total !== parts.amount + parts.fee) {
+    throw new Error(
+      `${railId}: ${parts.total} leaving the wallet is not ${parts.amount} delivered plus ${parts.fee} in fees \u2014 the quote is not receiver-exact`
+    );
+  }
+  return {
+    amount: satsOf(parts.amount, `${railId}.amount`),
+    fee: satsOf(parts.fee, `${railId}.fee`),
+    total: satsOf(parts.total, `${railId}.total`)
+  };
+};
+var resultOf = (railId, swap) => ({
+  railId,
+  // The tagged public form M6 minted — round-trippable to `client.swaps()`,
+  // which is where the outcomes past this handle's terminal one are read.
+  swapId: swap.id,
+  // The transaction that left THIS wallet, which is what `txid` means on
+  // every other rail. A swap's later legs — the solver's fill, the trader's
+  // L1 claim — are the client's to report, not the handle's.
+  ...swap.fundingTxid === void 0 ? {} : { txid: swap.fundingTxid }
+});
+var swapHandle = async (railId, client, quote) => makeHandle3(railId, async (emit) => {
+  const accepted = await client.accept(quote);
+  return await new Promise((resolve, reject) => {
+    let finished = false;
+    let unsubscribe;
+    const listener = (update) => {
+      if (finished || update.swap.id !== accepted.id) return;
+      const status = paymentStatusOf(update.outcome);
+      const result = resultOf(railId, update.swap);
+      if (!isTerminalStatus(status)) {
+        emit({ status, result });
+        return;
+      }
+      finished = true;
+      unsubscribe?.();
+      if (status === "settled") {
+        emit({ status, result });
+        resolve(result);
+        return;
+      }
+      reject(new SwapPaymentFailedError(railId, update.outcome, update.swap));
+    };
+    unsubscribe = client.onUpdate(listener);
+    if (finished) unsubscribe();
+  });
+});
+
+// src/payment/lightning.ts
+var LIGHTNING_RAIL = "lightning";
+var inputFor = (invoice, amount) => ({
+  to: invoice,
+  ...amount === void 0 ? {} : { amount: BigInt(amount), amountOn: "take" }
+});
+function lightningRail(client) {
+  return {
+    id: LIGHTNING_RAIL,
+    // Amount-blind and non-throwing: classification only, which is what
+    // keeps `match` from being a second gate on top of `available`.
+    match: (req) => invoiceTarget2(req.raw) !== void 0,
+    available: async (req) => {
+      const invoice = invoiceTarget2(req.raw);
+      if (invoice === void 0) return false;
+      return railAvailable(client, inputFor(invoice, req.amount));
+    },
+    quote: async (req) => {
+      const invoice = invoiceTarget2(req.raw);
+      if (invoice === void 0) {
+        throw new Error(`${LIGHTNING_RAIL}: the request carries no BOLT11 invoice`);
+      }
+      const quote = await client.quote(inputFor(invoice, req.amount));
+      const amounts = receiverExact(LIGHTNING_RAIL, {
+        amount: quote.take.amount,
+        fee: quote.fee.amount,
+        total: quote.give.amount
+      });
+      return {
+        railId: LIGHTNING_RAIL,
+        ...amounts,
+        meta: {
+          quoteId: quote.id,
+          // A `RouteQuote` carries no expiry of its own, so a held one
+          // can outlive the terms behind it. This is where a caller
+          // can see that; `send()` refuses with `QuoteExpired` rather
+          // than silently re-quoting.
+          expiresAt: quote.expiresAt,
+          ...quote.refundLocktime === void 0 ? {} : { refundLocktime: quote.refundLocktime },
+          ...quote.solver === void 0 ? {} : { solver: quote.solver },
+          ...quote.lock === void 0 ? {} : { paymentHash: quote.lock.hash },
+          market: quote.market.key
+        },
+        send: () => swapHandle(LIGHTNING_RAIL, client, quote)
+      };
+    }
+  };
+}
+
+// src/payment/onchainSwap.ts
+import { btcTarget as btcTarget2, resolveSendAmount as resolveSendAmount2, tryResolveSendAmount as tryResolveSendAmount2 } from "@arkade-os/sdk";
+var ONCHAIN_SWAP_RAIL = "onchain-swap";
+var claimFeeSats = (deps) => BigInt(Math.ceil((deps.claimVsize ?? ONCHAIN_CLAIM_VSIZE) * deps.claimFeeRateSatVb));
+function onchainSwapRail(client, deps) {
+  if (!Number.isFinite(deps.claimFeeRateSatVb) || deps.claimFeeRateSatVb <= 0) {
+    throw new Error(
+      `${ONCHAIN_SWAP_RAIL}: claimFeeRateSatVb must be positive, got ${deps.claimFeeRateSatVb}`
+    );
+  }
+  const claimFee = claimFeeSats(deps);
+  const inputFor2 = (address, amount) => ({
+    to: address,
+    amount: BigInt(amount) + claimFee,
+    amountOn: "take"
+  });
+  return {
+    id: ONCHAIN_SWAP_RAIL,
+    match: (req) => btcTarget2(req.raw) !== void 0,
+    available: async (req) => {
+      const address = btcTarget2(req.raw);
+      if (address === void 0) return false;
+      const amount = tryResolveSendAmount2(req.raw, req.amount);
+      if (amount === void 0) return false;
+      return railAvailable(client, inputFor2(address, amount));
+    },
+    quote: async (req) => {
+      const address = btcTarget2(req.raw);
+      if (address === void 0) {
+        throw new Error(`${ONCHAIN_SWAP_RAIL}: the request carries no bitcoin address`);
+      }
+      const amount = resolveSendAmount2(ONCHAIN_SWAP_RAIL, req.raw, req.amount);
+      const quote = await client.quote(inputFor2(address, amount));
+      const amounts = receiverExact(ONCHAIN_SWAP_RAIL, {
+        // What lands at the address, which is the HTLC the solver locks
+        // minus the claim this wallet will broadcast to take it.
+        amount: quote.take.amount - claimFee,
+        // Both halves of the cost, inside one number: the solver's
+        // spread, and the claim the trader pays for out of the payout.
+        fee: quote.fee.amount + claimFee,
+        total: quote.give.amount
+      });
+      return {
+        railId: ONCHAIN_SWAP_RAIL,
+        ...amounts,
+        meta: {
+          quoteId: quote.id,
+          expiresAt: quote.expiresAt,
+          ...quote.refundLocktime === void 0 ? {} : { refundLocktime: quote.refundLocktime },
+          ...quote.solver === void 0 ? {} : { solver: quote.solver },
+          ...quote.lock === void 0 ? {} : { paymentHash: quote.lock.hash },
+          market: quote.market.key,
+          /** The estimate folded into `fee`, so a caller can see it. */
+          claimFeeSats: Number(claimFee),
+          /** What the solver locks on L1, before the claim's fee. */
+          htlcAmountSats: Number(quote.take.amount)
+        },
+        send: () => swapHandle(ONCHAIN_SWAP_RAIL, client, quote)
+      };
+    }
+  };
+}
+
+// src/payment/router.ts
+import { PaymentRouter as Router, arkRail, onchainRail } from "@arkade-os/sdk";
+var SWAP_ROUTER_PRIORITY = [
+  "ark",
+  LIGHTNING_RAIL,
+  ONCHAIN_SWAP_RAIL,
+  "onchain"
+];
+function createSwapPaymentRouter(wallet, client, config) {
+  return new Router({
+    wallet,
+    prefs: { priority: [...SWAP_ROUTER_PRIORITY], ...config.prefs }
+  }).use(arkRail()).use(onchainRail()).use(lightningRail(client)).use(
+    onchainSwapRail(client, {
+      claimFeeRateSatVb: config.claimFeeRateSatVb,
+      ...config.claimVsize === void 0 ? {} : { claimVsize: config.claimVsize }
+    })
+  );
+}
+
 // src/claim.ts
 import { hex as hex10 } from "@scure/base";
 import { ripemd160 } from "@noble/hashes/legacy.js";
@@ -1824,6 +2368,15 @@ async function awaitRfqResolution(transport, rfqId, options = {}) {
     await sleep(pollMs);
   }
 }
+var walletOperator = (wallet) => {
+  let broadcaster;
+  const broadcasting = () => broadcaster ??= wallet.getArkadeBroadcaster();
+  return {
+    getInfo: () => wallet.getArkadeInfo({ requireLive: true }),
+    submitTx: async (...args) => (await broadcasting()).submitTx(...args),
+    finalizeTx: async (...args) => (await broadcasting()).finalizeTx(...args)
+  };
+};
 var LockupNeedsRecoveryError = class extends Error {
   name = "LockupNeedsRecoveryError";
   reason = "needs_recovery";
@@ -1835,11 +2388,10 @@ var LockupNeedsRecoveryError = class extends Error {
    * into one settlement with no CLTV awareness, so an early attempt can fail
    * the whole batch — including unrelated outputs that were otherwise fine.
    *
-   * Exposed as a value, not only inside the message, so a caller can encode
-   * `packages/boltz-swap`'s "pre-CLTV recoverable → skipped" rule without
-   * parsing prose. Seconds-based locktimes mature against the chain tip's
-   * timestamp rather than wall clock, so treat this as a floor to wait past,
-   * not an exact alarm.
+   * Exposed as a value, not only inside the message, so a caller can skip
+   * pre-CLTV recoverable outputs without parsing prose. Seconds-based
+   * locktimes mature against the chain tip's timestamp rather than wall
+   * clock, so treat this as a floor to wait past, not an exact alarm.
    */
   recoverableAfter;
   constructor(outpoints, recoverableAfter) {
@@ -1900,7 +2452,7 @@ async function readLockupFate(indexer, input) {
     if (vtxo.spentBy)
       spentBy.set(vtxo.spentBy, {
         checkpointTxid: vtxo.spentBy,
-        arkTxid: vtxo.arkTxId
+        txid: vtxo.arkTxId
       });
     else everySpendNamed = false;
   }
@@ -1929,32 +2481,32 @@ async function readLockupFate(indexer, input) {
   }
   return everySpendNamed && observed.size === spentBy.size ? { fate: "returned", spends } : { fate: "unknown" };
 }
-async function pushRefundWithoutReceiver(ark, input) {
+async function pushRefundWithoutReceiver(operator, input) {
   if (input.vtxos.length === 0) throw new Error("nothing to refund: no funded outputs");
   const swept = input.vtxos.filter((vtxo) => vtxo.recoverable);
   if (swept.length > 0) {
     throw new LockupNeedsRecoveryError(
       swept.map((vtxo) => `${vtxo.txid}:${vtxo.vout}`),
-      input.script.options.refundLocktime
+      input.contract.options.refundLocktime
     );
   }
-  const refundPkScript = input.refundPkScript ?? input.script.options.nonInteractiveParameters?.senderPkScript;
+  const refundPkScript = input.refundPkScript ?? input.contract.options.nonInteractiveParameters?.senderPkScript;
   if (!refundPkScript) {
     throw new Error(
       "no refund destination: the contract carries no emulator covenant suite, so pass refundPkScript explicitly"
     );
   }
-  const info = await ark.getInfo();
-  let serverUnrollScript;
+  const info = await operator.getInfo();
+  let operatorUnrollScript;
   try {
-    serverUnrollScript = CSVMultisigTapscript.decode(hex9.decode(info.checkpointTapscript));
+    operatorUnrollScript = CSVMultisigTapscript.decode(hex9.decode(info.checkpointTapscript));
   } catch {
-    throw new Error("invalid checkpointTapscript from the Arkade server");
+    throw new Error("invalid checkpointTapscript from the operator");
   }
-  const leaf = input.script.refundWithoutReceiver();
-  const tapTree = input.script.encode();
+  const leaf = input.contract.refundWithoutReceiver();
+  const tapTree = input.contract.encode();
   const amount = input.vtxos.reduce((sum, vtxo) => sum + vtxo.value, 0);
-  const { arkTx, checkpoints } = buildOffchainTx(
+  const { arkTx: tx, checkpoints } = buildOffchainTx(
     input.vtxos.map((vtxo) => ({
       txid: vtxo.txid,
       vout: vtxo.vout,
@@ -1963,14 +2515,14 @@ async function pushRefundWithoutReceiver(ark, input) {
       tapTree
     })),
     [{ script: refundPkScript, amount: BigInt(amount) }],
-    serverUnrollScript
+    operatorUnrollScript
   );
-  const signedArkTx = await input.sender.sign(arkTx);
-  const submitted = await ark.submitTx(
-    base643.encode(signedArkTx.toPSBT()),
+  const signedTx = await input.sender.sign(tx);
+  const submitted = await operator.submitTx(
+    base643.encode(signedTx.toPSBT()),
     checkpoints.map((c) => base643.encode(c.toPSBT()))
   );
-  assertSubmittedArkTxid(submitted, signedArkTx, "refundWithoutReceiver");
+  assertSubmittedArkTxid(submitted, signedTx, "refundWithoutReceiver");
   const matched = matchServerCheckpoints(
     submitted.signedCheckpointTxs,
     checkpoints,
@@ -1981,11 +2533,11 @@ async function pushRefundWithoutReceiver(ark, input) {
       async ({ server }) => base643.encode((await input.sender.sign(server, [0])).toPSBT())
     )
   );
-  await ark.finalizeTx(submitted.arkTxid, finalCheckpoints);
-  return { arkTxid: submitted.arkTxid, amount };
+  await operator.finalizeTx(submitted.arkTxid, finalCheckpoints);
+  return { txid: submitted.arkTxid, amount };
 }
 var REFUND_MTP_LAG_SECONDS = 2 * 60 * 60;
-async function refundIfUnresolved(transport, ark, indexer, input) {
+async function refundIfUnresolved(transport, operator, indexer, input) {
   const pollMs = input.pollMs ?? 5e3;
   const now = input.now ?? (() => Math.floor(Date.now() / 1e3));
   const attemptDeadline = input.attemptDeadline ?? input.refundLocktime + REFUND_MTP_LAG_SECONDS;
@@ -1996,7 +2548,7 @@ async function refundIfUnresolved(transport, ark, indexer, input) {
       let fate = { fate: "unknown" };
       try {
         fate = await readLockupFate(indexer, {
-          swapPkScript: input.script.pkScript,
+          swapPkScript: input.contract.pkScript,
           paymentHash: input.paymentHash
         });
       } catch {
@@ -2008,11 +2560,11 @@ async function refundIfUnresolved(transport, ark, indexer, input) {
           status
         };
       }
-      const vtxos = await findLockupVtxos(indexer, input.script.pkScript);
+      const vtxos = await findLockupVtxos(indexer, input.contract.pkScript);
       if (vtxos.length === 0) return { outcome: "nothing_to_refund", status };
       try {
-        const pushed = await pushRefundWithoutReceiver(ark, {
-          script: input.script,
+        const pushed = await pushRefundWithoutReceiver(operator, {
+          contract: input.contract,
           sender: input.sender,
           vtxos,
           refundPkScript: input.refundPkScript
@@ -2055,13 +2607,13 @@ var assertFiniteAmount = (value, reason, label) => {
   error.reason = reason;
   throw error;
 };
-async function pushClaim(ark, input) {
+async function pushClaim(operator, input) {
   if (input.vtxos.length === 0) throw new Error("nothing to claim: no funded outputs");
   const swept = input.vtxos.filter((vtxo) => vtxo.recoverable);
   if (swept.length > 0) {
     throw new LockupNeedsRecoveryError(
       swept.map((vtxo) => `${vtxo.txid}:${vtxo.vout}`),
-      input.script.options.refundLocktime
+      input.contract.options.refundLocktime
     );
   }
   const locked = input.vtxos.reduce((sum, vtxo) => sum + vtxo.value, 0);
@@ -2072,22 +2624,22 @@ async function pushClaim(ark, input) {
       throw new LockupAmountMismatchError(input.expectedAmount, locked);
     }
   }
-  const committed = input.script.options.preimageHash;
+  const committed = input.contract.options.preimageHash;
   if (hex10.encode(ripemd160(sha2563(input.preimage))) !== hex10.encode(committed)) {
     throw new Error("preimage does not match the covenant's payment hash");
   }
-  const info = await ark.getInfo();
-  let serverUnrollScript;
+  const info = await operator.getInfo();
+  let operatorUnrollScript;
   try {
-    serverUnrollScript = CSVMultisigTapscript2.decode(hex10.decode(info.checkpointTapscript));
+    operatorUnrollScript = CSVMultisigTapscript2.decode(hex10.decode(info.checkpointTapscript));
   } catch {
-    throw new Error("invalid checkpointTapscript from the Arkade server");
+    throw new Error("invalid checkpointTapscript from the operator");
   }
-  const leaf = input.script.claim();
-  const tapTree = input.script.encode();
-  const arkTxid = await signAndSubmitOffchainTx({
+  const leaf = input.contract.claim();
+  const tapTree = input.contract.encode();
+  const txid = await signAndSubmitOffchainTx({
     identity: claimWithPreimageIdentity(input.receiver, input.preimage),
-    provider: ark,
+    provider: operator,
     inputs: input.vtxos.map((vtxo) => ({
       txid: vtxo.txid,
       vout: vtxo.vout,
@@ -2098,10 +2650,10 @@ async function pushClaim(ark, input) {
     // One aggregate output: unlike the covenant refund, this leaf inspects
     // nothing about the output set.
     outputs: [{ script: input.destinationPkScript, amount: BigInt(locked) }],
-    serverUnrollScript,
-    verifyServerSignatures: { serverPubkey: input.script.options.server }
+    serverUnrollScript: operatorUnrollScript,
+    verifyServerSignatures: { serverPubkey: input.contract.options.server }
   });
-  return { arkTxid, amount: locked };
+  return { txid, amount: locked };
 }
 async function awaitLockupFunding(indexer, swapPkScript, options = {}) {
   const pollMs = options.pollMs ?? 5e3;
@@ -2116,13 +2668,13 @@ async function awaitLockupFunding(indexer, swapPkScript, options = {}) {
     await sleep2(pollMs);
   }
 }
-async function claimReceiveLockup(indexer, ark, input) {
+async function claimReceiveLockup(indexer, operator, input) {
   const vtxos = await awaitLockupFunding(indexer, input.swapPkScript, {
     pollMs: input.pollMs,
     deadline: input.deadline
   });
-  return pushClaim(ark, {
-    script: input.script,
+  return pushClaim(operator, {
+    contract: input.contract,
     receiver: input.receiver,
     preimage: input.preimage,
     vtxos,
@@ -2177,8 +2729,8 @@ async function senderIdentityForSwapRecord(wallet, record) {
 // src/arkadeRefunder.ts
 function arkadeRefunder(deps) {
   return async (swap) => {
-    const script = swap.lockup?.script;
-    if (!script) {
+    const contract = swap.lockup?.script;
+    if (!contract) {
       throw new Error(
         `swap ${swap.rfqId} carries no lockup covenant, so its refund cannot be built`
       );
@@ -2193,7 +2745,7 @@ function arkadeRefunder(deps) {
       );
     }
     const sender = await senderIdentityForSwapRecord(deps.wallet, rfqSignerOf(record) ?? {});
-    return pushRefundWithoutReceiver(deps.ark, { script, sender, vtxos });
+    return pushRefundWithoutReceiver(deps.operator, { contract, sender, vtxos });
   };
 }
 
@@ -2214,6 +2766,14 @@ function nextOnchainAction(input) {
       return input.htlcLocktime - input.now >= ONCHAIN_CLAIM_MARGIN_SECONDS ? "claim" : "claim_window_closed";
   }
 }
+var RFQ_CONFIGURATION_REFUSAL = {
+  noClaimLockupCallback: "no claimLockup callback is wired, so this wallet cannot claim the lockup",
+  noCallbacksForClaim: "no callbacks are wired, so this wallet cannot claim the lockup",
+  noClaimOnchainCallback: "no claimOnchain callback is wired, so this wallet cannot claim the L1 fill",
+  autoActionsDisabled: "automatic actions are disabled, so this wallet will not push the refund",
+  noCallbacksForRefund: "no callbacks are wired, so this wallet cannot push the refund"
+};
+var RFQ_CONFIGURATION_REFUSALS = Object.values(RFQ_CONFIGURATION_REFUSAL);
 var RfqSwapOriginRequired = class extends Error {
   /** The swap that could not be admitted. */
   rfqId;
@@ -2264,20 +2824,6 @@ var RfqSwapManager = class {
    * sign may well have been restored.
    */
   refundRefused = /* @__PURE__ */ new Set();
-  /**
-   * The last error a receive swap's claim callback threw, by rfqId.
-   *
-   * Kept only to tell two terminal outcomes apart once the claim window
-   * shuts: a swap whose claim was attempted and kept failing ends `failed`
-   * with that reason, while one that simply never became claimable ends
-   * `refunded`. Without it a broken claim callback would resolve a caller's
-   * {@link waitForSwapCompletion} as an ordinary unwind.
-   *
-   * Process-local, like {@link refundRefused}: after a restart the same swap
-   * ends `refunded` instead, which costs the caller a reason and nothing else
-   * — every throw was already reported through `onSwapFailed` as it happened.
-   */
-  lastClaimError = /* @__PURE__ */ new Map();
   /**
    * The lockup outpoints a receive swap's claim callback has already been
    * handed, by rfqId.
@@ -2589,6 +3135,19 @@ var RfqSwapManager = class {
   async getPendingSwaps() {
     return [...this.monitored.values()];
   }
+  /**
+   * Every swap this manager holds — {@link getPendingSwaps} plus the ones
+   * that already ended. The two sets are disjoint: a swap leaves `monitored`
+   * as it enters `finished`.
+   *
+   * The finished half is what this process has seen, which after
+   * {@link restoreFromRepository} is the stored history minus what retention
+   * pruned. A manager that has restored nothing answers with the live swaps
+   * alone.
+   */
+  async getAllSwaps() {
+    return [...this.monitored.values(), ...this.finished.values()];
+  }
   async hasSwap(rfqId) {
     return this.monitored.has(rfqId);
   }
@@ -2658,7 +3217,6 @@ var RfqSwapManager = class {
     if (swap) this.byLockupScript.delete(hex11.encode(swap.lockupPkScript));
     this.monitored.delete(rfqId);
     this.refundRefused.delete(rfqId);
-    this.lastClaimError.delete(rfqId);
     this.claimedOutpoints.delete(rfqId);
   }
   /**
@@ -2867,14 +3425,14 @@ var RfqSwapManager = class {
       return this.claimIfFunded(swap, vtxos);
     }
     if (now < swap.refundLocktime + REFUND_MTP_LAG_SECONDS) {
-      if (swap.claimArkTxid) return;
+      if (swap.claimTxid) return;
       return this.block(
         swap,
         "the claim window closed with the lockup unclaimed \u2014 only the solver can act now"
       );
     }
-    const failure = this.lastClaimError.get(swap.rfqId);
-    if (failure && !swap.claimArkTxid) {
+    const failure = swap.claimFailure;
+    if (failure && !swap.claimTxid) {
       return this.fail(swap, new Error(failure));
     }
     this.setState(swap, "refunded");
@@ -2889,7 +3447,7 @@ var RfqSwapManager = class {
    */
   async claimIfFunded(swap, vtxos) {
     if (vtxos.length === 0) return this.unblock(swap);
-    const partiallyClaimed = swap.claimArkTxid !== void 0;
+    const partiallyClaimed = swap.claimTxid !== void 0;
     if (partiallyClaimed && !this.hasUnclaimedOutpoint(swap.rfqId, vtxos)) {
       return;
     }
@@ -2911,21 +3469,22 @@ var RfqSwapManager = class {
     if (!this.callbacks || !this.callbacks.claimLockup) {
       return this.block(
         swap,
-        this.callbacks ? "no claimLockup callback is wired, so this wallet cannot claim the lockup" : "no callbacks are wired, so this wallet cannot claim the lockup"
+        this.callbacks ? RFQ_CONFIGURATION_REFUSAL.noClaimLockupCallback : RFQ_CONFIGURATION_REFUSAL.noCallbacksForClaim
       );
     }
     this.setState(swap, "claimable");
     if (!this.config.enableAutoActions) return;
     try {
-      const { arkTxid } = await this.callbacks.claimLockup(swap, vtxos, { partiallyClaimed });
-      this.lastClaimError.delete(swap.rfqId);
+      const { txid } = await this.callbacks.claimLockup(swap, vtxos, { partiallyClaimed });
+      delete swap.claimFailure;
       this.rememberClaimed(swap.rfqId, vtxos);
-      swap.claimArkTxid = arkTxid;
+      swap.claimTxid = txid;
       this.touch(swap);
       this.setState(swap, "claimed");
       this.emitAction(swap, "claimLockup");
     } catch (error) {
-      this.lastClaimError.set(swap.rfqId, errorMessage(error));
+      swap.claimFailure = errorMessage(error);
+      this.touch(swap);
       this.emitFailed(swap, error);
     }
   }
@@ -2962,10 +3521,7 @@ var RfqSwapManager = class {
     if (action === "claim" && phase.phase === "claimable") {
       if (swap.claimTxid) return "continue";
       if (this.callbacks && !this.callbacks.claimOnchain) {
-        this.block(
-          swap,
-          "no claimOnchain callback is wired, so this wallet cannot claim the L1 fill"
-        );
+        this.block(swap, RFQ_CONFIGURATION_REFUSAL.noClaimOnchainCallback);
         return "handled";
       }
       this.setOnchainState(swap, "claimable");
@@ -3005,14 +3561,14 @@ var RfqSwapManager = class {
     if (!this.config.enableAutoActions || !this.callbacks) {
       return this.block(
         swap,
-        this.callbacks ? "automatic actions are disabled, so this wallet will not push the refund" : "no callbacks are wired, so this wallet cannot push the refund"
+        this.callbacks ? RFQ_CONFIGURATION_REFUSAL.autoActionsDisabled : RFQ_CONFIGURATION_REFUSAL.noCallbacksForRefund
       );
     }
     this.unblock(swap);
     try {
       const pushed = await this.callbacks.refundArkade(swap);
       if (pushed) {
-        swap.refundArkTxid = pushed.arkTxid;
+        swap.refundTxid = pushed.txid;
         this.touch(swap);
       }
       this.setState(swap, "refunded");
@@ -3085,7 +3641,7 @@ var RfqSwapManager = class {
   /**
    * Record which ark transactions ended the lockup.
    *
-   * Only the ones the indexer actually named: `LockupSpend.arkTxid` is
+   * Only the ones the indexer actually named: `LockupSpend.txid` is
    * optional, and a checkpoint txid is not what history correlates on — a
    * record carrying one would name a transaction the wallet's own activity
    * never shows. Fewer txids is the right failure here.
@@ -3095,9 +3651,9 @@ var RfqSwapManager = class {
    * verdict once.
    */
   stampLockupSpends(swap, spends) {
-    const arkTxids = spends.map((spend) => spend.arkTxid).filter((txid) => txid !== void 0);
-    if (arkTxids.length === 0) return;
-    swap.lockupSpendArkTxids = arkTxids;
+    const txids = spends.map((spend) => spend.txid).filter((txid) => txid !== void 0);
+    if (txids.length === 0) return;
+    swap.lockupSpendTxids = txids;
     this.touch(swap);
   }
   touch(swap) {
@@ -3108,6 +3664,7 @@ var RfqSwapManager = class {
     if (swap.state === state) return;
     const previous = swap.state;
     if (previous === "needs_counterparty") delete swap.blockedReason;
+    if (isRfqSwapTerminal(state)) delete swap.claimFailure;
     swap.state = state;
     this.touch(swap);
     notify(this.swapUpdateListeners, (listener) => listener(swap, previous));
@@ -3178,10 +3735,9 @@ var RfqSwapManager = class {
   /**
    * Drop a terminal swap from monitoring and report it exactly once.
    *
-   * `onSwapCompleted` and `onSwapFailed` are mutually exclusive here, unlike
-   * Boltz's manager, which fires completion for every swap that leaves
-   * monitoring including the failed ones — a listener named "completed" that
-   * also fires on failure is a trap worth not inheriting.
+   * `onSwapCompleted` and `onSwapFailed` are mutually exclusive here: a
+   * listener named "completed" that also fires on failure is a trap, so a
+   * swap that leaves monitoring reports through exactly one of them.
    */
   finalize(swap) {
     if (!this.monitored.has(swap.rfqId)) return;
@@ -3217,7 +3773,7 @@ var traderClaimTxid = (swap) => {
     case "onchain_send":
       return swap.claimTxid;
     case "lightning_receive":
-      return swap.claimArkTxid;
+      return swap.claimTxid;
     default:
       return void 0;
   }
@@ -3227,7 +3783,7 @@ var outcomeOf = (swap) => {
   const lostReceive = swap.kind === "lightning_receive" && swap.state === "refunded";
   return {
     state: swap.state,
-    txid: lostReceive ? swap.refundArkTxid : traderClaimTxid(swap) ?? swap.refundArkTxid
+    txid: lostReceive ? swap.refundTxid : traderClaimTxid(swap) ?? swap.refundTxid
   };
 };
 var errorMessage = (error) => error instanceof Error ? error.message : String(error);
@@ -3238,27 +3794,190 @@ import {
   ArkAddress as ArkAddress4
 } from "@arkade-os/sdk";
 import { hex as hex12 } from "@scure/base";
+
+// src/client/corridors/lightning.ts
+import { invoiceTarget as invoiceTarget3 } from "@arkade-os/sdk";
+var INVOICE_HRPS = [
+  ["lnbcrt", ["regtest"]],
+  ["lntbs", ["signet", "mutinynet"]],
+  ["lnbc", ["bitcoin"]],
+  ["lntb", ["testnet"]]
+];
+var networksOfInvoiceHrp = (raw) => {
+  const lower = raw.toLowerCase();
+  return INVOICE_HRPS.find(([hrp]) => lower.startsWith(hrp))?.[1];
+};
+var PAYMENT_HASH = /^[0-9a-f]{64}$/;
+var LIGHTNING_DRIVE = {
+  give: {
+    lockups: [{ covenant: "arkade_lockup", owner: "solver", deadline: "refund_locktime" }],
+    actions: ["claimLockup"],
+    seams: ["indexer"]
+  },
+  take: {
+    lockups: [{ covenant: "arkade_lockup", owner: "trader", deadline: "refund_locktime" }],
+    actions: ["refundArkade"],
+    seams: ["indexer"]
+  }
+};
+var lightningCorridor = Object.assign(
+  (deps) => ({
+    corridor: "lightning",
+    deps,
+    drive: LIGHTNING_DRIVE,
+    matches(raw) {
+      const invoice = invoiceTarget3(raw);
+      if (invoice === void 0) return void 0;
+      const networks = networksOfInvoiceHrp(invoice);
+      if (networks === void 0) {
+        return { refused: "this invoice's network prefix names no network this SDK knows" };
+      }
+      if (!networks.includes(deps.networkName)) {
+        return {
+          refused: `this is a ${networks.join(" or ")} invoice and the wallet is on ${deps.networkName}`
+        };
+      }
+      let facts;
+      try {
+        facts = deps.decode(invoice);
+        if (!PAYMENT_HASH.test(facts.paymentHash)) {
+          return { refused: "the decoded invoice carries no usable payment hash" };
+        }
+      } catch (error) {
+        return {
+          refused: `the invoice did not decode: ${error instanceof Error ? error.message : String(error)}`
+        };
+      }
+      if (!Number.isSafeInteger(facts.expiresAt)) {
+        return { refused: "the decoded invoice carries no usable expiry" };
+      }
+      const now = Math.floor(Date.now() / 1e3);
+      if (facts.expiresAt <= now) {
+        return { refused: `the invoice expired ${now - facts.expiresAt}s ago` };
+      }
+      if (!Number.isSafeInteger(facts.amountSats) || facts.amountSats < 0) {
+        return { refused: "the decoded invoice carries no usable amount" };
+      }
+      if (facts.amountSats === 0) {
+        return { refused: "the invoice names no amount, and a send route needs one" };
+      }
+      return {
+        claimed: {
+          kind: "invoice",
+          bolt11: invoice,
+          paymentHash: facts.paymentHash,
+          amount: BigInt(facts.amountSats),
+          expiresAt: facts.expiresAt
+        }
+      };
+    }
+  }),
+  { target: invoiceTarget3 }
+);
+
+// src/client/corridors/onchain.ts
+import { btcTarget as btcTarget3 } from "@arkade-os/sdk";
+import * as btc2 from "@scure/btc-signer";
+var ONCHAIN_DRIVE = {
+  take: {
+    lockups: [
+      { covenant: "arkade_lockup", owner: "trader", deadline: "refund_locktime" },
+      { covenant: "onchain_htlc", owner: "solver", deadline: "htlc_refund_locktime" }
+    ],
+    actions: ["claimOnchain", "refundArkade"],
+    seams: ["indexer", "chain"]
+  }
+};
+var onchainCorridor = Object.assign(
+  (deps) => {
+    const l1 = l1NetworkFromArk(deps.networkName);
+    return {
+      corridor: "onchain",
+      deps,
+      drive: ONCHAIN_DRIVE,
+      matches(raw) {
+        const target = btcTarget3(raw);
+        if (target === void 0) return void 0;
+        try {
+          btc2.Address(L1_NETWORKS[l1]).decode(target);
+        } catch {
+          return { refused: `this is not a ${l1} address` };
+        }
+        return { claimed: { kind: "address", address: target } };
+      }
+    };
+  },
+  { target: btcTarget3 }
+);
+
+// src/client/outcome.ts
+var CORRIDOR_PASS = {
+  lightning_send: LIGHTNING_DRIVE.take,
+  lightning_receive: LIGHTNING_DRIVE.give,
+  onchain_send: ONCHAIN_DRIVE.take
+};
+var LOCKUP_OWNER = {
+  lightning_send: CORRIDOR_PASS.lightning_send.lockups[0].owner,
+  lightning_receive: CORRIDOR_PASS.lightning_receive.lockups[0].owner,
+  onchain_send: CORRIDOR_PASS.onchain_send.lockups[0].owner
+};
+var at = (outcome) => () => outcome;
+var CORRIDOR_OUTCOME = {
+  trader: {
+    pending: at("funded"),
+    claimable: at("funded"),
+    claimed: at("funded"),
+    needs_counterparty: at("needs_recovery"),
+    settled: (kind) => kind === "onchain_send" ? "claimed" : "paid",
+    refunded: at("refunded"),
+    failed: at("failed")
+  },
+  solver: {
+    // The solver has funded nothing yet: the invoice is shown and unpaid,
+    // which is what makes this `open` where the trader's side is `funded`.
+    pending: at("open"),
+    claimable: at("funded"),
+    claimed: at("funded"),
+    needs_counterparty: at("needs_recovery"),
+    // The trader's OWN claim, matched by the hash and not by our txid — so
+    // a claim that lands without us still counts.
+    settled: at("claimed"),
+    // The one inversion this whole module exists for: every non-claim leaf
+    // of a receive covenant is the solver's, so a lockup spent by one is
+    // the trader's incoming payment never arriving.
+    refunded: at("lapsed"),
+    failed: at("failed")
+  }
+};
+var corridorOutcome = (kind, state) => CORRIDOR_OUTCOME[LOCKUP_OWNER[kind]][state](kind);
+var ACTIVITY_TOKEN = {
+  accepted: "pending",
+  funding: "pending",
+  funded: "pending",
+  open: "pending",
+  // The drive's in-flight states have no user-visible phase distinct from
+  // "pending"; `needs_recovery` is different in kind — the swap is BLOCKED —
+  // and collapsing it here is the same deliberate choice v1 made, which the
+  // opaque-token design permits because apps map tokens themselves.
+  needs_recovery: "pending",
+  refunding: "pending",
+  cancelling: "pending",
+  cancelled: "cancelled",
+  filled: "settled",
+  claimed: "settled",
+  paid: "settled",
+  refunded: "refunded",
+  lapsed: "lost",
+  failed: "failed"
+};
+
+// src/activity.ts
 var LABELS = {
   lightning_send: "Lightning send",
   lightning_receive: "Lightning receive",
   onchain_send: "Onchain send"
 };
-var OUTCOME = {
-  pending: "pending",
-  // `claimable` and `claimed` are both in-progress states with no
-  // user-visible phase distinct from "pending". `needs_counterparty` is
-  // different in kind — the swap is BLOCKED, not merely in flight, since no
-  // unilateral trader move exists (see `RfqSwapState`). Collapsing it into
-  // `pending` here is a deliberate choice the opaque-token design permits —
-  // apps map tokens themselves — but a future reader weighing a `"blocked"`
-  // or `"stuck"` token should know this was already considered.
-  claimable: "pending",
-  claimed: "pending",
-  needs_counterparty: "pending",
-  settled: "settled",
-  refunded: "refunded",
-  failed: "failed"
-};
+var outcomeToken = (kind, state) => ACTIVITY_TOKEN[corridorOutcome(kind, state)];
 function swapActivityResolver(deps) {
   let byTxid = /* @__PURE__ */ new Map();
   return {
@@ -3277,13 +3996,17 @@ function swapActivityResolver(deps) {
       const key = tx.key.arkTxid || tx.key.commitmentTxid || tx.key.boardingTxid;
       const swap = key ? byTxid.get(key) : void 0;
       if (!swap) return void 0;
-      const lostReceive = swap.kind === "lightning_receive" && swap.state === "refunded";
       return [
         {
           groupId: `swap:${swap.rfqId}`,
           label: LABELS[swap.kind],
           kind: "swap",
-          outcome: lostReceive ? "lost" : OUTCOME[swap.state],
+          // `"lost"` for a receive leg that ended `refunded` comes out
+          // of the translation rather than out of a branch here: that
+          // leg has no trader-side refund, every non-claim leaf of its
+          // covenant is the solver's, and the client's `lapsed` is
+          // that fact.
+          outcome: outcomeToken(swap.kind, swap.state),
           metadata: { rfqId: swap.rfqId, swapKind: swap.kind }
         }
       ];
@@ -3294,16 +4017,17 @@ async function rfqSwapActivityInputs(deps) {
   const records = await deps.repository.getAllRfqSwaps();
   return Promise.all(records.map((record) => activityInputOf(record, deps.indexer)));
 }
-async function activityInputOf(record, indexer) {
+async function activityInputOf(stored, indexer) {
+  const record = normalizeRfqSwapRecord(stored);
   const txids = /* @__PURE__ */ new Set();
-  if (record.fundingArkTxid) txids.add(record.fundingArkTxid);
-  if (record.refundArkTxid) txids.add(record.refundArkTxid);
+  if (record.fundingTxid) txids.add(record.fundingTxid);
+  if (record.refundTxid) txids.add(record.refundTxid);
   const handler = rfqCorridorHandlers.getOrThrow(record.kind);
   for (const txid of handler.activityTxids?.(record.profile) ?? []) txids.add(txid);
-  for (const txid of record.lockupSpendArkTxids ?? []) txids.add(txid);
-  const spendUnknown = isRfqSwapTerminal(record.state) && !record.refundArkTxid && !record.lockupSpendArkTxids?.length;
-  if (indexer && (!record.fundingArkTxid || spendUnknown)) {
-    for (const txid of await lockupTxids(indexer, record, !record.fundingArkTxid)) {
+  for (const txid of record.lockupSpendTxids ?? []) txids.add(txid);
+  const spendUnknown = isRfqSwapTerminal(record.state) && !record.refundTxid && !record.lockupSpendTxids?.length;
+  if (indexer && (!record.fundingTxid || spendUnknown)) {
+    for (const txid of await lockupTxids(indexer, record, !record.fundingTxid)) {
       txids.add(txid);
     }
   }
@@ -3328,6 +4052,346 @@ async function lockupTxids(indexer, record, wantFunding) {
     return [];
   }
 }
+
+// src/swapClient.ts
+import { hex as hex13 } from "@scure/base";
+import { ArkAddress as ArkAddress5, asset as asset2, contractSigner as contractSigner2 } from "@arkade-os/sdk";
+import { quoteOffer } from "@arkade-os/solver-discovery";
+import * as btc3 from "@scure/btc-signer";
+var sideCorridorsOf = (market) => {
+  const read = (value) => value === "lightning" || value === "onchain" ? value : "arkade";
+  const m = market;
+  return { base: read(m.base_corridor), quote: read(m.quote_corridor) };
+};
+var resolveKind = (market, give) => {
+  const corridors = sideCorridorsOf(market);
+  const giveCorridor = corridors[give];
+  const receiveCorridor = corridors[give === "base" ? "quote" : "base"];
+  if (giveCorridor === "arkade" && receiveCorridor === "arkade") return "spot";
+  if (receiveCorridor === "lightning") return "ln_send";
+  if (giveCorridor === "lightning") return "ln_receive";
+  if (receiveCorridor === "onchain") return "onchain_send";
+  return "onchain_receive";
+};
+var need = (value, what, leg) => {
+  if (value === void 0) throw new Error(`a ${leg} quote needs ${what}`);
+  return value;
+};
+var payoutScriptFor = (address, payoutPubkey, network) => address !== void 0 ? l1ScriptForAddress(address, network) : btc3.p2tr(payoutPubkey, void 0, L1_NETWORKS[network]).script;
+var corridorAmount = (input, leg) => {
+  const raw = need(input.amount, "an amount", leg);
+  const amountOn = need(input.amountOn, "amountOn ('give' or 'receive')", leg);
+  const amount = Number(raw);
+  if (!Number.isSafeInteger(amount) || amount <= 0) {
+    throw new Error(`a ${leg} amount must be a positive integer of sats, got ${String(raw)}`);
+  }
+  return { amount, amountSide: amountOn === "give" ? "from" : "to" };
+};
+function createSwapClient(deps) {
+  const { wallet, repository, transportFor } = deps;
+  const ark = deps.ark ?? walletOperator(wallet);
+  let reader;
+  const reading = () => reader ??= wallet.getArkadeReader();
+  const indexer = deps.indexer ?? {
+    getVtxos: async (opts) => {
+      if (!opts)
+        throw new Error("getVtxos on the swap indexer requires scripts or outpoints");
+      return (await reading()).getVtxos(opts);
+    },
+    getVirtualTxs: async (...args) => (await reading()).getVirtualTxs(...args)
+  };
+  const managerDeps = { indexer, chain: deps.chain, repository };
+  const manager = new RfqSwapManager(managerDeps);
+  const listeners = /* @__PURE__ */ new Set();
+  const notify2 = (swap) => {
+    for (const listener of listeners) {
+      try {
+        listener(swap);
+      } catch {
+      }
+    }
+  };
+  manager.onSwapUpdate((swap) => notify2({ family: "rfq", swap }));
+  const claimLockup = async (swap, vtxos, { partiallyClaimed }) => {
+    const record = await repository.getRfqSwap(swap.rfqId);
+    if (!record) throw new Error(`rfq swap ${swap.rfqId} has no stored record to claim from`);
+    const secret = rfqClaimSecretOf(record);
+    if (!secret) throw new Error(`rfq swap ${swap.rfqId} carries no claim secret`);
+    const script = swap.lockup?.script;
+    if (!script) throw new Error(`rfq swap ${swap.rfqId} carries no lockup covenant`);
+    const payoutAddress = rfqClaimDestinationOf(record);
+    if (!payoutAddress) {
+      throw new Error(`rfq swap ${swap.rfqId} carries no claim destination`);
+    }
+    return pushClaim(ark, {
+      contract: script,
+      receiver: await contractSigner2(wallet, secret.signingDescriptor),
+      preimage: await preimageForSwapRecord(wallet, secret),
+      vtxos,
+      destinationPkScript: ArkAddress5.decode(payoutAddress).pkScript,
+      expectedAmount: swap.expectedAmount,
+      partiallyClaimed
+    });
+  };
+  manager.setCallbacks({
+    refundArkade: arkadeRefunder({ operator: ark, indexer, wallet, repository }),
+    claimLockup,
+    ...deps.claimOnchain ? { claimOnchain: deps.claimOnchain } : {}
+  });
+  let watcher;
+  const quote = async (market, input) => {
+    const kind = resolveKind(market, input.give);
+    switch (kind) {
+      case "spot": {
+        const raw = need(input.amount, "an amount", kind);
+        const amountOn = need(input.amountOn, "amountOn ('give' or 'receive')", kind);
+        const plan = await quoteOffer(market, {
+          give: input.give,
+          ...amountOn === "give" ? { giveAmount: raw } : { wantAmount: raw },
+          fetchImpl: deps.discovery.fetchImpl
+        });
+        return { kind, market, plan };
+      }
+      case "ln_send": {
+        const invoice = need(input.invoice, "the invoice to pay", kind);
+        const request = await requestLightningSend(wallet, transportFor(market), {
+          invoice,
+          emulatorPubkey: deps.emulatorPubkey
+        });
+        return { kind, market, request };
+      }
+      case "ln_receive": {
+        const params = {
+          ...corridorAmount(input, kind),
+          covclaimdPubkey: need(deps.covclaimdPubkey, "deps.covclaimdPubkey", kind),
+          decodeInvoice: need(deps.decodeInvoice, "deps.decodeInvoice", kind),
+          maxPayAmount: input.maxPayAmount,
+          emulatorPubkey: deps.emulatorPubkey
+        };
+        const request = await requestLightningReceive(wallet, transportFor(market), params);
+        return { kind, market, request, invoice: request.invoice };
+      }
+      case "onchain_send": {
+        need(deps.chain, "deps.chain (L1 access)", kind);
+        const payoutPubkey = need(input.payoutPubkey, "a payoutPubkey", kind);
+        const params = {
+          ...corridorAmount(input, kind),
+          payoutPubkey,
+          preimage: input.preimage,
+          emulatorPubkey: deps.emulatorPubkey
+        };
+        const request = await requestOnchainSend(wallet, transportFor(market), params);
+        return {
+          kind,
+          market,
+          request,
+          payoutPkScript: payoutScriptFor(
+            input.payoutAddress,
+            payoutPubkey,
+            request.l1Network
+          )
+        };
+      }
+      case "onchain_receive":
+        throw new Error(
+          "onchain->arkade is not driven by RfqSwapManager yet; quote it directly with requestOnchainReceive"
+        );
+    }
+  };
+  const admit = async (swap, origin) => {
+    let announced = false;
+    const heard = manager.onSwapUpdate((updated) => {
+      if (updated.rfqId === swap.rfqId) announced = true;
+    });
+    try {
+      await manager.addSwap(swap, origin);
+    } finally {
+      heard();
+    }
+    const unified = { family: "rfq", swap };
+    if (!announced) notify2(unified);
+    return unified;
+  };
+  const fundPersisted = async (swap, origin, funding) => {
+    await repository.saveRfqSwap(createRfqSwapRecord(origin, swap));
+    return wallet.send({ address: funding.address, amount: funding.amount });
+  };
+  const accept = async (accepted) => {
+    const now = Math.floor(Date.now() / 1e3);
+    switch (accepted.kind) {
+      case "spot": {
+        const { plan } = accepted;
+        const depositIsBtc = plan.deposit.asset.id === BTC_ASSET_ID;
+        const offer = await createOffer(wallet, {
+          wantAmount: plan.receive.atomic,
+          ...plan.receive.asset.id === BTC_ASSET_ID ? { offerAsset: asset2.AssetId.fromString(plan.deposit.asset.id) } : { wantAsset: asset2.AssetId.fromString(plan.receive.asset.id) },
+          emulatorPubkey: deps.emulatorPubkey
+        });
+        const txid = await wallet.send({
+          address: offer.address,
+          // asset deposits ride the SDK's dust-sat carrier
+          amount: depositIsBtc ? Number(plan.deposit.atomic) : void 0,
+          assets: depositIsBtc ? void 0 : [{ assetId: plan.deposit.asset.id, amount: plan.deposit.atomic }],
+          extensions: [offer.extension]
+        });
+        const swap = {
+          id: txid,
+          fromAsset: plan.deposit.asset.id,
+          toAsset: plan.receive.asset.id,
+          fromAmount: plan.deposit.atomic.toString(),
+          toAmount: plan.receive.atomic.toString(),
+          swapAddress: offer.address,
+          swapPkScript: hex13.encode(offer.swapPkScript),
+          offerHex: offer.offerHex,
+          fundingTxid: txid,
+          status: "pending",
+          createdAt: Date.now()
+        };
+        await addAssetSwap(repository, swap);
+        const unified = { family: "offer", swap };
+        notify2(unified);
+        return unified;
+      }
+      case "ln_send": {
+        const { request } = accepted;
+        const swap = {
+          kind: "lightning_send",
+          rfqId: request.rfqId,
+          state: "pending",
+          lockupPkScript: request.swapPkScript,
+          lockup: { script: request.script, address: request.address },
+          // the trader's own decode, never the solver's echo
+          paymentHash: request.contractParams.paymentHash,
+          refundLocktime: request.contractParams.refundLocktime,
+          createdAt: now,
+          updatedAt: now
+        };
+        const origin = {
+          kind: "lightning_send",
+          lockupAddress: request.address,
+          profile: rfqSecretsProfile(request.secrets, swap.paymentHash),
+          amount: request.fundAmount
+        };
+        const txid = await fundPersisted(swap, origin, {
+          address: request.address,
+          amount: request.fundAmount
+        });
+        return admit(swap, { ...origin, fundingTxid: txid });
+      }
+      case "ln_receive": {
+        const { request } = accepted;
+        const paymentHash = hex13.encode(request.secrets.paymentHash);
+        const swap = {
+          kind: "lightning_receive",
+          rfqId: request.rfqId,
+          state: "pending",
+          lockupPkScript: request.swapPkScript,
+          lockup: { script: request.script, address: request.address },
+          paymentHash,
+          refundLocktime: request.contractParams.refundLocktime,
+          expectedAmount: request.expectedAmount,
+          createdAt: now,
+          updatedAt: now
+        };
+        return admit(swap, {
+          kind: "lightning_receive",
+          lockupAddress: request.address,
+          profile: {
+            ...rfqSecretsProfile(request.secrets, paymentHash),
+            expectedAmount: request.expectedAmount,
+            payoutAddress: request.payoutAddress
+          },
+          amount: request.expectedAmount
+        });
+      }
+      case "onchain_send": {
+        const { request } = accepted;
+        const paymentHash = hex13.encode(request.secrets.paymentHash);
+        const swap = {
+          kind: "onchain_send",
+          rfqId: request.rfqId,
+          state: "pending",
+          lockupPkScript: request.swapPkScript,
+          lockup: { script: request.script, address: request.address },
+          paymentHash,
+          refundLocktime: request.refundLocktime,
+          htlc: request.htlc,
+          minConfirmations: request.minConfirmations,
+          payoutPkScript: accepted.payoutPkScript,
+          createdAt: now,
+          updatedAt: now
+        };
+        const origin = {
+          kind: "onchain_send",
+          lockupAddress: request.address,
+          profile: {
+            ...rfqSecretsProfile(request.secrets, paymentHash),
+            ...onchainSendProfile({
+              ...request,
+              payoutPkScript: accepted.payoutPkScript
+            })
+          },
+          amount: request.fundAmount
+        };
+        const txid = await fundPersisted(swap, origin, {
+          address: request.address,
+          amount: request.fundAmount
+        });
+        return admit(swap, { ...origin, fundingTxid: txid });
+      }
+    }
+  };
+  return {
+    manager,
+    markets: (useCache) => discoverMarkets({ ...deps.discovery, repository, useCache }),
+    quote,
+    accept,
+    cancel: async (fundingTxid) => {
+      const swaps = await getAssetSwapsOrThrow(repository);
+      const swap = swaps.find((s) => s.id === fundingTxid);
+      if (!swap) throw new Error(`no offer swap with funding txid ${fundingTxid}`);
+      if (swap.status !== "pending") {
+        throw new Error(`offer swap ${fundingTxid} is ${swap.status}, not cancellable`);
+      }
+      await updateAssetSwap(repository, fundingTxid, { status: "cancelling" });
+      await cancelOffer(wallet, swap.offerHex, {
+        repository,
+        fundingTxid
+      });
+    },
+    // Both families, live AND terminal — the offer half reads the whole
+    // stored history, and the RFQ half is every swap the manager holds.
+    // Its history is what `start()` restored plus what this session
+    // accepted; records past `RFQ_SWAP_RETENTION_SECONDS` are pruned.
+    swaps: async () => {
+      const offers = await getAssetSwaps(repository);
+      const rfq = await manager.getAllSwaps();
+      return [
+        ...offers.map((swap) => ({ family: "offer", swap })),
+        ...rfq.map((swap) => ({ family: "rfq", swap }))
+      ];
+    },
+    onUpdate: (listener) => {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    start: async () => {
+      managerDeps.contracts ??= await wallet.getContractManager();
+      await manager.restoreFromRepository();
+      await manager.start();
+      watcher ??= await watchOfferSwaps({
+        wallet,
+        repository,
+        onUpdate: (swap) => notify2({ family: "offer", swap })
+      });
+    },
+    stop: async () => {
+      await manager.stop();
+      watcher?.stop();
+      watcher = void 0;
+    }
+  };
+}
 export {
   ARKADE_ASSET,
   ARKADE_BTC,
@@ -3336,6 +4400,7 @@ export {
   InMemoryAssetSwapRepository,
   IndexedDbAssetSwapRepository,
   LIGHTNING_BTC,
+  LIGHTNING_RAIL,
   LIGHTNING_RECEIVE_PAIR,
   LIGHTNING_SEND_PAIR,
   LOCKTIME_THRESHOLD,
@@ -3346,6 +4411,7 @@ export {
   MAX_MIN_CONFIRMATIONS,
   MIN_CLAIM_WINDOW_SECONDS,
   MIN_HEADROOM_SECONDS,
+  NoSpendableDepositError,
   OFFER_PACKET_TYPE,
   ONCHAIN_BTC,
   ONCHAIN_CLAIM_MARGIN_SECONDS,
@@ -3354,6 +4420,9 @@ export {
   ONCHAIN_RECEIVE_PAIR,
   ONCHAIN_SECONDS_PER_BLOCK,
   ONCHAIN_SEND_PAIR,
+  ONCHAIN_SWAP_RAIL,
+  OfferCovenantMismatchError,
+  PAYMENT_STATUS,
   PreimageNotRecoverableError,
   QUOTE_OPTIONS,
   REFUND_MTP_LAG_SECONDS,
@@ -3370,6 +4439,8 @@ export {
   SWAP_LOCKUP_CONTRACT_KIND,
   SWAP_LOCKUP_CONTRACT_LABEL,
   SWAP_LOCKUP_CONTRACT_TYPE,
+  SWAP_ROUTER_PRIORITY,
+  SwapPaymentFailedError,
   SwapRefusal,
   addAssetSwap,
   arkadeAssetLeg,
@@ -3384,6 +4455,7 @@ export {
   buildHtlcRefund,
   cancelOffer,
   chainSourceFrom,
+  claimFeeSats,
   claimOnchainFill,
   claimReceiveLockup,
   classifyDepositSpend,
@@ -3391,6 +4463,8 @@ export {
   classifySpend,
   createOffer,
   createRfqSwapRecord,
+  createSwapClient,
+  createSwapPaymentRouter,
   decodeOffer,
   deriveLightningReceive,
   deriveOnchainReceive,
@@ -3405,28 +4479,35 @@ export {
   httpTransport,
   isRfqSwapTerminal,
   isRfqTerminal,
+  isTerminalStatus,
   l1ScriptForAddress,
+  lightningRail,
+  lightningReceiveContract,
   lightningReceiveRequest,
+  lightningSendContract,
   lightningSendRequest,
-  lightningSendVtxoScript,
   lockupContractParams,
   makeCachedFeedFetch,
   newPreimage,
   newRfqId,
   nextOnchainAction,
+  normalizeRfqSwapRecord,
+  offerContract,
   offerTermsFromQuote,
-  offerVtxoScript,
   onchainHtlcScript,
   onchainReceiveRequest,
   onchainSendProfile,
   onchainSendRequest,
+  onchainSwapRail,
   paymentHashOf,
+  paymentStatusOf,
   preimageForSwapRecord,
   pushClaim,
   pushRefundWithoutReceiver,
+  railAvailable,
   readLockupFate,
   rebuildRfqSwap,
-  receiveVtxoScript,
+  receiverExact,
   refundIfUnresolved,
   registerLockupContract,
   relayTransport,
@@ -3453,6 +4534,7 @@ export {
   spendTxidsOf,
   spendUpdate,
   swapActivityResolver,
+  swapHandle,
   swapPrograms,
   swapSecretsToRecord,
   unilateralClaimDelay,