@arkade-os/swap 0.0.18 → 0.0.20

package/dist/index.js

@@ -1,7 +1,9 @@
 import {
   ARKADE_ASSET,
   ARKADE_BTC,
+  ASSET_CARRIER_SATS,
   AddressMismatch,
+  BTC_ASSET_ID,
   CLAIM_PACKET_TYPE,
   L1_NETWORKS,
   LIGHTNING_BTC,
@@ -13,6 +15,8 @@ import {
   MAX_MIN_CONFIRMATIONS,
   MIN_CLAIM_WINDOW_SECONDS,
   MIN_HEADROOM_SECONDS,
+  OFFER_CONTRACT_KIND,
+  OFFER_PACKET_TYPE,
   ONCHAIN_BTC,
   ONCHAIN_CLAIM_MARGIN_SECONDS,
   ONCHAIN_DUST_SATS,
@@ -20,6 +24,8 @@ import {
   ONCHAIN_RECEIVE_PAIR,
   ONCHAIN_SECONDS_PER_BLOCK,
   ONCHAIN_SEND_PAIR,
+  PreimageNotRecoverableError,
+  RETIRABLE,
   RFQ_REFUSAL_ERROR_CODES,
   RFQ_TERMINAL_STATES,
   SEALED_CIPHERTEXT_LENGTH,
@@ -28,21 +34,31 @@ import {
   SWAP_LOCKUP_CONTRACT_LABEL,
   SWAP_LOCKUP_CONTRACT_TYPE,
   SwapRefusal,
+  addAssetSwap,
   appendArkadeScript,
   arkadeAssetLeg,
   arkadeSwapRequest,
+  assertArkadeFundable,
   assertFundable,
   assertReceivable,
   awaitOnchainFill,
   buildHtlcClaim,
   buildHtlcRefund,
+  cancelOffer,
+  canonicalAssetAmount,
   claimOnchainFill,
   claimPacketShape,
   classifyOnchainHtlc,
+  createOffer,
+  decodeOffer,
   deriveLightningReceive,
   deriveOnchainReceive,
   deriveOnchainSend,
+  encodeOffer,
   extractPreimage,
+  fillOffer,
+  getAssetSwaps,
+  getAssetSwapsOrThrow,
   httpTransport,
   isRfqRefusalErrorCode,
   l1ScriptForAddress,
@@ -52,806 +68,51 @@ import {
   lockupContractParams,
   newPreimage,
   newRfqId,
+  normalizeMakerPkScript,
+  normalizeMakerPublicKey,
   offerTermsFromQuote,
+  offerVtxoScript,
   onchainHtlcScript,
   onchainReceiveRequest,
   onchainSendRequest,
   paymentHashOf,
+  preimageForSwapRecord,
   receiveVtxoScript,
   registerLockupContract,
   relayTransport,
+  requestArkadeSwap,
   requestLightningReceive,
   requestLightningSend,
   requestOnchainReceive,
   requestOnchainSend,
+  restoreOfferCoverage,
+  retireOfferContract,
+  retireSettledOfferContracts,
   rfqPair,
   sealClaimPacket,
+  swapPrograms,
+  swapSecretsToRecord,
   unilateralClaimDelay,
   unilateralRefundDelay,
   unilateralRefundWithoutReceiverDelay,
+  updateAssetSwap,
+  updateAssetSwapBestEffort,
   verifyLockupAddress,
+  verifyOfferAddress,
   verifyReceiveInvoice
-} from "./chunk-N3W6LXH6.js";
+} from "./chunk-QJKMTPRQ.js";
 import {
   InMemoryAssetSwapRepository,
   marketsCacheKey
 } from "./chunk-6ZUS47GA.js";
 
-// src/offer.ts
-import { hex as hex2 } from "@scure/base";
-import { concatBytes } from "@scure/btc-signer/utils.js";
-import {
-  ASSET_CARRIER_SATS as SDK_ASSET_CARRIER_SATS,
-  ArkAddress,
-  RestArkProvider,
-  RestEmulatorProvider,
-  RestIndexerProvider,
-  arkade,
-  asset,
-  getNetwork,
-  resolveEmulatorPubkey,
-  toXOnlySignerHex
-} from "@arkade-os/sdk";
-
-// src/swap-want-asset.program.json
-var swap_want_asset_program_default = {
-  version: 0,
-  name: "banco-btc-to-asset",
-  params: [
-    { name: "makerWP", type: "pubkey" },
-    { name: "wantAmount", type: "int" },
-    { name: "wantAssetTxid", type: "hash" },
-    { name: "wantAssetGroupIndex", type: "int" },
-    { name: "server", type: "pubkey" },
-    { name: "user", type: "pubkey" }
-  ],
-  functions: {
-    fulfill: {
-      tapscript: { signers: ["$server"] },
-      arkadeScript: {
-        asm: [
-          0,
-          "$wantAssetTxid",
-          "$wantAssetGroupIndex",
-          "INSPECTOUTASSETLOOKUP",
-          "VERIFY",
-          "$wantAmount",
-          "GREATERTHANOREQUAL",
-          "VERIFY",
-          0,
-          "INSPECTOUTPUTSCRIPTPUBKEY",
-          1,
-          "EQUALVERIFY",
-          "$makerWP",
-          "EQUAL"
-        ]
-      }
-    },
-    cancel: {
-      tapscript: { signers: ["$user", "$server"] }
-    }
-  }
-};
-
-// src/swap-want-btc.program.json
-var swap_want_btc_program_default = {
-  version: 0,
-  name: "banco-asset-to-btc",
-  params: [
-    { name: "makerWP", type: "pubkey" },
-    { name: "wantAmount", type: "int" },
-    { name: "server", type: "pubkey" },
-    { name: "user", type: "pubkey" }
-  ],
-  functions: {
-    fulfill: {
-      tapscript: { signers: ["$server"] },
-      arkadeScript: {
-        asm: [
-          0,
-          "INSPECTOUTPUTVALUE",
-          "$wantAmount",
-          "GREATERTHANOREQUAL",
-          "VERIFY",
-          0,
-          "INSPECTOUTPUTSCRIPTPUBKEY",
-          1,
-          "EQUALVERIFY",
-          "$makerWP",
-          "EQUAL"
-        ]
-      }
-    },
-    cancel: {
-      tapscript: { signers: ["$user", "$server"] }
-    }
-  }
-};
-
-// src/coverage.ts
-var RETIRABLE = ["fulfilled", "cancelled"];
-var issuedAt = /* @__PURE__ */ new Map();
-var inFlight = /* @__PURE__ */ new Map();
-async function serialize(script, task) {
-  const previous = inFlight.get(script) ?? Promise.resolve();
-  const result = previous.then(task, task);
-  const settled = result.then(
-    () => {
-    },
-    () => {
-    }
-  );
-  inFlight.set(script, settled);
-  void settled.then(() => {
-    if (inFlight.get(script) === settled) inFlight.delete(script);
-  });
-  return result;
-}
-function addressOutstanding(swaps, script) {
-  const issued = issuedAt.get(script);
-  if (issued === void 0) return false;
-  if (swaps.some((s) => s.swapPkScript === script && s.createdAt >= issued)) {
-    issuedAt.delete(script);
-    return false;
-  }
-  return true;
-}
-async function promoteOfferContract(manager, script, issued = Date.now()) {
-  await serialize(script, async () => {
-    await manager.setContractWatchState(script, "watched");
-    issuedAt.set(script, issued);
-  });
-}
-async function retireOfferContract(manager, swaps, script) {
-  await serialize(script, async () => {
-    if (swaps.some((s) => s.swapPkScript === script && !RETIRABLE.includes(s.status))) return;
-    if (addressOutstanding(swaps, script)) return;
-    try {
-      await manager.setContractWatchState(script, "retained");
-    } catch (err) {
-      console.warn(`[swap] could not retire offer contract ${script}`, err);
-    }
-  });
-}
-async function retireSettledOfferContracts(manager, swaps) {
-  const settled = new Set(
-    swaps.filter((s) => RETIRABLE.includes(s.status)).map((s) => s.swapPkScript)
-  );
-  for (const script of settled) await retireOfferContract(manager, swaps, script);
-}
-
-// src/store.ts
-import { hex } from "@scure/base";
-import { sha256 } from "@noble/hashes/sha2.js";
-import { contractPreimage } from "@arkade-os/sdk";
-var BTC_ASSET_ID = "btc";
-var byNewest = (a, b) => b.createdAt - a.createdAt;
-var getAssetSwapsOrThrow = async (repository) => {
-  return (await repository.getAllSwaps()).filter(
-    (s) => s && typeof s.id === "string" && // offer swaps carry the TLV; onchain-corridor swaps carry
-    // the payment hash instead — either marks a valid record
-    (typeof s.offerHex === "string" || typeof s.paymentHash === "string")
-  ).sort(byNewest);
-};
-var getAssetSwaps = async (repository) => {
-  try {
-    return await getAssetSwapsOrThrow(repository);
-  } catch {
-    return [];
-  }
-};
-var saveSwapOrThrow = async (repository, swap) => {
-  try {
-    await repository.saveSwap(swap);
-  } catch (error) {
-    const reason = error instanceof Error ? error.message : String(error);
-    throw new Error(`failed to save swap ${swap.id}: ${reason}`);
-  }
-};
-var addAssetSwap = async (repository, swap) => {
-  const swaps = await getAssetSwapsOrThrow(repository);
-  if (swaps.some((s) => s.id === swap.id)) return swaps;
-  await saveSwapOrThrow(repository, swap);
-  const at = swaps.findIndex((s) => byNewest(swap, s) <= 0);
-  const merged = [...swaps];
-  merged.splice(at === -1 ? merged.length : at, 0, swap);
-  return merged;
-};
-var updateAssetSwap = async (repository, id, changes) => {
-  const swaps = (await getAssetSwapsOrThrow(repository)).map(
-    (s) => s.id === id ? { ...s, ...changes } : s
-  );
-  const updated = swaps.find((s) => s.id === id);
-  if (updated) await saveSwapOrThrow(repository, updated);
-  return swaps;
-};
-var updateAssetSwapBestEffort = async (repository, id, changes) => {
-  try {
-    return { swaps: await updateAssetSwap(repository, id, changes), persisted: true };
-  } catch (error) {
-    console.warn(`[swap] failed to persist update for swap ${id}`, error);
-    const swaps = (await getAssetSwaps(repository)).map(
-      (s) => s.id === id ? { ...s, ...changes } : s
-    );
-    return { swaps, persisted: false };
-  }
-};
-var swapSecretsToRecord = (secrets) => ({
-  signingDescriptor: secrets.descriptor,
-  ..."mustPersistPreimage" in secrets && secrets.mustPersistPreimage ? { preimageHex: hex.encode(secrets.preimage) } : {},
-  ..."preimageSalt" in secrets && secrets.preimageSalt ? { preimageSaltHex: hex.encode(secrets.preimageSalt) } : {}
-});
-var decodeHex32 = (value, field) => {
-  const bytes = hex.decode(value);
-  if (bytes.length !== 32) {
-    throw new Error(`${field} must be 32 bytes, got ${bytes.length}`);
-  }
-  return bytes;
-};
-var PreimageNotRecoverableError = class extends Error {
-  constructor(reason, message, options) {
-    super(message, options);
-    this.reason = reason;
-  }
-  reason;
-  name = "PreimageNotRecoverableError";
-};
-var preimageForSwapRecord = async (wallet, record) => {
-  if (!record.signingDescriptor) {
-    throw new PreimageNotRecoverableError(
-      "no-secrets",
-      "this swap record carries no signing descriptor"
-    );
-  }
-  let stored;
-  let salt;
-  try {
-    stored = record.preimageHex ? decodeHex32(record.preimageHex, "preimageHex") : void 0;
-    salt = record.preimageSaltHex ? decodeHex32(record.preimageSaltHex, "preimageSaltHex") : void 0;
-  } catch (cause) {
-    throw new PreimageNotRecoverableError(
-      "malformed-record",
-      `this swap record's secrets projection is unreadable: ${String(cause)}`,
-      { cause }
-    );
-  }
-  let preimage;
-  try {
-    preimage = await contractPreimage(wallet, record.signingDescriptor, { stored, salt });
-  } catch (cause) {
-    throw new PreimageNotRecoverableError(
-      "not-derivable",
-      `this wallet cannot produce the preimage for ${record.signingDescriptor}`,
-      { cause }
-    );
-  }
-  if (record.paymentHash && hex.encode(sha256(preimage)) !== record.paymentHash.toLowerCase()) {
-    throw new PreimageNotRecoverableError(
-      "hash-mismatch",
-      "the derived preimage does not match this swap's payment hash: wrong wallet, or a tampered salt"
-    );
-  }
-  return preimage;
-};
-
-// src/offer.ts
-var swapPrograms = {
-  wantAsset: arkade.parseArtifact(swap_want_asset_program_default),
-  wantBtc: arkade.parseArtifact(swap_want_btc_program_default)
-};
-function withExitClosure(program, exit) {
-  if (!exit) return program;
-  return {
-    ...program,
-    // typed params are authoritative: an undeclared `$exitDelay` fails
-    // validateProgram instead of compiling against an unbound value
-    params: [...program.params ?? [], { name: "exitDelay", type: "int" }],
-    functions: {
-      ...program.functions,
-      exit: {
-        tapscript: { signers: ["$user"], csv: { type: exit.type, value: "$exitDelay" } }
-      }
-    }
-  };
-}
-function swapProgramBinding(offer, serverPubkey) {
-  if (offer.makerPkScript.length !== FIELDS.makerPkScript.width) {
-    throw new Error("makerPkScript is not a 34-byte taproot scriptPubKey");
-  }
-  return {
-    program: withExitClosure(
-      offer.wantAsset ? swapPrograms.wantAsset : swapPrograms.wantBtc,
-      offer.exitDelay
-    ),
-    args: {
-      makerWP: offer.makerPkScript.subarray(2),
-      wantAmount: offer.wantAmount,
-      server: serverPubkey,
-      user: offer.makerPublicKey,
-      // internal byte order
-      ...offer.wantAsset && {
-        wantAssetTxid: offer.wantAsset.txid.slice().reverse(),
-        wantAssetGroupIndex: offer.wantAsset.groupIndex
-      },
-      ...offer.exitDelay && { exitDelay: offer.exitDelay.value }
-    },
-    keys: {
-      serverKey: serverPubkey,
-      userKey: offer.makerPublicKey,
-      emulatorKey: offer.emulatorPubkey
-    }
-  };
-}
-function offerVtxoScript(offer, serverPubkey) {
-  const { program, args, keys } = swapProgramBinding(offer, serverPubkey);
-  return new arkade.ArkadeProgramScript(program, args, keys);
-}
-var OFFER_PACKET_TYPE = 3;
-var FIELDS = {
-  swapPkScript: { tag: 1, width: 34 },
-  wantAmount: { tag: 2, width: 8 },
-  wantAsset: { tag: 3, width: void 0 },
-  makerPkScript: { tag: 5, width: 34 },
-  makerPublicKey: { tag: 7, width: 32 },
-  emulatorPubkey: { tag: 8, width: 32 },
-  ratioNum: { tag: 9, width: 8 },
-  ratioDen: { tag: 10, width: 8 },
-  offerAsset: { tag: 11, width: void 0 },
-  exitTimelock: { tag: 12, width: 9 }
-};
-var EXIT_TYPES = ["blocks", "seconds"];
-var NAMES = Object.fromEntries(Object.entries(FIELDS).map(([k, f]) => [f.tag, k]));
-function u64(name, value) {
-  if (value < BigInt(0) || value >> BigInt(64) > BigInt(0)) {
-    throw new Error(`${name} does not fit the offer wire format (u64)`);
-  }
-  const out = new Uint8Array(8);
-  new DataView(out.buffer).setBigUint64(0, value, false);
-  return out;
-}
-var readU64 = (value) => new DataView(value.buffer, value.byteOffset).getBigUint64(0, false);
-var setRatio = (name, value) => {
-  if (value === void 0 || value === BigInt(0)) return void 0;
-  if (value < BigInt(0)) throw new Error(`${name} does not fit the offer wire format (u64)`);
-  return value;
-};
-function tlv(type, value) {
-  if (value.length > 65535) throw new Error("TLV value exceeds the u16 length field");
-  return concatBytes(Uint8Array.of(type, value.length >> 8 & 255, value.length & 255), value);
-}
-function encodeOffer(offer) {
-  if (Boolean(offer.wantAsset) === Boolean(offer.offerAsset)) {
-    throw new Error("offer must carry exactly one of wantAsset or offerAsset");
-  }
-  for (const name of [
-    "swapPkScript",
-    "makerPkScript",
-    "makerPublicKey",
-    "emulatorPubkey"
-  ]) {
-    if (offer[name].length !== FIELDS[name].width) {
-      throw new Error(`${name} must be ${FIELDS[name].width} bytes`);
-    }
-  }
-  const ratioNum = setRatio("ratioNum", offer.ratioNum);
-  const ratioDen = setRatio("ratioDen", offer.ratioDen);
-  if (ratioNum === void 0 !== (ratioDen === void 0)) {
-    throw new Error("offer must carry both ratioNum and ratioDen, or neither");
-  }
-  const recs = [
-    tlv(FIELDS.swapPkScript.tag, offer.swapPkScript),
-    tlv(FIELDS.wantAmount.tag, u64("wantAmount", offer.wantAmount))
-  ];
-  if (offer.wantAsset) recs.push(tlv(FIELDS.wantAsset.tag, offer.wantAsset.serialize()));
-  if (ratioNum !== void 0) recs.push(tlv(FIELDS.ratioNum.tag, u64("ratioNum", ratioNum)));
-  if (ratioDen !== void 0) recs.push(tlv(FIELDS.ratioDen.tag, u64("ratioDen", ratioDen)));
-  if (offer.offerAsset) recs.push(tlv(FIELDS.offerAsset.tag, offer.offerAsset.serialize()));
-  recs.push(
-    tlv(FIELDS.makerPkScript.tag, offer.makerPkScript),
-    tlv(FIELDS.makerPublicKey.tag, offer.makerPublicKey),
-    tlv(FIELDS.emulatorPubkey.tag, offer.emulatorPubkey)
-  );
-  if (offer.exitDelay) recs.push(tlv(FIELDS.exitTimelock.tag, encodeExitDelay(offer.exitDelay)));
-  return concatBytes(...recs);
-}
-function encodeExitDelay(exit) {
-  return concatBytes(
-    Uint8Array.of(EXIT_TYPES.indexOf(assertExitDelay(exit).type)),
-    u64("exitDelay", exit.value)
-  );
-}
-function assertExitDelay(exit) {
-  if (EXIT_TYPES.indexOf(exit.type) < 0) {
-    throw new Error(`unknown exitDelay locktime type: ${exit.type}`);
-  }
-  if (exit.value <= BigInt(0)) {
-    throw new Error("exitDelay must be a positive relative locktime");
-  }
-  if (exit.value >> BigInt(32) > BigInt(0)) {
-    throw new Error("exitDelay does not fit the locktime field (u32)");
-  }
-  return exit;
-}
-function decodeOffer(data) {
-  const fields = {};
-  let off = 0;
-  while (off < data.length) {
-    if (off + 3 > data.length) throw new Error("truncated TLV header");
-    const type = data[off];
-    const length = data[off + 1] << 8 | data[off + 2];
-    off += 3;
-    if (off + length > data.length)
-      throw new Error(`truncated TLV value for type 0x${type.toString(16)}`);
-    const name = NAMES[type];
-    if (!name) throw new Error(`unknown TLV type: 0x${type.toString(16)}`);
-    if (fields[name] !== void 0) throw new Error(`duplicate TLV record: ${name}`);
-    fields[name] = data.slice(off, off + length);
-    off += length;
-  }
-  for (const name of ["wantAsset", "offerAsset"]) {
-    if (fields[name]?.length === 0) throw new Error(`missing/invalid ${name}`);
-  }
-  for (const [name, value] of Object.entries(fields)) {
-    const width = FIELDS[name].width;
-    if (width !== void 0 && value.length !== width) {
-      throw new Error(`missing/invalid ${name}`);
-    }
-  }
-  const need = (name) => {
-    const v = fields[name];
-    const len = FIELDS[name].width;
-    if (!v || len !== void 0 && v.length !== len)
-      throw new Error(`missing/invalid ${name}`);
-    return v;
-  };
-  const amount = need("wantAmount");
-  if (Boolean(fields.wantAsset) === Boolean(fields.offerAsset)) {
-    throw new Error("offer must carry exactly one of wantAsset or offerAsset");
-  }
-  const readRatio = (name) => {
-    const raw = fields[name];
-    if (!raw) return void 0;
-    const value = readU64(raw);
-    if (value === BigInt(0)) throw new Error(`missing/invalid ${name}`);
-    return value;
-  };
-  const ratioNum = readRatio("ratioNum");
-  const ratioDen = readRatio("ratioDen");
-  if (ratioNum === void 0 !== (ratioDen === void 0)) {
-    throw new Error("offer must carry both ratioNum and ratioDen, or neither");
-  }
-  return {
-    swapPkScript: need("swapPkScript"),
-    wantAmount: readU64(amount),
-    ...fields.wantAsset && { wantAsset: asset.AssetId.fromBytes(fields.wantAsset) },
-    ...fields.offerAsset && { offerAsset: asset.AssetId.fromBytes(fields.offerAsset) },
-    makerPkScript: need("makerPkScript"),
-    makerPublicKey: need("makerPublicKey"),
-    emulatorPubkey: need("emulatorPubkey"),
-    ...ratioNum !== void 0 && { ratioNum },
-    ...ratioDen !== void 0 && { ratioDen },
-    ...fields.exitTimelock && { exitDelay: decodeExitDelay(fields.exitTimelock) }
-  };
-}
-function decodeExitDelay(value) {
-  const type = EXIT_TYPES[value[0]];
-  if (!type) throw new Error(`unknown exitDelay locktime type: 0x${value[0].toString(16)}`);
-  return { type, value: readU64(value.subarray(1)) };
-}
-var OFFER_CONTRACT_LABEL = "Arkade swap offer";
-var OFFER_CONTRACT_KIND = "asset-swap-offer";
-async function registerOfferContract(wallet, arkServerUrl, network, binding, serverPubkey, expectedPkScript, opts = {}) {
-  const contractManager = opts.contractManager ?? await wallet.getContractManager();
-  const client = opts.client ?? await arkade.Arkade.connect({
-    arkade: new RestArkProvider(arkServerUrl),
-    indexer: new RestIndexerProvider(arkServerUrl),
-    identity: wallet.identity,
-    // without this the row's `address` would be derived against the SDK's
-    // default network while its script is right — a row that disagrees with
-    // the address the user is about to fund
-    network: getNetwork(network),
-    contractManager
-  });
-  await contractManager.createContract(
-    offerContractParams(client, binding, serverPubkey, expectedPkScript)
-  );
-  await promoteOfferContract(contractManager, hex2.encode(expectedPkScript), opts.issued);
-}
-function offerContractParams(client, binding, serverPubkey, expectedPkScript) {
-  const { program, args, keys } = swapProgramBinding(binding, serverPubkey);
-  const contract = new arkade.ArkadeContract(client, program, args, keys);
-  if (hex2.encode(contract.pkScript) !== hex2.encode(expectedPkScript)) {
-    throw new Error("derived covenant does not match the offer's swapPkScript");
-  }
-  return {
-    ...contract.toContractParams(),
-    label: OFFER_CONTRACT_LABEL,
-    metadata: { genericallySpendable: false, kind: OFFER_CONTRACT_KIND }
-  };
-}
-async function restoreOfferCoverage(wallet, arkServerUrl, swaps) {
-  const live = swaps.filter((s) => !RETIRABLE.includes(s.status));
-  if (live.length === 0) return;
-  const arkProvider = new RestArkProvider(arkServerUrl);
-  const info = await arkProvider.getInfo();
-  const serverPubKey = hex2.decode(toXOnlySignerHex(info.signerPubkey));
-  const contractManager = await wallet.getContractManager();
-  const client = await arkade.Arkade.connect({
-    arkade: arkProvider,
-    indexer: new RestIndexerProvider(arkServerUrl),
-    identity: wallet.identity,
-    network: getNetwork(info.network),
-    contractManager
-  });
-  const done = /* @__PURE__ */ new Set();
-  const covenants = [];
-  for (const swap of live) {
-    if (done.has(swap.swapPkScript)) continue;
-    done.add(swap.swapPkScript);
-    try {
-      const { swapPkScript: _, ...binding } = decodeOffer(hex2.decode(swap.offerHex));
-      covenants.push({
-        script: swap.swapPkScript,
-        issued: swap.createdAt,
-        params: offerContractParams(
-          client,
-          binding,
-          serverPubKey,
-          hex2.decode(swap.swapPkScript)
-        )
-      });
-    } catch (err) {
-      console.warn(`[swap] could not restore coverage for ${swap.swapPkScript}`, err);
-    }
-  }
-  if (covenants.length === 0) return;
-  const paramsList = covenants.map((c) => c.params);
-  if (contractManager.createContracts) {
-    await contractManager.createContracts(paramsList);
-  } else {
-    for (const params of paramsList) await contractManager.createContract(params);
-  }
-  for (const c of covenants) await promoteOfferContract(contractManager, c.script, c.issued);
-}
-function serverExitDelay(delay) {
-  if (typeof delay !== "bigint" || delay <= BigInt(0)) {
-    throw new Error(
-      "the server reports no usable unilateralExitDelay; pass `exitDelay` to set the offer's exit closure explicitly, or `noExit: true` to publish without one"
-    );
-  }
-  return assertExitDelay({ value: delay, type: delay < BigInt(512) ? "blocks" : "seconds" });
-}
-async function createOffer(wallet, arkServerUrl, params) {
-  if (Boolean(params.wantAsset) === Boolean(params.offerAsset)) {
-    throw new Error("set exactly one of wantAsset (BTC->asset) or offerAsset (asset->BTC)");
-  }
-  const [info, makerAddress, makerPublicKey] = await Promise.all([
-    new RestArkProvider(arkServerUrl).getInfo(),
-    wallet.getAddress(),
-    wallet.identity.xOnlyPublicKey()
-  ]);
-  const serverPubKey = hex2.decode(toXOnlySignerHex(info.signerPubkey));
-  const network = getNetwork(info.network);
-  const emuKey = hex2.decode(
-    toXOnlySignerHex(resolveEmulatorPubkey(network, params.emulatorPubkey))
-  );
-  const binding = {
-    wantAmount: params.wantAmount,
-    wantAsset: params.wantAsset,
-    offerAsset: params.offerAsset,
-    makerPkScript: ArkAddress.decode(makerAddress).pkScript,
-    makerPublicKey,
-    emulatorPubkey: emuKey,
-    // checked HERE, before the covenant is derived and registered below:
-    // deferring it to `encodeOffer` leaves a registered contract behind for
-    // an offer that then fails to encode. @see assertExitDelay
-    exitDelay: params.noExit ? void 0 : params.exitDelay ? assertExitDelay(params.exitDelay) : serverExitDelay(info.unilateralExitDelay)
-  };
-  const script = offerVtxoScript(binding, serverPubKey);
-  const offer = { ...binding, swapPkScript: script.pkScript };
-  await registerOfferContract(
-    wallet,
-    arkServerUrl,
-    info.network,
-    binding,
-    serverPubKey,
-    script.pkScript
-  );
-  const payload = encodeOffer(offer);
-  return {
-    offerHex: hex2.encode(payload),
-    extension: { type: OFFER_PACKET_TYPE, payload },
-    // VtxoScript.address owns address construction; assembling an ArkAddress
-    // from tweakedPublicKey here would silently miss any future step it gains
-    address: script.address(network.hrp, serverPubKey).encode(),
-    swapPkScript: script.pkScript
-  };
-}
-async function cancelOffer(wallet, arkServerUrl, offerHex, opts) {
-  const { repository, fundingTxid, swapAddress } = opts;
-  const offer = decodeOffer(hex2.decode(offerHex));
-  const contractManager = await wallet.getContractManager();
-  const client = await arkade.Arkade.connect({
-    arkade: new RestArkProvider(arkServerUrl),
-    indexer: new RestIndexerProvider(arkServerUrl),
-    identity: wallet.identity,
-    // registered offers resolve their VTXOs from the contract repository
-    // instead of a direct indexer query; the indexer above stays as the
-    // fallback for offers created before registration existed
-    contractManager
-    // no `network`, unlike registerOfferContract: the row lookup is by
-    // script and the payout script comes from wallet.getAddress(), so the
-    // client's network (which only shapes address derivation) is unused here
-  });
-  const operatorPubkey = swapAddress ? ArkAddress.decode(swapAddress).serverPubKey : client.serverKey;
-  const { program, args, keys } = swapProgramBinding(offer, operatorPubkey);
-  const rebuilt = new arkade.ArkadeProgramScript(program, args, keys);
-  if (hex2.encode(rebuilt.pkScript) !== hex2.encode(offer.swapPkScript)) {
-    throw new Error(
-      "rebuilt covenant does not match the offer's swapPkScript \u2014 the server signing key has likely rotated since funding; pass swapAddress (the funded address) to pin the original key"
-    );
-  }
-  const contract = new arkade.ArkadeContract(client, program, args, keys);
-  const [vtxos, makerAddress] = await Promise.all([contract.getUtxos(), wallet.getAddress()]);
-  if (!fundingTxid && vtxos.length > 1) {
-    throw new Error(
-      "multiple spendable deposits at the swap address \u2014 pass fundingTxid to select one"
-    );
-  }
-  const vtxo = fundingTxid ? vtxos.find((v) => v.txid === fundingTxid) : vtxos[0];
-  if (!vtxo) throw new Error("no spendable VTXO at the swap address");
-  const makerPkScript = ArkAddress.decode(makerAddress).pkScript;
-  const cancel = contract.functions.cancel().from({ txid: vtxo.txid, vout: vtxo.vout, value: vtxo.value }).to(makerPkScript, BigInt(vtxo.value));
-  for (const a of vtxo.assets ?? []) {
-    cancel.withAsset({
-      assetId: a.assetId,
-      inputs: [{ vin: 0, amount: BigInt(a.amount) }],
-      outputs: [{ vout: 0, amount: BigInt(a.amount) }]
-    });
-  }
-  const swapId = fundingTxid ?? vtxo.txid;
-  const hasLocalRecord = (await getAssetSwapsOrThrow(repository)).some((s) => s.id === swapId);
-  if (hasLocalRecord) await updateAssetSwap(repository, swapId, { status: "cancelling" });
-  const { txid } = await cancel.send();
-  if (hasLocalRecord) {
-    const { persisted, swaps } = await updateAssetSwapBestEffort(repository, swapId, {
-      status: "cancelled",
-      spentTxid: txid
-    });
-    if (persisted) {
-      await retireOfferContract(contractManager, swaps, hex2.encode(offer.swapPkScript));
-    }
-  }
-  return txid;
-}
-var ASSET_CARRIER_SATS = BigInt(SDK_ASSET_CARRIER_SATS);
-async function fillOffer(wallet, arkServerUrl, offerHex, opts) {
-  const {
-    fund,
-    payoutScript,
-    fundingTxid,
-    swapAddress,
-    assetCarrierSats = ASSET_CARRIER_SATS,
-    emulator,
-    emulatorPubkey
-  } = opts;
-  const offer = decodeOffer(hex2.decode(offerHex));
-  const wantedAssetId = offer.wantAsset?.toString();
-  if (fund.length === 0) {
-    throw new Error("fillOffer needs coins to pay wantAmount with \u2014 `fund` is empty");
-  }
-  if (wantedAssetId !== void 0) {
-    const supplied = fund.reduce(
-      (sum, coin) => sum + amountOfAsset(coin.assets, wantedAssetId),
-      BigInt(0)
-    );
-    if (supplied < offer.wantAmount) {
-      throw new Error(
-        `fillOffer needs ${offer.wantAmount} of ${wantedAssetId} to pay the maker, but \`fund\` declares ${supplied} \u2014 pass coins carrying it, and declare their assets`
-      );
-    }
-  }
-  const contractManager = await wallet.getContractManager();
-  const client = await arkade.Arkade.connect({
-    arkade: new RestArkProvider(arkServerUrl),
-    indexer: new RestIndexerProvider(arkServerUrl),
-    identity: wallet.identity,
-    contractManager,
-    // `fulfill` is a covenant path, so the emulator executes the arkade
-    // script and finalizes with arkd. Without it the spend is built and then
-    // refused at submission — there is no default to fall back on.
-    emulator: typeof emulator === "string" ? new RestEmulatorProvider(emulator) : emulator,
-    // Only reached for the client's own emulatorKey, which this fill never
-    // derives against — the offer's own key is bound below. It still has to
-    // resolve, and on a network with no pinned key it throws without this.
-    ...emulatorPubkey ? { emulatorPubkey } : {}
-  });
-  const serverKey = swapAddress ? ArkAddress.decode(swapAddress).serverPubKey : client.serverKey;
-  const { program, args, keys } = swapProgramBinding(offer, serverKey);
-  const rebuilt = new arkade.ArkadeProgramScript(program, args, keys);
-  if (hex2.encode(rebuilt.pkScript) !== hex2.encode(offer.swapPkScript)) {
-    throw new Error(
-      "rebuilt covenant does not match the offer's swapPkScript \u2014 the server signing key has likely rotated since funding; pass swapAddress (the funded address) to pin the original key"
-    );
-  }
-  const contract = new arkade.ArkadeContract(client, program, args, keys);
-  const [vtxos, takerAddress] = await Promise.all([contract.getUtxos(), wallet.getAddress()]);
-  if (!fundingTxid && vtxos.length > 1) {
-    throw new Error(
-      "multiple spendable deposits at the swap address \u2014 pass fundingTxid to select one"
-    );
-  }
-  const vtxo = fundingTxid ? vtxos.find((v) => v.txid === fundingTxid) : vtxos[0];
-  if (!vtxo) throw new Error("no spendable VTXO at the swap address");
-  if (offer.offerAsset) {
-    const offered = offer.offerAsset.toString();
-    const deposited = amountOfAsset(vtxo.assets, offered);
-    if (deposited <= BigInt(0)) {
-      throw new Error(
-        `the deposit at the swap address carries no ${offered}, which this offer sells \u2014 filling it would pay wantAmount for nothing. The indexer may be behind, or the offer may not be backed by what it advertises`
-      );
-    }
-  }
-  const payout = payoutScript ?? ArkAddress.decode(takerAddress).pkScript;
-  const makerSats = wantedAssetId === void 0 ? offer.wantAmount : assetCarrierSats;
-  const fill = contract.functions.fulfill().from({ txid: vtxo.txid, vout: vtxo.vout, value: vtxo.value }).fund(fund).to(offer.makerPkScript, makerSats).change(payout);
-  const held = /* @__PURE__ */ new Map();
-  const hold = (vin, assets) => {
-    for (const a of assets ?? []) {
-      const amount = BigInt(a.amount);
-      if (amount <= BigInt(0)) continue;
-      held.set(a.assetId, [...held.get(a.assetId) ?? [], { vin, amount }]);
-    }
-  };
-  hold(0, vtxo.assets);
-  fund.forEach((coin, i) => hold(i + 1, coin.assets));
-  const outputsSum = makerSats;
-  const inputsSum = fund.reduce((s, c) => s + BigInt(c.value), BigInt(vtxo.value));
-  const hasPayoutOutput = inputsSum > outputsSum;
-  const emitWanted = () => {
-    if (wantedAssetId === void 0) return;
-    const supplying = held.get(wantedAssetId) ?? [];
-    const supplied = supplying.reduce((s, i) => s + i.amount, BigInt(0));
-    const outputs = [{ vout: 0, amount: offer.wantAmount }];
-    const surplus = supplied - offer.wantAmount;
-    if (surplus > BigInt(0)) {
-      if (!hasPayoutOutput) {
-        throw new Error(
-          `fillOffer has ${surplus} of ${wantedAssetId} to return but no payout output \u2014 fund with more sats than the maker's output takes`
-        );
-      }
-      outputs.push({ vout: 1, amount: surplus });
-    }
-    fill.withAsset({ assetId: wantedAssetId, inputs: supplying, outputs });
-    held.delete(wantedAssetId);
-  };
-  emitWanted();
-  for (const [assetId, inputs] of held) {
-    const amount = inputs.reduce((s, i) => s + i.amount, BigInt(0));
-    if (!hasPayoutOutput) {
-      throw new Error(
-        `fillOffer has ${amount} of ${assetId} to return but no payout output \u2014 fund with more sats than the maker's output takes`
-      );
-    }
-    fill.withAsset({ assetId, inputs, outputs: [{ vout: 1, amount }] });
-  }
-  const { txid } = await fill.send();
-  return txid;
-}
-var amountOfAsset = (assets, assetId) => {
-  let total = BigInt(0);
-  for (const a of assets ?? []) {
-    if (a.assetId === assetId) total += BigInt(a.amount);
-  }
-  return total;
-};
-
 // src/markets.ts
 import {
   bestMarket,
   discover,
   isNetwork,
   marketLegKey,
+  registryIndexUrl,
   sideLimits
 } from "@arkade-os/solver-discovery";
 import { isSubdust } from "@arkade-os/sdk";
@@ -866,9 +127,9 @@ var LEGACY_CORRIDORS = {
 };
 var assetOf = (market, side) => side === "base" ? market.base_asset : market.quote_asset;
 var marketAssetId = (market, side) => {
-  const asset2 = assetOf(market, side);
-  if (typeof asset2?.caip19_id === "string") return asset2.caip19_id;
-  return typeof asset2?.id === "string" ? asset2.id : void 0;
+  const asset = assetOf(market, side);
+  if (typeof asset?.caip19_id === "string") return asset.caip19_id;
+  return typeof asset?.id === "string" ? asset.id : void 0;
 };
 var chainNamespaceOf = (id) => {
   if (id === void 0) return void 0;
@@ -967,12 +228,14 @@ var discoverMarkets = async (options) => {
     fetchImpl,
     useCache = true
   } = options;
-  if (!registry || !isNetwork(network)) return [];
-  const cached = repository && await readMarketsCache(repository, network, registry);
+  if (!isNetwork(network)) return [];
+  const registries = registry ? [registry] : void 0;
+  const registryKey = registries?.[0] ?? registryIndexUrl(network);
+  const cached = repository && await readMarketsCache(repository, network, registryKey);
   if (useCache && cached && Date.now() - cached.fetchedAt < MARKETS_CACHE_TTL_MS)
     return cached.markets;
   const { markets, sources, warnings } = await discover({
-    registries: [registry],
+    registries,
     localCards,
     network,
     fetchImpl
@@ -982,7 +245,7 @@ var discoverMarkets = async (options) => {
   if (!reachable && cached) return cached.markets;
   if (reachable && repository) {
     try {
-      await repository.saveCachedMarkets(network, registry, {
+      await repository.saveCachedMarkets(network, registryKey, {
         markets,
         fetchedAt: Date.now()
       });
@@ -996,8 +259,8 @@ var findMarket = (markets, fromId, toId) => {
   const resolveMarketId = (id) => {
     for (const market of markets) {
       for (const side of ["base", "quote"]) {
-        const asset2 = side === "base" ? market.base_asset : market.quote_asset;
-        if (asset2.id === id) return marketLegKey(market, side);
+        const asset = side === "base" ? market.base_asset : market.quote_asset;
+        if (asset.id === id) return marketLegKey(market, side);
         const canonical = marketAssetId(market, side) ?? "";
         const matchesBtc = id === BTC_ASSET_ID && /^arkade:[^/]+\/slip44:(?:0|1)$/.test(canonical);
         const matchesAsset = /^[0-9a-f]{68}$/.test(id) && canonical.endsWith(`/asset:${id}`);
@@ -1147,7 +410,7 @@ var IndexedDbAssetSwapRepository = class {
 };
 
 // src/restore.ts
-import { base64, hex as hex3 } from "@scure/base";
+import { base64, hex } from "@scure/base";
 import {
   Extension,
   Transaction,
@@ -1183,7 +446,7 @@ function classifySpend(offer, serverPubkey, spendTx, deposit) {
   let leaves;
   try {
     const script = offerVtxoScript(offer, serverPubkey);
-    if (hex3.encode(script.pkScript) !== hex3.encode(offer.swapPkScript)) return "indeterminate";
+    if (hex.encode(script.pkScript) !== hex.encode(offer.swapPkScript)) return "indeterminate";
     leaves = {
       // both routes that hand the deposit back; `exit` is absent on an
       // offer that carries no exit closure, and drops out here
@@ -1196,11 +459,11 @@ function classifySpend(offer, serverPubkey, spendTx, deposit) {
   for (let i = 0; i < spendTx.inputsLength; i++) {
     const input = spendTx.getInput(i);
     if (!input.txid || input.index !== deposit.vout) continue;
-    if (hex3.encode(input.txid) !== deposit.txid) continue;
+    if (hex.encode(input.txid) !== deposit.txid) continue;
     for (const leaf of input.tapLeafScript ?? []) {
-      const spent = hex3.encode(scriptFromTapLeafScript(leaf));
-      if (leaves.returned.some((back) => spent === hex3.encode(back))) return "cancelled";
-      if (leaves.fulfill && spent === hex3.encode(leaves.fulfill)) return "fulfilled";
+      const spent = hex.encode(scriptFromTapLeafScript(leaf));
+      if (leaves.returned.some((back) => spent === hex.encode(back))) return "cancelled";
+      if (leaves.fulfill && spent === hex.encode(leaves.fulfill)) return "fulfilled";
     }
   }
   return "indeterminate";
@@ -1220,7 +483,7 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
     try {
       reopened.push({
         fundingTx: { type: "sent", redeemTxid: swap.fundingTxid },
-        offer: decodeOffer(hex3.decode(swap.offerHex)),
+        offer: decodeOffer(hex.decode(swap.offerHex)),
         offerHex: swap.offerHex,
         existing: swap
       });
@@ -1252,13 +515,13 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
       found.push({
         fundingTx,
         offer: decodeOffer(payload),
-        offerHex: hex3.encode(payload)
+        offerHex: hex.encode(payload)
       });
     } catch {
     }
   }
   if (found.length === 0) return { restored: [], scannedTxids: fetchedTxids };
-  const scripts = [...new Set(found.map((f) => hex3.encode(f.offer.swapPkScript)))];
+  const scripts = [...new Set(found.map((f) => hex.encode(f.offer.swapPkScript)))];
   const { vtxos } = await indexer.getVtxos({ scripts });
   const vtxoByScriptAndTxid = new Map(vtxos.map((v) => [`${v.script}:${v.txid}`, v]));
   const txByAnyId = /* @__PURE__ */ new Map();
@@ -1270,7 +533,7 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
   const spendTxids = /* @__PURE__ */ new Set();
   for (const { fundingTx, offer } of found) {
     const vtxo = vtxoByScriptAndTxid.get(
-      `${hex3.encode(offer.swapPkScript)}:${fundingTx.redeemTxid}`
+      `${hex.encode(offer.swapPkScript)}:${fundingTx.redeemTxid}`
     );
     if (vtxo?.virtualStatus.state !== "spent") continue;
     for (const txid of spendTxidsOf(vtxo)) spendTxids.add(txid);
@@ -1279,7 +542,7 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
   const restored = [];
   const unresolved = /* @__PURE__ */ new Set();
   for (const { fundingTx, offer, offerHex, existing } of found) {
-    const swapPkScript = hex3.encode(offer.swapPkScript);
+    const swapPkScript = hex.encode(offer.swapPkScript);
     const vtxo = vtxoByScriptAndTxid.get(`${swapPkScript}:${fundingTx.redeemTxid}`);
     if (!vtxo) {
       unresolved.add(fundingTx.redeemTxid);
@@ -1459,7 +722,7 @@ function registerAssetSwapRestore(wallet, options) {
 }
 
 // src/rfqCorridors.ts
-import { hex as hex4 } from "@scure/base";
+import { hex as hex2 } from "@scure/base";
 
 // src/rfqCorridor.ts
 var RfqCorridorRegistry = class {
@@ -1615,13 +878,14 @@ var LightningReceiveCorridor = {
 };
 function onchainSendProfile(result) {
   return {
-    claimKey: hex4.encode(result.htlcParams.claimKey),
-    refundKey: hex4.encode(result.htlcParams.refundKey),
+    claimKey: hex2.encode(result.htlcParams.claimKey),
+    refundKey: hex2.encode(result.htlcParams.refundKey),
     htlcLocktime: result.htlcParams.refundLocktime,
     network: result.l1Network,
     htlcAddress: result.htlc.address,
     minConfirmations: result.minConfirmations,
-    payoutPkScript: hex4.encode(result.payoutPkScript)
+    expectedAmount: result.expectedAmount,
+    payoutPkScript: hex2.encode(result.payoutPkScript)
   };
 }
 var OnchainSendCorridor = {
@@ -1632,6 +896,7 @@ var OnchainSendCorridor = {
   project: (swap) => {
     const send = swap;
     return {
+      expectedAmount: send.expectedAmount,
       ...send.funding ? { funding: send.funding } : {},
       ...send.claimTxid ? { claimTxid: send.claimTxid } : {}
     };
@@ -1648,6 +913,11 @@ var OnchainSendCorridor = {
         `onchain_send record carries no usable minConfirmations (${String(profile.minConfirmations)}); the confirmation gate cannot be checked \u2014 refusing to restore a swap that would claim an unconfirmed fill`
       );
     }
+    if (!Number.isSafeInteger(profile.expectedAmount) || profile.expectedAmount <= 0) {
+      throw new Error(
+        `onchain_send record carries no usable expectedAmount (${String(profile.expectedAmount)}); the funded value cannot be checked \u2014 refusing to restore a swap that would claim an underfunded fill`
+      );
+    }
     const htlc = onchainHtlcScript(
       {
         // From the profile, not the covenant: the lockup commits to
@@ -1655,8 +925,8 @@ var OnchainSendCorridor = {
         // unlocks both legs, but only one of the two hashes of it
         // is recoverable here.
         paymentHash,
-        claimKey: hex4.decode(profile.claimKey),
-        refundKey: hex4.decode(profile.refundKey),
+        claimKey: hex2.decode(profile.claimKey),
+        refundKey: hex2.decode(profile.refundKey),
         refundLocktime: profile.htlcLocktime
       },
       profile.network
@@ -1670,9 +940,10 @@ var OnchainSendCorridor = {
       paymentHash,
       htlc,
       minConfirmations: profile.minConfirmations,
+      expectedAmount: profile.expectedAmount,
       // Optional here, required at the write: throwing on an older
       // record would strand the refund it is still owed.
-      ...profile.payoutPkScript ? { payoutPkScript: hex4.decode(profile.payoutPkScript) } : {},
+      ...profile.payoutPkScript ? { payoutPkScript: hex2.decode(profile.payoutPkScript) } : {},
       ...profile.funding ? { funding: profile.funding } : {},
       ...profile.claimTxid ? { claimTxid: profile.claimTxid } : {}
     };
@@ -1690,8 +961,8 @@ rfqCorridorHandlers.register(LightningReceiveCorridor);
 rfqCorridorHandlers.register(OnchainSendCorridor);
 
 // src/rfqRecord.ts
-import { ArkAddress as ArkAddress2, VHTLCV2ContractHandler } from "@arkade-os/sdk";
-import { hex as hex5 } from "@scure/base";
+import { ArkAddress, VHTLCV2ContractHandler } from "@arkade-os/sdk";
+import { hex as hex3 } from "@scure/base";
 
 // src/rfqSwapState.ts
 var RFQ_SWAP_TERMINAL_STATES = ["settled", "refunded", "failed"];
@@ -1715,8 +986,8 @@ function assertSameSwap(origin, swap) {
       `rfq swap record is a ${origin.kind} origin paired with a ${swap.kind} swap`
     );
   }
-  const funded = hex5.encode(ArkAddress2.decode(origin.lockupAddress).pkScript);
-  const watched = hex5.encode(swap.lockupPkScript);
+  const funded = hex3.encode(ArkAddress.decode(origin.lockupAddress).pkScript);
+  const watched = hex3.encode(swap.lockupPkScript);
   if (funded !== watched) {
     throw new Error(
       `rfq swap record's lockup address holds ${funded}, but the swap watches ${watched} \u2014 these are not the same swap`
@@ -1761,10 +1032,10 @@ function rfqSwapOriginOf(record) {
 }
 function lockupScript(params, lockupAddress) {
   const script = VHTLCV2ContractHandler.createScript(params);
-  const funded = ArkAddress2.decode(lockupAddress).pkScript;
-  if (hex5.encode(funded) !== hex5.encode(script.pkScript)) {
+  const funded = ArkAddress.decode(lockupAddress).pkScript;
+  if (hex3.encode(funded) !== hex3.encode(script.pkScript)) {
     throw new Error(
-      `rfq swap covenant params derive ${hex5.encode(script.pkScript)}, but the record's lockup address holds ${hex5.encode(funded)} \u2014 these params are not this swap's`
+      `rfq swap covenant params derive ${hex3.encode(script.pkScript)}, but the record's lockup address holds ${hex3.encode(funded)} \u2014 these params are not this swap's`
     );
   }
   return script;
@@ -1799,11 +1070,11 @@ function shouldRetainRfqSwap(record, now) {
 }
 
 // src/watch.ts
-import { base64 as base642, hex as hex6 } from "@scure/base";
+import { base64 as base642, hex as hex4 } from "@scure/base";
 import {
-  ArkAddress as ArkAddress3,
+  ArkAddress as ArkAddress2,
   isContractVtxoEvent,
-  RestIndexerProvider as RestIndexerProvider3,
+  RestIndexerProvider as RestIndexerProvider2,
   Transaction as Transaction2
 } from "@arkade-os/sdk";
 var TERMINAL = ["fulfilled", "cancelled", "recoverable"];
@@ -1825,8 +1096,8 @@ async function watchOfferSwaps({
   onUpdate
 }) {
   const manager = await wallet.getContractManager();
-  const serverPubkey = ArkAddress3.decode(await wallet.getAddress()).serverPubKey;
-  const indexer = new RestIndexerProvider3(arkServerUrl);
+  const serverPubkey = ArkAddress2.decode(await wallet.getAddress()).serverPubKey;
+  const indexer = new RestIndexerProvider2(arkServerUrl);
   let queue = Promise.resolve();
   const enqueue = (task) => {
     queue = queue.then(task).catch(() => {
@@ -1839,7 +1110,7 @@ async function watchOfferSwaps({
       if (candidates.length === 0) return "indeterminate";
       const { txs } = await indexer.getVirtualTxs(candidates);
       return classifyDepositSpend(
-        decodeOffer(hex6.decode(swap.offerHex)),
+        decodeOffer(hex4.decode(swap.offerHex)),
         serverPubkey,
         txs.map((psbt) => Transaction2.fromPSBT(base642.decode(psbt))),
         { txid: vtxo.txid, vout: vtxo.vout }
@@ -1904,7 +1175,7 @@ async function watchOfferSwaps({
 
 // src/chainSource.ts
 import * as btc from "@scure/btc-signer";
-import { hex as hex7 } from "@scure/base";
+import { hex as hex5 } from "@scure/base";
 var addressOf = (pkScript, network) => btc.Address(L1_NETWORKS[network]).encode(btc.OutScript.decode(pkScript));
 var chainSourceFrom = (provider, network) => {
   const spenderFromHistory = async (txid, vout, pkScript) => {
@@ -1934,7 +1205,7 @@ var chainSourceFrom = (provider, network) => {
       const spender = outspend.txid || await spenderFromHistory(txid, vout, pkScript);
       if (!spender) return null;
       const raw = await provider.getRawTransaction(spender);
-      return { txHex: hex7.encode(raw) };
+      return { txHex: hex5.encode(raw) };
     },
     broadcast(txHex) {
       return provider.broadcastTransaction(txHex);
@@ -1947,7 +1218,7 @@ var chainSourceFrom = (provider, network) => {
 
 // src/payment/rendezvous.ts
 import { sideLimits as sideLimits2 } from "@arkade-os/solver-discovery";
-import { hex as hex8 } from "@scure/base";
+import { hex as hex6 } from "@scure/base";
 var XONLY_HEX = /^[0-9a-f]{64}$/;
 var rendezvousOf = (market, pinned) => {
   const transports = { nostr: { relays: market.transports?.nostr?.relays ?? [] } };
@@ -1966,7 +1237,7 @@ var rendezvousOf = (market, pinned) => {
   };
 };
 var solverRendezvous = (markets, payoutCorridor, amountSats, fallbackEmulatorPubkey) => {
-  const encoded = fallbackEmulatorPubkey ? hex8.encode(fallbackEmulatorPubkey) : void 0;
+  const encoded = fallbackEmulatorPubkey ? hex6.encode(fallbackEmulatorPubkey) : void 0;
   if (encoded !== void 0 && !XONLY_HEX.test(encoded)) return void 0;
   const pinned = encoded;
   const quoteCorridor = payoutCorridor === "lightning" ? "bolt11" : "bitcoin";
@@ -2221,12 +1492,12 @@ var parseAssetId = (assetId) => {
 };
 var marketLabel = (market) => `${market.base_asset.ticker || market.base_asset.id}/${market.quote_asset.ticker || market.quote_asset.id}`;
 function crossAssetRail(deps) {
-  const planFor = async (asset2) => {
+  const planFor = async (asset) => {
     const markets = await deps.discover();
-    const found = findMarket(markets, BTC_ASSET_ID, asset2.assetId);
+    const found = findMarket(markets, BTC_ASSET_ID, asset.assetId);
     const market = found?.market;
     if (!market) return void 0;
-    const plan = await deps.quote(market, found.give, asset2.amount);
+    const plan = await deps.quote(market, found.give, asset.amount);
     const [balance, dust] = await Promise.all([deps.btcBalance(), deps.dust()]);
     return { plan, error: validatePlan(plan, balance, dust) };
   };
@@ -2236,29 +1507,29 @@ function crossAssetRail(deps) {
     available: async (req) => {
       const assets = assetsOf3(req);
       if (assets.length !== 1) return false;
-      const [asset2] = assets;
-      if (asset2.assetId === BTC_ASSET_ID) return false;
-      if (typeof asset2.amount !== "bigint" || asset2.amount <= 0n) return false;
-      if (!parseAssetId(asset2.assetId)) return false;
-      const planned = await planFor(asset2);
+      const [asset] = assets;
+      if (asset.assetId === BTC_ASSET_ID) return false;
+      if (typeof asset.amount !== "bigint" || asset.amount <= 0n) return false;
+      if (!parseAssetId(asset.assetId)) return false;
+      const planned = await planFor(asset);
       return planned !== void 0 && planned.error === void 0;
     },
     quote: async (req, ctx) => {
       const payTo = arkTarget(req.raw);
-      const asset2 = resolveAssetAmount(CROSS_ASSET_RAIL, req);
-      const wantAsset = parseAssetId(asset2.assetId);
+      const asset = resolveAssetAmount(CROSS_ASSET_RAIL, req);
+      const wantAsset = parseAssetId(asset.assetId);
       if (!wantAsset) {
         throw new Error(
-          `${CROSS_ASSET_RAIL}: ${asset2.assetId} is not an asset id (expected 34 bytes of hex)`
+          `${CROSS_ASSET_RAIL}: ${asset.assetId} is not an asset id (expected 34 bytes of hex)`
         );
       }
-      const planned = await planFor(asset2);
+      const planned = await planFor(asset);
       if (!planned) {
-        throw new Error(`${CROSS_ASSET_RAIL}: no market swaps BTC into ${asset2.assetId}`);
+        throw new Error(`${CROSS_ASSET_RAIL}: no market swaps BTC into ${asset.assetId}`);
       }
       if (planned.error) {
         throw new Error(
-          `${CROSS_ASSET_RAIL}: cannot swap into ${asset2.assetId} \u2014 ${planned.error}`
+          `${CROSS_ASSET_RAIL}: cannot swap into ${asset.assetId} \u2014 ${planned.error}`
         );
       }
       const { plan } = planned;
@@ -2278,7 +1549,7 @@ function crossAssetRail(deps) {
         fee: depositSats,
         total: depositSats + carrier,
         assets: {
-          delivered: asset2,
+          delivered: asset,
           spent: { assetId: BTC_ASSET_ID, amount: plan.deposit.atomic }
         },
         meta: {
@@ -2288,7 +1559,7 @@ function crossAssetRail(deps) {
         },
         send: async () => makeHandle3(CROSS_ASSET_RAIL, async (emit) => {
           const offer = await createOffer(ctx.wallet, deps.arkServerUrl, {
-            wantAmount: asset2.amount,
+            wantAmount: asset.amount,
             wantAsset,
             ...deps.emulatorPubkey ? { emulatorPubkey: deps.emulatorPubkey } : {}
           });
@@ -2298,7 +1569,7 @@ function crossAssetRail(deps) {
             address: offer.address,
             swapPkScript: offer.swapPkScript,
             depositSats,
-            asset: asset2,
+            asset,
             payTo,
             plan
           };
@@ -2315,7 +1586,7 @@ function crossAssetRail(deps) {
           const txid = await ctx.wallet.send({
             address: payTo,
             amount: carrier,
-            assets: [asset2]
+            assets: [asset]
           });
           await deps.persist({ ...swap, phase: "settled", txid });
           const result = {
@@ -2332,10 +1603,10 @@ function crossAssetRail(deps) {
 }
 
 // src/reveal.ts
-import { base64 as base643, hex as hex9 } from "@scure/base";
+import { base64 as base643, hex as hex7 } from "@scure/base";
 import { ripemd160 } from "@noble/hashes/legacy.js";
-import { sha256 as sha2562 } from "@noble/hashes/sha2.js";
-import { ArkAddress as ArkAddress4 } from "@arkade-os/sdk";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { ArkAddress as ArkAddress3 } from "@arkade-os/sdk";
 var CovclaimdRevealError = class extends Error {
   name = "CovclaimdRevealError";
   status;
@@ -2352,7 +1623,7 @@ var decodeKey = (value, field) => {
   if (typeof value !== "string") throw new Error(`covclaimd info: ${field} is not a string`);
   let bytes;
   try {
-    bytes = hex9.decode(value);
+    bytes = hex7.decode(value);
   } catch {
     throw new Error(`covclaimd info: ${field} is not hex`);
   }
@@ -2412,7 +1683,7 @@ var covclaimdClient = (baseUrl, options = {}) => {
       const body = await readJson("info", response);
       return {
         covclaimdPubkey: decodeKey(body?.covclaimd_pub_key, "covclaimd_pub_key"),
-        emulatorPubkey: hex9.encode(decodeKey(body?.emulator_pub_key, "emulator_pub_key"))
+        emulatorPubkey: hex7.encode(decodeKey(body?.emulator_pub_key, "emulator_pub_key"))
       };
     },
     async reveal(params) {
@@ -2434,15 +1705,15 @@ function revealFieldsFromScript(script) {
   }
   return {
     arkadeScript: base643.encode(script.nonInteractiveClaimArkadeScript),
-    taptree: hex9.encode(script.encode())
+    taptree: hex7.encode(script.encode())
   };
 }
 async function revealClaimPacket(client, input) {
   const fields = revealFieldsFromScript(input.script);
-  if (hex9.encode(ArkAddress4.decode(input.address).pkScript) !== hex9.encode(input.script.pkScript)) {
+  if (hex7.encode(ArkAddress3.decode(input.address).pkScript) !== hex7.encode(input.script.pkScript)) {
     throw new Error("address does not belong to this covenant");
   }
-  if (hex9.encode(ripemd160(sha2562(input.preimage))) !== hex9.encode(input.script.options.preimageHash)) {
+  if (hex7.encode(ripemd160(sha256(input.preimage))) !== hex7.encode(input.script.options.preimageHash)) {
     throw new Error("preimage does not match the covenant's payment hash");
   }
   const { ciphertext } = await sealClaimPacket({
@@ -2454,9 +1725,9 @@ async function revealClaimPacket(client, input) {
 }
 
 // src/claim.ts
-import { hex as hex11 } from "@scure/base";
+import { hex as hex9 } from "@scure/base";
 import { ripemd160 as ripemd1602 } from "@noble/hashes/legacy.js";
-import { sha256 as sha2564 } from "@noble/hashes/sha2.js";
+import { sha256 as sha2563 } from "@noble/hashes/sha2.js";
 import {
   CSVMultisigTapscript as CSVMultisigTapscript2,
   claimWithPreimageIdentity,
@@ -2464,8 +1735,8 @@ import {
 } from "@arkade-os/sdk";
 
 // src/refund.ts
-import { base64 as base644, hex as hex10 } from "@scure/base";
-import { sha256 as sha2563 } from "@noble/hashes/sha2.js";
+import { base64 as base644, hex as hex8 } from "@scure/base";
+import { sha256 as sha2562 } from "@noble/hashes/sha2.js";
 import {
   CSVMultisigTapscript,
   ConditionWitness,
@@ -2522,7 +1793,7 @@ var LockupNeedsRecoveryError = class extends Error {
   }
 };
 async function findLockupVtxos(indexer, swapPkScript) {
-  const scripts = [hex10.encode(swapPkScript)];
+  const scripts = [hex8.encode(swapPkScript)];
   const [spendable, recoverable] = await Promise.all([
     indexer.getVtxos({ scripts, spendableOnly: true }),
     indexer.getVtxos({ scripts, recoverableOnly: true })
@@ -2548,13 +1819,13 @@ async function findLockupVtxos(indexer, swapPkScript) {
   }
   return out;
 }
-var hashesTo = (candidate, paymentHash) => hex10.encode(sha2563(candidate)) === paymentHash;
+var hashesTo = (candidate, paymentHash) => hex8.encode(sha2562(candidate)) === paymentHash;
 var candidateWitnessItems = (tx, inputIndex) => [
   ...getArkPsbtFields(tx, inputIndex, ConditionWitness).flat(),
   ...tx.getInput(inputIndex).finalScriptWitness ?? []
 ];
 async function readLockupFate(indexer, input) {
-  const { vtxos } = await indexer.getVtxos({ scripts: [hex10.encode(input.swapPkScript)] });
+  const { vtxos } = await indexer.getVtxos({ scripts: [hex8.encode(input.swapPkScript)] });
   const all = vtxos ?? [];
   if (all.length === 0) return { fate: "unknown" };
   const exited = all.filter((vtxo) => vtxo.isUnrolled && !hasTerminalSpend(vtxo));
@@ -2589,7 +1860,7 @@ async function readLockupFate(indexer, input) {
     for (let i = 0; i < tx.inputsLength; i++) {
       const spent = tx.getInput(i);
       if (!spent.txid) continue;
-      const txid = hex10.encode(spent.txid);
+      const txid = hex8.encode(spent.txid);
       if (!all.some((vtxo) => vtxo.txid === txid && vtxo.vout === spent.index)) continue;
       for (const candidate of candidateWitnessItems(tx, i)) {
         if (hashesTo(candidate, input.paymentHash)) {
@@ -2618,7 +1889,7 @@ async function pushRefundWithoutReceiver(ark, input) {
   const info = await ark.getInfo();
   let serverUnrollScript;
   try {
-    serverUnrollScript = CSVMultisigTapscript.decode(hex10.decode(info.checkpointTapscript));
+    serverUnrollScript = CSVMultisigTapscript.decode(hex8.decode(info.checkpointTapscript));
   } catch {
     throw new Error("invalid checkpointTapscript from the Arkade server");
   }
@@ -2744,13 +2015,13 @@ async function pushClaim(ark, input) {
     }
   }
   const committed = input.script.options.preimageHash;
-  if (hex11.encode(ripemd1602(sha2564(input.preimage))) !== hex11.encode(committed)) {
+  if (hex9.encode(ripemd1602(sha2563(input.preimage))) !== hex9.encode(committed)) {
     throw new Error("preimage does not match the covenant's payment hash");
   }
   const info = await ark.getInfo();
   let serverUnrollScript;
   try {
-    serverUnrollScript = CSVMultisigTapscript2.decode(hex11.decode(info.checkpointTapscript));
+    serverUnrollScript = CSVMultisigTapscript2.decode(hex9.decode(info.checkpointTapscript));
   } catch {
     throw new Error("invalid checkpointTapscript from the Arkade server");
   }
@@ -2869,7 +2140,7 @@ function arkadeRefunder(deps) {
 }
 
 // src/swapManager.ts
-import { hex as hex12 } from "@scure/base";
+import { hex as hex10 } from "@scure/base";
 import {
   isContractVtxoEvent as isContractVtxoEvent2
 } from "@arkade-os/sdk";
@@ -3320,7 +2591,7 @@ var RfqSwapManager = class {
   // ── internals ────────────────────────────────────────────────────────────
   track(swap) {
     this.monitored.set(swap.rfqId, swap);
-    this.byLockupScript.set(hex12.encode(swap.lockupPkScript), swap);
+    this.byLockupScript.set(hex10.encode(swap.lockupPkScript), swap);
   }
   /** Drops the swap from BOTH indexes. The event index is the one that stops
    * a late event finding a swap that is gone; `pollSwap`'s own
@@ -3329,7 +2600,7 @@ var RfqSwapManager = class {
    * them from silently re-driving a cancelled swap. */
   untrack(rfqId) {
     const swap = this.monitored.get(rfqId);
-    if (swap) this.byLockupScript.delete(hex12.encode(swap.lockupPkScript));
+    if (swap) this.byLockupScript.delete(hex10.encode(swap.lockupPkScript));
     this.monitored.delete(rfqId);
     this.refundRefused.delete(rfqId);
     this.lastClaimError.delete(rfqId);
@@ -3392,7 +2663,7 @@ var RfqSwapManager = class {
     if (!lockup) {
       try {
         const [existing] = await contracts.getContracts({
-          script: hex12.encode(swap.lockupPkScript)
+          script: hex10.encode(swap.lockupPkScript)
         });
         if (existing) {
           this.registered.set(swap.rfqId, true);
@@ -3411,13 +2682,13 @@ var RfqSwapManager = class {
       );
       return;
     }
-    const script = hex12.encode(lockup.script.pkScript);
-    if (script !== hex12.encode(swap.lockupPkScript)) {
+    const script = hex10.encode(lockup.script.pkScript);
+    if (script !== hex10.encode(swap.lockupPkScript)) {
       this.registered.set(swap.rfqId, false);
       this.emitFailed(
         swap,
         new Error(
-          `swap ${swap.rfqId} lockup script ${script} does not match its lockupPkScript ${hex12.encode(swap.lockupPkScript)}`
+          `swap ${swap.rfqId} lockup script ${script} does not match its lockupPkScript ${hex10.encode(swap.lockupPkScript)}`
         )
       );
       return;
@@ -3436,7 +2707,7 @@ var RfqSwapManager = class {
    * script for its whole life. Best-effort — the swap is over either way. */
   retireContract(swap) {
     if (!this.deps.contracts || !this.registered.get(swap.rfqId)) return;
-    void this.deps.contracts.setContractWatchState(hex12.encode(swap.lockupPkScript), "retained").catch((error) => this.emitFailed(swap, error));
+    void this.deps.contracts.setContractWatchState(hex10.encode(swap.lockupPkScript), "retained").catch((error) => this.emitFailed(swap, error));
   }
   arm() {
     if (!this.running) return;
@@ -3636,6 +2907,21 @@ var RfqSwapManager = class {
     });
     if (action === "claim" && phase.phase === "claimable") {
       if (swap.claimTxid) return "continue";
+      if (!Number.isSafeInteger(swap.expectedAmount) || swap.expectedAmount <= 0) {
+        this.block(
+          swap,
+          `expectedAmount is not a positive number of sats (${String(swap.expectedAmount)}), so the funded value cannot be checked \u2014 refusing to publish the preimage`
+        );
+        return "handled";
+      }
+      const filled = Number(phase.utxo.amount);
+      if (!Number.isFinite(filled) || filled < swap.expectedAmount) {
+        this.block(
+          swap,
+          `fill holds ${filled} sats, below the agreed ${swap.expectedAmount} \u2014 refusing to publish the preimage`
+        );
+        return "handled";
+      }
       if (this.callbacks && !this.callbacks.claimOnchain) {
         this.block(
           swap,
@@ -3689,6 +2975,8 @@ var RfqSwapManager = class {
       if (pushed) {
         swap.refundArkTxid = pushed.arkTxid;
         this.touch(swap);
+      } else if (now < swap.refundLocktime + REFUND_MTP_LAG_SECONDS) {
+        return;
       }
       this.setState(swap, "refunded");
       this.emitAction(swap, "refundArkade");
@@ -3910,9 +3198,9 @@ var outpointKey = (vtxo) => `${vtxo.txid}:${vtxo.vout}`;
 
 // src/activity.ts
 import {
-  ArkAddress as ArkAddress5
+  ArkAddress as ArkAddress4
 } from "@arkade-os/sdk";
-import { hex as hex13 } from "@scure/base";
+import { hex as hex11 } from "@scure/base";
 var LABELS = {
   lightning_send: "Lightning send",
   lightning_receive: "Lightning receive",
@@ -3987,7 +3275,7 @@ async function activityInputOf(record, indexer) {
 async function lockupTxids(indexer, record, wantFunding) {
   let script;
   try {
-    script = hex13.encode(ArkAddress5.decode(record.lockupAddress).pkScript);
+    script = hex11.encode(ArkAddress4.decode(record.lockupAddress).pkScript);
   } catch {
     return [];
   }
@@ -4058,6 +3346,7 @@ export {
   arkadeAssetLeg,
   arkadeRefunder,
   arkadeSwapRequest,
+  assertArkadeFundable,
   assertFundable,
   assertReceivable,
   awaitLockupFunding,
@@ -4066,6 +3355,7 @@ export {
   buildHtlcClaim,
   buildHtlcRefund,
   cancelOffer,
+  canonicalAssetAmount,
   chainSourceFrom,
   claimOnchainFill,
   claimPacketShape,
@@ -4106,6 +3396,8 @@ export {
   newPreimage,
   newRfqId,
   nextOnchainAction,
+  normalizeMakerPkScript,
+  normalizeMakerPublicKey,
   offerTermsFromQuote,
   offerVtxoScript,
   onchainHtlcScript,
@@ -4123,6 +3415,7 @@ export {
   registerAssetSwapRestore,
   registerLockupContract,
   relayTransport,
+  requestArkadeSwap,
   requestLightningReceive,
   requestLightningSend,
   requestOnchainReceive,
@@ -4160,6 +3453,7 @@ export {
   updateRfqSwapRecord,
   validatePlan,
   verifyLockupAddress,
+  verifyOfferAddress,
   verifyReceiveInvoice,
   watchOfferSwaps
 };