@arkade-os/swap 0.0.3 → 0.0.5

package/dist/index.cjs

@@ -53,20 +53,20 @@ __export(index_exports, {
   ONCHAIN_RECEIVE_PAIR: () => ONCHAIN_RECEIVE_PAIR,
   ONCHAIN_SECONDS_PER_BLOCK: () => ONCHAIN_SECONDS_PER_BLOCK,
   ONCHAIN_SEND_PAIR: () => ONCHAIN_SEND_PAIR,
+  PreimageNotRecoverableError: () => PreimageNotRecoverableError,
   QUOTE_OPTIONS: () => QUOTE_OPTIONS,
   REFUND_MTP_LAG_SECONDS: () => REFUND_MTP_LAG_SECONDS,
-  RFQ_PREIMAGE_TAG: () => RFQ_PREIMAGE_TAG,
   RFQ_RESOLVED_STATES: () => RFQ_RESOLVED_STATES,
   RFQ_SWAP_TERMINAL_STATES: () => RFQ_SWAP_TERMINAL_STATES,
   RFQ_TERMINAL_STATES: () => RFQ_TERMINAL_STATES,
   RefundNotLocallyPossibleError: () => RefundNotLocallyPossibleError,
   RfqSwapManager: () => RfqSwapManager,
+  SOLO_REFUND_HEADROOM_SECONDS: () => SOLO_REFUND_HEADROOM_SECONDS,
   SWAP_LOCKUP_CONTRACT_KIND: () => SWAP_LOCKUP_CONTRACT_KIND,
   SWAP_LOCKUP_CONTRACT_LABEL: () => SWAP_LOCKUP_CONTRACT_LABEL,
   SWAP_LOCKUP_CONTRACT_TYPE: () => SWAP_LOCKUP_CONTRACT_TYPE,
   SwapRefusal: () => SwapRefusal,
   addAssetSwap: () => addAssetSwap,
-  adoptSwapDescriptor: () => adoptSwapDescriptor,
   arkadeSwapRequest: () => arkadeSwapRequest,
   assertFundable: () => assertFundable,
   assertReceivable: () => assertReceivable,
@@ -75,7 +75,6 @@ __export(index_exports, {
   awaitRfqResolution: () => awaitRfqResolution,
   buildHtlcClaim: () => buildHtlcClaim,
   buildHtlcRefund: () => buildHtlcRefund,
-  buildPreimageMessage: () => buildPreimageMessage,
   cancelOffer: () => cancelOffer,
   claimOnchainFill: () => claimOnchainFill,
   claimReceiveLockup: () => claimReceiveLockup,
@@ -87,8 +86,6 @@ __export(index_exports, {
   deriveLightningReceive: () => deriveLightningReceive,
   deriveOnchainReceive: () => deriveOnchainReceive,
   deriveOnchainSend: () => deriveOnchainSend,
-  derivePreimage: () => derivePreimage,
-  deriveSwapSecrets: () => deriveSwapSecrets,
   discoverMarkets: () => discoverMarkets,
   encodeOffer: () => encodeOffer,
   extractPreimage: () => extractPreimage,
@@ -97,7 +94,6 @@ __export(index_exports, {
   getAssetSwaps: () => getAssetSwaps,
   getAssetSwapsOrThrow: () => getAssetSwapsOrThrow,
   httpTransport: () => httpTransport,
-  isDeterministicSigner: () => isDeterministicSigner,
   isRfqSwapTerminal: () => isRfqSwapTerminal,
   isRfqTerminal: () => isRfqTerminal,
   lightningReceiveRequest: () => lightningReceiveRequest,
@@ -113,10 +109,9 @@ __export(index_exports, {
   onchainReceiveRequest: () => onchainReceiveRequest,
   onchainSendRequest: () => onchainSendRequest,
   paymentHashOf: () => paymentHashOf,
-  preimageForRfqSecrets: () => preimageForRfqSecrets,
+  preimageForSwapRecord: () => preimageForSwapRecord,
   pushClaim: () => pushClaim,
   pushRefundWithoutReceiver: () => pushRefundWithoutReceiver,
-  randomSwapSecrets: () => randomSwapSecrets,
   readLockupFate: () => readLockupFate,
   receiveVtxoScript: () => receiveVtxoScript,
   refundIfUnresolved: () => refundIfUnresolved,
@@ -129,15 +124,12 @@ __export(index_exports, {
   restoreAssetSwaps: () => restoreAssetSwaps,
   retireSettledOfferContracts: () => retireSettledOfferContracts,
   rfqPair: () => rfqPair,
-  rfqSecretsOfRecord: () => rfqSecretsOfRecord,
-  rfqSecretsToRecord: () => rfqSecretsToRecord,
   sealClaimPacket: () => sealClaimPacket,
-  senderIdentityForRfqSecrets: () => senderIdentityForRfqSecrets,
   senderIdentityForSwapRecord: () => senderIdentityForSwapRecord,
-  senderPubkeyForRfqSecrets: () => senderPubkeyForRfqSecrets,
   spendTxidsOf: () => spendTxidsOf,
   spendUpdate: () => spendUpdate,
   swapPrograms: () => swapPrograms,
+  swapSecretsToRecord: () => swapSecretsToRecord,
   unilateralClaimDelay: () => unilateralClaimDelay,
   unilateralRefundDelay: () => unilateralRefundDelay,
   unilateralRefundWithoutReceiverDelay: () => unilateralRefundWithoutReceiverDelay,
@@ -151,9 +143,9 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/offer.ts
-var import_base = require("@scure/base");
+var import_base2 = require("@scure/base");
 var import_utils = require("@scure/btc-signer/utils.js");
-var import_sdk = require("@arkade-os/sdk");
+var import_sdk2 = require("@arkade-os/sdk");
 
 // src/swap-want-asset.program.json
 var swap_want_asset_program_default = {
@@ -283,6 +275,9 @@ async function retireSettledOfferContracts(manager, swaps) {
 }
 
 // src/store.ts
+var import_base = require("@scure/base");
+var import_sha2 = require("@noble/hashes/sha2.js");
+var import_sdk = require("@arkade-os/sdk");
 var BTC_ASSET_ID = "btc";
 var byNewest = (a, b) => b.createdAt - a.createdAt;
 var getAssetSwapsOrThrow = async (repository) => {
@@ -335,11 +330,68 @@ var updateAssetSwapBestEffort = async (repository, id, changes) => {
     return { swaps, persisted: false };
   }
 };
+var swapSecretsToRecord = (secrets) => ({
+  signingDescriptor: secrets.descriptor,
+  ..."mustPersistPreimage" in secrets && secrets.mustPersistPreimage ? { preimageHex: import_base.hex.encode(secrets.preimage) } : {},
+  ..."preimageSalt" in secrets && secrets.preimageSalt ? { preimageSaltHex: import_base.hex.encode(secrets.preimageSalt) } : {}
+});
+var decodeHex32 = (value, field) => {
+  const bytes = import_base.hex.decode(value);
+  if (bytes.length !== 32) {
+    throw new Error(`${field} must be 32 bytes, got ${bytes.length}`);
+  }
+  return bytes;
+};
+var PreimageNotRecoverableError = class extends Error {
+  constructor(reason, message, options) {
+    super(message, options);
+    this.reason = reason;
+  }
+  reason;
+  name = "PreimageNotRecoverableError";
+};
+var preimageForSwapRecord = async (wallet, record) => {
+  if (!record.signingDescriptor) {
+    throw new PreimageNotRecoverableError(
+      "no-secrets",
+      "this swap record carries no signing descriptor"
+    );
+  }
+  let stored;
+  let salt;
+  try {
+    stored = record.preimageHex ? decodeHex32(record.preimageHex, "preimageHex") : void 0;
+    salt = record.preimageSaltHex ? decodeHex32(record.preimageSaltHex, "preimageSaltHex") : void 0;
+  } catch (cause) {
+    throw new PreimageNotRecoverableError(
+      "malformed-record",
+      `this swap record's secrets projection is unreadable: ${String(cause)}`,
+      { cause }
+    );
+  }
+  let preimage;
+  try {
+    preimage = await (0, import_sdk.contractPreimage)(wallet, record.signingDescriptor, { stored, salt });
+  } catch (cause) {
+    throw new PreimageNotRecoverableError(
+      "not-derivable",
+      `this wallet cannot produce the preimage for ${record.signingDescriptor}`,
+      { cause }
+    );
+  }
+  if (record.paymentHash && import_base.hex.encode((0, import_sha2.sha256)(preimage)) !== record.paymentHash.toLowerCase()) {
+    throw new PreimageNotRecoverableError(
+      "hash-mismatch",
+      "the derived preimage does not match this swap's payment hash: wrong wallet, or a tampered salt"
+    );
+  }
+  return preimage;
+};
 
 // src/offer.ts
 var swapPrograms = {
-  wantAsset: import_sdk.arkade.parseArtifact(swap_want_asset_program_default),
-  wantBtc: import_sdk.arkade.parseArtifact(swap_want_btc_program_default)
+  wantAsset: import_sdk2.arkade.parseArtifact(swap_want_asset_program_default),
+  wantBtc: import_sdk2.arkade.parseArtifact(swap_want_btc_program_default)
 };
 function swapProgramBinding(offer, serverPubkey) {
   if (offer.makerPkScript.length !== FIELDS.makerPkScript.width) {
@@ -367,7 +419,7 @@ function swapProgramBinding(offer, serverPubkey) {
 }
 function offerVtxoScript(offer, serverPubkey) {
   const { program, args, keys } = swapProgramBinding(offer, serverPubkey);
-  return new import_sdk.arkade.ArkadeProgramScript(program, args, keys);
+  return new import_sdk2.arkade.ArkadeProgramScript(program, args, keys);
 }
 var OFFER_PACKET_TYPE = 3;
 var FIELDS = {
@@ -449,8 +501,8 @@ function decodeOffer(data) {
   return {
     swapPkScript: need("swapPkScript"),
     wantAmount: new DataView(amount.buffer, amount.byteOffset).getBigUint64(0, false),
-    ...fields.wantAsset && { wantAsset: import_sdk.asset.AssetId.fromBytes(fields.wantAsset) },
-    ...fields.offerAsset && { offerAsset: import_sdk.asset.AssetId.fromBytes(fields.offerAsset) },
+    ...fields.wantAsset && { wantAsset: import_sdk2.asset.AssetId.fromBytes(fields.wantAsset) },
+    ...fields.offerAsset && { offerAsset: import_sdk2.asset.AssetId.fromBytes(fields.offerAsset) },
     makerPkScript: need("makerPkScript"),
     makerPublicKey: need("makerPublicKey"),
     emulatorPubkey: need("emulatorPubkey")
@@ -461,45 +513,45 @@ var OFFER_CONTRACT_KIND = "asset-swap-offer";
 async function registerOfferContract(wallet, arkServerUrl, network, binding, serverPubkey, expectedPkScript) {
   const { program, args, keys } = swapProgramBinding(binding, serverPubkey);
   const contractManager = await wallet.getContractManager();
-  const client = await import_sdk.arkade.Arkade.connect({
-    arkade: new import_sdk.RestArkProvider(arkServerUrl),
-    indexer: new import_sdk.RestIndexerProvider(arkServerUrl),
+  const client = await import_sdk2.arkade.Arkade.connect({
+    arkade: new import_sdk2.RestArkProvider(arkServerUrl),
+    indexer: new import_sdk2.RestIndexerProvider(arkServerUrl),
     identity: wallet.identity,
     // without this the row's `address` would be derived against the SDK's
     // default network while its script is right — a row that disagrees with
     // the address the user is about to fund
-    network: (0, import_sdk.getNetwork)(network),
+    network: (0, import_sdk2.getNetwork)(network),
     contractManager
   });
-  const contract = new import_sdk.arkade.ArkadeContract(client, program, args, keys);
-  if (import_base.hex.encode(contract.pkScript) !== import_base.hex.encode(expectedPkScript)) {
+  const contract = new import_sdk2.arkade.ArkadeContract(client, program, args, keys);
+  if (import_base2.hex.encode(contract.pkScript) !== import_base2.hex.encode(expectedPkScript)) {
     throw new Error("derived covenant does not match the offer's swapPkScript");
   }
   await contract.register({
     label: OFFER_CONTRACT_LABEL,
     metadata: { genericallySpendable: false, kind: OFFER_CONTRACT_KIND }
   });
-  await promoteOfferContract(contractManager, import_base.hex.encode(expectedPkScript));
+  await promoteOfferContract(contractManager, import_base2.hex.encode(expectedPkScript));
 }
 async function createOffer(wallet, arkServerUrl, params) {
   if (Boolean(params.wantAsset) === Boolean(params.offerAsset)) {
     throw new Error("set exactly one of wantAsset (BTC->asset) or offerAsset (asset->BTC)");
   }
   const [info, makerAddress, makerPublicKey] = await Promise.all([
-    new import_sdk.RestArkProvider(arkServerUrl).getInfo(),
+    new import_sdk2.RestArkProvider(arkServerUrl).getInfo(),
     wallet.getAddress(),
     wallet.identity.xOnlyPublicKey()
   ]);
-  const serverPubKey = import_base.hex.decode((0, import_sdk.toXOnlySignerHex)(info.signerPubkey));
-  const network = (0, import_sdk.getNetwork)(info.network);
-  const emuKey = import_base.hex.decode(
-    (0, import_sdk.toXOnlySignerHex)((0, import_sdk.resolveEmulatorPubkey)(network, params.emulatorPubkey))
+  const serverPubKey = import_base2.hex.decode((0, import_sdk2.toXOnlySignerHex)(info.signerPubkey));
+  const network = (0, import_sdk2.getNetwork)(info.network);
+  const emuKey = import_base2.hex.decode(
+    (0, import_sdk2.toXOnlySignerHex)((0, import_sdk2.resolveEmulatorPubkey)(network, params.emulatorPubkey))
   );
   const binding = {
     wantAmount: params.wantAmount,
     wantAsset: params.wantAsset,
     offerAsset: params.offerAsset,
-    makerPkScript: import_sdk.ArkAddress.decode(makerAddress).pkScript,
+    makerPkScript: import_sdk2.ArkAddress.decode(makerAddress).pkScript,
     makerPublicKey,
     emulatorPubkey: emuKey
   };
@@ -515,7 +567,7 @@ async function createOffer(wallet, arkServerUrl, params) {
   );
   const payload = encodeOffer(offer);
   return {
-    offerHex: import_base.hex.encode(payload),
+    offerHex: import_base2.hex.encode(payload),
     extension: { type: OFFER_PACKET_TYPE, payload },
     // VtxoScript.address owns address construction; assembling an ArkAddress
     // from tweakedPublicKey here would silently miss any future step it gains
@@ -525,11 +577,11 @@ async function createOffer(wallet, arkServerUrl, params) {
 }
 async function cancelOffer(wallet, arkServerUrl, offerHex, opts) {
   const { repository, fundingTxid, swapAddress } = opts;
-  const offer = decodeOffer(import_base.hex.decode(offerHex));
+  const offer = decodeOffer(import_base2.hex.decode(offerHex));
   const contractManager = await wallet.getContractManager();
-  const client = await import_sdk.arkade.Arkade.connect({
-    arkade: new import_sdk.RestArkProvider(arkServerUrl),
-    indexer: new import_sdk.RestIndexerProvider(arkServerUrl),
+  const client = await import_sdk2.arkade.Arkade.connect({
+    arkade: new import_sdk2.RestArkProvider(arkServerUrl),
+    indexer: new import_sdk2.RestIndexerProvider(arkServerUrl),
     identity: wallet.identity,
     // registered offers resolve their VTXOs from the contract repository
     // instead of a direct indexer query; the indexer above stays as the
@@ -539,15 +591,15 @@ async function cancelOffer(wallet, arkServerUrl, offerHex, opts) {
     // script and the payout script comes from wallet.getAddress(), so the
     // client's network (which only shapes address derivation) is unused here
   });
-  const serverKey = swapAddress ? import_sdk.ArkAddress.decode(swapAddress).serverPubKey : client.serverKey;
+  const serverKey = swapAddress ? import_sdk2.ArkAddress.decode(swapAddress).serverPubKey : client.serverKey;
   const { program, args, keys } = swapProgramBinding(offer, serverKey);
-  const rebuilt = new import_sdk.arkade.ArkadeProgramScript(program, args, keys);
-  if (import_base.hex.encode(rebuilt.pkScript) !== import_base.hex.encode(offer.swapPkScript)) {
+  const rebuilt = new import_sdk2.arkade.ArkadeProgramScript(program, args, keys);
+  if (import_base2.hex.encode(rebuilt.pkScript) !== import_base2.hex.encode(offer.swapPkScript)) {
     throw new Error(
       "rebuilt covenant does not match the offer's swapPkScript \u2014 the server signing key has likely rotated since funding; pass swapAddress (the funded address) to pin the original key"
     );
   }
-  const contract = new import_sdk.arkade.ArkadeContract(client, program, args, keys);
+  const contract = new import_sdk2.arkade.ArkadeContract(client, program, args, keys);
   const [vtxos, makerAddress] = await Promise.all([contract.getUtxos(), wallet.getAddress()]);
   if (!fundingTxid && vtxos.length > 1) {
     throw new Error(
@@ -556,7 +608,7 @@ async function cancelOffer(wallet, arkServerUrl, offerHex, opts) {
   }
   const vtxo = fundingTxid ? vtxos.find((v) => v.txid === fundingTxid) : vtxos[0];
   if (!vtxo) throw new Error("no spendable VTXO at the swap address");
-  const makerPkScript = import_sdk.ArkAddress.decode(makerAddress).pkScript;
+  const makerPkScript = import_sdk2.ArkAddress.decode(makerAddress).pkScript;
   const cancel = contract.functions.cancel().from({ txid: vtxo.txid, vout: vtxo.vout, value: vtxo.value }).to(makerPkScript, BigInt(vtxo.value));
   for (const a of vtxo.assets ?? []) {
     cancel.withAsset({
@@ -575,7 +627,7 @@ async function cancelOffer(wallet, arkServerUrl, offerHex, opts) {
       spentTxid: txid
     });
     if (persisted) {
-      await retireOfferContract(contractManager, swaps, import_base.hex.encode(offer.swapPkScript));
+      await retireOfferContract(contractManager, swaps, import_base2.hex.encode(offer.swapPkScript));
     }
   }
   return txid;
@@ -583,7 +635,7 @@ async function cancelOffer(wallet, arkServerUrl, offerHex, opts) {
 
 // src/markets.ts
 var import_solver_discovery = require("@arkade-os/solver-discovery");
-var import_sdk2 = require("@arkade-os/sdk");
+var import_sdk3 = require("@arkade-os/sdk");
 var QUOTE_OPTIONS = { safetyBps: 0 };
 var makeCachedFeedFetch = (ttlMs = 3e4, fetchImpl = fetch) => {
   const cache = /* @__PURE__ */ new Map();
@@ -700,7 +752,7 @@ var validatePlan = (plan, giveBalance, dust) => {
   const receiveIsBtc = plan.receive.asset.id === BTC_ASSET_ID;
   if (depositIsBtc || receiveIsBtc) {
     const btcSide = depositIsBtc ? plan.deposit.atomic : plan.receive.atomic;
-    if ((0, import_sdk2.isSubdust)(btcSide, dust)) return "below-dust";
+    if ((0, import_sdk3.isSubdust)(btcSide, dust)) return "below-dust";
   }
   return void 0;
 };
@@ -708,7 +760,7 @@ var validatePlan = (plan, giveBalance, dust) => {
 // src/repository.ts
 var marketsCacheKey = (network, registry) => `arkade-intents-markets-${network}-${registry}`;
 var InMemoryAssetSwapRepository = class {
-  version = 1;
+  version = 2;
   swaps = /* @__PURE__ */ new Map();
   scanned = /* @__PURE__ */ new Set();
   markets = /* @__PURE__ */ new Map();
@@ -740,7 +792,7 @@ var InMemoryAssetSwapRepository = class {
 };
 
 // src/indexedDbRepository.ts
-var import_sdk3 = require("@arkade-os/sdk");
+var import_sdk4 = require("@arkade-os/sdk");
 var DEFAULT_DB_NAME = "arkade-intents";
 var DB_VERSION = 1;
 var STORE_SWAPS = "swaps";
@@ -770,7 +822,7 @@ var IndexedDbAssetSwapRepository = class {
     this.dbName = dbName;
   }
   dbName;
-  version = 1;
+  version = 2;
   // the promise, not the resolved database: openDatabase bumps a refcount on
   // every call including cache hits, while dispose closes once, so two
   // concurrent first calls would strand the refcount above zero and leak the
@@ -778,7 +830,7 @@ var IndexedDbAssetSwapRepository = class {
   // can be retried rather than cached forever.
   dbPromise = null;
   ensureDb() {
-    return this.dbPromise ??= (0, import_sdk3.openDatabase)(this.dbName, DB_VERSION, initDatabase).catch(
+    return this.dbPromise ??= (0, import_sdk4.openDatabase)(this.dbName, DB_VERSION, initDatabase).catch(
       (err) => {
         this.dbPromise = null;
         throw err;
@@ -835,14 +887,14 @@ var IndexedDbAssetSwapRepository = class {
   }
   async [Symbol.asyncDispose]() {
     if (!this.dbPromise) return;
-    await (0, import_sdk3.closeDatabase)(this.dbName);
+    await (0, import_sdk4.closeDatabase)(this.dbName);
     this.dbPromise = null;
   }
 };
 
 // src/restore.ts
-var import_base2 = require("@scure/base");
-var import_sdk4 = require("@arkade-os/sdk");
+var import_base3 = require("@scure/base");
+var import_sdk5 = require("@arkade-os/sdk");
 var TXS_PER_REQUEST = 50;
 async function fetchParsedTxs(indexer, txids) {
   const parsedByTxid = /* @__PURE__ */ new Map();
@@ -858,7 +910,7 @@ async function fetchParsedTxs(indexer, txids) {
     if (result.status !== "fulfilled") continue;
     for (const psbt of result.value) {
       try {
-        const parsed = import_sdk4.Transaction.fromPSBT(import_base2.base64.decode(psbt));
+        const parsed = import_sdk5.Transaction.fromPSBT(import_base3.base64.decode(psbt));
         parsedByTxid.set(parsed.id, parsed);
       } catch {
       }
@@ -873,7 +925,7 @@ function classifySpend(offer, serverPubkey, spendTx, deposit) {
   let leaves;
   try {
     const script = offerVtxoScript(offer, serverPubkey);
-    if (import_base2.hex.encode(script.pkScript) !== import_base2.hex.encode(offer.swapPkScript)) return "indeterminate";
+    if (import_base3.hex.encode(script.pkScript) !== import_base3.hex.encode(offer.swapPkScript)) return "indeterminate";
     leaves = {
       cancel: script.functionByName("cancel")?.leafScript,
       fulfill: script.functionByName("fulfill")?.leafScript
@@ -884,11 +936,11 @@ function classifySpend(offer, serverPubkey, spendTx, deposit) {
   for (let i = 0; i < spendTx.inputsLength; i++) {
     const input = spendTx.getInput(i);
     if (!input.txid || input.index !== deposit.vout) continue;
-    if (import_base2.hex.encode(input.txid) !== deposit.txid) continue;
+    if (import_base3.hex.encode(input.txid) !== deposit.txid) continue;
     for (const leaf of input.tapLeafScript ?? []) {
-      const spent = import_base2.hex.encode((0, import_sdk4.scriptFromTapLeafScript)(leaf));
-      if (leaves.cancel && spent === import_base2.hex.encode(leaves.cancel)) return "cancelled";
-      if (leaves.fulfill && spent === import_base2.hex.encode(leaves.fulfill)) return "fulfilled";
+      const spent = import_base3.hex.encode((0, import_sdk5.scriptFromTapLeafScript)(leaf));
+      if (leaves.cancel && spent === import_base3.hex.encode(leaves.cancel)) return "cancelled";
+      if (leaves.fulfill && spent === import_base3.hex.encode(leaves.fulfill)) return "fulfilled";
     }
   }
   return "indeterminate";
@@ -917,19 +969,19 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
     if (!fundingTx) continue;
     fetchedTxids.push(txid);
     try {
-      const packet = import_sdk4.Extension.fromTx(parsed).getPacketByType(OFFER_PACKET_TYPE);
+      const packet = import_sdk5.Extension.fromTx(parsed).getPacketByType(OFFER_PACKET_TYPE);
       if (!packet) continue;
       const payload = packet.serialize();
       found.push({
         fundingTx,
         offer: decodeOffer(payload),
-        offerHex: import_base2.hex.encode(payload)
+        offerHex: import_base3.hex.encode(payload)
       });
     } catch {
     }
   }
   if (found.length === 0) return { restored: [], scannedTxids: fetchedTxids };
-  const scripts = [...new Set(found.map((f) => import_base2.hex.encode(f.offer.swapPkScript)))];
+  const scripts = [...new Set(found.map((f) => import_base3.hex.encode(f.offer.swapPkScript)))];
   const { vtxos } = await indexer.getVtxos({ scripts });
   const vtxoByScriptAndTxid = new Map(vtxos.map((v) => [`${v.script}:${v.txid}`, v]));
   const txByAnyId = /* @__PURE__ */ new Map();
@@ -941,7 +993,7 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
   const spendTxids = /* @__PURE__ */ new Set();
   for (const { fundingTx, offer } of found) {
     const vtxo = vtxoByScriptAndTxid.get(
-      `${import_base2.hex.encode(offer.swapPkScript)}:${fundingTx.redeemTxid}`
+      `${import_base3.hex.encode(offer.swapPkScript)}:${fundingTx.redeemTxid}`
     );
     if (vtxo?.virtualStatus.state !== "spent") continue;
     for (const txid of spendTxidsOf(vtxo)) spendTxids.add(txid);
@@ -950,7 +1002,7 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
   const restored = [];
   const unresolved = /* @__PURE__ */ new Set();
   for (const { fundingTx, offer, offerHex } of found) {
-    const swapPkScript = import_base2.hex.encode(offer.swapPkScript);
+    const swapPkScript = import_base3.hex.encode(offer.swapPkScript);
     const vtxo = vtxoByScriptAndTxid.get(`${swapPkScript}:${fundingTx.redeemTxid}`);
     if (!vtxo) {
       unresolved.add(fundingTx.redeemTxid);
@@ -1007,8 +1059,8 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
 }
 
 // src/watch.ts
-var import_base3 = require("@scure/base");
-var import_sdk5 = require("@arkade-os/sdk");
+var import_base4 = require("@scure/base");
+var import_sdk6 = require("@arkade-os/sdk");
 var TERMINAL = ["fulfilled", "cancelled", "recoverable"];
 function spendUpdate(swap, spend) {
   if (TERMINAL.includes(swap.status)) return void 0;
@@ -1028,8 +1080,8 @@ async function watchOfferSwaps({
   onUpdate
 }) {
   const manager = await wallet.getContractManager();
-  const serverPubkey = import_sdk5.ArkAddress.decode(await wallet.getAddress()).serverPubKey;
-  const indexer = new import_sdk5.RestIndexerProvider(arkServerUrl);
+  const serverPubkey = import_sdk6.ArkAddress.decode(await wallet.getAddress()).serverPubKey;
+  const indexer = new import_sdk6.RestIndexerProvider(arkServerUrl);
   let queue = Promise.resolve();
   const enqueue = (task) => {
     queue = queue.then(task).catch(() => {
@@ -1042,9 +1094,9 @@ async function watchOfferSwaps({
       if (candidates.length === 0) return "indeterminate";
       const { txs } = await indexer.getVirtualTxs(candidates);
       return classifyDepositSpend(
-        decodeOffer(import_base3.hex.decode(swap.offerHex)),
+        decodeOffer(import_base4.hex.decode(swap.offerHex)),
         serverPubkey,
-        txs.map((psbt) => import_sdk5.Transaction.fromPSBT(import_base3.base64.decode(psbt))),
+        txs.map((psbt) => import_sdk6.Transaction.fromPSBT(import_base4.base64.decode(psbt))),
         { txid: vtxo.txid, vout: vtxo.vout }
       );
     } catch {
@@ -1091,8 +1143,8 @@ var import_legacy2 = require("@noble/hashes/legacy.js");
 var import_sdk8 = require("@arkade-os/sdk");
 
 // src/onchainHtlc.ts
-var import_base4 = require("@scure/base");
-var import_sha2 = require("@noble/hashes/sha2.js");
+var import_base5 = require("@scure/base");
+var import_sha22 = require("@noble/hashes/sha2.js");
 var import_legacy = require("@noble/hashes/legacy.js");
 var btc = __toESM(require("@scure/btc-signer"), 1);
 var ONCHAIN_ORDER_MARGIN_SECONDS = 2 * 60 * 60;
@@ -1101,8 +1153,8 @@ var MAX_MIN_CONFIRMATIONS = 6;
 var ONCHAIN_SECONDS_PER_BLOCK = 600;
 var ONCHAIN_DUST_SATS = BigInt(330);
 var newPreimage = () => crypto.getRandomValues(new Uint8Array(32));
-var paymentHashOf = (preimage) => import_base4.hex.encode((0, import_sha2.sha256)(preimage));
-var h160FromPaymentHash = (paymentHash) => (0, import_legacy.ripemd160)(import_base4.hex.decode(paymentHash));
+var paymentHashOf = (preimage) => import_base5.hex.encode((0, import_sha22.sha256)(preimage));
+var h160FromPaymentHash = (paymentHash) => (0, import_legacy.ripemd160)(import_base5.hex.decode(paymentHash));
 var L1_NETWORKS = {
   bitcoin: btc.NETWORK,
   testnet: btc.TEST_NETWORK,
@@ -1143,7 +1195,7 @@ function onchainHtlcScript(params, network) {
   );
   const controlBlockFor = (leaf) => {
     for (const [block, script] of payment.tapLeafScript ?? []) {
-      if (script.length - 1 === leaf.length && import_base4.hex.encode(script.subarray(0, leaf.length)) === import_base4.hex.encode(leaf)) {
+      if (script.length - 1 === leaf.length && import_base5.hex.encode(script.subarray(0, leaf.length)) === import_base5.hex.encode(leaf)) {
         return btc.TaprootControlBlock.encode(block);
       }
     }
@@ -1236,13 +1288,13 @@ var buildHtlcRefund = (input) => buildLeafSpend({
 function extractPreimage(txHex, paymentHash) {
   let raw;
   try {
-    raw = btc.RawTx.decode(import_base4.hex.decode(txHex));
+    raw = btc.RawTx.decode(import_base5.hex.decode(txHex));
   } catch {
     return null;
   }
   for (const stack of raw.witnesses ?? []) {
     for (const item of stack) {
-      if (item.length === 32 && import_base4.hex.encode((0, import_sha2.sha256)(item)) === paymentHash) return item;
+      if (item.length === 32 && import_base5.hex.encode((0, import_sha22.sha256)(item)) === paymentHash) return item;
     }
   }
   return null;
@@ -1283,7 +1335,7 @@ async function classifyOnchainHtlc(chain, input) {
     const spend = await chain.getSpendingTx(input.funding.txid, input.funding.vout);
     if (!spend) return { phase: "unfunded" };
     const preimage = extractPreimage(spend.txHex, input.htlc.paymentHash);
-    const txid = btc.Transaction.fromRaw(import_base4.hex.decode(spend.txHex), {
+    const txid = btc.Transaction.fromRaw(import_base5.hex.decode(spend.txHex), {
       allowUnknownInputs: true,
       allowUnknownOutputs: true
     }).id;
@@ -1296,177 +1348,19 @@ async function classifyOnchainHtlc(chain, input) {
   return { phase: "claimable", utxo: best };
 }
 
-// src/secrets.ts
-var import_base5 = require("@scure/base");
-var import_sha22 = require("@noble/hashes/sha2.js");
-var import_utils2 = require("@noble/hashes/utils.js");
-var import_secp256k1 = require("@noble/curves/secp256k1.js");
-var import_sdk6 = require("@arkade-os/sdk");
-var RFQ_PREIMAGE_TAG = "Arkade-RFQ-Preimage-v1";
-function buildPreimageMessage(xonly, index) {
-  if (xonly.length !== 32) {
-    throw new Error(`x-only pubkey must be 32 bytes, got ${xonly.length}`);
-  }
-  if (!Number.isInteger(index) || index < 0 || index > 4294967295) {
-    throw new Error(`index must be a u32, got ${index}`);
-  }
-  const tag = new TextEncoder().encode(RFQ_PREIMAGE_TAG);
-  const message = new Uint8Array(tag.length + 32 + 4);
-  message.set(tag, 0);
-  message.set(xonly, tag.length);
-  new DataView(message.buffer).setUint32(tag.length + 32, index, true);
-  return message;
-}
-var PREIMAGE_INDEX = 0;
-async function deriveSwapSecrets(wallet) {
-  if (!(0, import_sdk6.isHDAllocationCapable)(wallet)) return void 0;
-  const signingDescriptor = await wallet.getNextSigningDescriptor();
-  if (!signingDescriptor) return void 0;
-  return { derivable: true, signingDescriptor };
-}
-function randomSwapSecrets(opts = {}) {
-  if (opts.preimage instanceof Uint8Array && opts.preimage.length !== 32) {
-    throw new Error(`preimage must be 32 bytes, got ${opts.preimage.length}`);
-  }
-  const preimage = opts.preimage instanceof Uint8Array ? opts.preimage : opts.preimage ? (0, import_utils2.randomBytes)(32) : void 0;
-  return {
-    derivable: false,
-    senderPrivateKey: import_secp256k1.schnorr.utils.randomSecretKey(),
-    ...preimage ? { preimage } : {}
-  };
-}
-function rfqSecretsToRecord(secrets) {
-  if (secrets.derivable) {
-    return {
-      signingDescriptor: secrets.signingDescriptor,
-      ...secrets.preimage ? { preimageHex: import_base5.hex.encode(secrets.preimage) } : {}
-    };
-  }
-  return {
-    fallbackSecrets: {
-      version: 1,
-      type: "stored",
-      senderPrivateKeyHex: import_base5.hex.encode(secrets.senderPrivateKey),
-      ...secrets.preimage ? { preimageHex: import_base5.hex.encode(secrets.preimage) } : {}
-    }
-  };
-}
-function rfqSecretsOfRecord(record) {
-  if (record.signingDescriptor) {
-    return {
-      derivable: true,
-      signingDescriptor: record.signingDescriptor,
-      ...record.preimageHex ? { preimage: decodeHex32(record.preimageHex, "preimageHex") } : {}
-    };
-  }
-  const fallback = record.fallbackSecrets;
-  if (!fallback) return void 0;
-  if (fallback.version !== 1 || fallback.type !== "stored") {
-    throw new Error("unsupported RFQ fallback secrets record");
-  }
-  return {
-    derivable: false,
-    senderPrivateKey: decodeHex32(fallback.senderPrivateKeyHex, "senderPrivateKeyHex"),
-    ...fallback.preimageHex ? { preimage: decodeHex32(fallback.preimageHex, "preimageHex") } : {}
-  };
-}
-function decodeHex32(value, label) {
-  const bytes = import_base5.hex.decode(value);
-  if (bytes.length !== 32) {
-    throw new Error(label + " must be 32 bytes, got " + bytes.length);
-  }
-  return bytes;
-}
-async function adoptSwapDescriptor(wallet, signingDescriptor) {
-  if (!(0, import_sdk6.isHDAllocationCapable)(wallet)) return;
-  await wallet.advanceSigningDescriptorWatermark(signingDescriptor);
-}
-var RefundNotLocallyPossibleError = class extends Error {
-  constructor(reason, message, options) {
-    super(message, options);
-    this.reason = reason;
-  }
-  reason;
-  name = "RefundNotLocallyPossibleError";
-};
-async function senderIdentityForRfqSecrets(wallet, secrets) {
-  if (!secrets.derivable) return import_sdk6.SingleKey.fromPrivateKey(secrets.senderPrivateKey);
-  const signer = (0, import_sdk6.isHDWalletCapable)(wallet) ? await wallet.signerForDescriptor(secrets.signingDescriptor) : void 0;
-  if (!signer || !isDeterministicSigner(signer)) {
-    throw new RefundNotLocallyPossibleError(
-      "foreign-descriptor",
-      `this wallet cannot derive ${secrets.signingDescriptor}; the swap was created on another wallet`
-    );
-  }
-  return signer;
-}
-async function senderIdentityForSwapRecord(wallet, record) {
-  let secrets;
-  try {
-    secrets = rfqSecretsOfRecord(record);
-  } catch (error) {
-    throw new RefundNotLocallyPossibleError(
-      "unreadable-secrets",
-      error instanceof Error ? error.message : String(error),
-      // the record's own diagnosis, kept for a caller that wants more
-      // than the message
-      { cause: error }
-    );
-  }
-  if (!secrets) {
-    throw new RefundNotLocallyPossibleError(
-      "no-secrets",
-      "this swap record carries no signing descriptor and no fallback secrets"
-    );
-  }
-  return senderIdentityForRfqSecrets(wallet, secrets);
-}
-async function senderPubkeyForRfqSecrets(wallet, secrets) {
-  if (!secrets.derivable) return import_secp256k1.schnorr.getPublicKey(secrets.senderPrivateKey);
-  return (await senderIdentityForRfqSecrets(wallet, secrets)).xOnlyPublicKey();
-}
-function isDeterministicSigner(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const v = value;
-  return typeof v.signSchnorrDeterministic === "function" && typeof v.xOnlyPublicKey === "function";
-}
-async function derivePreimage(signer) {
-  const xonly = await signer.xOnlyPublicKey();
-  const message = buildPreimageMessage(xonly, PREIMAGE_INDEX);
-  return (0, import_sha22.sha256)(await signer.signSchnorrDeterministic((0, import_sha22.sha256)(message)));
-}
-async function preimageForRfqSecrets(wallet, secrets) {
-  if (!secrets.derivable) {
-    if (!secrets.preimage) throw new Error("this swap carries no stored preimage");
-    return secrets.preimage;
-  }
-  if (secrets.preimage) return secrets.preimage;
-  const signer = await senderIdentityForRfqSecrets(wallet, secrets);
-  if (!isDeterministicSigner(signer)) {
-    throw new Error(
-      `wallet cannot sign deterministically for ${secrets.signingDescriptor}; its preimage is not derivable`
-    );
-  }
-  try {
-    return await derivePreimage(signer);
-  } catch (cause) {
-    throw new Error(
-      `wallet cannot sign deterministically for ${secrets.signingDescriptor}; its preimage is not derivable`,
-      { cause }
-    );
-  }
-}
+// src/rfq.ts
+var import_sdk9 = require("@arkade-os/sdk");
 
 // src/claimPacket.ts
 var import_base6 = require("@scure/base");
-var import_secp256k12 = require("@noble/curves/secp256k1.js");
+var import_secp256k1 = require("@noble/curves/secp256k1.js");
 var import_hkdf = require("@noble/hashes/hkdf.js");
 var import_sha23 = require("@noble/hashes/sha2.js");
 var HKDF_INFO = new TextEncoder().encode("covclaimd/preimage/v1");
 async function sealClaimPacket(input) {
   return sealWithEntropy(
     input,
-    import_secp256k12.secp256k1.utils.randomSecretKey(),
+    import_secp256k1.secp256k1.utils.randomSecretKey(),
     crypto.getRandomValues(new Uint8Array(12))
   );
 }
@@ -1475,8 +1369,8 @@ async function sealWithEntropy(input, ephemeralKey, nonce) {
   if (input.covclaimdPubkey.length !== 33) {
     throw new Error("covclaimd pubkey must be 33-byte compressed");
   }
-  const ephemeralPub = import_secp256k12.secp256k1.getPublicKey(ephemeralKey, true);
-  const sharedX = import_secp256k12.secp256k1.getSharedSecret(ephemeralKey, input.covclaimdPubkey, true).subarray(1);
+  const ephemeralPub = import_secp256k1.secp256k1.getPublicKey(ephemeralKey, true);
+  const sharedX = import_secp256k1.secp256k1.getSharedSecret(ephemeralKey, input.covclaimdPubkey, true).subarray(1);
   const key = (0, import_hkdf.hkdf)(import_sha23.sha256, sharedX, ephemeralPub, HKDF_INFO, 32);
   if (nonce.length !== 12) throw new Error("nonce must be 12 bytes");
   const aesKey = await crypto.subtle.importKey("raw", key, "AES-GCM", false, [
@@ -1786,21 +1680,22 @@ var relayTransport = (relayUrl, options) => {
   };
 };
 var SEQUENCE_GRANULARITY_SECONDS = 512;
+var SOLO_REFUND_HEADROOM_SECONDS = 8 * SEQUENCE_GRANULARITY_SECONDS;
 var unilateralClaimDelay = (serverExitDelaySeconds) => {
   if (!Number.isFinite(serverExitDelaySeconds) || serverExitDelaySeconds < SEQUENCE_GRANULARITY_SECONDS) {
     throw new Error(
       `server exit delay must be at least ${SEQUENCE_GRANULARITY_SECONDS}s of seconds, got ${serverExitDelaySeconds}`
     );
   }
-  if (serverExitDelaySeconds > (65535 - 2) * SEQUENCE_GRANULARITY_SECONDS) {
+  if (serverExitDelaySeconds > 65535 * SEQUENCE_GRANULARITY_SECONDS - SOLO_REFUND_HEADROOM_SECONDS) {
     throw new Error(
-      `server exit delay ${serverExitDelaySeconds}s exceeds what BIP68 can encode once the two refund tiers are stacked above it`
+      `server exit delay ${serverExitDelaySeconds}s exceeds what BIP68 can encode once the solo refund's headroom is stacked above it`
     );
   }
   return Math.ceil(serverExitDelaySeconds / SEQUENCE_GRANULARITY_SECONDS) * SEQUENCE_GRANULARITY_SECONDS;
 };
-var unilateralRefundDelay = (claimDelay) => claimDelay + SEQUENCE_GRANULARITY_SECONDS;
-var unilateralRefundWithoutReceiverDelay = (claimDelay) => claimDelay + 2 * SEQUENCE_GRANULARITY_SECONDS;
+var unilateralRefundDelay = (claimDelay) => claimDelay;
+var unilateralRefundWithoutReceiverDelay = (claimDelay) => claimDelay + SOLO_REFUND_HEADROOM_SECONDS;
 function lightningSendVtxoScript(params) {
   const seconds = (value) => ({
     type: "seconds",
@@ -1829,13 +1724,8 @@ function lightningSendVtxoScript(params) {
 }
 async function requestLightningSend(wallet, arkServerUrl, transport, params) {
   const rfqId = params.rfqId ?? newRfqId();
-  const secrets = await deriveSwapSecrets(wallet) ?? randomSwapSecrets();
-  if (!secrets.derivable) {
-    console.warn(
-      "[swap] wallet cannot allocate an HD descriptor: the sender key is random and MUST be persisted before funding"
-    );
-  }
-  const senderPubkey = await senderPubkeyForRfqSecrets(wallet, secrets);
+  const secrets = await (0, import_sdk9.provisionRefundKey)(wallet);
+  const senderPubkey = secrets.pubkey;
   const [info, refundAddress] = await Promise.all([
     new import_sdk8.RestArkProvider(arkServerUrl).getInfo(),
     wallet.getAddress()
@@ -1995,23 +1885,14 @@ function deriveOnchainSend(input) {
 }
 async function requestOnchainSend(wallet, arkServerUrl, transport, params) {
   const rfqId = params.rfqId ?? newRfqId();
-  if (params.preimage && params.preimage.length !== 32) {
-    throw new Error(`preimage must be 32 bytes, got ${params.preimage.length}`);
-  }
-  const derivedSecrets = await deriveSwapSecrets(wallet);
-  const secrets = derivedSecrets ? params.preimage ? { ...derivedSecrets, preimage: params.preimage } : derivedSecrets : randomSwapSecrets({ preimage: params.preimage ?? true });
-  if (!secrets.derivable) {
+  const secrets = await (0, import_sdk9.provisionClaimSecret)(wallet, { preimage: params.preimage });
+  if (secrets.mustPersistPreimage) {
     console.warn(
-      params.preimage ? "[swap] this swap's sender key is random; the supplied preimage and sender key MUST be persisted before funding" : "[swap] this swap's preimage and sender key are random and MUST be persisted before funding"
-    );
-  } else if (params.preimage) {
-    console.warn(
-      "[swap] this swap's preimage was supplied by the caller and MUST be persisted with the signing descriptor before funding"
+      "[swap] this swap's preimage cannot be re-derived from the seed and MUST be persisted with the record before funding"
     );
   }
-  const preimage = await preimageForRfqSecrets(wallet, secrets);
-  const paymentHash = paymentHashOf(preimage);
-  const senderPubkey = await senderPubkeyForRfqSecrets(wallet, secrets);
+  const paymentHash = import_base8.hex.encode(secrets.paymentHash);
+  const senderPubkey = secrets.pubkey;
   const [info, refundAddress] = await Promise.all([
     new import_sdk8.RestArkProvider(arkServerUrl).getInfo(),
     wallet.getAddress()
@@ -2189,15 +2070,15 @@ function deriveLightningReceive(input) {
 }
 async function requestLightningReceive(wallet, arkServerUrl, transport, params) {
   const rfqId = params.rfqId ?? newRfqId();
-  const secrets = await deriveSwapSecrets(wallet) ?? randomSwapSecrets({ preimage: true });
-  if (!secrets.derivable) {
+  const secrets = await (0, import_sdk9.provisionClaimSecret)(wallet);
+  if (secrets.mustPersistPreimage) {
     console.warn(
-      "[swap] this swap's preimage and payout key are random and MUST be persisted before paying"
+      "[swap] this swap's preimage cannot be re-derived from the seed and MUST be persisted with the record before paying"
     );
   }
-  const preimage = await preimageForRfqSecrets(wallet, secrets);
-  const paymentHash = paymentHashOf(preimage);
-  const payoutPubkey = await senderPubkeyForRfqSecrets(wallet, secrets);
+  const preimage = secrets.preimage;
+  const paymentHash = import_base8.hex.encode(secrets.paymentHash);
+  const payoutPubkey = secrets.pubkey;
   const [info, payoutAddress] = await Promise.all([
     new import_sdk8.RestArkProvider(arkServerUrl).getInfo(),
     wallet.getAddress()
@@ -2307,15 +2188,15 @@ function deriveOnchainReceive(input) {
 }
 async function requestOnchainReceive(wallet, arkServerUrl, transport, params) {
   const rfqId = params.rfqId ?? newRfqId();
-  const secrets = await deriveSwapSecrets(wallet) ?? randomSwapSecrets({ preimage: true });
-  if (!secrets.derivable) {
+  const secrets = await (0, import_sdk9.provisionClaimSecret)(wallet);
+  if (secrets.mustPersistPreimage) {
     console.warn(
-      "[swap] this swap's preimage and payout key are random and MUST be persisted before funding"
+      "[swap] this swap's preimage cannot be re-derived from the seed and MUST be persisted with the record before funding"
     );
   }
-  const preimage = await preimageForRfqSecrets(wallet, secrets);
-  const paymentHash = paymentHashOf(preimage);
-  const payoutPubkey = await senderPubkeyForRfqSecrets(wallet, secrets);
+  const preimage = secrets.preimage;
+  const paymentHash = import_base8.hex.encode(secrets.paymentHash);
+  const payoutPubkey = secrets.pubkey;
   const [info, payoutAddress] = await Promise.all([
     new import_sdk8.RestArkProvider(arkServerUrl).getInfo(),
     wallet.getAddress()
@@ -2386,12 +2267,12 @@ async function requestOnchainReceive(wallet, arkServerUrl, transport, params) {
 var import_base10 = require("@scure/base");
 var import_legacy3 = require("@noble/hashes/legacy.js");
 var import_sha25 = require("@noble/hashes/sha2.js");
-var import_sdk10 = require("@arkade-os/sdk");
+var import_sdk11 = require("@arkade-os/sdk");
 
 // src/refund.ts
 var import_base9 = require("@scure/base");
 var import_sha24 = require("@noble/hashes/sha2.js");
-var import_sdk9 = require("@arkade-os/sdk");
+var import_sdk10 = require("@arkade-os/sdk");
 var sleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var isRfqTerminal = (state) => RFQ_TERMINAL_STATES.includes(state);
 var RFQ_RESOLVED_STATES = ["settled", "refunded"];
@@ -2465,7 +2346,7 @@ async function findLockupVtxos(indexer, swapPkScript) {
 }
 var hashesTo = (candidate, paymentHash) => import_base9.hex.encode((0, import_sha24.sha256)(candidate)) === paymentHash;
 var candidateWitnessItems = (tx, inputIndex) => [
-  ...(0, import_sdk9.getArkPsbtFields)(tx, inputIndex, import_sdk9.ConditionWitness).flat(),
+  ...(0, import_sdk10.getArkPsbtFields)(tx, inputIndex, import_sdk10.ConditionWitness).flat(),
   ...tx.getInput(inputIndex).finalScriptWitness ?? []
 ];
 async function readLockupFate(indexer, input) {
@@ -2484,7 +2365,7 @@ async function readLockupFate(indexer, input) {
   for (const raw of txs) {
     let tx;
     try {
-      tx = import_sdk9.Transaction.fromPSBT(import_base9.base64.decode(raw));
+      tx = import_sdk10.Transaction.fromPSBT(import_base9.base64.decode(raw));
     } catch {
       continue;
     }
@@ -2521,14 +2402,14 @@ async function pushRefundWithoutReceiver(ark, input) {
   const info = await ark.getInfo();
   let serverUnrollScript;
   try {
-    serverUnrollScript = import_sdk9.CSVMultisigTapscript.decode(import_base9.hex.decode(info.checkpointTapscript));
+    serverUnrollScript = import_sdk10.CSVMultisigTapscript.decode(import_base9.hex.decode(info.checkpointTapscript));
   } catch {
     throw new Error("invalid checkpointTapscript from the Arkade server");
   }
   const leaf = input.script.refundWithoutReceiver();
   const tapTree = input.script.encode();
   const amount = input.vtxos.reduce((sum, vtxo) => sum + vtxo.value, 0);
-  const { arkTx, checkpoints } = (0, import_sdk9.buildOffchainTx)(
+  const { arkTx, checkpoints } = (0, import_sdk10.buildOffchainTx)(
     input.vtxos.map((vtxo) => ({
       txid: vtxo.txid,
       vout: vtxo.vout,
@@ -2544,8 +2425,8 @@ async function pushRefundWithoutReceiver(ark, input) {
     import_base9.base64.encode(signedArkTx.toPSBT()),
     checkpoints.map((c) => import_base9.base64.encode(c.toPSBT()))
   );
-  (0, import_sdk9.assertSubmittedArkTxid)(submitted, signedArkTx, "refundWithoutReceiver");
-  const matched = (0, import_sdk9.matchServerCheckpoints)(
+  (0, import_sdk10.assertSubmittedArkTxid)(submitted, signedArkTx, "refundWithoutReceiver");
+  const matched = (0, import_sdk10.matchServerCheckpoints)(
     submitted.signedCheckpointTxs,
     checkpoints,
     "refundWithoutReceiver"
@@ -2638,14 +2519,14 @@ async function pushClaim(ark, input) {
   const info = await ark.getInfo();
   let serverUnrollScript;
   try {
-    serverUnrollScript = import_sdk10.CSVMultisigTapscript.decode(import_base10.hex.decode(info.checkpointTapscript));
+    serverUnrollScript = import_sdk11.CSVMultisigTapscript.decode(import_base10.hex.decode(info.checkpointTapscript));
   } catch {
     throw new Error("invalid checkpointTapscript from the Arkade server");
   }
   const leaf = input.script.claim();
   const tapTree = input.script.encode();
-  const arkTxid = await (0, import_sdk10.signAndSubmitOffchainTx)({
-    identity: (0, import_sdk10.claimWithPreimageIdentity)(input.receiver, input.preimage),
+  const arkTxid = await (0, import_sdk11.signAndSubmitOffchainTx)({
+    identity: (0, import_sdk11.claimWithPreimageIdentity)(input.receiver, input.preimage),
     provider: ark,
     inputs: input.vtxos.map((vtxo) => ({
       txid: vtxo.txid,
@@ -2691,6 +2572,44 @@ async function claimReceiveLockup(indexer, ark, input) {
   });
 }
 
+// src/refundBlocked.ts
+var import_sdk12 = require("@arkade-os/sdk");
+var RefundNotLocallyPossibleError = class extends Error {
+  constructor(reason, message, options) {
+    super(message, options);
+    this.reason = reason;
+  }
+  reason;
+  name = "RefundNotLocallyPossibleError";
+};
+async function senderIdentityForSwapRecord(wallet, record) {
+  if (!record.signingDescriptor) {
+    throw new RefundNotLocallyPossibleError(
+      "no-secrets",
+      "this swap record carries no signing descriptor"
+    );
+  }
+  try {
+    return await (0, import_sdk12.contractSigner)(wallet, record.signingDescriptor);
+  } catch (cause) {
+    if (cause instanceof import_sdk12.WalletCannotSignError) {
+      throw new RefundNotLocallyPossibleError(
+        "unsignable-wallet",
+        `this wallet holds ${record.signingDescriptor} but cannot sign with it; attach its signer`,
+        { cause }
+      );
+    }
+    if (cause instanceof import_sdk12.ForeignDescriptorError) {
+      throw new RefundNotLocallyPossibleError(
+        "foreign-descriptor",
+        `this wallet cannot derive ${record.signingDescriptor}; the swap was created on another wallet`,
+        { cause }
+      );
+    }
+    throw cause;
+  }
+}
+
 // src/swapManager.ts
 var import_base11 = require("@scure/base");
 var RFQ_SWAP_TERMINAL_STATES = ["settled", "refunded", "failed"];
@@ -3482,20 +3401,20 @@ var outpointKey = (vtxo) => `${vtxo.txid}:${vtxo.vout}`;
   ONCHAIN_RECEIVE_PAIR,
   ONCHAIN_SECONDS_PER_BLOCK,
   ONCHAIN_SEND_PAIR,
+  PreimageNotRecoverableError,
   QUOTE_OPTIONS,
   REFUND_MTP_LAG_SECONDS,
-  RFQ_PREIMAGE_TAG,
   RFQ_RESOLVED_STATES,
   RFQ_SWAP_TERMINAL_STATES,
   RFQ_TERMINAL_STATES,
   RefundNotLocallyPossibleError,
   RfqSwapManager,
+  SOLO_REFUND_HEADROOM_SECONDS,
   SWAP_LOCKUP_CONTRACT_KIND,
   SWAP_LOCKUP_CONTRACT_LABEL,
   SWAP_LOCKUP_CONTRACT_TYPE,
   SwapRefusal,
   addAssetSwap,
-  adoptSwapDescriptor,
   arkadeSwapRequest,
   assertFundable,
   assertReceivable,
@@ -3504,7 +3423,6 @@ var outpointKey = (vtxo) => `${vtxo.txid}:${vtxo.vout}`;
   awaitRfqResolution,
   buildHtlcClaim,
   buildHtlcRefund,
-  buildPreimageMessage,
   cancelOffer,
   claimOnchainFill,
   claimReceiveLockup,
@@ -3516,8 +3434,6 @@ var outpointKey = (vtxo) => `${vtxo.txid}:${vtxo.vout}`;
   deriveLightningReceive,
   deriveOnchainReceive,
   deriveOnchainSend,
-  derivePreimage,
-  deriveSwapSecrets,
   discoverMarkets,
   encodeOffer,
   extractPreimage,
@@ -3526,7 +3442,6 @@ var outpointKey = (vtxo) => `${vtxo.txid}:${vtxo.vout}`;
   getAssetSwaps,
   getAssetSwapsOrThrow,
   httpTransport,
-  isDeterministicSigner,
   isRfqSwapTerminal,
   isRfqTerminal,
   lightningReceiveRequest,
@@ -3542,10 +3457,9 @@ var outpointKey = (vtxo) => `${vtxo.txid}:${vtxo.vout}`;
   onchainReceiveRequest,
   onchainSendRequest,
   paymentHashOf,
-  preimageForRfqSecrets,
+  preimageForSwapRecord,
   pushClaim,
   pushRefundWithoutReceiver,
-  randomSwapSecrets,
   readLockupFate,
   receiveVtxoScript,
   refundIfUnresolved,
@@ -3558,15 +3472,12 @@ var outpointKey = (vtxo) => `${vtxo.txid}:${vtxo.vout}`;
   restoreAssetSwaps,
   retireSettledOfferContracts,
   rfqPair,
-  rfqSecretsOfRecord,
-  rfqSecretsToRecord,
   sealClaimPacket,
-  senderIdentityForRfqSecrets,
   senderIdentityForSwapRecord,
-  senderPubkeyForRfqSecrets,
   spendTxidsOf,
   spendUpdate,
   swapPrograms,
+  swapSecretsToRecord,
   unilateralClaimDelay,
   unilateralRefundDelay,
   unilateralRefundWithoutReceiverDelay,