@arkade-os/swap 0.0.6 → 0.0.8

package/dist/index.js

@@ -5,6 +5,7 @@ import {
   LIGHTNING_BTC,
   LIGHTNING_RECEIVE_PAIR,
   LIGHTNING_SEND_PAIR,
+  LockupContractMissing,
   LockupRegistrationFailed,
   MAX_MIN_CONFIRMATIONS,
   MIN_CLAIM_WINDOW_SECONDS,
@@ -22,6 +23,7 @@ import {
   SWAP_LOCKUP_CONTRACT_LABEL,
   SWAP_LOCKUP_CONTRACT_TYPE,
   SwapRefusal,
+  arkadeAssetLeg,
   arkadeSwapRequest,
   assertFundable,
   assertReceivable,
@@ -38,6 +40,7 @@ import {
   lightningReceiveRequest,
   lightningSendRequest,
   lightningSendVtxoScript,
+  lockupContractParams,
   newPreimage,
   newRfqId,
   offerTermsFromQuote,
@@ -59,11 +62,11 @@ import {
   unilateralRefundWithoutReceiverDelay,
   verifyLockupAddress,
   verifyReceiveInvoice
-} from "./chunk-Q4FAYBXS.js";
+} from "./chunk-TU4NGZDP.js";
 import {
   InMemoryAssetSwapRepository,
   marketsCacheKey
-} from "./chunk-WGRU2DBF.js";
+} from "./chunk-6ZUS47GA.js";
 
 // src/offer.ts
 import { hex as hex2 } from "@scure/base";
@@ -695,60 +698,50 @@ var validatePlan = (plan, giveBalance, dust) => {
 };
 
 // src/indexedDbRepository.ts
-import { closeDatabase, openDatabase } from "@arkade-os/sdk";
+import {
+  awaitTransaction,
+  createManagedConnection,
+  promisifyRequest
+} from "@arkade-os/sdk";
 var DEFAULT_DB_NAME = "arkade-intents";
-var DB_VERSION = 1;
+var DB_VERSION = 2;
 var STORE_SWAPS = "swaps";
+var STORE_RFQ_SWAPS = "rfqSwaps";
 var STORE_SCANNED = "scannedTxids";
 var STORE_MARKETS = "markets";
 var STORES = [
   [STORE_SWAPS, { keyPath: "id" }],
+  // v2. Separate from `swaps` rather than sharing it: the two record types
+  // have different keys and no consumer wants them interleaved.
+  [STORE_RFQ_SWAPS, { keyPath: "rfqId" }],
   [STORE_SCANNED],
   [STORE_MARKETS]
 ];
-function initDatabase(db) {
+function initDatabase(db, oldVersion, transaction) {
+  void oldVersion;
+  void transaction;
   for (const [name, options] of STORES) {
     if (!db.objectStoreNames.contains(name)) db.createObjectStore(name, options);
   }
 }
-var request = (req) => new Promise((resolve, reject) => {
-  req.onsuccess = () => resolve(req.result);
-  req.onerror = () => reject(req.error);
-});
-var txDone = (tx) => new Promise((resolve, reject) => {
-  tx.oncomplete = () => resolve();
-  tx.onerror = () => reject(tx.error);
-  tx.onabort = () => reject(tx.error);
-});
 var IndexedDbAssetSwapRepository = class {
+  version = 4;
+  connection;
   constructor(dbName = DEFAULT_DB_NAME) {
-    this.dbName = dbName;
-  }
-  dbName;
-  version = 2;
-  // the promise, not the resolved database: openDatabase bumps a refcount on
-  // every call including cache hits, while dispose closes once, so two
-  // concurrent first calls would strand the refcount above zero and leak the
-  // connection for the process lifetime. Cleared on failure so a failed open
-  // can be retried rather than cached forever.
-  dbPromise = null;
+    this.connection = createManagedConnection(dbName, DB_VERSION, initDatabase);
+  }
   ensureDb() {
-    return this.dbPromise ??= openDatabase(this.dbName, DB_VERSION, initDatabase).catch(
-      (err) => {
-        this.dbPromise = null;
-        throw err;
-      }
-    );
+    return this.connection.get();
   }
   async readStore(name) {
     return (await this.ensureDb()).transaction([name], "readonly").objectStore(name);
   }
   /** Every write in one place, so none of them can forget to await the
    * commit. Requests need no individual await: a failed one aborts the
-   * transaction, which `txDone` reports. */
+   * transaction, which `awaitTransaction` reports. */
   async write(name, apply) {
     const tx = (await this.ensureDb()).transaction([name], "readwrite");
-    const done = txDone(tx);
+    const done = awaitTransaction(tx);
     apply(tx.objectStore(name));
     await done;
   }
@@ -758,10 +751,26 @@ var IndexedDbAssetSwapRepository = class {
     });
   }
   async getAllSwaps() {
-    return request((await this.readStore(STORE_SWAPS)).getAll());
+    return promisifyRequest((await this.readStore(STORE_SWAPS)).getAll());
+  }
+  async saveRfqSwap(record) {
+    await this.write(STORE_RFQ_SWAPS, (store) => {
+      store.put(record);
+    });
+  }
+  async getRfqSwap(rfqId) {
+    return promisifyRequest((await this.readStore(STORE_RFQ_SWAPS)).get(rfqId));
+  }
+  async getAllRfqSwaps() {
+    return promisifyRequest((await this.readStore(STORE_RFQ_SWAPS)).getAll());
+  }
+  async removeRfqSwap(rfqId) {
+    await this.write(STORE_RFQ_SWAPS, (store) => {
+      store.delete(rfqId);
+    });
   }
   async getScannedTxids() {
-    const keys = await request((await this.readStore(STORE_SCANNED)).getAllKeys());
+    const keys = await promisifyRequest((await this.readStore(STORE_SCANNED)).getAllKeys());
     return new Set(keys);
   }
   async markTxidsScanned(txids) {
@@ -771,7 +780,7 @@ var IndexedDbAssetSwapRepository = class {
   }
   async getCachedMarkets(network, registry) {
     const store = await this.readStore(STORE_MARKETS);
-    return request(store.get(marketsCacheKey(network, registry)));
+    return promisifyRequest(store.get(marketsCacheKey(network, registry)));
   }
   async saveCachedMarkets(network, registry, entry) {
     await this.write(STORE_MARKETS, (store) => {
@@ -784,19 +793,353 @@ var IndexedDbAssetSwapRepository = class {
   async clear() {
     const stores = STORES.map(([name]) => name);
     const tx = (await this.ensureDb()).transaction(stores, "readwrite");
-    const done = txDone(tx);
+    const done = awaitTransaction(tx);
     for (const name of stores) tx.objectStore(name).clear();
     await done;
   }
   async [Symbol.asyncDispose]() {
-    if (!this.dbPromise) return;
-    await closeDatabase(this.dbName);
-    this.dbPromise = null;
+    await this.connection[Symbol.asyncDispose]();
   }
 };
 
+// src/rfqCorridors.ts
+import { hex as hex3 } from "@scure/base";
+
+// src/rfqCorridor.ts
+var RfqCorridorRegistry = class {
+  handlers = /* @__PURE__ */ new Map();
+  register(handler) {
+    if (this.handlers.has(handler.kind)) {
+      throw new Error(
+        `RFQ corridor handler for kind '${handler.kind}' is already registered`
+      );
+    }
+    this.handlers.set(handler.kind, handler);
+  }
+  /** Takes a bare `string`, deliberately, where {@link RfqCorridorHandler.kind}
+   * is the manager's union: a lookup key comes off a record a backend handed
+   * back, and that it typechecks as a `kind` is a claim about the type, not
+   * about what was stored. Narrowing this would read as a check already made. */
+  get(kind) {
+    return this.handlers.get(kind);
+  }
+  /**
+   * The handler for a kind, or a loud failure.
+   *
+   * A record whose corridor is not registered cannot be restored, and
+   * guessing would monitor a swap with no idea how to drive it. Names the
+   * registered kinds so a missing `register()` call is obvious.
+   */
+  getOrThrow(kind) {
+    const handler = this.get(kind);
+    if (!handler) {
+      throw new Error(
+        `no RFQ corridor handler registered for kind '${kind}'; registered: ${this.registeredKinds().join(", ") || "none"}`
+      );
+    }
+    return handler;
+  }
+  has(kind) {
+    return this.handlers.has(kind);
+  }
+  registeredKinds() {
+    return [...this.handlers.keys()];
+  }
+  /** Test seam, mirroring the contract registry's. */
+  unregister(kind) {
+    return this.handlers.delete(kind);
+  }
+};
+var rfqCorridorHandlers = new RfqCorridorRegistry();
+
+// src/rfqProfileParts.ts
+var rfqSecretsProfile = (secrets, paymentHash) => {
+  const { signingDescriptor, ...preimage } = swapSecretsToRecord(secrets);
+  return {
+    signer: { signingDescriptor },
+    ...paymentHash ? { hashlock: { paymentHash, ...preimage } } : {}
+  };
+};
+var parseHex32 = (value, field) => {
+  if (typeof value !== "string" || !/^[0-9a-fA-F]{64}$/.test(value)) {
+    throw new Error(`${field} must be 32 bytes of hex, got ${JSON.stringify(value)}`);
+  }
+  return value.toLowerCase();
+};
+var parseSigner = (value) => {
+  const signingDescriptor = value?.signingDescriptor;
+  if (typeof signingDescriptor !== "string" || signingDescriptor.length === 0) {
+    throw new Error(
+      `rfq profile.signer carries no signingDescriptor (got ${JSON.stringify(signingDescriptor)})`
+    );
+  }
+  return { signingDescriptor };
+};
+var parseHashlock = (value) => {
+  const raw = value ?? {};
+  const hashlock = {
+    paymentHash: parseHex32(raw.paymentHash, "rfq profile.hashlock.paymentHash")
+  };
+  if (raw.preimageHex !== void 0) {
+    hashlock.preimageHex = parseHex32(raw.preimageHex, "rfq profile.hashlock.preimageHex");
+  }
+  if (raw.preimageSaltHex !== void 0) {
+    hashlock.preimageSaltHex = parseHex32(
+      raw.preimageSaltHex,
+      "rfq profile.hashlock.preimageSaltHex"
+    );
+  }
+  return hashlock;
+};
+var hydrateHashlock = (profile) => {
+  try {
+    return { paymentHash: parseHashlock(profile.hashlock).paymentHash };
+  } catch (cause) {
+    throw new Error(
+      `rfq record carries no usable hashlock; it cannot verify a preimage: ${String(cause)}`,
+      { cause }
+    );
+  }
+};
+var rfqSignerOf = (record) => {
+  const signer = record.profile.signer;
+  if (signer === void 0) return void 0;
+  return parseSigner(signer);
+};
+var rfqClaimSecretOf = (record) => {
+  const handler = rfqCorridorHandlers.getOrThrow(record.kind);
+  if (!handler.claimSecret) return void 0;
+  try {
+    const claim = handler.claimSecret(record.profile);
+    return { ...parseSigner(claim), ...parseHashlock(claim) };
+  } catch (cause) {
+    throw new PreimageNotRecoverableError(
+      "malformed-record",
+      `this ${record.kind} record's claim secret is unreadable: ${String(cause)}`,
+      { cause }
+    );
+  }
+};
+
+// src/rfqCorridors.ts
+var LightningSendCorridor = {
+  kind: "lightning_send",
+  project: () => ({}),
+  hydrate: (profile) => hydrateHashlock(profile)
+  // No `claimSecret`, deliberately: `provisionRefundKey` mints no preimage at
+  // all, and deriving one off the refund descriptor would fail the payment
+  // hash check — a `hash-mismatch` on a swap that was never broken.
+};
+var LightningReceiveCorridor = {
+  kind: "lightning_receive",
+  // What the manager holds: the amount gate, and its own claim once it lands.
+  // `payoutAddress` comes from the request result and never changes, so the
+  // caller writes it once and this leaves it alone.
+  project: (swap) => {
+    const receive = swap;
+    return {
+      expectedAmount: receive.expectedAmount,
+      ...receive.claimArkTxid ? { claimArkTxid: receive.claimArkTxid } : {}
+    };
+  },
+  hydrate(profile) {
+    if (typeof profile.expectedAmount !== "number" || !Number.isFinite(profile.expectedAmount)) {
+      throw new Error("lightning_receive record carries no expectedAmount; it cannot claim");
+    }
+    return {
+      ...hydrateHashlock(profile),
+      expectedAmount: profile.expectedAmount,
+      ...profile.claimArkTxid ? { claimArkTxid: profile.claimArkTxid } : {}
+    };
+  },
+  // We are the claimant here, so the preimage material on the hashlock is
+  // ours to use.
+  claimSecret: (profile) => ({ ...profile.signer, ...profile.hashlock }),
+  activityTxids: (profile) => profile.claimArkTxid ? [profile.claimArkTxid] : []
+};
+function onchainSendProfile(result) {
+  return {
+    claimKey: hex3.encode(result.htlcParams.claimKey),
+    refundKey: hex3.encode(result.htlcParams.refundKey),
+    htlcLocktime: result.htlcParams.refundLocktime,
+    network: result.l1Network,
+    htlcAddress: result.htlc.address,
+    minConfirmations: result.minConfirmations
+  };
+}
+var OnchainSendCorridor = {
+  kind: "onchain_send",
+  // The L1 keys and the network are only in the request result — nothing on
+  // `OnchainSendSwap` carries them — so the caller writes them once. What the
+  // manager learns as it drives the swap is the fill and our own claim.
+  project: (swap) => {
+    const send = swap;
+    return {
+      ...send.funding ? { funding: send.funding } : {},
+      ...send.claimTxid ? { claimTxid: send.claimTxid } : {}
+    };
+  },
+  hydrate(profile) {
+    const { paymentHash } = hydrateHashlock(profile);
+    if (!profile.claimKey || !profile.refundKey) {
+      throw new Error(
+        "onchain_send record carries no L1 keys; its HTLC cannot be rebuilt and its refund window would pass unwatched"
+      );
+    }
+    if (!Number.isInteger(profile.minConfirmations) || profile.minConfirmations < 1) {
+      throw new Error(
+        `onchain_send record carries no usable minConfirmations (${String(profile.minConfirmations)}); the confirmation gate cannot be checked \u2014 refusing to restore a swap that would claim an unconfirmed fill`
+      );
+    }
+    const htlc = onchainHtlcScript(
+      {
+        // From the profile, not the covenant: the lockup commits to
+        // `hash160(P)`, and the HTLC needs `sha256(P)`. One P
+        // unlocks both legs, but only one of the two hashes of it
+        // is recoverable here.
+        paymentHash,
+        claimKey: hex3.decode(profile.claimKey),
+        refundKey: hex3.decode(profile.refundKey),
+        refundLocktime: profile.htlcLocktime
+      },
+      profile.network
+    );
+    if (htlc.address !== profile.htlcAddress) {
+      throw new Error(
+        `onchain_send record's L1 inputs derive ${htlc.address}, but the fill was expected at ${String(profile.htlcAddress)} \u2014 these are not this swap's`
+      );
+    }
+    return {
+      paymentHash,
+      htlc,
+      minConfirmations: profile.minConfirmations,
+      ...profile.funding ? { funding: profile.funding } : {},
+      ...profile.claimTxid ? { claimTxid: profile.claimTxid } : {}
+    };
+  },
+  // The trader claims the L1 HTLC with P, so this leg's preimage material is
+  // ours.
+  claimSecret: (profile) => ({ ...profile.signer, ...profile.hashlock }),
+  // Our own L1 claim only. `funding` is the SOLVER's fill into the HTLC —
+  // not a transaction of ours, so grouping it would claim a row this wallet
+  // never made.
+  activityTxids: (profile) => profile.claimTxid ? [profile.claimTxid] : []
+};
+rfqCorridorHandlers.register(LightningSendCorridor);
+rfqCorridorHandlers.register(LightningReceiveCorridor);
+rfqCorridorHandlers.register(OnchainSendCorridor);
+
+// src/rfqRecord.ts
+import { ArkAddress as ArkAddress2, VHTLCV2ContractHandler } from "@arkade-os/sdk";
+import { hex as hex4 } from "@scure/base";
+
+// src/rfqSwapState.ts
+var RFQ_SWAP_TERMINAL_STATES = ["settled", "refunded", "failed"];
+var isRfqSwapTerminal = (state) => RFQ_SWAP_TERMINAL_STATES.includes(state);
+
+// src/rfqRecord.ts
+var RFQ_SWAP_RETENTION_SECONDS = 30 * 24 * 60 * 60;
+var managerState = (swap) => ({
+  rfqId: swap.rfqId,
+  state: swap.state,
+  createdAt: swap.createdAt,
+  updatedAt: swap.updatedAt,
+  ...swap.refundArkTxid ? { refundArkTxid: swap.refundArkTxid } : {},
+  ...swap.lockupSpendArkTxids?.length ? { lockupSpendArkTxids: [...swap.lockupSpendArkTxids] } : {},
+  ...swap.failure ? { failure: swap.failure } : {},
+  ...swap.blockedReason ? { blockedReason: swap.blockedReason } : {}
+});
+function assertSameSwap(origin, swap) {
+  if (origin.kind !== swap.kind) {
+    throw new Error(
+      `rfq swap record is a ${origin.kind} origin paired with a ${swap.kind} swap`
+    );
+  }
+  const funded = hex4.encode(ArkAddress2.decode(origin.lockupAddress).pkScript);
+  const watched = hex4.encode(swap.lockupPkScript);
+  if (funded !== watched) {
+    throw new Error(
+      `rfq swap record's lockup address holds ${funded}, but the swap watches ${watched} \u2014 these are not the same swap`
+    );
+  }
+}
+function createRfqSwapRecord(origin, swap) {
+  assertSameSwap(origin, swap);
+  const handler = rfqCorridorHandlers.getOrThrow(origin.kind);
+  return {
+    ...origin,
+    ...managerState(swap),
+    // The caller wrote what only the request result knows; the handler adds
+    // what the live swap already carries.
+    profile: { ...origin.profile, ...handler.project(swap) }
+  };
+}
+function updateRfqSwapRecord(record, swap) {
+  assertSameSwap(record, swap);
+  const {
+    refundArkTxid: _refundArkTxid,
+    lockupSpendArkTxids: _lockupSpendArkTxids,
+    failure: _failure,
+    blockedReason: _blockedReason,
+    ...origin
+  } = record;
+  const handler = rfqCorridorHandlers.getOrThrow(record.kind);
+  return {
+    ...origin,
+    ...managerState(swap),
+    profile: { ...record.profile, ...handler.project(swap) }
+  };
+}
+function rfqSwapOriginOf(record) {
+  return {
+    kind: record.kind,
+    lockupAddress: record.lockupAddress,
+    profile: { ...record.profile },
+    ...record.amount !== void 0 ? { amount: record.amount } : {},
+    ...record.fundingArkTxid ? { fundingArkTxid: record.fundingArkTxid } : {}
+  };
+}
+function lockupScript(params, lockupAddress) {
+  const script = VHTLCV2ContractHandler.createScript(params);
+  const funded = ArkAddress2.decode(lockupAddress).pkScript;
+  if (hex4.encode(funded) !== hex4.encode(script.pkScript)) {
+    throw new Error(
+      `rfq swap covenant params derive ${hex4.encode(script.pkScript)}, but the record's lockup address holds ${hex4.encode(funded)} \u2014 these params are not this swap's`
+    );
+  }
+  return script;
+}
+function rebuildRfqSwap(record, params) {
+  const script = lockupScript(params, record.lockupAddress);
+  const common = {
+    rfqId: record.rfqId,
+    state: record.state,
+    lockupPkScript: script.pkScript,
+    lockup: { script, address: record.lockupAddress },
+    // From the covenant, which binds it: the record's own copy would be a
+    // second source for the deadline the refund is gated on.
+    refundLocktime: Number(script.options.refundLocktime),
+    createdAt: record.createdAt,
+    updatedAt: record.updatedAt,
+    ...record.refundArkTxid ? { refundArkTxid: record.refundArkTxid } : {},
+    ...record.lockupSpendArkTxids?.length ? { lockupSpendArkTxids: [...record.lockupSpendArkTxids] } : {},
+    ...record.failure ? { failure: record.failure } : {},
+    ...record.blockedReason ? { blockedReason: record.blockedReason } : {}
+  };
+  const handler = rfqCorridorHandlers.getOrThrow(record.kind);
+  return {
+    ...common,
+    kind: record.kind,
+    ...handler.hydrate(record.profile, { lockup: script })
+  };
+}
+function shouldRetainRfqSwap(record, now) {
+  if (!isRfqSwapTerminal(record.state)) return true;
+  return now - record.updatedAt < RFQ_SWAP_RETENTION_SECONDS;
+}
+
 // src/restore.ts
-import { base64, hex as hex3 } from "@scure/base";
+import { base64, hex as hex5 } from "@scure/base";
 import {
   Extension,
   Transaction,
@@ -832,7 +1175,7 @@ function classifySpend(offer, serverPubkey, spendTx, deposit) {
   let leaves;
   try {
     const script = offerVtxoScript(offer, serverPubkey);
-    if (hex3.encode(script.pkScript) !== hex3.encode(offer.swapPkScript)) return "indeterminate";
+    if (hex5.encode(script.pkScript) !== hex5.encode(offer.swapPkScript)) return "indeterminate";
     leaves = {
       cancel: script.functionByName("cancel")?.leafScript,
       fulfill: script.functionByName("fulfill")?.leafScript
@@ -843,11 +1186,11 @@ function classifySpend(offer, serverPubkey, spendTx, deposit) {
   for (let i = 0; i < spendTx.inputsLength; i++) {
     const input = spendTx.getInput(i);
     if (!input.txid || input.index !== deposit.vout) continue;
-    if (hex3.encode(input.txid) !== deposit.txid) continue;
+    if (hex5.encode(input.txid) !== deposit.txid) continue;
     for (const leaf of input.tapLeafScript ?? []) {
-      const spent = hex3.encode(scriptFromTapLeafScript(leaf));
-      if (leaves.cancel && spent === hex3.encode(leaves.cancel)) return "cancelled";
-      if (leaves.fulfill && spent === hex3.encode(leaves.fulfill)) return "fulfilled";
+      const spent = hex5.encode(scriptFromTapLeafScript(leaf));
+      if (leaves.cancel && spent === hex5.encode(leaves.cancel)) return "cancelled";
+      if (leaves.fulfill && spent === hex5.encode(leaves.fulfill)) return "fulfilled";
     }
   }
   return "indeterminate";
@@ -882,13 +1225,13 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
       found.push({
         fundingTx,
         offer: decodeOffer(payload),
-        offerHex: hex3.encode(payload)
+        offerHex: hex5.encode(payload)
       });
     } catch {
     }
   }
   if (found.length === 0) return { restored: [], scannedTxids: fetchedTxids };
-  const scripts = [...new Set(found.map((f) => hex3.encode(f.offer.swapPkScript)))];
+  const scripts = [...new Set(found.map((f) => hex5.encode(f.offer.swapPkScript)))];
   const { vtxos } = await indexer.getVtxos({ scripts });
   const vtxoByScriptAndTxid = new Map(vtxos.map((v) => [`${v.script}:${v.txid}`, v]));
   const txByAnyId = /* @__PURE__ */ new Map();
@@ -900,7 +1243,7 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
   const spendTxids = /* @__PURE__ */ new Set();
   for (const { fundingTx, offer } of found) {
     const vtxo = vtxoByScriptAndTxid.get(
-      `${hex3.encode(offer.swapPkScript)}:${fundingTx.redeemTxid}`
+      `${hex5.encode(offer.swapPkScript)}:${fundingTx.redeemTxid}`
     );
     if (vtxo?.virtualStatus.state !== "spent") continue;
     for (const txid of spendTxidsOf(vtxo)) spendTxids.add(txid);
@@ -909,7 +1252,7 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
   const restored = [];
   const unresolved = /* @__PURE__ */ new Set();
   for (const { fundingTx, offer, offerHex } of found) {
-    const swapPkScript = hex3.encode(offer.swapPkScript);
+    const swapPkScript = hex5.encode(offer.swapPkScript);
     const vtxo = vtxoByScriptAndTxid.get(`${swapPkScript}:${fundingTx.redeemTxid}`);
     if (!vtxo) {
       unresolved.add(fundingTx.redeemTxid);
@@ -966,9 +1309,9 @@ async function restoreAssetSwaps(indexer, txs, existingIds, opts) {
 }
 
 // src/watch.ts
-import { base64 as base642, hex as hex4 } from "@scure/base";
+import { base64 as base642, hex as hex6 } from "@scure/base";
 import {
-  ArkAddress as ArkAddress2,
+  ArkAddress as ArkAddress3,
   RestIndexerProvider as RestIndexerProvider3,
   Transaction as Transaction2
 } from "@arkade-os/sdk";
@@ -991,7 +1334,7 @@ async function watchOfferSwaps({
   onUpdate
 }) {
   const manager = await wallet.getContractManager();
-  const serverPubkey = ArkAddress2.decode(await wallet.getAddress()).serverPubKey;
+  const serverPubkey = ArkAddress3.decode(await wallet.getAddress()).serverPubKey;
   const indexer = new RestIndexerProvider3(arkServerUrl);
   let queue = Promise.resolve();
   const enqueue = (task) => {
@@ -1005,7 +1348,7 @@ async function watchOfferSwaps({
       if (candidates.length === 0) return "indeterminate";
       const { txs } = await indexer.getVirtualTxs(candidates);
       return classifyDepositSpend(
-        decodeOffer(hex4.decode(swap.offerHex)),
+        decodeOffer(hex6.decode(swap.offerHex)),
         serverPubkey,
         txs.map((psbt) => Transaction2.fromPSBT(base642.decode(psbt))),
         { txid: vtxo.txid, vout: vtxo.vout }
@@ -1049,7 +1392,7 @@ async function watchOfferSwaps({
 }
 
 // src/claim.ts
-import { hex as hex6 } from "@scure/base";
+import { hex as hex8 } from "@scure/base";
 import { ripemd160 } from "@noble/hashes/legacy.js";
 import { sha256 as sha2563 } from "@noble/hashes/sha2.js";
 import {
@@ -1059,7 +1402,7 @@ import {
 } from "@arkade-os/sdk";
 
 // src/refund.ts
-import { base64 as base643, hex as hex5 } from "@scure/base";
+import { base64 as base643, hex as hex7 } from "@scure/base";
 import { sha256 as sha2562 } from "@noble/hashes/sha2.js";
 import {
   CSVMultisigTapscript,
@@ -1116,7 +1459,7 @@ var LockupNeedsRecoveryError = class extends Error {
   }
 };
 async function findLockupVtxos(indexer, swapPkScript) {
-  const scripts = [hex5.encode(swapPkScript)];
+  const scripts = [hex7.encode(swapPkScript)];
   const [spendable, recoverable] = await Promise.all([
     indexer.getVtxos({ scripts, spendableOnly: true }),
     indexer.getVtxos({ scripts, recoverableOnly: true })
@@ -1141,23 +1484,28 @@ async function findLockupVtxos(indexer, swapPkScript) {
   }
   return out;
 }
-var hashesTo = (candidate, paymentHash) => hex5.encode(sha2562(candidate)) === paymentHash;
+var hashesTo = (candidate, paymentHash) => hex7.encode(sha2562(candidate)) === paymentHash;
 var candidateWitnessItems = (tx, inputIndex) => [
   ...getArkPsbtFields(tx, inputIndex, ConditionWitness).flat(),
   ...tx.getInput(inputIndex).finalScriptWitness ?? []
 ];
 async function readLockupFate(indexer, input) {
-  const { vtxos } = await indexer.getVtxos({ scripts: [hex5.encode(input.swapPkScript)] });
+  const { vtxos } = await indexer.getVtxos({ scripts: [hex7.encode(input.swapPkScript)] });
   const all = vtxos ?? [];
   if (all.length === 0) return { fate: "unknown" };
-  const spentBy = /* @__PURE__ */ new Set();
+  const spentBy = /* @__PURE__ */ new Map();
   let everySpendNamed = true;
   for (const vtxo of all) {
     if (!vtxo.isSpent && !vtxo.spentBy && !vtxo.settledBy) return { fate: "open" };
-    if (vtxo.spentBy) spentBy.add(vtxo.spentBy);
+    if (vtxo.spentBy)
+      spentBy.set(vtxo.spentBy, {
+        checkpointTxid: vtxo.spentBy,
+        arkTxid: vtxo.arkTxId
+      });
     else everySpendNamed = false;
   }
-  const { txs } = await indexer.getVirtualTxs([...spentBy]);
+  const spends = [...spentBy.values()];
+  const { txs } = await indexer.getVirtualTxs([...spentBy.keys()]);
   const observed = /* @__PURE__ */ new Set();
   for (const raw of txs) {
     let tx;
@@ -1170,16 +1518,16 @@ async function readLockupFate(indexer, input) {
     for (let i = 0; i < tx.inputsLength; i++) {
       const spent = tx.getInput(i);
       if (!spent.txid) continue;
-      const txid = hex5.encode(spent.txid);
+      const txid = hex7.encode(spent.txid);
       if (!all.some((vtxo) => vtxo.txid === txid && vtxo.vout === spent.index)) continue;
       for (const candidate of candidateWitnessItems(tx, i)) {
         if (hashesTo(candidate, input.paymentHash)) {
-          return { fate: "claimed", preimage: candidate };
+          return { fate: "claimed", preimage: candidate, spends };
         }
       }
     }
   }
-  return everySpendNamed && observed.size === spentBy.size ? { fate: "returned" } : { fate: "unknown" };
+  return everySpendNamed && observed.size === spentBy.size ? { fate: "returned", spends } : { fate: "unknown" };
 }
 async function pushRefundWithoutReceiver(ark, input) {
   if (input.vtxos.length === 0) throw new Error("nothing to refund: no funded outputs");
@@ -1199,7 +1547,7 @@ async function pushRefundWithoutReceiver(ark, input) {
   const info = await ark.getInfo();
   let serverUnrollScript;
   try {
-    serverUnrollScript = CSVMultisigTapscript.decode(hex5.decode(info.checkpointTapscript));
+    serverUnrollScript = CSVMultisigTapscript.decode(hex7.decode(info.checkpointTapscript));
   } catch {
     throw new Error("invalid checkpointTapscript from the Arkade server");
   }
@@ -1310,13 +1658,13 @@ async function pushClaim(ark, input) {
     }
   }
   const committed = input.script.options.preimageHash;
-  if (hex6.encode(ripemd160(sha2563(input.preimage))) !== hex6.encode(committed)) {
+  if (hex8.encode(ripemd160(sha2563(input.preimage))) !== hex8.encode(committed)) {
     throw new Error("preimage does not match the covenant's payment hash");
   }
   const info = await ark.getInfo();
   let serverUnrollScript;
   try {
-    serverUnrollScript = CSVMultisigTapscript2.decode(hex6.decode(info.checkpointTapscript));
+    serverUnrollScript = CSVMultisigTapscript2.decode(hex8.decode(info.checkpointTapscript));
   } catch {
     throw new Error("invalid checkpointTapscript from the Arkade server");
   }
@@ -1411,10 +1759,31 @@ async function senderIdentityForSwapRecord(wallet, record) {
   }
 }
 
+// src/arkadeRefunder.ts
+function arkadeRefunder(deps) {
+  return async (swap) => {
+    const script = swap.lockup?.script;
+    if (!script) {
+      throw new Error(
+        `swap ${swap.rfqId} carries no lockup covenant, so its refund cannot be built`
+      );
+    }
+    const vtxos = await findLockupVtxos(deps.indexer, swap.lockupPkScript);
+    if (vtxos.length === 0) return null;
+    const record = await deps.repository.getRfqSwap(swap.rfqId);
+    if (!record) {
+      throw new RefundNotLocallyPossibleError(
+        "no-secrets",
+        `no stored record for ${swap.rfqId}; the descriptor that signs its refund lives there`
+      );
+    }
+    const sender = await senderIdentityForSwapRecord(deps.wallet, rfqSignerOf(record) ?? {});
+    return pushRefundWithoutReceiver(deps.ark, { script, sender, vtxos });
+  };
+}
+
 // src/swapManager.ts
-import { hex as hex7 } from "@scure/base";
-var RFQ_SWAP_TERMINAL_STATES = ["settled", "refunded", "failed"];
-var isRfqSwapTerminal = (state) => RFQ_SWAP_TERMINAL_STATES.includes(state);
+import { hex as hex9 } from "@scure/base";
 function nextOnchainAction(input) {
   switch (input.phase.phase) {
     case "unfunded":
@@ -1430,6 +1799,17 @@ function nextOnchainAction(input) {
       return input.htlcLocktime - input.now >= ONCHAIN_CLAIM_MARGIN_SECONDS ? "claim" : "claim_window_closed";
   }
 }
+var RfqSwapOriginRequired = class extends Error {
+  /** The swap that could not be admitted. */
+  rfqId;
+  constructor(rfqId) {
+    super(
+      `rfq swap ${rfqId} has no stored record and no origin was supplied; pass the request-time origin as addSwap's second argument so its first record can be written`
+    );
+    this.name = "RfqSwapOriginRequired";
+    this.rfqId = rfqId;
+  }
+};
 var notify = (listeners, call) => {
   for (const listener of listeners) {
     try {
@@ -1507,7 +1887,20 @@ var RfqSwapManager = class {
    * answers instead of throwing "not found". Cleared by {@link removeSwap}. */
   finished = /* @__PURE__ */ new Map();
   waiters = /* @__PURE__ */ new Map();
-  /** Records changed during the current pass, flushed through `saveSwap`. */
+  /**
+   * The request-time origin of each swap the manager may have to CREATE a
+   * record for, by rfqId.
+   *
+   * Needed only for a swap the store has never seen: once a record exists,
+   * `updateRfqSwapRecord` carries the origin half through and the map is
+   * redundant. It is kept anyway for the swap's whole life, so a record the
+   * store loses between passes is rewritten rather than lost — and dropped
+   * by {@link removeSwap} and by retention, which are the two places a swap
+   * stops being this manager's business.
+   */
+  origins = /* @__PURE__ */ new Map();
+  /** Records changed during the current pass, flushed to the repository and
+   * through `saveSwap`. */
   dirty = /* @__PURE__ */ new Set();
   /** Race guard: one action at a time per swap. */
   inProgress = /* @__PURE__ */ new Set();
@@ -1529,7 +1922,9 @@ var RfqSwapManager = class {
       this.actionExecutedListeners.add(config.events.onActionExecuted);
     }
   }
-  /** Wire the money-moving half. Without it the manager only watches. */
+  /** Wire the money-moving half. Without it the manager only watches. The
+   * two claims may be omitted for a consumer that drives no kind reaching
+   * them — see {@link AvailableRfqSwapManagerCallbacks}. */
   setCallbacks(callbacks) {
     this.callbacks = callbacks;
   }
@@ -1549,6 +1944,116 @@ var RfqSwapManager = class {
     this.actionExecutedListeners.add(listener);
     return () => this.actionExecutedListeners.delete(listener);
   }
+  /**
+   * Rebuild every stored swap and take over monitoring them.
+   *
+   * The composition a consumer otherwise writes by hand, and the one place
+   * all four pieces meet: retention decides what to keep
+   * (`shouldRetainRfqSwap`), the lockup's contract row supplies the covenant
+   * (`lockupContractParams`), `rebuildRfqSwap` turns a record back into a
+   * live swap, and each rebuilt swap arrives with its own origin, so nothing
+   * is asked of the caller.
+   *
+   * **Deliberately not part of {@link start}.** A consumer that wants to
+   * look at its records — count them, show them, prune and stop — is not
+   * forced to start driving money to do it. Call this first and `start()`
+   * after; a manager already running polls the restored swaps at once.
+   *
+   * Retention runs BEFORE the rebuild, so a record past
+   * `RFQ_SWAP_RETENTION_SECONDS` costs no contract lookup on its way to being
+   * dropped.
+   *
+   * **A record that cannot be rebuilt is reported, never swallowed and never
+   * fatal.** `rebuildRfqSwap` throws by design when the covenant params do
+   * not derive the funded address, and `lockupContractParams` throws
+   * `LockupContractMissing` when the wallet has no row for the lockup — both
+   * say something true about that one record, and neither is a reason to
+   * strand the others. They come back in {@link RfqRestoreResult.failed}.
+   */
+  async restoreFromRepository(options = {}) {
+    const repository = this.requireRepository("restoreFromRepository");
+    const params = options.params ?? this.paramsFromContracts();
+    const records = await repository.getAllRfqSwaps();
+    const pruned = await this.dropRetired(repository, records);
+    const retired = new Set(pruned);
+    const restored = [];
+    const failed = [];
+    for (const record of records) {
+      if (retired.has(record.rfqId)) continue;
+      let swap;
+      try {
+        swap = rebuildRfqSwap(record, await params(record));
+      } catch (error) {
+        failed.push({
+          rfqId: record.rfqId,
+          error: error instanceof Error ? error : new Error(errorMessage(error))
+        });
+        continue;
+      }
+      this.origins.set(record.rfqId, rfqSwapOriginOf(record));
+      if (isRfqSwapTerminal(swap.state)) this.finished.set(swap.rfqId, swap);
+      else this.track(swap);
+      restored.push(swap);
+    }
+    if (this.running) {
+      await Promise.allSettled(
+        restored.filter((swap) => this.monitored.has(swap.rfqId)).map((swap) => this.pollSwap(swap))
+      );
+    }
+    return { restored, failed, pruned };
+  }
+  /**
+   * Drop stored records that are terminal and past
+   * `RFQ_SWAP_RETENTION_SECONDS`, and return their ids.
+   *
+   * `needs_counterparty` is never dropped, however old: the money is still at
+   * the lockup and the counterparty's move still ends the swap. That rule
+   * lives in `shouldRetainRfqSwap`, which this defers to rather than
+   * restating.
+   *
+   * Public because retention is a caller's cadence, not the manager's: a
+   * long-lived process wants it on a timer of its own, a mobile app wants it
+   * at boot. {@link restoreFromRepository} runs it first, so the boot path
+   * needs no separate call.
+   */
+  async pruneRetiredSwaps() {
+    const repository = this.deps.repository;
+    if (!repository) return [];
+    return this.dropRetired(repository, await repository.getAllRfqSwaps());
+  }
+  async dropRetired(repository, records) {
+    const now = this.config.now();
+    const dropped = [];
+    for (const record of records) {
+      if (shouldRetainRfqSwap(record, now)) continue;
+      await repository.removeRfqSwap(record.rfqId);
+      this.finished.delete(record.rfqId);
+      if (!this.monitored.has(record.rfqId)) this.origins.delete(record.rfqId);
+      dropped.push(record.rfqId);
+    }
+    return dropped;
+  }
+  requireRepository(method) {
+    const repository = this.deps.repository;
+    if (!repository) {
+      throw new Error(
+        `${method} needs a record store; pass one as RfqSwapManagerDeps.repository`
+      );
+    }
+    return repository;
+  }
+  /** The default covenant source: the wallet's own contract row for each
+   * lockup, which is where registration put it before the address could be
+   * funded. */
+  paramsFromContracts() {
+    const contracts = this.deps.contracts;
+    if (!contracts) {
+      throw new Error(
+        "restoreFromRepository needs the covenant parameters: wire RfqSwapManagerDeps.contracts so each lockup's contract row can be read, or pass options.params"
+      );
+    }
+    return (record) => lockupContractParams(contracts, record.lockupAddress);
+  }
   /**
    * Load records and begin monitoring. Runs one pass immediately — a caller
    * resuming after a restart may be well past a deadline already — then
@@ -1558,8 +2063,17 @@ var RfqSwapManager = class {
    * Calling it again while running loads the records and returns rather than
    * re-arming — dropping them silently would strand a funded swap on a
    * caller's harmless double-start.
+   *
+   * The signature is unchanged with a {@link RfqSwapManagerDeps.repository}
+   * wired; the origins are resolved from the store instead, by the same rule
+   * {@link addSwap} applies. A swap the store has never seen throws
+   * {@link RfqSwapOriginRequired} — hand that one to `addSwap` with its
+   * origin, or restore the whole set with {@link restoreFromRepository},
+   * which needs no caller input at all. Every swap is checked before any is
+   * tracked, so a bad one in the list does not leave a half-loaded manager.
    */
   async start(swaps = []) {
+    for (const swap of swaps) await this.admit(swap);
     for (const swap of swaps) {
       if (isRfqSwapTerminal(swap.state)) this.finished.set(swap.rfqId, swap);
       else this.track(swap);
@@ -1591,9 +2105,22 @@ var RfqSwapManager = class {
     this.unsubscribeContracts?.();
     this.unsubscribeContracts = null;
   }
-  /** Begin monitoring a swap. Polled immediately when the manager is running,
-   * so a just-funded swap does not wait out a whole interval. */
-  async addSwap(swap) {
+  /**
+   * Begin monitoring a swap. Polled immediately when the manager is running,
+   * so a just-funded swap does not wait out a whole interval.
+   *
+   * `origin` is the request-time half a live swap cannot carry — the corridor,
+   * the funded address, the corridor's profile, the funding txid — and it is
+   * what lets the manager write this swap's FIRST record. Supply it whenever
+   * a {@link RfqSwapManagerDeps.repository} is wired and the swap is new. It
+   * may be omitted for a swap the store already holds a record for, which is
+   * then read to confirm it; omitting it for one the store has never seen
+   * throws {@link RfqSwapOriginRequired} rather than admitting a swap whose
+   * record could never be written. With no repository wired the parameter is
+   * inert.
+   */
+  async addSwap(swap, origin) {
+    await this.admit(swap, origin);
     if (isRfqSwapTerminal(swap.state)) {
       this.finished.set(swap.rfqId, swap);
       return;
@@ -1601,6 +2128,29 @@ var RfqSwapManager = class {
     this.track(swap);
     if (this.running) await this.pollSwap(swap);
   }
+  /**
+   * Settle where this swap's record will come from, before it is monitored.
+   *
+   * Three ways it can be answered, in order: the caller passed an origin, one
+   * is already remembered from an earlier `addSwap`, or the store holds a
+   * record — which is the origin, already written. Only the last costs a read,
+   * and only when the first two are absent.
+   */
+  async admit(swap, origin) {
+    if (origin) {
+      assertSameSwap(origin, swap);
+      this.origins.set(swap.rfqId, origin);
+      if (this.deps.repository && !isRfqSwapTerminal(swap.state)) {
+        this.dirty.add(swap.rfqId);
+      }
+      return;
+    }
+    const repository = this.deps.repository;
+    if (!repository || this.origins.has(swap.rfqId)) return;
+    const stored = await repository.getRfqSwap(swap.rfqId);
+    if (!stored) throw new RfqSwapOriginRequired(swap.rfqId);
+    this.origins.set(swap.rfqId, rfqSwapOriginOf(stored));
+  }
   /** Forget a swap entirely, monitored or finished.
    *
    * Its contract row is left alone: registration is a wallet-level fact about
@@ -1618,6 +2168,7 @@ var RfqSwapManager = class {
     }
     this.waiters.delete(rfqId);
     this.dirty.delete(rfqId);
+    this.origins.delete(rfqId);
   }
   /** Every swap still being monitored. */
   async getPendingSwaps() {
@@ -1680,7 +2231,7 @@ var RfqSwapManager = class {
   // ── internals ────────────────────────────────────────────────────────────
   track(swap) {
     this.monitored.set(swap.rfqId, swap);
-    this.byLockupScript.set(hex7.encode(swap.lockupPkScript), swap);
+    this.byLockupScript.set(hex9.encode(swap.lockupPkScript), swap);
   }
   /** Drops the swap from BOTH indexes. The event index is the one that stops
    * a late event finding a swap that is gone; `pollSwap`'s own
@@ -1689,7 +2240,7 @@ var RfqSwapManager = class {
    * them from silently re-driving a cancelled swap. */
   untrack(rfqId) {
     const swap = this.monitored.get(rfqId);
-    if (swap) this.byLockupScript.delete(hex7.encode(swap.lockupPkScript));
+    if (swap) this.byLockupScript.delete(hex9.encode(swap.lockupPkScript));
     this.monitored.delete(rfqId);
     this.refundRefused.delete(rfqId);
     this.lastClaimError.delete(rfqId);
@@ -1751,7 +2302,7 @@ var RfqSwapManager = class {
     if (!lockup) {
       try {
         const [existing] = await contracts.getContracts({
-          script: hex7.encode(swap.lockupPkScript)
+          script: hex9.encode(swap.lockupPkScript)
         });
         if (existing) {
           this.registered.set(swap.rfqId, true);
@@ -1770,13 +2321,13 @@ var RfqSwapManager = class {
       );
       return;
     }
-    const script = hex7.encode(lockup.script.pkScript);
-    if (script !== hex7.encode(swap.lockupPkScript)) {
+    const script = hex9.encode(lockup.script.pkScript);
+    if (script !== hex9.encode(swap.lockupPkScript)) {
       this.registered.set(swap.rfqId, false);
       this.emitFailed(
         swap,
         new Error(
-          `swap ${swap.rfqId} lockup script ${script} does not match its lockupPkScript ${hex7.encode(swap.lockupPkScript)}`
+          `swap ${swap.rfqId} lockup script ${script} does not match its lockupPkScript ${hex9.encode(swap.lockupPkScript)}`
         )
       );
       return;
@@ -1795,7 +2346,7 @@ var RfqSwapManager = class {
    * script for its whole life. Best-effort — the swap is over either way. */
   retireContract(swap) {
     if (!this.deps.contracts || !this.registered.get(swap.rfqId)) return;
-    void this.deps.contracts.setContractWatchState(hex7.encode(swap.lockupPkScript), "retained").catch((error) => this.emitFailed(swap, error));
+    void this.deps.contracts.setContractWatchState(hex9.encode(swap.lockupPkScript), "retained").catch((error) => this.emitFailed(swap, error));
   }
   arm() {
     if (!this.running) return;
@@ -1833,6 +2384,7 @@ var RfqSwapManager = class {
       fate = { fate: "unknown" };
     }
     if (fate.fate === "claimed" || fate.fate === "returned") {
+      this.stampLockupSpends(swap, fate.spends);
       this.setState(swap, fate.fate === "claimed" ? "settled" : "refunded");
       return;
     }
@@ -1917,10 +2469,10 @@ var RfqSwapManager = class {
         );
       }
     }
-    if (!this.callbacks) {
+    if (!this.callbacks || !this.callbacks.claimLockup) {
       return this.block(
         swap,
-        "no callbacks are wired, so this wallet cannot claim the lockup"
+        this.callbacks ? "no claimLockup callback is wired, so this wallet cannot claim the lockup" : "no callbacks are wired, so this wallet cannot claim the lockup"
       );
     }
     this.setState(swap, "claimable");
@@ -1970,8 +2522,15 @@ var RfqSwapManager = class {
     });
     if (action === "claim" && phase.phase === "claimable") {
       if (swap.claimTxid) return "continue";
+      if (this.callbacks && !this.callbacks.claimOnchain) {
+        this.block(
+          swap,
+          "no claimOnchain callback is wired, so this wallet cannot claim the L1 fill"
+        );
+        return "handled";
+      }
       this.setOnchainState(swap, "claimable");
-      if (!this.config.enableAutoActions || !this.callbacks) return "handled";
+      if (!this.config.enableAutoActions || !this.callbacks?.claimOnchain) return "handled";
       try {
         const { txid } = await this.callbacks.claimOnchain(swap, phase.utxo);
         swap.claimTxid = txid;
@@ -2084,6 +2643,24 @@ var RfqSwapManager = class {
     if (swap.state !== "needs_counterparty") return;
     this.setState(swap, traderClaimTxid(swap) ? "claimed" : "pending");
   }
+  /**
+   * Record which ark transactions ended the lockup.
+   *
+   * Only the ones the indexer actually named: `LockupSpend.arkTxid` is
+   * optional, and a checkpoint txid is not what history correlates on — a
+   * record carrying one would name a transaction the wallet's own activity
+   * never shows. Fewer txids is the right failure here.
+   *
+   * Assigned rather than merged: the fate is one read of the whole lockup,
+   * so it is the complete answer for this swap, and a swap only reaches a
+   * verdict once.
+   */
+  stampLockupSpends(swap, spends) {
+    const arkTxids = spends.map((spend) => spend.arkTxid).filter((txid) => txid !== void 0);
+    if (arkTxids.length === 0) return;
+    swap.lockupSpendArkTxids = arkTxids;
+    this.touch(swap);
+  }
   touch(swap) {
     swap.updatedAt = this.config.now();
     this.dirty.add(swap.rfqId);
@@ -2109,9 +2686,29 @@ var RfqSwapManager = class {
   emitAction(swap, action) {
     notify(this.actionExecutedListeners, (listener) => listener(swap, action));
   }
-  /** Whether the record is now persisted — false only when `saveSwap` threw. */
+  /**
+   * Flush a changed record to every sink that is wired, and say whether all
+   * of them took it.
+   *
+   * Up to two writes, in this order: the canonical `RfqSwapRecord` to
+   * {@link RfqSwapManagerDeps.repository}, then
+   * {@link RfqSwapManagerCallbacks.saveSwap}. Both gate — a rejection from
+   * either leaves the record dirty and monitored, so waiters stay unsettled
+   * and a terminal swap is not finalized until the write it claims lands.
+   * That is exactly today's rule for `saveSwap`, applied to whichever sinks
+   * exist; wiring the repository does not weaken it.
+   *
+   * The canonical write goes FIRST and a failure there skips the second.
+   * `saveSwap` is a projection of the record, and projecting a state the
+   * record of record has just refused would leave the secondary sink ahead
+   * of the primary — the one ordering that survives no restart.
+   *
+   * With neither wired the state is process-local, which is what a manager
+   * with no callbacks has always done.
+   */
   async save(swap) {
-    if (!this.callbacks) return true;
+    if (!await this.saveRecord(swap)) return false;
+    if (!this.callbacks?.saveSwap) return true;
     try {
       await this.callbacks.saveSwap(swap);
       return true;
@@ -2120,6 +2717,25 @@ var RfqSwapManager = class {
       return false;
     }
   }
+  /** The canonical write. True when there is no repository to write to. */
+  async saveRecord(swap) {
+    const repository = this.deps.repository;
+    if (!repository) return true;
+    try {
+      const stored = await repository.getRfqSwap(swap.rfqId);
+      const record = stored ? updateRfqSwapRecord(stored, swap) : createRfqSwapRecord(this.originOrThrow(swap), swap);
+      await repository.saveRfqSwap(record);
+      return true;
+    } catch (error) {
+      this.emitFailed(swap, error);
+      return false;
+    }
+  }
+  originOrThrow(swap) {
+    const origin = this.origins.get(swap.rfqId);
+    if (!origin) throw new RfqSwapOriginRequired(swap.rfqId);
+    return origin;
+  }
   /**
    * Drop a terminal swap from monitoring and report it exactly once.
    *
@@ -2179,6 +2795,10 @@ var errorMessage = (error) => error instanceof Error ? error.message : String(er
 var outpointKey = (vtxo) => `${vtxo.txid}:${vtxo.vout}`;
 
 // src/activity.ts
+import {
+  ArkAddress as ArkAddress4
+} from "@arkade-os/sdk";
+import { hex as hex10 } from "@scure/base";
 var LABELS = {
   lightning_send: "Lightning send",
   lightning_receive: "Lightning receive",
@@ -2231,6 +2851,44 @@ function swapActivityResolver(deps) {
     }
   };
 }
+async function rfqSwapActivityInputs(deps) {
+  const records = await deps.repository.getAllRfqSwaps();
+  return Promise.all(records.map((record) => activityInputOf(record, deps.indexer)));
+}
+async function activityInputOf(record, indexer) {
+  const txids = /* @__PURE__ */ new Set();
+  if (record.fundingArkTxid) txids.add(record.fundingArkTxid);
+  if (record.refundArkTxid) txids.add(record.refundArkTxid);
+  const handler = rfqCorridorHandlers.getOrThrow(record.kind);
+  for (const txid of handler.activityTxids?.(record.profile) ?? []) txids.add(txid);
+  for (const txid of record.lockupSpendArkTxids ?? []) txids.add(txid);
+  const spendUnknown = isRfqSwapTerminal(record.state) && !record.refundArkTxid && !record.lockupSpendArkTxids?.length;
+  if (indexer && (!record.fundingArkTxid || spendUnknown)) {
+    for (const txid of await lockupTxids(indexer, record, !record.fundingArkTxid)) {
+      txids.add(txid);
+    }
+  }
+  return { rfqId: record.rfqId, kind: record.kind, state: record.state, txids: [...txids] };
+}
+async function lockupTxids(indexer, record, wantFunding) {
+  let script;
+  try {
+    script = hex10.encode(ArkAddress4.decode(record.lockupAddress).pkScript);
+  } catch {
+    return [];
+  }
+  try {
+    const { vtxos } = await indexer.getVtxos({ scripts: [script] });
+    const out = [];
+    for (const vtxo of vtxos ?? []) {
+      if (wantFunding) out.push(vtxo.txid);
+      if (vtxo.arkTxId) out.push(vtxo.arkTxId);
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
 export {
   ARKADE_ASSET,
   ARKADE_BTC,
@@ -2242,6 +2900,7 @@ export {
   LIGHTNING_RECEIVE_PAIR,
   LIGHTNING_SEND_PAIR,
   LockupAmountMismatchError,
+  LockupContractMissing,
   LockupNeedsRecoveryError,
   LockupRegistrationFailed,
   MAX_MIN_CONFIRMATIONS,
@@ -2259,16 +2918,20 @@ export {
   QUOTE_OPTIONS,
   REFUND_MTP_LAG_SECONDS,
   RFQ_RESOLVED_STATES,
+  RFQ_SWAP_RETENTION_SECONDS,
   RFQ_SWAP_TERMINAL_STATES,
   RFQ_TERMINAL_STATES,
   RefundNotLocallyPossibleError,
   RfqSwapManager,
+  RfqSwapOriginRequired,
   SOLO_REFUND_HEADROOM_SECONDS,
   SWAP_LOCKUP_CONTRACT_KIND,
   SWAP_LOCKUP_CONTRACT_LABEL,
   SWAP_LOCKUP_CONTRACT_TYPE,
   SwapRefusal,
   addAssetSwap,
+  arkadeAssetLeg,
+  arkadeRefunder,
   arkadeSwapRequest,
   assertFundable,
   assertReceivable,
@@ -2284,6 +2947,7 @@ export {
   classifyOnchainHtlc,
   classifySpend,
   createOffer,
+  createRfqSwapRecord,
   decodeOffer,
   deriveLightningReceive,
   deriveOnchainReceive,
@@ -2301,6 +2965,7 @@ export {
   lightningReceiveRequest,
   lightningSendRequest,
   lightningSendVtxoScript,
+  lockupContractParams,
   makeCachedFeedFetch,
   newPreimage,
   newRfqId,
@@ -2309,12 +2974,14 @@ export {
   offerVtxoScript,
   onchainHtlcScript,
   onchainReceiveRequest,
+  onchainSendProfile,
   onchainSendRequest,
   paymentHashOf,
   preimageForSwapRecord,
   pushClaim,
   pushRefundWithoutReceiver,
   readLockupFate,
+  rebuildRfqSwap,
   receiveVtxoScript,
   refundIfUnresolved,
   registerLockupContract,
@@ -2325,9 +2992,15 @@ export {
   requestOnchainSend,
   restoreAssetSwaps,
   retireSettledOfferContracts,
+  rfqClaimSecretOf,
   rfqPair,
+  rfqSecretsProfile,
+  rfqSignerOf,
+  rfqSwapActivityInputs,
+  rfqSwapOriginOf,
   sealClaimPacket,
   senderIdentityForSwapRecord,
+  shouldRetainRfqSwap,
   spendTxidsOf,
   spendUpdate,
   swapActivityResolver,
@@ -2338,6 +3011,7 @@ export {
   unilateralRefundWithoutReceiverDelay,
   updateAssetSwap,
   updateAssetSwapBestEffort,
+  updateRfqSwapRecord,
   validatePlan,
   verifyLockupAddress,
   verifyReceiveInvoice,