@arkade-os/swap 0.0.9 → 0.0.10

package/dist/{chunk-2FEMUOIH.js → chunk-5NPYNQ5V.js}

@@ -639,10 +639,8 @@ async function requestLightningSend(wallet, arkServerUrl, transport, params) {
   const rfqId = params.rfqId ?? newRfqId();
   const secrets = await provisionRefundKey(wallet);
   const senderPubkey = secrets.pubkey;
-  const [info, refundAddress] = await Promise.all([
-    new RestArkProvider(arkServerUrl).getInfo(),
-    wallet.getAddress()
-  ]);
+  const refundAddress = secrets.address;
+  const info = await new RestArkProvider(arkServerUrl).getInfo();
   const quote = await transport.requestQuote(
     lightningSendRequest({ rfqId, invoice: params.invoice.raw, refundAddress, senderPubkey })
   );
@@ -677,7 +675,7 @@ async function requestLightningSend(wallet, arkServerUrl, transport, params) {
     ),
     senderPubkey,
     receiverPkScript: solverHex(receiverPkScriptHex, "profile.receiver_pk_script"),
-    refundPkScript: ArkAddress2.decode(refundAddress).pkScript
+    refundPkScript: secrets.pkScript
   };
   const script = lightningSendVtxoScript(treeParams);
   const address = script.address(network.hrp, serverPubkey).encode();

package/dist/index.cjs

@@ -609,8 +609,8 @@ async function cancelOffer(wallet, arkServerUrl, offerHex, opts) {
     // script and the payout script comes from wallet.getAddress(), so the
     // client's network (which only shapes address derivation) is unused here
   });
-  const serverKey = swapAddress ? import_sdk2.ArkAddress.decode(swapAddress).serverPubKey : client.serverKey;
-  const { program, args, keys } = swapProgramBinding(offer, serverKey);
+  const operatorPubkey = swapAddress ? import_sdk2.ArkAddress.decode(swapAddress).serverPubKey : client.serverKey;
+  const { program, args, keys } = swapProgramBinding(offer, operatorPubkey);
   const rebuilt = new import_sdk2.arkade.ArkadeProgramScript(program, args, keys);
   if (import_base2.hex.encode(rebuilt.pkScript) !== import_base2.hex.encode(offer.swapPkScript)) {
     throw new Error(
@@ -2135,10 +2135,8 @@ async function requestLightningSend(wallet, arkServerUrl, transport, params) {
   const rfqId = params.rfqId ?? newRfqId();
   const secrets = await (0, import_sdk10.provisionRefundKey)(wallet);
   const senderPubkey = secrets.pubkey;
-  const [info, refundAddress] = await Promise.all([
-    new import_sdk9.RestArkProvider(arkServerUrl).getInfo(),
-    wallet.getAddress()
-  ]);
+  const refundAddress = secrets.address;
+  const info = await new import_sdk9.RestArkProvider(arkServerUrl).getInfo();
   const quote = await transport.requestQuote(
     lightningSendRequest({ rfqId, invoice: params.invoice.raw, refundAddress, senderPubkey })
   );
@@ -2173,7 +2171,7 @@ async function requestLightningSend(wallet, arkServerUrl, transport, params) {
     ),
     senderPubkey,
     receiverPkScript: solverHex(receiverPkScriptHex, "profile.receiver_pk_script"),
-    refundPkScript: import_sdk9.ArkAddress.decode(refundAddress).pkScript
+    refundPkScript: secrets.pkScript
   };
   const script = lightningSendVtxoScript(treeParams);
   const address = script.address(network.hrp, serverPubkey).encode();
@@ -2747,6 +2745,7 @@ async function findLockupVtxos(indexer, swapPkScript) {
     [recoverable.vtxos ?? [], true]
   ]) {
     for (const vtxo of vtxos) {
+      if (vtxo.isUnrolled) continue;
       const key = `${vtxo.txid}:${vtxo.vout}`;
       if (seen.has(key)) continue;
       seen.add(key);
@@ -2769,10 +2768,17 @@ async function readLockupFate(indexer, input) {
   const { vtxos } = await indexer.getVtxos({ scripts: [import_base11.hex.encode(input.swapPkScript)] });
   const all = vtxos ?? [];
   if (all.length === 0) return { fate: "unknown" };
+  const exited = all.filter((vtxo) => vtxo.isUnrolled && !(0, import_sdk11.hasTerminalSpend)(vtxo));
+  if (exited.length > 0) {
+    return {
+      fate: "exited",
+      outpoints: exited.map((vtxo) => ({ txid: vtxo.txid, vout: vtxo.vout }))
+    };
+  }
   const spentBy = /* @__PURE__ */ new Map();
   let everySpendNamed = true;
   for (const vtxo of all) {
-    if (!vtxo.isSpent && !vtxo.spentBy && !vtxo.settledBy) return { fate: "open" };
+    if (!(0, import_sdk11.hasTerminalSpend)(vtxo)) return { fate: "open" };
     if (vtxo.spentBy)
       spentBy.set(vtxo.spentBy, {
         checkpointTxid: vtxo.spentBy,
@@ -3660,12 +3666,36 @@ var RfqSwapManager = class {
       this.setState(swap, fate.fate === "claimed" ? "settled" : "refunded");
       return;
     }
-    if (swap.kind === "lightning_receive") return this.driveReceiveClaim(swap);
+    if (swap.kind === "lightning_receive") {
+      return fate.fate === "exited" ? this.blockExitedLockup(swap, fate) : this.driveReceiveClaim(swap);
+    }
     if (swap.kind === "onchain_send" && swap.state !== "claimed") {
       if (await this.driveOnchain(swap) === "handled") return;
     }
+    if (fate.fate === "exited") {
+      const claiming = swap.state === "claimable" || swap.state === "claimed";
+      if (this.config.now() < swap.refundLocktime && claiming) return;
+      return this.blockExitedLockup(swap, fate);
+    }
     await this.driveArkadeRefund(swap);
   }
+  /**
+   * The lockup was unilaterally exited: its outputs sit onchain under the
+   * VHTLC script, where no offchain claim or refund can reach them.
+   *
+   * `needs_counterparty` rather than a terminal state, because the money still
+   * needs action and the swap can still end either way — an onchain claim can
+   * reveal the preimage, an onchain refund can return it — and that state is
+   * documented as re-checked every pass. It must be set from HERE and not from
+   * inside `driveArkadeRefund`, whose two `unblock` calls would lift it again
+   * on the very next pass.
+   */
+  blockExitedLockup(swap, fate) {
+    this.block(
+      swap,
+      `the lockup was unilaterally exited (${fate.outpoints.length} output(s) onchain), so no offchain spend can move it \u2014 complete the unroll and spend it onchain`
+    );
+  }
   /**
    * The receive leg's whole state machine: claim the solver-funded lockup
    * while the window is open, and recognise the shapes in which it can be

package/dist/index.d.cts

@@ -1,9 +1,9 @@
 import { ProvisionedKey, ProvisionedClaimSecret, asset, IWallet, arkade, RestIndexerProvider, Transaction, IContractManager, VHTLC, Identity, ActivityResolver } from '@arkade-os/sdk';
-import { S as SwapSecretsProjection, R as RfqSwapRecord, A as AssetSwapRepository, a as AssetSwap, M as MarketsCacheEntry, b as RefundArkProvider, c as RefundIndexer, L as LockupVtxo, d as RfqSwap, e as ArkadeRefundResult, f as LockupSpendIndexer, g as RfqSwapState } from './repository-DEHLtD9l.cjs';
-export { h as AssetSwapStatus, i as AvailableRfqSwapManagerCallbacks, B as BTC_ASSET_ID, I as InMemoryAssetSwapRepository, j as LightningReceiveSwap, k as LightningSendSwap, l as LockupFate, m as LockupNeedsRecoveryError, n as LockupParams, o as LockupSpend, O as OnchainSendAction, p as OnchainSendSwap, P as PersistableRfqSwap, q as PreimageBlockedReason, r as PreimageNotRecoverableError, s as REFUND_MTP_LAG_SECONDS, t as RFQ_RESOLVED_STATES, u as RFQ_SWAP_RETENTION_SECONDS, v as RFQ_SWAP_TERMINAL_STATES, w as RefundOutcome, x as RfqRestoreFailure, y as RfqRestoreOptions, z as RfqRestoreResult, C as RfqSwapActionName, D as RfqSwapLockup, E as RfqSwapManager, F as RfqSwapManagerCallbacks, G as RfqSwapManagerConfig, H as RfqSwapManagerDeps, J as RfqSwapManagerEvents, K as RfqSwapOrigin, N as RfqSwapOriginRequired, Q as RfqSwapOutcome, T as RfqSwapRecordStore, U as SwapContractRegistry, V as addAssetSwap, W as awaitRfqResolution, X as createRfqSwapRecord, Y as findLockupVtxos, Z as getAssetSwaps, _ as getAssetSwapsOrThrow, $ as isRfqSwapTerminal, a0 as isRfqTerminal, a1 as nextOnchainAction, a2 as preimageForSwapRecord, a3 as pushRefundWithoutReceiver, a4 as readLockupFate, a5 as rebuildRfqSwap, a6 as refundIfUnresolved, a7 as rfqSwapOriginOf, a8 as shouldRetainRfqSwap, a9 as swapSecretsToRecord, aa as updateAssetSwap, ab as updateAssetSwapBestEffort, ac as updateRfqSwapRecord } from './repository-DEHLtD9l.cjs';
+import { S as SwapSecretsProjection, R as RfqSwapRecord, A as AssetSwapRepository, a as AssetSwap, M as MarketsCacheEntry, b as RefundArkProvider, c as RefundIndexer, L as LockupVtxo, d as RfqSwap, e as ArkadeRefundResult, f as LockupSpendIndexer, g as RfqSwapState } from './repository-C8FXlmHY.cjs';
+export { h as AssetSwapStatus, i as AvailableRfqSwapManagerCallbacks, B as BTC_ASSET_ID, I as InMemoryAssetSwapRepository, j as LightningReceiveSwap, k as LightningSendSwap, l as LockupFate, m as LockupNeedsRecoveryError, n as LockupParams, o as LockupSpend, O as OnchainSendAction, p as OnchainSendSwap, P as PersistableRfqSwap, q as PreimageBlockedReason, r as PreimageNotRecoverableError, s as REFUND_MTP_LAG_SECONDS, t as RFQ_RESOLVED_STATES, u as RFQ_SWAP_RETENTION_SECONDS, v as RFQ_SWAP_TERMINAL_STATES, w as RefundOutcome, x as RfqRestoreFailure, y as RfqRestoreOptions, z as RfqRestoreResult, C as RfqSwapActionName, D as RfqSwapLockup, E as RfqSwapManager, F as RfqSwapManagerCallbacks, G as RfqSwapManagerConfig, H as RfqSwapManagerDeps, J as RfqSwapManagerEvents, K as RfqSwapOrigin, N as RfqSwapOriginRequired, Q as RfqSwapOutcome, T as RfqSwapRecordStore, U as SwapContractRegistry, V as addAssetSwap, W as awaitRfqResolution, X as createRfqSwapRecord, Y as findLockupVtxos, Z as getAssetSwaps, _ as getAssetSwapsOrThrow, $ as isRfqSwapTerminal, a0 as isRfqTerminal, a1 as nextOnchainAction, a2 as preimageForSwapRecord, a3 as pushRefundWithoutReceiver, a4 as readLockupFate, a5 as rebuildRfqSwap, a6 as refundIfUnresolved, a7 as rfqSwapOriginOf, a8 as shouldRetainRfqSwap, a9 as swapSecretsToRecord, aa as updateAssetSwap, ab as updateAssetSwapBestEffort, ac as updateRfqSwapRecord } from './repository-C8FXlmHY.cjs';
 import { Network, LocalCardInput, DiscoveredMarket, Side, OfferPlan } from '@arkade-os/solver-discovery';
-import { O as OnchainNetwork, a as OnchainHtlc, b as OnchainHtlcParams } from './rfq-hbzhTWHT.cjs';
-export { A as ARKADE_ASSET, c as ARKADE_BTC, d as AddressMismatch, C as ChainSource, e as ChainUtxo, H as HtlcUtxo, I as InvoiceFacts, L as LIGHTNING_BTC, f as LIGHTNING_RECEIVE_PAIR, g as LIGHTNING_SEND_PAIR, h as LOCKTIME_THRESHOLD, i as LightningReceiveTreeParams, j as LightningSendTreeParams, M as MAX_MIN_CONFIRMATIONS, k as MIN_CLAIM_WINDOW_SECONDS, l as MIN_HEADROOM_SECONDS, m as ONCHAIN_BTC, n as ONCHAIN_CLAIM_MARGIN_SECONDS, o as ONCHAIN_DUST_SATS, p as ONCHAIN_ORDER_MARGIN_SECONDS, q as ONCHAIN_RECEIVE_PAIR, r as ONCHAIN_SECONDS_PER_BLOCK, s as ONCHAIN_SEND_PAIR, t as OnchainHtlcPhase, R as RFQ_TERMINAL_STATES, u as RelaySocket, v as RfqQuote, w as RfqRefusalReason, x as RfqStatus, y as RfqTransport, S as SOLO_REFUND_HEADROOM_SECONDS, z as SwapRefusal, B as arkadeAssetLeg, D as arkadeSwapRequest, E as assertFundable, F as assertReceivable, G as awaitOnchainFill, J as buildHtlcClaim, K as buildHtlcRefund, N as claimOnchainFill, P as classifyOnchainHtlc, Q as deriveLightningReceive, T as deriveOnchainReceive, U as deriveOnchainSend, V as extractPreimage, W as httpTransport, X as lightningReceiveRequest, Y as lightningSendRequest, Z as lightningSendVtxoScript, _ as newPreimage, $ as newRfqId, a0 as offerTermsFromQuote, a1 as onchainHtlcScript, a2 as onchainReceiveRequest, a3 as onchainSendRequest, a4 as paymentHashOf, a5 as receiveVtxoScript, a6 as relayTransport, a7 as requestLightningReceive, a8 as requestLightningSend, a9 as requestOnchainReceive, aa as requestOnchainSend, ab as rfqPair, ac as unilateralClaimDelay, ad as unilateralRefundDelay, ae as unilateralRefundWithoutReceiverDelay, af as verifyLockupAddress, ag as verifyReceiveInvoice } from './rfq-hbzhTWHT.cjs';
+import { O as OnchainNetwork, a as OnchainHtlc, b as OnchainHtlcParams } from './rfq-DglvHMNC.cjs';
+export { A as ARKADE_ASSET, c as ARKADE_BTC, d as AddressMismatch, C as ChainSource, e as ChainUtxo, H as HtlcUtxo, I as InvoiceFacts, L as LIGHTNING_BTC, f as LIGHTNING_RECEIVE_PAIR, g as LIGHTNING_SEND_PAIR, h as LOCKTIME_THRESHOLD, i as LightningReceiveTreeParams, j as LightningSendTreeParams, M as MAX_MIN_CONFIRMATIONS, k as MIN_CLAIM_WINDOW_SECONDS, l as MIN_HEADROOM_SECONDS, m as ONCHAIN_BTC, n as ONCHAIN_CLAIM_MARGIN_SECONDS, o as ONCHAIN_DUST_SATS, p as ONCHAIN_ORDER_MARGIN_SECONDS, q as ONCHAIN_RECEIVE_PAIR, r as ONCHAIN_SECONDS_PER_BLOCK, s as ONCHAIN_SEND_PAIR, t as OnchainHtlcPhase, R as RFQ_TERMINAL_STATES, u as RelaySocket, v as RfqQuote, w as RfqRefusalReason, x as RfqStatus, y as RfqTransport, S as SOLO_REFUND_HEADROOM_SECONDS, z as SwapRefusal, B as arkadeAssetLeg, D as arkadeSwapRequest, E as assertFundable, F as assertReceivable, G as awaitOnchainFill, J as buildHtlcClaim, K as buildHtlcRefund, N as claimOnchainFill, P as classifyOnchainHtlc, Q as deriveLightningReceive, T as deriveOnchainReceive, U as deriveOnchainSend, V as extractPreimage, W as httpTransport, X as lightningReceiveRequest, Y as lightningSendRequest, Z as lightningSendVtxoScript, _ as newPreimage, $ as newRfqId, a0 as offerTermsFromQuote, a1 as onchainHtlcScript, a2 as onchainReceiveRequest, a3 as onchainSendRequest, a4 as paymentHashOf, a5 as receiveVtxoScript, a6 as relayTransport, a7 as requestLightningReceive, a8 as requestLightningSend, a9 as requestOnchainReceive, aa as requestOnchainSend, ab as rfqPair, ac as unilateralClaimDelay, ad as unilateralRefundDelay, ae as unilateralRefundWithoutReceiverDelay, af as verifyLockupAddress, ag as verifyReceiveInvoice } from './rfq-DglvHMNC.cjs';
 
 /**
  * Which wallet key signs this leg. Stored at `profile.signer`.

package/dist/index.d.ts

@@ -1,9 +1,9 @@
 import { ProvisionedKey, ProvisionedClaimSecret, asset, IWallet, arkade, RestIndexerProvider, Transaction, IContractManager, VHTLC, Identity, ActivityResolver } from '@arkade-os/sdk';
-import { S as SwapSecretsProjection, R as RfqSwapRecord, A as AssetSwapRepository, a as AssetSwap, M as MarketsCacheEntry, b as RefundArkProvider, c as RefundIndexer, L as LockupVtxo, d as RfqSwap, e as ArkadeRefundResult, f as LockupSpendIndexer, g as RfqSwapState } from './repository-DIAr5XYk.js';
-export { h as AssetSwapStatus, i as AvailableRfqSwapManagerCallbacks, B as BTC_ASSET_ID, I as InMemoryAssetSwapRepository, j as LightningReceiveSwap, k as LightningSendSwap, l as LockupFate, m as LockupNeedsRecoveryError, n as LockupParams, o as LockupSpend, O as OnchainSendAction, p as OnchainSendSwap, P as PersistableRfqSwap, q as PreimageBlockedReason, r as PreimageNotRecoverableError, s as REFUND_MTP_LAG_SECONDS, t as RFQ_RESOLVED_STATES, u as RFQ_SWAP_RETENTION_SECONDS, v as RFQ_SWAP_TERMINAL_STATES, w as RefundOutcome, x as RfqRestoreFailure, y as RfqRestoreOptions, z as RfqRestoreResult, C as RfqSwapActionName, D as RfqSwapLockup, E as RfqSwapManager, F as RfqSwapManagerCallbacks, G as RfqSwapManagerConfig, H as RfqSwapManagerDeps, J as RfqSwapManagerEvents, K as RfqSwapOrigin, N as RfqSwapOriginRequired, Q as RfqSwapOutcome, T as RfqSwapRecordStore, U as SwapContractRegistry, V as addAssetSwap, W as awaitRfqResolution, X as createRfqSwapRecord, Y as findLockupVtxos, Z as getAssetSwaps, _ as getAssetSwapsOrThrow, $ as isRfqSwapTerminal, a0 as isRfqTerminal, a1 as nextOnchainAction, a2 as preimageForSwapRecord, a3 as pushRefundWithoutReceiver, a4 as readLockupFate, a5 as rebuildRfqSwap, a6 as refundIfUnresolved, a7 as rfqSwapOriginOf, a8 as shouldRetainRfqSwap, a9 as swapSecretsToRecord, aa as updateAssetSwap, ab as updateAssetSwapBestEffort, ac as updateRfqSwapRecord } from './repository-DIAr5XYk.js';
+import { S as SwapSecretsProjection, R as RfqSwapRecord, A as AssetSwapRepository, a as AssetSwap, M as MarketsCacheEntry, b as RefundArkProvider, c as RefundIndexer, L as LockupVtxo, d as RfqSwap, e as ArkadeRefundResult, f as LockupSpendIndexer, g as RfqSwapState } from './repository-Cw2EvvZG.js';
+export { h as AssetSwapStatus, i as AvailableRfqSwapManagerCallbacks, B as BTC_ASSET_ID, I as InMemoryAssetSwapRepository, j as LightningReceiveSwap, k as LightningSendSwap, l as LockupFate, m as LockupNeedsRecoveryError, n as LockupParams, o as LockupSpend, O as OnchainSendAction, p as OnchainSendSwap, P as PersistableRfqSwap, q as PreimageBlockedReason, r as PreimageNotRecoverableError, s as REFUND_MTP_LAG_SECONDS, t as RFQ_RESOLVED_STATES, u as RFQ_SWAP_RETENTION_SECONDS, v as RFQ_SWAP_TERMINAL_STATES, w as RefundOutcome, x as RfqRestoreFailure, y as RfqRestoreOptions, z as RfqRestoreResult, C as RfqSwapActionName, D as RfqSwapLockup, E as RfqSwapManager, F as RfqSwapManagerCallbacks, G as RfqSwapManagerConfig, H as RfqSwapManagerDeps, J as RfqSwapManagerEvents, K as RfqSwapOrigin, N as RfqSwapOriginRequired, Q as RfqSwapOutcome, T as RfqSwapRecordStore, U as SwapContractRegistry, V as addAssetSwap, W as awaitRfqResolution, X as createRfqSwapRecord, Y as findLockupVtxos, Z as getAssetSwaps, _ as getAssetSwapsOrThrow, $ as isRfqSwapTerminal, a0 as isRfqTerminal, a1 as nextOnchainAction, a2 as preimageForSwapRecord, a3 as pushRefundWithoutReceiver, a4 as readLockupFate, a5 as rebuildRfqSwap, a6 as refundIfUnresolved, a7 as rfqSwapOriginOf, a8 as shouldRetainRfqSwap, a9 as swapSecretsToRecord, aa as updateAssetSwap, ab as updateAssetSwapBestEffort, ac as updateRfqSwapRecord } from './repository-Cw2EvvZG.js';
 import { Network, LocalCardInput, DiscoveredMarket, Side, OfferPlan } from '@arkade-os/solver-discovery';
-import { O as OnchainNetwork, a as OnchainHtlc, b as OnchainHtlcParams } from './rfq-hbzhTWHT.js';
-export { A as ARKADE_ASSET, c as ARKADE_BTC, d as AddressMismatch, C as ChainSource, e as ChainUtxo, H as HtlcUtxo, I as InvoiceFacts, L as LIGHTNING_BTC, f as LIGHTNING_RECEIVE_PAIR, g as LIGHTNING_SEND_PAIR, h as LOCKTIME_THRESHOLD, i as LightningReceiveTreeParams, j as LightningSendTreeParams, M as MAX_MIN_CONFIRMATIONS, k as MIN_CLAIM_WINDOW_SECONDS, l as MIN_HEADROOM_SECONDS, m as ONCHAIN_BTC, n as ONCHAIN_CLAIM_MARGIN_SECONDS, o as ONCHAIN_DUST_SATS, p as ONCHAIN_ORDER_MARGIN_SECONDS, q as ONCHAIN_RECEIVE_PAIR, r as ONCHAIN_SECONDS_PER_BLOCK, s as ONCHAIN_SEND_PAIR, t as OnchainHtlcPhase, R as RFQ_TERMINAL_STATES, u as RelaySocket, v as RfqQuote, w as RfqRefusalReason, x as RfqStatus, y as RfqTransport, S as SOLO_REFUND_HEADROOM_SECONDS, z as SwapRefusal, B as arkadeAssetLeg, D as arkadeSwapRequest, E as assertFundable, F as assertReceivable, G as awaitOnchainFill, J as buildHtlcClaim, K as buildHtlcRefund, N as claimOnchainFill, P as classifyOnchainHtlc, Q as deriveLightningReceive, T as deriveOnchainReceive, U as deriveOnchainSend, V as extractPreimage, W as httpTransport, X as lightningReceiveRequest, Y as lightningSendRequest, Z as lightningSendVtxoScript, _ as newPreimage, $ as newRfqId, a0 as offerTermsFromQuote, a1 as onchainHtlcScript, a2 as onchainReceiveRequest, a3 as onchainSendRequest, a4 as paymentHashOf, a5 as receiveVtxoScript, a6 as relayTransport, a7 as requestLightningReceive, a8 as requestLightningSend, a9 as requestOnchainReceive, aa as requestOnchainSend, ab as rfqPair, ac as unilateralClaimDelay, ad as unilateralRefundDelay, ae as unilateralRefundWithoutReceiverDelay, af as verifyLockupAddress, ag as verifyReceiveInvoice } from './rfq-hbzhTWHT.js';
+import { O as OnchainNetwork, a as OnchainHtlc, b as OnchainHtlcParams } from './rfq-DglvHMNC.js';
+export { A as ARKADE_ASSET, c as ARKADE_BTC, d as AddressMismatch, C as ChainSource, e as ChainUtxo, H as HtlcUtxo, I as InvoiceFacts, L as LIGHTNING_BTC, f as LIGHTNING_RECEIVE_PAIR, g as LIGHTNING_SEND_PAIR, h as LOCKTIME_THRESHOLD, i as LightningReceiveTreeParams, j as LightningSendTreeParams, M as MAX_MIN_CONFIRMATIONS, k as MIN_CLAIM_WINDOW_SECONDS, l as MIN_HEADROOM_SECONDS, m as ONCHAIN_BTC, n as ONCHAIN_CLAIM_MARGIN_SECONDS, o as ONCHAIN_DUST_SATS, p as ONCHAIN_ORDER_MARGIN_SECONDS, q as ONCHAIN_RECEIVE_PAIR, r as ONCHAIN_SECONDS_PER_BLOCK, s as ONCHAIN_SEND_PAIR, t as OnchainHtlcPhase, R as RFQ_TERMINAL_STATES, u as RelaySocket, v as RfqQuote, w as RfqRefusalReason, x as RfqStatus, y as RfqTransport, S as SOLO_REFUND_HEADROOM_SECONDS, z as SwapRefusal, B as arkadeAssetLeg, D as arkadeSwapRequest, E as assertFundable, F as assertReceivable, G as awaitOnchainFill, J as buildHtlcClaim, K as buildHtlcRefund, N as claimOnchainFill, P as classifyOnchainHtlc, Q as deriveLightningReceive, T as deriveOnchainReceive, U as deriveOnchainSend, V as extractPreimage, W as httpTransport, X as lightningReceiveRequest, Y as lightningSendRequest, Z as lightningSendVtxoScript, _ as newPreimage, $ as newRfqId, a0 as offerTermsFromQuote, a1 as onchainHtlcScript, a2 as onchainReceiveRequest, a3 as onchainSendRequest, a4 as paymentHashOf, a5 as receiveVtxoScript, a6 as relayTransport, a7 as requestLightningReceive, a8 as requestLightningSend, a9 as requestOnchainReceive, aa as requestOnchainSend, ab as rfqPair, ac as unilateralClaimDelay, ad as unilateralRefundDelay, ae as unilateralRefundWithoutReceiverDelay, af as verifyLockupAddress, ag as verifyReceiveInvoice } from './rfq-DglvHMNC.js';
 
 /**
  * Which wallet key signs this leg. Stored at `profile.signer`.

package/dist/index.js

@@ -63,7 +63,7 @@ import {
   unilateralRefundWithoutReceiverDelay,
   verifyLockupAddress,
   verifyReceiveInvoice
-} from "./chunk-2FEMUOIH.js";
+} from "./chunk-5NPYNQ5V.js";
 import {
   InMemoryAssetSwapRepository,
   marketsCacheKey
@@ -527,8 +527,8 @@ async function cancelOffer(wallet, arkServerUrl, offerHex, opts) {
     // script and the payout script comes from wallet.getAddress(), so the
     // client's network (which only shapes address derivation) is unused here
   });
-  const serverKey = swapAddress ? ArkAddress.decode(swapAddress).serverPubKey : client.serverKey;
-  const { program, args, keys } = swapProgramBinding(offer, serverKey);
+  const operatorPubkey = swapAddress ? ArkAddress.decode(swapAddress).serverPubKey : client.serverKey;
+  const { program, args, keys } = swapProgramBinding(offer, operatorPubkey);
   const rebuilt = new arkade.ArkadeProgramScript(program, args, keys);
   if (hex2.encode(rebuilt.pkScript) !== hex2.encode(offer.swapPkScript)) {
     throw new Error(
@@ -1412,6 +1412,7 @@ import {
   assertSubmittedArkTxid,
   buildOffchainTx,
   getArkPsbtFields,
+  hasTerminalSpend,
   matchServerCheckpoints
 } from "@arkade-os/sdk";
 var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -1472,6 +1473,7 @@ async function findLockupVtxos(indexer, swapPkScript) {
     [recoverable.vtxos ?? [], true]
   ]) {
     for (const vtxo of vtxos) {
+      if (vtxo.isUnrolled) continue;
       const key = `${vtxo.txid}:${vtxo.vout}`;
       if (seen.has(key)) continue;
       seen.add(key);
@@ -1494,10 +1496,17 @@ async function readLockupFate(indexer, input) {
   const { vtxos } = await indexer.getVtxos({ scripts: [hex7.encode(input.swapPkScript)] });
   const all = vtxos ?? [];
   if (all.length === 0) return { fate: "unknown" };
+  const exited = all.filter((vtxo) => vtxo.isUnrolled && !hasTerminalSpend(vtxo));
+  if (exited.length > 0) {
+    return {
+      fate: "exited",
+      outpoints: exited.map((vtxo) => ({ txid: vtxo.txid, vout: vtxo.vout }))
+    };
+  }
   const spentBy = /* @__PURE__ */ new Map();
   let everySpendNamed = true;
   for (const vtxo of all) {
-    if (!vtxo.isSpent && !vtxo.spentBy && !vtxo.settledBy) return { fate: "open" };
+    if (!hasTerminalSpend(vtxo)) return { fate: "open" };
     if (vtxo.spentBy)
       spentBy.set(vtxo.spentBy, {
         checkpointTxid: vtxo.spentBy,
@@ -2389,12 +2398,36 @@ var RfqSwapManager = class {
       this.setState(swap, fate.fate === "claimed" ? "settled" : "refunded");
       return;
     }
-    if (swap.kind === "lightning_receive") return this.driveReceiveClaim(swap);
+    if (swap.kind === "lightning_receive") {
+      return fate.fate === "exited" ? this.blockExitedLockup(swap, fate) : this.driveReceiveClaim(swap);
+    }
     if (swap.kind === "onchain_send" && swap.state !== "claimed") {
       if (await this.driveOnchain(swap) === "handled") return;
     }
+    if (fate.fate === "exited") {
+      const claiming = swap.state === "claimable" || swap.state === "claimed";
+      if (this.config.now() < swap.refundLocktime && claiming) return;
+      return this.blockExitedLockup(swap, fate);
+    }
     await this.driveArkadeRefund(swap);
   }
+  /**
+   * The lockup was unilaterally exited: its outputs sit onchain under the
+   * VHTLC script, where no offchain claim or refund can reach them.
+   *
+   * `needs_counterparty` rather than a terminal state, because the money still
+   * needs action and the swap can still end either way — an onchain claim can
+   * reveal the preimage, an onchain refund can return it — and that state is
+   * documented as re-checked every pass. It must be set from HERE and not from
+   * inside `driveArkadeRefund`, whose two `unblock` calls would lift it again
+   * on the very next pass.
+   */
+  blockExitedLockup(swap, fate) {
+    this.block(
+      swap,
+      `the lockup was unilaterally exited (${fate.outpoints.length} output(s) onchain), so no offchain spend can move it \u2014 complete the unroll and spend it onchain`
+    );
+  }
   /**
    * The receive leg's whole state machine: claim the solver-funded lockup
    * while the window is open, and recognise the shapes in which it can be

package/dist/nostr.d.cts

@@ -1,4 +1,4 @@
-import { y as RfqTransport } from './rfq-hbzhTWHT.cjs';
+import { y as RfqTransport } from './rfq-DglvHMNC.cjs';
 import { SimplePool } from 'nostr-tools';
 import '@arkade-os/sdk';
 

package/dist/nostr.d.ts

@@ -1,4 +1,4 @@
-import { y as RfqTransport } from './rfq-hbzhTWHT.js';
+import { y as RfqTransport } from './rfq-DglvHMNC.js';
 import { SimplePool } from 'nostr-tools';
 import '@arkade-os/sdk';
 

package/dist/nostr.js

@@ -1,7 +1,7 @@
 import {
   expectQuote,
   pairOf
-} from "./chunk-2FEMUOIH.js";
+} from "./chunk-5NPYNQ5V.js";
 
 // src/nostr.ts
 import {

package/dist/repositories/realm/index.d.cts

@@ -1,8 +1,8 @@
 import { RealmLike } from '@arkade-os/sdk/repositories/realm';
-import { A as AssetSwapRepository, a as AssetSwap, R as RfqSwapRecord, M as MarketsCacheEntry } from '../../repository-DEHLtD9l.cjs';
+import { A as AssetSwapRepository, a as AssetSwap, R as RfqSwapRecord, M as MarketsCacheEntry } from '../../repository-C8FXlmHY.cjs';
 import '@arkade-os/solver-discovery';
 import '@arkade-os/sdk';
-import '../../rfq-hbzhTWHT.cjs';
+import '../../rfq-DglvHMNC.cjs';
 
 /**
  * Realm backend for React Native.

package/dist/repositories/realm/index.d.ts

@@ -1,8 +1,8 @@
 import { RealmLike } from '@arkade-os/sdk/repositories/realm';
-import { A as AssetSwapRepository, a as AssetSwap, R as RfqSwapRecord, M as MarketsCacheEntry } from '../../repository-DIAr5XYk.js';
+import { A as AssetSwapRepository, a as AssetSwap, R as RfqSwapRecord, M as MarketsCacheEntry } from '../../repository-Cw2EvvZG.js';
 import '@arkade-os/solver-discovery';
 import '@arkade-os/sdk';
-import '../../rfq-hbzhTWHT.js';
+import '../../rfq-DglvHMNC.js';
 
 /**
  * Realm backend for React Native.

package/dist/repositories/sqlite/index.d.cts

@@ -1,8 +1,8 @@
 import { SQLExecutor } from '@arkade-os/sdk/repositories/sqlite';
-import { A as AssetSwapRepository, a as AssetSwap, R as RfqSwapRecord, M as MarketsCacheEntry } from '../../repository-DEHLtD9l.cjs';
+import { A as AssetSwapRepository, a as AssetSwap, R as RfqSwapRecord, M as MarketsCacheEntry } from '../../repository-C8FXlmHY.cjs';
 import '@arkade-os/solver-discovery';
 import '@arkade-os/sdk';
-import '../../rfq-hbzhTWHT.cjs';
+import '../../rfq-DglvHMNC.cjs';
 
 /**
  * SQLite backend over the SDK's `SQLExecutor`, so any driver plugs in

package/dist/repositories/sqlite/index.d.ts

@@ -1,8 +1,8 @@
 import { SQLExecutor } from '@arkade-os/sdk/repositories/sqlite';
-import { A as AssetSwapRepository, a as AssetSwap, R as RfqSwapRecord, M as MarketsCacheEntry } from '../../repository-DIAr5XYk.js';
+import { A as AssetSwapRepository, a as AssetSwap, R as RfqSwapRecord, M as MarketsCacheEntry } from '../../repository-Cw2EvvZG.js';
 import '@arkade-os/solver-discovery';
 import '@arkade-os/sdk';
-import '../../rfq-hbzhTWHT.js';
+import '../../rfq-DglvHMNC.js';
 
 /**
  * SQLite backend over the SDK's `SQLExecutor`, so any driver plugs in

package/dist/{repository-DIAr5XYk.d.ts → repository-C8FXlmHY.d.cts}

@@ -1,6 +1,6 @@
 import { DiscoveredMarket } from '@arkade-os/solver-discovery';
 import { IWallet, ProvisionedKey, ProvisionedClaimSecret, RestArkProvider, RestIndexerProvider, VHTLC, Identity, IContractManager } from '@arkade-os/sdk';
-import { x as RfqStatus, y as RfqTransport, a as OnchainHtlc, e as ChainUtxo, C as ChainSource, t as OnchainHtlcPhase } from './rfq-hbzhTWHT.js';
+import { x as RfqStatus, y as RfqTransport, a as OnchainHtlc, e as ChainUtxo, C as ChainSource, t as OnchainHtlcPhase } from './rfq-DglvHMNC.cjs';
 
 type AssetSwapStatus = "pending" | "cancelling" | "fulfilled" | "cancelled" | "recoverable" | "awaiting_fill" | "claimable" | "claimed" | "refunded_l1";
 /** The sentinel asset id for BTC itself, as opposed to a 68-hex asset id.
@@ -227,12 +227,15 @@ interface LockupVtxo {
      * It is still the trader's money and it is still visible, which is why
      * {@link findLockupVtxos} returns it. What it is not is refundable by
      * {@link pushRefundWithoutReceiver}: that builds an offchain Ark
-     * transaction, and the SDK's own predicates make the two states mutually
-     * exclusive — `canSpendOffchain` is false exactly when `canRecoverOnchain`
-     * is true (`wallet/vtxo.ts`), and the latter is documented as "must be
-     * recovered into a fresh batch rather than spent offchain". Holding the
-     * trader's `sender` key does not change that; a sweep removes the leaf from
-     * the live tree, not the signature from the trader.
+     * transaction, and the SDK's own predicates put the two states on opposite
+     * sides — `canSpendOffchain` is false whenever `canRecoverOnchain` is true
+     * (`wallet/vtxo.ts`), and the latter is documented as "must be recovered
+     * into a fresh batch rather than spent offchain". Holding the trader's
+     * `sender` key does not change that; a sweep removes the leaf from the live
+     * tree, not the signature from the trader.
+     *
+     * Opposite, but not exhaustive: an unrolled output satisfies neither, and
+     * {@link findLockupVtxos} drops those before they reach this type at all.
      *
      * `packages/boltz-swap` splits on exactly this fact rather than working
      * around it: `settleRefundWithoutReceiver` sends a live VTXO through an
@@ -321,6 +324,18 @@ declare class LockupNeedsRecoveryError extends Error {
  * That function refuses the recoverable ones by name rather than submitting a
  * spend the server must reject.
  *
+ * **Unrolled outputs are the one exception, and are dropped.** A unilaterally
+ * exited output lives onchain behind its CSV; no offchain spend of any leaf can
+ * reach it, and `LockupVtxo` carries no field to say so, so a caller could not
+ * tell it apart from a live one. Whether arkd returns such an output under
+ * `spendableOnly` is not determinable from here, so the exclusion is made
+ * defensively rather than assumed. It costs the two waiting callers nothing
+ * they wanted: `awaitLockupFunding` keeps waiting for a claimable lockup
+ * instead of publishing `P` into a spend that cannot land, and
+ * `refundIfUnresolved` reports `nothing_to_refund` instead of grinding a doomed
+ * push to its deadline. The manager reads the exit through
+ * {@link readLockupFate}, which queries unfiltered and reports it as `exited`.
+ *
  * This read — not the RFQ's reported state — is the authority on whether
  * there is anything left at the lockup.
  *
@@ -374,6 +389,29 @@ type LockupFate =
     fate: "returned";
     spends: readonly LockupSpend[];
 }
+/**
+ * At least one output was unilaterally exited: it sits onchain under the
+ * VHTLC script, where no offchain claim or refund can reach it.
+ *
+ * Not terminal, and not a loss. The money is still under the same script
+ * with the same leaves, so `completeUnroll` plus an onchain spend can still
+ * end the swap either way — which is why this outranks `open`: an output
+ * that is "still unspent" but unreachable is not a swap that is merely
+ * running.
+ *
+ * It outranks a verdict too, on a lockup where a sibling output was claimed
+ * or returned. That is the rule `open` already sets, not a new one: the
+ * unspent test short-circuits before any witness is read, so a partially
+ * resolved lockup has never reported `claimed`/`returned`. What changes is
+ * only that such a lockup now says why it is unresolved.
+ */
+ | {
+    fate: "exited";
+    outpoints: readonly {
+        txid: string;
+        vout: number;
+    }[];
+}
 /** Nothing was learned: no outputs visible, an output spent by nothing the
  * indexer names, a spend it could not produce, or a blob that would not
  * decode. Never an answer. */
@@ -409,6 +447,11 @@ type LockupFate =
  * response to `unknown` is the same as to `open`: keep watching, and let the
  * refund timelock — which no outage can move — be what ends the wait.
  *
+ * **An exit is read before anything else, and over the whole set.** It is the
+ * one fact that makes an unspent output unreachable, so it outranks `open`; and
+ * it is scanned across every output rather than in outpoint order, so which
+ * output happens to come first cannot change the answer.
+ *
  * Ask-the-indexer, don't-trust-local-state: read fresh on every poll, never
  * cached, the same posture {@link findLockupVtxos} already establishes.
  */
@@ -447,9 +490,9 @@ declare function readLockupFate(indexer: LockupSpendIndexer, input: {
  * {@link refundIfUnresolved}, which retries.
  *
  * **Swept outputs are refused, not attempted.** This is an OFFCHAIN spend, and
- * a swept output is no longer a live leaf: `canSpendOffchain` and
- * `canRecoverOnchain` are mutually exclusive by construction, so a recoverable
- * input cannot be spent this way whatever key signs it (see
+ * a swept output is no longer a live leaf: `canSpendOffchain` is false wherever
+ * `canRecoverOnchain` is true, so a recoverable input cannot be spent this way
+ * whatever key signs it (see
  * {@link LockupVtxo.recoverable}). Because every input lands in ONE aggregate
  * transaction, a single swept output would take the live ones down with it —
  * so the whole push is refused with {@link LockupNeedsRecoveryError} naming the
@@ -1162,7 +1205,9 @@ interface RfqSwapManagerDeps {
  *    `settled`; a lockup fully spent by anything else ends it `refunded`.
  *    Anything the indexer could not answer is `unknown`, which is NOT an
  *    answer: the pass carries on to the steps below, whose deadlines an indexer
- *    outage has no bearing on.
+ *    outage has no bearing on. `exited` — an output unilaterally taken onchain
+ *    — ends neither the swap nor the pass: it blocks the Arkade half below,
+ *    with the L1 half left running.
  * 2. **Drive the trader's claim.** On an onchain send that is the L1 fill — see
  *    {@link nextOnchainAction}. On a receive it is the lockup itself, and it
  *    ends the pass: that leg has no step 3.
@@ -1493,6 +1538,18 @@ declare class RfqSwapManager {
     private arm;
     private pollSwap;
     private runPass;
+    /**
+     * The lockup was unilaterally exited: its outputs sit onchain under the
+     * VHTLC script, where no offchain claim or refund can reach them.
+     *
+     * `needs_counterparty` rather than a terminal state, because the money still
+     * needs action and the swap can still end either way — an onchain claim can
+     * reveal the preimage, an onchain refund can return it — and that state is
+     * documented as re-checked every pass. It must be set from HERE and not from
+     * inside `driveArkadeRefund`, whose two `unblock` calls would lift it again
+     * on the very next pass.
+     */
+    private blockExitedLockup;
     /**
      * The receive leg's whole state machine: claim the solver-funded lockup
      * while the window is open, and recognise the shapes in which it can be

package/dist/{repository-DEHLtD9l.d.cts → repository-Cw2EvvZG.d.ts}

@@ -1,6 +1,6 @@
 import { DiscoveredMarket } from '@arkade-os/solver-discovery';
 import { IWallet, ProvisionedKey, ProvisionedClaimSecret, RestArkProvider, RestIndexerProvider, VHTLC, Identity, IContractManager } from '@arkade-os/sdk';
-import { x as RfqStatus, y as RfqTransport, a as OnchainHtlc, e as ChainUtxo, C as ChainSource, t as OnchainHtlcPhase } from './rfq-hbzhTWHT.cjs';
+import { x as RfqStatus, y as RfqTransport, a as OnchainHtlc, e as ChainUtxo, C as ChainSource, t as OnchainHtlcPhase } from './rfq-DglvHMNC.js';
 
 type AssetSwapStatus = "pending" | "cancelling" | "fulfilled" | "cancelled" | "recoverable" | "awaiting_fill" | "claimable" | "claimed" | "refunded_l1";
 /** The sentinel asset id for BTC itself, as opposed to a 68-hex asset id.
@@ -227,12 +227,15 @@ interface LockupVtxo {
      * It is still the trader's money and it is still visible, which is why
      * {@link findLockupVtxos} returns it. What it is not is refundable by
      * {@link pushRefundWithoutReceiver}: that builds an offchain Ark
-     * transaction, and the SDK's own predicates make the two states mutually
-     * exclusive — `canSpendOffchain` is false exactly when `canRecoverOnchain`
-     * is true (`wallet/vtxo.ts`), and the latter is documented as "must be
-     * recovered into a fresh batch rather than spent offchain". Holding the
-     * trader's `sender` key does not change that; a sweep removes the leaf from
-     * the live tree, not the signature from the trader.
+     * transaction, and the SDK's own predicates put the two states on opposite
+     * sides — `canSpendOffchain` is false whenever `canRecoverOnchain` is true
+     * (`wallet/vtxo.ts`), and the latter is documented as "must be recovered
+     * into a fresh batch rather than spent offchain". Holding the trader's
+     * `sender` key does not change that; a sweep removes the leaf from the live
+     * tree, not the signature from the trader.
+     *
+     * Opposite, but not exhaustive: an unrolled output satisfies neither, and
+     * {@link findLockupVtxos} drops those before they reach this type at all.
      *
      * `packages/boltz-swap` splits on exactly this fact rather than working
      * around it: `settleRefundWithoutReceiver` sends a live VTXO through an
@@ -321,6 +324,18 @@ declare class LockupNeedsRecoveryError extends Error {
  * That function refuses the recoverable ones by name rather than submitting a
  * spend the server must reject.
  *
+ * **Unrolled outputs are the one exception, and are dropped.** A unilaterally
+ * exited output lives onchain behind its CSV; no offchain spend of any leaf can
+ * reach it, and `LockupVtxo` carries no field to say so, so a caller could not
+ * tell it apart from a live one. Whether arkd returns such an output under
+ * `spendableOnly` is not determinable from here, so the exclusion is made
+ * defensively rather than assumed. It costs the two waiting callers nothing
+ * they wanted: `awaitLockupFunding` keeps waiting for a claimable lockup
+ * instead of publishing `P` into a spend that cannot land, and
+ * `refundIfUnresolved` reports `nothing_to_refund` instead of grinding a doomed
+ * push to its deadline. The manager reads the exit through
+ * {@link readLockupFate}, which queries unfiltered and reports it as `exited`.
+ *
  * This read — not the RFQ's reported state — is the authority on whether
  * there is anything left at the lockup.
  *
@@ -374,6 +389,29 @@ type LockupFate =
     fate: "returned";
     spends: readonly LockupSpend[];
 }
+/**
+ * At least one output was unilaterally exited: it sits onchain under the
+ * VHTLC script, where no offchain claim or refund can reach it.
+ *
+ * Not terminal, and not a loss. The money is still under the same script
+ * with the same leaves, so `completeUnroll` plus an onchain spend can still
+ * end the swap either way — which is why this outranks `open`: an output
+ * that is "still unspent" but unreachable is not a swap that is merely
+ * running.
+ *
+ * It outranks a verdict too, on a lockup where a sibling output was claimed
+ * or returned. That is the rule `open` already sets, not a new one: the
+ * unspent test short-circuits before any witness is read, so a partially
+ * resolved lockup has never reported `claimed`/`returned`. What changes is
+ * only that such a lockup now says why it is unresolved.
+ */
+ | {
+    fate: "exited";
+    outpoints: readonly {
+        txid: string;
+        vout: number;
+    }[];
+}
 /** Nothing was learned: no outputs visible, an output spent by nothing the
  * indexer names, a spend it could not produce, or a blob that would not
  * decode. Never an answer. */
@@ -409,6 +447,11 @@ type LockupFate =
  * response to `unknown` is the same as to `open`: keep watching, and let the
  * refund timelock — which no outage can move — be what ends the wait.
  *
+ * **An exit is read before anything else, and over the whole set.** It is the
+ * one fact that makes an unspent output unreachable, so it outranks `open`; and
+ * it is scanned across every output rather than in outpoint order, so which
+ * output happens to come first cannot change the answer.
+ *
  * Ask-the-indexer, don't-trust-local-state: read fresh on every poll, never
  * cached, the same posture {@link findLockupVtxos} already establishes.
  */
@@ -447,9 +490,9 @@ declare function readLockupFate(indexer: LockupSpendIndexer, input: {
  * {@link refundIfUnresolved}, which retries.
  *
  * **Swept outputs are refused, not attempted.** This is an OFFCHAIN spend, and
- * a swept output is no longer a live leaf: `canSpendOffchain` and
- * `canRecoverOnchain` are mutually exclusive by construction, so a recoverable
- * input cannot be spent this way whatever key signs it (see
+ * a swept output is no longer a live leaf: `canSpendOffchain` is false wherever
+ * `canRecoverOnchain` is true, so a recoverable input cannot be spent this way
+ * whatever key signs it (see
  * {@link LockupVtxo.recoverable}). Because every input lands in ONE aggregate
  * transaction, a single swept output would take the live ones down with it —
  * so the whole push is refused with {@link LockupNeedsRecoveryError} naming the
@@ -1162,7 +1205,9 @@ interface RfqSwapManagerDeps {
  *    `settled`; a lockup fully spent by anything else ends it `refunded`.
  *    Anything the indexer could not answer is `unknown`, which is NOT an
  *    answer: the pass carries on to the steps below, whose deadlines an indexer
- *    outage has no bearing on.
+ *    outage has no bearing on. `exited` — an output unilaterally taken onchain
+ *    — ends neither the swap nor the pass: it blocks the Arkade half below,
+ *    with the L1 half left running.
  * 2. **Drive the trader's claim.** On an onchain send that is the L1 fill — see
  *    {@link nextOnchainAction}. On a receive it is the lockup itself, and it
  *    ends the pass: that leg has no step 3.
@@ -1493,6 +1538,18 @@ declare class RfqSwapManager {
     private arm;
     private pollSwap;
     private runPass;
+    /**
+     * The lockup was unilaterally exited: its outputs sit onchain under the
+     * VHTLC script, where no offchain claim or refund can reach them.
+     *
+     * `needs_counterparty` rather than a terminal state, because the money still
+     * needs action and the swap can still end either way — an onchain claim can
+     * reveal the preimage, an onchain refund can return it — and that state is
+     * documented as re-checked every pass. It must be set from HERE and not from
+     * inside `driveArkadeRefund`, whose two `unblock` calls would lift it again
+     * on the very next pass.
+     */
+    private blockExitedLockup;
     /**
      * The receive leg's whole state machine: claim the solver-funded lockup
      * while the window is open, and recognise the shapes in which it can be

package/dist/{rfq-hbzhTWHT.d.ts → rfq-DglvHMNC.d.cts}

@@ -487,12 +487,11 @@ interface InvoiceFacts {
  * throws while nothing is funded. `RfqSwapManager` re-registers as a backstop
  * for older records; a repeat write is a no-op.
  *
- * The `sender` key comes from the wallet — a fresh HD descriptor per call, or
- * the wallet's static key — and is returned as `senderPubkey` plus `secrets`.
- * `secrets` holds only a public descriptor; the signer re-derives from the
- * wallet, so nothing secret is at rest. Persist `secrets` with the record
- * anyway: it is how the refund signer is found again. `nonInteractiveRefund`
- * recovers the funds even without it — but it needs the SOLVER's active
+ * The `sender` key is the wallet's identity key, reused by {@link
+ * provisionRefundKey} — returned as `senderPubkey` plus `secrets`. `secrets`
+ * holds only a public descriptor; the signer re-derives from the wallet, so
+ * nothing secret is at rest. Persist `secrets` with the record anyway: it is
+ * how the refund signer is found again. `nonInteractiveRefund` recovers the funds even without it — but it needs the SOLVER's active
  * cooperation, not just infrastructure uptime.
  */
 declare function requestLightningSend(wallet: IWallet, arkServerUrl: string, transport: RfqTransport, params: {
@@ -515,7 +514,8 @@ declare function requestLightningSend(wallet: IWallet, arkServerUrl: string, tra
      * `lockup` (with `address`): without it the manager can only poll, and
      * cannot retire the row this call just wrote. */
     script: InstanceType<typeof VHTLC.ScriptV2>;
-    /** Where a failed swap refunds. */
+    /** Where a failed swap refunds — the same address `secrets.pkScript` was
+     * decoded from, so the quote and the covenant always name one script. */
     refundAddress: string;
     /** The VHTLC `sender` x-only key, bound into the covenant. Public. */
     senderPubkey: Uint8Array;
@@ -528,7 +528,9 @@ declare function requestLightningSend(wallet: IWallet, arkServerUrl: string, tra
      * Returned so a consumer can persist the swap without re-deriving any of
      * it. Half of these are not on the quote: `serverPubkey` and `claimDelay`
      * come from this wallet's own `getInfo()`, `emulatorPubkey` from a
-     * per-network pin, `refundPkScript` from decoding an address.
+     * per-network pin, `refundPkScript` from `secrets` — decoded from the
+     * refund address at provisioning time, the same address this call returns
+     * as `refundAddress`.
      *
      * All public. Persisting them is optional: this call also registers the
      * lockup as a contract, and that row is where `rebuildRfqSwap` takes its

package/dist/{rfq-hbzhTWHT.d.cts → rfq-DglvHMNC.d.ts}

@@ -487,12 +487,11 @@ interface InvoiceFacts {
  * throws while nothing is funded. `RfqSwapManager` re-registers as a backstop
  * for older records; a repeat write is a no-op.
  *
- * The `sender` key comes from the wallet — a fresh HD descriptor per call, or
- * the wallet's static key — and is returned as `senderPubkey` plus `secrets`.
- * `secrets` holds only a public descriptor; the signer re-derives from the
- * wallet, so nothing secret is at rest. Persist `secrets` with the record
- * anyway: it is how the refund signer is found again. `nonInteractiveRefund`
- * recovers the funds even without it — but it needs the SOLVER's active
+ * The `sender` key is the wallet's identity key, reused by {@link
+ * provisionRefundKey} — returned as `senderPubkey` plus `secrets`. `secrets`
+ * holds only a public descriptor; the signer re-derives from the wallet, so
+ * nothing secret is at rest. Persist `secrets` with the record anyway: it is
+ * how the refund signer is found again. `nonInteractiveRefund` recovers the funds even without it — but it needs the SOLVER's active
  * cooperation, not just infrastructure uptime.
  */
 declare function requestLightningSend(wallet: IWallet, arkServerUrl: string, transport: RfqTransport, params: {
@@ -515,7 +514,8 @@ declare function requestLightningSend(wallet: IWallet, arkServerUrl: string, tra
      * `lockup` (with `address`): without it the manager can only poll, and
      * cannot retire the row this call just wrote. */
     script: InstanceType<typeof VHTLC.ScriptV2>;
-    /** Where a failed swap refunds. */
+    /** Where a failed swap refunds — the same address `secrets.pkScript` was
+     * decoded from, so the quote and the covenant always name one script. */
     refundAddress: string;
     /** The VHTLC `sender` x-only key, bound into the covenant. Public. */
     senderPubkey: Uint8Array;
@@ -528,7 +528,9 @@ declare function requestLightningSend(wallet: IWallet, arkServerUrl: string, tra
      * Returned so a consumer can persist the swap without re-deriving any of
      * it. Half of these are not on the quote: `serverPubkey` and `claimDelay`
      * come from this wallet's own `getInfo()`, `emulatorPubkey` from a
-     * per-network pin, `refundPkScript` from decoding an address.
+     * per-network pin, `refundPkScript` from `secrets` — decoded from the
+     * refund address at provisioning time, the same address this call returns
+     * as `refundAddress`.
      *
      * All public. Persisting them is optional: this call also registers the
      * lockup as a contract, and that row is where `rebuildRfqSwap` takes its

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arkade-os/swap",
-  "version": "0.0.9",
+  "version": "0.0.10",
   "type": "module",
   "description": "Client-side Arkade Intents asset swaps: discover markets, quote, create/track/cancel offers, restore from chain.",
   "repository": {
@@ -70,7 +70,7 @@
     "@noble/hashes": "2.0.1",
     "@scure/base": "2.0.0",
     "@scure/btc-signer": "2.0.1",
-    "@arkade-os/sdk": "0.4.66"
+    "@arkade-os/sdk": "0.4.67"
   },
   "peerDependencies": {
     "nostr-tools": "^2.12.0"
@@ -91,8 +91,8 @@
   "scripts": {
     "build": "tsup src/index.ts src/nostr.ts src/repositories/sqlite/index.ts src/repositories/realm/index.ts --format esm,cjs --dts --clean",
     "typecheck": "tsc --noEmit",
-    "format": "prettier --write src test",
-    "lint": "prettier --check src test",
+    "format": "biome format --write src test",
+    "lint": "biome format src test",
     "test": "vitest run --exclude test/e2e",
     "test:unit": "vitest run --exclude test/e2e",
     "test:integration": "vitest run test/e2e/** --exclude test/e2e/rfq*.test.ts",