@hyperbridge/simplex 0.16.5 → 0.16.7

package/dist/index.js

@@ -2402,6 +2402,7 @@ function closedKey(chain, vault) {
 // src/config/external-links.json
 var external_links_default = {
   hyperfxApp: "https://app.hyperfx.finance",
+  alchemyDashboard: "https://dashboard.alchemy.com/",
   hyperbridgeExplorers: {
     mainnet: "https://nexus.statescan.io",
     testnet: "https://gargantua.statescan.io"
@@ -2421,6 +2422,52 @@ var external_links_default = {
 };
 
 // src/cli/init/chains.ts
+var FREE_RPC_URLS = {
+  1: [
+    "https://mainnet.gateway.tenderly.co",
+    "https://rpc.mevblocker.io",
+    "https://ethereum-rpc.publicnode.com",
+    "https://ethereum.public.blockpi.network/v1/rpc/public",
+    "https://eth.blockrazor.xyz",
+    "https://eth.api.pocket.network",
+    "https://ethereum-public.nodies.app",
+    "https://eth-mainnet.public.blastapi.io",
+    "https://public-eth.nownodes.io"
+  ],
+  56: [
+    "https://bsc-rpc.publicnode.com",
+    "https://public-bsc-mainnet.fastnode.io",
+    "https://public-bsc.nownodes.io",
+    "https://bsc.blockrazor.xyz",
+    "https://rpc-bsc.48.club",
+    "https://bsc.api.pocket.network"
+  ],
+  137: [
+    "https://polygon-bor-rpc.publicnode.com",
+    "https://polygon.drpc.org",
+    "https://polygon.gateway.tenderly.co",
+    "https://rpc.private.mev-x.com/polygon",
+    "https://poly.api.pocket.network"
+  ],
+  8453: [
+    "https://base-rpc.publicnode.com",
+    "https://base.gateway.tenderly.co",
+    "https://base.public.blockpi.network/v1/rpc/public",
+    "https://base.rpc.blxrbdn.com",
+    "https://rpc.baseazul.dev",
+    "https://mainnet.base.org",
+    "https://base-public.nodies.app"
+  ],
+  42161: [
+    "https://arbitrum-one-rpc.publicnode.com",
+    "https://arbitrum.gateway.tenderly.co",
+    "https://arbitrum.drpc.org",
+    "https://public-arb-mainnet.fastnode.io",
+    "https://arb-one.api.pocket.network",
+    "https://arbitrum-one-public.nodies.app",
+    "https://arb1.arbitrum.io/rpc"
+  ]
+};
 var CHAIN_NATIVE_SYMBOLS = {
   1: "ETH",
   56: "BNB",
@@ -2448,7 +2495,8 @@ var INIT_CHAINS = [
     label: "Ethereum",
     network: "mainnet",
     alchemySubdomain: "eth-mainnet",
-    explorerUrl: external_links_default.chainExplorers.ethereum
+    explorerUrl: external_links_default.chainExplorers.ethereum,
+    defaultRpcUrls: FREE_RPC_URLS[1]
   },
   {
     chainId: 42161,
@@ -2456,7 +2504,8 @@ var INIT_CHAINS = [
     label: "Arbitrum",
     network: "mainnet",
     alchemySubdomain: "arb-mainnet",
-    explorerUrl: external_links_default.chainExplorers.arbitrum
+    explorerUrl: external_links_default.chainExplorers.arbitrum,
+    defaultRpcUrls: FREE_RPC_URLS[42161]
   },
   {
     chainId: 8453,
@@ -2464,7 +2513,8 @@ var INIT_CHAINS = [
     label: "Base",
     network: "mainnet",
     alchemySubdomain: "base-mainnet",
-    explorerUrl: external_links_default.chainExplorers.base
+    explorerUrl: external_links_default.chainExplorers.base,
+    defaultRpcUrls: FREE_RPC_URLS[8453]
   },
   {
     chainId: 137,
@@ -2472,7 +2522,8 @@ var INIT_CHAINS = [
     label: "Polygon",
     network: "mainnet",
     alchemySubdomain: "polygon-mainnet",
-    explorerUrl: external_links_default.chainExplorers.polygon
+    explorerUrl: external_links_default.chainExplorers.polygon,
+    defaultRpcUrls: FREE_RPC_URLS[137]
   },
   {
     chainId: 56,
@@ -2480,7 +2531,8 @@ var INIT_CHAINS = [
     label: "BNB Chain",
     network: "mainnet",
     alchemySubdomain: "bnb-mainnet",
-    explorerUrl: external_links_default.chainExplorers.bnb
+    explorerUrl: external_links_default.chainExplorers.bnb,
+    defaultRpcUrls: FREE_RPC_URLS[56]
   },
   {
     chainId: 11155111,
@@ -2597,10 +2649,16 @@ var CANCEL_ORDER_MUTATION = `
 `;
 var OrderbookRequestError = class extends Error {
 };
+function graphqlEndpoint(url) {
+  const trimmed = url.trim();
+  if (trimmed.includes("?")) return trimmed;
+  const withoutTrailingSlash = trimmed.replace(/\/+$/, "");
+  return withoutTrailingSlash.endsWith("/graphql") ? withoutTrailingSlash : `${withoutTrailingSlash}/graphql`;
+}
 var OrderbookClient = class {
   constructor(url, requestTimeoutMs, loggers = defaultLoggerContext()) {
-    this.url = url;
     this.requestTimeoutMs = requestTimeoutMs;
+    this.url = graphqlEndpoint(url);
     this.logger = loggers.get("orderbook");
   }
   /** The limits to validate against before posting, plus the books on offer. */
@@ -2698,7 +2756,9 @@ var OrderbookClient = class {
       clearTimeout(timer);
     }
     if (!response.ok) {
-      throw new OrderbookRequestError(`Orderbook returned HTTP ${response.status} ${response.statusText}`);
+      throw new OrderbookRequestError(
+        `Orderbook at ${this.url} returned HTTP ${response.status} ${response.statusText}`
+      );
     }
     const body = await response.json().catch((err) => {
       throw new OrderbookRequestError(`Orderbook returned a body that is not JSON: ${describe(err)}`);
@@ -2813,7 +2873,7 @@ var HEARTBEAT_TYPES = {
 var LimitOrderValidationError = class extends Error {
 };
 var LimitOrderService = class {
-  constructor(store, client, contractService, configService, assetRegistry, signer, defaultTtlSecs, delegationService, loggers = defaultLoggerContext(), startingNonce = initialOrderNonce) {
+  constructor(store, client, contractService, configService, assetRegistry, signer, defaultTtlSecs, delegationService, loggers = defaultLoggerContext(), startingNonce = initialOrderNonce, vaultBalances) {
     this.store = store;
     this.client = client;
     this.contractService = contractService;
@@ -2823,6 +2883,7 @@ var LimitOrderService = class {
     this.defaultTtlSecs = defaultTtlSecs;
     this.delegationService = delegationService;
     this.startingNonce = startingNonce;
+    this.vaultBalances = vaultBalances;
     this.logger = loggers.get("limit-orders");
   }
   /**
@@ -2958,6 +3019,18 @@ var LimitOrderService = class {
       throw err;
     }
   }
+  /**
+   * The pairs an order can be written against, the smallest payout each token may carry, and
+   * the tokens the orderbook registers on each chain.
+   *
+   * The orderbook lists the books; `resolveBook` refuses a request naming anything else, so the
+   * operator is offered exactly these and no combination of symbols they could not post. The
+   * chains do the same for the source chains an order can accept.
+   */
+  async books() {
+    const limits = await this.limits();
+    return { books: limits.books, minOrderSizes: limits.serverInfo.minOrderSizes, chains: limits.chains ?? [] };
+  }
   /**
    * Reads `serverInfo` and `books`, reusing the last read for {@link LIMITS_TTL_MS}.
    *
@@ -3038,6 +3111,18 @@ var LimitOrderService = class {
         );
       }
     }
+    if (book.base !== book.quote) {
+      const input = normalizeSymbol(request.tokenIn);
+      const lacking = sources.filter((source) => {
+        const listed = limits.chains?.find((chain) => chain.id === source);
+        return listed && !listed.tokens.some((token) => normalizeSymbol(token.symbol) === input);
+      });
+      if (lacking.length > 0) {
+        throw new LimitOrderValidationError(
+          `The orderbook has no ${request.tokenIn} on ${lacking.join(", ")}, so swaps from there cannot pay this order`
+        );
+      }
+    }
     if (ttlSecs < limits.serverInfo.minOrderTtlSecs) {
       throw new LimitOrderValidationError(
         `ttlSecs must be at least the orderbook's minimum of ${limits.serverInfo.minOrderTtlSecs}; got ${ttlSecs}`
@@ -3065,28 +3150,61 @@ var LimitOrderService = class {
    * balance on the fill chain, so the operator hears it while they are creating
    * the order.
    *
+   * A fill pays out of the wallet and then withdraws any shortfall from the
+   * configured ERC-4626 vaults in the same batch, so what those vaults hold of
+   * the payout token backs the order too and is counted here. Without it an
+   * operator who sweeps inventory into a vault is refused orders their filler
+   * would have filled.
+   *
    * Each order is checked against the whole balance, not against what is left of
    * it after the others. One balance backs every order resting on it — that is
    * what quoting both sides of a book is — and the orderbook says as much: it
    * advertises each entry at `min(quoted, balance)` rather than dividing the
    * balance between them. Whichever order fills first draws the inventory down,
    * and the rest are cut to what is left. Netting them here would refuse the
-   * second side of every book.
+   * second side of every book. Vault positions are counted the same way: the
+   * whole position, not what is left after reservations for fills in flight.
    */
   async assertWalletCanPay(symbol, chain, payout) {
     const token = this.assetRegistry.getAddress(symbol, chain);
     if (!token) return;
     const decimals = await this.decimalsFor(symbol, token, chain);
-    const balance = toScaled(
+    const wallet = toScaled(
       await this.contractService.getTokenBalance(chain, token, this.signer.address),
       decimals
     );
-    if (balance < payout) {
+    const vaults = await this.vaultHoldings(token, chain);
+    if (wallet + vaults < payout) {
+      const held = vaults > 0n ? `${toHuman(wallet)} in the wallet and ${toHuman(vaults)} in vaults` : toHuman(wallet);
       throw new LimitOrderValidationError(
-        `The wallet holds ${toHuman(balance)} ${symbol} on ${chain}, which cannot pay out ${toHuman(payout)}`
+        `The wallet holds ${held} ${symbol} on ${chain}, which cannot pay out ${toHuman(payout)}`
       );
     }
   }
+  /**
+   * What the configured vaults hold of `token` on `chain`, in scaled units.
+   *
+   * Zero when no vault is configured. A snapshot that cannot be read is also
+   * zero: the wallet alone then has to cover the order, which refuses one the
+   * filler might have managed rather than accepting one it could not.
+   */
+  async vaultHoldings(token, chain) {
+    if (!this.vaultBalances) return 0n;
+    let positions;
+    try {
+      positions = await this.vaultBalances.getBalanceSnapshot(chain);
+    } catch (err) {
+      this.logger.warn({ chain, token, err }, "Could not read vault balances; backing the order on the wallet alone");
+      return 0n;
+    }
+    const wanted = token.toLowerCase();
+    let total = 0n;
+    for (const position of positions) {
+      if (position.chain !== chain || position.asset.toLowerCase() !== wanted) continue;
+      total += toScaled(position.positionAssets, position.decimals);
+    }
+    return total;
+  }
   /**
    * Works a limit order down by what a fill delivered, and puts the rest back on
    * the orderbook.
@@ -12890,14 +13008,10 @@ var RATE_LIMIT_RPC_CODES = /* @__PURE__ */ new Set([-32005, -32097, -32016, 429]
 var RATE_LIMIT_SUSPENSION_MS = 5 * 6e4;
 var SCAN_BUDGET = {
   timeoutMs: 5e3,
-  retryCount: 1,
-  retryDelayMs: 500,
   deadlineMs: 12e3
 };
 var CONFIRMATION_BUDGET = {
   timeoutMs: 1e4,
-  retryCount: 1,
-  retryDelayMs: 500,
   deadlineMs: 3e4
 };
 var MALFORMED_RESPONSE_SUSPENSION_MS = 3e4;
@@ -12989,8 +13103,14 @@ var _QuorumPublicClient = class _QuorumPublicClient {
         chain,
         transport: http(url, {
           timeout: budget.timeoutMs,
-          retryCount: budget.retryCount,
-          retryDelay: budget.retryDelayMs
+          // No transport-level retry. viem's retry sleeps for the provider's
+          // `Retry-After` verbatim and uncapped, which reaches the socket
+          // before {@link suspensionMsFor} can apply its clamp — and even
+          // without that header, retrying inside the task is what makes a
+          // task's worst case (timeout, backoff, timeout) approach the
+          // deadline that is supposed to bound it. One attempt per endpoint
+          // per call; `retryPromise` above the quorum owns the retry policy.
+          retryCount: 0
         })
       })
     );
@@ -13004,11 +13124,10 @@ var _QuorumPublicClient = class _QuorumPublicClient {
     return this.rpcUrls.filter((url) => (_QuorumPublicClient.benchedUntil.get(url) ?? 0) > now);
   }
   /**
-   * The endpoints this call queries — everyone not benched — and the quorum
-   * bar for exactly that set. A benched endpoint is dropped outright: it
-   * answers nothing while throttled, so counting it could only fail calls the
-   * remaining endpoints agree on. With every endpoint benched, everyone is
-   * queried again; there is nobody left to prefer.
+   * The endpoints this call queries: everyone not benched. A benched endpoint is
+   * dropped outright: it answers nothing while throttled, so asking it could only
+   * cost a request. With every endpoint benched, everyone is queried again; there
+   * is nobody left to prefer.
    */
   participants() {
     const now = Date.now();
@@ -13016,12 +13135,7 @@ var _QuorumPublicClient = class _QuorumPublicClient {
     const active = all.filter(({ idx }) => (_QuorumPublicClient.benchedUntil.get(this.rpcUrls[idx]) ?? 0) <= now);
     const allBenched = active.length === 0;
     const queried = allBenched ? all : active;
-    return {
-      queried,
-      skipped: all.length - queried.length,
-      threshold: quorumThreshold(queried.length),
-      allBenched
-    };
+    return { queried, skipped: all.length - queried.length, allBenched };
   }
   /**
    * Records a task failure against its endpoint. Only the failures
@@ -13066,17 +13180,21 @@ var _QuorumPublicClient = class _QuorumPublicClient {
    * retries would otherwise stall every confirmation poll). Stragglers settle
    * out of band and are ignored. `tryDecide` returns undefined to keep
    * waiting; once every task has settled, `finalize` must decide (it throws
-   * the QuorumError when the full response set still has no quorum). Early
-   * exit never weakens the trust model — a decision still requires the same
-   * quorum, it just doesn't wait for votes it no longer needs.
+   * the QuorumError when the full response set still has no quorum).
+   *
+   * Both are handed the bar: the BFT threshold over the endpoints that have not
+   * failed, answered or still out. A failure lowers it rather than counting
+   * against it. Counting the pending endpoints keeps an early decision to a bar
+   * no lower than the full response set would get, so a vote it did not wait for
+   * could never have reversed it.
    *
    * `deadlineMs` bounds the other direction: when the bar is NOT reachable
    * from the fast responders, the call used to wait out every straggler, and
    * the caller's own retry loop multiplied that into minutes of a chain not
    * being scanned at all, silently. At the deadline the outstanding endpoints
    * are treated as failures — named in the QuorumError, so the operator sees
-   * which ones held the call up — and `finalize` decides on the rest. The
-   * trust model is untouched: a decision still needs the same quorum.
+   * which ones held the call up — and `finalize` decides over the endpoints
+   * that answered.
    */
   settleUntilQuorum(tasks, tryDecide, finalize) {
     return new Promise((resolve, reject) => {
@@ -13094,13 +13212,14 @@ var _QuorumPublicClient = class _QuorumPublicClient {
       const evaluate = () => {
         if (done) return;
         try {
-          const early = tryDecide(fulfilled);
+          const threshold = quorumThreshold(tasks.length - failures.length);
+          const early = tryDecide(fulfilled, threshold);
           if (early !== void 0) {
             finish(() => resolve(early));
             return;
           }
           if (outstanding === 0) {
-            const value = finalize(fulfilled, failures);
+            const value = finalize(fulfilled, failures, threshold);
             finish(() => resolve(value));
           }
         } catch (error) {
@@ -13118,7 +13237,7 @@ var _QuorumPublicClient = class _QuorumPublicClient {
           error: new Error(`no answer within the ${this.deadlineMs}ms quorum deadline`)
         }));
         try {
-          const value = finalize(fulfilled, [...failures, ...stragglers]);
+          const value = finalize(fulfilled, [...failures, ...stragglers], quorumThreshold(fulfilled.length));
           finish(() => resolve(value));
         } catch (error) {
           finish(() => reject(error));
@@ -13145,22 +13264,22 @@ var _QuorumPublicClient = class _QuorumPublicClient {
     });
   }
   /**
-   * Highest block head backed by a full quorum. Throws {@link QuorumError}
-   * when fewer than `threshold` endpoints respond.
+   * Highest block head backed by a quorum of the endpoints that answer. Throws
+   * {@link QuorumError} when none do.
    */
   async getBlockNumber() {
-    const { queried, skipped, threshold, allBenched } = this.participants();
+    const { queried, skipped, allBenched } = this.participants();
     return this.settleUntilQuorum(
       queried.map(({ idx, client }) => ({ idx, task: client.getBlockNumber() })),
       // Early exit as soon as a quorum is satisfiable. Late voters could
       // only raise the reported head; the earlier (lower) head is
       // conservative for every consumer (fewer confirmations counted,
       // smaller scan windows).
-      (fulfilled) => this.quorumHead(
+      (fulfilled, threshold) => this.quorumHead(
         fulfilled.map((f) => f.value),
         threshold
       ) ?? void 0,
-      (fulfilled, failures) => {
+      (fulfilled, failures, threshold) => {
         const head = this.quorumHead(
           fulfilled.map((f) => f.value),
           threshold
@@ -13201,7 +13320,7 @@ var _QuorumPublicClient = class _QuorumPublicClient {
       }
       return views;
     };
-    const { queried, skipped, threshold, allBenched } = this.participants();
+    const { queried, skipped, allBenched } = this.participants();
     return this.settleUntilQuorum(
       queried.map(({ idx, client }) => ({
         idx,
@@ -13220,8 +13339,8 @@ var _QuorumPublicClient = class _QuorumPublicClient {
       // Early exit only on a POSITIVE quorum: an agreeing inclusion group can
       // only grow, so the first satisfiable quorum is final. Not-found votes
       // never decide early — "not confirmed" needs the full response set.
-      (fulfilled) => aggregateConfirmations(toViews(fulfilled), threshold) ?? void 0,
-      (fulfilled, failures) => {
+      (fulfilled, threshold) => aggregateConfirmations(toViews(fulfilled), threshold) ?? void 0,
+      (fulfilled, failures, threshold) => {
         const confirmations = aggregateConfirmations(toViews(fulfilled), threshold);
         if (confirmations === null) {
           throw new QuorumError(
@@ -13250,7 +13369,7 @@ var _QuorumPublicClient = class _QuorumPublicClient {
       }
       return groups;
     };
-    const { queried, skipped, threshold, allBenched } = this.participants();
+    const { queried, skipped, allBenched } = this.participants();
     return this.settleUntilQuorum(
       queried.map(({ idx, client }) => ({
         idx,
@@ -13262,13 +13381,13 @@ var _QuorumPublicClient = class _QuorumPublicClient {
       // two disjoint groups can't both hold one), so the first satisfiable
       // agreement is final — no need to wait out stragglers that could
       // only join or lose.
-      (fulfilled) => {
+      (fulfilled, threshold) => {
         for (const group of groupOf(fulfilled).values()) {
           if (group.providerIdxs.length >= threshold) return group.result;
         }
         return void 0;
       },
-      (fulfilled, failures) => {
+      (fulfilled, failures, threshold) => {
         const groups = groupOf(fulfilled);
         for (const group of groups.values()) {
           if (group.providerIdxs.length >= threshold) return group.result;
@@ -21224,8 +21343,15 @@ var IntentFiller = class {
     const evalDurationSec = (Date.now() - evalStartMs) / 1e3;
     this.monitor.emit("orderTiming", { orderId: order.id, phase: "evaluation", durationSec: evalDurationSec });
     if (validStrategies.length === 0) {
-      this.logger.warn({ orderId: order.id }, "No profitable strategy found for order");
-      this.monitor.emit("orderSkipped", { orderId: order.id, reason: "No profitable strategy" });
+      const priced = eligibleStrategies.some((s) => s !== null);
+      this.logger.warn(
+        { orderId: order.id },
+        priced ? "No profitable strategy found for order" : "No strategy can fill this order"
+      );
+      this.monitor.emit("orderSkipped", {
+        orderId: order.id,
+        reason: priced ? "No profitable strategy" : "No strategy can fill this order"
+      });
       return null;
     }
     this.logger.info(
@@ -21672,16 +21798,63 @@ function byBestOfferFirst(a, b) {
   if (a.available !== b.available) return a.available > b.available ? -1 : 1;
   return a.order.id < b.order.id ? -1 : 1;
 }
+function whyUnmatched(orders, incoming, resolve, now = /* @__PURE__ */ new Date()) {
+  let furthest = -1;
+  for (const order of orders) {
+    const failed = firstFailed(order, incoming, resolve, now);
+    furthest = Math.max(furthest, failed === null ? CHECKS.length : CHECKS.indexOf(failed));
+  }
+  const { source, destination, inputSymbol } = incoming;
+  if (furthest < CHECKS.length) {
+    switch (CHECKS[Math.max(furthest, 0)]) {
+      case "open":
+        return "no limit order is open";
+      case "chain":
+        return `no open limit order fills on ${destination}`;
+      case "input":
+        return `no limit order on ${destination} takes ${inputSymbol} in`;
+      case "output":
+        return `no limit order on ${destination} taking ${inputSymbol} in pays out the token this order asks for`;
+      case "source":
+        return `no limit order for this pair on ${destination} accepts swaps from ${source}`;
+    }
+  }
+  const priced = orders.filter((order) => firstFailed(order, incoming, resolve, now) === null).map((order) => ({
+    order,
+    offer: offerFor({
+      side: order.side,
+      inputAmount: incoming.inputNet,
+      price: BigInt(order.price),
+      outputDecimals: incoming.outputDecimals
+    })
+  }));
+  if (priced.some(({ offer }) => offer >= incoming.requestedOutput)) {
+    return "the limit orders that meet its rate have nothing left to pay out";
+  }
+  const best = priced.reduce((a, b) => b.offer > a.offer ? b : a);
+  const symbol = limitOrderLegs(best.order).output;
+  return `it asks for ${readable(incoming.requestedOutput)} ${symbol}; the best limit order offers ${readable(best.offer)} ${symbol}`;
+}
+var CHECKS = ["open", "chain", "input", "output", "source"];
 function serves(order, incoming, resolve, now) {
-  if (order.status !== "open") return false;
-  if (order.expiresAt !== null && new Date(order.expiresAt) <= now) return false;
-  if (order.fillChain !== incoming.destination) return false;
+  return firstFailed(order, incoming, resolve, now) === null;
+}
+function firstFailed(order, incoming, resolve, now) {
+  if (order.status !== "open") return "open";
+  if (order.expiresAt !== null && new Date(order.expiresAt) <= now) return "open";
+  if (order.fillChain !== incoming.destination) return "chain";
   const legs = limitOrderLegs(order);
-  if (normalizeSymbol(legs.input) !== normalizeSymbol(incoming.inputSymbol)) return false;
+  if (normalizeSymbol(legs.input) !== normalizeSymbol(incoming.inputSymbol)) return "input";
   const outputToken = resolve(legs.output, order.fillChain);
-  if (!outputToken || outputToken.toLowerCase() !== incoming.outputToken.toLowerCase()) return false;
-  if (incoming.source === incoming.destination) return true;
-  return order.acceptedSources.includes(incoming.source);
+  if (!outputToken || outputToken.toLowerCase() !== incoming.outputToken.toLowerCase()) return "output";
+  if (incoming.source === incoming.destination) return null;
+  return order.acceptedSources.includes(incoming.source) ? null : "source";
+}
+function readable(amount) {
+  const [whole, fraction] = toHuman(amount).split(".");
+  const grouped = whole.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+  const cut = fraction?.slice(0, 6).replace(/0+$/, "");
+  return cut ? `${grouped}.${cut}` : grouped;
 }
 
 // src/orderbook/usd.ts
@@ -21823,15 +21996,20 @@ var FXFiller = class _FXFiller {
     }
     try {
       if (order.inputs.length !== order.output.assets.length) {
-        this.logger.debug(
-          { inputs: order.inputs.length, outputs: order.output.assets.length },
+        this.logger.info(
+          { orderId: order.id, inputs: order.inputs.length, outputs: order.output.assets.length },
           "Order input/output length mismatch or empty"
         );
         return false;
       }
       if ((await this.matchOrder(order)).length === 0) {
-        this.logger.debug(
-          { orderId: order.id, sourceChain: order.source, destChain: order.destination },
+        this.logger.info(
+          {
+            orderId: order.id,
+            sourceChain: order.source,
+            destChain: order.destination,
+            reason: await this.explainUnmatched(order)
+          },
           "No limit order matches this order"
         );
         return false;
@@ -22373,30 +22551,53 @@ var FXFiller = class _FXFiller {
    */
   async matchLeg(order, leg) {
     if (!this.limitOrders) return [];
+    const incoming = await this.incomingFor(order, leg);
+    if (!incoming) return [];
+    return matchLimitOrders(
+      await this.limitOrders.open(),
+      incoming,
+      (symbol, chain) => this.registry.getAddress(symbol, chain)
+    );
+  }
+  /** Why no limit order serves the order, leg by leg, for the line that says it was passed over. */
+  async explainUnmatched(order) {
+    if (!this.limitOrders) return "limit orders are not loaded";
+    const open = await this.limitOrders.open();
+    const reasons = [];
+    for (let leg = 0; leg < order.inputs.length; leg++) {
+      const incoming = await this.incomingFor(order, leg);
+      const reason = incoming ? whyUnmatched(open, incoming, (symbol, chain) => this.registry.getAddress(symbol, chain)) : `its input token is not in the asset registry on ${order.source}`;
+      reasons.push(order.inputs.length > 1 ? `leg ${leg}: ${reason}` : reason);
+    }
+    return reasons.join("; ");
+  }
+  /**
+   * One leg as the matcher sees it, or null when its input token is not one the asset
+   * registry knows on the source chain.
+   *
+   * Amounts cross into the matcher at 1e18, the unit limit orders are kept in.
+   */
+  async incomingFor(order, leg) {
     const input = order.inputs[leg];
     const output = order.output.assets[leg];
-    if (!input || !output) return [];
+    if (!input || !output) return null;
     const inputToken = bytes32ToBytes204(input.token);
     const outputToken = bytes32ToBytes204(output.token);
     const inputSymbol = this.registry.symbolFor(inputToken, order.source);
-    if (!inputSymbol) return [];
+    if (!inputSymbol) return null;
     const [inputDecimals, outputDecimals] = await Promise.all([
       this.contractService.getTokenDecimals(inputToken, order.source),
       this.contractService.getTokenDecimals(outputToken, order.destination)
     ]);
-    return matchLimitOrders(
-      await this.limitOrders.open(),
-      {
-        source: order.source,
-        destination: order.destination,
-        inputSymbol,
-        outputToken,
-        inputNet: toScaled(input.amount, inputDecimals),
-        requestedOutput: toScaled(output.amount, outputDecimals),
-        outputDecimals
-      },
-      (symbol, chain) => this.registry.getAddress(symbol, chain)
-    );
+    return {
+      source: order.source,
+      destination: order.destination,
+      inputSymbol,
+      outputToken,
+      inputNet: toScaled(input.amount, inputDecimals),
+      requestedOutput: toScaled(output.amount, outputDecimals),
+      outputDecimals
+    };
   }
   /**
    * The order's input in **USD**, or null when no limit order connects its input
@@ -23563,7 +23764,10 @@ async function bootFiller(config, options) {
     runtimeSigner,
     config.orderbook.defaultTtlSecs ?? DEFAULT_LIMIT_ORDER_TTL_SECONDS,
     new DelegationService(chainClientManager, configService, runtimeSigner),
-    options.loggers
+    options.loggers,
+    initialOrderNonce,
+    // A fill withdraws a payout shortfall from the vaults, so what they hold backs an order too.
+    vaultVenue
   );
   intentFiller.setLimitOrderService(limitOrderService);
   const lifecycle = new LimitOrderLifecycle(
@@ -24106,6 +24310,8 @@ var MAX_BLOCK_RANGE = 1000n;
 var PUBLISH_CHUNK = 250;
 var yieldToConsumers = () => new Promise((resolve) => setImmediate(resolve));
 var STOP_DRAIN_TIMEOUT_MS = 5e3;
+var STALL_THRESHOLD_MS = 45e3;
+var STALL_REPORT_INTERVAL_MS = 6e4;
 var ChainScanner = class {
   constructor(target, loggers = defaultLoggerContext(), scanIntervalMs = DEFAULT_SCAN_INTERVAL_MS) {
     this.target = target;
@@ -24119,6 +24325,18 @@ var ChainScanner = class {
     this.errorHandler = () => {
     };
     this.stopped = false;
+    /**
+     * How far past the cursor the next pass reads, as `toBlock - fromBlock`:
+     * halved after a failed read, doubled after a good one, between 0 (one block)
+     * and {@link MAX_BLOCK_RANGE}.
+     *
+     * Free endpoints cap `eth_getLogs` ranges far below the full span — on
+     * Arbitrum three of seven refused 100 blocks — and the cursor never moves
+     * past a range it failed to read. At a fixed span a catch-up that outgrew
+     * those caps was stuck for good: the range only grew, so the capped endpoints
+     * never rejoined and the quorum never formed.
+     */
+    this.span = MAX_BLOCK_RANGE;
     this.logger = loggers.get("chain-scanner");
     this.quorumClient = new QuorumPublicClient(target.chainId, target.rpcUrls, loggers);
     if (this.quorumClient.size > 1) {
@@ -24161,8 +24379,9 @@ var ChainScanner = class {
     if (this.timer || this.stopped) return;
     this.logger.info({ chainId: this.target.chainId }, "Block scanner started");
     this.timer = setInterval(() => {
-      if (this.mutex.isLocked()) return;
+      if (this.mutex.isLocked()) return this.reportStall();
       void this.mutex.runExclusive(async () => {
+        this.pass = { phase: "head", startedAt: Date.now(), reportedAt: 0 };
         try {
           await this.scan();
         } catch (error) {
@@ -24176,10 +24395,66 @@ var ChainScanner = class {
             "Error in block scanner"
           );
           this.errorHandler(error);
+        } finally {
+          this.notePassEnd();
         }
       });
     }, this.scanIntervalMs);
   }
+  /**
+   * Records which await the current pass is sitting on, for the watchdog.
+   *
+   * A no-op when no pass is registered — `scan()` is driven directly by tests
+   * and by nothing else, so there is no watchdog to inform.
+   */
+  enter(phase) {
+    if (this.pass) this.pass.phase = phase;
+  }
+  /**
+   * Says that a pass has outlived the quorum budgets and names the phase it is
+   * stuck in, then repeats every {@link STALL_REPORT_INTERVAL_MS} until it ends.
+   *
+   * Observation only: the pass is left alone. Aborting it would need a cancel
+   * path through the quorum client that does not exist, and the cursor is safe
+   * either way — a pass that never completes never advances it.
+   */
+  reportStall() {
+    const pass = this.pass;
+    if (!pass) return;
+    const now = Date.now();
+    const heldMs = now - pass.startedAt;
+    if (heldMs < STALL_THRESHOLD_MS) return;
+    if (pass.reportedAt !== 0 && now - pass.reportedAt < STALL_REPORT_INTERVAL_MS) return;
+    pass.reportedAt = now;
+    this.logger.warn(
+      {
+        chainId: this.target.chainId,
+        phase: pass.phase,
+        heldMs,
+        cursor: this.cursor?.toString(),
+        rpcUrls: this.target.rpcUrls
+      },
+      "Block scan pass has outlived its budget \u2014 this chain is not being scanned"
+    );
+  }
+  /**
+   * Closes out a pass, and says so if the watchdog complained about it — without
+   * this the log shows a chain going quiet and never shows it coming back.
+   */
+  notePassEnd() {
+    const pass = this.pass;
+    this.pass = void 0;
+    if (!pass || pass.reportedAt === 0) return;
+    this.logger.warn(
+      {
+        chainId: this.target.chainId,
+        phase: pass.phase,
+        heldMs: Date.now() - pass.startedAt,
+        cursor: this.cursor?.toString()
+      },
+      "Block scan pass finished after outliving its budget \u2014 scanning has resumed"
+    );
+  }
   /**
    * Points this loop at different endpoints, keeping the cursor.
    *
@@ -24221,11 +24496,12 @@ var ChainScanner = class {
     }
     if (currentBlock <= this.cursor) return;
     const fromBlock = this.cursor + 1n;
-    const toBlock = fromBlock + MAX_BLOCK_RANGE > currentBlock ? currentBlock : fromBlock + MAX_BLOCK_RANGE;
+    const toBlock = fromBlock + this.span > currentBlock ? currentBlock : fromBlock + this.span;
     this.logger.debug(
       { chainId: this.target.chainId, fromBlock, toBlock, gap: Number(toBlock - fromBlock) },
       "Scanning blocks"
     );
+    this.enter("logs");
     let logs;
     try {
       logs = await retryPromise3(
@@ -24247,6 +24523,7 @@ var ChainScanner = class {
       );
     } catch (error) {
       if (isBlockRangeError(error)) return;
+      this.narrow(toBlock - fromBlock);
       throw error;
     }
     if (this.stopped) return;
@@ -24257,6 +24534,7 @@ var ChainScanner = class {
         { chainId: this.target.chainId, fromBlock, toBlock, eventCount: placed.length },
         "Found OrderPlaced events in block scan"
       );
+      this.enter("publish-orders");
       await this.publishOrders(placed);
     }
     if (filled.length > 0) {
@@ -24264,10 +24542,36 @@ var ChainScanner = class {
         { chainId: this.target.chainId, fromBlock, toBlock, eventCount: filled.length },
         "Found OrderFilled events in block scan"
       );
+      this.enter("publish-fills");
       await this.publishFills(filled);
     }
     if (this.stopped) return;
     this.cursor = toBlock;
+    this.widen();
+  }
+  /**
+   * Halves the span below the range that just failed, so the next pass asks
+   * for something a range-capped endpoint will answer. Halving the attempted
+   * range rather than the span matters near the head, where a pass reads fewer
+   * blocks than the span allows.
+   */
+  narrow(attempted) {
+    const next = attempted / 2n;
+    if (next >= this.span) return;
+    this.span = next;
+    this.logger.warn(
+      { chainId: this.target.chainId, span: Number(next) },
+      "Narrowing the block scan range after a failed read"
+    );
+  }
+  /** Doubles the span back toward {@link MAX_BLOCK_RANGE} after a good read. */
+  widen() {
+    if (this.span >= MAX_BLOCK_RANGE) return;
+    const next = this.span === 0n ? 1n : this.span * 2n;
+    this.span = next > MAX_BLOCK_RANGE ? MAX_BLOCK_RANGE : next;
+    if (this.span === MAX_BLOCK_RANGE) {
+      this.logger.info({ chainId: this.target.chainId }, "Block scan range back to full");
+    }
   }
   async publishOrders(logs) {
     const rebuilt = reconstructOrdersFromLogs(logs, {
@@ -24634,6 +24938,10 @@ var LimitOrderController = class {
     ]);
     return { order, fills, bids };
   }
+  /** The pairs the orderbook lists, the smallest payout each token may carry, and its tokens per chain. */
+  books() {
+    return this.service.books();
+  }
   /** Creates the order, posts it, and reports what the orderbook made of it. */
   async create(request) {
     const posted = await this.service.create(request);