@hyperbridge/simplex 0.16.8 → 0.16.11

package/dist/index.cjs

@@ -32,6 +32,8 @@ var src_exports = {};
 __export(src_exports, {
   AssetController: () => AssetController,
   ChainController: () => ChainController,
+  LimitOrderController: () => LimitOrderController,
+  LimitOrderValidationError: () => LimitOrderValidationError,
   LoggerContext: () => LoggerContext,
   MemoryDataStore: () => MemoryDataStore,
   OrderScanner: () => OrderScanner,
@@ -44,6 +46,7 @@ __export(src_exports, {
   WalletController: () => WalletController,
   addLogSink: () => addLogSink,
   assertConfirmationCoverage: () => assertConfirmationCoverage,
+  canDerive: () => canDerive,
   configureLogger: () => configureLogger,
   createSigner: () => createSigner,
   digestSigner: () => digestSigner,
@@ -56,10 +59,12 @@ __export(src_exports, {
   pickAnchorStable: () => pickAnchorStable,
   privateKeySigner: () => privateKeySigner,
   registrySymbols: () => registrySymbols,
+  secretPhraseSigner: () => secretPhraseSigner,
   turnkeySigner: () => turnkeySigner,
   validateAssetDefinitions: () => validateAssetDefinitions,
   validateConfig: () => validateConfig,
   validatePairConfigs: () => validatePairConfigs,
+  validateSecretPhrase: () => validateSecretPhrase,
   validateSignerConfig: () => validateSignerConfig,
   validateVaultToml: () => validateVaultToml,
   viemSigner: () => viemSigner
@@ -70,7 +75,7 @@ module.exports = __toCommonJS(src_exports);
 var import_node_events3 = require("node:events");
 
 // src/core/boot.ts
-var import_viem30 = require("viem");
+var import_viem32 = require("viem");
 
 // src/core/filler.ts
 var import_util_crypto = require("@polkadot/util-crypto");
@@ -2838,11 +2843,21 @@ var import_node_crypto = require("node:crypto");
 var import_sdk4 = require("@hyperbridge/sdk");
 
 // src/orderbook/amounts.ts
+var import_viem6 = require("viem");
 var ORDERBOOK_SCALE = 10n ** 18n;
 function toRaw(amount, decimals) {
   const shift = 18 - decimals;
   return shift >= 0 ? amount / 10n ** BigInt(shift) : amount * 10n ** BigInt(-shift);
 }
+function budgetIdFor(limitOrderId) {
+  return (0, import_viem6.keccak256)((0, import_viem6.stringToBytes)(limitOrderId));
+}
+function budgetFor(order, token, decimals) {
+  return { budgetId: budgetIdFor(order.id), cap: toRaw(BigInt(order.size), decimals), token };
+}
+function budgetRoom(budget, spent, decimals) {
+  return spent >= budget.cap ? 0n : toScaled(budget.cap - spent, decimals);
+}
 function fromHuman(amount) {
   const text = amount.trim();
   if (!/^[0-9]+(\.[0-9]+)?$/.test(text)) {
@@ -2863,6 +2878,10 @@ function toScaled(amount, decimals) {
   const shift = 18 - decimals;
   return shift >= 0 ? amount * 10n ** BigInt(shift) : amount / 10n ** BigInt(-shift);
 }
+function toScaledUp(amount, decimals) {
+  const shift = 18 - decimals;
+  return shift >= 0 ? amount * 10n ** BigInt(shift) : divCeil(amount, 10n ** BigInt(-shift));
+}
 function divCeil(numerator, denominator) {
   return (numerator + denominator - 1n) / denominator;
 }
@@ -2904,6 +2923,87 @@ function inputFor(params) {
   return divCeil(scaled, unit) * unit;
 }
 
+// src/orderbook/matching.ts
+function limitOrderLegs(order) {
+  return order.side === "BID" ? { input: order.base, output: order.quote } : { input: order.quote, output: order.base };
+}
+function matchLimitOrders(orders, incoming, resolve, now = /* @__PURE__ */ new Date()) {
+  const qualifying = orders.filter((order) => serves(order, incoming, resolve, now)).map((order) => {
+    const offer = offerFor({
+      side: order.side,
+      inputAmount: incoming.inputNet,
+      price: BigInt(order.price),
+      outputDecimals: incoming.outputDecimals
+    });
+    const available = BigInt(order.remaining);
+    return { order, offer, available, payout: offer < available ? offer : available };
+  }).filter((candidate) => candidate.offer >= incoming.requestedOutput && candidate.payout > 0n).sort(byBestOfferFirst);
+  return qualifying;
+}
+function byBestOfferFirst(a, b) {
+  if (a.offer !== b.offer) return a.offer > b.offer ? -1 : 1;
+  if (a.available !== b.available) return a.available > b.available ? -1 : 1;
+  return a.order.id < b.order.id ? -1 : 1;
+}
+function whyUnmatched(orders, incoming, resolve, now = /* @__PURE__ */ new Date()) {
+  let furthest = -1;
+  for (const order of orders) {
+    const failed = firstFailed(order, incoming, resolve, now);
+    furthest = Math.max(furthest, failed === null ? CHECKS.length : CHECKS.indexOf(failed));
+  }
+  const { source, destination, inputSymbol } = incoming;
+  if (furthest < CHECKS.length) {
+    switch (CHECKS[Math.max(furthest, 0)]) {
+      case "open":
+        return "no limit order is open";
+      case "chain":
+        return `no open limit order fills on ${destination}`;
+      case "input":
+        return `no limit order on ${destination} takes ${inputSymbol} in`;
+      case "output":
+        return `no limit order on ${destination} taking ${inputSymbol} in pays out the token this order asks for`;
+      case "source":
+        return `no limit order for this pair on ${destination} accepts swaps from ${source}`;
+    }
+  }
+  const priced = orders.filter((order) => firstFailed(order, incoming, resolve, now) === null).map((order) => ({
+    order,
+    offer: offerFor({
+      side: order.side,
+      inputAmount: incoming.inputNet,
+      price: BigInt(order.price),
+      outputDecimals: incoming.outputDecimals
+    })
+  }));
+  if (priced.some(({ offer }) => offer >= incoming.requestedOutput)) {
+    return "the limit orders that meet its rate have nothing left to pay out";
+  }
+  const best = priced.reduce((a, b) => b.offer > a.offer ? b : a);
+  const symbol = limitOrderLegs(best.order).output;
+  return `it asks for ${readable(incoming.requestedOutput)} ${symbol}; the best limit order offers ${readable(best.offer)} ${symbol}`;
+}
+var CHECKS = ["open", "chain", "input", "output", "source"];
+function serves(order, incoming, resolve, now) {
+  return firstFailed(order, incoming, resolve, now) === null;
+}
+function firstFailed(order, incoming, resolve, now) {
+  if (order.status !== "open") return "open";
+  if (order.expiresAt !== null && new Date(order.expiresAt) <= now) return "open";
+  if (order.fillChain !== incoming.destination) return "chain";
+  const legs = limitOrderLegs(order);
+  if (normalizeSymbol(legs.input) !== normalizeSymbol(incoming.inputSymbol)) return "input";
+  const outputToken = resolve(legs.output, order.fillChain);
+  if (!outputToken || outputToken.toLowerCase() !== incoming.outputToken.toLowerCase()) return "output";
+  if (incoming.source === incoming.destination) return null;
+  return order.acceptedSources.includes(incoming.source) ? null : "source";
+}
+function readable(amount) {
+  const [whole, fraction] = toHuman(amount).split(".");
+  const grouped = whole.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+  const cut = fraction?.slice(0, 6).replace(/0+$/, "");
+  return cut ? `${grouped}.${cut}` : grouped;
+}
+
 // src/orderbook/limit-orders.ts
 var LIMITS_TTL_MS = 5 * 60 * 1e3;
 var POSTABLE = ["open", "resizing"];
@@ -3418,6 +3518,58 @@ var LimitOrderService = class {
     }
     return report;
   }
+  /**
+   * Lowers every open order's `remaining` to what the solver's account will still
+   * pay for it, and puts the order back on the book at that size.
+   *
+   * The account tallies each order's payouts on the fill chain and refuses a fill
+   * that would take the tally past the order's size. A fill that never settled
+   * here, or a store restored from an older copy, leaves `remaining` above that
+   * room and the order posted at a size the account will refuse. A tally behind
+   * the store changes nothing: `remaining` is never raised.
+   *
+   * Answers how many orders were lowered.
+   */
+  async reconcileTallies() {
+    let lowered = 0;
+    for (const order of await this.store.list({ status: "open" })) {
+      try {
+        const clamped = await this.clampToTally(order);
+        if (!clamped) continue;
+        lowered++;
+        await this.resize(clamped, BigInt(order.remaining) - BigInt(clamped.remaining));
+      } catch (err) {
+        this.logger.error({ id: order.id, err }, "Could not bring the limit order in line with its on-chain tally");
+      }
+    }
+    return lowered;
+  }
+  /** The order as the store now holds it when its tally lowered it, null when it was left alone. */
+  async clampToTally(order) {
+    const token = this.assetRegistry.getAddress(limitOrderLegs(order).output, order.fillChain);
+    if (!token) return null;
+    const decimals = await this.contractService.getTokenDecimals(token, order.fillChain);
+    const budget = budgetFor(order, token, decimals);
+    const spent = await this.contractService.limitOrderSpent(order.fillChain, budget.budgetId);
+    if (spent === null) return null;
+    const room = budgetRoom(budget, spent, decimals);
+    const over = BigInt(order.remaining) - (room + BigInt(order.reserved));
+    if (over < toScaled(1n, decimals)) return null;
+    const clamped = await this.store.clampRemaining(order.id, room.toString());
+    if (!clamped) return null;
+    this.logger.warn(
+      {
+        id: order.id,
+        before: order.remaining,
+        after: clamped.remaining,
+        spent: spent.toString(),
+        cap: budget.cap.toString(),
+        reserved: clamped.reserved
+      },
+      "Limit order had more left than its on-chain tally allows; lowering it"
+    );
+    return clamped;
+  }
   /**
    * Withdraws every order that has outlived the operator's own `expiresAt`.
    *
@@ -3679,7 +3831,7 @@ async function patchRuntimeState(store, patch) {
 }
 
 // src/services/wallet/mpcvault.ts
-var import_viem6 = require("viem");
+var import_viem7 = require("viem");
 var grpc = __toESM(require("@grpc/grpc-js"), 1);
 
 // src/proto/mpcvault/platform/v1/api.ts
@@ -12243,18 +12395,18 @@ var MpcVaultService = class {
   // Signature assembly
   // -----------------------------------------------------------------------
   signatureFromParts(parts, normalizeV = false) {
-    const r = (0, import_viem6.padHex)((0, import_viem6.toHex)(BigInt(parts.R || "0")), { size: 32 });
-    const s = (0, import_viem6.padHex)((0, import_viem6.toHex)(BigInt(parts.S || "0")), { size: 32 });
+    const r = (0, import_viem7.padHex)((0, import_viem7.toHex)(BigInt(parts.R || "0")), { size: 32 });
+    const s = (0, import_viem7.padHex)((0, import_viem7.toHex)(BigInt(parts.S || "0")), { size: 32 });
     const vInt = this.parseFlexibleBigInt(parts.V || "0");
-    let v = (0, import_viem6.padHex)((0, import_viem6.toHex)(vInt), { size: 1 });
+    let v = (0, import_viem7.padHex)((0, import_viem7.toHex)(vInt), { size: 1 });
     if (normalizeV) {
-      v = (0, import_viem6.padHex)((0, import_viem6.toHex)(vInt < 27n ? vInt + 27n : vInt), { size: 1 });
+      v = (0, import_viem7.padHex)((0, import_viem7.toHex)(vInt < 27n ? vInt + 27n : vInt), { size: 1 });
     }
-    return (0, import_viem6.concatHex)([r, s, v]);
+    return (0, import_viem7.concatHex)([r, s, v]);
   }
   ecdsaPartsToSignatureComponents(parts) {
-    const r = (0, import_viem6.padHex)((0, import_viem6.toHex)(BigInt(parts.R || "0")), { size: 32 });
-    const s = (0, import_viem6.padHex)((0, import_viem6.toHex)(BigInt(parts.S || "0")), { size: 32 });
+    const r = (0, import_viem7.padHex)((0, import_viem7.toHex)(BigInt(parts.R || "0")), { size: 32 });
+    const s = (0, import_viem7.padHex)((0, import_viem7.toHex)(BigInt(parts.S || "0")), { size: 32 });
     const vInt = this.parseFlexibleBigInt(parts.V || "0");
     const yParity = vInt >= 27n ? Number(vInt - 27n) : Number(vInt);
     if (yParity !== 0 && yParity !== 1) {
@@ -12290,7 +12442,7 @@ var MpcVaultService = class {
     const messageBytes = Buffer.from(messageHash.slice(2), "hex");
     const prefix = Buffer.from(`Ethereum Signed Message:
 ${messageBytes.length}`);
-    const ethSignedMessageHash = (0, import_viem6.keccak256)((0, import_viem6.concatHex)([(0, import_viem6.toHex)(prefix), messageHash]));
+    const ethSignedMessageHash = (0, import_viem7.keccak256)((0, import_viem7.concatHex)([(0, import_viem7.toHex)(prefix), messageHash]));
     const ethSignedBytes = Buffer.from(ethSignedMessageHash.slice(2), "hex");
     const uuid = await this.createSigningRequest({
       vaultUuid: this.vaultUuid,
@@ -12378,11 +12530,12 @@ var SignerType = /* @__PURE__ */ ((SignerType2) => {
   SignerType2["PrivateKey"] = "privateKey";
   SignerType2["MpcVault"] = "mpcVault";
   SignerType2["Turnkey"] = "turnkey";
+  SignerType2["SecretPhrase"] = "secretPhrase";
   return SignerType2;
 })(SignerType || {});
 
 // src/services/wallet/accounts/mpc.ts
-var import_viem7 = require("viem");
+var import_viem8 = require("viem");
 var import_utils = require("viem/utils");
 function mpcVaultSigner(config) {
   const service = new MpcVaultService({
@@ -12417,9 +12570,9 @@ function mpcVaultSigner(config) {
       if (tx.authorizationList?.length) {
         const serializable = { ...tx, type: "eip7702" };
         const signature = await service.signRawHashComponents(
-          (0, import_viem7.keccak256)((0, import_viem7.serializeTransaction)(serializable))
+          (0, import_viem8.keccak256)((0, import_viem8.serializeTransaction)(serializable))
         );
-        return (0, import_viem7.serializeTransaction)(serializable, signature);
+        return (0, import_viem8.serializeTransaction)(serializable, signature);
       }
       return service.signTransaction({
         chainId: tx.chainId,
@@ -12444,10 +12597,10 @@ function requireChainId(value) {
 var import_accounts = require("viem/accounts");
 
 // src/services/wallet/accounts/viem.ts
-var import_viem8 = require("viem");
+var import_viem9 = require("viem");
 var import_utils2 = require("viem/utils");
 function splitSignature(signature, source) {
-  const sig = (0, import_viem8.parseSignature)(signature);
+  const sig = (0, import_viem9.parseSignature)(signature);
   const yParity = sig.yParity ?? (sig.v !== void 0 ? Number(sig.v >= 27n ? sig.v - 27n : sig.v) : void 0);
   if (yParity !== 0 && yParity !== 1) {
     throw new Error(`Failed to derive yParity from ${source} signature`);
@@ -12499,9 +12652,54 @@ function privateKeySigner(privateKey) {
   return viemSigner((0, import_accounts.privateKeyToAccount)(privateKey));
 }
 
+// src/services/wallet/accounts/secretphrase.ts
+var import_bip39 = require("@scure/bip39");
+var import_accounts2 = require("viem/accounts");
+var WORD_COUNTS = [12, 15, 18, 21, 24];
+var MAX_DERIVATION_INDEX = 2 ** 31 - 1;
+function normaliseSecretPhrase(phrase) {
+  return phrase.trim().split(/\s+/).join(" ").toLowerCase();
+}
+function validateSecretPhrase(phrase) {
+  if (typeof phrase !== "string") throw new Error("Secret phrase must be a string");
+  const normalised = normaliseSecretPhrase(phrase);
+  const words = normalised === "" ? [] : normalised.split(" ");
+  if (!WORD_COUNTS.includes(words.length)) {
+    throw new Error(`Secret phrase must have ${WORD_COUNTS.join(", ")} words; got ${words.length}`);
+  }
+  if (words.some((word) => !import_accounts2.english.includes(word))) {
+    throw new Error("Secret phrase contains a word that is not in the BIP-39 English wordlist");
+  }
+  if (!(0, import_bip39.validateMnemonic)(normalised, import_accounts2.english)) {
+    throw new Error("Secret phrase checksum does not match; check the words and their order");
+  }
+}
+function assertDerivationIndex(index, name = "Derivation index") {
+  const expected = `${name} must be an integer between 0 and ${MAX_DERIVATION_INDEX}`;
+  if (typeof index !== "number") throw new Error(expected);
+  if (!Number.isInteger(index) || index < 0 || index > MAX_DERIVATION_INDEX) {
+    throw new Error(`${expected}; got ${index}`);
+  }
+}
+function secretPhraseSigner(config) {
+  validateSecretPhrase(config.phrase);
+  const phrase = normaliseSecretPhrase(config.phrase);
+  const accountIndex = config.accountIndex ?? 0;
+  assertDerivationIndex(accountIndex, "accountIndex");
+  const derive = (index) => {
+    assertDerivationIndex(index);
+    return { ...viemSigner((0, import_accounts2.mnemonicToAccount)(phrase, { addressIndex: index })), mode: "secretPhrase" };
+  };
+  return { ...derive(accountIndex), accountIndex, derive };
+}
+function canDerive(signer) {
+  const candidate = signer;
+  return typeof candidate.derive === "function" && typeof candidate.accountIndex === "number";
+}
+
 // src/services/wallet/accounts/turnkey.ts
 var import_sdk_server = require("@turnkey/sdk-server");
-var import_viem10 = require("@turnkey/viem");
+var import_viem12 = require("@turnkey/viem");
 async function turnkeySigner(config) {
   const turnkey = new import_sdk_server.Turnkey({
     defaultOrganizationId: config.organizationId,
@@ -12509,7 +12707,7 @@ async function turnkeySigner(config) {
     apiPrivateKey: config.apiPrivateKey,
     apiPublicKey: config.apiPublicKey
   });
-  const account = await (0, import_viem10.createAccount)({
+  const account = await (0, import_viem12.createAccount)({
     client: turnkey.apiClient(),
     organizationId: config.organizationId,
     signWith: config.signWith
@@ -12522,6 +12720,7 @@ async function createSigner(config) {
   if (config.type === "privateKey" /* PrivateKey */) return privateKeySigner(config.key);
   if (config.type === "mpcVault" /* MpcVault */) return mpcVaultSigner(config);
   if (config.type === "turnkey" /* Turnkey */) return turnkeySigner(config);
+  if (config.type === "secretPhrase" /* SecretPhrase */) return secretPhraseSigner(config);
   throw new Error(`Unsupported signer mode: ${config.type ?? "unknown"}`);
 }
 function validateSignerConfig(config) {
@@ -12547,15 +12746,23 @@ function validateSignerConfig(config) {
     if (!config.signWith) throw new Error("simplex.signer.signWith is required");
     return;
   }
+  if (config.type === "secretPhrase" /* SecretPhrase */) {
+    if (!config.phrase) {
+      throw new Error("simplex.signer.phrase is required when simplex.signer.type=secretPhrase");
+    }
+    validateSecretPhrase(config.phrase);
+    if (config.accountIndex !== void 0) assertDerivationIndex(config.accountIndex, "simplex.signer.accountIndex");
+    return;
+  }
   throw new Error(`Unsupported signer mode: ${config.type ?? "unknown"}`);
 }
 
 // src/services/wallet/account.ts
-var import_viem12 = require("viem");
+var import_viem14 = require("viem");
 var import_utils3 = require("viem/utils");
-var import_accounts2 = require("viem/accounts");
+var import_accounts3 = require("viem/accounts");
 function accountFor(signer) {
-  return (0, import_accounts2.toAccount)({
+  return (0, import_accounts3.toAccount)({
     address: signer.address,
     signTypedData: (typedData) => signer.signTypedData(typedData),
     signTransaction: async (transaction) => await signer.signTransaction(toSignerTransaction(transaction)),
@@ -12595,7 +12802,7 @@ function digestSigner(opts) {
   return {
     address: opts.address,
     mode: opts.mode,
-    signTypedData: async (typedData) => (0, import_viem12.serializeSignature)(await sign((0, import_viem12.hashTypedData)(typedData))),
+    signTypedData: async (typedData) => (0, import_viem14.serializeSignature)(await sign((0, import_viem14.hashTypedData)(typedData))),
     signAuthorization: (auth) => sign(
       (0, import_utils3.hashAuthorization)({
         address: auth.contractAddress,
@@ -12605,8 +12812,8 @@ function digestSigner(opts) {
     ),
     signTransaction: async (tx) => {
       const serializable = tx;
-      const signature = await sign((0, import_viem12.keccak256)((0, import_viem12.serializeTransaction)(serializable)));
-      return (0, import_viem12.serializeTransaction)(serializable, signature);
+      const signature = await sign((0, import_viem14.keccak256)((0, import_viem14.serializeTransaction)(serializable)));
+      return (0, import_viem14.serializeTransaction)(serializable, signature);
     }
   };
 }
@@ -12635,6 +12842,12 @@ async function deriveSubstrateKeyPair(key) {
 }
 
 // src/services/CacheService.ts
+function budgetToCache(budget) {
+  return { budgetId: budget.budgetId, cap: budget.cap.toString(), token: budget.token };
+}
+function budgetFromCache(budget) {
+  return { budgetId: budget.budgetId, cap: BigInt(budget.cap), token: budget.token };
+}
 var CacheService = class {
   constructor(loggers = defaultLoggerContext()) {
     this.CACHE_EXPIRY_MS = 1 * 60 * 1e3;
@@ -12792,7 +13005,24 @@ var CacheService = class {
       return null;
     }
   }
-  setFillerOutputs(orderId, outputs, inputs = []) {
+  /**
+   * The budget of the limit order that priced the outputs cached for this order, or
+   * null when no limit order did.
+   *
+   * Kept on the same entry as the outputs, so the two are replaced and expire
+   * together: a bid can never sign one limit order's payout beside another's budget.
+   */
+  getBidBudget(orderId) {
+    try {
+      const cache = this.cacheData.fillerOutputs[orderId];
+      if (cache?.budget && this.isCacheValid(cache.timestamp)) return budgetFromCache(cache.budget);
+      return null;
+    } catch (error) {
+      this.logger.error({ err: error }, "Error getting bid budget");
+      return null;
+    }
+  }
+  setFillerOutputs(orderId, outputs, inputs = [], budget) {
     try {
       this.cleanupStaleData();
       this.cacheData.fillerOutputs[orderId] = {
@@ -12804,6 +13034,7 @@ var CacheService = class {
           token: o.token,
           amount: o.amount.toString()
         })),
+        ...budget ? { budget: budgetToCache(budget) } : {},
         timestamp: Date.now()
       };
     } catch (error) {
@@ -12849,7 +13080,8 @@ var CacheService = class {
           data: call.data
         })),
         partialFill: plan.partialFill,
-        profit: plan.profit
+        profit: plan.profit,
+        ...plan.budget ? { budget: budgetFromCache(plan.budget) } : {}
       }));
     } catch (error) {
       this.logger.error({ err: error }, "Error getting bid plans");
@@ -12878,7 +13110,8 @@ var CacheService = class {
             data: call.data
           })),
           partialFill: plan.partialFill,
-          profit: plan.profit
+          profit: plan.profit,
+          ...plan.budget ? { budget: budgetToCache(plan.budget) } : {}
         })),
         timestamp: Date.now()
       };
@@ -13036,12 +13269,12 @@ var CacheService = class {
 };
 
 // src/services/ChainClientManager.ts
-var import_viem15 = require("viem");
-var import_accounts3 = require("viem/accounts");
+var import_viem17 = require("viem");
+var import_accounts4 = require("viem/accounts");
 var import_sdk6 = require("@hyperbridge/sdk");
 
 // src/services/QuorumPublicClient.ts
-var import_viem14 = require("viem");
+var import_viem16 = require("viem");
 var import_sdk5 = require("@hyperbridge/sdk");
 function quorumThreshold(numProviders) {
   return Math.floor(2 * numProviders / 3) + 1;
@@ -13141,9 +13374,9 @@ var _QuorumPublicClient = class _QuorumPublicClient {
     this.deadlineMs = budget.deadlineMs;
     const chain = (0, import_sdk5.getViemChain)(chainId);
     this.clients = this.rpcUrls.map(
-      (url) => (0, import_viem14.createPublicClient)({
+      (url) => (0, import_viem16.createPublicClient)({
         chain,
-        transport: (0, import_viem14.http)(url, {
+        transport: (0, import_viem16.http)(url, {
           timeout: budget.timeoutMs,
           // No transport-level retry. viem's retry sleeps for the provider's
           // `Retry-After` verbatim and uncapped, which reaches the socket
@@ -13559,9 +13792,9 @@ var HTTP_TRANSPORT_OPTS = {
 };
 function buildTransport(rpcUrls) {
   if (rpcUrls.length === 1) {
-    return (0, import_viem15.http)(rpcUrls[0], HTTP_TRANSPORT_OPTS);
+    return (0, import_viem17.http)(rpcUrls[0], HTTP_TRANSPORT_OPTS);
   }
-  return (0, import_viem15.fallback)(rpcUrls.map((url) => (0, import_viem15.http)(url, HTTP_TRANSPORT_OPTS)));
+  return (0, import_viem17.fallback)(rpcUrls.map((url) => (0, import_viem17.http)(url, HTTP_TRANSPORT_OPTS)));
 }
 function walletClientCacheKey(chainId, accountAddress) {
   return `${chainId}:${accountAddress.toLowerCase()}`;
@@ -13587,7 +13820,7 @@ var ViemClientFactoryImpl = class {
     if (!this.publicClients.has(chainConfig.chainId)) {
       const chain = (0, import_sdk6.getViemChain)(chainConfig.chainId);
       const urls = rpcUrls && rpcUrls.length > 0 ? rpcUrls : [chainConfig.rpcUrl];
-      const publicClient = (0, import_viem15.createPublicClient)({
+      const publicClient = (0, import_viem17.createPublicClient)({
         chain,
         transport: buildTransport(urls)
       });
@@ -13600,7 +13833,7 @@ var ViemClientFactoryImpl = class {
     if (!this.walletClients.has(key)) {
       const chain = (0, import_sdk6.getViemChain)(chainConfig.chainId);
       const urls = rpcUrls && rpcUrls.length > 0 ? rpcUrls : [chainConfig.rpcUrl];
-      const walletClient = (0, import_viem15.createWalletClient)({
+      const walletClient = (0, import_viem17.createWalletClient)({
         chain,
         account,
         transport: buildTransport(urls)
@@ -13615,7 +13848,7 @@ var ChainClientManager = class {
     this.clientFactory = new ViemClientFactoryImpl();
     this.quorumClients = /* @__PURE__ */ new Map();
     this.configService = configService;
-    this.signer = signer ?? privateKeySigner((0, import_accounts3.generatePrivateKey)());
+    this.signer = signer ?? privateKeySigner((0, import_accounts4.generatePrivateKey)());
     this.account = accountFor(this.signer);
   }
   /** This filler's logging destination, relayed from the config service. */
@@ -13684,9 +13917,47 @@ var ChainClientManager = class {
 };
 
 // src/services/ContractInteractionService.ts
-var import_viem21 = require("viem");
+var import_viem23 = require("viem");
 var import_sdk7 = require("@hyperbridge/sdk");
 
+// src/config/abis/SolverAccount.ts
+var SOLVER_ACCOUNT_ABI = [
+  {
+    inputs: [
+      { name: "orderId", type: "bytes32" },
+      { name: "cap", type: "uint256" },
+      { name: "token", type: "address" },
+      { name: "approved", type: "uint256" },
+      { name: "fee", type: "uint256" }
+    ],
+    name: "debitOrder",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    inputs: [{ name: "orderId", type: "bytes32" }],
+    name: "spent",
+    outputs: [{ name: "", type: "uint256" }],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [{ name: "sender", type: "address" }],
+    name: "AccountUnauthorized",
+    type: "error"
+  },
+  {
+    inputs: [
+      { name: "orderId", type: "bytes32" },
+      { name: "total", type: "uint256" },
+      { name: "cap", type: "uint256" }
+    ],
+    name: "LimitOrderExceeded",
+    type: "error"
+  }
+];
+
 // src/config/abis/EvmHost.ts
 var EVM_HOST = [
   {
@@ -17539,10 +17810,10 @@ var ENTRYPOINT_ABI = [
 ];
 
 // src/services/paymaster/provider/simplex.ts
-var import_viem20 = require("viem");
+var import_viem22 = require("viem");
 
 // src/services/paymaster/types.ts
-var import_viem16 = require("viem");
+var import_viem18 = require("viem");
 var RECOMMENDED_AMOUNT_USD = 5n;
 var VERIFICATION_GAS_LIMIT_PERMIT2 = 200000n;
 var VERIFICATION_GAS_LIMIT_PERMIT = 250000n;
@@ -17550,19 +17821,19 @@ var PERMIT2_DEADLINE_SECONDS = 3600n;
 var POST_OP_GAS_LIMIT_SIMPLEX = 40000n;
 var DEPOSIT_HEADROOM_PERCENT = 150n;
 function packPaymasterAndData(pm) {
-  return (0, import_viem16.encodePacked)(
+  return (0, import_viem18.encodePacked)(
     ["address", "uint128", "uint128", "bytes"],
     [pm.paymaster, pm.paymasterVerificationGasLimit, pm.paymasterPostOpGasLimit, pm.paymasterData]
   );
 }
 
 // src/services/paymaster/permit.ts
-var import_viem19 = require("viem");
+var import_viem21 = require("viem");
 
 // src/config/abis/EIP2612.ts
-var import_viem17 = require("viem");
+var import_viem19 = require("viem");
 var EIP2612_ABI = [
-  ...import_viem17.erc20Abi,
+  ...import_viem19.erc20Abi,
   {
     inputs: [{ internalType: "address", name: "owner", type: "address" }],
     stateMutability: "view",
@@ -17580,7 +17851,7 @@ var EIP2612_ABI = [
 ];
 
 // src/services/paymaster/permit2.ts
-var import_viem18 = require("viem");
+var import_viem20 = require("viem");
 function permit2TransferTypedData(p) {
   return {
     types: {
@@ -17615,16 +17886,16 @@ function permit2TransferTypedData(p) {
   };
 }
 function randomPermit2Nonce() {
-  return (0, import_viem18.bytesToBigInt)(crypto.getRandomValues(new Uint8Array(32)));
+  return (0, import_viem20.bytesToBigInt)(crypto.getRandomValues(new Uint8Array(32)));
 }
 async function signPermit2Transfer(signer, p) {
   const signature = await signer.signTypedData(permit2TransferTypedData(p));
   return normalizeSignature65(signature);
 }
 function normalizeSignature65(signature) {
-  const length = (0, import_viem18.size)(signature);
+  const length = (0, import_viem20.size)(signature);
   if (length === 64) {
-    return (0, import_viem18.serializeSignature)((0, import_viem18.compactSignatureToSignature)((0, import_viem18.parseCompactSignature)(signature)));
+    return (0, import_viem20.serializeSignature)((0, import_viem20.compactSignatureToSignature)((0, import_viem20.parseCompactSignature)(signature)));
   }
   if (length !== 65) {
     throw new Error(`Permit2 signature must be 64 or 65 bytes, got ${length}`);
@@ -17638,7 +17909,7 @@ function normalizeSignature65(signature) {
 
 // src/services/paymaster/permit.ts
 async function signEip2612Permit(client, signer, owner, spender, tokenAddress, value, chainId) {
-  const token = (0, import_viem19.getContract)({
+  const token = (0, import_viem21.getContract)({
     client,
     address: tokenAddress,
     abi: EIP2612_ABI
@@ -17676,7 +17947,7 @@ async function signEip2612Permit(client, signer, owner, spender, tokenAddress, v
       spender,
       value,
       nonce,
-      deadline: import_viem19.maxUint256
+      deadline: import_viem21.maxUint256
     }
   };
   return normalizeSignature65(await signer.signTypedData(typedData));
@@ -17804,7 +18075,7 @@ async function selectToken(client, solverAccount, tokens, permit2) {
   for (const token of tokens) {
     const balance = await client.readContract({
       address: token.address,
-      abi: import_viem20.erc20Abi,
+      abi: import_viem22.erc20Abi,
       functionName: "balanceOf",
       args: [solverAccount]
     });
@@ -17834,7 +18105,7 @@ async function paymasterSupportsPermit2(client, chainId, paymasterAddress) {
     permit2Support.set(key, { supported: true, checkedAt: Date.now() });
     return true;
   } catch (error) {
-    const isRevert = error instanceof import_viem20.BaseError && error.walk((e) => e instanceof import_viem20.ContractFunctionRevertedError || e instanceof import_viem20.ContractFunctionZeroDataError);
+    const isRevert = error instanceof import_viem22.BaseError && error.walk((e) => e instanceof import_viem22.ContractFunctionRevertedError || e instanceof import_viem22.ContractFunctionZeroDataError);
     if (isRevert) {
       permit2Support.set(key, { supported: false, checkedAt: Date.now() });
       return false;
@@ -17845,7 +18116,7 @@ async function paymasterSupportsPermit2(client, chainId, paymasterAddress) {
 async function readAllowance(client, token, owner, spender) {
   return await client.readContract({
     address: token,
-    abi: import_viem20.erc20Abi,
+    abi: import_viem22.erc20Abi,
     functionName: "allowance",
     args: [owner, spender]
   });
@@ -17865,7 +18136,7 @@ async function buildPermit2Mode(signer, p) {
   const r = `0x${signature.slice(2, 66)}`;
   const s = `0x${signature.slice(66, 130)}`;
   const v = Number.parseInt(signature.slice(130, 132), 16);
-  const paymasterData = (0, import_viem20.encodePacked)(
+  const paymasterData = (0, import_viem22.encodePacked)(
     ["uint8", "address", "uint256", "uint256", "uint256", "uint8", "bytes32", "bytes32"],
     [2, p.token, p.amount, nonce, deadline, v, r, s]
   );
@@ -17889,9 +18160,9 @@ async function buildPermitMode(client, signer, solverAccount, paymasterAddress,
   const r = `0x${permitSignature.slice(2, 66)}`;
   const s = `0x${permitSignature.slice(66, 130)}`;
   const v = Number.parseInt(permitSignature.slice(130, 132), 16);
-  const paymasterData = (0, import_viem20.encodePacked)(
+  const paymasterData = (0, import_viem22.encodePacked)(
     ["uint8", "address", "uint256", "uint256", "uint8", "bytes32", "bytes32"],
-    [0, tokenAddress, permitAmount, import_viem20.maxUint256, v, r, s]
+    [0, tokenAddress, permitAmount, import_viem22.maxUint256, v, r, s]
   );
   return {
     paymaster: paymasterAddress,
@@ -17905,7 +18176,7 @@ async function ensureFundedApprove(client, walletClient, chainId, solverAccount,
   const key = `${chainId}:${tokenAddress.toLowerCase()}:${solverAccount.toLowerCase()}`;
   const inFlight = approvalsInFlight.get(key);
   if (inFlight) return inFlight;
-  const pending = sendFundedApprove(client, walletClient, solverAccount, tokenAddress, spender, import_viem20.maxUint256).finally(
+  const pending = sendFundedApprove(client, walletClient, solverAccount, tokenAddress, spender, import_viem22.maxUint256).finally(
     () => {
       approvalsInFlight.delete(key);
     }
@@ -17923,7 +18194,7 @@ async function sendFundedApprove(client, walletClient, solverAccount, tokenAddre
   const requiredNative = APPROVE_TX_GAS * gasPrice * (needsReset ? 2n : 1n);
   if (nativeBalance < requiredNative) {
     throw new Error(
-      `SimplexPaymaster needs a one-time Permit2 approval for the fee token on this chain; send native dust (>= ${(0, import_viem20.formatEther)(requiredNative)}) to ${solverAccount}`
+      `SimplexPaymaster needs a one-time Permit2 approval for the fee token on this chain; send native dust (>= ${(0, import_viem22.formatEther)(requiredNative)}) to ${solverAccount}`
     );
   }
   if (needsReset) {
@@ -17934,7 +18205,7 @@ async function sendFundedApprove(client, walletClient, solverAccount, tokenAddre
 async function sendApproveTx(client, walletClient, tokenAddress, spender, amount) {
   const hash = await walletClient.writeContract({
     address: tokenAddress,
-    abi: import_viem20.erc20Abi,
+    abi: import_viem22.erc20Abi,
     functionName: "approve",
     args: [spender, amount],
     chain: walletClient.chain,
@@ -17959,7 +18230,7 @@ async function tokenSupportsPermit(client, tokenAddress) {
     });
     return true;
   } catch (error) {
-    const isRevert = error instanceof import_viem20.BaseError && error.walk((e) => e instanceof import_viem20.ContractFunctionRevertedError || e instanceof import_viem20.ContractFunctionZeroDataError);
+    const isRevert = error instanceof import_viem22.BaseError && error.walk((e) => e instanceof import_viem22.ContractFunctionRevertedError || e instanceof import_viem22.ContractFunctionZeroDataError);
     if (isRevert) return false;
     throw error;
   }
@@ -18066,6 +18337,10 @@ function describeShortfall(balances) {
 // src/services/ContractInteractionService.ts
 import_decimal2.Decimal.config({ precision: 28, rounding: 4 });
 var FUNDING_GAS_PER_CALL = 400000n;
+var DEBIT_ORDER_GAS = 60000n;
+function settles(budget) {
+  return !!budget && budget.token.toLowerCase() !== import_sdk7.ADDRESS_ZERO;
+}
 var LIMIT_ORDER_CALL_GAS_LIMIT = 500000n;
 var LIMIT_ORDER_VERIFICATION_GAS_LIMIT = 150000n;
 var LIMIT_ORDER_PRE_VERIFICATION_GAS = 50000n;
@@ -18255,17 +18530,19 @@ var ContractInteractionService = class {
   }
   /**
    * The call gas a bid needs: the shared estimate plus room for the funding calls
-   * this bid prepends.
+   * this bid prepends and for settling its limit order's budget.
    *
    * Funding calls are not simulated (the V4 PositionManager's flash accounting does
    * not resolve in the bundler's estimation context), so each one adds a fixed
    * allowance for its modifyLiquidities + take. They differ between the bids on one
    * order, since each draws on its own limit order and so on its own funding, which
    * is why this is worked out per bid rather than baked into the cached estimate.
+   * The estimate is of a lone fillOrder, so the budget call is not in it either.
    */
-  callGasLimitFor(order, baseCallGasLimit) {
+  callGasLimitFor(order, baseCallGasLimit, budget) {
     const funding = order.id ? this.cacheService.getFundingPrepends(order.id) : null;
-    return baseCallGasLimit + FUNDING_GAS_PER_CALL * BigInt(funding?.calls?.length ?? 0);
+    const fundingGas = FUNDING_GAS_PER_CALL * BigInt(funding?.calls?.length ?? 0);
+    return baseCallGasLimit + fundingGas + (settles(budget) ? DEBIT_ORDER_GAS : 0n);
   }
   /**
    * Gets the fee token address and decimals for a given chain.
@@ -18337,7 +18614,7 @@ var ContractInteractionService = class {
       this.logger.warn(
         {
           chain,
-          walletBalance: (0, import_viem21.formatEther)(solverBalance),
+          walletBalance: (0, import_viem23.formatEther)(solverBalance),
           walletGasUnits: walletGasUnits.toString(),
           gasPrice: gasPrice.toString()
         },
@@ -18352,10 +18629,10 @@ var ContractInteractionService = class {
       this.logger.info(
         {
           chain,
-          currentDeposit: (0, import_viem21.formatEther)(currentDeposit),
+          currentDeposit: (0, import_viem23.formatEther)(currentDeposit),
           depositGasUnits: depositGasUnits.toString(),
           targetGasUnits: targetGasUnits.toString(),
-          walletBalance: (0, import_viem21.formatEther)(solverBalance)
+          walletBalance: (0, import_viem23.formatEther)(solverBalance)
         },
         "EntryPoint deposit covers target gas units, no top-up needed"
       );
@@ -18366,8 +18643,8 @@ var ContractInteractionService = class {
       this.logger.warn(
         {
           chain,
-          deficit: (0, import_viem21.formatEther)(deficit),
-          solverBalance: (0, import_viem21.formatEther)(solverBalance),
+          deficit: (0, import_viem23.formatEther)(deficit),
+          solverBalance: (0, import_viem23.formatEther)(solverBalance),
           depositGasUnits: depositGasUnits.toString(),
           targetGasUnits: targetGasUnits.toString()
         },
@@ -18379,10 +18656,10 @@ var ContractInteractionService = class {
     this.logger.info(
       {
         chain,
-        currentDeposit: (0, import_viem21.formatEther)(currentDeposit),
+        currentDeposit: (0, import_viem23.formatEther)(currentDeposit),
         depositGasUnits: depositGasUnits.toString(),
         targetGasUnits: targetGasUnits.toString(),
-        topUpAmount: (0, import_viem21.formatEther)(deficit)
+        topUpAmount: (0, import_viem23.formatEther)(deficit)
       },
       "Topping up EntryPoint deposit to cover target gas units"
     );
@@ -18405,7 +18682,7 @@ var ContractInteractionService = class {
       const addr = tokenAddress.toLowerCase();
       if (addr !== sourceUsdc && addr !== sourceUsdt) continue;
       const decimals = await this.getTokenDecimals(tokenAddress, order.source);
-      const tokenAmount = new import_decimal2.Decimal((0, import_viem21.formatUnits)(input.amount, decimals));
+      const tokenAmount = new import_decimal2.Decimal((0, import_viem23.formatUnits)(input.amount, decimals));
       inputUsdValue = inputUsdValue.plus(tokenAmount);
     }
     return inputUsdValue;
@@ -18447,6 +18724,27 @@ var ContractInteractionService = class {
       { maxRetries: 3, backoffMs: 250, logMessage: "Failed to read token balance" }
     );
   }
+  /**
+   * What the solver's account has tallied against a limit order's budget on `chain`, in
+   * the paid token's own units, or null when it cannot be read.
+   *
+   * Null rather than a throw: an account whose implementation keeps no tally answers
+   * with a revert or with no data, and the caller carries on without the figure either
+   * way. Not retried, since that answer does not change on a second ask.
+   */
+  async limitOrderSpent(chain, budgetId) {
+    try {
+      return await this.clientManager.getPublicClient(chain).readContract({
+        address: this.solverAccountAddress,
+        abi: SOLVER_ACCOUNT_ABI,
+        functionName: "spent",
+        args: [budgetId]
+      });
+    } catch (err) {
+      this.logger.warn({ err, chain, budgetId }, "Could not read the limit order's tally from the solver account");
+      return null;
+    }
+  }
   async getSolverEntryPointBalance(chain) {
     const entryPointAddress = this.configService.getEntryPointAddress(chain);
     if (!entryPointAddress) {
@@ -18475,7 +18773,7 @@ var ContractInteractionService = class {
     const walletClient = this.clientManager.getWalletClient(chain);
     const publicClient = this.clientManager.getPublicClient(chain);
     this.logger.info(
-      { chain, solver: this.solverAccountAddress, amount: (0, import_viem21.formatEther)(amount) },
+      { chain, solver: this.solverAccountAddress, amount: (0, import_viem23.formatEther)(amount) },
       "Depositing to EntryPoint"
     );
     const hash = await walletClient.writeContract({
@@ -18490,7 +18788,7 @@ var ContractInteractionService = class {
     if (receipt.status !== "success") {
       throw new Error(`EntryPoint deposit transaction reverted: ${hash}`);
     }
-    this.logger.info({ chain, txHash: hash, amount: (0, import_viem21.formatEther)(amount) }, "EntryPoint deposit confirmed");
+    this.logger.info({ chain, txHash: hash, amount: (0, import_viem23.formatEther)(amount) }, "EntryPoint deposit confirmed");
     return hash;
   }
   /**
@@ -18510,7 +18808,7 @@ var ContractInteractionService = class {
     const walletClient = this.clientManager.getWalletClient(chain);
     const publicClient = this.clientManager.getPublicClient(chain);
     this.logger.info(
-      { chain, solver: this.solverAccountAddress, amount: (0, import_viem21.formatEther)(balance) },
+      { chain, solver: this.solverAccountAddress, amount: (0, import_viem23.formatEther)(balance) },
       "Withdrawing from EntryPoint"
     );
     const hash = await walletClient.writeContract({
@@ -18524,7 +18822,7 @@ var ContractInteractionService = class {
     if (receipt.status !== "success") {
       throw new Error(`EntryPoint withdrawal transaction reverted: ${hash}`);
     }
-    this.logger.info({ chain, txHash: hash, amount: (0, import_viem21.formatEther)(balance) }, "EntryPoint withdrawal confirmed");
+    this.logger.info({ chain, txHash: hash, amount: (0, import_viem23.formatEther)(balance) }, "EntryPoint withdrawal confirmed");
     return hash;
   }
   /**
@@ -18587,7 +18885,8 @@ var ContractInteractionService = class {
     if (!cachedEstimate) {
       throw new Error(`No cached gas estimate found for order ${order.id}. Call estimateGasFillPost first.`);
     }
-    const callGasLimit = this.callGasLimitFor(order, cachedEstimate.callGasLimit);
+    const budget = this.cacheService.getBidBudget(order.id);
+    const callGasLimit = this.callGasLimitFor(order, cachedEstimate.callGasLimit, budget);
     const cachedFillerOutputs = this.cacheService.getFillerOutputs(order.id);
     const cachedFillerInputs = this.cacheService.getFillerInputs(order.id);
     if (!cachedFillerOutputs || !cachedFillerInputs) {
@@ -18614,7 +18913,8 @@ var ContractInteractionService = class {
       order,
       cachedFillerOutputs,
       fillOptions,
-      cachedEstimate.totalCostInSourceFeeToken + dispatchFeeTokenAmount
+      cachedEstimate.totalCostInSourceFeeToken + dispatchFeeTokenAmount,
+      budget ? { budget, solverAccount: solverAccountAddress } : void 0
     );
     const commitment = (0, import_sdk7.orderCommitment)(order);
     const nonce = await this.clientManager.getPublicClient(order.destination).readContract({
@@ -18760,7 +19060,7 @@ var ContractInteractionService = class {
       {
         target: outputToken,
         value: 0n,
-        data: (0, import_viem21.encodeFunctionData)({
+        data: (0, import_viem23.encodeFunctionData)({
           abi: ERC20_ABI,
           functionName: "approve",
           args: [gateway, outputAmount]
@@ -18806,8 +19106,13 @@ var ContractInteractionService = class {
    * Same-chain fills release escrow locally with no Hyperbridge dispatch, so the
    * gateway never pulls the fee token — its approval is skipped. Only cross-chain
    * fills, which dispatch a RedeemEscrow message paid in the fee token, need it.
+   *
+   * A bid priced by a limit order ends with `debitOrder`, which takes the budget's id
+   * as its `orderId`, works out what the fill paid from what is left of the allowance
+   * and reverts the whole batch if the order's payouts would pass its size. It has to
+   * come last, after the gateway has drawn on the allowance.
    */
-  async buildApprovalAndFillCalldata(order, fillerOutputs, fillOptions, requiredFeeTokenAmount) {
+  async buildApprovalAndFillCalldata(order, fillerOutputs, fillOptions, requiredFeeTokenAmount, settlement) {
     const chain = order.destination;
     const intentGatewayV2Address = this.configService.getIntentGatewayAddress(chain);
     const perTokenRequired = /* @__PURE__ */ new Map();
@@ -18817,9 +19122,10 @@ var ContractInteractionService = class {
       const key = addr.toLowerCase();
       perTokenRequired.set(key, (perTokenRequired.get(key) ?? 0n) + output.amount);
     }
+    let feeKey;
     if (order.source !== order.destination) {
       const feeToken = await this.getFeeTokenWithDecimals(chain);
-      const feeKey = feeToken.address.toLowerCase();
+      feeKey = feeToken.address.toLowerCase();
       perTokenRequired.set(feeKey, (perTokenRequired.get(feeKey) ?? 0n) + requiredFeeTokenAmount);
     }
     const fundingPrepends = order.id ? this.cacheService.getFundingPrepends(order.id) : null;
@@ -18831,7 +19137,7 @@ var ContractInteractionService = class {
         calls.push({
           target: tokenAddress,
           value: 0n,
-          data: (0, import_viem21.encodeFunctionData)({
+          data: (0, import_viem23.encodeFunctionData)({
             abi: ERC20_ABI,
             functionName: "approve",
             args: [intentGatewayV2Address, amount]
@@ -18845,17 +19151,37 @@ var ContractInteractionService = class {
       value: nativeOutputValue,
       data: (0, import_sdk7.encodeFillOrder)((0, import_sdk7.transformOrderForContract)(order), fillOptions)
     });
+    if (settlement && settles(settlement.budget)) {
+      const { budget, solverAccount } = settlement;
+      const budgetToken = budget.token.toLowerCase();
+      const approved = perTokenRequired.get(budgetToken) ?? 0n;
+      if (approved === 0n) {
+        throw new Error(
+          `Bid on order ${order.id} approves nothing in ${budget.token}, the token budget ${budget.budgetId} is measured in`
+        );
+      }
+      const fee = feeKey === budgetToken ? fillOptions.relayerFee : 0n;
+      calls.push({
+        target: solverAccount,
+        value: 0n,
+        data: (0, import_viem23.encodeFunctionData)({
+          abi: SOLVER_ACCOUNT_ABI,
+          functionName: "debitOrder",
+          args: [budget.budgetId, budget.cap, budgetToken, approved, fee]
+        })
+      });
+    }
     return (0, import_sdk7.encodeERC7821ExecuteBatch)(calls);
   }
 };
 
 // src/services/DelegationService.ts
-var import_viem23 = require("viem");
+var import_viem25 = require("viem");
 var import_sdk9 = require("@hyperbridge/sdk");
 
 // src/services/UserOpSender.ts
 var import_sdk8 = require("@hyperbridge/sdk");
-var import_viem22 = require("viem");
+var import_viem24 = require("viem");
 var FALLBACK_VERIFICATION_GAS_LIMIT = 250000n;
 var FALLBACK_CALL_GAS_LIMIT = 1500000n;
 var FALLBACK_PRE_VERIFICATION_GAS = 150000n;
@@ -18928,11 +19254,11 @@ var UserOpSender = class {
     });
     const formattedAuth = auth ? {
       address: auth.address,
-      chainId: (0, import_viem22.toHex)(auth.chainId),
-      nonce: (0, import_viem22.toHex)(auth.nonce),
+      chainId: (0, import_viem24.toHex)(auth.chainId),
+      nonce: (0, import_viem24.toHex)(auth.nonce),
       r: auth.r,
       s: auth.s,
-      yParity: (0, import_viem22.toHex)(auth.yParity)
+      yParity: (0, import_viem24.toHex)(auth.yParity)
     } : void 0;
     const { verificationGasLimit, callGasLimit, preVerificationGas } = gas ?? await this.estimateGas({
       bundlerUrl,
@@ -19100,10 +19426,10 @@ function bootstrapCallData(approval) {
     {
       target: approval.token,
       value: 0n,
-      data: (0, import_viem23.encodeFunctionData)({
-        abi: import_viem23.erc20Abi,
+      data: (0, import_viem25.encodeFunctionData)({
+        abi: import_viem25.erc20Abi,
         functionName: "approve",
-        args: [approval.spender, import_viem23.maxUint256]
+        args: [approval.spender, import_viem25.maxUint256]
       })
     }
   ]);
@@ -19154,10 +19480,10 @@ var DelegationService = class {
       return await walletClient.sendTransaction({
         to: approval.token,
         value: 0n,
-        data: (0, import_viem23.encodeFunctionData)({
-          abi: import_viem23.erc20Abi,
+        data: (0, import_viem25.encodeFunctionData)({
+          abi: import_viem25.erc20Abi,
           functionName: "approve",
-          args: [approval.spender, import_viem23.maxUint256]
+          args: [approval.spender, import_viem25.maxUint256]
         }),
         authorizationList: [authorization],
         chain: walletClient.chain,
@@ -19391,8 +19717,8 @@ var DelegationService = class {
         {
           chain,
           authority,
-          nativeBalance: (0, import_viem23.formatEther)(native.nativeBalance),
-          requiredNative: (0, import_viem23.formatEther)(native.requiredNative)
+          nativeBalance: (0, import_viem25.formatEther)(native.nativeBalance),
+          requiredNative: (0, import_viem25.formatEther)(native.requiredNative)
         },
         "Delegation failed: insufficient native balance for direct EIP-7702 tx and paymaster path unavailable"
       );
@@ -19467,7 +19793,7 @@ var DelegationService = class {
         { chain, authority: this.signer.address, mode: this.signer.mode ?? "custom" },
         "Revoking EIP-7702 delegation"
       );
-      const authorization = await this.buildAuthorization(chain, import_viem23.zeroAddress);
+      const authorization = await this.buildAuthorization(chain, import_viem25.zeroAddress);
       const hash = await this.sendDelegationTransaction(chain, authorization);
       const receipt = await publicClient.waitForTransactionReceipt({ hash });
       if (receipt.status === "success") {
@@ -19483,13 +19809,13 @@ var DelegationService = class {
 };
 
 // src/services/RebalancingService.ts
-var import_viem26 = require("viem");
+var import_viem28 = require("viem");
 var import_sdk13 = require("@hyperbridge/sdk");
 var import_decimal3 = require("decimal.js");
 
 // src/services/rebalancers/binance.ts
 var import_wallet2 = require("@binance/wallet");
-var import_viem24 = require("viem");
+var import_viem26 = require("viem");
 var import_sdk10 = require("@hyperbridge/sdk");
 var DEPOSIT_STATUS_SUCCESS = 1;
 var WITHDRAW_STATUS_COMPLETED = 6;
@@ -19801,7 +20127,7 @@ var BinanceRebalancer = class {
       abi: ERC20_ABI,
       functionName: "decimals"
     });
-    const amountWei = (0, import_viem24.parseUnits)(amount, Number(tokenDecimals));
+    const amountWei = (0, import_viem26.parseUnits)(amount, Number(tokenDecimals));
     const balance = await publicClient.readContract({
       address: tokenAddress,
       abi: ERC20_ABI,
@@ -20025,7 +20351,7 @@ var CctpRebalancer = class {
 };
 
 // src/services/rebalancers/usdt0.ts
-var import_viem25 = require("viem");
+var import_viem27 = require("viem");
 var import_sdk12 = require("@hyperbridge/sdk");
 
 // src/config/abis/Oft.ts
@@ -20188,7 +20514,7 @@ var Usdt0Rebalancer = class {
     const publicClient = this.chainClientManager.getPublicClient(source);
     const walletClient = this.chainClientManager.getWalletClient(source);
     const recipient = recipientAddress || this.account.address;
-    const amountWei = (0, import_viem25.parseUnits)(amount, 6);
+    const amountWei = (0, import_viem27.parseUnits)(amount, 6);
     if (sourceChainId === 1) {
       const allowance = await publicClient.readContract({
         address: tokenAddress,
@@ -20201,7 +20527,7 @@ var Usdt0Rebalancer = class {
           address: tokenAddress,
           abi: ERC20_ABI,
           functionName: "approve",
-          args: [oftAddress, import_viem25.maxUint256],
+          args: [oftAddress, import_viem27.maxUint256],
           chain: walletClient.chain
         });
         await publicClient.waitForTransactionReceipt({ hash: approveTx, confirmations: 1 });
@@ -20283,8 +20609,8 @@ var Usdt0Rebalancer = class {
     if (!oftAddress) throw new Error(`Chain ${source} not supported by USDT0`);
     const publicClient = this.chainClientManager.getPublicClient(source);
     const recipient = recipientAddress || this.account.address;
-    const amountWei = (0, import_viem25.parseUnits)(amount, 6);
-    const recipientBytes32 = (0, import_viem25.padHex)(recipient, { size: 32 });
+    const amountWei = (0, import_viem27.parseUnits)(amount, 6);
+    const recipientBytes32 = (0, import_viem27.padHex)(recipient, { size: 32 });
     const sendParam = {
       dstEid: destEid,
       to: recipientBytes32,
@@ -20636,7 +20962,7 @@ var RebalancingService = class {
         functionName: "balanceOf",
         args: [this.walletAddress]
       });
-      const balanceDecimal = new import_decimal3.Decimal((0, import_viem26.formatUnits)(balanceWei, Number(decimals)));
+      const balanceDecimal = new import_decimal3.Decimal((0, import_viem28.formatUnits)(balanceWei, Number(decimals)));
       return balanceDecimal.toNumber();
     } catch (error) {
       this.logger.error({ error, chain, asset }, "Failed to get current balance");
@@ -20684,11 +21010,11 @@ function byBestRate(a, b) {
   return left === right ? 0 : left > right ? -1 : 1;
 }
 function chargedFor(hold, delivered, released) {
-  if (hold.take === void 0 || released === 0n) return delivered;
-  const take = BigInt(hold.take);
-  if (take === 0n) return delivered;
-  const atRate = (BigInt(hold.amount) * released + take - 1n) / take;
-  return atRate > delivered ? atRate : delivered;
+  const take = hold.take === void 0 ? 0n : BigInt(hold.take);
+  if (take === 0n || released === 0n) return toScaledUp(delivered.raw, delivered.decimals);
+  const offered = toRaw(BigInt(hold.amount), delivered.decimals);
+  const atRate = (offered * released + take - 1n) / take;
+  return toScaledUp(atRate > delivered.raw ? atRate : delivered.raw, delivered.decimals);
 }
 var IntentFiller = class {
   constructor(chainConfigs, strategies, config, configService, chainClientManager, contractService, signer, scanners, rebalancingService, bidStorage, limitOrders, assetRegistry) {
@@ -20765,6 +21091,17 @@ var IntentFiller = class {
   setLimitOrderService(service) {
     this.limitOrderService = service;
   }
+  /**
+   * Brings the limit orders' `remaining` in line with their on-chain tallies.
+   *
+   * On the settlement queue, so the pass and a fill never resize the same order at
+   * once. Resolves when the pass has run.
+   */
+  async reconcileLimitOrderTallies() {
+    await this.settlementQueue.add(async () => {
+      await this.limitOrderService?.reconcileTallies();
+    });
+  }
   /** Whether the given chain id is configured for watch-only (monitor, never fill). */
   isChainWatchOnly(chainId) {
     const watchOnly = this.config.watchOnly;
@@ -21410,7 +21747,7 @@ var IntentFiller = class {
         let reservation = [];
         if (plan) {
           if (order.id) {
-            cache.setFillerOutputs(order.id, plan.fillerOutputs, plan.fillerInputs);
+            cache.setFillerOutputs(order.id, plan.fillerOutputs, plan.fillerInputs, plan.budget);
             cache.setPartialFill(order.id, plan.partialFill);
             if (plan.fundingCalls.length > 0) cache.setFundingPrepends(order.id, plan.fundingCalls);
             else cache.clearFundingPrepends(order.id);
@@ -21611,7 +21948,7 @@ var IntentFiller = class {
       await this.releaseAll(claimed);
       return;
     }
-    const settled = executedHold(claimed, delivered, released);
+    const settled = executedHold(claimed, delivered.scaled, released);
     const charged = chargedFor(settled, delivered, released);
     const settledBid = rows.find(
       (row) => row.reservations.some(
@@ -21664,15 +22001,15 @@ var IntentFiller = class {
     if (delivered === null) return [];
     const settled = executedHold(
       holds.map((entry) => entry.hold),
-      delivered,
+      delivered.scaled,
       released
     );
     const row = holds.find((entry) => entry.hold === settled).row;
     return this.bidStorage.claimReservation(commitment, row.bid ?? void 0);
   }
   /**
-   * What this fill delivered of the token the limit order pays, at 1e18, or null
-   * when the fill names none of it.
+   * What this fill delivered of the token the limit order pays, or null when the
+   * fill names none of it.
    */
   async deliveredAgainst(limitOrderId, chainId, outputs) {
     const order = await this.limitOrders?.get(limitOrderId);
@@ -21688,7 +22025,7 @@ var IntentFiller = class {
     }
     if (total === 0n) return null;
     const decimals = await this.contractService.getTokenDecimals(address, chain);
-    return toScaled(total, decimals);
+    return { scaled: toScaled(total, decimals), raw: total, decimals };
   }
   /**
    * Gives back whatever this bid still holds against its limit order.
@@ -21778,90 +22115,9 @@ var IntentFiller = class {
 
 // src/strategies/fx.ts
 var import_sdk15 = require("@hyperbridge/sdk");
-var import_viem27 = require("viem");
+var import_viem29 = require("viem");
 var import_decimal6 = require("decimal.js");
 
-// src/orderbook/matching.ts
-function limitOrderLegs(order) {
-  return order.side === "BID" ? { input: order.base, output: order.quote } : { input: order.quote, output: order.base };
-}
-function matchLimitOrders(orders, incoming, resolve, now = /* @__PURE__ */ new Date()) {
-  const qualifying = orders.filter((order) => serves(order, incoming, resolve, now)).map((order) => {
-    const offer = offerFor({
-      side: order.side,
-      inputAmount: incoming.inputNet,
-      price: BigInt(order.price),
-      outputDecimals: incoming.outputDecimals
-    });
-    const available = BigInt(order.remaining);
-    return { order, offer, available, payout: offer < available ? offer : available };
-  }).filter((candidate) => candidate.offer >= incoming.requestedOutput && candidate.payout > 0n).sort(byBestOfferFirst);
-  return qualifying;
-}
-function byBestOfferFirst(a, b) {
-  if (a.offer !== b.offer) return a.offer > b.offer ? -1 : 1;
-  if (a.available !== b.available) return a.available > b.available ? -1 : 1;
-  return a.order.id < b.order.id ? -1 : 1;
-}
-function whyUnmatched(orders, incoming, resolve, now = /* @__PURE__ */ new Date()) {
-  let furthest = -1;
-  for (const order of orders) {
-    const failed = firstFailed(order, incoming, resolve, now);
-    furthest = Math.max(furthest, failed === null ? CHECKS.length : CHECKS.indexOf(failed));
-  }
-  const { source, destination, inputSymbol } = incoming;
-  if (furthest < CHECKS.length) {
-    switch (CHECKS[Math.max(furthest, 0)]) {
-      case "open":
-        return "no limit order is open";
-      case "chain":
-        return `no open limit order fills on ${destination}`;
-      case "input":
-        return `no limit order on ${destination} takes ${inputSymbol} in`;
-      case "output":
-        return `no limit order on ${destination} taking ${inputSymbol} in pays out the token this order asks for`;
-      case "source":
-        return `no limit order for this pair on ${destination} accepts swaps from ${source}`;
-    }
-  }
-  const priced = orders.filter((order) => firstFailed(order, incoming, resolve, now) === null).map((order) => ({
-    order,
-    offer: offerFor({
-      side: order.side,
-      inputAmount: incoming.inputNet,
-      price: BigInt(order.price),
-      outputDecimals: incoming.outputDecimals
-    })
-  }));
-  if (priced.some(({ offer }) => offer >= incoming.requestedOutput)) {
-    return "the limit orders that meet its rate have nothing left to pay out";
-  }
-  const best = priced.reduce((a, b) => b.offer > a.offer ? b : a);
-  const symbol = limitOrderLegs(best.order).output;
-  return `it asks for ${readable(incoming.requestedOutput)} ${symbol}; the best limit order offers ${readable(best.offer)} ${symbol}`;
-}
-var CHECKS = ["open", "chain", "input", "output", "source"];
-function serves(order, incoming, resolve, now) {
-  return firstFailed(order, incoming, resolve, now) === null;
-}
-function firstFailed(order, incoming, resolve, now) {
-  if (order.status !== "open") return "open";
-  if (order.expiresAt !== null && new Date(order.expiresAt) <= now) return "open";
-  if (order.fillChain !== incoming.destination) return "chain";
-  const legs = limitOrderLegs(order);
-  if (normalizeSymbol(legs.input) !== normalizeSymbol(incoming.inputSymbol)) return "input";
-  const outputToken = resolve(legs.output, order.fillChain);
-  if (!outputToken || outputToken.toLowerCase() !== incoming.outputToken.toLowerCase()) return "output";
-  if (incoming.source === incoming.destination) return null;
-  return order.acceptedSources.includes(incoming.source) ? null : "source";
-}
-function readable(amount) {
-  const [whole, fraction] = toHuman(amount).split(".");
-  const grouped = whole.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
-  const cut = fraction?.slice(0, 6).replace(/0+$/, "");
-  return cut ? `${grouped}.${cut}` : grouped;
-}
-
 // src/orderbook/usd.ts
 var import_decimal5 = require("decimal.js");
 function limitOrderUsdEdges(orders) {
@@ -21916,9 +22172,13 @@ var FXFiller = class _FXFiller {
    */
   constructor(signer, configService, clientManager, contractService, pairs, registry, options) {
     this.name = "FXFiller";
-    /** Consecutive orders where overfill clamp activated. */
+    /**
+     * Consecutive orders where the overfill clamp activated. Dormant: the clamp
+     * existed for venue-priced legs, which went with Uniswap V4 pricing, so every
+     * outcome is now recorded unclamped and this never climbs. See `recordOrderOutcome`.
+     */
     this.consecutiveClamps = 0;
-    /** Once set, the filler refuses all orders until restart — systemic pricing error suspected. */
+    /** Once set, the filler refuses all orders until reset. Unreachable while the clamp is dormant. */
     this.halted = false;
     this.logger = moduleLogger(configService.loggers, "fx-simplex");
     const { confirmationPolicy, fundingVenues = [], limitOrders } = options ?? {};
@@ -21967,10 +22227,9 @@ var FXFiller = class _FXFiller {
     this.pairs.push(pair);
   }
   /**
-   * Removes a market from the running engine. All-or-nothing: at least one
-   * market must remain and no other pair may lose its USD anchor (removing a
-   * reference feed that anchors a dependent market is rejected). In-flight
-   * rechecks of orders on the removed pair simply stop matching.
+   * Removes a market from the running engine. At least one market must remain.
+   * Matching reads the limit orders rather than the pairs, so removing a market
+   * changes what the dashboard lists, not what the filler fills.
    */
   removePair(pair) {
     const index = this.pairs.indexOf(pair);
@@ -22026,22 +22285,20 @@ var FXFiller = class _FXFiller {
     }
   }
   /**
-   * Evaluates whether an order is profitable to fill under the per-pair
-   * `maxOrderSize` caps (where set) and the filler's current token balances.
+   * Evaluates whether an order is profitable to fill against the operator's
+   * limit orders and the filler's current token balances.
    *
    * High-level flow:
-   * - Resolve each (input, output) leg to a configured pair and direction.
-   * - Estimate each pair's total token0 notional in the order and cap it at
-   *   the pair's `maxOrderSize` when one is set; pair curves are evaluated at
-   *   that (possibly uncapped) notional.
-   * - Walk the legs, allocating from each pair's capped token0 budget and
-   *   pricing outputs at the pair's rate.
-   * - Further cap each leg by the filler's current token balance plus
-   *   funding-venue withdrawals.
-   * - Cache the resulting outputs for later use in `executeOrder`.
-   *
-   * Note: we may intentionally overfill relative to the user's requested
-   * outputs if the pair pricing makes that attractive. This is how we stay competitive.
+   * - Match each (input, output) leg against the open limit orders.
+   * - Build one bid per matching order, best offer first, each paying the
+   *   order's whole offer for the input at its own rate, capped by what the
+   *   order has left. The gateway credits the swapper the ask and splits
+   *   anything above it between the swapper and the protocol.
+   * - Treat a payout below the ask as a partial fill, which only orders
+   *   without output calldata and without an earlier partial fill allow.
+   * - Cap each payout by the filler's balance plus funding-venue withdrawals,
+   *   then gate it on fees (full fills) and the same-asset spread.
+   * - Cache the resulting bids for later use in `executeOrder`.
    */
   async calculateProfitability(order) {
     if (order.id) this.contractService.cacheService.clearPartialFill(order.id);
@@ -22059,6 +22316,7 @@ var FXFiller = class _FXFiller {
       const multiLeg = order.inputs.length > 1;
       const plans = [];
       const plannedOn = /* @__PURE__ */ new Map();
+      const spentOn = /* @__PURE__ */ new Map();
       for (let leg = 0; leg < order.inputs.length; leg++) {
         const input = order.inputs[leg];
         const output = order.output.assets[leg];
@@ -22080,7 +22338,30 @@ var FXFiller = class _FXFiller {
         for (const candidate of matches) {
           let partialFill = false;
           const fundingCalls = [];
-          const left = candidate.available - (plannedOn.get(candidate.order.id) ?? 0n);
+          const budget = budgetFor(candidate.order, outputToken, outputDecimals);
+          if (!spentOn.has(candidate.order.id)) {
+            spentOn.set(
+              candidate.order.id,
+              await this.contractService.limitOrderSpent(destChain, budget.budgetId)
+            );
+          }
+          const spent = spentOn.get(candidate.order.id) ?? null;
+          const room = spent === null ? candidate.available : budgetRoom(budget, spent, outputDecimals);
+          if (room === 0n) {
+            this.logger.info(
+              {
+                orderId: order.id,
+                leg,
+                limitOrder: candidate.order.id,
+                spent: spent?.toString(),
+                cap: budget.cap.toString()
+              },
+              "Skipping a bid: the limit order has nothing left on chain"
+            );
+            continue;
+          }
+          const available = room < candidate.available ? room : candidate.available;
+          const left = available - (plannedOn.get(candidate.order.id) ?? 0n);
           if (left <= 0n) {
             this.logger.info(
               { orderId: order.id, leg, limitOrder: candidate.order.id },
@@ -22115,10 +22396,7 @@ var FXFiller = class _FXFiller {
               {
                 orderId: order.id,
                 limitOrder: candidate.order.id,
-                available: (0, import_viem27.formatUnits)(
-                  candidate.available,
-                  18
-                ),
+                available: (0, import_viem29.formatUnits)(available, 18),
                 userRequested: output.amount.toString(),
                 payout: targetOutput.toString(),
                 crossChain: sourceChain !== destChain
@@ -22163,7 +22441,10 @@ var FXFiller = class _FXFiller {
             }
           }
           const effectiveBalance = walletContribution + credited;
-          const finalOutputAmount = effectiveBalance > targetOutput ? targetOutput : effectiveBalance;
+          const finalOutputAmount = toRaw(
+            toScaled(effectiveBalance > targetOutput ? targetOutput : effectiveBalance, outputDecimals),
+            outputDecimals
+          );
           if (finalOutputAmount === 0n) {
             this.logger.info(
               {
@@ -22252,7 +22533,7 @@ var FXFiller = class _FXFiller {
             const spread = convertedInput - finalOutputAmount;
             if (spread <= 0n) sameAssetProfitable = false;
             realizedSpreadProfit = adjustDecimalsFloor(spread, outputDecimals, feeTokenDecimals);
-            const spreadUsd = outputSymbol && usdValueOf(usdFactors, outputSymbol, new import_decimal6.Decimal((0, import_viem27.formatUnits)(spread, outputDecimals)));
+            const spreadUsd = outputSymbol && usdValueOf(usdFactors, outputSymbol, new import_decimal6.Decimal((0, import_viem29.formatUnits)(spread, outputDecimals)));
             if (spreadUsd) sameAssetEdgeUsd = spreadUsd;
           }
           const payoutSurplusUsd = new import_decimal6.Decimal(0);
@@ -22267,9 +22548,9 @@ var FXFiller = class _FXFiller {
                 {
                   orderId: order.id,
                   feeToken: feeTokenLower,
-                  residual: (0, import_viem27.formatUnits)(residual, feeToken.decimals),
-                  dispatchFee: (0, import_viem27.formatUnits)(dispatchFee, feeToken.decimals),
-                  required: (0, import_viem27.formatUnits)(required, feeToken.decimals)
+                  residual: (0, import_viem29.formatUnits)(residual, feeToken.decimals),
+                  dispatchFee: (0, import_viem29.formatUnits)(dispatchFee, feeToken.decimals),
+                  required: (0, import_viem29.formatUnits)(required, feeToken.decimals)
                 },
                 "Skipping order: fill leaves too little of the fee token to dispatch the escrow release"
               );
@@ -22282,10 +22563,10 @@ var FXFiller = class _FXFiller {
             this.logger.info(
               {
                 orderId: order.id,
-                orderFees: (0, import_viem27.formatUnits)(order.fees, feeTokenDecimals),
-                fillGas: (0, import_viem27.formatUnits)(totalCostInSourceFeeToken, feeTokenDecimals),
-                relayerFee: (0, import_viem27.formatUnits)(relayerFeeInSourceFeeToken, feeTokenDecimals),
-                executionCost: (0, import_viem27.formatUnits)(executionCost, feeTokenDecimals)
+                orderFees: (0, import_viem29.formatUnits)(order.fees, feeTokenDecimals),
+                fillGas: (0, import_viem29.formatUnits)(totalCostInSourceFeeToken, feeTokenDecimals),
+                relayerFee: (0, import_viem29.formatUnits)(relayerFeeInSourceFeeToken, feeTokenDecimals),
+                executionCost: (0, import_viem29.formatUnits)(executionCost, feeTokenDecimals)
               },
               "Skipping order: attached fees do not cover execution cost (fill gas + relayer fee)"
             );
@@ -22293,13 +22574,13 @@ var FXFiller = class _FXFiller {
           }
           if (sameAsset && !sameAssetProfitable) {
             this.logger.info(
-              { orderId: order.id, realizedSpreadProfit: (0, import_viem27.formatUnits)(realizedSpreadProfit, feeTokenDecimals) },
+              { orderId: order.id, realizedSpreadProfit: (0, import_viem29.formatUnits)(realizedSpreadProfit, feeTokenDecimals) },
               "Skipping order: a same-asset fill does not net a positive spread"
             );
             continue;
           }
           const feeProfit = order.fees - executionCost;
-          const totalProfit = partialFill ? partialEdgeUsd.toNumber() : Number.parseFloat((0, import_viem27.formatUnits)(feeProfit + realizedSpreadProfit, feeTokenDecimals));
+          const totalProfit = partialFill ? partialEdgeUsd.toNumber() : Number.parseFloat((0, import_viem29.formatUnits)(feeProfit + realizedSpreadProfit, feeTokenDecimals));
           this.logger.info(
             {
               orderId: order.id,
@@ -22315,12 +22596,12 @@ var FXFiller = class _FXFiller {
               limitOrders: matches.length,
               available: candidate.available.toString(),
               payout: targetOutput.toString(),
-              orderFees: (0, import_viem27.formatUnits)(order.fees, feeTokenDecimals),
-              fillGas: (0, import_viem27.formatUnits)(totalCostInSourceFeeToken, feeTokenDecimals),
-              relayerFee: (0, import_viem27.formatUnits)(relayerFeeInSourceFeeToken, feeTokenDecimals),
-              executionCost: (0, import_viem27.formatUnits)(executionCost, feeTokenDecimals),
-              feeProfit: (0, import_viem27.formatUnits)(feeProfit, feeTokenDecimals),
-              realizedSpreadProfit: (0, import_viem27.formatUnits)(realizedSpreadProfit, feeTokenDecimals),
+              orderFees: (0, import_viem29.formatUnits)(order.fees, feeTokenDecimals),
+              fillGas: (0, import_viem29.formatUnits)(totalCostInSourceFeeToken, feeTokenDecimals),
+              relayerFee: (0, import_viem29.formatUnits)(relayerFeeInSourceFeeToken, feeTokenDecimals),
+              executionCost: (0, import_viem29.formatUnits)(executionCost, feeTokenDecimals),
+              feeProfit: (0, import_viem29.formatUnits)(feeProfit, feeTokenDecimals),
+              realizedSpreadProfit: (0, import_viem29.formatUnits)(realizedSpreadProfit, feeTokenDecimals),
               payoutSurplusUsd: payoutSurplusUsd.toString(),
               totalProfit,
               profitable: totalProfit > 0
@@ -22339,7 +22620,8 @@ var FXFiller = class _FXFiller {
             fillerInputs,
             fundingCalls: [...fundingCalls],
             partialFill,
-            profit: totalProfit
+            profit: totalProfit,
+            budget
           });
           if (!partialEligibleCheap) break;
         }
@@ -22347,7 +22629,12 @@ var FXFiller = class _FXFiller {
       if (plans.length === 0) return 0;
       if (order.id) {
         this.contractService.cacheService.setBidPlans(order.id, plans);
-        this.contractService.cacheService.setFillerOutputs(order.id, plans[0].fillerOutputs, plans[0].fillerInputs);
+        this.contractService.cacheService.setFillerOutputs(
+          order.id,
+          plans[0].fillerOutputs,
+          plans[0].fillerInputs,
+          plans[0].budget
+        );
         this.contractService.cacheService.setPartialFill(order.id, plans[0].partialFill);
         this.contractService.cacheService.setMatchedLimitOrder(order.id, [
           { limitOrderId: plans[0].limitOrderId, payout: plans[0].payout }
@@ -22442,10 +22729,14 @@ var FXFiller = class _FXFiller {
   // =========================================================================
   /**
    * Update consecutive-clamp counter after a successful order evaluation.
-   * Only venue-priced legs feed this counter (see clamp site) — a streak of those
-   * is the signal that a live market source has gone off (stale pool, manipulated
-   * venue) and the filler should stop until an operator investigates. Offline
-   * price-curve clamps warn but never reach here.
+   *
+   * Dormant. Only venue-priced legs ever fed a clamped outcome here: a streak
+   * of those meant a live market source had gone off (stale pool, manipulated
+   * venue). Venue pricing went with Uniswap V4, and limit orders are prices the
+   * operator set, so the only caller records `false` and the filler never
+   * halts. `isHalted`, `resetHalt` and `[simplex.overfillProtection]
+   * maxConsecutiveClamps` are kept so existing configs and the halt API still
+   * load; they can go once nothing reads them.
    */
   recordOrderOutcome(clamped, orderId) {
     if (clamped) {
@@ -22471,18 +22762,6 @@ var FXFiller = class _FXFiller {
     this.consecutiveClamps = 0;
     this.logger.warn("FXFiller halt reset by operator \u2014 resuming order evaluation");
   }
-  /**
-   * Given a single (input, output) leg and the remaining token0 budget of its
-   * pair, computes how much token0 notional to allocate to this leg and the
-   * corresponding maximum output amount at the pair's rate.
-   *
-   * `rate` is **token1 per 1 token0**:
-   * - token0 input → token1 output: token0 × rate → token1 amount.
-   * - token1 input → token0 output: token1 ÷ rate → token0 amount.
-   *
-   * Returns `null` when this leg cannot consume any of the pair's remaining
-   * budget (e.g. the cap has already been exhausted).
-   */
   /**
    * Whether any solver has already delivered output against this order.
    *
@@ -22622,7 +22901,7 @@ var FXFiller = class _FXFiller {
       const symbol = this.registry.symbolFor(inputToken, order.source);
       if (!symbol) return null;
       const decimals = await this.contractService.getTokenDecimals(inputToken, order.source);
-      const legUsd = usdValueOf(factors, symbol, new import_decimal6.Decimal((0, import_viem27.formatUnits)(input.amount, decimals)));
+      const legUsd = usdValueOf(factors, symbol, new import_decimal6.Decimal((0, import_viem29.formatUnits)(input.amount, decimals)));
       if (!legUsd) return null;
       inputUsd = inputUsd.plus(legUsd);
     }
@@ -22635,7 +22914,7 @@ function minBigInt(first, ...rest) {
 
 // src/services/TokenSender.ts
 var import_sdk16 = require("@hyperbridge/sdk");
-var import_viem28 = require("viem");
+var import_viem30 = require("viem");
 var TokenSender = class {
   constructor(clientManager, solver, getVaults, userOpSender, configService) {
     this.clientManager = clientManager;
@@ -22647,18 +22926,18 @@ var TokenSender = class {
   }
   async send(params) {
     const { chain, token, amount, to } = params;
-    if (!(0, import_viem28.isAddress)(to)) throw new Error(`Invalid recipient address: ${to}`);
+    if (!(0, import_viem30.isAddress)(to)) throw new Error(`Invalid recipient address: ${to}`);
     const publicClient = this.clientManager.getPublicClient(chain);
     const calls = [];
     let redeemed = false;
     if (token === "native") {
-      const value = (0, import_viem28.parseUnits)(amount, 18);
+      const value = (0, import_viem30.parseUnits)(amount, 18);
       if (value <= 0n) throw new Error("Amount must be greater than 0");
       const balance = await publicClient.getBalance({ address: this.solver });
       if (balance < value) throw new Error(`Insufficient native balance: have ${balance}, need ${value}`);
       calls.push({ target: to, value, data: "0x" });
     } else {
-      if (!(0, import_viem28.isAddress)(token)) throw new Error(`Invalid token address: ${token}`);
+      if (!(0, import_viem30.isAddress)(token)) throw new Error(`Invalid token address: ${token}`);
       const tokenLower = token.toLowerCase();
       const [decimals, balance] = await Promise.all([
         publicClient.readContract({ abi: ERC20_ABI, address: token, functionName: "decimals" }),
@@ -22669,7 +22948,7 @@ var TokenSender = class {
           args: [this.solver]
         })
       ]);
-      const units = (0, import_viem28.parseUnits)(amount, decimals);
+      const units = (0, import_viem30.parseUnits)(amount, decimals);
       if (units <= 0n) throw new Error("Amount must be greater than 0");
       const isVaultShare = this.getVaults().some(
         (v) => v.chain === chain && v.vault.toLowerCase() === tokenLower
@@ -22680,7 +22959,7 @@ var TokenSender = class {
         calls.push({
           target: token,
           value: 0n,
-          data: (0, import_viem28.encodeFunctionData)({ abi: ERC4626_ABI, functionName: "redeem", args: [units, to, this.solver] })
+          data: (0, import_viem30.encodeFunctionData)({ abi: ERC4626_ABI, functionName: "redeem", args: [units, to, this.solver] })
         });
       } else {
         const reserve = this.userOpSender?.canSponsor(chain) && this.configService ? paymasterReserveForToken(chain, tokenLower, this.configService) : 0n;
@@ -22703,7 +22982,7 @@ var TokenSender = class {
         calls.push({
           target: token,
           value: 0n,
-          data: (0, import_viem28.encodeFunctionData)({ abi: ERC20_ABI, functionName: "transfer", args: [to, units] })
+          data: (0, import_viem30.encodeFunctionData)({ abi: ERC20_ABI, functionName: "transfer", args: [to, units] })
         });
       }
     }
@@ -22746,7 +23025,7 @@ var TokenSender = class {
       });
       const required = shortfall > 0n ? shortfall : 0n;
       if (available < required) continue;
-      const floor = vault.minBalance === void 0 ? 0n : (0, import_viem28.parseUnits)(vault.minBalance, decimals);
+      const floor = vault.minBalance === void 0 ? 0n : (0, import_viem30.parseUnits)(vault.minBalance, decimals);
       const headroom = reserve > floor ? reserve : floor;
       const wanted = shortfall + headroom;
       const amount = available >= wanted ? wanted : required;
@@ -22754,7 +23033,7 @@ var TokenSender = class {
       return {
         target: vault.vault,
         value: 0n,
-        data: (0, import_viem28.encodeFunctionData)({
+        data: (0, import_viem30.encodeFunctionData)({
           abi: ERC4626_ABI,
           functionName: "withdraw",
           args: [amount, this.solver, this.solver]
@@ -22820,9 +23099,9 @@ var LimitOrderLifecycle = class {
     const reconcileMs = this.options.reconcileIntervalSecs * 1e3;
     this.every(heartbeatMs, "heartbeat", () => this.service.heartbeat());
     this.every(EXPIRY_SWEEP_MS, "expiry", () => this.expire());
-    this.every(reconcileMs, "reconciliation", () => this.reconcile());
+    this.every(reconcileMs, "reconciliation", () => this.upkeep());
     this.logger.info({ heartbeatMs, expiryMs: EXPIRY_SWEEP_MS, reconcileMs }, "Orderbook lifecycle started");
-    void this.run("reconciliation", () => this.reconcile());
+    void this.upkeep();
   }
   stop() {
     this.timers.forEach((timer) => clearInterval(timer));
@@ -22833,6 +23112,14 @@ var LimitOrderLifecycle = class {
     const expired = await this.service.expireStale();
     if (expired > 0) this.logger.info({ expired }, "Withdrew limit orders that had outlived their expiry");
   }
+  /**
+   * The tally pass first, so reconciliation against the orderbook reads the sizes
+   * it left. Each fails on its own.
+   */
+  async upkeep() {
+    await this.run("tally reconciliation", async () => this.options.reconcileTallies());
+    await this.run("reconciliation", () => this.reconcile());
+  }
   async reconcile() {
     const report = await this.service.reconcile();
     if (report.cancelled || report.reposted || report.underFunded) {
@@ -22868,7 +23155,7 @@ var LimitOrderLifecycle = class {
 
 // src/services/BalanceProvider.ts
 var import_node_events = require("node:events");
-var import_viem29 = require("viem");
+var import_viem31 = require("viem");
 var BalanceProvider = class extends import_node_events.EventEmitter {
   constructor(options) {
     super();
@@ -22961,7 +23248,7 @@ var BalanceProvider = class extends import_node_events.EventEmitter {
     try {
       const native = await client.getBalance({ address: fillerAddr });
       const symbol = nativeTokenSymbol(chainId);
-      row.native = { symbol, amount: Number.parseFloat((0, import_viem29.formatUnits)(native, 18)) };
+      row.native = { symbol, amount: Number.parseFloat((0, import_viem31.formatUnits)(native, 18)) };
     } catch (err) {
       issues.push({ chainId, source: "native", message: errorMessage(err) });
     }
@@ -23032,7 +23319,7 @@ var BalanceProvider = class extends import_node_events.EventEmitter {
               functionName: "balanceOf",
               args: [fillerAddr]
             });
-            wallet = Number.parseFloat((0, import_viem29.formatUnits)(balance, definition.decimals));
+            wallet = Number.parseFloat((0, import_viem31.formatUnits)(balance, definition.decimals));
           } catch (err) {
             issues.push({
               chainId,
@@ -23060,8 +23347,8 @@ var BalanceProvider = class extends import_node_events.EventEmitter {
           available: wallet !== null && vaultDataAvailable ? Math.max(wallet - walletReserve, 0) + vaultAvailable : null,
           vaults: positions.map((position) => ({
             address: position.vault,
-            position: Number.parseFloat((0, import_viem29.formatUnits)(position.positionAssets, position.decimals)),
-            available: Number.parseFloat((0, import_viem29.formatUnits)(position.availableAssets, position.decimals)),
+            position: Number.parseFloat((0, import_viem31.formatUnits)(position.positionAssets, position.decimals)),
+            available: Number.parseFloat((0, import_viem31.formatUnits)(position.availableAssets, position.decimals)),
             acceptsDeposits: position.acceptsDeposits
           })),
           status: complete ? "fresh" : wallet !== null || positions.length > 0 ? "partial" : "unavailable"
@@ -23104,8 +23391,8 @@ var BalanceProvider = class extends import_node_events.EventEmitter {
         const api = await coprocessor.queryApi();
         const account = await api.query.system.account(address);
         const decimals = api.registry.chainDecimals[0] ?? 12;
-        const free = Number.parseFloat((0, import_viem29.formatUnits)(BigInt(account.data.free.toString()), decimals));
-        const reserved = Number.parseFloat((0, import_viem29.formatUnits)(BigInt(account.data.reserved.toString()), decimals));
+        const free = Number.parseFloat((0, import_viem31.formatUnits)(BigInt(account.data.free.toString()), decimals));
+        const reserved = Number.parseFloat((0, import_viem31.formatUnits)(BigInt(account.data.reserved.toString()), decimals));
         this.snapshot = { ...this.snapshot, hyperbridge: { address, free, reserved } };
       } catch (err) {
         this.logger.warn({ err }, "Failed to fetch Hyperbridge balance");
@@ -23125,7 +23412,7 @@ function isConfiguredAddress(address) {
 }
 function sumFormatted(positions, field) {
   return positions.reduce(
-    (total, position) => total + Number.parseFloat((0, import_viem29.formatUnits)(position[field], position.decimals)),
+    (total, position) => total + Number.parseFloat((0, import_viem31.formatUnits)(position[field], position.decimals)),
     0
   );
 }
@@ -23633,7 +23920,7 @@ async function bootFiller(config, options) {
   const sharedCacheService = new CacheService(options.loggers);
   if (!options.signer && !globalWatchOnly && !allChainsWatchOnly(watchOnlyConfig, resolvedChains)) {
     throw new Error(
-      "A signer is required unless every chain is watch-only: pass `signer` to Simplex.start (privateKeySigner, turnkeySigner, mpcVaultSigner, viemSigner, or your own Signer implementation). Running the binary? Configure it under [simplex.signer]."
+      "A signer is required unless every chain is watch-only: pass `signer` to Simplex.start (privateKeySigner, secretPhraseSigner, turnkeySigner, mpcVaultSigner, viemSigner, or your own Signer implementation). Running the binary? Configure it under [simplex.signer]."
     );
   }
   const chainClientManager = new ChainClientManager(configService, options.signer);
@@ -23772,7 +24059,8 @@ async function bootFiller(config, options) {
   const lifecycle = new LimitOrderLifecycle(
     limitOrderService,
     {
-      reconcileIntervalSecs: config.orderbook?.reconcileIntervalSecs ?? DEFAULT_RECONCILE_INTERVAL_SECS
+      reconcileIntervalSecs: config.orderbook?.reconcileIntervalSecs ?? DEFAULT_RECONCILE_INTERVAL_SECS,
+      reconcileTallies: () => intentFiller.reconcileLimitOrderTallies()
     },
     options.loggers
   );
@@ -23810,8 +24098,8 @@ async function bootFiller(config, options) {
   if (vaultVenue) {
     vaultVenue.onTx = ({ chain, kind, txHash, sponsored, movements }) => {
       const rows = movements.length > 0 ? movements.map((move) => {
-        const underlying = { token: move.symbol, amount: (0, import_viem30.formatUnits)(move.amount, move.decimals) };
-        const shares = move.shares === void 0 ? { token: null, amount: null } : { token: move.shareSymbol, amount: (0, import_viem30.formatUnits)(move.shares, move.shareDecimals) };
+        const underlying = { token: move.symbol, amount: (0, import_viem32.formatUnits)(move.amount, move.decimals) };
+        const shares = move.shares === void 0 ? { token: null, amount: null } : { token: move.shareSymbol, amount: (0, import_viem32.formatUnits)(move.shares, move.shareDecimals) };
         const out = kind === "sweep" ? underlying : shares;
         const back = kind === "sweep" ? shares : underlying;
         return { token: out.token, amount: out.amount, to: move.vault, tokenIn: back.token, amountIn: back.amount };
@@ -24243,6 +24531,14 @@ var MemoryLimitOrderStore = class {
     const remaining = BigInt(order.remaining) - BigInt(amount);
     return this.patch(id, { remaining: (remaining > 0n ? remaining : 0n).toString() });
   }
+  async clampRemaining(id, room) {
+    const order = this.orders.get(id);
+    if (!order || order.status !== "open") return null;
+    const sum = BigInt(room) + BigInt(order.reserved);
+    const target = sum > 0n ? sum : 0n;
+    if (target >= BigInt(order.remaining)) return null;
+    return this.patch(id, { remaining: target.toString() });
+  }
   async release(id, amount) {
     const order = this.orders.get(id);
     if (!order) return;
@@ -24751,7 +25047,8 @@ var OrderScanner = class _OrderScanner {
    * back from its own endpoints, which also proves they answer for one chain
    * before a filler ever depends on them.
    *
-   * @throws if an endpoint set is invalid or unreachable, if two entries resolve
+   * @throws if an endpoint set is invalid, if none of a chain's endpoints answer,
+   *   if its endpoints disagree on the chain, if two entries resolve
    *   to the same chain, or if `scanIntervalSecs` is below the minimum.
    */
   static async create(options) {
@@ -24811,7 +25108,10 @@ var OrderScanner = class _OrderScanner {
   async addChainNow(chain) {
     if (this.closed) throw new Error("This OrderScanner is closed");
     const rpcUrls = validateRpcUrls(chain.rpcUrls);
-    const chainId = chain.chainId ?? await fetchChainId(rpcUrls[0]);
+    const chainId = chain.chainId ?? (await resolveChainConfigs([{ rpcUrls, bundlerUrl: chain.bundlerUrl ?? "" }], {
+      loggers: this.loggers,
+      tolerateUnreachable: true
+    }))[0].chainId;
     if (this.closed) throw new Error("This OrderScanner is closed");
     if (this.scanners.has(chainId)) {
       throw new Error(`Chain ${chainId} is already in this scanner`);
@@ -24911,7 +25211,7 @@ var LimitOrderController = class {
   get service() {
     const service = this.runtime.limitOrders;
     if (!service) {
-      throw new Error("No orderbook is configured \u2014 set [orderbook] enabled and url to use limit orders");
+      throw new Error("No orderbook is configured \u2014 set [orderbook] url to use limit orders");
     }
     return service;
   }
@@ -25376,7 +25676,7 @@ var Simplex = class _Simplex extends import_node_events3.EventEmitter {
     const tomlSigner = options.config.simplex?.signer;
     if (tomlSigner && !options.signer) {
       throw new Error(
-        "config.simplex.signer describes a signer but none was passed. Simplex.start takes a Signer instance: `signer: await createSigner(config.simplex.signer)`, or build one directly with privateKeySigner/turnkeySigner/mpcVaultSigner/viemSigner."
+        "config.simplex.signer describes a signer but none was passed. Simplex.start takes a Signer instance: `signer: await createSigner(config.simplex.signer)`, or build one directly with privateKeySigner/secretPhraseSigner/turnkeySigner/mpcVaultSigner/viemSigner."
       );
     }
     const loggers = new LoggerContext({
@@ -25580,6 +25880,8 @@ var Simplex = class _Simplex extends import_node_events3.EventEmitter {
 0 && (module.exports = {
   AssetController,
   ChainController,
+  LimitOrderController,
+  LimitOrderValidationError,
   LoggerContext,
   MemoryDataStore,
   OrderScanner,
@@ -25592,6 +25894,7 @@ var Simplex = class _Simplex extends import_node_events3.EventEmitter {
   WalletController,
   addLogSink,
   assertConfirmationCoverage,
+  canDerive,
   configureLogger,
   createSigner,
   digestSigner,
@@ -25604,10 +25907,12 @@ var Simplex = class _Simplex extends import_node_events3.EventEmitter {
   pickAnchorStable,
   privateKeySigner,
   registrySymbols,
+  secretPhraseSigner,
   turnkeySigner,
   validateAssetDefinitions,
   validateConfig,
   validatePairConfigs,
+  validateSecretPhrase,
   validateSignerConfig,
   validateVaultToml,
   viemSigner