@hyperbridge/simplex 0.16.8 → 0.16.11

package/dist/index.js

@@ -2781,11 +2781,21 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { getChainId, MAX_DECLARED_ENTRIES } from "@hyperbridge/sdk";
 
 // src/orderbook/amounts.ts
+import { keccak256, stringToBytes } from "viem";
 var ORDERBOOK_SCALE = 10n ** 18n;
 function toRaw(amount, decimals) {
   const shift = 18 - decimals;
   return shift >= 0 ? amount / 10n ** BigInt(shift) : amount * 10n ** BigInt(-shift);
 }
+function budgetIdFor(limitOrderId) {
+  return keccak256(stringToBytes(limitOrderId));
+}
+function budgetFor(order, token, decimals) {
+  return { budgetId: budgetIdFor(order.id), cap: toRaw(BigInt(order.size), decimals), token };
+}
+function budgetRoom(budget, spent, decimals) {
+  return spent >= budget.cap ? 0n : toScaled(budget.cap - spent, decimals);
+}
 function fromHuman(amount) {
   const text = amount.trim();
   if (!/^[0-9]+(\.[0-9]+)?$/.test(text)) {
@@ -2806,6 +2816,10 @@ function toScaled(amount, decimals) {
   const shift = 18 - decimals;
   return shift >= 0 ? amount * 10n ** BigInt(shift) : amount / 10n ** BigInt(-shift);
 }
+function toScaledUp(amount, decimals) {
+  const shift = 18 - decimals;
+  return shift >= 0 ? amount * 10n ** BigInt(shift) : divCeil(amount, 10n ** BigInt(-shift));
+}
 function divCeil(numerator, denominator) {
   return (numerator + denominator - 1n) / denominator;
 }
@@ -2847,6 +2861,87 @@ function inputFor(params) {
   return divCeil(scaled, unit) * unit;
 }
 
+// src/orderbook/matching.ts
+function limitOrderLegs(order) {
+  return order.side === "BID" ? { input: order.base, output: order.quote } : { input: order.quote, output: order.base };
+}
+function matchLimitOrders(orders, incoming, resolve, now = /* @__PURE__ */ new Date()) {
+  const qualifying = orders.filter((order) => serves(order, incoming, resolve, now)).map((order) => {
+    const offer = offerFor({
+      side: order.side,
+      inputAmount: incoming.inputNet,
+      price: BigInt(order.price),
+      outputDecimals: incoming.outputDecimals
+    });
+    const available = BigInt(order.remaining);
+    return { order, offer, available, payout: offer < available ? offer : available };
+  }).filter((candidate) => candidate.offer >= incoming.requestedOutput && candidate.payout > 0n).sort(byBestOfferFirst);
+  return qualifying;
+}
+function byBestOfferFirst(a, b) {
+  if (a.offer !== b.offer) return a.offer > b.offer ? -1 : 1;
+  if (a.available !== b.available) return a.available > b.available ? -1 : 1;
+  return a.order.id < b.order.id ? -1 : 1;
+}
+function whyUnmatched(orders, incoming, resolve, now = /* @__PURE__ */ new Date()) {
+  let furthest = -1;
+  for (const order of orders) {
+    const failed = firstFailed(order, incoming, resolve, now);
+    furthest = Math.max(furthest, failed === null ? CHECKS.length : CHECKS.indexOf(failed));
+  }
+  const { source, destination, inputSymbol } = incoming;
+  if (furthest < CHECKS.length) {
+    switch (CHECKS[Math.max(furthest, 0)]) {
+      case "open":
+        return "no limit order is open";
+      case "chain":
+        return `no open limit order fills on ${destination}`;
+      case "input":
+        return `no limit order on ${destination} takes ${inputSymbol} in`;
+      case "output":
+        return `no limit order on ${destination} taking ${inputSymbol} in pays out the token this order asks for`;
+      case "source":
+        return `no limit order for this pair on ${destination} accepts swaps from ${source}`;
+    }
+  }
+  const priced = orders.filter((order) => firstFailed(order, incoming, resolve, now) === null).map((order) => ({
+    order,
+    offer: offerFor({
+      side: order.side,
+      inputAmount: incoming.inputNet,
+      price: BigInt(order.price),
+      outputDecimals: incoming.outputDecimals
+    })
+  }));
+  if (priced.some(({ offer }) => offer >= incoming.requestedOutput)) {
+    return "the limit orders that meet its rate have nothing left to pay out";
+  }
+  const best = priced.reduce((a, b) => b.offer > a.offer ? b : a);
+  const symbol = limitOrderLegs(best.order).output;
+  return `it asks for ${readable(incoming.requestedOutput)} ${symbol}; the best limit order offers ${readable(best.offer)} ${symbol}`;
+}
+var CHECKS = ["open", "chain", "input", "output", "source"];
+function serves(order, incoming, resolve, now) {
+  return firstFailed(order, incoming, resolve, now) === null;
+}
+function firstFailed(order, incoming, resolve, now) {
+  if (order.status !== "open") return "open";
+  if (order.expiresAt !== null && new Date(order.expiresAt) <= now) return "open";
+  if (order.fillChain !== incoming.destination) return "chain";
+  const legs = limitOrderLegs(order);
+  if (normalizeSymbol(legs.input) !== normalizeSymbol(incoming.inputSymbol)) return "input";
+  const outputToken = resolve(legs.output, order.fillChain);
+  if (!outputToken || outputToken.toLowerCase() !== incoming.outputToken.toLowerCase()) return "output";
+  if (incoming.source === incoming.destination) return null;
+  return order.acceptedSources.includes(incoming.source) ? null : "source";
+}
+function readable(amount) {
+  const [whole, fraction] = toHuman(amount).split(".");
+  const grouped = whole.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+  const cut = fraction?.slice(0, 6).replace(/0+$/, "");
+  return cut ? `${grouped}.${cut}` : grouped;
+}
+
 // src/orderbook/limit-orders.ts
 var LIMITS_TTL_MS = 5 * 60 * 1e3;
 var POSTABLE = ["open", "resizing"];
@@ -3361,6 +3456,58 @@ var LimitOrderService = class {
     }
     return report;
   }
+  /**
+   * Lowers every open order's `remaining` to what the solver's account will still
+   * pay for it, and puts the order back on the book at that size.
+   *
+   * The account tallies each order's payouts on the fill chain and refuses a fill
+   * that would take the tally past the order's size. A fill that never settled
+   * here, or a store restored from an older copy, leaves `remaining` above that
+   * room and the order posted at a size the account will refuse. A tally behind
+   * the store changes nothing: `remaining` is never raised.
+   *
+   * Answers how many orders were lowered.
+   */
+  async reconcileTallies() {
+    let lowered = 0;
+    for (const order of await this.store.list({ status: "open" })) {
+      try {
+        const clamped = await this.clampToTally(order);
+        if (!clamped) continue;
+        lowered++;
+        await this.resize(clamped, BigInt(order.remaining) - BigInt(clamped.remaining));
+      } catch (err) {
+        this.logger.error({ id: order.id, err }, "Could not bring the limit order in line with its on-chain tally");
+      }
+    }
+    return lowered;
+  }
+  /** The order as the store now holds it when its tally lowered it, null when it was left alone. */
+  async clampToTally(order) {
+    const token = this.assetRegistry.getAddress(limitOrderLegs(order).output, order.fillChain);
+    if (!token) return null;
+    const decimals = await this.contractService.getTokenDecimals(token, order.fillChain);
+    const budget = budgetFor(order, token, decimals);
+    const spent = await this.contractService.limitOrderSpent(order.fillChain, budget.budgetId);
+    if (spent === null) return null;
+    const room = budgetRoom(budget, spent, decimals);
+    const over = BigInt(order.remaining) - (room + BigInt(order.reserved));
+    if (over < toScaled(1n, decimals)) return null;
+    const clamped = await this.store.clampRemaining(order.id, room.toString());
+    if (!clamped) return null;
+    this.logger.warn(
+      {
+        id: order.id,
+        before: order.remaining,
+        after: clamped.remaining,
+        spent: spent.toString(),
+        cap: budget.cap.toString(),
+        reserved: clamped.reserved
+      },
+      "Limit order had more left than its on-chain tally allows; lowering it"
+    );
+    return clamped;
+  }
   /**
    * Withdraws every order that has outlived the operator's own `expiresAt`.
    *
@@ -3622,7 +3769,7 @@ async function patchRuntimeState(store, patch) {
 }
 
 // src/services/wallet/mpcvault.ts
-import { concatHex, keccak256, padHex, toHex } from "viem";
+import { concatHex, keccak256 as keccak2562, padHex, toHex } from "viem";
 import * as grpc from "@grpc/grpc-js";
 
 // src/proto/mpcvault/platform/v1/api.ts
@@ -12235,7 +12382,7 @@ var MpcVaultService = class {
     const messageBytes = Buffer.from(messageHash.slice(2), "hex");
     const prefix = Buffer.from(`Ethereum Signed Message:
 ${messageBytes.length}`);
-    const ethSignedMessageHash = keccak256(concatHex([toHex(prefix), messageHash]));
+    const ethSignedMessageHash = keccak2562(concatHex([toHex(prefix), messageHash]));
     const ethSignedBytes = Buffer.from(ethSignedMessageHash.slice(2), "hex");
     const uuid = await this.createSigningRequest({
       vaultUuid: this.vaultUuid,
@@ -12323,11 +12470,12 @@ var SignerType = /* @__PURE__ */ ((SignerType2) => {
   SignerType2["PrivateKey"] = "privateKey";
   SignerType2["MpcVault"] = "mpcVault";
   SignerType2["Turnkey"] = "turnkey";
+  SignerType2["SecretPhrase"] = "secretPhrase";
   return SignerType2;
 })(SignerType || {});
 
 // src/services/wallet/accounts/mpc.ts
-import { keccak256 as keccak2562, serializeTransaction } from "viem";
+import { keccak256 as keccak2563, serializeTransaction } from "viem";
 import { hashAuthorization } from "viem/utils";
 function mpcVaultSigner(config) {
   const service = new MpcVaultService({
@@ -12362,7 +12510,7 @@ function mpcVaultSigner(config) {
       if (tx.authorizationList?.length) {
         const serializable = { ...tx, type: "eip7702" };
         const signature = await service.signRawHashComponents(
-          keccak2562(serializeTransaction(serializable))
+          keccak2563(serializeTransaction(serializable))
         );
         return serializeTransaction(serializable, signature);
       }
@@ -12444,6 +12592,51 @@ function privateKeySigner(privateKey) {
   return viemSigner(privateKeyToAccount(privateKey));
 }
 
+// src/services/wallet/accounts/secretphrase.ts
+import { validateMnemonic } from "@scure/bip39";
+import { english, mnemonicToAccount } from "viem/accounts";
+var WORD_COUNTS = [12, 15, 18, 21, 24];
+var MAX_DERIVATION_INDEX = 2 ** 31 - 1;
+function normaliseSecretPhrase(phrase) {
+  return phrase.trim().split(/\s+/).join(" ").toLowerCase();
+}
+function validateSecretPhrase(phrase) {
+  if (typeof phrase !== "string") throw new Error("Secret phrase must be a string");
+  const normalised = normaliseSecretPhrase(phrase);
+  const words = normalised === "" ? [] : normalised.split(" ");
+  if (!WORD_COUNTS.includes(words.length)) {
+    throw new Error(`Secret phrase must have ${WORD_COUNTS.join(", ")} words; got ${words.length}`);
+  }
+  if (words.some((word) => !english.includes(word))) {
+    throw new Error("Secret phrase contains a word that is not in the BIP-39 English wordlist");
+  }
+  if (!validateMnemonic(normalised, english)) {
+    throw new Error("Secret phrase checksum does not match; check the words and their order");
+  }
+}
+function assertDerivationIndex(index, name = "Derivation index") {
+  const expected = `${name} must be an integer between 0 and ${MAX_DERIVATION_INDEX}`;
+  if (typeof index !== "number") throw new Error(expected);
+  if (!Number.isInteger(index) || index < 0 || index > MAX_DERIVATION_INDEX) {
+    throw new Error(`${expected}; got ${index}`);
+  }
+}
+function secretPhraseSigner(config) {
+  validateSecretPhrase(config.phrase);
+  const phrase = normaliseSecretPhrase(config.phrase);
+  const accountIndex = config.accountIndex ?? 0;
+  assertDerivationIndex(accountIndex, "accountIndex");
+  const derive = (index) => {
+    assertDerivationIndex(index);
+    return { ...viemSigner(mnemonicToAccount(phrase, { addressIndex: index })), mode: "secretPhrase" };
+  };
+  return { ...derive(accountIndex), accountIndex, derive };
+}
+function canDerive(signer) {
+  const candidate = signer;
+  return typeof candidate.derive === "function" && typeof candidate.accountIndex === "number";
+}
+
 // src/services/wallet/accounts/turnkey.ts
 import { Turnkey } from "@turnkey/sdk-server";
 import { createAccount } from "@turnkey/viem";
@@ -12467,6 +12660,7 @@ async function createSigner(config) {
   if (config.type === "privateKey" /* PrivateKey */) return privateKeySigner(config.key);
   if (config.type === "mpcVault" /* MpcVault */) return mpcVaultSigner(config);
   if (config.type === "turnkey" /* Turnkey */) return turnkeySigner(config);
+  if (config.type === "secretPhrase" /* SecretPhrase */) return secretPhraseSigner(config);
   throw new Error(`Unsupported signer mode: ${config.type ?? "unknown"}`);
 }
 function validateSignerConfig(config) {
@@ -12492,13 +12686,21 @@ function validateSignerConfig(config) {
     if (!config.signWith) throw new Error("simplex.signer.signWith is required");
     return;
   }
+  if (config.type === "secretPhrase" /* SecretPhrase */) {
+    if (!config.phrase) {
+      throw new Error("simplex.signer.phrase is required when simplex.signer.type=secretPhrase");
+    }
+    validateSecretPhrase(config.phrase);
+    if (config.accountIndex !== void 0) assertDerivationIndex(config.accountIndex, "simplex.signer.accountIndex");
+    return;
+  }
   throw new Error(`Unsupported signer mode: ${config.type ?? "unknown"}`);
 }
 
 // src/services/wallet/account.ts
 import {
   hashTypedData,
-  keccak256 as keccak2563,
+  keccak256 as keccak2564,
   serializeSignature,
   serializeTransaction as serializeTransaction2
 } from "viem";
@@ -12555,7 +12757,7 @@ function digestSigner(opts) {
     ),
     signTransaction: async (tx) => {
       const serializable = tx;
-      const signature = await sign(keccak2563(serializeTransaction2(serializable)));
+      const signature = await sign(keccak2564(serializeTransaction2(serializable)));
       return serializeTransaction2(serializable, signature);
     }
   };
@@ -12585,6 +12787,12 @@ async function deriveSubstrateKeyPair(key) {
 }
 
 // src/services/CacheService.ts
+function budgetToCache(budget) {
+  return { budgetId: budget.budgetId, cap: budget.cap.toString(), token: budget.token };
+}
+function budgetFromCache(budget) {
+  return { budgetId: budget.budgetId, cap: BigInt(budget.cap), token: budget.token };
+}
 var CacheService = class {
   constructor(loggers = defaultLoggerContext()) {
     this.CACHE_EXPIRY_MS = 1 * 60 * 1e3;
@@ -12742,7 +12950,24 @@ var CacheService = class {
       return null;
     }
   }
-  setFillerOutputs(orderId, outputs, inputs = []) {
+  /**
+   * The budget of the limit order that priced the outputs cached for this order, or
+   * null when no limit order did.
+   *
+   * Kept on the same entry as the outputs, so the two are replaced and expire
+   * together: a bid can never sign one limit order's payout beside another's budget.
+   */
+  getBidBudget(orderId) {
+    try {
+      const cache = this.cacheData.fillerOutputs[orderId];
+      if (cache?.budget && this.isCacheValid(cache.timestamp)) return budgetFromCache(cache.budget);
+      return null;
+    } catch (error) {
+      this.logger.error({ err: error }, "Error getting bid budget");
+      return null;
+    }
+  }
+  setFillerOutputs(orderId, outputs, inputs = [], budget) {
     try {
       this.cleanupStaleData();
       this.cacheData.fillerOutputs[orderId] = {
@@ -12754,6 +12979,7 @@ var CacheService = class {
           token: o.token,
           amount: o.amount.toString()
         })),
+        ...budget ? { budget: budgetToCache(budget) } : {},
         timestamp: Date.now()
       };
     } catch (error) {
@@ -12799,7 +13025,8 @@ var CacheService = class {
           data: call.data
         })),
         partialFill: plan.partialFill,
-        profit: plan.profit
+        profit: plan.profit,
+        ...plan.budget ? { budget: budgetFromCache(plan.budget) } : {}
       }));
     } catch (error) {
       this.logger.error({ err: error }, "Error getting bid plans");
@@ -12828,7 +13055,8 @@ var CacheService = class {
             data: call.data
           })),
           partialFill: plan.partialFill,
-          profit: plan.profit
+          profit: plan.profit,
+          ...plan.budget ? { budget: budgetToCache(plan.budget) } : {}
         })),
         timestamp: Date.now()
       };
@@ -13661,6 +13889,44 @@ import {
   bytes20ToBytes32
 } from "@hyperbridge/sdk";
 
+// src/config/abis/SolverAccount.ts
+var SOLVER_ACCOUNT_ABI = [
+  {
+    inputs: [
+      { name: "orderId", type: "bytes32" },
+      { name: "cap", type: "uint256" },
+      { name: "token", type: "address" },
+      { name: "approved", type: "uint256" },
+      { name: "fee", type: "uint256" }
+    ],
+    name: "debitOrder",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    inputs: [{ name: "orderId", type: "bytes32" }],
+    name: "spent",
+    outputs: [{ name: "", type: "uint256" }],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [{ name: "sender", type: "address" }],
+    name: "AccountUnauthorized",
+    type: "error"
+  },
+  {
+    inputs: [
+      { name: "orderId", type: "bytes32" },
+      { name: "total", type: "uint256" },
+      { name: "cap", type: "uint256" }
+    ],
+    name: "LimitOrderExceeded",
+    type: "error"
+  }
+];
+
 // src/config/abis/EvmHost.ts
 var EVM_HOST = [
   {
@@ -18054,6 +18320,10 @@ function describeShortfall(balances) {
 // src/services/ContractInteractionService.ts
 Decimal2.config({ precision: 28, rounding: 4 });
 var FUNDING_GAS_PER_CALL = 400000n;
+var DEBIT_ORDER_GAS = 60000n;
+function settles(budget) {
+  return !!budget && budget.token.toLowerCase() !== ADDRESS_ZERO;
+}
 var LIMIT_ORDER_CALL_GAS_LIMIT = 500000n;
 var LIMIT_ORDER_VERIFICATION_GAS_LIMIT = 150000n;
 var LIMIT_ORDER_PRE_VERIFICATION_GAS = 50000n;
@@ -18243,17 +18513,19 @@ var ContractInteractionService = class {
   }
   /**
    * The call gas a bid needs: the shared estimate plus room for the funding calls
-   * this bid prepends.
+   * this bid prepends and for settling its limit order's budget.
    *
    * Funding calls are not simulated (the V4 PositionManager's flash accounting does
    * not resolve in the bundler's estimation context), so each one adds a fixed
    * allowance for its modifyLiquidities + take. They differ between the bids on one
    * order, since each draws on its own limit order and so on its own funding, which
    * is why this is worked out per bid rather than baked into the cached estimate.
+   * The estimate is of a lone fillOrder, so the budget call is not in it either.
    */
-  callGasLimitFor(order, baseCallGasLimit) {
+  callGasLimitFor(order, baseCallGasLimit, budget) {
     const funding = order.id ? this.cacheService.getFundingPrepends(order.id) : null;
-    return baseCallGasLimit + FUNDING_GAS_PER_CALL * BigInt(funding?.calls?.length ?? 0);
+    const fundingGas = FUNDING_GAS_PER_CALL * BigInt(funding?.calls?.length ?? 0);
+    return baseCallGasLimit + fundingGas + (settles(budget) ? DEBIT_ORDER_GAS : 0n);
   }
   /**
    * Gets the fee token address and decimals for a given chain.
@@ -18435,6 +18707,27 @@ var ContractInteractionService = class {
       { maxRetries: 3, backoffMs: 250, logMessage: "Failed to read token balance" }
     );
   }
+  /**
+   * What the solver's account has tallied against a limit order's budget on `chain`, in
+   * the paid token's own units, or null when it cannot be read.
+   *
+   * Null rather than a throw: an account whose implementation keeps no tally answers
+   * with a revert or with no data, and the caller carries on without the figure either
+   * way. Not retried, since that answer does not change on a second ask.
+   */
+  async limitOrderSpent(chain, budgetId) {
+    try {
+      return await this.clientManager.getPublicClient(chain).readContract({
+        address: this.solverAccountAddress,
+        abi: SOLVER_ACCOUNT_ABI,
+        functionName: "spent",
+        args: [budgetId]
+      });
+    } catch (err) {
+      this.logger.warn({ err, chain, budgetId }, "Could not read the limit order's tally from the solver account");
+      return null;
+    }
+  }
   async getSolverEntryPointBalance(chain) {
     const entryPointAddress = this.configService.getEntryPointAddress(chain);
     if (!entryPointAddress) {
@@ -18575,7 +18868,8 @@ var ContractInteractionService = class {
     if (!cachedEstimate) {
       throw new Error(`No cached gas estimate found for order ${order.id}. Call estimateGasFillPost first.`);
     }
-    const callGasLimit = this.callGasLimitFor(order, cachedEstimate.callGasLimit);
+    const budget = this.cacheService.getBidBudget(order.id);
+    const callGasLimit = this.callGasLimitFor(order, cachedEstimate.callGasLimit, budget);
     const cachedFillerOutputs = this.cacheService.getFillerOutputs(order.id);
     const cachedFillerInputs = this.cacheService.getFillerInputs(order.id);
     if (!cachedFillerOutputs || !cachedFillerInputs) {
@@ -18602,7 +18896,8 @@ var ContractInteractionService = class {
       order,
       cachedFillerOutputs,
       fillOptions,
-      cachedEstimate.totalCostInSourceFeeToken + dispatchFeeTokenAmount
+      cachedEstimate.totalCostInSourceFeeToken + dispatchFeeTokenAmount,
+      budget ? { budget, solverAccount: solverAccountAddress } : void 0
     );
     const commitment = orderCommitment2(order);
     const nonce = await this.clientManager.getPublicClient(order.destination).readContract({
@@ -18794,8 +19089,13 @@ var ContractInteractionService = class {
    * Same-chain fills release escrow locally with no Hyperbridge dispatch, so the
    * gateway never pulls the fee token — its approval is skipped. Only cross-chain
    * fills, which dispatch a RedeemEscrow message paid in the fee token, need it.
+   *
+   * A bid priced by a limit order ends with `debitOrder`, which takes the budget's id
+   * as its `orderId`, works out what the fill paid from what is left of the allowance
+   * and reverts the whole batch if the order's payouts would pass its size. It has to
+   * come last, after the gateway has drawn on the allowance.
    */
-  async buildApprovalAndFillCalldata(order, fillerOutputs, fillOptions, requiredFeeTokenAmount) {
+  async buildApprovalAndFillCalldata(order, fillerOutputs, fillOptions, requiredFeeTokenAmount, settlement) {
     const chain = order.destination;
     const intentGatewayV2Address = this.configService.getIntentGatewayAddress(chain);
     const perTokenRequired = /* @__PURE__ */ new Map();
@@ -18805,9 +19105,10 @@ var ContractInteractionService = class {
       const key = addr.toLowerCase();
       perTokenRequired.set(key, (perTokenRequired.get(key) ?? 0n) + output.amount);
     }
+    let feeKey;
     if (order.source !== order.destination) {
       const feeToken = await this.getFeeTokenWithDecimals(chain);
-      const feeKey = feeToken.address.toLowerCase();
+      feeKey = feeToken.address.toLowerCase();
       perTokenRequired.set(feeKey, (perTokenRequired.get(feeKey) ?? 0n) + requiredFeeTokenAmount);
     }
     const fundingPrepends = order.id ? this.cacheService.getFundingPrepends(order.id) : null;
@@ -18833,6 +19134,26 @@ var ContractInteractionService = class {
       value: nativeOutputValue,
       data: encodeFillOrder(transformOrderForContract(order), fillOptions)
     });
+    if (settlement && settles(settlement.budget)) {
+      const { budget, solverAccount } = settlement;
+      const budgetToken = budget.token.toLowerCase();
+      const approved = perTokenRequired.get(budgetToken) ?? 0n;
+      if (approved === 0n) {
+        throw new Error(
+          `Bid on order ${order.id} approves nothing in ${budget.token}, the token budget ${budget.budgetId} is measured in`
+        );
+      }
+      const fee = feeKey === budgetToken ? fillOptions.relayerFee : 0n;
+      calls.push({
+        target: solverAccount,
+        value: 0n,
+        data: encodeFunctionData2({
+          abi: SOLVER_ACCOUNT_ABI,
+          functionName: "debitOrder",
+          args: [budget.budgetId, budget.cap, budgetToken, approved, fee]
+        })
+      });
+    }
     return encodeERC7821ExecuteBatch2(calls);
   }
 };
@@ -20685,11 +21006,11 @@ function byBestRate(a, b) {
   return left === right ? 0 : left > right ? -1 : 1;
 }
 function chargedFor(hold, delivered, released) {
-  if (hold.take === void 0 || released === 0n) return delivered;
-  const take = BigInt(hold.take);
-  if (take === 0n) return delivered;
-  const atRate = (BigInt(hold.amount) * released + take - 1n) / take;
-  return atRate > delivered ? atRate : delivered;
+  const take = hold.take === void 0 ? 0n : BigInt(hold.take);
+  if (take === 0n || released === 0n) return toScaledUp(delivered.raw, delivered.decimals);
+  const offered = toRaw(BigInt(hold.amount), delivered.decimals);
+  const atRate = (offered * released + take - 1n) / take;
+  return toScaledUp(atRate > delivered.raw ? atRate : delivered.raw, delivered.decimals);
 }
 var IntentFiller = class {
   constructor(chainConfigs, strategies, config, configService, chainClientManager, contractService, signer, scanners, rebalancingService, bidStorage, limitOrders, assetRegistry) {
@@ -20766,6 +21087,17 @@ var IntentFiller = class {
   setLimitOrderService(service) {
     this.limitOrderService = service;
   }
+  /**
+   * Brings the limit orders' `remaining` in line with their on-chain tallies.
+   *
+   * On the settlement queue, so the pass and a fill never resize the same order at
+   * once. Resolves when the pass has run.
+   */
+  async reconcileLimitOrderTallies() {
+    await this.settlementQueue.add(async () => {
+      await this.limitOrderService?.reconcileTallies();
+    });
+  }
   /** Whether the given chain id is configured for watch-only (monitor, never fill). */
   isChainWatchOnly(chainId) {
     const watchOnly = this.config.watchOnly;
@@ -21411,7 +21743,7 @@ var IntentFiller = class {
         let reservation = [];
         if (plan) {
           if (order.id) {
-            cache.setFillerOutputs(order.id, plan.fillerOutputs, plan.fillerInputs);
+            cache.setFillerOutputs(order.id, plan.fillerOutputs, plan.fillerInputs, plan.budget);
             cache.setPartialFill(order.id, plan.partialFill);
             if (plan.fundingCalls.length > 0) cache.setFundingPrepends(order.id, plan.fundingCalls);
             else cache.clearFundingPrepends(order.id);
@@ -21612,7 +21944,7 @@ var IntentFiller = class {
       await this.releaseAll(claimed);
       return;
     }
-    const settled = executedHold(claimed, delivered, released);
+    const settled = executedHold(claimed, delivered.scaled, released);
     const charged = chargedFor(settled, delivered, released);
     const settledBid = rows.find(
       (row) => row.reservations.some(
@@ -21665,15 +21997,15 @@ var IntentFiller = class {
     if (delivered === null) return [];
     const settled = executedHold(
       holds.map((entry) => entry.hold),
-      delivered,
+      delivered.scaled,
       released
     );
     const row = holds.find((entry) => entry.hold === settled).row;
     return this.bidStorage.claimReservation(commitment, row.bid ?? void 0);
   }
   /**
-   * What this fill delivered of the token the limit order pays, at 1e18, or null
-   * when the fill names none of it.
+   * What this fill delivered of the token the limit order pays, or null when the
+   * fill names none of it.
    */
   async deliveredAgainst(limitOrderId, chainId, outputs) {
     const order = await this.limitOrders?.get(limitOrderId);
@@ -21689,7 +22021,7 @@ var IntentFiller = class {
     }
     if (total === 0n) return null;
     const decimals = await this.contractService.getTokenDecimals(address, chain);
-    return toScaled(total, decimals);
+    return { scaled: toScaled(total, decimals), raw: total, decimals };
   }
   /**
    * Gives back whatever this bid still holds against its limit order.
@@ -21785,87 +22117,6 @@ import {
 import { formatUnits as formatUnits4 } from "viem";
 import { Decimal as Decimal6 } from "decimal.js";
 
-// src/orderbook/matching.ts
-function limitOrderLegs(order) {
-  return order.side === "BID" ? { input: order.base, output: order.quote } : { input: order.quote, output: order.base };
-}
-function matchLimitOrders(orders, incoming, resolve, now = /* @__PURE__ */ new Date()) {
-  const qualifying = orders.filter((order) => serves(order, incoming, resolve, now)).map((order) => {
-    const offer = offerFor({
-      side: order.side,
-      inputAmount: incoming.inputNet,
-      price: BigInt(order.price),
-      outputDecimals: incoming.outputDecimals
-    });
-    const available = BigInt(order.remaining);
-    return { order, offer, available, payout: offer < available ? offer : available };
-  }).filter((candidate) => candidate.offer >= incoming.requestedOutput && candidate.payout > 0n).sort(byBestOfferFirst);
-  return qualifying;
-}
-function byBestOfferFirst(a, b) {
-  if (a.offer !== b.offer) return a.offer > b.offer ? -1 : 1;
-  if (a.available !== b.available) return a.available > b.available ? -1 : 1;
-  return a.order.id < b.order.id ? -1 : 1;
-}
-function whyUnmatched(orders, incoming, resolve, now = /* @__PURE__ */ new Date()) {
-  let furthest = -1;
-  for (const order of orders) {
-    const failed = firstFailed(order, incoming, resolve, now);
-    furthest = Math.max(furthest, failed === null ? CHECKS.length : CHECKS.indexOf(failed));
-  }
-  const { source, destination, inputSymbol } = incoming;
-  if (furthest < CHECKS.length) {
-    switch (CHECKS[Math.max(furthest, 0)]) {
-      case "open":
-        return "no limit order is open";
-      case "chain":
-        return `no open limit order fills on ${destination}`;
-      case "input":
-        return `no limit order on ${destination} takes ${inputSymbol} in`;
-      case "output":
-        return `no limit order on ${destination} taking ${inputSymbol} in pays out the token this order asks for`;
-      case "source":
-        return `no limit order for this pair on ${destination} accepts swaps from ${source}`;
-    }
-  }
-  const priced = orders.filter((order) => firstFailed(order, incoming, resolve, now) === null).map((order) => ({
-    order,
-    offer: offerFor({
-      side: order.side,
-      inputAmount: incoming.inputNet,
-      price: BigInt(order.price),
-      outputDecimals: incoming.outputDecimals
-    })
-  }));
-  if (priced.some(({ offer }) => offer >= incoming.requestedOutput)) {
-    return "the limit orders that meet its rate have nothing left to pay out";
-  }
-  const best = priced.reduce((a, b) => b.offer > a.offer ? b : a);
-  const symbol = limitOrderLegs(best.order).output;
-  return `it asks for ${readable(incoming.requestedOutput)} ${symbol}; the best limit order offers ${readable(best.offer)} ${symbol}`;
-}
-var CHECKS = ["open", "chain", "input", "output", "source"];
-function serves(order, incoming, resolve, now) {
-  return firstFailed(order, incoming, resolve, now) === null;
-}
-function firstFailed(order, incoming, resolve, now) {
-  if (order.status !== "open") return "open";
-  if (order.expiresAt !== null && new Date(order.expiresAt) <= now) return "open";
-  if (order.fillChain !== incoming.destination) return "chain";
-  const legs = limitOrderLegs(order);
-  if (normalizeSymbol(legs.input) !== normalizeSymbol(incoming.inputSymbol)) return "input";
-  const outputToken = resolve(legs.output, order.fillChain);
-  if (!outputToken || outputToken.toLowerCase() !== incoming.outputToken.toLowerCase()) return "output";
-  if (incoming.source === incoming.destination) return null;
-  return order.acceptedSources.includes(incoming.source) ? null : "source";
-}
-function readable(amount) {
-  const [whole, fraction] = toHuman(amount).split(".");
-  const grouped = whole.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
-  const cut = fraction?.slice(0, 6).replace(/0+$/, "");
-  return cut ? `${grouped}.${cut}` : grouped;
-}
-
 // src/orderbook/usd.ts
 import { Decimal as Decimal5 } from "decimal.js";
 function limitOrderUsdEdges(orders) {
@@ -21920,9 +22171,13 @@ var FXFiller = class _FXFiller {
    */
   constructor(signer, configService, clientManager, contractService, pairs, registry, options) {
     this.name = "FXFiller";
-    /** Consecutive orders where overfill clamp activated. */
+    /**
+     * Consecutive orders where the overfill clamp activated. Dormant: the clamp
+     * existed for venue-priced legs, which went with Uniswap V4 pricing, so every
+     * outcome is now recorded unclamped and this never climbs. See `recordOrderOutcome`.
+     */
     this.consecutiveClamps = 0;
-    /** Once set, the filler refuses all orders until restart — systemic pricing error suspected. */
+    /** Once set, the filler refuses all orders until reset. Unreachable while the clamp is dormant. */
     this.halted = false;
     this.logger = moduleLogger(configService.loggers, "fx-simplex");
     const { confirmationPolicy, fundingVenues = [], limitOrders } = options ?? {};
@@ -21971,10 +22226,9 @@ var FXFiller = class _FXFiller {
     this.pairs.push(pair);
   }
   /**
-   * Removes a market from the running engine. All-or-nothing: at least one
-   * market must remain and no other pair may lose its USD anchor (removing a
-   * reference feed that anchors a dependent market is rejected). In-flight
-   * rechecks of orders on the removed pair simply stop matching.
+   * Removes a market from the running engine. At least one market must remain.
+   * Matching reads the limit orders rather than the pairs, so removing a market
+   * changes what the dashboard lists, not what the filler fills.
    */
   removePair(pair) {
     const index = this.pairs.indexOf(pair);
@@ -22030,22 +22284,20 @@ var FXFiller = class _FXFiller {
     }
   }
   /**
-   * Evaluates whether an order is profitable to fill under the per-pair
-   * `maxOrderSize` caps (where set) and the filler's current token balances.
+   * Evaluates whether an order is profitable to fill against the operator's
+   * limit orders and the filler's current token balances.
    *
    * High-level flow:
-   * - Resolve each (input, output) leg to a configured pair and direction.
-   * - Estimate each pair's total token0 notional in the order and cap it at
-   *   the pair's `maxOrderSize` when one is set; pair curves are evaluated at
-   *   that (possibly uncapped) notional.
-   * - Walk the legs, allocating from each pair's capped token0 budget and
-   *   pricing outputs at the pair's rate.
-   * - Further cap each leg by the filler's current token balance plus
-   *   funding-venue withdrawals.
-   * - Cache the resulting outputs for later use in `executeOrder`.
-   *
-   * Note: we may intentionally overfill relative to the user's requested
-   * outputs if the pair pricing makes that attractive. This is how we stay competitive.
+   * - Match each (input, output) leg against the open limit orders.
+   * - Build one bid per matching order, best offer first, each paying the
+   *   order's whole offer for the input at its own rate, capped by what the
+   *   order has left. The gateway credits the swapper the ask and splits
+   *   anything above it between the swapper and the protocol.
+   * - Treat a payout below the ask as a partial fill, which only orders
+   *   without output calldata and without an earlier partial fill allow.
+   * - Cap each payout by the filler's balance plus funding-venue withdrawals,
+   *   then gate it on fees (full fills) and the same-asset spread.
+   * - Cache the resulting bids for later use in `executeOrder`.
    */
   async calculateProfitability(order) {
     if (order.id) this.contractService.cacheService.clearPartialFill(order.id);
@@ -22063,6 +22315,7 @@ var FXFiller = class _FXFiller {
       const multiLeg = order.inputs.length > 1;
       const plans = [];
       const plannedOn = /* @__PURE__ */ new Map();
+      const spentOn = /* @__PURE__ */ new Map();
       for (let leg = 0; leg < order.inputs.length; leg++) {
         const input = order.inputs[leg];
         const output = order.output.assets[leg];
@@ -22084,7 +22337,30 @@ var FXFiller = class _FXFiller {
         for (const candidate of matches) {
           let partialFill = false;
           const fundingCalls = [];
-          const left = candidate.available - (plannedOn.get(candidate.order.id) ?? 0n);
+          const budget = budgetFor(candidate.order, outputToken, outputDecimals);
+          if (!spentOn.has(candidate.order.id)) {
+            spentOn.set(
+              candidate.order.id,
+              await this.contractService.limitOrderSpent(destChain, budget.budgetId)
+            );
+          }
+          const spent = spentOn.get(candidate.order.id) ?? null;
+          const room = spent === null ? candidate.available : budgetRoom(budget, spent, outputDecimals);
+          if (room === 0n) {
+            this.logger.info(
+              {
+                orderId: order.id,
+                leg,
+                limitOrder: candidate.order.id,
+                spent: spent?.toString(),
+                cap: budget.cap.toString()
+              },
+              "Skipping a bid: the limit order has nothing left on chain"
+            );
+            continue;
+          }
+          const available = room < candidate.available ? room : candidate.available;
+          const left = available - (plannedOn.get(candidate.order.id) ?? 0n);
           if (left <= 0n) {
             this.logger.info(
               { orderId: order.id, leg, limitOrder: candidate.order.id },
@@ -22119,10 +22395,7 @@ var FXFiller = class _FXFiller {
               {
                 orderId: order.id,
                 limitOrder: candidate.order.id,
-                available: formatUnits4(
-                  candidate.available,
-                  18
-                ),
+                available: formatUnits4(available, 18),
                 userRequested: output.amount.toString(),
                 payout: targetOutput.toString(),
                 crossChain: sourceChain !== destChain
@@ -22167,7 +22440,10 @@ var FXFiller = class _FXFiller {
             }
           }
           const effectiveBalance = walletContribution + credited;
-          const finalOutputAmount = effectiveBalance > targetOutput ? targetOutput : effectiveBalance;
+          const finalOutputAmount = toRaw(
+            toScaled(effectiveBalance > targetOutput ? targetOutput : effectiveBalance, outputDecimals),
+            outputDecimals
+          );
           if (finalOutputAmount === 0n) {
             this.logger.info(
               {
@@ -22343,7 +22619,8 @@ var FXFiller = class _FXFiller {
             fillerInputs,
             fundingCalls: [...fundingCalls],
             partialFill,
-            profit: totalProfit
+            profit: totalProfit,
+            budget
           });
           if (!partialEligibleCheap) break;
         }
@@ -22351,7 +22628,12 @@ var FXFiller = class _FXFiller {
       if (plans.length === 0) return 0;
       if (order.id) {
         this.contractService.cacheService.setBidPlans(order.id, plans);
-        this.contractService.cacheService.setFillerOutputs(order.id, plans[0].fillerOutputs, plans[0].fillerInputs);
+        this.contractService.cacheService.setFillerOutputs(
+          order.id,
+          plans[0].fillerOutputs,
+          plans[0].fillerInputs,
+          plans[0].budget
+        );
         this.contractService.cacheService.setPartialFill(order.id, plans[0].partialFill);
         this.contractService.cacheService.setMatchedLimitOrder(order.id, [
           { limitOrderId: plans[0].limitOrderId, payout: plans[0].payout }
@@ -22446,10 +22728,14 @@ var FXFiller = class _FXFiller {
   // =========================================================================
   /**
    * Update consecutive-clamp counter after a successful order evaluation.
-   * Only venue-priced legs feed this counter (see clamp site) — a streak of those
-   * is the signal that a live market source has gone off (stale pool, manipulated
-   * venue) and the filler should stop until an operator investigates. Offline
-   * price-curve clamps warn but never reach here.
+   *
+   * Dormant. Only venue-priced legs ever fed a clamped outcome here: a streak
+   * of those meant a live market source had gone off (stale pool, manipulated
+   * venue). Venue pricing went with Uniswap V4, and limit orders are prices the
+   * operator set, so the only caller records `false` and the filler never
+   * halts. `isHalted`, `resetHalt` and `[simplex.overfillProtection]
+   * maxConsecutiveClamps` are kept so existing configs and the halt API still
+   * load; they can go once nothing reads them.
    */
   recordOrderOutcome(clamped, orderId) {
     if (clamped) {
@@ -22475,18 +22761,6 @@ var FXFiller = class _FXFiller {
     this.consecutiveClamps = 0;
     this.logger.warn("FXFiller halt reset by operator \u2014 resuming order evaluation");
   }
-  /**
-   * Given a single (input, output) leg and the remaining token0 budget of its
-   * pair, computes how much token0 notional to allocate to this leg and the
-   * corresponding maximum output amount at the pair's rate.
-   *
-   * `rate` is **token1 per 1 token0**:
-   * - token0 input → token1 output: token0 × rate → token1 amount.
-   * - token1 input → token0 output: token1 ÷ rate → token0 amount.
-   *
-   * Returns `null` when this leg cannot consume any of the pair's remaining
-   * budget (e.g. the cap has already been exhausted).
-   */
   /**
    * Whether any solver has already delivered output against this order.
    *
@@ -22824,9 +23098,9 @@ var LimitOrderLifecycle = class {
     const reconcileMs = this.options.reconcileIntervalSecs * 1e3;
     this.every(heartbeatMs, "heartbeat", () => this.service.heartbeat());
     this.every(EXPIRY_SWEEP_MS, "expiry", () => this.expire());
-    this.every(reconcileMs, "reconciliation", () => this.reconcile());
+    this.every(reconcileMs, "reconciliation", () => this.upkeep());
     this.logger.info({ heartbeatMs, expiryMs: EXPIRY_SWEEP_MS, reconcileMs }, "Orderbook lifecycle started");
-    void this.run("reconciliation", () => this.reconcile());
+    void this.upkeep();
   }
   stop() {
     this.timers.forEach((timer) => clearInterval(timer));
@@ -22837,6 +23111,14 @@ var LimitOrderLifecycle = class {
     const expired = await this.service.expireStale();
     if (expired > 0) this.logger.info({ expired }, "Withdrew limit orders that had outlived their expiry");
   }
+  /**
+   * The tally pass first, so reconciliation against the orderbook reads the sizes
+   * it left. Each fails on its own.
+   */
+  async upkeep() {
+    await this.run("tally reconciliation", async () => this.options.reconcileTallies());
+    await this.run("reconciliation", () => this.reconcile());
+  }
   async reconcile() {
     const report = await this.service.reconcile();
     if (report.cancelled || report.reposted || report.underFunded) {
@@ -23637,7 +23919,7 @@ async function bootFiller(config, options) {
   const sharedCacheService = new CacheService(options.loggers);
   if (!options.signer && !globalWatchOnly && !allChainsWatchOnly(watchOnlyConfig, resolvedChains)) {
     throw new Error(
-      "A signer is required unless every chain is watch-only: pass `signer` to Simplex.start (privateKeySigner, turnkeySigner, mpcVaultSigner, viemSigner, or your own Signer implementation). Running the binary? Configure it under [simplex.signer]."
+      "A signer is required unless every chain is watch-only: pass `signer` to Simplex.start (privateKeySigner, secretPhraseSigner, turnkeySigner, mpcVaultSigner, viemSigner, or your own Signer implementation). Running the binary? Configure it under [simplex.signer]."
     );
   }
   const chainClientManager = new ChainClientManager(configService, options.signer);
@@ -23776,7 +24058,8 @@ async function bootFiller(config, options) {
   const lifecycle = new LimitOrderLifecycle(
     limitOrderService,
     {
-      reconcileIntervalSecs: config.orderbook?.reconcileIntervalSecs ?? DEFAULT_RECONCILE_INTERVAL_SECS
+      reconcileIntervalSecs: config.orderbook?.reconcileIntervalSecs ?? DEFAULT_RECONCILE_INTERVAL_SECS,
+      reconcileTallies: () => intentFiller.reconcileLimitOrderTallies()
     },
     options.loggers
   );
@@ -24247,6 +24530,14 @@ var MemoryLimitOrderStore = class {
     const remaining = BigInt(order.remaining) - BigInt(amount);
     return this.patch(id, { remaining: (remaining > 0n ? remaining : 0n).toString() });
   }
+  async clampRemaining(id, room) {
+    const order = this.orders.get(id);
+    if (!order || order.status !== "open") return null;
+    const sum = BigInt(room) + BigInt(order.reserved);
+    const target = sum > 0n ? sum : 0n;
+    if (target >= BigInt(order.remaining)) return null;
+    return this.patch(id, { remaining: target.toString() });
+  }
   async release(id, amount) {
     const order = this.orders.get(id);
     if (!order) return;
@@ -24755,7 +25046,8 @@ var OrderScanner = class _OrderScanner {
    * back from its own endpoints, which also proves they answer for one chain
    * before a filler ever depends on them.
    *
-   * @throws if an endpoint set is invalid or unreachable, if two entries resolve
+   * @throws if an endpoint set is invalid, if none of a chain's endpoints answer,
+   *   if its endpoints disagree on the chain, if two entries resolve
    *   to the same chain, or if `scanIntervalSecs` is below the minimum.
    */
   static async create(options) {
@@ -24815,7 +25107,10 @@ var OrderScanner = class _OrderScanner {
   async addChainNow(chain) {
     if (this.closed) throw new Error("This OrderScanner is closed");
     const rpcUrls = validateRpcUrls(chain.rpcUrls);
-    const chainId = chain.chainId ?? await fetchChainId(rpcUrls[0]);
+    const chainId = chain.chainId ?? (await resolveChainConfigs([{ rpcUrls, bundlerUrl: chain.bundlerUrl ?? "" }], {
+      loggers: this.loggers,
+      tolerateUnreachable: true
+    }))[0].chainId;
     if (this.closed) throw new Error("This OrderScanner is closed");
     if (this.scanners.has(chainId)) {
       throw new Error(`Chain ${chainId} is already in this scanner`);
@@ -24915,7 +25210,7 @@ var LimitOrderController = class {
   get service() {
     const service = this.runtime.limitOrders;
     if (!service) {
-      throw new Error("No orderbook is configured \u2014 set [orderbook] enabled and url to use limit orders");
+      throw new Error("No orderbook is configured \u2014 set [orderbook] url to use limit orders");
     }
     return service;
   }
@@ -25380,7 +25675,7 @@ var Simplex = class _Simplex extends EventEmitter4 {
     const tomlSigner = options.config.simplex?.signer;
     if (tomlSigner && !options.signer) {
       throw new Error(
-        "config.simplex.signer describes a signer but none was passed. Simplex.start takes a Signer instance: `signer: await createSigner(config.simplex.signer)`, or build one directly with privateKeySigner/turnkeySigner/mpcVaultSigner/viemSigner."
+        "config.simplex.signer describes a signer but none was passed. Simplex.start takes a Signer instance: `signer: await createSigner(config.simplex.signer)`, or build one directly with privateKeySigner/secretPhraseSigner/turnkeySigner/mpcVaultSigner/viemSigner."
       );
     }
     const loggers = new LoggerContext({
@@ -25583,6 +25878,8 @@ var Simplex = class _Simplex extends EventEmitter4 {
 export {
   AssetController,
   ChainController,
+  LimitOrderController,
+  LimitOrderValidationError,
   LoggerContext,
   MemoryDataStore,
   OrderScanner,
@@ -25595,6 +25892,7 @@ export {
   WalletController,
   addLogSink,
   assertConfirmationCoverage,
+  canDerive,
   configureLogger,
   createSigner,
   digestSigner,
@@ -25607,10 +25905,12 @@ export {
   pickAnchorStable,
   privateKeySigner,
   registrySymbols,
+  secretPhraseSigner,
   turnkeySigner,
   validateAssetDefinitions,
   validateConfig,
   validatePairConfigs,
+  validateSecretPhrase,
   validateSignerConfig,
   validateVaultToml,
   viemSigner