@qntx/wallet-engine 0.0.0-stage → 0.4.0

package/dist/index.mjs

@@ -0,0 +1,3420 @@
+import { createStore } from "zustand/vanilla";
+import { SparkInputError, bitcoinAddressScript, createSparkClient, decodeBolt11, decodeSparkAddress, encodeSparkAddress, parseSparkInvoice, uuidv7 } from "@qntx/spark";
+import { nostr } from "@qntx/wallet/nostr";
+import { spark } from "@qntx/wallet/spark";
+import { parseBackupHeader } from "@qntx/wallet";
+import { signedMatchesUnsigned, verifyEvent } from "@qntx/nostr";
+import { decodeLnurl, encodeLnurl, lightningAddressUrl, registerLightningAddress, requestInvoice, resolveLnurl, submitWithdraw, unregisterLightningAddress } from "@qntx/spark/lnurl";
+import { makeZapRequest } from "@qntx/nostr/nips/nip57";
+import { base64 } from "@scure/base";
+//#region src/controller.ts
+/**
+* Controller base: a zustand vanilla store plus lifecycle. `update` applies a recipe that must
+* return a NEW state object; returning the same reference is a no-op (no set, no notification).
+* Persistence and migrations layer on later — this package carries only what its first user needs.
+*/
+var Controller = class {
+	name;
+	store;
+	constructor(options) {
+		this.name = options.name;
+		this.store = createStore(options.defaultState);
+	}
+	getState() {
+		return this.store.getState();
+	}
+	update(recipe) {
+		this.store.setState((state) => recipe(state));
+	}
+};
+//#endregion
+//#region src/events.ts
+function createEventBus(logger) {
+	const listeners = /* @__PURE__ */ new Map();
+	return {
+		emit(type, payload) {
+			const set = listeners.get(type);
+			if (set === void 0) return;
+			for (const listener of set) try {
+				listener(payload);
+			} catch (error) {
+				logger.warn("event listener threw", error);
+			}
+		},
+		on(type, listener) {
+			let set = listeners.get(type);
+			if (set === void 0) {
+				set = /* @__PURE__ */ new Set();
+				listeners.set(type, set);
+			}
+			const stored = listener;
+			set.add(stored);
+			return () => {
+				set.delete(stored);
+			};
+		}
+	};
+}
+//#endregion
+//#region src/errors.ts
+/** Typed engine errors: store codes are `closed` and `integrity` (decrypt or bind failure). */
+var EngineStoreError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "EngineStoreError";
+		this.code = code;
+	}
+};
+//#endregion
+//#region src/store/guard.ts
+/** NUL is the composite-key/AAD separator — a name or key containing it collides. */
+function checkName(kind, value) {
+	if (value.includes("\0")) throw new EngineStoreError("invalid-input", `${kind} must not contain NUL`);
+}
+//#endregion
+//#region src/store/memory.ts
+/** In-memory EngineStore: the Node/test implementation — same contract, no durability. */
+function createMemoryEngineStore(backing) {
+	const collections = backing?.collections ?? /* @__PURE__ */ new Map();
+	let closed = false;
+	const guard = () => {
+		if (closed) throw new EngineStoreError("closed", "engine store is closed");
+	};
+	return {
+		collection(name) {
+			checkName("collection", name);
+			let table = collections.get(name);
+			if (table === void 0) {
+				table = /* @__PURE__ */ new Map();
+				collections.set(name, table);
+			}
+			return {
+				get: async (key) => {
+					guard();
+					checkName("key", key);
+					const value = table.get(key);
+					return value === void 0 ? void 0 : new Uint8Array(value);
+				},
+				put: async (key, bytes) => {
+					guard();
+					checkName("key", key);
+					table.set(key, new Uint8Array(bytes));
+				},
+				delete: async (key) => {
+					guard();
+					checkName("key", key);
+					table.delete(key);
+				},
+				list: async () => {
+					guard();
+					return [...table.keys()];
+				}
+			};
+		},
+		close: async () => {
+			closed = true;
+			collections.clear();
+		}
+	};
+}
+//#endregion
+//#region src/accounts/errors.ts
+var AccountTreeError = class extends Error {
+	category;
+	constructor(category, message, cause) {
+		super(message, { cause });
+		this.name = "AccountTreeError";
+		this.category = category;
+	}
+};
+//#endregion
+//#region src/accounts/controller.ts
+const EMPTY_TREE = {
+	wallets: {},
+	groups: {},
+	selected: null,
+	totals: {}
+};
+const TOTAL_KEY = (walletId, index) => `${walletId}:${index}`;
+const withoutBinding = (g) => {
+	const { boundPubkey: _removed, ...rest } = g;
+	return rest;
+};
+const NAME_MAX$1 = 24;
+const TOTALS_DEBOUNCE_MS = 1e3;
+const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const own = (o, k) => Object.hasOwn(o, k);
+const isNonNegativeInt$1 = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+function validateName(v) {
+	if (v === void 0) return;
+	if (typeof v !== "string") return;
+	const name = v.trim();
+	return name.length > 0 && name.length <= NAME_MAX$1 ? name : void 0;
+}
+const KNOWN_GROUP_KEYS$1 = /* @__PURE__ */ new Set([
+	"walletId",
+	"index",
+	"name",
+	"hidden",
+	"boundPubkey",
+	"updatedAt"
+]);
+const KNOWN_TOP_KEYS = /* @__PURE__ */ new Set([
+	"wallets",
+	"groups",
+	"selected",
+	"totals"
+]);
+const KNOWN_WALLET_KEYS$1 = /* @__PURE__ */ new Set(["name", "updatedAt"]);
+const KNOWN_SELECTED_KEYS = /* @__PURE__ */ new Set(["walletId", "groupIndex"]);
+const PUBKEY_RE$1 = /^[0-9a-f]{64}$/;
+/** Strict decode — any malformed shape or unknown key returns `undefined`. */
+function decodeTree(bytes) {
+	try {
+		const text = new TextDecoder().decode(bytes);
+		const raw = JSON.parse(text);
+		if (!isPlainObject(raw)) return;
+		for (const k of Object.keys(raw)) if (!KNOWN_TOP_KEYS.has(k)) return;
+		const rawWallets = raw["wallets"];
+		const rawGroups = raw["groups"];
+		const rawSelected = raw["selected"];
+		const rawTotals = raw["totals"];
+		if (!isPlainObject(rawWallets) || !isPlainObject(rawGroups) || !isPlainObject(rawTotals)) return;
+		const wallets = {};
+		for (const [walletId, w] of Object.entries(rawWallets)) {
+			if (!isPlainObject(w) || walletId.length === 0) return;
+			for (const k of Object.keys(w)) if (!KNOWN_WALLET_KEYS$1.has(k)) return;
+			const name = validateName(w["name"]);
+			if (w["name"] !== void 0 && name === void 0) return;
+			const { updatedAt } = w;
+			if (!isNonNegativeInt$1(updatedAt)) return;
+			wallets[walletId] = {
+				updatedAt,
+				...name === void 0 ? {} : { name }
+			};
+		}
+		const groups = {};
+		for (const [walletId, arr] of Object.entries(rawGroups)) {
+			if (!Array.isArray(arr)) return;
+			const seen = /* @__PURE__ */ new Set();
+			const list = [];
+			for (const item of arr) {
+				if (!isPlainObject(item)) return;
+				for (const k of Object.keys(item)) if (!KNOWN_GROUP_KEYS$1.has(k)) return;
+				if (item["walletId"] !== walletId || !isNonNegativeInt$1(item["index"])) return;
+				const { index } = item;
+				if (seen.has(index) || item["hidden"] !== true && item["hidden"] !== false) return;
+				seen.add(index);
+				const name = validateName(item["name"]);
+				if (item["name"] !== void 0 && name === void 0) return;
+				const { updatedAt } = item;
+				if (!isNonNegativeInt$1(updatedAt)) return;
+				const { boundPubkey } = item;
+				if (boundPubkey !== void 0 && (typeof boundPubkey !== "string" || !PUBKEY_RE$1.test(boundPubkey))) return;
+				list.push({
+					walletId,
+					index,
+					hidden: item["hidden"],
+					updatedAt,
+					...name === void 0 ? {} : { name },
+					...boundPubkey === void 0 ? {} : { boundPubkey }
+				});
+			}
+			list.sort((a, b) => a.index - b.index);
+			groups[walletId] = list;
+		}
+		let selected = null;
+		if (rawSelected !== void 0 && rawSelected !== null) {
+			if (!isPlainObject(rawSelected)) return;
+			for (const k of Object.keys(rawSelected)) if (!KNOWN_SELECTED_KEYS.has(k)) return;
+			const { walletId } = rawSelected;
+			const { groupIndex } = rawSelected;
+			if (typeof walletId !== "string" || walletId.length === 0 || !isNonNegativeInt$1(groupIndex)) return;
+			selected = {
+				walletId,
+				groupIndex
+			};
+		}
+		const totals = {};
+		for (const [k, v] of Object.entries(rawTotals)) {
+			if (!own(rawTotals, k) || !isNonNegativeInt$1(v)) return;
+			totals[k] = v;
+		}
+		return {
+			wallets,
+			groups,
+			selected,
+			totals
+		};
+	} catch {
+		return;
+	}
+}
+function encodeTree(tree) {
+	return new TextEncoder().encode(JSON.stringify(tree));
+}
+/**
+* Declarative account tree: wallets come from the Wallet snapshot (reconciled on unlock and on
+* every snapshot change while unlocked), groups/names/hidden/selected/totals persist to the engine
+* store under `accounts/tree`. The controller drives `spark.setAccounts` with the selected group
+* only — an unselected group needs no live client (incoming transfers are claimed whenever it is
+* selected again). The active account's `balanceSats` feeds `totals`, debounced 1 s before
+* persist.
+*/
+var AccountTreeController = class extends Controller {
+	options;
+	col;
+	sparkUnsubscribe;
+	totalsTimer;
+	persistChain = Promise.resolve();
+	constructor(options) {
+		super({
+			name: "accounts",
+			defaultState: () => ({
+				status: "locked",
+				wallets: [],
+				groups: {},
+				selected: null,
+				totals: {}
+			})
+		});
+		this.options = options;
+	}
+	setStore(store) {
+		this.col = store === void 0 ? void 0 : store.collection("accounts");
+	}
+	/** Load persisted state, reconcile with the snapshot, start driving Spark. */
+	async init() {
+		const persisted = await this.load();
+		this.update(() => ({
+			status: "ready",
+			...persistedToState(persisted)
+		}));
+		this.reconcile();
+		this.driveSpark(this.getState().selected);
+		this.sparkUnsubscribe = this.options.spark.store.subscribe((state) => {
+			this.onSparkState(state.accounts);
+		});
+	}
+	async destroy() {
+		this.sparkUnsubscribe?.();
+		this.sparkUnsubscribe = void 0;
+		await this.lock();
+	}
+	/** Locked: stop every Spark client, flush pending persists, then drop to the empty state. */
+	async lock() {
+		this.sparkUnsubscribe?.();
+		this.sparkUnsubscribe = void 0;
+		this.options.spark.setAccounts([]);
+		await this.flushTotals();
+		this.col = void 0;
+		this.update(() => ({
+			status: "locked",
+			wallets: [],
+			groups: {},
+			selected: null,
+			totals: {}
+		}));
+		await Promise.resolve();
+	}
+	/** Reconcile groups/names/selected with `wallet.getSnapshot().wallets`; persists on change. */
+	reconcile() {
+		if (this.getState().status !== "ready") return;
+		const live = this.options.wallet.getSnapshot().wallets.map((w) => w.walletId);
+		const liveSet = new Set(live);
+		const state = this.getState();
+		const entriesById = new Map(state.wallets.map((w) => [w.walletId, w]));
+		const wallets = live.map((walletId) => {
+			return entriesById.get(walletId) ?? {
+				walletId,
+				updatedAt: 0
+			};
+		});
+		const groups = {};
+		for (const walletId of live) {
+			const existing = state.groups[walletId] ?? [];
+			groups[walletId] = existing.length > 0 ? existing : [{
+				walletId,
+				index: 0,
+				hidden: false,
+				updatedAt: 0
+			}];
+		}
+		const totals = {};
+		for (const [k, v] of Object.entries(state.totals)) {
+			const walletId = k.slice(0, Math.max(0, k.lastIndexOf(":")));
+			if (liveSet.has(walletId)) totals[k] = v;
+		}
+		const selected = this.validSelection(groups, live, state.selected);
+		if (JSON.stringify(wallets) !== JSON.stringify(state.wallets) || JSON.stringify(groups) !== JSON.stringify(state.groups) || JSON.stringify(totals) !== JSON.stringify(state.totals) || JSON.stringify(selected) !== JSON.stringify(state.selected)) {
+			this.update((s) => ({
+				...s,
+				wallets,
+				groups,
+				totals,
+				selected
+			}));
+			this.persist();
+			this.driveSpark(selected);
+		}
+	}
+	addGroup(walletId) {
+		this.mustWallet(walletId);
+		const groups = this.getState().groups[walletId] ?? [];
+		let index = 0;
+		for (const g of groups) index = Math.max(index, g.index + 1);
+		const updatedAt = this.options.now();
+		this.mutateGroups(walletId, (list) => [...list, {
+			walletId,
+			index,
+			hidden: false,
+			updatedAt
+		}]);
+		return index;
+	}
+	addGroups(walletId, indices) {
+		this.mustWallet(walletId);
+		this.mutateGroups(walletId, (list) => {
+			const have = new Set(list.map((g) => g.index));
+			const added = [];
+			const updatedAt = this.options.now();
+			for (const i of indices) if (Number.isSafeInteger(i) && i >= 0 && !have.has(i)) {
+				have.add(i);
+				added.push({
+					walletId,
+					index: i,
+					hidden: false,
+					updatedAt
+				});
+			}
+			return [...list, ...added].sort((a, b) => a.index - b.index);
+		});
+	}
+	renameWallet(walletId, name) {
+		this.mustWallet(walletId);
+		const trimmed = this.checkedName(name);
+		const updatedAt = this.options.now();
+		this.update((s) => ({
+			...s,
+			wallets: s.wallets.map((w) => w.walletId === walletId ? {
+				walletId,
+				name: trimmed,
+				updatedAt
+			} : w)
+		}));
+		this.persist();
+	}
+	renameGroup(walletId, index, name) {
+		this.mustGroup(walletId, index);
+		const trimmed = this.checkedName(name);
+		const updatedAt = this.options.now();
+		this.mutateGroups(walletId, (list) => list.map((g) => g.index === index ? {
+			...g,
+			name: trimmed,
+			updatedAt
+		} : g));
+	}
+	setHidden(walletId, index, hidden) {
+		const state = this.getState();
+		this.mustGroup(walletId, index);
+		const visible = this.visibleGroups(state).filter((g) => !(g.walletId === walletId && g.index === index));
+		if (hidden && visible.length === 0) throw new AccountTreeError("rejected", "cannot hide every account group");
+		const updatedAt = this.options.now();
+		this.mutateGroups(walletId, (list) => list.map((g) => g.index === index ? {
+			...g,
+			hidden,
+			updatedAt
+		} : g));
+		const sel = state.selected;
+		if (sel !== null && sel.walletId === walletId && sel.groupIndex === index && hidden) this.selectFallback();
+	}
+	select(walletId, index) {
+		const state = this.getState();
+		const group = (state.groups[walletId] ?? []).find((g) => g.index === index);
+		if (group === void 0) throw new AccountTreeError("not-found", "account group does not exist");
+		if (group.hidden) throw new AccountTreeError("rejected", "cannot select a hidden account group");
+		if (state.selected?.walletId === walletId && state.selected.groupIndex === index) return;
+		this.update((s) => ({
+			...s,
+			selected: {
+				walletId,
+				groupIndex: index
+			}
+		}));
+		this.persist();
+		this.driveSpark(this.getState().selected);
+	}
+	/**
+	* Binds a social identity to one group. The identity is unique across the whole tree — every
+	* group in every wallet carrying it loses the binding (each entry re-stamped).
+	*/
+	bind(walletId, index, pubkey) {
+		this.mustGroup(walletId, index);
+		if (!PUBKEY_RE$1.test(pubkey)) throw new AccountTreeError("invalid-input", "boundPubkey must be 64 lowercase hex");
+		const updatedAt = this.options.now();
+		this.update((s) => ({
+			...s,
+			groups: Object.fromEntries(Object.entries(s.groups).map(([wid, list]) => [wid, list.map((g) => {
+				if (wid === walletId && g.index === index) return {
+					...g,
+					boundPubkey: pubkey,
+					updatedAt
+				};
+				if (g.boundPubkey === pubkey) return {
+					...withoutBinding(g),
+					updatedAt
+				};
+				return g;
+			})]))
+		}));
+		this.persist();
+	}
+	unbind(walletId, index) {
+		this.mustGroup(walletId, index);
+		const updatedAt = this.options.now();
+		this.mutateGroups(walletId, (list) => list.map((g) => g.index === index ? {
+			...withoutBinding(g),
+			updatedAt
+		} : g));
+	}
+	/**
+	* Which group currently holds a pubkey — merges can leave the same identity on groups in two
+	* wallets; the newest `updatedAt` wins, ties resolve by snapshot wallet order then lower index.
+	*/
+	bindingOf(pubkey) {
+		const s = this.getState();
+		let best;
+		let walletPos = -1;
+		for (const w of s.wallets) {
+			walletPos += 1;
+			for (const g of s.groups[w.walletId] ?? []) {
+				if (g.boundPubkey !== pubkey) continue;
+				if (best === void 0 || g.updatedAt > best.updatedAt || g.updatedAt === best.updatedAt && (walletPos < best.walletPos || walletPos === best.walletPos && g.index < best.groupIndex)) best = {
+					walletId: w.walletId,
+					groupIndex: g.index,
+					updatedAt: g.updatedAt,
+					walletPos
+				};
+			}
+		}
+		return best === void 0 ? void 0 : {
+			walletId: best.walletId,
+			groupIndex: best.groupIndex
+		};
+	}
+	/** The wallet's metadata document — every group, hidden included. */
+	exportMeta(walletId) {
+		this.mustWallet(walletId);
+		const s = this.getState();
+		const w = s.wallets.find((x) => x.walletId === walletId);
+		const wallet = {
+			updatedAt: w?.updatedAt ?? 0,
+			...w?.name === void 0 ? {} : { name: w.name }
+		};
+		const groups = [];
+		for (const g of s.groups[walletId] ?? []) groups.push({
+			index: g.index,
+			hidden: g.hidden,
+			updatedAt: g.updatedAt,
+			...g.name === void 0 ? {} : { name: g.name },
+			...g.boundPubkey === void 0 ? {} : { boundPubkey: g.boundPubkey }
+		});
+		return {
+			v: 1,
+			wallet,
+			groups
+		};
+	}
+	/**
+	* Entry-level last-writer-wins merge: a newer remote `updatedAt` replaces the local entry, a tie
+	* keeps local; remote-only groups are added. `selected`/hidden rules are re-validated — if the
+	* merge hides the selected group it is re-selected, and a merge may never leave every group
+	* hidden (the selected one stays visible and is re-stamped so the fix propagates).
+	*/
+	mergeMeta(walletId, doc) {
+		this.mustWallet(walletId);
+		let changed = false;
+		let localNewer = false;
+		const s = this.getState();
+		const localWallet = s.wallets.find((w) => w.walletId === walletId);
+		const walletUpdatedAt = localWallet?.updatedAt ?? 0;
+		let wallet = localWallet ?? {
+			walletId,
+			updatedAt: 0
+		};
+		if (doc.wallet.updatedAt > walletUpdatedAt) {
+			wallet = {
+				walletId,
+				updatedAt: doc.wallet.updatedAt,
+				...doc.wallet.name === void 0 ? {} : { name: doc.wallet.name }
+			};
+			changed = true;
+		} else if (walletUpdatedAt > doc.wallet.updatedAt) localNewer = true;
+		const localByIndex = new Map((s.groups[walletId] ?? []).map((g) => [g.index, g]));
+		const groups = [...s.groups[walletId] ?? []];
+		for (const remote of doc.groups) {
+			const local = localByIndex.get(remote.index);
+			if (local === void 0) {
+				groups.push({
+					walletId,
+					index: remote.index,
+					hidden: remote.hidden,
+					updatedAt: remote.updatedAt,
+					...remote.name === void 0 ? {} : { name: remote.name },
+					...remote.boundPubkey === void 0 ? {} : { boundPubkey: remote.boundPubkey }
+				});
+				changed = true;
+				continue;
+			}
+			if (remote.updatedAt > local.updatedAt) {
+				const replaced = {
+					walletId,
+					index: remote.index,
+					hidden: remote.hidden,
+					updatedAt: remote.updatedAt,
+					...remote.name === void 0 ? {} : { name: remote.name },
+					...remote.boundPubkey === void 0 ? {} : { boundPubkey: remote.boundPubkey }
+				};
+				const at = groups.findIndex((g) => g.index === remote.index);
+				groups[at] = replaced;
+				changed = true;
+			} else if (local.updatedAt > remote.updatedAt) localNewer = true;
+		}
+		for (const g of groups) if (!doc.groups.some((r) => r.index === g.index) && g.updatedAt > 0) localNewer = true;
+		groups.sort((a, b) => a.index - b.index);
+		const walletOrder = s.wallets.map((w) => w.walletId);
+		let selected = this.validSelection({
+			...s.groups,
+			[walletId]: groups
+		}, walletOrder, s.selected);
+		if (!groups.some((g) => !g.hidden) && groups.length > 0) {
+			const keep = selected ?? {
+				walletId,
+				groupIndex: groups[0]?.index ?? 0
+			};
+			const now = this.options.now();
+			for (const [i, g] of groups.entries()) if (g.index === keep.groupIndex) groups[i] = {
+				...g,
+				hidden: false,
+				updatedAt: now
+			};
+			selected = keep;
+			changed = true;
+			localNewer = true;
+		}
+		if (selected?.walletId !== s.selected?.walletId || selected?.groupIndex !== s.selected?.groupIndex) changed = true;
+		if (changed) {
+			this.update((st) => ({
+				...st,
+				wallets: st.wallets.map((w) => w.walletId === walletId ? wallet : w),
+				groups: {
+					...st.groups,
+					[walletId]: groups
+				},
+				selected
+			}));
+			this.persist();
+			this.driveSpark(selected);
+		}
+		return {
+			changed,
+			localNewer
+		};
+	}
+	/** Sequential inspect from 0 upward; index 0 always included; stop after 2 consecutive unused. */
+	async discoverSpark(walletId) {
+		this.mustWallet(walletId);
+		const found = [0];
+		let index = 0;
+		let unused = 0;
+		while (found.length < 65) {
+			const ref = {
+				walletId,
+				groupIndex: index,
+				network: this.options.sparkNetwork
+			};
+			const { used } = await this.options.spark.inspect(ref);
+			if (used) {
+				if (index !== 0) found.push(index);
+				unused = 0;
+			} else {
+				unused += 1;
+				if (index !== 0 && unused >= 2) break;
+			}
+			index += 1;
+		}
+		return found;
+	}
+	/** Refresh `totals` for every other visible group; per-group failures are logged and skipped. */
+	async refreshTotals() {
+		const state = this.getState();
+		const sel = state.selected;
+		const targets = this.visibleGroups(state).filter((g) => !(sel !== null && g.walletId === sel.walletId && g.index === sel.groupIndex));
+		let cursor = 0;
+		const worker = async () => {
+			while (cursor < targets.length) {
+				const group = targets[cursor];
+				cursor += 1;
+				if (group === void 0) return;
+				try {
+					const ref = {
+						walletId: group.walletId,
+						groupIndex: group.index,
+						network: this.options.sparkNetwork
+					};
+					const { balanceSats } = await this.options.spark.inspect(ref);
+					this.setTotal(group.walletId, group.index, balanceSats);
+				} catch (error) {
+					this.options.logger.warn(`refreshTotals failed for ${group.walletId}:${group.index}`, error);
+				}
+			}
+		};
+		await Promise.all([worker(), worker()]);
+	}
+	onSparkState(accounts) {
+		const sel = this.getState().selected;
+		if (sel === null) return;
+		const balance = accounts[`${sel.walletId}:${sel.groupIndex}:${this.options.sparkNetwork}`]?.balanceSats;
+		if (balance !== void 0) this.setTotal(sel.walletId, sel.groupIndex, balance);
+	}
+	setTotal(walletId, index, balanceSats) {
+		const k = TOTAL_KEY(walletId, index);
+		if (this.getState().totals[k] === balanceSats) return;
+		this.update((s) => ({
+			...s,
+			totals: {
+				...s.totals,
+				[k]: balanceSats
+			}
+		}));
+		this.scheduleTotalsPersist();
+	}
+	driveSpark(selected) {
+		this.options.spark.setAccounts(selected === null ? [] : [{
+			...selected,
+			network: this.options.sparkNetwork
+		}]);
+	}
+	visibleGroups(state) {
+		const out = [];
+		for (const w of state.wallets) for (const g of state.groups[w.walletId] ?? []) if (!g.hidden) out.push(g);
+		return out;
+	}
+	validSelection(groups, walletOrder, current) {
+		if (current !== null) {
+			const g = (groups[current.walletId] ?? []).find((x) => x.index === current.groupIndex);
+			if (g !== void 0 && !g.hidden) return current;
+		}
+		for (const walletId of walletOrder) for (const g of groups[walletId] ?? []) if (!g.hidden) return {
+			walletId,
+			groupIndex: g.index
+		};
+		return null;
+	}
+	selectFallback() {
+		const state = this.getState();
+		const next = this.validSelection(state.groups, state.wallets.map((w) => w.walletId), null);
+		this.update((s) => ({
+			...s,
+			selected: next
+		}));
+		this.persist();
+		this.driveSpark(next);
+	}
+	mutateGroups(walletId, fn) {
+		this.update((s) => ({
+			...s,
+			groups: {
+				...s.groups,
+				[walletId]: fn(s.groups[walletId] ?? [])
+			}
+		}));
+		this.persist();
+	}
+	mustWallet(walletId) {
+		if (this.getState().status !== "ready") throw new AccountTreeError("locked", "account tree is locked");
+		if (!this.getState().wallets.some((w) => w.walletId === walletId)) throw new AccountTreeError("not-found", "wallet does not exist");
+	}
+	mustGroup(walletId, index) {
+		this.mustWallet(walletId);
+		if (!(this.getState().groups[walletId] ?? []).some((g) => g.index === index)) throw new AccountTreeError("not-found", "account group does not exist");
+	}
+	checkedName(name) {
+		const trimmed = name.trim();
+		if (trimmed.length === 0 || trimmed.length > NAME_MAX$1) throw new AccountTreeError("invalid-input", "name must be 1-24 characters");
+		return trimmed;
+	}
+	async load() {
+		if (this.col === void 0) return EMPTY_TREE;
+		const bytes = await this.col.get("tree");
+		if (bytes === void 0) return EMPTY_TREE;
+		const tree = decodeTree(bytes);
+		if (tree === void 0) {
+			this.options.logger.warn("invalid persisted account tree — starting empty");
+			return EMPTY_TREE;
+		}
+		return tree;
+	}
+	/** Queues a store write behind the previous one — the last queued write always lands last. */
+	persist() {
+		const { col } = this;
+		if (col === void 0) return;
+		const previous = this.persistChain;
+		this.persistChain = (async () => {
+			try {
+				await previous;
+				const s = this.getState();
+				const tree = {
+					wallets: Object.fromEntries(s.wallets.map((w) => [w.walletId, {
+						updatedAt: w.updatedAt,
+						...w.name === void 0 ? {} : { name: w.name }
+					}])),
+					groups: s.groups,
+					selected: s.selected,
+					totals: s.totals
+				};
+				await col.put("tree", encodeTree(tree));
+			} catch (error) {
+				this.options.logger.warn("account tree persist failed", error);
+			}
+		})();
+	}
+	scheduleTotalsPersist() {
+		if (this.totalsTimer !== void 0) return;
+		this.totalsTimer = setTimeout(() => {
+			this.totalsTimer = void 0;
+			this.persist();
+		}, TOTALS_DEBOUNCE_MS);
+	}
+	async flushTotals() {
+		if (this.totalsTimer !== void 0) {
+			clearTimeout(this.totalsTimer);
+			this.totalsTimer = void 0;
+			this.persist();
+		}
+		await this.persistChain;
+	}
+};
+function persistedToState(tree) {
+	const wallets = [];
+	for (const [walletId, w] of Object.entries(tree.wallets)) if (w.name === void 0) wallets.push({
+		walletId,
+		updatedAt: w.updatedAt
+	});
+	else wallets.push({
+		walletId,
+		name: w.name,
+		updatedAt: w.updatedAt
+	});
+	return {
+		wallets,
+		groups: tree.groups,
+		selected: tree.selected,
+		totals: tree.totals
+	};
+}
+//#endregion
+//#region ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/_u64.js
+const fromNumH = (n) => n / 2 ** 32 | 0;
+const fromNumL = (n) => n >>> 0;
+function setU64FromNum(view, byteOffset, n, isLE) {
+	const h = fromNumH(n);
+	const l = fromNumL(n);
+	view.setUint32(byteOffset, isLE ? l : h, isLE);
+	view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
+}
+//#endregion
+//#region ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/utils.js
+/**
+* Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.
+* @param a - value to test
+* @returns `true` when the value is a Uint8Array-compatible view.
+* @example
+* Check whether a value is a Uint8Array-compatible view.
+* ```ts
+* isBytes(new Uint8Array([1, 2, 3]));
+* ```
+*/
+function isBytes(a) {
+	return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+const atitle = (title) => title ? `"${title}" ` : "";
+/**
+* Asserts something is a non-negative integer.
+* @param n - number to validate
+* @param title - label included in thrown errors
+* @returns The validated number.
+* @throws On wrong argument types. {@link TypeError}
+* @throws On wrong argument ranges or values. {@link RangeError}
+* @example
+* Validate a non-negative integer option.
+* ```ts
+* anumber(32, 'length');
+* ```
+*/
+function anumber(n, title = "") {
+	if (typeof n !== "number") throw new TypeError(atitle(title) + "expected number, got " + typeof n);
+	if (!Number.isSafeInteger(n) || n < 0) throw new RangeError(atitle(title) + "expected integer >= 0, got " + n);
+	return n;
+}
+/**
+* Asserts something is Uint8Array.
+* @param value - value to validate
+* @param length - optional exact length constraint
+* @param title - label included in thrown errors
+* @returns The validated byte array.
+* @throws On wrong argument types. {@link TypeError}
+* @throws On wrong argument ranges or values. {@link RangeError}
+* @example
+* Validate that a value is a byte array.
+* ```ts
+* abytes(new Uint8Array([1, 2, 3]));
+* ```
+*/
+function abytes(value, length, title = "") {
+	if (isBytes(value) && (length === void 0 || value.length === length)) return value;
+	if (length !== void 0) anumber(length, "length");
+	const bytes = isBytes(value);
+	const ofLen = length !== void 0 ? ` of length ${length}` : "";
+	const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+	const message = atitle(title) + "expected Uint8Array" + ofLen + ", got " + got;
+	if (!bytes) throw new TypeError(message);
+	throw new RangeError(message);
+}
+const aobject = (value, label) => {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
+};
+const aopts = (value, label) => {
+	aobject(value, label);
+	const proto = Object.getPrototypeOf(value);
+	if (proto !== Object.prototype && proto !== null) throw new TypeError(`"${label}" expected plain object`);
+	if (Object.hasOwn(value, "__proto__")) throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
+/**
+* Asserts a hash instance has not been destroyed or finished.
+* @param instance - hash instance to validate
+* @param checkFinished - whether to reject finalized instances
+* @throws If the hash instance has already been destroyed or finalized. {@link Error}
+* @example
+* Validate that a hash instance is still usable.
+* ```ts
+* import { aexists } from '@noble/hashes/utils.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* const hash = sha256.create();
+* aexists(hash);
+* ```
+*/
+function aexists(instance, checkFinished = true) {
+	if (instance.destroyed) throw new Error("hash was destroyed");
+	if (checkFinished && instance.finished) throw new Error("digest() was already called");
+}
+/**
+* Asserts output is a sufficiently-sized byte array.
+* @param out - destination buffer
+* @param instance - hash instance providing output length
+* Oversized buffers are allowed; downstream code only promises to fill the first `outputLen` bytes.
+* @throws On wrong argument types. {@link TypeError}
+* @throws On wrong argument ranges or values. {@link RangeError}
+* @example
+* Validate a caller-provided digest buffer.
+* ```ts
+* import { aoutput } from '@noble/hashes/utils.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* const hash = sha256.create();
+* aoutput(new Uint8Array(hash.outputLen), hash);
+* ```
+*/
+function aoutput(out, instance) {
+	abytes(out, void 0, "output");
+	const min = instance.outputLen;
+	if (!(out.length >= min)) throw new RangeError("\"output\" expected length >= " + min);
+}
+/**
+* Zeroizes typed arrays in place. Warning: JS provides no guarantees.
+* @param arrays - arrays to overwrite with zeros
+* @example
+* Zeroize sensitive buffers in place.
+* ```ts
+* clean(new Uint8Array([1, 2, 3]));
+* ```
+*/
+function clean(...arrays) {
+	for (let i = 0; i < arrays.length; i++) arrays[i].fill(0);
+}
+/**
+* Creates a DataView for byte-level manipulation.
+* @param arr - source typed array
+* @returns DataView over the same buffer region.
+* @example
+* Create a DataView over an existing buffer.
+* ```ts
+* createView(new Uint8Array(4));
+* ```
+*/
+function createView(arr) {
+	return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+/**
+* Rotate-right operation for uint32 values.
+* @param word - source word
+* @param shift - shift amount in bits
+* @returns Rotated word.
+* @example
+* Rotate a 32-bit word to the right.
+* ```ts
+* rotr(0x12345678, 8);
+* ```
+*/
+function rotr(word, shift) {
+	return word << 32 - shift | word >>> shift;
+}
+const hasHexBuiltin = /* @__PURE__ */ (() => typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function")();
+const hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
+/**
+* Convert byte array to hex string.
+* Uses the built-in function when available and assumes it matches the tested
+* fallback semantics.
+* @param bytes - bytes to encode
+* @returns Lowercase hexadecimal string.
+* @throws On wrong argument types. {@link TypeError}
+* @example
+* Convert bytes to lowercase hexadecimal.
+* ```ts
+* bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])); // 'cafe0123'
+* ```
+*/
+function bytesToHex(bytes) {
+	abytes(bytes);
+	if (hasHexBuiltin) return bytes.toHex();
+	let hex = "";
+	for (let i = 0; i < bytes.length; i++) hex += hexes[bytes[i]];
+	return hex;
+}
+/**
+* Converts string to bytes using UTF8 encoding.
+* Built-in doesn't validate input to be string: we do the check.
+* Non-ASCII details are delegated to the platform `TextEncoder`.
+* @param str - string to encode
+* @returns UTF-8 encoded bytes.
+* @throws On wrong argument types. {@link TypeError}
+* @example
+* Encode a string as UTF-8 bytes.
+* ```ts
+* utf8ToBytes('abc'); // Uint8Array.from([97, 98, 99])
+* ```
+*/
+function utf8ToBytes(str) {
+	if (typeof str !== "string") throw new TypeError("string expected");
+	const encoded = new TextEncoder().encode(str);
+	try {
+		return new Uint8Array(encoded);
+	} finally {
+		clean(encoded);
+	}
+}
+/**
+* Merges default options and passed options.
+* @param defaults - base option object
+* @param opts - user overrides
+* @param title - label included in thrown override errors
+* @returns Fresh merged option object with a null prototype.
+* @throws On wrong argument types. {@link TypeError}
+* @example
+* Merge user overrides onto default options.
+* ```ts
+* checkOpts({ dkLen: 32 }, { asyncTick: 10 });
+* ```
+*/
+function checkOpts(defaults, opts, title = "opts") {
+	aopts(defaults, "defaults");
+	if (opts !== void 0) aopts(opts, title);
+	return Object.assign(Object.create(null), defaults, opts);
+}
+/**
+* Creates a callable hash function from a stateful class constructor.
+* @param hashCons - hash constructor or factory
+* @param info - optional metadata such as DER OID
+* @returns Frozen callable hash wrapper with `.create()`.
+*   Wrapper construction eagerly calls `hashCons(undefined)` once to read
+*   `outputLen` / `blockLen`, so constructor side effects happen at module
+*   init time.
+* @throws On wrong argument types. {@link TypeError}
+* @example
+* Wrap a stateful hash constructor into a callable helper.
+* ```ts
+* import { createHasher } from '@noble/hashes/utils.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* const wrapped = createHasher(sha256.create, { oid: sha256.oid });
+* wrapped(new Uint8Array([1]));
+* ```
+*/
+function createHasher(hashCons, info = {}) {
+	if (typeof hashCons !== "function") throw new TypeError("\"hashCons\" expected function, got type=" + typeof hashCons);
+	info = checkOpts({}, info, "info");
+	const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+	const tmp = hashCons(void 0);
+	hashC.outputLen = tmp.outputLen;
+	hashC.blockLen = tmp.blockLen;
+	hashC.canXOF = tmp.canXOF;
+	hashC.create = (opts) => hashCons(opts);
+	Object.assign(hashC, info);
+	return Object.freeze(hashC);
+}
+/**
+* Creates OID metadata for NIST hashes with prefix `06 09 60 86 48 01 65 03 04 02`.
+* @param suffix - final OID byte for the selected hash.
+*   The helper accepts any byte even though only the documented NIST hash
+*   suffixes are meaningful downstream.
+* @returns Object containing the DER-encoded OID.
+* @example
+* Build OID metadata for a NIST hash.
+* ```ts
+* oidNist(0x01);
+* ```
+*/
+const oidNist = (suffix) => ({ oid: Uint8Array.from([
+	6,
+	9,
+	96,
+	134,
+	72,
+	1,
+	101,
+	3,
+	4,
+	2,
+	suffix
+]) });
+//#endregion
+//#region ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/_md.js
+/**
+* Internal Merkle-Damgard hash utils.
+* @module
+*/
+/**
+* Shared 32-bit conditional boolean primitive reused by SHA-256, SHA-1, and MD5 `F`.
+* Returns bits from `b` when `a` is set, otherwise from `c`.
+* The XOR form is equivalent to MD5's `F(X,Y,Z) = XY v not(X)Z` because the masked terms never
+* set the same bit.
+* @param a - selector word
+* @param b - word chosen when selector bit is set
+* @param c - word chosen when selector bit is clear
+* @returns Mixed 32-bit word.
+* @example
+* Combine three words with the shared 32-bit choice primitive.
+* ```ts
+* Chi(0xffffffff, 0x12345678, 0x87654321);
+* ```
+*/
+function Chi(a, b, c) {
+	return a & b ^ ~a & c;
+}
+/**
+* Shared 32-bit majority primitive reused by SHA-256 and SHA-1.
+* Returns bits shared by at least two inputs.
+* @param a - first input word
+* @param b - second input word
+* @param c - third input word
+* @returns Mixed 32-bit word.
+* @example
+* Combine three words with the shared 32-bit majority primitive.
+* ```ts
+* Maj(0xffffffff, 0x12345678, 0x87654321);
+* ```
+*/
+function Maj(a, b, c) {
+	return a & b ^ a & c ^ b & c;
+}
+/**
+* Merkle-Damgard hash construction base class.
+* Could be used to create MD5, RIPEMD, SHA1, SHA2.
+* Accepts only byte-aligned `Uint8Array` input, even when the underlying spec describes bit
+* strings with partial-byte tails.
+* @param blockLen - internal block size in bytes
+* @param outputLen - digest size in bytes
+* @param padOffset - trailing length field size in bytes
+* @param isLE - whether length and state words are encoded in little-endian
+* @example
+* Use a concrete subclass to get the shared Merkle-Damgard update/digest flow.
+* ```ts
+* import { _SHA1 } from '@noble/hashes/legacy.js';
+* const hash = new _SHA1();
+* hash.update(new Uint8Array([97, 98, 99]));
+* hash.digest();
+* ```
+*/
+var HashMD = class {
+	blockLen;
+	outputLen;
+	canXOF = false;
+	padOffset;
+	isLE;
+	buffer;
+	view;
+	finished = false;
+	length = 0;
+	pos = 0;
+	destroyed = false;
+	constructor(blockLen, outputLen, padOffset, isLE) {
+		this.blockLen = blockLen;
+		this.outputLen = outputLen;
+		this.padOffset = padOffset;
+		this.isLE = isLE;
+		this.buffer = new Uint8Array(blockLen);
+		this.view = createView(this.buffer);
+	}
+	update(data) {
+		aexists(this);
+		abytes(data);
+		const { view, buffer, blockLen } = this;
+		const len = data.length;
+		let processed = false;
+		for (let pos = 0; pos < len;) {
+			const take = Math.min(blockLen - this.pos, len - pos);
+			if (take === blockLen) {
+				const dataView = createView(data);
+				for (; blockLen <= len - pos; pos += blockLen) this.process(dataView, pos);
+				processed = true;
+				continue;
+			}
+			buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
+			this.pos += take;
+			pos += take;
+			if (this.pos === blockLen) {
+				this.process(view, 0);
+				this.pos = 0;
+				processed = true;
+			}
+		}
+		this.length += data.length;
+		if (processed) this.roundClean();
+		return this;
+	}
+	digestInto(out) {
+		aexists(this);
+		aoutput(out, this);
+		this.finished = true;
+		const { buffer, view, blockLen, isLE } = this;
+		let { pos } = this;
+		buffer[pos++] = 128;
+		buffer.fill(0, pos);
+		if (this.padOffset > blockLen - pos) {
+			this.process(view, 0);
+			buffer.fill(0);
+		}
+		setU64FromNum(view, blockLen - 8, this.length * 8, isLE);
+		this.process(view, 0);
+		this.roundClean();
+		const oview = out === buffer ? view : createView(out);
+		const len = this.outputLen;
+		const outLen = len / 4;
+		const state = this.get();
+		if (len % 4 || outLen > state.length) throw new Error("invalid outputLen");
+		for (let i = 0; i < outLen; i++) oview.setUint32(4 * i, state[i], isLE);
+	}
+	digest() {
+		const { buffer, outputLen } = this;
+		this.digestInto(buffer);
+		const res = buffer.slice(0, outputLen);
+		this.destroy();
+		return res;
+	}
+	_cloneIntoMeta(to) {
+		const { buffer, length, finished, destroyed, pos } = this;
+		to.destroyed = destroyed;
+		to.finished = finished;
+		to.length = length;
+		to.pos = pos;
+		if (pos) to.buffer.set(buffer);
+		return to;
+	}
+	clone() {
+		return this._cloneInto();
+	}
+};
+/**
+* Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.
+* Check out `test/misc/sha2-gen-iv.js` for recomputation guide.
+*/
+/** Initial SHA256 state from RFC 6234 §6.1: the first 32 bits of the fractional parts of the
+* square roots of the first eight prime numbers. Exported as a shared table; callers must treat
+* it as read-only because constructors copy words from it by index. */
+const SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+	1779033703,
+	3144134277,
+	1013904242,
+	2773480762,
+	1359893119,
+	2600822924,
+	528734635,
+	1541459225
+]);
+//#endregion
+//#region ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/sha2.js
+/**
+* SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.
+* SHA256 is the fastest hash implementable in JS, even faster than Blake3.
+* Check out {@link https://www.rfc-editor.org/rfc/rfc4634 | RFC 4634} and
+* {@link https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf | FIPS 180-4}.
+* @module
+*/
+/**
+* SHA-224 / SHA-256 round constants from RFC 6234 §5.1: the first 32 bits
+* of the cube roots of the first 64 primes (2..311).
+*/
+const SHA256_K = /* @__PURE__ */ Uint32Array.from([
+	1116352408,
+	1899447441,
+	3049323471,
+	3921009573,
+	961987163,
+	1508970993,
+	2453635748,
+	2870763221,
+	3624381080,
+	310598401,
+	607225278,
+	1426881987,
+	1925078388,
+	2162078206,
+	2614888103,
+	3248222580,
+	3835390401,
+	4022224774,
+	264347078,
+	604807628,
+	770255983,
+	1249150122,
+	1555081692,
+	1996064986,
+	2554220882,
+	2821834349,
+	2952996808,
+	3210313671,
+	3336571891,
+	3584528711,
+	113926993,
+	338241895,
+	666307205,
+	773529912,
+	1294757372,
+	1396182291,
+	1695183700,
+	1986661051,
+	2177026350,
+	2456956037,
+	2730485921,
+	2820302411,
+	3259730800,
+	3345764771,
+	3516065817,
+	3600352804,
+	4094571909,
+	275423344,
+	430227734,
+	506948616,
+	659060556,
+	883997877,
+	958139571,
+	1322822218,
+	1537002063,
+	1747873779,
+	1955562222,
+	2024104815,
+	2227730452,
+	2361852424,
+	2428436474,
+	2756734187,
+	3204031479,
+	3329325298
+]);
+/** Reusable SHA-224 / SHA-256 message schedule buffer `W_t` from RFC 6234 §6.2 step 1. */
+const SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+/** Internal SHA-224 / SHA-256 compression engine from RFC 6234 §6.2. */
+var SHA2_32B = class extends HashMD {
+	A = 0;
+	B = 0;
+	C = 0;
+	D = 0;
+	E = 0;
+	F = 0;
+	G = 0;
+	H = 0;
+	constructor(outputLen, IV) {
+		super(64, outputLen, 8, false);
+		this.A = IV[0] | 0;
+		this.B = IV[1] | 0;
+		this.C = IV[2] | 0;
+		this.D = IV[3] | 0;
+		this.E = IV[4] | 0;
+		this.F = IV[5] | 0;
+		this.G = IV[6] | 0;
+		this.H = IV[7] | 0;
+	}
+	get() {
+		const { A, B, C, D, E, F, G, H } = this;
+		return [
+			A,
+			B,
+			C,
+			D,
+			E,
+			F,
+			G,
+			H
+		];
+	}
+	set(A, B, C, D, E, F, G, H) {
+		this.A = A | 0;
+		this.B = B | 0;
+		this.C = C | 0;
+		this.D = D | 0;
+		this.E = E | 0;
+		this.F = F | 0;
+		this.G = G | 0;
+		this.H = H | 0;
+	}
+	_cloneInto(to) {
+		(to ||= new this.constructor()).set(...this.get());
+		return this._cloneIntoMeta(to);
+	}
+	process(view, offset) {
+		for (let i = 0; i < 16; i++, offset += 4) SHA256_W[i] = view.getUint32(offset, false);
+		for (let i = 16; i < 64; i++) {
+			const W15 = SHA256_W[i - 15];
+			const W2 = SHA256_W[i - 2];
+			const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+			const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
+			SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+		}
+		let { A, B, C, D, E, F, G, H } = this;
+		for (let i = 0; i < 64; i++) {
+			const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+			const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+			const T2 = (rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22)) + Maj(A, B, C) | 0;
+			H = G;
+			G = F;
+			F = E;
+			E = D + T1 | 0;
+			D = C;
+			C = B;
+			B = A;
+			A = T1 + T2 | 0;
+		}
+		A = A + this.A | 0;
+		B = B + this.B | 0;
+		C = C + this.C | 0;
+		D = D + this.D | 0;
+		E = E + this.E | 0;
+		F = F + this.F | 0;
+		G = G + this.G | 0;
+		H = H + this.H | 0;
+		this.set(A, B, C, D, E, F, G, H);
+	}
+	roundClean() {
+		clean(SHA256_W);
+	}
+	destroy() {
+		this.destroyed = true;
+		this.set(0, 0, 0, 0, 0, 0, 0, 0);
+		clean(this.buffer);
+	}
+};
+/** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */
+var _SHA256 = class extends SHA2_32B {
+	constructor() {
+		super(32, SHA256_IV);
+	}
+};
+/**
+* SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:
+*
+* - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.
+* - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.
+* - Each sha256 hash is executing 2^18 bit operations.
+* - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.
+* @param msg - message bytes to hash
+* @param opts - Reserved hash options.
+* @returns Digest bytes.
+* @example
+* Hash a message with SHA2-256.
+* ```ts
+* sha256(new Uint8Array([97, 98, 99]));
+* ```
+*/
+const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), /* @__PURE__ */ oidNist(1));
+//#endregion
+//#region src/backup/errors.ts
+var BackupControllerError = class extends Error {
+	category;
+	constructor(category, message) {
+		super(message);
+		this.name = "BackupControllerError";
+		this.category = category;
+	}
+};
+//#endregion
+//#region src/backup/controller.ts
+/**
+* The backup reconcile loop (design/backup.mdx "同步"): keeps the cloud file
+* `qntx-wallet-backup-<id>.json` in step with the vault. Single-flight — a trigger during a run
+* schedules exactly one rerun; `lock()` bumps a generation so a stale run never writes state, store
+* or cloud after that point.
+*
+* Security shape: the engine only ever moves ciphertext. The BEK stays in the enclave; the local
+* record is a digest/coverage baseline, not a key.
+*/
+const COLLECTION = "backup";
+const RECORD_KEY = "state";
+const FILE_PREFIX = "qntx-wallet-backup-";
+const FILE_SUFFIX = ".json";
+function fileName(id) {
+	return `${FILE_PREFIX}${id}${FILE_SUFFIX}`;
+}
+function digestOf(text) {
+	return bytesToHex(sha256(utf8ToBytes(text)));
+}
+function sorted(values) {
+	return [...values].sort();
+}
+function sameSet(a, b) {
+	return a.length === b.length && a.every((v, i) => v === b[i]);
+}
+const isObject$2 = (v) => typeof v === "object" && v !== null;
+const isStringArray = (v) => Array.isArray(v) && v.every((e) => typeof e === "string");
+/** Strict record validation — anything malformed reads as absent (and is logged). */
+function parseRecord(bytes) {
+	if (bytes === void 0) return;
+	try {
+		const value = JSON.parse(new TextDecoder().decode(bytes));
+		if (!isObject$2(value)) return;
+		const o = value;
+		const { id } = o;
+		const { digest } = o;
+		const { uploadedAt } = o;
+		const { walletIds } = o;
+		const { nostrKeyIds } = o;
+		if (typeof id !== "string" || !/^[0-9a-f]{32}$/.test(id)) return;
+		if (digest !== void 0 && (typeof digest !== "string" || !/^[0-9a-f]{64}$/.test(digest))) return;
+		if (uploadedAt !== void 0 && (typeof uploadedAt !== "number" || !Number.isSafeInteger(uploadedAt))) return;
+		if (!isStringArray(walletIds) || !isStringArray(nostrKeyIds)) return;
+		return {
+			id,
+			digest,
+			uploadedAt,
+			walletIds,
+			nostrKeyIds
+		};
+	} catch {
+		return;
+	}
+}
+var BackupController = class extends Controller {
+	wallet;
+	cloud;
+	now;
+	logger;
+	engineStore;
+	generation = 0;
+	current;
+	rerun = false;
+	/** Set by restore() before the store opens — written as a record on the first reconcile. */
+	pendingAdoption;
+	constructor(options) {
+		super({
+			name: "backup",
+			defaultState: () => defaultState()
+		});
+		this.wallet = options.wallet;
+		this.cloud = options.cloud;
+		this.now = options.now;
+		this.logger = options.logger;
+	}
+	async init() {
+		await Promise.resolve();
+	}
+	async destroy() {
+		this.generation += 1;
+		await Promise.resolve();
+	}
+	/** The engine hands over the store on unlock and takes it back on lock. */
+	setStore(store) {
+		this.engineStore = store;
+	}
+	/** Bumps the generation: an in-flight reconcile writes nothing after this point. */
+	lock() {
+		this.generation += 1;
+		this.engineStore = void 0;
+		this.update(() => defaultState());
+	}
+	trigger() {
+		this.triggerAsync();
+	}
+	async triggerAsync() {
+		try {
+			await this.reconcile();
+		} catch (error) {
+			this.logger.warn("backup reconcile trigger failed", error);
+		}
+	}
+	/** Explicit sync — awaits the run so callers see its outcome. */
+	async sync() {
+		await this.reconcile();
+	}
+	async enable(options) {
+		if (this.cloud === void 0 || !await this.cloud.available()) throw new BackupControllerError("unavailable", "the cloud store is unavailable");
+		await this.wallet.backup.enable(options);
+		await this.reconcileOrThrow();
+	}
+	async disable() {
+		await this.wallet.backup.disable();
+		await this.reconcileOrThrow();
+	}
+	/** Files under our prefix with a parseable header. */
+	async list() {
+		if (this.cloud === void 0) return [];
+		const names = (await this.cloud.list()).filter((n) => n.startsWith(FILE_PREFIX) && n.endsWith(FILE_SUFFIX));
+		const { cloud } = this;
+		const texts = await Promise.all(names.map(async (name) => cloud.read(name)));
+		const out = [];
+		for (const [index, name] of names.entries()) {
+			const text = texts[index];
+			if (text === void 0) continue;
+			try {
+				out.push({
+					name,
+					header: parseBackupHeader(text)
+				});
+			} catch {
+				this.logger.warn("backup file failed to parse", new Error(name));
+			}
+		}
+		return out;
+	}
+	async restore(options) {
+		if (this.cloud === void 0) throw new BackupControllerError("cloud", "no cloud store configured");
+		const text = await this.cloud.read(options.name);
+		if (text === void 0) throw new BackupControllerError("cloud", "backup file not found");
+		const id = idFromName(options.name);
+		if (id === void 0) throw new BackupControllerError("cloud", "unrecognized backup file name");
+		const wasUninitialized = this.wallet.getSnapshot().vault === "uninitialized";
+		if (wasUninitialized) this.pendingAdoption = {
+			id,
+			digest: digestOf(text)
+		};
+		let wallets;
+		try {
+			wallets = await this.wallet.backup.restore({
+				envelope: text,
+				backupFactor: options.backupFactor,
+				...options.factor === void 0 ? {} : { factor: options.factor }
+			});
+		} catch (error) {
+			this.pendingAdoption = void 0;
+			throw error;
+		}
+		const { backup } = this.wallet.getSnapshot();
+		if (!wasUninitialized && backup !== null && backup.id === id) {
+			const previous = await this.readRecord();
+			await this.writeRecord({
+				id,
+				digest: digestOf(text),
+				uploadedAt: previous?.uploadedAt,
+				walletIds: [],
+				nostrKeyIds: []
+			});
+		}
+		try {
+			await this.reconcile();
+		} catch {}
+		return wallets;
+	}
+	async reconcileOrThrow() {
+		await this.reconcile();
+		const { status, error } = this.getState();
+		if (status === "error" || status === "conflict" || status === "unavailable") throw new BackupControllerError(error ?? "cloud", `backup sync failed: ${status}`);
+	}
+	async readRecord() {
+		const bytes = await this.engineStore?.collection(COLLECTION).get(RECORD_KEY);
+		const record = parseRecord(bytes);
+		if (bytes !== void 0 && record === void 0) this.logger.warn("backup record failed to parse — treating as absent", /* @__PURE__ */ new Error(COLLECTION));
+		return record;
+	}
+	async writeRecord(record) {
+		await this.engineStore?.collection(COLLECTION).put(RECORD_KEY, new TextEncoder().encode(JSON.stringify(record)));
+	}
+	async deleteRecord() {
+		await this.engineStore?.collection(COLLECTION).delete(RECORD_KEY);
+	}
+	snapshot() {
+		return this.wallet.getSnapshot();
+	}
+	unprotected(snapshot, record) {
+		const covered = snapshot.backup !== null && record !== void 0 && record.id === snapshot.backup.id && record.digest !== void 0;
+		const wallets = snapshot.wallets.filter((w) => w.backup !== "mnemonic");
+		const keys = snapshot.nostr.keys.filter((k) => k.ref.kind === "standalone" && k.backedUp === false);
+		const walletIds = wallets.map((w) => w.walletId).filter((id) => !covered || !record.walletIds.includes(id));
+		const nostrKeyIds = keys.map((k) => k.publicKey).filter((id) => !covered || !record.nostrKeyIds.includes(id));
+		return {
+			walletIds: sorted(walletIds),
+			nostrKeyIds: sorted(nostrKeyIds)
+		};
+	}
+	coverage(snapshot) {
+		return {
+			walletIds: sorted(snapshot.wallets.map((w) => w.walletId)),
+			nostrKeyIds: sorted(snapshot.nostr.keys.filter((k) => k.ref.kind === "standalone").map((k) => k.publicKey))
+		};
+	}
+	setStatus(generation, status, error, record) {
+		if (generation !== this.generation) return;
+		const snapshot = this.snapshot();
+		this.update((state) => ({
+			...state,
+			status,
+			backup: snapshot.backup,
+			uploadedAt: record?.uploadedAt,
+			error,
+			unprotected: this.unprotected(snapshot, record)
+		}));
+	}
+	/**
+	* Single-flight: a trigger during a run flags exactly one rerun inside the same promise, so
+	* `sync()`/`enable()` await real convergence instead of a mid-run snapshot.
+	*/
+	async reconcile() {
+		if (this.current !== void 0) {
+			this.rerun = true;
+			return this.current;
+		}
+		this.current = (async () => {
+			try {
+				do {
+					this.rerun = false;
+					await this.pass(this.generation);
+				} while (this.rerun);
+			} finally {
+				this.current = void 0;
+			}
+		})();
+		return this.current;
+	}
+	async pass(generation) {
+		const snapshot = this.snapshot();
+		if (snapshot.vault !== "unlocked" || this.engineStore === void 0) return;
+		let record = await this.readRecord();
+		if (this.cloud === void 0 || !await this.cloud.available()) {
+			this.setStatus(generation, "unavailable", void 0, record);
+			return;
+		}
+		if (generation !== this.generation) return;
+		const adoption = this.pendingAdoption;
+		if (adoption !== void 0) {
+			this.pendingAdoption = void 0;
+			if (snapshot.backup?.id === adoption.id) {
+				record = {
+					id: adoption.id,
+					digest: adoption.digest,
+					uploadedAt: void 0,
+					walletIds: [],
+					nostrKeyIds: []
+				};
+				if (generation !== this.generation) return;
+				await this.writeRecord(record);
+			} else this.logger.warn("backup adoption dropped — the vault's backup key is not the file's", new Error(adoption.id));
+		}
+		const { backup } = snapshot;
+		if (backup === null) {
+			if (record !== void 0) try {
+				if (generation !== this.generation) return;
+				await this.cloud.delete(fileName(record.id));
+				if (generation !== this.generation) return;
+				await this.deleteRecord();
+			} catch (error) {
+				this.logger.warn("backup cloud delete failed — retrying next reconcile", error);
+				this.setStatus(generation, "error", "cloud", record);
+				return;
+			}
+			this.setStatus(generation, "off", void 0, void 0);
+			return;
+		}
+		const baseline = record !== void 0 && record.id === backup.id ? record.digest : void 0;
+		const cov = this.coverage(snapshot);
+		if (baseline !== void 0 && record !== void 0 && sameSet(cov.walletIds, record.walletIds) && sameSet(cov.nostrKeyIds, record.nostrKeyIds)) {
+			this.setStatus(generation, "synced", void 0, record);
+			return;
+		}
+		this.setStatus(generation, "syncing", void 0, record);
+		try {
+			const envelope = await this.wallet.backup.update();
+			if (generation !== this.generation) return;
+			const name = fileName(backup.id);
+			const remote = await this.cloud.read(name);
+			const digest = digestOf(envelope);
+			if (remote !== void 0 && digestOf(remote) !== baseline) {
+				this.setStatus(generation, "conflict", "conflict", record);
+				return;
+			}
+			if (generation !== this.generation) return;
+			await this.cloud.write(name, envelope);
+			if (await this.cloud.read(name) !== envelope) {
+				this.setStatus(generation, "error", "cloud", record);
+				return;
+			}
+			const next = {
+				id: backup.id,
+				digest,
+				uploadedAt: this.now(),
+				walletIds: cov.walletIds,
+				nostrKeyIds: cov.nostrKeyIds
+			};
+			if (generation !== this.generation) return;
+			await this.writeRecord(next);
+			if (record !== void 0 && record.id !== backup.id) try {
+				if (generation !== this.generation) return;
+				await this.cloud.delete(fileName(record.id));
+			} catch (error) {
+				this.logger.warn("stale backup file delete failed", error);
+			}
+			this.setStatus(generation, "synced", void 0, next);
+		} catch (error) {
+			if (generation !== this.generation) return;
+			this.logger.warn("backup reconcile failed", error);
+			this.setStatus(generation, "error", "cloud", record);
+		}
+	}
+};
+function defaultState() {
+	return {
+		status: "locked",
+		backup: null,
+		uploadedAt: void 0,
+		unprotected: {
+			walletIds: [],
+			nostrKeyIds: []
+		},
+		error: void 0
+	};
+}
+function idFromName(name) {
+	if (!name.startsWith(FILE_PREFIX) || !name.endsWith(FILE_SUFFIX)) return;
+	const id = name.slice(19, name.length - 5);
+	return /^[0-9a-f]{32}$/.test(id) ? id : void 0;
+}
+const NAME_MAX = 24;
+const PUBKEY_RE = /^[0-9a-f]{64}$/;
+const KNOWN_DOC_KEYS = /* @__PURE__ */ new Set([
+	"v",
+	"wallet",
+	"groups"
+]);
+const KNOWN_WALLET_KEYS = /* @__PURE__ */ new Set(["name", "updatedAt"]);
+const KNOWN_GROUP_KEYS = /* @__PURE__ */ new Set([
+	"index",
+	"name",
+	"hidden",
+	"boundPubkey",
+	"updatedAt"
+]);
+const isObject$1 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const isNonNegativeInt = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+const validName = (v) => v === void 0 || typeof v === "string" && v.trim().length > 0 && v.trim().length <= NAME_MAX;
+const trimmedName = (v) => typeof v === "string" ? v.trim() : void 0;
+/** Strict decode — any malformed shape, unknown key or duplicate index returns `undefined`. */
+function decodeMetaDoc(value) {
+	if (!isObject$1(value)) return;
+	for (const k of Object.keys(value)) if (!KNOWN_DOC_KEYS.has(k)) return;
+	if (value["v"] !== 1) return;
+	const { wallet } = value;
+	if (!isObject$1(wallet)) return;
+	for (const k of Object.keys(wallet)) if (!KNOWN_WALLET_KEYS.has(k)) return;
+	if (!validName(wallet["name"]) || !isNonNegativeInt(wallet["updatedAt"])) return;
+	const { groups } = value;
+	if (!Array.isArray(groups)) return;
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const item of groups) {
+		if (!isObject$1(item)) return;
+		for (const k of Object.keys(item)) if (!KNOWN_GROUP_KEYS.has(k)) return;
+		const { index } = item;
+		if (!isNonNegativeInt(index) || seen.has(index)) return;
+		seen.add(index);
+		if (!validName(item["name"]) || item["hidden"] !== true && item["hidden"] !== false) return;
+		const { boundPubkey } = item;
+		if (boundPubkey !== void 0 && (typeof boundPubkey !== "string" || !PUBKEY_RE.test(boundPubkey))) return;
+		if (!isNonNegativeInt(item["updatedAt"])) return;
+		const gName = trimmedName(item["name"]);
+		out.push({
+			index,
+			hidden: item["hidden"],
+			updatedAt: item["updatedAt"],
+			...gName === void 0 ? {} : { name: gName },
+			...boundPubkey === void 0 ? {} : { boundPubkey }
+		});
+	}
+	out.sort((a, b) => a.index - b.index);
+	const name = trimmedName(wallet["name"]);
+	return {
+		v: 1,
+		wallet: {
+			updatedAt: wallet["updatedAt"],
+			...name === void 0 ? {} : { name }
+		},
+		groups: out
+	};
+}
+/** UTF-8 JSON — `undefined` when the document exceeds the 64 KB limit. */
+function encodeMetaDoc(doc) {
+	const bytes = new TextEncoder().encode(JSON.stringify(doc));
+	return bytes.byteLength <= 65536 ? bytes : void 0;
+}
+function decodeMetaDocBytes(bytes) {
+	if (bytes.byteLength > 65536) return;
+	try {
+		return decodeMetaDoc(JSON.parse(new TextDecoder().decode(bytes)));
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/meta/errors.ts
+var MetaSyncError = class extends Error {
+	category;
+	constructor(category, message, cause) {
+		super(message, { cause });
+		this.name = "MetaSyncError";
+		this.category = category;
+	}
+};
+//#endregion
+//#region src/meta/controller.ts
+const META_SYNC_KIND = 30078;
+const PUBLISH_DEBOUNCE_MS = 2e3;
+/**
+* Wallet-metadata sync over kind-30078 addressable events: one NIP-44-encrypted document per
+* wallet, authored by its group-0 derived key. Pull always precedes publish in an unlock session —
+* replaceable events would otherwise let a stale local tree overwrite a newer remote document.
+* Debounced publishes are per wallet; a generation counter cancels in-flight write-backs on lock.
+*/
+var MetaSyncController = class extends Controller {
+	options;
+	generation = 0;
+	pulled = /* @__PURE__ */ new Set();
+	lastRemoteCreatedAt = /* @__PURE__ */ new Map();
+	lastExported = /* @__PURE__ */ new Map();
+	timers = /* @__PURE__ */ new Map();
+	inflight = /* @__PURE__ */ new Set();
+	accountsUnsubscribe;
+	constructor(options) {
+		super({
+			name: "metaSync",
+			defaultState: () => ({ wallets: {} })
+		});
+		this.options = options;
+	}
+	/** Unlocked: pull every wallet whose group-0 identity exists, then watch the tree. */
+	async init() {
+		const gen = ++this.generation;
+		this.accountsUnsubscribe = this.options.accounts.store.subscribe(() => {
+			this.onTreeChange();
+		});
+		await this.pullAll(gen);
+	}
+	async destroy() {
+		await this.lock();
+	}
+	/** Locked: cancel debounces and in-flight write-backs, forget the pull/publish bookkeeping. */
+	async lock() {
+		this.generation += 1;
+		this.accountsUnsubscribe?.();
+		this.accountsUnsubscribe = void 0;
+		for (const timer of this.timers.values()) clearTimeout(timer);
+		this.timers.clear();
+		this.pulled.clear();
+		this.lastRemoteCreatedAt.clear();
+		this.lastExported.clear();
+		this.inflight.clear();
+		this.update(() => ({ wallets: {} }));
+		await Promise.resolve();
+	}
+	/** Snapshot changed while unlocked: pull newly-seen wallets, drop removed ones. */
+	reconcile() {
+		if (this.options.metaSync === void 0) return;
+		const snap = this.options.wallet.getSnapshot();
+		const live = new Set(snap.wallets.map((w) => w.walletId));
+		const gen = this.generation;
+		for (const w of snap.wallets) if (this.getState().wallets[w.walletId] === void 0) this.pullOne(w.walletId, gen);
+		this.update((s) => {
+			const wallets = Object.fromEntries(Object.entries(s.wallets).filter(([walletId]) => live.has(walletId)));
+			return {
+				...s,
+				wallets
+			};
+		});
+	}
+	/** Manual re-pull of every wallet that can sync. */
+	async sync() {
+		await this.pullAll(this.generation);
+	}
+	async pullAll(gen) {
+		const snap = this.options.wallet.getSnapshot();
+		await Promise.all(snap.wallets.map(async (w) => this.pullOne(w.walletId, gen)));
+	}
+	async pubkeyFor(signer) {
+		return signer.getPublicKey();
+	}
+	signerFor(walletId) {
+		const snap = this.options.wallet.getSnapshot();
+		const ref = {
+			kind: "derived",
+			walletId,
+			groupIndex: 0
+		};
+		if (!snap.nostr.keys.some((k) => k.ref.kind === "derived" && k.ref.walletId === walletId && k.ref.groupIndex === 0)) return;
+		return this.options.nostr.signer(ref);
+	}
+	setStatus(walletId, status) {
+		this.update((s) => ({
+			...s,
+			wallets: {
+				...s.wallets,
+				[walletId]: status
+			}
+		}));
+	}
+	async pullOne(walletId, gen) {
+		const config = this.options.metaSync;
+		if (config === void 0 || this.inflight.has(walletId)) return;
+		const signer = this.signerFor(walletId);
+		if (signer === void 0) {
+			if (gen === this.generation) this.setStatus(walletId, { status: "unavailable" });
+			return;
+		}
+		this.inflight.add(walletId);
+		this.setStatus(walletId, { status: "syncing" });
+		try {
+			const pubkey = await this.pubkeyFor(signer);
+			const events = await config.relays.fetch(this.filterFor(pubkey, config.tag));
+			let remote;
+			let remoteSkipped = 0;
+			for (const e of events) {
+				if (!this.acceptableEvent(e, pubkey, config.tag)) {
+					remoteSkipped += 1;
+					continue;
+				}
+				if (remote === void 0 || e.created_at > remote.created_at) remote = e;
+			}
+			if (remote === void 0) {
+				const local = this.options.accounts.exportMeta(walletId);
+				const hasEdits = local.wallet.updatedAt > 0 || local.groups.some((g) => g.updatedAt > 0);
+				if (gen !== this.generation) return;
+				this.pulled.add(walletId);
+				this.rememberExport(walletId);
+				this.setStatus(walletId, { status: "synced" });
+				if (hasEdits) await this.publishNow(walletId, gen);
+			} else {
+				const decrypt = signer.nip44Decrypt;
+				const plaintext = decrypt === void 0 ? void 0 : await decrypt.call(signer, pubkey, remote.content).catch(() => void 0);
+				const doc = plaintext === void 0 ? void 0 : decodeMetaDocBytes(new TextEncoder().encode(plaintext));
+				if (doc === void 0) {
+					if (gen !== this.generation) return;
+					const error = plaintext !== void 0 && isUnsupportedDoc(plaintext) ? "unsupported" : "corrupt";
+					this.setStatus(walletId, {
+						status: "error",
+						error
+					});
+					this.options.logger.warn(`meta sync: unreadable remote doc (${error})`);
+					return;
+				}
+				const merge = this.options.accounts.mergeMeta(walletId, doc);
+				if (gen !== this.generation) return;
+				this.lastRemoteCreatedAt.set(walletId, remote.created_at);
+				this.pulled.add(walletId);
+				this.rememberExport(walletId);
+				this.setStatus(walletId, { status: "synced" });
+				if (merge.localNewer) await this.publishNow(walletId, gen);
+			}
+			if (remoteSkipped > 0) this.options.logger.warn(`meta sync: ignored ${remoteSkipped} invalid remote events`);
+		} catch (error) {
+			if (gen === this.generation) {
+				this.setStatus(walletId, {
+					status: "error",
+					error: categorizeSync(error)
+				});
+				this.options.logger.warn("meta sync pull failed", error);
+			}
+		} finally {
+			this.inflight.delete(walletId);
+		}
+	}
+	filterFor(pubkey, tag) {
+		return {
+			kinds: [META_SYNC_KIND],
+			authors: [pubkey],
+			"#d": [tag]
+		};
+	}
+	acceptableEvent(e, pubkey, tag) {
+		if (e.kind !== 30078 || e.pubkey !== pubkey || !verifyEvent(e)) return false;
+		const dTags = e.tags.filter((t) => t[0] === "d");
+		return dTags.length === 1 && dTags[0]?.[1] === tag;
+	}
+	/** Snapshot the wallet's exported doc — the debounce publishes only on a real change. */
+	rememberExport(walletId) {
+		try {
+			const doc = this.options.accounts.exportMeta(walletId);
+			this.lastExported.set(walletId, JSON.stringify(doc));
+		} catch {}
+	}
+	onTreeChange() {
+		if (this.options.metaSync === void 0) return;
+		for (const walletId of this.pulled) {
+			let current;
+			try {
+				current = JSON.stringify(this.options.accounts.exportMeta(walletId));
+			} catch {
+				continue;
+			}
+			if (current === this.lastExported.get(walletId)) continue;
+			this.lastExported.set(walletId, current);
+			const existing = this.timers.get(walletId);
+			if (existing !== void 0) clearTimeout(existing);
+			const gen = this.generation;
+			this.timers.set(walletId, setTimeout(() => {
+				this.timers.delete(walletId);
+				this.publishNow(walletId, gen);
+			}, PUBLISH_DEBOUNCE_MS));
+		}
+	}
+	async publishNow(walletId, gen) {
+		const config = this.options.metaSync;
+		if (config === void 0 || !this.pulled.has(walletId)) return;
+		const signer = this.signerFor(walletId);
+		if (signer === void 0) {
+			this.setStatus(walletId, { status: "unavailable" });
+			return;
+		}
+		try {
+			const bytes = encodeMetaDoc(this.options.accounts.exportMeta(walletId));
+			if (bytes === void 0) throw new MetaSyncError("internal", "meta doc exceeds 64 KB");
+			const encrypt = signer.nip44Encrypt;
+			if (encrypt === void 0) throw new MetaSyncError("internal", "signer lacks nip44 encryption");
+			const pubkey = await this.pubkeyFor(signer);
+			const content = await encrypt.call(signer, pubkey, new TextDecoder().decode(bytes));
+			const lastRemote = this.lastRemoteCreatedAt.get(walletId) ?? 0;
+			const created_at = Math.max(Math.floor(this.options.now() / 1e3), lastRemote + 1);
+			const event = await signer.signEvent({
+				pubkey,
+				kind: META_SYNC_KIND,
+				created_at,
+				tags: [["d", config.tag]],
+				content
+			});
+			if (gen !== this.generation) return;
+			await config.relays.publish(event);
+		} catch (error) {
+			if (gen === this.generation) {
+				this.setStatus(walletId, {
+					status: "error",
+					error: categorizeSync(error)
+				});
+				this.options.logger.warn("meta sync publish failed", error);
+			}
+		}
+	}
+};
+function categorizeSync(error) {
+	return error instanceof MetaSyncError ? error.category : "network";
+}
+/** A decrypted doc that parses as JSON with a numeric `v` above 1 is a newer schema, not garbage. */
+function isUnsupportedDoc(plaintext) {
+	try {
+		const doc = JSON.parse(plaintext);
+		return typeof doc === "object" && doc !== null && "v" in doc && typeof doc.v === "number" && doc.v > 1;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/payments/parse.ts
+/** Invoices with less than this much life left are treated as already expired. */
+const BOLT11_EXPIRY_GRACE_MS = 6e4;
+const invalid = (reason) => ({
+	kind: "invalid",
+	reason
+});
+/** BTC decimal `amount` → sats. At most 8 decimal places; must fit a safe integer. */
+function btcAmountSats(text) {
+	const match = /^(\d+)(?:\.(\d{1,8}))?$/.exec(text);
+	if (match === null) return;
+	const [, whole] = match;
+	if (whole === void 0) return;
+	const sats = BigInt(whole) * 100000000n + BigInt((match[2] ?? "").padEnd(8, "0") || "0");
+	return sats <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(sats) : void 0;
+}
+/**
+* BOLT11 → fields, network- and expiry-checked. `undefined` = not a bolt11 string; `"network"` /
+* `"expired"` / `"malformed"` are the failure modes.
+*/
+function bolt11Fields(text, options) {
+	let decoded;
+	try {
+		decoded = decodeBolt11(text);
+	} catch {
+		return;
+	}
+	const network = decoded.network === "mainnet" ? "mainnet" : decoded.network === "regtest" ? "regtest" : void 0;
+	if (network === void 0) return "network";
+	if (network !== options.network) return "network";
+	const expiresAt = (decoded.timestamp + decoded.expirySeconds) * 1e3;
+	if (expiresAt <= options.now + BOLT11_EXPIRY_GRACE_MS) return "expired";
+	return {
+		...decoded.amountMsat === void 0 ? {} : { amountSats: Math.ceil(Number(decoded.amountMsat) / 1e3) },
+		paymentHash: bytesToHex(decoded.paymentHash),
+		...decoded.description === void 0 ? {} : { description: decoded.description },
+		expiresAt
+	};
+}
+/** Spark address or sats/token invoice → options. `null` means not a spark input. */
+function sparkOptions(text, options) {
+	let decoded;
+	try {
+		decoded = decodeSparkAddress(text);
+	} catch {
+		return;
+	}
+	if (decoded.network !== options.network) return "network";
+	if (decoded.invoice === void 0) return [{
+		kind: "spark",
+		address: text
+	}];
+	if (decoded.invoice.expiresAt !== void 0 && decoded.invoice.expiresAt <= options.now) return "expired";
+	if (decoded.invoice.payment?.type === "tokens") return "token";
+	let parsed;
+	try {
+		parsed = parseSparkInvoice(text, {
+			network: options.network,
+			now: options.now
+		});
+	} catch {
+		return "malformed";
+	}
+	const { payment } = parsed.fields;
+	return [{
+		kind: "spark-invoice",
+		invoice: text,
+		...payment?.type === "sats" && payment.amount !== void 0 ? { amountSats: payment.amount } : {},
+		...parsed.fields.memo === void 0 ? {} : { memo: parsed.fields.memo },
+		...parsed.fields.expiresAt === void 0 ? {} : { expiresAt: parsed.fields.expiresAt }
+	}];
+}
+/** Does `address` decode under the other network? Used only to classify a rejection. */
+function decodesOnOtherNetwork(address, options) {
+	try {
+		bitcoinAddressScript(address, options.network === "mainnet" ? "regtest" : "mainnet");
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** BIP-21 URI → request. Only the `spark=` and `lightning=` payment methods are supported. */
+function bip21Parse(text, options) {
+	const q = text.indexOf("?");
+	const address = text.slice(8, q === -1 ? void 0 : q);
+	const params = /* @__PURE__ */ new Map();
+	if (q !== -1) for (const pair of text.slice(q + 1).split("&")) {
+		const eq = pair.indexOf("=");
+		if (eq === -1) return invalid("malformed");
+		let key;
+		let value;
+		try {
+			key = decodeURIComponent(pair.slice(0, eq)).toLowerCase();
+			value = decodeURIComponent(pair.slice(eq + 1));
+		} catch {
+			return invalid("malformed");
+		}
+		if (params.has(key)) return invalid("malformed");
+		if (key.startsWith("req-") && !BIP21_KNOWN_REQ_PARAMS.has(key)) return invalid("malformed");
+		params.set(key, value);
+	}
+	const options_ = [];
+	let declaredSats;
+	const spark = params.get("spark");
+	if (spark !== void 0) {
+		const parsed = sparkOptions(spark, options);
+		if (parsed === void 0 || parsed === "malformed") return invalid("malformed");
+		if (parsed === "token") return {
+			kind: "unsupported",
+			format: "spark-token-invoice"
+		};
+		if (parsed === "network" || parsed === "expired") return invalid(parsed);
+		options_.push(...parsed);
+		const sats = parsed.find((o) => o.kind === "spark-invoice")?.amountSats;
+		if (sats !== void 0) {
+			if (declaredSats !== void 0 && declaredSats !== sats) return invalid("amount-mismatch");
+			declaredSats = sats;
+		}
+	}
+	const lightning = params.get("lightning");
+	if (lightning !== void 0) {
+		const parsed = bolt11Fields(lightning, options);
+		if (parsed === void 0 || parsed === "malformed") return invalid("malformed");
+		if (parsed === "network" || parsed === "expired") return invalid(parsed);
+		options_.push({
+			kind: "lightning",
+			invoice: lightning,
+			...parsed.amountSats === void 0 ? {} : { amountSats: parsed.amountSats },
+			paymentHash: parsed.paymentHash,
+			...parsed.description === void 0 ? {} : { description: parsed.description },
+			expiresAt: parsed.expiresAt
+		});
+		if (parsed.amountSats !== void 0) {
+			if (declaredSats !== void 0 && declaredSats !== parsed.amountSats) return invalid("amount-mismatch");
+			declaredSats = parsed.amountSats;
+		}
+	}
+	if (address.length > 0) {
+		try {
+			bitcoinAddressScript(address, options.network);
+		} catch {
+			return invalid(decodesOnOtherNetwork(address, options) ? "network" : "malformed");
+		}
+		options_.push({
+			kind: "bitcoin",
+			address
+		});
+	}
+	const declaredAmount = params.get("amount");
+	if (declaredAmount !== void 0) {
+		const sats = btcAmountSats(declaredAmount);
+		if (sats === void 0) return invalid("malformed");
+		if (declaredSats !== void 0 && declaredSats !== sats) return invalid("amount-mismatch");
+		declaredSats = sats;
+	}
+	if (options_.length === 0) {
+		if (params.has("lno")) return {
+			kind: "unsupported",
+			format: "bolt12"
+		};
+		if (params.has("sp")) return {
+			kind: "unsupported",
+			format: "silent-payment"
+		};
+		return invalid("malformed");
+	}
+	return {
+		kind: "request",
+		request: {
+			options: options_,
+			...declaredSats === void 0 ? {} : { amountSats: declaredSats },
+			...params.get("label") === void 0 ? {} : { label: params.get("label") ?? "" },
+			...params.get("message") === void 0 ? {} : { message: params.get("message") ?? "" }
+		}
+	};
+}
+const BIP21_KNOWN_REQ_PARAMS = /* @__PURE__ */ new Set([
+	"req-amount",
+	"req-label",
+	"req-message"
+]);
+/** `input` → PaymentParse. Never throws: every failure is a structured result. */
+function parsePayment(input, options) {
+	try {
+		const text = input.trim();
+		if (/^nostr\+walletconnect:/i.test(text)) return {
+			kind: "unsupported",
+			format: "nostr-wallet-connect"
+		};
+		const stripped = text.toLowerCase().startsWith("lightning:") ? text.slice(10) : text;
+		if (/^bitcoin:/i.test(stripped)) return bip21Parse(`bitcoin:${stripped.slice(stripped.indexOf(":") + 1)}`, options);
+		const bolt11 = bolt11Fields(stripped, options);
+		if (bolt11 === "network" || bolt11 === "expired" || bolt11 === "malformed") return invalid(bolt11);
+		if (bolt11 !== void 0) return {
+			kind: "request",
+			request: {
+				options: [{
+					kind: "lightning",
+					invoice: stripped,
+					...bolt11.amountSats === void 0 ? {} : { amountSats: bolt11.amountSats },
+					paymentHash: bolt11.paymentHash,
+					...bolt11.description === void 0 ? {} : { description: bolt11.description },
+					expiresAt: bolt11.expiresAt
+				}],
+				...bolt11.amountSats === void 0 ? {} : { amountSats: bolt11.amountSats }
+			}
+		};
+		const spark = sparkOptions(stripped, options);
+		if (spark === "token") return {
+			kind: "unsupported",
+			format: "spark-token-invoice"
+		};
+		if (spark === "network" || spark === "expired" || spark === "malformed") return invalid(spark);
+		if (spark !== void 0) return {
+			kind: "request",
+			request: { options: spark }
+		};
+		if (/^(lnurlp|lnurlw):/i.test(stripped)) {
+			const rest = stripped.slice(stripped.indexOf("://") + 3);
+			const url = `${(rest.split(/[/?#]/, 1)[0] ?? "").toLowerCase().endsWith(".onion") ? "http" : "https"}://${rest}`;
+			if (new URL(url).searchParams.get("tag") === "login") return {
+				kind: "unsupported",
+				format: "lnurl-auth"
+			};
+			return {
+				kind: "lnurl",
+				url
+			};
+		}
+		if (/^keyauth:/i.test(stripped)) return {
+			kind: "unsupported",
+			format: "lnurl-auth"
+		};
+		if (!stripped.includes(":") && stripped.includes("@")) return {
+			kind: "lnurl",
+			url: lightningAddressUrl(stripped),
+			address: stripped
+		};
+		if (/^lno1[02-9ac-hj-np-z]+$/i.test(stripped)) return {
+			kind: "unsupported",
+			format: "bolt12"
+		};
+		try {
+			const url = decodeLnurl(stripped);
+			if (new URL(url).searchParams.get("tag") === "login") return {
+				kind: "unsupported",
+				format: "lnurl-auth"
+			};
+			return {
+				kind: "lnurl",
+				url
+			};
+		} catch {}
+		try {
+			bitcoinAddressScript(stripped, options.network);
+			return {
+				kind: "request",
+				request: { options: [{
+					kind: "bitcoin",
+					address: stripped
+				}] }
+			};
+		} catch {
+			if (decodesOnOtherNetwork(stripped, options)) return invalid("network");
+		}
+		return { kind: "unrecognized" };
+	} catch {
+		return invalid("malformed");
+	}
+}
+//#endregion
+//#region src/spark/errors.ts
+var SparkControllerError = class extends Error {
+	category;
+	constructor(category, message, cause) {
+		super(message, { cause });
+		this.name = "SparkControllerError";
+		this.category = category;
+	}
+};
+/** Maps a thrown client/kernel error into a category without leaking payloads. */
+function categorize(error) {
+	const name = error instanceof Error ? error.name : "";
+	const message = error instanceof Error ? error.message : "";
+	if (/approval|denied|rejected/i.test(message)) return /required/i.test(message) ? "approval-required" : "rejected";
+	if (/insufficient|not enough|balance/i.test(message)) return "insufficient-funds";
+	if (name === "SparkRequestError" || /fetch|network|timeout|unavailable|closed/i.test(message)) return "network";
+	return "internal";
+}
+//#endregion
+//#region src/payments/errors.ts
+var PaymentError = class extends Error {
+	category;
+	constructor(category, message, cause) {
+		super(message, { cause });
+		this.name = "PaymentError";
+		this.category = category;
+	}
+};
+//#endregion
+//#region src/payments/pay.ts
+/**
+* Executes one parsed payment option. Every input validation happens before the approval round — a
+* `PaymentError` here never consumed a verification. `SparkControllerError` and `WalletError` pass
+* through untouched.
+*/
+async function pay(context, params) {
+	const { spark } = context;
+	const ref = params.account;
+	let result;
+	switch (params.option.kind) {
+		case "spark":
+			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "spark payment: amountSats is required");
+			result = {
+				kind: "spark",
+				transfer: await spark.send(ref, {
+					receiver: params.option.address,
+					amountSats: params.amountSats,
+					verify: params.verify
+				})
+			};
+			break;
+		case "spark-invoice": {
+			if (params.option.expiresAt !== void 0 && params.option.expiresAt <= context.now()) throw new PaymentError("rejected", "spark invoice expired");
+			if (params.option.amountSats !== void 0 && params.amountSats !== void 0 && params.amountSats !== params.option.amountSats) throw new PaymentError("invalid-input", "spark invoice: amountSats conflicts with the invoice amount");
+			const invoiceAmount = params.option.amountSats === void 0 ? params.amountSats : void 0;
+			result = {
+				kind: "spark",
+				transfer: await spark.paySparkInvoice(ref, {
+					invoice: params.option.invoice,
+					...invoiceAmount === void 0 ? {} : { amountSats: invoiceAmount },
+					verify: params.verify
+				})
+			};
+			break;
+		}
+		case "lightning":
+			if (params.option.amountSats === void 0 && params.amountSats === void 0) throw new PaymentError("invalid-input", "amountless invoice: amountSats is required");
+			if (params.maxFeeSats === void 0) throw new PaymentError("invalid-input", "lightning payment: maxFeeSats is required");
+			if (params.option.expiresAt <= context.now() + 6e4) throw new PaymentError("rejected", "lightning invoice expired");
+			if (params.option.amountSats !== void 0 && params.amountSats !== void 0 && params.amountSats !== params.option.amountSats) throw new PaymentError("invalid-input", "amountSats conflicts with the invoice amount");
+			result = {
+				kind: "lightning",
+				payment: await spark.payInvoice(ref, {
+					invoice: params.option.invoice,
+					maxFeeSats: params.maxFeeSats,
+					...params.option.amountSats === void 0 && params.amountSats !== void 0 ? { amountSats: params.amountSats } : {},
+					verify: params.verify
+				})
+			};
+			break;
+		case "lnurl-pay": {
+			const { request } = params.option;
+			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "lnurl-pay: amountSats is required");
+			if (params.maxFeeSats === void 0) throw new PaymentError("invalid-input", "lnurl-pay: maxFeeSats is required");
+			const amountMsat = params.amountSats * 1e3;
+			if (amountMsat < request.minSendableMsat || amountMsat > request.maxSendableMsat) throw new PaymentError("rejected", "lnurl-pay: amount outside the service's range");
+			if (request.commentAllowed === 0 && params.comment !== void 0) throw new PaymentError("rejected", "lnurl-pay: comments not accepted by this service");
+			if (params.comment !== void 0 && params.comment.length > request.commentAllowed) throw new PaymentError("rejected", "lnurl-pay: comment exceeds the service's limit");
+			let requested;
+			try {
+				requested = await requestInvoice(request, {
+					fetch: context.fetch,
+					network: ref.network,
+					amountMsat,
+					...params.comment === void 0 ? {} : { comment: params.comment }
+				});
+			} catch (error) {
+				if (error instanceof PaymentError || error instanceof SparkControllerError) throw error;
+				throw new PaymentError("network", "lnurl-pay: invoice request failed", error);
+			}
+			result = {
+				kind: "lightning",
+				payment: await spark.payInvoice(ref, {
+					invoice: requested.invoice,
+					maxFeeSats: params.maxFeeSats,
+					verify: params.verify
+				})
+			};
+			break;
+		}
+		case "lnurl-withdraw": {
+			const { request } = params.option;
+			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "lnurl-withdraw: amountSats is required");
+			const amountMsat = params.amountSats * 1e3;
+			if (amountMsat < request.minWithdrawableMsat || amountMsat > request.maxWithdrawableMsat) throw new PaymentError("rejected", "lnurl-withdraw: amount outside the service's range");
+			const invoice = await spark.createInvoice(ref, {
+				amountSats: params.amountSats,
+				memo: request.defaultDescription
+			});
+			try {
+				await submitWithdraw(request, {
+					fetch: context.fetch,
+					invoice: invoice.invoice
+				});
+			} catch (error) {
+				if (error instanceof PaymentError || error instanceof SparkControllerError) throw error;
+				throw new PaymentError("network", "lnurl-withdraw: submission failed", error);
+			}
+			result = {
+				kind: "lnurl-withdraw",
+				invoice
+			};
+			break;
+		}
+		case "bitcoin":
+			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "bitcoin payment: amountSats is required");
+			result = {
+				kind: "withdraw",
+				exit: await spark.withdraw(ref, {
+					address: params.option.address,
+					speed: params.speed ?? "MEDIUM",
+					verify: params.verify,
+					amountSats: params.amountSats,
+					...params.maxFeeSats === void 0 ? {} : { maxFeeSats: params.maxFeeSats }
+				})
+			};
+	}
+	return result;
+}
+//#endregion
+//#region src/payments/resolve.ts
+/**
+* `parsePayment` plus LNURL dereferencing: an `lnurl` result is fetched and turned into a concrete
+* `lnurl-pay` / `lnurl-withdraw` request (`tag=login` endpoints report as unsupported). Network
+* failures throw `PaymentError("network")` — remote error bodies never enter the message.
+*/
+async function resolvePayment(input, options) {
+	const parsed = parsePayment(input, options);
+	if (parsed.kind !== "lnurl") return parsed;
+	let resolved;
+	try {
+		resolved = await resolveLnurl(parsed.url, { fetch: options.fetch });
+	} catch {
+		throw new PaymentError("network", "lnurl: resolution failed");
+	}
+	if (resolved.tag === "payRequest") return {
+		kind: "request",
+		request: { options: [{
+			kind: "lnurl-pay",
+			request: resolved,
+			...parsed.address === void 0 ? {} : { address: parsed.address }
+		}] }
+	};
+	if (resolved.tag === "withdrawRequest") return {
+		kind: "request",
+		request: { options: [{
+			kind: "lnurl-withdraw",
+			request: resolved
+		}] }
+	};
+	return {
+		kind: "unsupported",
+		format: "lnurl-auth"
+	};
+}
+//#endregion
+//#region src/payments/zap.ts
+/** Everything up to payment: resolve LNURL, sign the 9734, request the invoice. */
+async function prepareZap(params, context) {
+	const amountMsat = params.amountSats * 1e3;
+	if (!Number.isSafeInteger(params.amountSats) || params.amountSats <= 0 || !Number.isSafeInteger(amountMsat)) throw new PaymentError("invalid-input", "zap amount is not a positive safe integer");
+	try {
+		const resolved = await resolveLnurl(params.recipient.lightning, { fetch: context.fetch });
+		if (resolved.tag !== "payRequest") throw new PaymentError("rejected", "recipient is not an LNURL-pay endpoint");
+		if (!resolved.allowsNostr || resolved.nostrPubkey === void 0) throw new PaymentError("rejected", "LNURL service does not accept nostr zaps");
+		if (amountMsat < resolved.minSendableMsat || amountMsat > resolved.maxSendableMsat) throw new PaymentError("rejected", "zap amount outside the service's bounds");
+		if (params.comment !== void 0) {
+			if (resolved.commentAllowed === 0) throw new PaymentError("rejected", "the service does not accept comments");
+			if (params.comment.length > resolved.commentAllowed) throw new PaymentError("rejected", "comment exceeds the service's limit");
+		}
+		const lnurl = params.recipient.lightning.toLowerCase().startsWith("lnurl1") ? params.recipient.lightning.toLowerCase() : encodeLnurl(lightningAddressUrl(params.recipient.lightning));
+		const base = {
+			amount: amountMsat,
+			relays: [...params.relays],
+			comment: params.comment,
+			lnurl
+		};
+		const unsigned = {
+			..."event" in params.recipient ? makeZapRequest({
+				event: params.recipient.event,
+				...base
+			}) : makeZapRequest({
+				pubkey: params.recipient.pubkey,
+				...base
+			}),
+			pubkey: await params.signer.getPublicKey()
+		};
+		const zapRequest = await params.signer.signEvent(unsigned);
+		if (!verifyEvent(zapRequest) || !signedMatchesUnsigned(zapRequest, unsigned)) throw new PaymentError("rejected", "signer returned a zap request that does not match");
+		const { invoice } = await requestInvoice(resolved, {
+			fetch: context.fetch,
+			network: params.network,
+			amountMsat,
+			...params.comment === void 0 ? {} : { comment: params.comment },
+			zapRequest: JSON.stringify(zapRequest)
+		});
+		const decoded = decodeBolt11(invoice);
+		const expiresAt = (decoded.timestamp + decoded.expirySeconds) * 1e3;
+		if (expiresAt <= context.now() + 6e4) throw new PaymentError("rejected", "zap invoice expires too soon");
+		const eventId = "event" in params.recipient ? params.recipient.event.id : void 0;
+		return {
+			zapRequest,
+			invoice,
+			paymentHash: bytesToHex(decoded.paymentHash),
+			expiresAt,
+			amountSats: params.amountSats,
+			receiptPubkey: bytesToHex(resolved.nostrPubkey),
+			recipientPubkey: "event" in params.recipient ? params.recipient.event.pubkey : params.recipient.pubkey,
+			...eventId === void 0 ? {} : { eventId },
+			...params.comment === void 0 ? {} : { comment: params.comment },
+			lightning: params.recipient.lightning
+		};
+	} catch (error) {
+		if (error instanceof PaymentError) throw error;
+		if (error instanceof SparkInputError || error instanceof Error && error.cause instanceof SparkInputError) throw new PaymentError("rejected", "zap failed invoice validation");
+		throw new PaymentError(categorizePayment(error), "zap failed");
+	}
+}
+/**
+* Pays a prepared zap through the controller's approve-first path. A nearly-expired invoice is
+* rejected before approval — the user may have sat on the confirm screen since `prepareZap`.
+*/
+async function payZap(spark, account, prepared, options) {
+	if (prepared.expiresAt <= options.now() + 6e4) throw new PaymentError("rejected", "zap invoice expired");
+	return spark.payInvoice(account, {
+		invoice: prepared.invoice,
+		maxFeeSats: options.maxFeeSats,
+		verify: options.verify,
+		note: {
+			kind: "zap",
+			recipientPubkey: prepared.recipientPubkey,
+			...prepared.eventId === void 0 ? {} : { eventId: prepared.eventId },
+			...prepared.comment === void 0 ? {} : { comment: prepared.comment },
+			lightning: prepared.lightning
+		}
+	});
+}
+function categorizePayment(error) {
+	return categorize(error) === "network" ? "network" : "rejected";
+}
+//#endregion
+//#region src/spark/notes.ts
+const HEX64 = /^[0-9a-f]{64}$/;
+const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const NOTE_FIELDS = /* @__PURE__ */ new Set([
+	"kind",
+	"recipientPubkey",
+	"eventId",
+	"comment",
+	"lightning"
+]);
+/** Strict read-side validation: anything off-shape is `undefined`, never a throw. */
+function parsePaymentNote(value) {
+	if (!isObject(value)) return;
+	for (const field of Object.keys(value)) if (!NOTE_FIELDS.has(field)) return;
+	const { kind, recipientPubkey, eventId, comment, lightning } = value;
+	if (kind !== "zap") return;
+	if (typeof recipientPubkey !== "string" || !HEX64.test(recipientPubkey)) return;
+	if (eventId !== void 0 && (typeof eventId !== "string" || !HEX64.test(eventId))) return;
+	if (comment !== void 0 && (typeof comment !== "string" || comment.length > 2e3)) return;
+	if (typeof lightning !== "string" || lightning.length === 0) return;
+	return {
+		kind: "zap",
+		recipientPubkey,
+		...eventId === void 0 ? {} : { eventId },
+		...comment === void 0 ? {} : { comment },
+		lightning
+	};
+}
+function encodePaymentNote(note) {
+	return new TextEncoder().encode(JSON.stringify(note));
+}
+//#endregion
+//#region src/spark/exit-chain-codec.ts
+/**
+* SparkExitChain persistence codec: JSON with Uint8Arrays tagged `{ $b64: "…" }` — small and
+* explicit rather than schema-bound, so upstream field additions survive a round-trip.
+*/
+function encodeValue(value) {
+	if (value instanceof Uint8Array) return { $b64: base64.encode(value) };
+	if (Array.isArray(value)) return value.map(encodeValue);
+	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, encodeValue(v)]));
+	return value;
+}
+function decodeValue(value) {
+	if (Array.isArray(value)) return value.map(decodeValue);
+	if (typeof value === "object" && value !== null) {
+		const entries = Object.entries(value);
+		const b64 = entries.length === 1 && entries[0]?.[0] === "$b64" ? entries[0][1] : void 0;
+		if (typeof b64 === "string") return base64.decode(b64);
+		return Object.fromEntries(entries.map(([k, v]) => [k, decodeValue(v)]));
+	}
+	return value;
+}
+function encodeExitChain(chain) {
+	return new TextEncoder().encode(JSON.stringify(encodeValue(chain)));
+}
+function decodeExitChain(bytes) {
+	return decodeValue(JSON.parse(new TextDecoder().decode(bytes)));
+}
+//#endregion
+//#region src/spark/store.ts
+const ALL = "__all__";
+/**
+* SparkStore over one EngineCollection: chains keyed by leafId, plus an index record listing them
+* (`exitChains` is a full listing — the port has no secondary index).
+*/
+function sparkStore(col) {
+	const readIndex = async () => {
+		const index = await col.get(ALL);
+		if (index === void 0) return [];
+		const parsed = JSON.parse(new TextDecoder().decode(index));
+		if (!Array.isArray(parsed)) return [];
+		return parsed.filter((v) => typeof v === "string");
+	};
+	const writeIndex = async (ids) => {
+		await col.put(ALL, new TextEncoder().encode(JSON.stringify(ids)));
+	};
+	return {
+		exitChains: async () => {
+			const ids = await readIndex();
+			const chains = [];
+			for (const leafId of ids) {
+				const record = await col.get(leafId);
+				if (record !== void 0) chains.push(decodeExitChain(record));
+			}
+			return chains;
+		},
+		putExitChains: async (chains) => {
+			const ids = await readIndex();
+			const set = new Set(ids);
+			for (const chain of chains) {
+				await col.put(chain.leafId, encodeExitChain(chain));
+				set.add(chain.leafId);
+			}
+			await writeIndex([...set]);
+		},
+		deleteExitChains: async (leafIds) => {
+			const ids = await readIndex();
+			const drop = new Set(leafIds);
+			for (const leafId of leafIds) await col.delete(leafId);
+			await writeIndex(ids.filter((leafId) => !drop.has(leafId)));
+		}
+	};
+}
+//#endregion
+//#region src/spark/controller.ts
+const key = (ref) => `${ref.walletId}:${ref.groupIndex}:${ref.network}`;
+/** TransferId: the client and SO expect a UUIDv7 — mint it from the injected clock+random. */
+const transferId = (random, now) => uuidv7(random, now);
+/** Catch-up sync for one pass: claim every pending transfer, then read balance and identity. */
+async function resync(client, log) {
+	const { failures } = await client.transfers.claimPending();
+	for (const failure of failures) log(failure.transferId, failure.error);
+	const [balance, identity] = await Promise.all([client.balance(), client.identityPublicKey()]);
+	return {
+		balance,
+		identity
+	};
+}
+/** Abortable backoff — resolves early when the signal aborts; removes its listener. */
+async function eventsBackoff(failures, signal) {
+	await new Promise((resolve) => {
+		const timer = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, Math.min(2 ** failures, 30) * 1e3);
+		const onAbort = () => {
+			clearTimeout(timer);
+			resolve();
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+var SparkController = class extends Controller {
+	options;
+	engineStore;
+	accounts = /* @__PURE__ */ new Map();
+	clients = /* @__PURE__ */ new Map();
+	recentSeq = /* @__PURE__ */ new Map();
+	aborts = /* @__PURE__ */ new Map();
+	constructor(options) {
+		super({
+			name: "spark",
+			defaultState: () => ({ accounts: {} })
+		});
+		this.options = options;
+	}
+	/** Engine calls this with the open store on unlock; `undefined` on lock. */
+	setStore(store) {
+		this.engineStore = store;
+	}
+	/**
+	* Declarative account set: refs not yet tracked are patched `locked` and started when the store
+	* is open; tracked refs no longer listed are stopped and dropped; running refs stay untouched.
+	*/
+	setAccounts(refs) {
+		const wanted = new Map(refs.map((ref) => [key(ref), ref]));
+		for (const k of this.accounts.keys()) if (!wanted.has(k)) {
+			this.accounts.delete(k);
+			this.stopAccount(k);
+		}
+		for (const [k, ref] of wanted) {
+			if (!this.accounts.has(k)) {
+				this.accounts.set(k, ref);
+				this.patch(k, { status: "locked" });
+			}
+			if (this.engineStore !== void 0 && !this.clients.has(k)) this.startAccount(ref);
+		}
+	}
+	async init() {
+		for (const ref of this.accounts.values()) this.startAccount(ref);
+		await Promise.resolve();
+	}
+	async destroy() {
+		await this.lockAll();
+	}
+	stopAccount(k) {
+		this.aborts.get(k)?.abort();
+		this.aborts.delete(k);
+		this.clients.get(k)?.close();
+		this.clients.delete(k);
+		this.update((s) => {
+			if (!(k in s.accounts)) return s;
+			const { [k]: _dropped, ...rest } = s.accounts;
+			return {
+				...s,
+				accounts: rest
+			};
+		});
+	}
+	/** Lock: abort every event loop, close every client, reset state. */
+	async lockAll() {
+		for (const [k, client] of this.clients) {
+			this.aborts.get(k)?.abort();
+			client.close();
+		}
+		this.aborts.clear();
+		this.clients.clear();
+		this.engineStore = void 0;
+		await Promise.resolve();
+		this.update((s) => Object.keys(s.accounts).length === 0 ? s : {
+			...s,
+			accounts: Object.fromEntries(Object.keys(s.accounts).map((k) => [k, { status: "locked" }]))
+		});
+	}
+	startAccount(ref) {
+		const k = key(ref);
+		if (this.engineStore === void 0 || this.clients.has(k)) return;
+		this.patch(k, { status: "connecting" });
+		try {
+			const col = this.engineStore.collection(`spark-exit-chains:${k}`);
+			const client = this.options.createClient({
+				ref,
+				store: sparkStore(col),
+				signer: this.options.spark.signer(ref),
+				fetch: this.options.fetch
+			});
+			this.clients.set(k, client);
+			const abort = new AbortController();
+			this.aborts.set(k, abort);
+			this.runEvents(k, client, abort.signal, ref.network);
+		} catch (error) {
+			this.patch(k, {
+				status: "error",
+				errorCategory: categorize(error)
+			});
+			this.options.logger.warn("spark account failed to start", error);
+		}
+	}
+	runEvents(k, client, signal, network) {
+		const loop = async () => {
+			let failures = 0;
+			while (!signal.aborted) {
+				try {
+					const { balance, identity } = await resync(client, (transferId, error) => {
+						this.options.logger.warn(`spark catch-up claim failed for ${transferId} (${categorize(error)})`);
+					});
+					if (signal.aborted) return;
+					this.patch(k, {
+						balanceSats: balance,
+						status: "ready",
+						identityPublicKey: [...identity].map((b) => b.toString(16).padStart(2, "0")).join(""),
+						sparkAddress: encodeSparkAddress({
+							network,
+							identityPublicKey: identity
+						})
+					});
+					this.refreshRecent(k, client);
+					const iterator = client.events(signal)[Symbol.asyncIterator]();
+					let open = true;
+					while (open) {
+						const item = await iterator.next();
+						if (item.done === true) open = false;
+						else {
+							const event = item.value;
+							if (event.type === "transfer") try {
+								await this.handleTransfer(client, event, signal, k);
+								failures = 0;
+							} catch (error) {
+								if (!(error instanceof SparkInputError)) throw error;
+								this.options.logger.warn(`spark claim of ${event.transferId} rejected (${categorize(error)})`);
+								failures = 0;
+							}
+						}
+					}
+					failures += 1;
+					this.options.logger.warn("spark event stream ended — resubscribing");
+				} catch (error) {
+					if (signal.aborted) return;
+					failures += 1;
+					if (failures === 1) this.patch(k, {
+						status: "error",
+						errorCategory: categorize(error)
+					});
+					this.options.logger.warn("spark event stream failed — resubscribing", error);
+				}
+				await eventsBackoff(failures, signal);
+			}
+		};
+		loop();
+	}
+	async handleTransfer(client, event, signal, k) {
+		if (event.direction === "incoming") await client.transfers.claim(event.transferId, { signal });
+		this.patch(k, { balanceSats: await client.balance() });
+		this.refreshRecent(k, client);
+	}
+	notesCollection(k) {
+		return this.engineStore?.collection(`spark-notes:${k}`);
+	}
+	/** Attach locally written notes to a history page; malformed records warn and drop. */
+	async withNotes(k, payments) {
+		const col = this.notesCollection(k);
+		if (col === void 0) return payments;
+		return Promise.all(payments.map(async (payment) => {
+			const bytes = await col.get(payment.id);
+			if (bytes === void 0) return payment;
+			let note;
+			try {
+				note = parsePaymentNote(JSON.parse(new TextDecoder().decode(bytes)));
+			} catch {
+				note = void 0;
+			}
+			if (note === void 0) {
+				this.options.logger.warn(`spark note record for ${payment.id} ignored: malformed`, /* @__PURE__ */ new Error("malformed payment note"));
+				return payment;
+			}
+			return {
+				...payment,
+				note
+			};
+		}));
+	}
+	/**
+	* Refill `recent` from the first history page. A failure keeps the previous page — it never
+	* touches `status`/`errorCategory`. A per-account sequence keeps a slower older refresh from
+	* overwriting a newer one.
+	*/
+	async refreshRecent(k, client) {
+		const seq = (this.recentSeq.get(k) ?? 0) + 1;
+		this.recentSeq.set(k, seq);
+		try {
+			const { payments } = await client.transfers.history({ limit: 20 });
+			const items = await this.withNotes(k, payments);
+			if (this.recentSeq.get(k) === seq && this.clients.get(k) === client) this.patch(k, { recent: items });
+		} catch (error) {
+			this.options.logger.warn(`spark recent refresh failed for ${k}`, error);
+		}
+	}
+	patch(k, delta) {
+		this.update((s) => ({
+			...s,
+			accounts: {
+				...s.accounts,
+				[k]: {
+					status: "locked",
+					...s.accounts[k],
+					...delta
+				}
+			}
+		}));
+	}
+	clientFor(ref) {
+		const client = this.clients.get(key(ref));
+		if (client === void 0) throw new SparkControllerError("internal", "account is not connected");
+		return client;
+	}
+	async guarded(fn) {
+		try {
+			return await fn();
+		} catch (error) {
+			if (error instanceof SparkControllerError) throw error;
+			throw new SparkControllerError(categorize(error), "spark action failed", error);
+		}
+	}
+	/**
+	* One-off balance + activity probe for an account that may not be running: builds a temporary
+	* client through the same factory on the account's own exit-chain collection (nothing diverges —
+	* `balance()`/`transfers.history` never write it), reads, and closes it in `finally`.
+	*/
+	async inspect(ref) {
+		return this.guarded(async () => {
+			if (this.engineStore === void 0) throw new SparkControllerError("internal", "engine store is not open");
+			const k = key(ref);
+			const running = this.clients.get(k);
+			if (running !== void 0) {
+				const [balance, page] = await Promise.all([running.balance(), running.transfers.history({ limit: 1 })]);
+				return {
+					balanceSats: balance,
+					used: balance > 0 || page.payments.length > 0
+				};
+			}
+			const client = this.options.createClient({
+				ref,
+				store: sparkStore(this.engineStore.collection(`spark-exit-chains:${k}`)),
+				signer: this.options.spark.signer(ref),
+				fetch: this.options.fetch
+			});
+			try {
+				const [balance, page] = await Promise.all([client.balance(), client.transfers.history({ limit: 1 })]);
+				return {
+					balanceSats: balance,
+					used: balance > 0 || page.payments.length > 0
+				};
+			} finally {
+				client.close();
+			}
+		});
+	}
+	/** History for one account: a client page merged with locally written notes by id. */
+	async history(ref, options) {
+		return this.guarded(async () => {
+			const { payments, nextOffset } = await this.clientFor(ref).transfers.history({
+				...options?.limit === void 0 ? {} : { limit: options.limit },
+				...options?.offset === void 0 ? {} : { offset: options.offset }
+			});
+			return {
+				items: await this.withNotes(key(ref), payments),
+				nextOffset
+			};
+		});
+	}
+	async send(ref, params) {
+		return this.guarded(async () => {
+			const client = this.clientFor(ref);
+			const receiver = decodeSparkAddress(params.receiver);
+			if (receiver.network !== ref.network) throw new SparkControllerError("rejected", "receiver address is on a different network");
+			const identity = receiver.identityPublicKey;
+			await this.options.spark.approve({
+				account: ref,
+				intent: {
+					kind: "transfer",
+					receivers: [{
+						identityPublicKey: identity,
+						amountSats: params.amountSats
+					}]
+				},
+				verify: params.verify
+			});
+			const transfer = await client.transfers.send({
+				receiver: params.receiver,
+				amountSats: params.amountSats,
+				transferId: transferId(this.options.random, this.options.now)
+			});
+			this.refreshRecent(key(ref), client);
+			return transfer;
+		});
+	}
+	async registerLightningAddress(ref, params) {
+		const signer = this.options.spark.signer(ref);
+		try {
+			return await registerLightningAddress({
+				...params,
+				fetch: this.options.fetch,
+				signer
+			});
+		} catch (error) {
+			throw error instanceof SparkControllerError ? error : new SparkControllerError("internal", "registration failed");
+		}
+	}
+	async unregisterLightningAddress(ref, params) {
+		const signer = this.options.spark.signer(ref);
+		try {
+			await unregisterLightningAddress({
+				...params,
+				fetch: this.options.fetch,
+				signer
+			});
+		} catch (error) {
+			throw error instanceof SparkControllerError ? error : new SparkControllerError("internal", "unregistration failed");
+		}
+	}
+	async payInvoice(ref, params) {
+		return this.guarded(async () => {
+			const client = this.clientFor(ref);
+			await this.options.spark.approve({
+				account: ref,
+				intent: {
+					kind: "lightning",
+					invoice: params.invoice,
+					...params.amountSats === void 0 ? {} : { amountSats: params.amountSats },
+					maxFeeSats: params.maxFeeSats
+				},
+				verify: params.verify
+			});
+			const payment = await client.lightning.pay({
+				invoice: params.invoice,
+				maxFeeSats: params.maxFeeSats,
+				...params.amountSats === void 0 ? {} : { amountSats: params.amountSats },
+				transferId: transferId(this.options.random, this.options.now)
+			});
+			if (params.note !== void 0) try {
+				await this.notesCollection(key(ref))?.put(payment.transferId, encodePaymentNote(params.note));
+			} catch (error) {
+				this.options.logger.warn("spark note write failed", error);
+			}
+			this.refreshRecent(key(ref), client);
+			return payment;
+		});
+	}
+	/**
+	* Pays a Spark invoice address. The approval intent mirrors `send`: receiver identity and amount
+	* come from the parsed invoice (the supplied `amountSats` fills an open invoice). Then
+	* `client.invoices.pay` executes it.
+	*/
+	async paySparkInvoice(ref, params) {
+		return this.guarded(async () => {
+			const client = this.clientFor(ref);
+			const parsed = parseSparkInvoice(params.invoice, {
+				network: ref.network,
+				now: this.options.now()
+			});
+			const invoicePayment = parsed.fields.payment;
+			if (invoicePayment !== void 0 && invoicePayment.type !== "sats") throw new SparkControllerError("rejected", "spark invoice: only sats invoices are supported");
+			if (invoicePayment?.type === "sats" && invoicePayment.amount !== void 0 && params.amountSats !== void 0 && params.amountSats !== invoicePayment.amount) throw new SparkControllerError("rejected", "spark invoice: amountSats conflicts with the invoice amount");
+			const amountSats = invoicePayment?.type === "sats" && invoicePayment.amount !== void 0 ? invoicePayment.amount : params.amountSats;
+			if (amountSats === void 0) throw new SparkControllerError("rejected", "spark invoice: amountless invoice requires amountSats");
+			await this.options.spark.approve({
+				account: ref,
+				intent: {
+					kind: "transfer",
+					receivers: [{
+						identityPublicKey: parsed.receiverIdentityPublicKey,
+						amountSats
+					}]
+				},
+				verify: params.verify
+			});
+			const result = await client.invoices.pay(params.invoice, {
+				amount: amountSats,
+				transferId: transferId(this.options.random, this.options.now)
+			});
+			this.refreshRecent(key(ref), client);
+			if (typeof result === "string") throw new SparkControllerError("internal", "unexpected token invoice result");
+			return result;
+		});
+	}
+	async createInvoice(ref, params) {
+		return this.guarded(async () => this.clientFor(ref).lightning.createInvoice({
+			amountSats: params.amountSats,
+			...params.memo === void 0 ? {} : { memo: params.memo }
+		}));
+	}
+	async receiveAddress(ref) {
+		const state = this.getState().accounts[key(ref)];
+		await Promise.resolve();
+		return state?.sparkAddress;
+	}
+	/**
+	* Cooperative exit to an L1 address. The client exits `amountSats` of leaves and the payout is
+	* `amountSats - fee`, so the approval intent carries the PAYOUT: `amountSats: exit - fee` and
+	* `maxFeeSats: fee` — the kernel matches the exit output against the intent, not the leaf total.
+	*/
+	async withdraw(ref, params) {
+		return this.guarded(async () => {
+			const client = this.clientFor(ref);
+			try {
+				bitcoinAddressScript(params.address, ref.network);
+			} catch {
+				throw new SparkControllerError("rejected", "withdrawal address is not on this network");
+			}
+			const exitAmount = params.amountSats ?? await client.balance();
+			const fee = (await client.withdrawals.quoteCooperativeExit({
+				address: params.address,
+				amountSats: exitAmount
+			})).fees[params.speed === "FAST" ? "fast" : params.speed === "MEDIUM" ? "medium" : "slow"];
+			if (params.maxFeeSats !== void 0 && params.maxFeeSats < fee) throw new SparkControllerError("rejected", "maxFeeSats below the quoted fee");
+			if (fee >= exitAmount) throw new SparkControllerError("insufficient-funds", "exit fee meets or exceeds the amount");
+			await this.options.spark.approve({
+				account: ref,
+				intent: {
+					kind: "exit",
+					address: params.address,
+					amountSats: exitAmount - fee,
+					maxFeeSats: fee
+				},
+				verify: params.verify
+			});
+			const exit = await client.withdrawals.cooperativeExit({
+				address: params.address,
+				speed: params.speed,
+				maxFeeSats: fee,
+				amountSats: exitAmount,
+				transferId: transferId(this.options.random, this.options.now)
+			});
+			this.refreshRecent(key(ref), client);
+			return exit;
+		});
+	}
+};
+//#endregion
+//#region src/engine.ts
+/**
+* Composition root: wires the Wallet's lock state to the SparkController's lifecycle. Unlocked →
+* open the EngineStore and start every declared account; locked → abort event loops, close every
+* client, close the store and reset account state. Transitions are serialized on one promise chain,
+* so an unlock→lock flip can never overlap a still-opening store.
+*/
+function createWalletEngine(options) {
+	const backup = new BackupController({
+		wallet: options.wallet,
+		cloud: options.cloud,
+		now: options.now,
+		logger: options.logger
+	});
+	const controller = new SparkController({
+		spark: options.sparkApis ?? spark(options.wallet),
+		fetch: options.fetch,
+		random: options.random,
+		now: options.now,
+		logger: options.logger,
+		createClient: ({ ref, store, signer, fetch }) => createSparkClient({
+			network: ref.network,
+			signer,
+			store,
+			fetch
+		})
+	});
+	const accounts = new AccountTreeController({
+		wallet: options.wallet,
+		spark: controller,
+		sparkNetwork: options.sparkNetwork,
+		logger: options.logger,
+		now: options.now
+	});
+	const metaSync = new MetaSyncController({
+		wallet: options.wallet,
+		accounts,
+		nostr: { signer: (ref) => nostr(options.wallet).signer(ref) },
+		metaSync: options.metaSync,
+		logger: options.logger,
+		now: options.now
+	});
+	let chain = Promise.resolve();
+	let store;
+	let started = false;
+	const transition = async () => {
+		const unlocked = options.wallet.getSnapshot().vault === "unlocked";
+		if (unlocked && !started) {
+			started = true;
+			try {
+				store = await options.openStore();
+			} catch (error) {
+				started = false;
+				store = void 0;
+				options.logger.warn("engine store failed to open", error);
+				return;
+			}
+			controller.setStore(store);
+			backup.setStore(store);
+			accounts.setStore(store);
+			backup.trigger();
+			await accounts.init();
+			await controller.init();
+			await metaSync.init();
+		} else if (!unlocked && started) {
+			started = false;
+			await metaSync.lock();
+			await accounts.lock();
+			await controller.lockAll();
+			controller.setStore(void 0);
+			const s = store;
+			store = void 0;
+			await s?.close();
+		}
+	};
+	const snapshotListener = () => {
+		if (options.wallet.getSnapshot().vault === "unlocked") {
+			backup.trigger();
+			accounts.reconcile();
+			metaSync.reconcile();
+		} else backup.lock();
+	};
+	const schedule = () => {
+		const previous = chain;
+		chain = (async () => {
+			try {
+				await previous;
+				await transition();
+			} catch (error) {
+				options.logger.warn("engine lock transition failed", error);
+			}
+		})();
+	};
+	const unsubscribe = options.wallet.subscribe(() => {
+		schedule();
+		snapshotListener();
+	});
+	schedule();
+	return {
+		spark: controller,
+		accounts,
+		metaSync,
+		backup,
+		zaps: {
+			prepare: async (params) => prepareZap(params, {
+				fetch: options.fetch,
+				now: options.now
+			}),
+			pay: async (account, prepared, payOptions) => payZap(controller, account, prepared, {
+				...payOptions,
+				now: options.now
+			})
+		},
+		payments: {
+			parse: (input, network) => parsePayment(input, {
+				network,
+				now: options.now()
+			}),
+			resolve: async (input, network) => resolvePayment(input, {
+				network,
+				now: options.now(),
+				fetch: options.fetch
+			}),
+			pay: async (params) => pay({
+				spark: controller,
+				fetch: options.fetch,
+				now: options.now
+			}, params)
+		},
+		unsubscribe
+	};
+}
+//#endregion
+//#region src/backup/memory.ts
+const tick = Promise.resolve();
+/** In-memory CloudStore for tests and the playground; swap the Map for cross-engine sharing. */
+function createMemoryCloudStore(backing) {
+	const files = backing ?? /* @__PURE__ */ new Map();
+	let reachable = true;
+	return {
+		available: async () => {
+			await tick;
+			return reachable;
+		},
+		list: async () => {
+			await tick;
+			return [...files.keys()].sort();
+		},
+		read: async (name) => {
+			await tick;
+			return files.get(name);
+		},
+		write: async (name, text) => {
+			await tick;
+			files.set(name, text);
+		},
+		delete: async (name) => {
+			await tick;
+			files.delete(name);
+		},
+		setReachable: (v) => {
+			reachable = v;
+		}
+	};
+}
+//#endregion
+export { AccountTreeController, AccountTreeError, BackupController, BackupControllerError, Controller, EngineStoreError, MetaSyncController, MetaSyncError, PaymentError, SparkController, SparkControllerError, createEventBus, createMemoryCloudStore, createMemoryEngineStore, createWalletEngine, decodeExitChain, encodeExitChain, parsePayment, payZap, prepareZap, resolvePayment, sparkStore };
+
+//# sourceMappingURL=index.mjs.map