@qntx/wallet-engine 0.5.2 → 0.6.0

package/dist/index.mjs

@@ -1,22 +1,23 @@
+import { A as parseWith, M as INSTALL_ID_HEADER, c as networkById, i as servedNetworksResponse, t as networksPath, u as esploraBasePath, x as rpcPath } from "./contract-D5pguqiZ.mjs";
 import { createStore } from "zustand/vanilla";
+import { Address, OutScript, Transaction } from "@scure/btc-signer";
 import { SparkInputError, bitcoinAddressScript, createSparkClient, decodeBolt11, decodeSparkAddress, encodeSparkAddress, parseSparkInvoice, uuidv7 } from "@qntx/spark";
+import { BITCOIN_NETWORKS, bitcoinAddressFromXpub, bitcoinNetwork, bitcoinPubkeyFromXpub, decodeBitcoinPsbt } from "@qntx/wallet-chains/bitcoin";
+import { checksumEvmAddress, decodeEvm, isEvmAddress } from "@qntx/wallet-chains/evm";
+import { PROGRAM_IDS, decodeSolana, isSolanaAddress, netAfterTransferFee, parseMintExtensions } from "@qntx/wallet-chains/solana";
+import { WalletError, parseBackupHeader } from "@qntx/wallet";
+import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
+import { decodeLnurl, encodeLnurl, lightningAddressUrl, registerLightningAddress, requestInvoice, resolveLnurl, submitWithdraw, unregisterLightningAddress } from "@qntx/spark/lnurl";
+import { signedMatchesUnsigned, verifyEvent } from "@qntx/nostr";
+import { makeZapRequest } from "@qntx/nostr/nips/nip57";
 import { nostr } from "@qntx/wallet/nostr";
 import { spark } from "@qntx/wallet/spark";
 import { createPublicClient, decodeFunctionResult, encodeFunctionData, fallback, http, isAddress, isHex, numberToHex } from "viem";
-import { bitcoinAddressFromXpub, bitcoinNetwork, bitcoinPubkeyFromXpub, decodeBitcoinPsbt } from "@qntx/wallet-chains/bitcoin";
 import { chains } from "@qntx/wallet/chains";
 import { sha256 } from "@noble/hashes/sha2.js";
-import { Address, OutScript, Transaction } from "@scure/btc-signer";
-import { checksumEvmAddress, decodeEvm } from "@qntx/wallet-chains/evm";
-import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
-import { parseBackupHeader } from "@qntx/wallet";
-import { signedMatchesUnsigned, verifyEvent } from "@qntx/nostr";
 import { base64, hex } from "@scure/base";
 import { p2wpkh } from "@scure/btc-signer/payment.js";
 import { selectUTXO } from "@scure/btc-signer/utxo.js";
-import { decodeLnurl, encodeLnurl, lightningAddressUrl, registerLightningAddress, requestInvoice, resolveLnurl, submitWithdraw, unregisterLightningAddress } from "@qntx/spark/lnurl";
-import { makeZapRequest } from "@qntx/nostr/nips/nip57";
-import { PROGRAM_IDS, decodeSolana, netAfterTransferFee, parseMintExtensions } from "@qntx/wallet-chains/solana";
 import { getSetComputeUnitLimitInstruction, getSetComputeUnitPriceInstruction } from "@solana-program/compute-budget";
 import { getTransferSolInstruction } from "@solana-program/system";
 import { TOKEN_PROGRAM_ADDRESS, findAssociatedTokenPda, getCreateAssociatedTokenIdempotentInstruction, getTransferCheckedInstruction } from "@solana-program/token";
@@ -133,6 +134,1146 @@ function createMemoryEngineStore(backing) {
 	};
 }
 //#endregion
+//#region src/addresses/errors.ts
+var AddressBookError = class extends Error {
+	category;
+	constructor(category, message) {
+		super(message);
+		this.name = "AddressBookError";
+		this.category = category;
+	}
+};
+//#endregion
+//#region src/addresses/normalize.ts
+/**
+* The canonical form of `address` for its family — EIP-55 for EVM, the re-encoded form for bitcoin
+* (accepted on any known bitcoin network, since a contact is not tied to the wallet's network) and
+* Spark (identity key only, no invoice fields) — or `undefined` when it is not a valid address.
+*/
+function normalizeAddress(family, address) {
+	try {
+		if (family === "evm") return isEvmAddress(address) ? checksumEvmAddress(address) : void 0;
+		if (family === "solana") return isSolanaAddress(address) ? address : void 0;
+		if (family === "spark") {
+			const decoded = decodeSparkAddress(address);
+			return encodeSparkAddress({
+				network: decoded.network,
+				identityPublicKey: decoded.identityPublicKey
+			});
+		}
+		for (const network of Object.values(BITCOIN_NETWORKS)) try {
+			const codec = Address(network.params);
+			return codec.encode(codec.decode(address));
+		} catch {}
+		return;
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/addresses/record.ts
+/**
+* The address-book record shared by the controller, the sync merge and the metadata document: a
+* live entry, or a tombstone that carries a deletion to the other devices.
+*/
+const isTombstone = (record) => "deleted" in record;
+const isFamily = (v) => v === "evm" || v === "solana" || v === "bitcoin" || v === "spark";
+const ENTRY_KEYS = /* @__PURE__ */ new Set([
+	"id",
+	"name",
+	"family",
+	"address",
+	"note",
+	"createdAt",
+	"updatedAt"
+]);
+const TOMBSTONE_KEYS = /* @__PURE__ */ new Set([
+	"id",
+	"deleted",
+	"updatedAt"
+]);
+const isObject$12 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const isNonNegativeInt$2 = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+/** Trimmed name, or `undefined` when it is not 1 to {@link NAME_MAX} characters. */
+const cleanName = (raw) => {
+	const name = raw.trim();
+	return name.length > 0 && name.length <= 32 ? name : void 0;
+};
+/** Trimmed note; an empty one means no note. `undefined` return with `ok: false` when too long. */
+const cleanNote = (raw) => {
+	const note = raw?.trim();
+	if (note === void 0 || note.length === 0) return {
+		ok: true,
+		note: void 0
+	};
+	return note.length <= 120 ? {
+		ok: true,
+		note
+	} : { ok: false };
+};
+const hasOnly = (value, keys) => Object.keys(value).every((k) => keys.has(k));
+/**
+* Strict decode with the controller's rules; the address is re-normalized. Anything else is
+* `undefined`.
+*/
+function decodeRecord(value) {
+	if (!isObject$12(value) || typeof value["id"] !== "string" || !isNonNegativeInt$2(value["updatedAt"])) return;
+	if ("deleted" in value) return value["deleted"] === true && hasOnly(value, TOMBSTONE_KEYS) ? {
+		id: value["id"],
+		deleted: true,
+		updatedAt: value["updatedAt"]
+	} : void 0;
+	const { family, name, address, note } = value;
+	if (!hasOnly(value, ENTRY_KEYS) || !isFamily(family) || typeof name !== "string" || typeof address !== "string" || !isNonNegativeInt$2(value["createdAt"]) || note !== void 0 && typeof note !== "string") return;
+	const cleanedName = cleanName(name);
+	const normalized = normalizeAddress(family, address);
+	const cleanedNote = cleanNote(note);
+	if (cleanedName === void 0 || normalized === void 0 || !cleanedNote.ok || note !== void 0 && cleanedNote.note === void 0) return;
+	return {
+		id: value["id"],
+		name: cleanedName,
+		family,
+		address: normalized,
+		...cleanedNote.note === void 0 ? {} : { note: cleanedNote.note },
+		createdAt: value["createdAt"],
+		updatedAt: value["updatedAt"]
+	};
+}
+const serialized = (record) => JSON.stringify(record);
+/** The winner of two versions of one id: larger `updatedAt`, then the larger serialization. */
+function pickWinner(a, b) {
+	if (a.updatedAt !== b.updatedAt) return a.updatedAt > b.updatedAt ? a : b;
+	return serialized(a) >= serialized(b) ? a : b;
+}
+const pruneTombstones = (records, now) => records.filter((r) => !isTombstone(r) || now - r.updatedAt <= 7776e6);
+/** Newest first, id as the tiebreak, so every device orders (and truncates) the same way. */
+const newestFirst = (a, b) => b.updatedAt - a.updatedAt || (a.id < b.id ? -1 : 1);
+/** Drops the oldest tombstones until at most `max` records remain, or no tombstone is left. */
+function evictTombstones(records, max) {
+	const excess = records.length - max;
+	if (excess <= 0) return records;
+	const oldest = new Set(records.filter(isTombstone).sort((a, b) => a.updatedAt - b.updatedAt || (a.id < b.id ? -1 : 1)).slice(0, excess).map((r) => r.id));
+	return records.filter((r) => !oldest.has(r.id));
+}
+/** {@link mergeRecords}, also counting the live entries the cap forced out. */
+function mergeWithReport(local, remote, now) {
+	const byId = /* @__PURE__ */ new Map();
+	for (const record of [...local, ...remote]) {
+		const existing = byId.get(record.id);
+		byId.set(record.id, existing === void 0 ? record : pickWinner(existing, record));
+	}
+	const live = /* @__PURE__ */ new Map();
+	const kept = [];
+	for (const record of [...pruneTombstones([...byId.values()], now)].sort(newestFirst)) {
+		if (isTombstone(record)) {
+			kept.push(record);
+			continue;
+		}
+		const key = `${record.family}:${record.address}`;
+		if (!live.has(key)) {
+			live.set(key, record);
+			kept.push(record);
+		}
+	}
+	const evicted = evictTombstones(kept, 128);
+	return {
+		records: [...evicted.slice(0, 128)].sort((a, b) => a.id < b.id ? -1 : 1),
+		droppedLive: evicted.slice(128).filter((r) => !isTombstone(r)).length
+	};
+}
+//#endregion
+//#region src/addresses/controller.ts
+/**
+* Address book: named recipients, validated and normalized per chain family, persisted in the
+* engine store and cleared from memory on lock. Deletions are kept as tombstones so they reach the
+* other devices; `syncEntries`/`merge` are the whole surface the metadata sync needs. Request risk
+* checks treat its addresses as known.
+*/
+const COLLECTION$3 = "contacts";
+const entriesOf = (records) => Object.fromEntries(records.flatMap((r) => isTombstone(r) ? [] : [[r.id, r]]));
+var AddressBookController = class extends Controller {
+	options;
+	engineStore;
+	/** Every record, tombstones included, by id. */
+	records = /* @__PURE__ */ new Map();
+	constructor(options) {
+		super({
+			name: "address-book",
+			defaultState: () => ({ entries: {} })
+		});
+		this.options = options;
+	}
+	async init() {
+		const store = await this.options.openStore();
+		this.engineStore = store;
+		const collection = store.collection(COLLECTION$3);
+		const keys = await collection.list();
+		const rows = await Promise.all(keys.map(async (key) => collection.get(key)));
+		const records = /* @__PURE__ */ new Map();
+		for (const raw of rows) {
+			if (raw === void 0) continue;
+			const record = decodeRecord(JSON.parse(new TextDecoder().decode(raw)));
+			if (record === void 0) this.options.logger.warn("address book record skipped: malformed");
+			else records.set(record.id, record);
+		}
+		this.records = records;
+		this.update(() => ({ entries: entriesOf([...records.values()]) }));
+	}
+	async destroy() {
+		this.lock();
+		await Promise.resolve();
+	}
+	lock() {
+		this.engineStore = void 0;
+		this.records = /* @__PURE__ */ new Map();
+		this.update(() => ({ entries: {} }));
+	}
+	/** Entries and tombstones, for the metadata document. */
+	syncEntries() {
+		return [...this.records.values()].sort((a, b) => a.id < b.id ? -1 : 1);
+	}
+	/**
+	* Merges records from another device (last writer wins, tombstones win over older entries).
+	* Returns whether anything local changed and whether the merged set holds something `remote`
+	* lacks, i.e. whether the remote copy needs a newer publish.
+	*/
+	async merge(remote) {
+		const store = this.requireStore();
+		const before = JSON.stringify(this.syncEntries());
+		const { records: merged, droppedLive } = mergeWithReport(this.syncEntries(), remote, this.options.now());
+		if (droppedLive > 0) this.options.logger.warn(`address book sync: ${droppedLive} contacts dropped, over the 128-record cap`);
+		const remoteSorted = JSON.stringify([...remote].sort((a, b) => a.id < b.id ? -1 : 1));
+		const localNewer = JSON.stringify(merged) !== remoteSorted;
+		if (JSON.stringify(merged) === before) return {
+			changed: false,
+			localNewer
+		};
+		const collection = store.collection(COLLECTION$3);
+		const next = new Map(merged.map((r) => [r.id, r]));
+		await Promise.all([...merged.map(async (r) => collection.put(r.id, new TextEncoder().encode(JSON.stringify(r)))), ...[...this.records.keys()].filter((id) => !next.has(id)).map(async (id) => collection.delete(id))]);
+		this.records = next;
+		this.update(() => ({ entries: entriesOf(merged) }));
+		return {
+			changed: true,
+			localNewer
+		};
+	}
+	async add(params) {
+		const store = this.requireStore();
+		const name = cleanName(params.name);
+		if (name === void 0) throw new AddressBookError("invalid-input", `name must be 1 to 32 characters`);
+		const note = this.checkedNote(params.note);
+		const address = normalizeAddress(params.family, params.address.trim());
+		if (address === void 0) throw new AddressBookError("invalid-input", `not a valid ${params.family} address`);
+		if (Object.values(this.getState().entries).some((e) => e.family === params.family && e.address === address)) throw new AddressBookError("duplicate", "this address is already in the address book");
+		if (this.records.size >= 128) {
+			const kept = evictTombstones([...this.records.values()], 127);
+			if (kept.length >= 128) throw new AddressBookError("limit", `the address book holds at most 128 contacts`);
+			const keptIds = new Set(kept.map((r) => r.id));
+			await Promise.all([...this.records.keys()].filter((id) => !keptIds.has(id)).map(async (id) => store.collection(COLLECTION$3).delete(id)));
+			this.records = new Map(kept.map((r) => [r.id, r]));
+		}
+		const now = this.options.now();
+		const entry = {
+			id: `contact-${[...this.options.random(8)].map((b) => b.toString(16).padStart(2, "0")).join("")}`,
+			name,
+			family: params.family,
+			address,
+			...note === void 0 ? {} : { note },
+			createdAt: now,
+			updatedAt: now
+		};
+		await this.persist(store, entry);
+		return entry;
+	}
+	async rename(id, name) {
+		const store = this.requireStore();
+		const existing = this.requireEntry(id);
+		const cleaned = cleanName(name);
+		if (cleaned === void 0) throw new AddressBookError("invalid-input", `name must be 1 to 32 characters`);
+		const entry = {
+			...existing,
+			name: cleaned,
+			updatedAt: this.options.now()
+		};
+		await this.persist(store, entry);
+		return entry;
+	}
+	/** Sets or clears (empty or `undefined`) the note. */
+	async setNote(id, note) {
+		const store = this.requireStore();
+		const existing = this.requireEntry(id);
+		const cleaned = this.checkedNote(note);
+		const { note: _previous, ...rest } = existing;
+		const entry = {
+			...rest,
+			...cleaned === void 0 ? {} : { note: cleaned },
+			updatedAt: this.options.now()
+		};
+		await this.persist(store, entry);
+		return entry;
+	}
+	/** Removes the entry, leaving a tombstone so other devices drop it too. */
+	async remove(id) {
+		const store = this.requireStore();
+		this.requireEntry(id);
+		await this.persist(store, {
+			id,
+			deleted: true,
+			updatedAt: this.options.now()
+		});
+	}
+	checkedNote(note) {
+		const cleaned = cleanNote(note);
+		if (!cleaned.ok) throw new AddressBookError("invalid-input", `note must be at most 120 characters`);
+		return cleaned.note;
+	}
+	requireEntry(id) {
+		const entry = this.getState().entries[id];
+		if (entry === void 0) throw new AddressBookError("not-found", `unknown contact ${id}`);
+		return entry;
+	}
+	async persist(store, record) {
+		await store.collection(COLLECTION$3).put(record.id, new TextEncoder().encode(JSON.stringify(record)));
+		this.records.set(record.id, record);
+		this.update(() => ({ entries: entriesOf([...this.records.values()]) }));
+	}
+	requireStore() {
+		if (this.engineStore === void 0) throw new AddressBookError("locked", "the address book requires an unlocked vault");
+		return this.engineStore;
+	}
+};
+//#endregion
+//#region src/spark/errors.ts
+var SparkControllerError = class extends Error {
+	category;
+	constructor(category, message, cause) {
+		super(message, { cause });
+		this.name = "SparkControllerError";
+		this.category = category;
+	}
+};
+/** Maps a thrown client/kernel error into a category without leaking payloads. */
+function categorize(error) {
+	const name = error instanceof Error ? error.name : "";
+	const message = error instanceof Error ? error.message : "";
+	if (/approval|denied|rejected/i.test(message)) return /required/i.test(message) ? "approval-required" : "rejected";
+	if (/insufficient|not enough|balance/i.test(message)) return "insufficient-funds";
+	if (name === "SparkRequestError" || /fetch|network|timeout|unavailable|closed/i.test(message)) return "network";
+	return "internal";
+}
+const feeCheck = (amountSats, maxFeeSats) => maxFeeSats !== void 0 && maxFeeSats >= amountSats ? ["fee-exceeds-amount"] : [];
+//#endregion
+//#region src/payments/errors.ts
+var PaymentError = class extends Error {
+	category;
+	constructor(category, message, cause) {
+		super(message, { cause });
+		this.name = "PaymentError";
+		this.category = category;
+	}
+};
+//#endregion
+//#region src/payments/pay.ts
+const lightningDetails = (invoice) => {
+	const decoded = decodeBolt11(invoice);
+	return {
+		payee: bytesToHex(decoded.payee),
+		expiresAt: (decoded.timestamp + decoded.expirySeconds) * 1e3
+	};
+};
+/**
+* Validates one parsed payment option and fixes everything the approval needs — including the
+* LNURL-pay invoice, fetched here exactly once. Every input validation happens before the approval
+* round, so a `PaymentError` here never consumed a verification. `lnurl-withdraw` receives funds
+* and has its own entry, {@link withdrawLnurl}.
+*/
+async function preparePay(context, params) {
+	const ref = params.account;
+	const { network } = ref;
+	if (params.option.kind === "lnurl-withdraw") throw new PaymentError("invalid-input", "lnurl-withdraw receives funds: use payments.withdrawLnurl");
+	switch (params.option.kind) {
+		case "spark": {
+			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "spark payment: amountSats is required");
+			const { address } = params.option;
+			const { amountSats } = params;
+			return {
+				display: {
+					family: "spark",
+					network,
+					kind: "transfer",
+					amountSats,
+					receiver: address
+				},
+				checks: [],
+				staleReason: () => void 0,
+				execute: async (spark, verify) => ({
+					kind: "spark",
+					transfer: await spark.send(ref, {
+						receiver: address,
+						amountSats,
+						verify
+					})
+				})
+			};
+		}
+		case "spark-invoice": {
+			const { option } = params;
+			if (option.expiresAt !== void 0 && option.expiresAt <= context.now()) throw new PaymentError("rejected", "spark invoice expired");
+			if (option.amountSats !== void 0 && params.amountSats !== void 0 && params.amountSats !== option.amountSats) throw new PaymentError("invalid-input", "spark invoice: amountSats conflicts with the invoice amount");
+			const amountSats = option.amountSats ?? params.amountSats;
+			if (amountSats === void 0) throw new PaymentError("invalid-input", "spark invoice: amountless invoice requires amountSats");
+			const openAmount = option.amountSats === void 0 ? params.amountSats : void 0;
+			const parsed = parseSparkInvoice(option.invoice, {
+				network,
+				now: context.now()
+			});
+			const { expiresAt } = option;
+			return {
+				display: {
+					family: "spark",
+					network,
+					kind: "transfer",
+					amountSats,
+					receiver: encodeSparkAddress({
+						network,
+						identityPublicKey: parsed.receiverIdentityPublicKey
+					}),
+					...option.memo === void 0 ? {} : { description: option.memo }
+				},
+				checks: [],
+				staleReason: (now) => expiresAt !== void 0 && expiresAt <= now ? "spark invoice expired" : void 0,
+				execute: async (spark, verify) => ({
+					kind: "spark",
+					transfer: await spark.paySparkInvoice(ref, {
+						invoice: option.invoice,
+						...openAmount === void 0 ? {} : { amountSats: openAmount },
+						verify
+					})
+				})
+			};
+		}
+		case "lightning": {
+			const { option } = params;
+			if (option.amountSats === void 0 && params.amountSats === void 0) throw new PaymentError("invalid-input", "amountless invoice: amountSats is required");
+			if (params.maxFeeSats === void 0) throw new PaymentError("invalid-input", "lightning payment: maxFeeSats is required");
+			if (option.expiresAt <= context.now() + 6e4) throw new PaymentError("rejected", "lightning invoice expired");
+			if (option.amountSats !== void 0 && params.amountSats !== void 0 && params.amountSats !== option.amountSats) throw new PaymentError("invalid-input", "amountSats conflicts with the invoice amount");
+			const { maxFeeSats } = params;
+			const openAmount = option.amountSats === void 0 ? params.amountSats : void 0;
+			const amountSats = option.amountSats ?? params.amountSats ?? 0;
+			const { payee } = lightningDetails(option.invoice);
+			const { expiresAt } = option;
+			return {
+				display: {
+					family: "spark",
+					network,
+					kind: "lightning",
+					amountSats,
+					maxFeeSats,
+					receiver: payee,
+					...option.description === void 0 ? {} : { description: option.description }
+				},
+				checks: feeCheck(amountSats, maxFeeSats),
+				staleReason: (now) => expiresAt <= now + 6e4 ? "lightning invoice expired" : void 0,
+				execute: async (spark, verify) => ({
+					kind: "lightning",
+					payment: await spark.payInvoice(ref, {
+						invoice: option.invoice,
+						maxFeeSats,
+						...openAmount === void 0 ? {} : { amountSats: openAmount },
+						verify
+					})
+				})
+			};
+		}
+		case "lnurl-pay": {
+			const { request } = params.option;
+			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "lnurl-pay: amountSats is required");
+			if (params.maxFeeSats === void 0) throw new PaymentError("invalid-input", "lnurl-pay: maxFeeSats is required");
+			const { amountSats, maxFeeSats } = params;
+			const amountMsat = amountSats * 1e3;
+			if (amountMsat < request.minSendableMsat || amountMsat > request.maxSendableMsat) throw new PaymentError("rejected", "lnurl-pay: amount outside the service's range");
+			if (request.commentAllowed === 0 && params.comment !== void 0) throw new PaymentError("rejected", "lnurl-pay: comments not accepted by this service");
+			if (params.comment !== void 0 && params.comment.length > request.commentAllowed) throw new PaymentError("rejected", "lnurl-pay: comment exceeds the service's limit");
+			let requested;
+			try {
+				requested = await requestInvoice(request, {
+					fetch: context.fetch,
+					network,
+					amountMsat,
+					...params.comment === void 0 ? {} : { comment: params.comment }
+				});
+			} catch (error) {
+				if (error instanceof PaymentError || error instanceof SparkControllerError) throw error;
+				throw new PaymentError("network", "lnurl-pay: invoice request failed", error);
+			}
+			const { invoice } = requested;
+			const { payee, expiresAt } = lightningDetails(invoice);
+			return {
+				display: {
+					family: "spark",
+					network,
+					kind: "lightning",
+					amountSats,
+					maxFeeSats,
+					receiver: payee,
+					description: request.description
+				},
+				checks: feeCheck(amountSats, maxFeeSats),
+				staleReason: (now) => expiresAt <= now + 6e4 ? "lightning invoice expired" : void 0,
+				execute: async (spark, verify) => ({
+					kind: "lightning",
+					payment: await spark.payInvoice(ref, {
+						invoice,
+						maxFeeSats,
+						verify
+					})
+				})
+			};
+		}
+		default: {
+			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "bitcoin payment: amountSats is required");
+			const { address } = params.option;
+			const { amountSats, maxFeeSats } = params;
+			const speed = params.speed ?? "MEDIUM";
+			return {
+				display: {
+					family: "spark",
+					network,
+					kind: "exit",
+					amountSats,
+					...maxFeeSats === void 0 ? {} : { maxFeeSats },
+					receiver: address
+				},
+				checks: feeCheck(amountSats, maxFeeSats),
+				staleReason: () => void 0,
+				execute: async (spark, verify) => ({
+					kind: "withdraw",
+					exit: await spark.withdraw(ref, {
+						address,
+						speed,
+						verify,
+						amountSats,
+						...maxFeeSats === void 0 ? {} : { maxFeeSats }
+					})
+				})
+			};
+		}
+	}
+}
+/**
+* LNURL-withdraw: asks the service to pay an invoice this wallet creates. It receives funds, so it
+* needs no verification factor and does not go through the request pipeline.
+*/
+async function withdrawLnurl(context, params) {
+	const { request } = params.option;
+	const amountMsat = params.amountSats * 1e3;
+	if (amountMsat < request.minWithdrawableMsat || amountMsat > request.maxWithdrawableMsat) throw new PaymentError("rejected", "lnurl-withdraw: amount outside the service's range");
+	const invoice = await context.spark.createInvoice(params.account, {
+		amountSats: params.amountSats,
+		memo: request.defaultDescription
+	});
+	try {
+		await submitWithdraw(request, {
+			fetch: context.fetch,
+			invoice: invoice.invoice
+		});
+	} catch (error) {
+		if (error instanceof PaymentError || error instanceof SparkControllerError) throw error;
+		throw new PaymentError("network", "lnurl-withdraw: submission failed", error);
+	}
+	return {
+		kind: "lnurl-withdraw",
+		invoice
+	};
+}
+//#endregion
+//#region src/payments/zap.ts
+/** Everything up to payment: resolve LNURL, sign the 9734, request the invoice. */
+async function prepareZap(params, context) {
+	const amountMsat = params.amountSats * 1e3;
+	if (!Number.isSafeInteger(params.amountSats) || params.amountSats <= 0 || !Number.isSafeInteger(amountMsat)) throw new PaymentError("invalid-input", "zap amount is not a positive safe integer");
+	try {
+		const resolved = await resolveLnurl(params.recipient.lightning, { fetch: context.fetch });
+		if (resolved.tag !== "payRequest") throw new PaymentError("rejected", "recipient is not an LNURL-pay endpoint");
+		if (!resolved.allowsNostr || resolved.nostrPubkey === void 0) throw new PaymentError("rejected", "LNURL service does not accept nostr zaps");
+		if (amountMsat < resolved.minSendableMsat || amountMsat > resolved.maxSendableMsat) throw new PaymentError("rejected", "zap amount outside the service's bounds");
+		if (params.comment !== void 0) {
+			if (resolved.commentAllowed === 0) throw new PaymentError("rejected", "the service does not accept comments");
+			if (params.comment.length > resolved.commentAllowed) throw new PaymentError("rejected", "comment exceeds the service's limit");
+		}
+		const lnurl = params.recipient.lightning.toLowerCase().startsWith("lnurl1") ? params.recipient.lightning.toLowerCase() : encodeLnurl(lightningAddressUrl(params.recipient.lightning));
+		const base = {
+			amount: amountMsat,
+			relays: [...params.relays],
+			comment: params.comment,
+			lnurl
+		};
+		const unsigned = {
+			..."event" in params.recipient ? makeZapRequest({
+				event: params.recipient.event,
+				...base
+			}) : makeZapRequest({
+				pubkey: params.recipient.pubkey,
+				...base
+			}),
+			pubkey: await params.signer.getPublicKey()
+		};
+		const zapRequest = await params.signer.signEvent(unsigned);
+		if (!verifyEvent(zapRequest) || !signedMatchesUnsigned(zapRequest, unsigned)) throw new PaymentError("rejected", "signer returned a zap request that does not match");
+		const { invoice } = await requestInvoice(resolved, {
+			fetch: context.fetch,
+			network: params.network,
+			amountMsat,
+			...params.comment === void 0 ? {} : { comment: params.comment },
+			zapRequest: JSON.stringify(zapRequest)
+		});
+		const decoded = decodeBolt11(invoice);
+		const expiresAt = (decoded.timestamp + decoded.expirySeconds) * 1e3;
+		if (expiresAt <= context.now() + 6e4) throw new PaymentError("rejected", "zap invoice expires too soon");
+		const eventId = "event" in params.recipient ? params.recipient.event.id : void 0;
+		return {
+			zapRequest,
+			invoice,
+			paymentHash: bytesToHex(decoded.paymentHash),
+			expiresAt,
+			amountSats: params.amountSats,
+			receiptPubkey: bytesToHex(resolved.nostrPubkey),
+			recipientPubkey: "event" in params.recipient ? params.recipient.event.pubkey : params.recipient.pubkey,
+			...eventId === void 0 ? {} : { eventId },
+			...params.comment === void 0 ? {} : { comment: params.comment },
+			lightning: params.recipient.lightning
+		};
+	} catch (error) {
+		if (error instanceof PaymentError) throw error;
+		if (error instanceof SparkInputError || error instanceof Error && error.cause instanceof SparkInputError) throw new PaymentError("rejected", "zap failed invoice validation");
+		throw new PaymentError(categorizePayment(error), "zap failed");
+	}
+}
+/**
+* Fixes a prepared zap for approval: the invoice (fetched by {@link prepareZap}) is paid as-is, and
+* the zap note is written under the payment's transfer id afterwards. A nearly-expired invoice is
+* refused here and again at approval — the user may sit on the confirm screen.
+*/
+function prepareZapAction(account, prepared, options) {
+	if (prepared.expiresAt <= options.now() + 6e4) throw new PaymentError("rejected", "zap invoice expired");
+	const { maxFeeSats } = options;
+	const { payee } = lightningInvoiceDetails(prepared.invoice);
+	return {
+		display: {
+			family: "spark",
+			network: account.network,
+			kind: "lightning",
+			amountSats: prepared.amountSats,
+			maxFeeSats,
+			receiver: payee,
+			...prepared.comment === void 0 ? {} : { description: prepared.comment }
+		},
+		checks: feeCheck(prepared.amountSats, maxFeeSats),
+		staleReason: (now) => prepared.expiresAt <= now + 6e4 ? "zap invoice expired" : void 0,
+		execute: async (spark, verify) => ({
+			kind: "lightning",
+			payment: await spark.payInvoice(account, {
+				invoice: prepared.invoice,
+				maxFeeSats,
+				verify,
+				note: {
+					kind: "zap",
+					recipientPubkey: prepared.recipientPubkey,
+					...prepared.eventId === void 0 ? {} : { eventId: prepared.eventId },
+					...prepared.comment === void 0 ? {} : { comment: prepared.comment },
+					lightning: prepared.lightning
+				}
+			})
+		})
+	};
+}
+const lightningInvoiceDetails = (invoice) => ({ payee: bytesToHex(decodeBolt11(invoice).payee) });
+function categorizePayment(error) {
+	return categorize(error) === "network" ? "network" : "rejected";
+}
+//#endregion
+//#region src/transactions/route.ts
+const hexId = (prefix, random) => `${prefix}-${[...random(8)].map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+const newId = (random) => hexId("tx", random);
+const newRequestId = (random) => hexId("req", random);
+const errorMessage$1 = (error) => error instanceof Error ? error.message : String(error);
+const LIVE_REPLACEMENT_STATES = /* @__PURE__ */ new Set([
+	"draft",
+	"signed",
+	"submitted",
+	"pending"
+]);
+/**
+* Approval-time check for a replacement: the original must still be unconfirmed and no other
+* replacement of it may already be on its way.
+*/
+const replacementStaleReason = (ctx, originalId) => {
+	const txs = ctx.txs();
+	const original = txs[originalId];
+	if (original?.state !== "submitted" && original?.state !== "pending") return "original transaction already finished — nothing to replace";
+	return Object.values(txs).some((t) => t.replaces === originalId && LIVE_REPLACEMENT_STATES.has(t.state)) ? "original transaction was already replaced — start over" : void 0;
+};
+//#endregion
+//#region src/requests/checks.ts
+/** Two reads of one fee differ by more than this share of the smaller one. */
+const FEE_MISMATCH_PERCENT = 25n;
+/** A fee ceiling above this multiple of the independent estimate is flagged. */
+const FEE_CAP_MULTIPLIER = 2n;
+/**
+* `|a − b| / min(a, b)` is strictly above {@link FEE_MISMATCH_PERCENT}; a zero against a non-zero
+* always is.
+*/
+const feesDiffer = (a, b) => {
+	const low = a < b ? a : b;
+	return ((a < b ? b : a) - low) * 100n > low * FEE_MISMATCH_PERCENT;
+};
+/**
+* The final ceiling exceeds {@link FEE_CAP_MULTIPLIER} times the independent estimate of the same
+* tier.
+*/
+const exceedsNetworkCap = (final, independent) => final > independent * FEE_CAP_MULTIPLIER;
+/** The worst-case fee is not below the amount sent (native-asset sends only). */
+const feeReachesAmount = (maxFee, amount) => maxFee >= amount;
+const min = (a, b) => a < b ? a : b;
+const max = (a, b) => a > b ? a : b;
+/** EIP-1559 quotes are `maxFee = baseFee × 2 + priority`; this recovers the base fee. */
+const baseFeeOf = (quote) => (quote.maxFeePerGas - (quote.maxPriorityFeePerGas ?? 0n)) / 2n;
+/**
+* EIP-1559: priority fee is the lower of the two, `maxFeePerGas = max(baseFee) × 2 + priority` (a
+* high ceiling only prevents a stuck transaction, the base fee actually paid is the chain's).
+* Legacy: the lower gas price. Two different shapes cannot be merged — the independent quote wins.
+*/
+const mergeEvmQuote = (primary, independent) => {
+	const a = primary.maxPriorityFeePerGas;
+	const b = independent.maxPriorityFeePerGas;
+	if (a !== void 0 && b !== void 0) {
+		const priority = min(a, b);
+		const maxFeePerGas = max(baseFeeOf(primary), baseFeeOf(independent)) * 2n + priority;
+		return {
+			quote: {
+				tier: primary.tier,
+				wei: maxFeePerGas,
+				maxFeePerGas,
+				maxPriorityFeePerGas: priority
+			},
+			mismatch: feesDiffer(a, b) || feesDiffer(baseFeeOf(primary), baseFeeOf(independent))
+		};
+	}
+	if (a === void 0 && b === void 0) {
+		const price = min(primary.maxFeePerGas, independent.maxFeePerGas);
+		return {
+			quote: {
+				tier: primary.tier,
+				wei: price,
+				maxFeePerGas: price,
+				maxPriorityFeePerGas: void 0
+			},
+			mismatch: feesDiffer(primary.maxFeePerGas, independent.maxFeePerGas)
+		};
+	}
+	return {
+		quote: independent,
+		mismatch: true
+	};
+};
+const mergeSolanaQuote = (primary, independent) => ({
+	quote: {
+		tier: primary.tier,
+		microLamportsPerCu: min(primary.microLamportsPerCu, independent.microLamportsPerCu)
+	},
+	mismatch: feesDiffer(primary.microLamportsPerCu, independent.microLamportsPerCu)
+});
+/** Bitcoin fee rates (sat/vB) per confirmation target. */
+const mergeSatPerByte = (primary, independent) => ({
+	rate: Math.min(primary, independent),
+	mismatch: feesDiffer(BigInt(Math.ceil(primary)), BigInt(Math.ceil(independent)))
+});
+/** The checks a prepared build carries, in a stable order and without duplicates. */
+const collectChecks = (flags) => [...new Set(flags.filter((f) => f !== void 0))];
+/** EVM addresses compare without the `0x` prefix and case-insensitively. */
+const comparable = (family, address) => family === "evm" ? address.replace(/^0x/i, "").toLowerCase() : address;
+const looksLike = (a, b) => a !== b && a.length >= 8 && b.length >= 8 && a.slice(0, 4) === b.slice(0, 4) && a.slice(-4) === b.slice(-4);
+/** Findings for every recipient of one request, deduplicated, `danger` first. */
+function assessRecipients(family, recipients, known) {
+	const knownSet = new Set(known.map((a) => comparable(family, a)));
+	const found = /* @__PURE__ */ new Map();
+	for (const recipient of recipients) {
+		const candidate = comparable(family, recipient);
+		if (knownSet.has(candidate)) continue;
+		found.set("first-recipient", {
+			code: "first-recipient",
+			level: "warning"
+		});
+		if ([...knownSet].some((k) => looksLike(candidate, k))) found.set("address-poisoning", {
+			code: "address-poisoning",
+			level: "danger"
+		});
+	}
+	return [...found.values()].sort((a, b) => Number(b.level === "danger") - Number(a.level === "danger"));
+}
+//#endregion
+//#region src/requests/sign-log.ts
+const SIGN_LOG_LIMIT = 1e3;
+const COLLECTION$2 = "sign-log";
+const isObject$11 = (v) => typeof v === "object" && v !== null;
+const METHODS = /* @__PURE__ */ new Set([
+	"send",
+	"speed-up",
+	"cancel",
+	"cpfp",
+	"pay",
+	"zap"
+]);
+const OUTCOMES = /* @__PURE__ */ new Set([
+	"submitted",
+	"rejected",
+	"failed",
+	"expired",
+	"invalidated"
+]);
+const FAMILIES = /* @__PURE__ */ new Set([
+	"evm",
+	"solana",
+	"bitcoin"
+]);
+const isAccount = (value) => {
+	if (!isObject$11(value)) return false;
+	if (value["kind"] === "hd") return typeof value["walletId"] === "string" && typeof value["groupIndex"] === "number" && typeof value["template"] === "string";
+	if (value["kind"] === "imported") return typeof value["keyId"] === "string" && FAMILIES.has(value["family"]);
+	return value["kind"] === void 0 && typeof value["walletId"] === "string" && typeof value["groupIndex"] === "number" && typeof value["network"] === "string";
+};
+const isEntry = (value) => isObject$11(value) && typeof value["id"] === "string" && typeof value["at"] === "number" && METHODS.has(value["method"]) && OUTCOMES.has(value["outcome"]) && isAccount(value["account"]);
+/** Sortable key: time first, request id as the tiebreak. */
+const keyOf = (entry) => `${String(entry.at).padStart(16, "0")}-${entry.id}`;
+function createSignLog(logger) {
+	let store;
+	return {
+		open: (next) => {
+			store = next;
+		},
+		close: () => {
+			store = void 0;
+		},
+		append: async (entry) => {
+			const current = store;
+			if (current === void 0) {
+				logger.warn(`sign log entry for request ${entry.id} (${entry.outcome}) not written: vault locked`);
+				return;
+			}
+			const collection = current.collection(COLLECTION$2);
+			await collection.put(keyOf(entry), new TextEncoder().encode(JSON.stringify(entry)));
+			const keys = [...await collection.list()].sort();
+			await Promise.all(keys.slice(0, Math.max(0, keys.length - SIGN_LOG_LIMIT)).map(async (k) => collection.delete(k)));
+		},
+		list: async () => {
+			if (store === void 0) return [];
+			const collection = store.collection(COLLECTION$2);
+			const keys = [...await collection.list()].sort();
+			const rows = await Promise.all(keys.map(async (k) => collection.get(k)));
+			const entries = [];
+			for (const raw of rows) {
+				if (raw === void 0) continue;
+				const parsed = JSON.parse(new TextDecoder().decode(raw));
+				if (isEntry(parsed)) entries.push(parsed);
+			}
+			return entries.reverse();
+		},
+		clear: async () => {
+			if (store === void 0) return;
+			const collection = store.collection(COLLECTION$2);
+			const keys = [...await collection.list()].sort();
+			await Promise.all(keys.map(async (k) => collection.delete(k)));
+		}
+	};
+}
+//#endregion
+//#region src/requests/controller.ts
+/**
+* Request pipeline for internal sends, speed-ups, cancellations and CPFP: `prepare` builds,
+* estimates and cross-checks without signing; `approve(id, method, verify)` is the only way to
+* sign, and only for a live, unexpired request of the right method; locking invalidates everything
+* that has not finished. The unsigned content stays in a private table, never in the state
+* snapshot, and cannot change after prepare.
+*/
+/** Requests expire this long after creation. */
+const REQUEST_TTL_MS = 6e5;
+const isSparkInput = (input) => input.method === "pay" || input.method === "zap";
+const LIVE = /* @__PURE__ */ new Set(["awaiting-approval", "signing"]);
+const errorMessage = (error) => error instanceof Error ? error.message : String(error);
+var RequestController = class extends Controller {
+	options;
+	entries = /* @__PURE__ */ new Map();
+	log;
+	/** Original transaction id → the unfinished request replacing or accelerating it. */
+	targets = /* @__PURE__ */ new Map();
+	locked = true;
+	/** Bumped on every unlock and lock so work that outlives a session never touches the next one. */
+	session = 0;
+	constructor(options) {
+		super({
+			name: "requests",
+			defaultState: () => ({ requests: {} })
+		});
+		this.options = options;
+		this.log = createSignLog(options.logger);
+	}
+	async init() {
+		this.session += 1;
+		this.locked = false;
+		this.entries.clear();
+		this.targets.clear();
+		this.update(() => ({ requests: {} }));
+		this.log.open(await this.options.openStore());
+	}
+	async destroy() {
+		this.lock();
+		await Promise.resolve();
+	}
+	/** Locking is not consent: every unfinished request becomes `invalidated` and frees its resources. */
+	lock() {
+		this.session += 1;
+		this.locked = true;
+		for (const [id, request] of Object.entries(this.getState().requests)) if (LIVE.has(request.stage)) this.finish(id, "invalidated");
+		this.log.close();
+	}
+	/** The signature record, newest first. */
+	async signLog() {
+		return this.log.list();
+	}
+	async clearSignLog() {
+		await this.log.clear();
+	}
+	async prepare(input) {
+		if (this.locked) throw new Error("requests require an unlocked vault");
+		const { session } = this;
+		const id = newRequestId(this.options.random);
+		const target = input.method === "send" || isSparkInput(input) ? void 0 : input.txId;
+		if (target !== void 0) {
+			if (this.targets.has(target)) throw new Error(`transaction ${target} already has an unfinished replacement request`);
+			this.targets.set(target, id);
+		}
+		let built;
+		try {
+			built = await this.build(input, id);
+		} catch (error) {
+			this.unclaim(id);
+			throw error;
+		}
+		if (session !== this.session) {
+			built.run.release();
+			this.unclaim(id);
+			throw new Error("the vault was locked while the request was being prepared");
+		}
+		const { checks } = built;
+		const createdAt = this.options.now();
+		const request = {
+			id,
+			origin: { kind: "internal" },
+			method: input.method,
+			account: built.account,
+			network: built.network,
+			...target === void 0 ? {} : { target },
+			stage: "awaiting-approval",
+			display: built.display,
+			verification: checks.length > 0 ? "unverifiable" : "verified",
+			checks,
+			risk: built.risk,
+			createdAt,
+			expiresAt: createdAt + REQUEST_TTL_MS
+		};
+		const stopTimer = this.options.setTimer(REQUEST_TTL_MS, () => {
+			if (this.getState().requests[id]?.stage === "awaiting-approval") this.finish(id, "expired");
+		});
+		this.entries.set(id, {
+			prepared: built.run,
+			stopTimer
+		});
+		this.put(request);
+		return request;
+	}
+	async build(input, id) {
+		if (input.method === "pay" || input.method === "zap") {
+			const action = input.method === "pay" ? await preparePay({
+				fetch: this.options.fetch,
+				now: this.options.now
+			}, input) : prepareZapAction(input.account, input.zap, {
+				maxFeeSats: input.maxFeeSats,
+				now: this.options.now
+			});
+			return {
+				account: input.account,
+				network: action.display.network,
+				display: action.display,
+				checks: collectChecks(action.checks),
+				risk: this.sparkRisk(action.display),
+				run: {
+					staleReason: () => action.staleReason(this.options.now()),
+					submit: async (verify) => action.execute(this.options.spark, verify),
+					release: () => void 0
+				}
+			};
+		}
+		const prepared = input.method === "send" ? await this.options.transactions.prepareSend(input, id) : await this.options.transactions.prepareReplacement(input, id);
+		return {
+			account: prepared.account,
+			network: prepared.network,
+			display: prepared.intent,
+			checks: collectChecks([prepared.intent.verifiability === "full" ? void 0 : "decode-partial", ...prepared.checks]),
+			risk: input.method === "send" ? this.chainRisk(prepared.intent) : [],
+			run: prepared
+		};
+	}
+	async approve(id, method, verify) {
+		const request = this.getState().requests[id];
+		if (request === void 0) throw new Error(`unknown request ${id}`);
+		if (request.method !== method) throw new Error(`request ${id} is a ${request.method} request, not ${method}`);
+		const entry = this.entries.get(id);
+		if (request.stage !== "awaiting-approval" || entry === void 0) throw new Error(`request ${id} is ${request.stage}, not awaiting approval`);
+		if (this.options.now() >= request.expiresAt) {
+			this.finish(id, "expired");
+			throw new Error(`request ${id} expired`);
+		}
+		const { session } = this;
+		this.put({
+			...request,
+			stage: "signing"
+		});
+		let stale;
+		try {
+			stale = await entry.prepared.staleReason();
+		} catch (error) {
+			stale = errorMessage(error);
+		}
+		if (session !== this.session) throw new Error(`request ${id} was invalidated`);
+		if (stale !== void 0) {
+			this.finish(id, "failed", stale);
+			throw new Error(stale);
+		}
+		try {
+			const result = await entry.prepared.submit(verify);
+			if (session === this.session) {
+				entry.stopTimer();
+				this.entries.delete(id);
+				this.unclaim(id);
+				const done = {
+					...this.requireRequest(id),
+					stage: "submitted",
+					..."id" in result ? { txId: result.id } : {}
+				};
+				this.put(done);
+				this.record(done, "submitted");
+			} else this.record(request, "submitted");
+			return result;
+		} catch (error) {
+			if (session === this.session) this.finish(id, this.failureStage(entry.prepared, error), errorMessage(error));
+			else this.record(request, "failed", errorMessage(error));
+			throw error;
+		}
+	}
+	/**
+	* A cancelled or refused verification is `rejected`; anything after it is `failed`. Chain
+	* requests record which step failed on the tracked transaction; for Spark, the approval round is
+	* the only source of `WalletError`.
+	*/
+	failureStage(run, error) {
+		if (run.txId === void 0) return error instanceof WalletError ? "rejected" : "failed";
+		return this.options.transactions.getState().txs[run.txId]?.state === "rejected" ? "rejected" : "failed";
+	}
+	reject(id) {
+		const request = this.getState().requests[id];
+		if (request === void 0) throw new Error(`unknown request ${id}`);
+		if (request.stage !== "awaiting-approval") throw new Error(`request ${id} is ${request.stage}, not awaiting approval`);
+		this.finish(id, "rejected");
+	}
+	requireRequest(id) {
+		const request = this.getState().requests[id];
+		if (request === void 0) throw new Error(`unknown request ${id}`);
+		return request;
+	}
+	put(request) {
+		this.update((s) => ({
+			...s,
+			requests: {
+				...s.requests,
+				[request.id]: request
+			}
+		}));
+	}
+	unclaim(requestId) {
+		for (const [target, holder] of this.targets) if (holder === requestId) this.targets.delete(target);
+	}
+	/** Ends a request in a terminal stage and frees what it reserved. */
+	finish(id, stage, error) {
+		this.unclaim(id);
+		const entry = this.entries.get(id);
+		if (entry !== void 0) {
+			entry.stopTimer();
+			this.entries.delete(id);
+			try {
+				entry.prepared.release();
+			} catch (releaseError) {
+				this.options.logger.warn("request release failed", releaseError);
+			}
+		}
+		const request = this.getState().requests[id];
+		if (request !== void 0) {
+			const ended = {
+				...request,
+				stage,
+				...error === void 0 ? {} : { error }
+			};
+			this.put(ended);
+			this.record(ended, stage, error);
+		}
+	}
+	/** Appends the final stage to the signature record; a failed write is a warning, not an error. */
+	record(request, outcome, error) {
+		const { display } = request;
+		const entry = {
+			id: request.id,
+			at: this.options.now(),
+			origin: request.origin,
+			method: request.method,
+			account: request.account,
+			network: request.network,
+			summary: "summary" in display ? display.summary : `${display.kind} ${display.amountSats}`,
+			verification: request.verification,
+			checks: request.checks,
+			risk: request.risk,
+			outcome,
+			...error === void 0 ? {} : { error }
+		};
+		this.appendLog(entry);
+	}
+	async appendLog(entry) {
+		try {
+			await this.log.append(entry);
+		} catch (error) {
+			this.options.logger.warn("sign log write failed", error);
+		}
+	}
+	/**
+	* Addresses the wallet already knows for a family: contacts, plus recipients of tracked chain
+	* sends (Spark payments are not tracked).
+	*/
+	knownAddresses(family) {
+		const contacts = Object.values(this.options.addressBook.getState().entries).filter((e) => e.family === family).map((e) => e.address);
+		if (family === "spark") return contacts;
+		const paid = Object.values(this.options.transactions.getState().txs).filter((tx) => tx.family === family && (tx.state === "submitted" || tx.state === "pending" || tx.state === "confirmed")).flatMap((tx) => tx.intent?.outflows.map((o) => o.to) ?? []);
+		return [...contacts, ...paid];
+	}
+	chainRisk(intent) {
+		return assessRecipients(intent.family, intent.outflows.map((o) => o.to), this.knownAddresses(intent.family));
+	}
+	/** Only a Spark transfer has a recipient to check; Lightning and exits are not assessed. */
+	sparkRisk(display) {
+		if (display.kind !== "transfer") return [];
+		return assessRecipients("spark", [normalizeAddress("spark", display.receiver) ?? display.receiver], this.knownAddresses("spark"));
+	}
+};
+//#endregion
 //#region src/chains/bitcoin-scan.ts
 /**
 * Gap-20 BIP-44/86 account scanning over Esplora — derives /0/* and /1/* from the account xpub,
@@ -280,6 +1421,10 @@ var BtcUtxoStore = class BtcUtxoStore {
 		});
 		this.persist();
 	}
+	/** True while a pending request or an unconfirmed transaction holds this output. */
+	isLocked(u) {
+		return this.utxos.get(BtcUtxoStore.key(u))?.status === "locked";
+	}
 	/** Released on failed/rejected/dropped; spent-removed on confirmed. */
 	endTx(txId, final) {
 		if (final === "confirmed") {
@@ -308,10 +1453,6 @@ var BtcUtxoStore = class BtcUtxoStore {
 	}
 };
 //#endregion
-//#region src/transactions/route.ts
-const newId = (random) => `tx-${[...random(8)].map((b) => b.toString(16).padStart(2, "0")).join("")}`;
-const errorMessage = (error) => error instanceof Error ? error.message : String(error);
-//#endregion
 //#region src/accounts/errors.ts
 var AccountTreeError = class extends Error {
 	category;
@@ -461,7 +1602,7 @@ const check = async (family, run) => {
 	} catch (error) {
 		return [family, {
 			used: false,
-			error: errorMessage(error)
+			error: errorMessage$1(error)
 		}];
 	}
 };
@@ -726,7 +1867,6 @@ var AccountTreeController = class extends Controller {
 			...g.boundPubkey === void 0 ? {} : { boundPubkey: g.boundPubkey }
 		});
 		return {
-			v: 1,
 			wallet,
 			groups
 		};
@@ -1144,8 +2284,9 @@ function persistedToState(tree) {
 * EVM chain adapter: native transfers through a viem PublicClient injected by NetworkController.
 * Fee tiers come from eth_feeHistory (20 blocks, p10/p50/p90 → slow/normal/fast, maxFee = 2×baseFee +
 * priority); networks that cannot answer feeHistory fall back to eth_gasPrice. gas = estimateGas ×
-* 1.2 (ceil). Nonces are allocated on a per-(network, from) serial queue as max(pending count, last
-* submitted + 1). Finalization uses the `finalized` block tag; receipts with status 0 fail.
+* 1.2 (ceil). The next nonce is read on a per-(network, from) serial queue as max(pending count,
+* last broadcast + 1) and is only recorded once a broadcast succeeds. Finalization uses the
+* `finalized` block tag; receipts with status 0 fail.
 */
 const ERC20_ABI = [
 	{
@@ -1229,20 +2370,35 @@ var EvmChainAdapter = class {
 		if (typeof result !== "string") throw new TypeError(`${method} returned a malformed result`);
 		return result;
 	}
-	/** Allocate the next nonce for (network, from) — serial per key. */
-	async nonce(client, network, from) {
+	/** The endpoint's pending transaction count for `from`. */
+	async pendingCount(client, from) {
+		return Number(await this.rpcHex(client, "eth_getTransactionCount", [from, "pending"]));
+	}
+	/**
+	* The next nonce for (network, from): the larger of the endpoint's pending count and one past the
+	* highest nonce this engine already broadcast. Reading it reserves nothing — only
+	* {@link commitNonce} after a successful broadcast advances the local record.
+	*/
+	async nextNonce(client, network, from) {
 		const key = `${network}:${from}`;
 		return this.serial(key, async () => {
-			const pending = Number(await this.rpcHex(client, "eth_getTransactionCount", [from, "pending"]));
+			const pending = await this.pendingCount(client, from);
 			const local = this.lastNonce.get(key);
-			const nonce = Math.max(pending, local === void 0 ? 0 : local + 1);
-			this.lastNonce.set(key, nonce);
-			return nonce;
+			return Math.max(pending, local === void 0 ? 0 : local + 1);
 		});
 	}
+	/** True once a broadcast at `nonce` or later is recorded for (network, from). */
+	nonceConsumed(network, from, nonce) {
+		const local = this.lastNonce.get(`${network}:${from}`);
+		return local !== void 0 && local >= nonce;
+	}
+	commitNonce(network, from, nonce) {
+		const key = `${network}:${from}`;
+		this.lastNonce.set(key, Math.max(this.lastNonce.get(key) ?? nonce, nonce));
+	}
 	/** ERC-20 gas is buffered ×1.1 instead of the native ×1.2 (chains.mdx "EVM"). */
-	async build(client, network, from, intent) {
-		const nonce = await this.nonce(client, network, from);
+	async build(client, network, from, intent, nonceOverride) {
+		const nonce = nonceOverride ?? await this.nextNonce(client, network, from);
 		const erc20 = intent.kind === "erc20";
 		const to = checksumEvmAddress(erc20 ? intent.token : intent.to);
 		const value = erc20 ? 0n : intent.value;
@@ -2085,7 +3241,8 @@ const PUBKEY_RE = /^[0-9a-f]{64}$/;
 const KNOWN_DOC_KEYS = /* @__PURE__ */ new Set([
 	"v",
 	"wallet",
-	"groups"
+	"groups",
+	"contacts"
 ]);
 const KNOWN_WALLET_KEYS = /* @__PURE__ */ new Set(["name", "updatedAt"]);
 const KNOWN_GROUP_KEYS = /* @__PURE__ */ new Set([
@@ -2099,11 +3256,14 @@ const isObject$7 = (v) => typeof v === "object" && v !== null && !Array.isArray(
 const isNonNegativeInt = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
 const validName = (v) => v === void 0 || typeof v === "string" && v.trim().length > 0 && v.trim().length <= NAME_MAX;
 const trimmedName = (v) => typeof v === "string" ? v.trim() : void 0;
-/** Strict decode — any malformed shape, unknown key or duplicate index returns `undefined`. */
+/**
+* Strict decode — any malformed shape, unknown key, duplicate index or id, or invalid contact
+* returns `undefined`; only `v: 2` is read.
+*/
 function decodeMetaDoc(value) {
 	if (!isObject$7(value)) return;
 	for (const k of Object.keys(value)) if (!KNOWN_DOC_KEYS.has(k)) return;
-	if (value["v"] !== 1) return;
+	if (value["v"] !== 2) return;
 	const { wallet } = value;
 	if (!isObject$7(wallet)) return;
 	for (const k of Object.keys(wallet)) if (!KNOWN_WALLET_KEYS.has(k)) return;
@@ -2132,9 +3292,18 @@ function decodeMetaDoc(value) {
 		});
 	}
 	out.sort((a, b) => a.index - b.index);
+	const { contacts } = value;
+	if (!Array.isArray(contacts) || contacts.length > 128) return;
+	const records = /* @__PURE__ */ new Map();
+	for (const item of contacts) {
+		const record = decodeRecord(item);
+		if (record === void 0 || records.has(record.id)) return;
+		records.set(record.id, record);
+	}
 	const name = trimmedName(wallet["name"]);
 	return {
-		v: 1,
+		v: 2,
+		contacts: [...records.values()].sort((a, b) => a.id < b.id ? -1 : 1),
 		wallet: {
 			updatedAt: wallet["updatedAt"],
 			...name === void 0 ? {} : { name }
@@ -2184,6 +3353,7 @@ var MetaSyncController = class extends Controller {
 	timers = /* @__PURE__ */ new Map();
 	inflight = /* @__PURE__ */ new Set();
 	accountsUnsubscribe;
+	addressBookUnsubscribe;
 	constructor(options) {
 		super({
 			name: "metaSync",
@@ -2197,6 +3367,9 @@ var MetaSyncController = class extends Controller {
 		this.accountsUnsubscribe = this.options.accounts.store.subscribe(() => {
 			this.onTreeChange();
 		});
+		this.addressBookUnsubscribe = this.options.addressBook.store.subscribe(() => {
+			this.onTreeChange();
+		});
 		await this.pullAll(gen);
 	}
 	async destroy() {
@@ -2207,6 +3380,8 @@ var MetaSyncController = class extends Controller {
 		this.generation += 1;
 		this.accountsUnsubscribe?.();
 		this.accountsUnsubscribe = void 0;
+		this.addressBookUnsubscribe?.();
+		this.addressBookUnsubscribe = void 0;
 		for (const timer of this.timers.values()) clearTimeout(timer);
 		this.timers.clear();
 		this.pulled.clear();
@@ -2284,8 +3459,8 @@ var MetaSyncController = class extends Controller {
 				if (remote === void 0 || e.created_at > remote.created_at) remote = e;
 			}
 			if (remote === void 0) {
-				const local = this.options.accounts.exportMeta(walletId);
-				const hasEdits = local.wallet.updatedAt > 0 || local.groups.some((g) => g.updatedAt > 0);
+				const local = this.exportDoc(walletId);
+				const hasEdits = local.wallet.updatedAt > 0 || local.groups.some((g) => g.updatedAt > 0) || local.contacts.length > 0;
 				if (gen !== this.generation) return;
 				this.pulled.add(walletId);
 				this.rememberExport(walletId);
@@ -2306,12 +3481,13 @@ var MetaSyncController = class extends Controller {
 					return;
 				}
 				const merge = this.options.accounts.mergeMeta(walletId, doc);
+				const contacts = await this.options.addressBook.merge(doc.contacts);
 				if (gen !== this.generation) return;
 				this.lastRemoteCreatedAt.set(walletId, remote.created_at);
 				this.pulled.add(walletId);
 				this.rememberExport(walletId);
 				this.setStatus(walletId, { status: "synced" });
-				if (merge.localNewer) await this.publishNow(walletId, gen);
+				if (merge.localNewer || contacts.localNewer) await this.publishNow(walletId, gen);
 			}
 			if (remoteSkipped > 0) this.options.logger.warn(`meta sync: ignored ${remoteSkipped} invalid remote events`);
 		} catch (error) {
@@ -2326,6 +3502,14 @@ var MetaSyncController = class extends Controller {
 			this.inflight.delete(walletId);
 		}
 	}
+	/** The wallet's tree plus the shared address book — every wallet's document carries both. */
+	exportDoc(walletId) {
+		return {
+			v: 2,
+			...this.options.accounts.exportMeta(walletId),
+			contacts: this.options.addressBook.syncEntries()
+		};
+	}
 	filterFor(pubkey, tag) {
 		return {
 			kinds: [META_SYNC_KIND],
@@ -2341,8 +3525,7 @@ var MetaSyncController = class extends Controller {
 	/** Snapshot the wallet's exported doc — the debounce publishes only on a real change. */
 	rememberExport(walletId) {
 		try {
-			const doc = this.options.accounts.exportMeta(walletId);
-			this.lastExported.set(walletId, JSON.stringify(doc));
+			this.lastExported.set(walletId, JSON.stringify(this.exportDoc(walletId)));
 		} catch {}
 	}
 	onTreeChange() {
@@ -2350,7 +3533,7 @@ var MetaSyncController = class extends Controller {
 		for (const walletId of this.pulled) {
 			let current;
 			try {
-				current = JSON.stringify(this.options.accounts.exportMeta(walletId));
+				current = JSON.stringify(this.exportDoc(walletId));
 			} catch {
 				continue;
 			}
@@ -2374,7 +3557,7 @@ var MetaSyncController = class extends Controller {
 			return;
 		}
 		try {
-			const bytes = encodeMetaDoc(this.options.accounts.exportMeta(walletId));
+			const bytes = encodeMetaDoc(this.exportDoc(walletId));
 			if (bytes === void 0) throw new MetaSyncError("internal", "meta doc exceeds 64 KB");
 			const encrypt = signer.nip44Encrypt;
 			if (encrypt === void 0) throw new MetaSyncError("internal", "signer lacks nip44 encryption");
@@ -2405,11 +3588,11 @@ var MetaSyncController = class extends Controller {
 function categorizeSync(error) {
 	return error instanceof MetaSyncError ? error.category : "network";
 }
-/** A decrypted doc that parses as JSON with a numeric `v` above 1 is a newer schema, not garbage. */
+/** A decrypted doc that parses as JSON with a numeric `v` above 2 is a newer schema, not garbage. */
 function isUnsupportedDoc(plaintext) {
 	try {
 		const doc = JSON.parse(plaintext);
-		return typeof doc === "object" && doc !== null && "v" in doc && typeof doc.v === "number" && doc.v > 1;
+		return typeof doc === "object" && doc !== null && "v" in doc && typeof doc.v === "number" && doc.v > 2;
 	} catch {
 		return false;
 	}
@@ -2608,102 +3791,6 @@ var BitcoinChainAdapter = class {
 	}
 };
 //#endregion
-//#region src/networks/registry.ts
-const entry = (chainId, name, symbol, testnet, _source) => ({
-	id: `eip155:${chainId}`,
-	chainId,
-	name,
-	symbol,
-	decimals: 18,
-	testnet,
-	family: "evm",
-	multicall3: "0xcA11bde05977b3631167028862bE2a173976CA11"
-});
-const NETWORKS = [
-	entry(1, "Ethereum", "ETH", false, "https://ethereum.org/en/developers/docs/networks/"),
-	entry(8453, "Base", "ETH", false, "https://docs.base.org/docs/network-information"),
-	entry(42161, "Arbitrum One", "ETH", false, "https://docs.arbitrum.io/for-devs/dev-tools-and-resources/chain-info"),
-	entry(10, "OP Mainnet", "ETH", false, "https://docs.optimism.io/chain/networks"),
-	entry(137, "Polygon", "POL", false, "https://docs.polygon.technology/pos/reference/rpc-endpoints/"),
-	entry(56, "BNB Smart Chain", "BNB", false, "https://docs.bnbchain.org/bnb-smart-chain/developers/json_rpc/"),
-	entry(999, "HyperEVM", "HYPE", false, "https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/hyperevm"),
-	entry(43114, "Avalanche C-Chain", "AVAX", false, "https://build.avax.network/docs/tooling/rpc-providers"),
-	entry(11155111, "Sepolia", "ETH", true, "https://ethereum.org/en/developers/docs/networks/"),
-	entry(84532, "Base Sepolia", "ETH", true, "https://docs.base.org/docs/network-information"),
-	entry(421614, "Arbitrum Sepolia", "ETH", true, "https://docs.arbitrum.io/for-devs/dev-tools-and-resources/chain-info"),
-	entry(11155420, "OP Sepolia", "ETH", true, "https://docs.optimism.io/chain/networks"),
-	entry(80002, "Polygon Amoy", "POL", true, "https://docs.polygon.technology/pos/reference/rpc-endpoints/"),
-	entry(97, "BNB Smart Chain Testnet", "tBNB", true, "https://docs.bnbchain.org/bnb-smart-chain/developers/json_rpc/"),
-	entry(998, "HyperEVM Testnet", "HYPE", true, "https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/hyperevm"),
-	entry(43113, "Avalanche Fuji", "AVAX", true, "https://build.avax.network/docs/tooling/rpc-providers")
-];
-const networkById = (id) => [
-	...NETWORKS,
-	...SOLANA_NETWORKS,
-	...BITCOIN_NETWORKS
-].find((n) => n.id === id);
-const BITCOIN_NETWORKS = [
-	{
-		id: "bip122:000000000019d6689c085ae165831e93",
-		chainId: 0,
-		name: "Bitcoin",
-		symbol: "BTC",
-		decimals: 8,
-		testnet: false,
-		family: "bitcoin",
-		genesisHash: "000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f"
-	},
-	{
-		id: "bip122:00000000da84f2bafbbc53dee25a72ae",
-		chainId: 0,
-		name: "Bitcoin Testnet4",
-		symbol: "tBTC",
-		decimals: 8,
-		testnet: true,
-		family: "bitcoin",
-		genesisHash: "00000000da84f2bafbbc53dee25a72ae507ff4914b867c565be350b0da8bf043"
-	},
-	{
-		id: "bip122:00000008819873e925422c1ff0f99f7c",
-		chainId: 0,
-		name: "Bitcoin Signet",
-		symbol: "sBTC",
-		decimals: 8,
-		testnet: true,
-		family: "bitcoin",
-		genesisHash: "00000008819873e925422c1ff0f99f7cc9bbb232af63a077a480a3633bee1ef6"
-	},
-	{
-		id: "bip122:0f9188f13cb7b2c71f2a335e3a4fc328",
-		chainId: 0,
-		name: "Bitcoin Regtest",
-		symbol: "rBTC",
-		decimals: 8,
-		testnet: true,
-		family: "bitcoin",
-		genesisHash: "0f9188f13cb7b2c71f2a335e3a4fc328bf5beb436012afca590b1a11466e2206"
-	}
-];
-const SOLANA_NETWORKS = [{
-	id: "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
-	chainId: 0,
-	name: "Solana",
-	symbol: "SOL",
-	decimals: 9,
-	testnet: false,
-	family: "solana",
-	genesisHash: "5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpWvDVGok8cUQPCbq9AzdTQvpNbNvyq4qDvMNTrDDezsFapSihepu2eQEdje"
-}, {
-	id: "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1",
-	chainId: 0,
-	name: "Solana Devnet",
-	symbol: "SOL",
-	decimals: 9,
-	testnet: true,
-	family: "solana",
-	genesisHash: "EtWTRABZaYq6iMfeYKouRu166VU2xqa1wcaWoxPkrZBGGSWgX4GwCJRmgdcvRaRmFbXfw3nDZBTqsr"
-}];
-//#endregion
 //#region src/networks/controller.ts
 /**
 * EVM network controller: the built-in registry plus host-provided and user-added RPC endpoints.
@@ -2715,21 +3802,86 @@ const SOLANA_NETWORKS = [{
 const esploraSleep = async (ms) => new Promise((resolve) => {
 	setTimeout(resolve, ms);
 });
+/** Bound on the unlock-time `/v1/networks` read so a dead gateway cannot stall unlocking. */
+const GATEWAY_PROBE_TIMEOUT_MS = 5e3;
 const isObject$5 = (v) => typeof v === "object" && v !== null;
+const makeClient = (info, urls, fetchFn) => createPublicClient({
+	chain: {
+		id: info.chainId,
+		name: info.name,
+		nativeCurrency: {
+			name: info.symbol,
+			symbol: info.symbol,
+			decimals: info.decimals
+		},
+		rpcUrls: { default: { http: [...urls] } }
+	},
+	transport: fallback(urls.map((url) => http(url, { fetchFn }))),
+	batch: { multicall: true }
+});
+const esploraClient = (urls, fetchFn) => esplora(urls, async (url, init) => {
+	const r = await fetchFn(url, init);
+	return {
+		ok: r.ok,
+		status: r.status,
+		headers: { get: (h) => r.headers.get(h) ?? void 0 },
+		json: async () => r.json(),
+		text: async () => r.text()
+	};
+}, esploraSleep);
+const solanaCaller = (urls, fetchFn) => ({ call: async (method, params) => {
+	const attempt = async (rest, last) => {
+		const [url, ...next] = rest;
+		if (url === void 0) throw last instanceof Error ? last : new Error(typeof last === "string" ? last : method);
+		try {
+			const body = await (await fetchFn(url, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					jsonrpc: "2.0",
+					id: 1,
+					method,
+					params
+				})
+			})).json();
+			if (!isObject$5(body)) return await attempt(next, /* @__PURE__ */ new Error(`malformed response from ${url}`));
+			if (body["error"] !== void 0) {
+				const msg = isObject$5(body["error"]) ? body["error"]["message"] : void 0;
+				return await attempt(next, new Error(typeof msg === "string" ? msg : method));
+			}
+			return body["result"];
+		} catch (error) {
+			return attempt(next, error);
+		}
+	};
+	return attempt(urls, void 0);
+} });
 var NetworkController = class extends Controller {
 	options;
 	engineStore;
 	clients = /* @__PURE__ */ new Map();
+	gatewayBase;
+	gatewayOrigin;
+	/** Networks the gateway reported at unlock; empty while locked or when the read failed. */
+	gatewayServed = /* @__PURE__ */ new Set();
 	constructor(options) {
 		super({
 			name: "networks",
 			defaultState: () => ({ customRpc: {} })
 		});
 		this.options = options;
+		if (options.gateway !== void 0) {
+			this.gatewayBase = options.gateway.url.replace(/\/+$/, "");
+			this.gatewayOrigin = new URL(options.gateway.url).origin;
+		}
 	}
 	async init() {
 		this.engineStore = await this.options.openStore();
-		const raw = await this.engineStore.collection("networks").get("customRpc");
+		await this.loadCustomRpc(this.engineStore);
+		await this.loadGatewayNetworks();
+	}
+	async loadCustomRpc(store) {
+		const raw = await store.collection("networks").get("customRpc");
 		if (raw === void 0) return;
 		const parsed = JSON.parse(new TextDecoder().decode(raw));
 		if (typeof parsed === "object" && parsed !== null) {
@@ -2741,16 +3893,56 @@ var NetworkController = class extends Controller {
 			}));
 		}
 	}
+	/** Reads the gateway's served networks; any failure leaves the gateway unused until next unlock. */
+	async loadGatewayNetworks() {
+		if (this.gatewayBase === void 0) return;
+		const url = `${this.gatewayBase}${networksPath}`;
+		try {
+			const res = await this.gatewayFetch(url, { signal: AbortSignal.timeout(GATEWAY_PROBE_TIMEOUT_MS) });
+			if (!res.ok) throw new Error(`status ${res.status}`);
+			const body = await res.json();
+			const served = parseWith(servedNetworksResponse, body);
+			if (served === void 0) throw new Error("malformed response");
+			this.gatewayServed = new Set(served.networks);
+		} catch {
+			this.gatewayServed = /* @__PURE__ */ new Set();
+			this.options.logger.warn(`gateway unavailable, not used for this session: ${url}`);
+		}
+	}
+	/** `fetch` that adds the install id to requests bound for the gateway's origin only. */
+	gatewayFetch = async (input, init) => {
+		const { gateway } = this.options;
+		const target = input instanceof Request ? input.url : String(input);
+		if (gateway === void 0 || new URL(target).origin !== this.gatewayOrigin) return this.options.fetch(input, init);
+		const headers = new Headers(init?.headers);
+		headers.set(INSTALL_ID_HEADER, gateway.installId);
+		return this.options.fetch(input, {
+			...init,
+			headers
+		});
+	};
 	async destroy() {
 		this.lock();
 		await Promise.resolve();
 	}
 	lock() {
+		this.gatewayServed = /* @__PURE__ */ new Set();
 		this.clients.clear();
 		this.engineStore = void 0;
 	}
+	/**
+	* Ordered endpoints: a network with custom endpoints uses custom → host and never the gateway;
+	* otherwise a gateway-served network uses gateway → host; else host only.
+	*/
 	endpoints(network) {
-		return [...this.getState().customRpc[network] ?? [], ...this.options.rpc[network] ?? []];
+		const custom = this.getState().customRpc[network] ?? [];
+		const host = this.options.rpc[network] ?? [];
+		if (custom.length > 0) return [...custom, ...host];
+		if (this.gatewayBase !== void 0 && this.gatewayServed.has(network)) {
+			const path = networkById(network)?.family === "bitcoin" ? esploraBasePath(network) : rpcPath(network);
+			return [`${this.gatewayBase}${path}`, ...host];
+		}
+		return host;
 	}
 	info(network) {
 		const info = networkById(network);
@@ -2763,78 +3955,56 @@ var NetworkController = class extends Controller {
 		if (cached !== void 0) return cached;
 		const urls = this.endpoints(network);
 		if (urls.length === 0) throw new Error(`no rpc endpoint for ${network}`);
-		const client = createPublicClient({
-			chain: {
-				id: info.chainId,
-				name: info.name,
-				nativeCurrency: {
-					name: info.symbol,
-					symbol: info.symbol,
-					decimals: info.decimals
-				},
-				rpcUrls: { default: { http: urls } }
-			},
-			transport: fallback(urls.map((url) => http(url, { fetchFn: this.options.fetch }))),
-			batch: { multicall: true }
-		});
+		const client = makeClient(info, urls, this.gatewayFetch);
 		this.clients.set(network, client);
 		return client;
 	}
-	/** Validate a custom endpoint's reported chain id, then persist it first in the list. */
-	/** Solana JSON-RPC over the ordered endpoint list — kit's transport is single-endpoint. */
-	/** Networks with at least one configured endpoint, filtered by family. */
+	/** True when the gateway heads this network's endpoint list (no custom endpoints, gateway-served). */
+	gatewayFirst(network) {
+		return (this.getState().customRpc[network] ?? []).length === 0 && this.gatewayBase !== void 0 && this.gatewayServed.has(network);
+	}
+	independent(network, make) {
+		if (!this.gatewayFirst(network)) return { kind: "not-needed" };
+		const hosts = this.options.rpc[network] ?? [];
+		return hosts.length === 0 ? { kind: "unavailable" } : {
+			kind: "available",
+			client: make(hosts)
+		};
+	}
+	/** Host-endpoint EVM client for cross-checking reads; never sends the install id. */
+	independentClient(network) {
+		return this.independent(network, (hosts) => makeClient(this.info(network), hosts, this.options.fetch));
+	}
+	independentSolanaRpc(network) {
+		return this.independent(network, (hosts) => solanaCaller(hosts, this.options.fetch));
+	}
+	independentEsplora(network) {
+		return this.independent(network, (hosts) => esploraClient(hosts, this.options.fetch));
+	}
+	/** Networks with at least one configured endpoint or served by the gateway, by family. */
 	enabled(family) {
-		return [.../* @__PURE__ */ new Set([...Object.keys(this.options.rpc), ...Object.keys(this.getState().customRpc)])].filter((id) => {
+		return [.../* @__PURE__ */ new Set([
+			...Object.keys(this.options.rpc),
+			...Object.keys(this.getState().customRpc),
+			...this.gatewayServed
+		])].filter((id) => {
 			const info = networkById(id);
 			return info !== void 0 && info.family === family;
 		});
 	}
+	/** Solana JSON-RPC over the ordered endpoint list — kit's transport is single-endpoint. */
 	solanaRpc(network) {
 		const urls = this.endpoints(network);
 		if (urls.length === 0) throw new Error(`no rpc endpoint for ${network}`);
-		return { call: async (method, params) => {
-			const attempt = async (rest, last) => {
-				const [url, ...next] = rest;
-				if (url === void 0) throw last instanceof Error ? last : new Error(typeof last === "string" ? last : method);
-				try {
-					const body = await (await this.options.fetch(url, {
-						method: "POST",
-						headers: { "content-type": "application/json" },
-						body: JSON.stringify({
-							jsonrpc: "2.0",
-							id: 1,
-							method,
-							params
-						})
-					})).json();
-					if (!isObject$5(body)) return await attempt(next, /* @__PURE__ */ new Error(`malformed response from ${url}`));
-					if (body["error"] !== void 0) {
-						const msg = isObject$5(body["error"]) ? body["error"]["message"] : void 0;
-						return await attempt(next, new Error(typeof msg === "string" ? msg : method));
-					}
-					return body["result"];
-				} catch (error) {
-					return attempt(next, error);
-				}
-			};
-			return attempt(urls, void 0);
-		} };
+		return solanaCaller(urls, this.gatewayFetch);
 	}
 	/** Bounded-concurrency + 429-aware ordered-failover Esplora client. */
 	esplora(network) {
 		const urls = this.endpoints(network);
 		if (urls.length === 0) throw new Error(`no esplora endpoint for ${network}`);
-		return esplora(urls, async (url, init) => {
-			const r = await this.options.fetch(url, init);
-			return {
-				ok: r.ok,
-				status: r.status,
-				headers: { get: (h) => r.headers.get(h) ?? void 0 },
-				json: async () => r.json(),
-				text: async () => r.text()
-			};
-		}, esploraSleep);
+		return esploraClient(urls, this.gatewayFetch);
 	}
+	/** Validate a custom endpoint's reported chain id, then persist it first in the list. */
 	async addRpc(network, url) {
 		const info = this.info(network);
 		if (info.family === "bitcoin") {
@@ -3166,156 +4336,6 @@ function parsePayment(input, options) {
 	}
 }
 //#endregion
-//#region src/spark/errors.ts
-var SparkControllerError = class extends Error {
-	category;
-	constructor(category, message, cause) {
-		super(message, { cause });
-		this.name = "SparkControllerError";
-		this.category = category;
-	}
-};
-/** Maps a thrown client/kernel error into a category without leaking payloads. */
-function categorize(error) {
-	const name = error instanceof Error ? error.name : "";
-	const message = error instanceof Error ? error.message : "";
-	if (/approval|denied|rejected/i.test(message)) return /required/i.test(message) ? "approval-required" : "rejected";
-	if (/insufficient|not enough|balance/i.test(message)) return "insufficient-funds";
-	if (name === "SparkRequestError" || /fetch|network|timeout|unavailable|closed/i.test(message)) return "network";
-	return "internal";
-}
-//#endregion
-//#region src/payments/errors.ts
-var PaymentError = class extends Error {
-	category;
-	constructor(category, message, cause) {
-		super(message, { cause });
-		this.name = "PaymentError";
-		this.category = category;
-	}
-};
-//#endregion
-//#region src/payments/pay.ts
-/**
-* Executes one parsed payment option. Every input validation happens before the approval round — a
-* `PaymentError` here never consumed a verification. `SparkControllerError` and `WalletError` pass
-* through untouched.
-*/
-async function pay(context, params) {
-	const { spark } = context;
-	const ref = params.account;
-	let result;
-	switch (params.option.kind) {
-		case "spark":
-			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "spark payment: amountSats is required");
-			result = {
-				kind: "spark",
-				transfer: await spark.send(ref, {
-					receiver: params.option.address,
-					amountSats: params.amountSats,
-					verify: params.verify
-				})
-			};
-			break;
-		case "spark-invoice": {
-			if (params.option.expiresAt !== void 0 && params.option.expiresAt <= context.now()) throw new PaymentError("rejected", "spark invoice expired");
-			if (params.option.amountSats !== void 0 && params.amountSats !== void 0 && params.amountSats !== params.option.amountSats) throw new PaymentError("invalid-input", "spark invoice: amountSats conflicts with the invoice amount");
-			const invoiceAmount = params.option.amountSats === void 0 ? params.amountSats : void 0;
-			result = {
-				kind: "spark",
-				transfer: await spark.paySparkInvoice(ref, {
-					invoice: params.option.invoice,
-					...invoiceAmount === void 0 ? {} : { amountSats: invoiceAmount },
-					verify: params.verify
-				})
-			};
-			break;
-		}
-		case "lightning":
-			if (params.option.amountSats === void 0 && params.amountSats === void 0) throw new PaymentError("invalid-input", "amountless invoice: amountSats is required");
-			if (params.maxFeeSats === void 0) throw new PaymentError("invalid-input", "lightning payment: maxFeeSats is required");
-			if (params.option.expiresAt <= context.now() + 6e4) throw new PaymentError("rejected", "lightning invoice expired");
-			if (params.option.amountSats !== void 0 && params.amountSats !== void 0 && params.amountSats !== params.option.amountSats) throw new PaymentError("invalid-input", "amountSats conflicts with the invoice amount");
-			result = {
-				kind: "lightning",
-				payment: await spark.payInvoice(ref, {
-					invoice: params.option.invoice,
-					maxFeeSats: params.maxFeeSats,
-					...params.option.amountSats === void 0 && params.amountSats !== void 0 ? { amountSats: params.amountSats } : {},
-					verify: params.verify
-				})
-			};
-			break;
-		case "lnurl-pay": {
-			const { request } = params.option;
-			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "lnurl-pay: amountSats is required");
-			if (params.maxFeeSats === void 0) throw new PaymentError("invalid-input", "lnurl-pay: maxFeeSats is required");
-			const amountMsat = params.amountSats * 1e3;
-			if (amountMsat < request.minSendableMsat || amountMsat > request.maxSendableMsat) throw new PaymentError("rejected", "lnurl-pay: amount outside the service's range");
-			if (request.commentAllowed === 0 && params.comment !== void 0) throw new PaymentError("rejected", "lnurl-pay: comments not accepted by this service");
-			if (params.comment !== void 0 && params.comment.length > request.commentAllowed) throw new PaymentError("rejected", "lnurl-pay: comment exceeds the service's limit");
-			let requested;
-			try {
-				requested = await requestInvoice(request, {
-					fetch: context.fetch,
-					network: ref.network,
-					amountMsat,
-					...params.comment === void 0 ? {} : { comment: params.comment }
-				});
-			} catch (error) {
-				if (error instanceof PaymentError || error instanceof SparkControllerError) throw error;
-				throw new PaymentError("network", "lnurl-pay: invoice request failed", error);
-			}
-			result = {
-				kind: "lightning",
-				payment: await spark.payInvoice(ref, {
-					invoice: requested.invoice,
-					maxFeeSats: params.maxFeeSats,
-					verify: params.verify
-				})
-			};
-			break;
-		}
-		case "lnurl-withdraw": {
-			const { request } = params.option;
-			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "lnurl-withdraw: amountSats is required");
-			const amountMsat = params.amountSats * 1e3;
-			if (amountMsat < request.minWithdrawableMsat || amountMsat > request.maxWithdrawableMsat) throw new PaymentError("rejected", "lnurl-withdraw: amount outside the service's range");
-			const invoice = await spark.createInvoice(ref, {
-				amountSats: params.amountSats,
-				memo: request.defaultDescription
-			});
-			try {
-				await submitWithdraw(request, {
-					fetch: context.fetch,
-					invoice: invoice.invoice
-				});
-			} catch (error) {
-				if (error instanceof PaymentError || error instanceof SparkControllerError) throw error;
-				throw new PaymentError("network", "lnurl-withdraw: submission failed", error);
-			}
-			result = {
-				kind: "lnurl-withdraw",
-				invoice
-			};
-			break;
-		}
-		case "bitcoin":
-			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "bitcoin payment: amountSats is required");
-			result = {
-				kind: "withdraw",
-				exit: await spark.withdraw(ref, {
-					address: params.option.address,
-					speed: params.speed ?? "MEDIUM",
-					verify: params.verify,
-					amountSats: params.amountSats,
-					...params.maxFeeSats === void 0 ? {} : { maxFeeSats: params.maxFeeSats }
-				})
-			};
-	}
-	return result;
-}
-//#endregion
 //#region src/payments/resolve.ts
 /**
 * `parsePayment` plus LNURL dereferencing: an `lnurl` result is fetched and turned into a concrete
@@ -3352,91 +4372,6 @@ async function resolvePayment(input, options) {
 	};
 }
 //#endregion
-//#region src/payments/zap.ts
-/** Everything up to payment: resolve LNURL, sign the 9734, request the invoice. */
-async function prepareZap(params, context) {
-	const amountMsat = params.amountSats * 1e3;
-	if (!Number.isSafeInteger(params.amountSats) || params.amountSats <= 0 || !Number.isSafeInteger(amountMsat)) throw new PaymentError("invalid-input", "zap amount is not a positive safe integer");
-	try {
-		const resolved = await resolveLnurl(params.recipient.lightning, { fetch: context.fetch });
-		if (resolved.tag !== "payRequest") throw new PaymentError("rejected", "recipient is not an LNURL-pay endpoint");
-		if (!resolved.allowsNostr || resolved.nostrPubkey === void 0) throw new PaymentError("rejected", "LNURL service does not accept nostr zaps");
-		if (amountMsat < resolved.minSendableMsat || amountMsat > resolved.maxSendableMsat) throw new PaymentError("rejected", "zap amount outside the service's bounds");
-		if (params.comment !== void 0) {
-			if (resolved.commentAllowed === 0) throw new PaymentError("rejected", "the service does not accept comments");
-			if (params.comment.length > resolved.commentAllowed) throw new PaymentError("rejected", "comment exceeds the service's limit");
-		}
-		const lnurl = params.recipient.lightning.toLowerCase().startsWith("lnurl1") ? params.recipient.lightning.toLowerCase() : encodeLnurl(lightningAddressUrl(params.recipient.lightning));
-		const base = {
-			amount: amountMsat,
-			relays: [...params.relays],
-			comment: params.comment,
-			lnurl
-		};
-		const unsigned = {
-			..."event" in params.recipient ? makeZapRequest({
-				event: params.recipient.event,
-				...base
-			}) : makeZapRequest({
-				pubkey: params.recipient.pubkey,
-				...base
-			}),
-			pubkey: await params.signer.getPublicKey()
-		};
-		const zapRequest = await params.signer.signEvent(unsigned);
-		if (!verifyEvent(zapRequest) || !signedMatchesUnsigned(zapRequest, unsigned)) throw new PaymentError("rejected", "signer returned a zap request that does not match");
-		const { invoice } = await requestInvoice(resolved, {
-			fetch: context.fetch,
-			network: params.network,
-			amountMsat,
-			...params.comment === void 0 ? {} : { comment: params.comment },
-			zapRequest: JSON.stringify(zapRequest)
-		});
-		const decoded = decodeBolt11(invoice);
-		const expiresAt = (decoded.timestamp + decoded.expirySeconds) * 1e3;
-		if (expiresAt <= context.now() + 6e4) throw new PaymentError("rejected", "zap invoice expires too soon");
-		const eventId = "event" in params.recipient ? params.recipient.event.id : void 0;
-		return {
-			zapRequest,
-			invoice,
-			paymentHash: bytesToHex(decoded.paymentHash),
-			expiresAt,
-			amountSats: params.amountSats,
-			receiptPubkey: bytesToHex(resolved.nostrPubkey),
-			recipientPubkey: "event" in params.recipient ? params.recipient.event.pubkey : params.recipient.pubkey,
-			...eventId === void 0 ? {} : { eventId },
-			...params.comment === void 0 ? {} : { comment: params.comment },
-			lightning: params.recipient.lightning
-		};
-	} catch (error) {
-		if (error instanceof PaymentError) throw error;
-		if (error instanceof SparkInputError || error instanceof Error && error.cause instanceof SparkInputError) throw new PaymentError("rejected", "zap failed invoice validation");
-		throw new PaymentError(categorizePayment(error), "zap failed");
-	}
-}
-/**
-* Pays a prepared zap through the controller's approve-first path. A nearly-expired invoice is
-* rejected before approval — the user may have sat on the confirm screen since `prepareZap`.
-*/
-async function payZap(spark, account, prepared, options) {
-	if (prepared.expiresAt <= options.now() + 6e4) throw new PaymentError("rejected", "zap invoice expired");
-	return spark.payInvoice(account, {
-		invoice: prepared.invoice,
-		maxFeeSats: options.maxFeeSats,
-		verify: options.verify,
-		note: {
-			kind: "zap",
-			recipientPubkey: prepared.recipientPubkey,
-			...prepared.eventId === void 0 ? {} : { eventId: prepared.eventId },
-			...prepared.comment === void 0 ? {} : { comment: prepared.comment },
-			lightning: prepared.lightning
-		}
-	});
-}
-function categorizePayment(error) {
-	return categorize(error) === "network" ? "network" : "rejected";
-}
-//#endregion
 //#region src/spark/notes.ts
 const HEX64 = /^[0-9a-f]{64}$/;
 const isObject$4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
@@ -4038,10 +4973,27 @@ const createBitcoinRoute = () => {
 	const bitcoin = new BitcoinChainAdapter();
 	const bitcoinUtxos = new BtcUtxoStore();
 	const pending = /* @__PURE__ */ new Map();
-	const send = async (ctx, params) => {
-		const { account, network, to, amount, fee, verify } = params;
+	/**
+	* Outputs held by a request that has not been broadcast yet ("txid:vout" → request id). Memory
+	* only: the request queue is not persisted, so a crash must not leave anything locked. The
+	* persistent lock (keyed by tx id) is written only once a broadcast succeeds.
+	*/
+	const reserved = /* @__PURE__ */ new Map();
+	const isHeld = (key) => {
+		const [txid = "", vout = "0"] = key.split(":");
+		return reserved.has(key) || bitcoinUtxos.isLocked({
+			txid,
+			vout: Number(vout)
+		});
+	};
+	const releaseReservation = (requestId) => {
+		for (const [key, holder] of reserved) if (holder === requestId) reserved.delete(key);
+	};
+	const prepare = async (ctx, params, requestId) => {
+		const { account, network, to, amount, fee } = params;
 		if (account.kind !== "hd") throw new Error("imported accounts are not yet supported");
 		const es = ctx.options.networks.esplora(network);
+		const independent = ctx.options.networks.independentEsplora(network);
 		const apis = ctx.options.chains ?? chains(ctx.options.wallet);
 		const template = [
 			"btc.bip44",
@@ -4103,9 +5055,25 @@ const createBitcoinRoute = () => {
 		const quotes = await feeTiers(es);
 		const quote = quotes.find((q) => q.tier === (fee === "fast" ? "fast" : fee === "slow" ? "slow" : "normal")) ?? quotes[1];
 		if (quote === void 0) throw new Error("no fee quote");
-		const { psbt, inputs: selected } = bitcoin.buildPsbt(inputs, to, amount, BigInt(quote.satPerByte), changeAddr, net.params);
+		const flags = [independent.kind === "unavailable" ? "reads-unverified" : void 0];
+		let rate = quote.satPerByte;
+		let independentRate;
+		if (independent.kind === "available") try {
+			independentRate = (await feeTiers(independent.client)).find((q) => q.tier === quote.tier)?.satPerByte;
+			if (independentRate === void 0) flags.push("reads-unverified");
+			else {
+				const merged = mergeSatPerByte(quote.satPerByte, independentRate);
+				({rate} = merged);
+				flags.push(merged.mismatch ? "fee-mismatch" : void 0);
+			}
+		} catch {
+			flags.push("reads-unverified");
+		}
+		const free = inputs.filter((i) => !isHeld(`${String(i.txid ?? "")}:${String(i.index ?? 0)}`));
+		const { psbt, inputs: selected } = bitcoin.buildPsbt(free, to, amount, BigInt(rate), changeAddr, net.params);
 		const selectedKeys = new Set(selected.map((i) => `${String(i.txid ?? "")}:${String(i.index ?? 0)}`));
 		const selectedUtxos = utxos.filter((u) => selectedKeys.has(`${u.txid}:${u.vout}`));
+		for (const key of selectedKeys) reserved.set(key, requestId);
 		const txP = Transaction.fromPSBT(psbt);
 		const ownScripts = new Set(change.filter((a) => !a.used).map((a) => hex.encode(scriptPubKey(a.address, net.params))));
 		const request = {
@@ -4130,7 +5098,7 @@ const createBitcoinRoute = () => {
 		const inTotal = selectedUtxos.reduce((a, u) => a + u.value, 0);
 		const outTotal = outValues.reduce((a, o) => a + o.value, 0);
 		const id0 = newId(ctx.options.random);
-		pending.set(id0, {
+		const stash = {
 			inputs,
 			allUtxos: utxos,
 			pathOf: (u) => {
@@ -4152,62 +5120,86 @@ const createBitcoinRoute = () => {
 			tier: fee === "fast" ? "fast" : fee === "slow" ? "slow" : "normal",
 			template,
 			network
-		});
-		let tx = {
-			id: id0,
-			family: "bitcoin",
-			network,
-			account: account.walletId,
-			hash: void 0,
-			state: "draft",
-			intent,
-			nonce: 0,
-			btc: {
-				inputs: selectedUtxos.map((u) => ({
-					txid: u.txid,
-					vout: u.vout,
-					value: u.value,
-					address: u.address
-				})),
-				outputs: outValues,
-				vsize,
-				fee: inTotal - outTotal,
-				feeRate: Math.ceil((inTotal - outTotal) / vsize)
-			},
-			submittedAt: ctx.options.now(),
-			error: void 0
 		};
-		tx = await ctx.transition(tx, {});
-		try {
-			const result = await apis.sign({
-				request,
-				verify
-			});
-			tx = await ctx.transition(tx, { state: "signed" });
-			if (result.kind !== "bitcoin.psbt" || !(result.signedPsbt instanceof Uint8Array)) throw new Error("unexpected bitcoin sign result");
-			bitcoinUtxos.lock(selectedUtxos, tx.id);
-			const signed = Transaction.fromPSBT(result.signedPsbt);
-			signed.finalize();
-			const raw = signed.extract();
-			const hash = String(await es.post("/tx", hex.encode(raw)));
-			tx = await ctx.transition(tx, {
-				state: "submitted",
-				hash,
-				submittedAt: ctx.options.now()
-			});
-			ctx.track(tx.id, hash);
-			return tx;
-		} catch (error) {
-			const failed = tx.state === "signed" ? "failed" : "rejected";
-			await ctx.transition(tx, {
-				state: failed,
-				error: errorMessage(error)
-			});
-			throw error;
-		}
+		const record = {
+			inputs: selectedUtxos.map((u) => ({
+				txid: u.txid,
+				vout: u.vout,
+				value: u.value,
+				address: u.address
+			})),
+			outputs: outValues,
+			vsize,
+			fee: inTotal - outTotal,
+			feeRate: Math.ceil((inTotal - outTotal) / vsize)
+		};
+		if (independentRate !== void 0) flags.push(exceedsNetworkCap(BigInt(record.feeRate), BigInt(Math.ceil(independentRate))) ? "fee-above-network" : void 0);
+		flags.push(feeReachesAmount(BigInt(record.fee), amount) ? "fee-exceeds-amount" : void 0);
+		const submit = async (verify) => {
+			pending.set(id0, stash);
+			let tx = {
+				id: id0,
+				family: "bitcoin",
+				network,
+				account: account.walletId,
+				hash: void 0,
+				state: "draft",
+				intent,
+				nonce: 0,
+				btc: record,
+				submittedAt: ctx.options.now(),
+				error: void 0
+			};
+			tx = await ctx.transition(tx, {});
+			try {
+				const result = await apis.sign({
+					request,
+					verify
+				});
+				tx = await ctx.transition(tx, { state: "signed" });
+				if (result.kind !== "bitcoin.psbt" || !(result.signedPsbt instanceof Uint8Array)) throw new Error("unexpected bitcoin sign result");
+				const signed = Transaction.fromPSBT(result.signedPsbt);
+				signed.finalize();
+				const raw = signed.extract();
+				const hash = String(await es.post("/tx", hex.encode(raw)));
+				bitcoinUtxos.lock(selectedUtxos, tx.id);
+				releaseReservation(requestId);
+				tx = await ctx.transition(tx, {
+					state: "submitted",
+					hash,
+					submittedAt: ctx.options.now()
+				});
+				ctx.track(tx.id, hash);
+				return tx;
+			} catch (error) {
+				const failed = tx.state === "signed" ? "failed" : "rejected";
+				await ctx.transition(tx, {
+					state: failed,
+					error: errorMessage$1(error)
+				});
+				throw error;
+			}
+		};
+		return {
+			txId: id0,
+			account,
+			network,
+			intent,
+			checks: collectChecks(flags),
+			staleReason: () => void 0,
+			submit,
+			release: () => {
+				releaseReservation(requestId);
+			}
+		};
 	};
 	/** Esplora `/tx/:txid/status` → terminal state or `undefined` to keep polling. */
-	const finish = async (ctx, stash, es, account, old, psbt, record, link, verify) => {
+	/**
+	* Builds the approval-ready request for a replacement or CPFP child. `held` are the extra outputs
+	* it spends beyond the original's own inputs; they are reserved in memory here and only locked
+	* persistently, under the new transaction id, once the broadcast succeeds.
+	*/
+	const prepareFinish = (ctx, stash, es, account, old, psbt, record, link, requestId, held, flags) => {
 		const apis = ctx.options.chains ?? chains(ctx.options.wallet);
 		const txP = Transaction.fromPSBT(psbt);
 		const request = {
@@ -4219,59 +5211,78 @@ const createBitcoinRoute = () => {
 		};
 		const ownScripts = new Set(stash.changeAddresses.map((a) => hex.encode(scriptPubKey(a, bitcoinNetwork(stash.network).params))));
 		const intent = decodeBitcoinPsbt(request, ownScripts);
-		let tx = {
-			id: newId(ctx.options.random),
-			family: "bitcoin",
+		const txId = newId(ctx.options.random);
+		for (const key of held) reserved.set(key, requestId);
+		const submit = async (verify) => {
+			let tx = {
+				id: txId,
+				family: "bitcoin",
+				network: old.network,
+				account: old.account,
+				hash: void 0,
+				state: "draft",
+				intent,
+				nonce: 0,
+				btc: record,
+				submittedAt: ctx.options.now(),
+				error: void 0,
+				...link
+			};
+			tx = await ctx.transition(tx, {});
+			try {
+				const result = await apis.sign({
+					request,
+					verify
+				});
+				tx = await ctx.transition(tx, { state: "signed" });
+				if (result.kind !== "bitcoin.psbt" || !(result.signedPsbt instanceof Uint8Array)) throw new Error("unexpected bitcoin sign result");
+				const signed = Transaction.fromPSBT(result.signedPsbt);
+				signed.finalize();
+				const raw = signed.extract();
+				const hash = String(await es.post("/tx", hex.encode(raw)));
+				if (link.replaces !== void 0) bitcoinUtxos.endTx(old.id, "dropped");
+				bitcoinUtxos.lock(record.inputs.map((i) => ({
+					...i,
+					status: "confirmed",
+					height: 0
+				})), tx.id);
+				releaseReservation(requestId);
+				tx = await ctx.transition(tx, {
+					state: "submitted",
+					hash,
+					submittedAt: ctx.options.now()
+				});
+				ctx.track(tx.id, hash);
+				return tx;
+			} catch (error) {
+				const failed = tx.state === "signed" ? "failed" : "rejected";
+				await ctx.transition(tx, {
+					state: failed,
+					error: errorMessage$1(error)
+				});
+				throw error;
+			}
+		};
+		return {
+			txId,
+			account,
 			network: old.network,
-			account: old.account,
-			hash: void 0,
-			state: "draft",
+			target: old.id,
 			intent,
-			nonce: 0,
-			btc: record,
-			submittedAt: ctx.options.now(),
-			error: void 0,
-			...link
+			checks: collectChecks(flags),
+			staleReason: () => link.replaces === void 0 ? void 0 : replacementStaleReason(ctx, old.id),
+			submit,
+			release: () => {
+				releaseReservation(requestId);
+			}
 		};
-		tx = await ctx.transition(tx, {});
-		try {
-			const result = await apis.sign({
-				request,
-				verify
-			});
-			tx = await ctx.transition(tx, { state: "signed" });
-			if (result.kind !== "bitcoin.psbt" || !(result.signedPsbt instanceof Uint8Array)) throw new Error("unexpected bitcoin sign result");
-			bitcoinUtxos.endTx(old.id, "dropped");
-			const signed = Transaction.fromPSBT(result.signedPsbt);
-			signed.finalize();
-			const raw = signed.extract();
-			const hash = String(await es.post("/tx", hex.encode(raw)));
-			bitcoinUtxos.lock(record.inputs.map((i) => ({
-				...i,
-				status: "confirmed",
-				height: 0
-			})), tx.id);
-			tx = await ctx.transition(tx, {
-				state: "submitted",
-				hash,
-				submittedAt: ctx.options.now()
-			});
-			ctx.track(tx.id, hash);
-			return tx;
-		} catch (error) {
-			const failed = tx.state === "signed" ? "failed" : "rejected";
-			await ctx.transition(tx, {
-				state: failed,
-				error: errorMessage(error)
-			});
-			throw error;
-		}
 	};
-	const replace = async (ctx, old, mode, verify) => {
+	const prepareReplace = async (ctx, old, mode, requestId) => {
 		const stash = pending.get(old.id);
 		const { btc } = old;
 		if (stash === void 0 || btc === void 0) throw new Error("the original build context is gone — cannot replace after restart");
 		const es = ctx.options.networks.esplora(old.network);
+		const independent = ctx.options.networks.independentEsplora(old.network);
 		const apis = ctx.options.chains ?? chains(ctx.options.wallet);
 		const { template } = stash;
 		if (!("xpub" in await apis.account({
@@ -4288,7 +5299,20 @@ const createBitcoinRoute = () => {
 		};
 		const tiers = await feeTiers(es);
 		const tierQuote = tiers.find((t) => t.tier === stash.tier) ?? tiers[1];
-		const rate = tierQuote === void 0 ? 1 : tierQuote.satPerByte;
+		let rate = tierQuote === void 0 ? 1 : tierQuote.satPerByte;
+		const flags = [independent.kind === "unavailable" ? "reads-unverified" : void 0];
+		let independentRate;
+		if (independent.kind === "available") try {
+			independentRate = (await feeTiers(independent.client)).find((q) => q.tier === tierQuote?.tier)?.satPerByte;
+			if (independentRate === void 0) flags.push("reads-unverified");
+			else {
+				const merged = mergeSatPerByte(rate, independentRate);
+				({rate} = merged);
+				flags.push(merged.mismatch ? "fee-mismatch" : void 0);
+			}
+		} catch {
+			flags.push("reads-unverified");
+		}
 		const newFee = Math.max(btc.fee + btc.vsize, Math.ceil(btc.vsize * rate));
 		const [changeAddr] = stash.changeAddresses;
 		if (changeAddr === void 0) throw new Error("no unused change address");
@@ -4300,7 +5324,7 @@ const createBitcoinRoute = () => {
 			amount: BigInt(o.value)
 		}));
 		const usedKeys = new Set(btc.inputs.map((i) => `${i.txid}:${i.vout}`));
-		const spare = stash.allUtxos.filter((u) => !usedKeys.has(`${u.txid}:${u.vout}`));
+		const spare = stash.allUtxos.filter((u) => !usedKeys.has(`${u.txid}:${u.vout}`) && !isHeld(`${u.txid}:${u.vout}`));
 		const extraInputs = [];
 		const extraUtxos = [];
 		const feeNeeded = (o) => BigInt(newFee) - (BigInt(inTotal) + extraUtxos.reduce((a, u) => a + BigInt(u.value), 0n) - o.reduce((a, x) => a + x.amount, 0n));
@@ -4371,13 +5395,15 @@ const createBitcoinRoute = () => {
 			fee: newFee,
 			feeRate: Math.ceil(newFee / vsize)
 		};
-		return finish(ctx, stash, es, account, old, psbt, record, { replaces: old.id }, verify);
+		if (independentRate !== void 0) flags.push(exceedsNetworkCap(BigInt(record.feeRate), BigInt(Math.ceil(independentRate))) ? "fee-above-network" : void 0);
+		return prepareFinish(ctx, stash, es, account, old, psbt, record, { replaces: old.id }, requestId, extraUtxos.map((u) => `${u.txid}:${u.vout}`), flags);
 	};
-	const bumpChild = async (ctx, old, targetRate, verify) => {
+	const prepareCpfp = async (ctx, old, targetRate, requestId) => {
 		const stash = pending.get(old.id);
 		const { btc } = old;
 		if (stash === void 0 || btc === void 0) throw new Error("the parent build context is gone — cannot bump after restart");
 		const es = ctx.options.networks.esplora(old.network);
+		const independent = ctx.options.networks.independentEsplora(old.network);
 		const { template } = stash;
 		const account = {
 			kind: "hd",
@@ -4390,6 +5416,15 @@ const createBitcoinRoute = () => {
 			vout
 		}] : []);
 		if (own.length === 0) throw new Error("parent has no own outputs to bump");
+		const parentKeys = own.map((o) => `${old.hash ?? ""}:${o.vout}`);
+		if (parentKeys.some((key) => isHeld(key))) throw new Error("the parent's outputs are already reserved by another request");
+		const flags = [independent.kind === "unavailable" ? "reads-unverified" : void 0];
+		if (independent.kind === "available") try {
+			const fastest = (await feeTiers(independent.client)).find((q) => q.tier === "fast");
+			flags.push(fastest === void 0 ? "reads-unverified" : exceedsNetworkCap(BigInt(Math.ceil(targetRate)), BigInt(Math.ceil(fastest.satPerByte))) ? "fee-above-network" : void 0);
+		} catch {
+			flags.push("reads-unverified");
+		}
 		const childInputs = bitcoin.toInputs(own.map((o) => ({
 			txid: old.hash ?? "",
 			vout: o.vout,
@@ -4412,9 +5447,9 @@ const createBitcoinRoute = () => {
 			amount: BigInt(inTotal - childFee)
 		}], net.params);
 		const record = {
-			inputs: own.map((o, i) => ({
+			inputs: own.map((o) => ({
 				txid: old.hash ?? "",
-				vout: i,
+				vout: o.vout,
 				value: o.value,
 				address: o.address
 			})),
@@ -4427,13 +5462,23 @@ const createBitcoinRoute = () => {
 			fee: childFee,
 			feeRate: Math.ceil(childFee / vsize)
 		};
-		return finish(ctx, stash, es, account, old, psbt, record, { parentId: old.id }, verify);
+		return prepareFinish(ctx, stash, es, account, old, psbt, record, { parentId: old.id }, requestId, parentKeys, flags);
+	};
+	const pollAndRelease = async (ctx, tx) => {
+		const state = await poll(ctx, tx);
+		if (state === "confirmed") bitcoinUtxos.endTx(tx.id, "confirmed");
+		return state;
 	};
 	return {
-		send,
-		poll,
-		replace,
-		bumpChild
+		prepare,
+		poll: pollAndRelease,
+		prepareReplace,
+		prepareCpfp,
+		unlock: async (store) => bitcoinUtxos.unlock(store),
+		lock: () => {
+			reserved.clear();
+			bitcoinUtxos.lockStore();
+		}
 	};
 };
 //#endregion
@@ -4445,12 +5490,13 @@ const createEvmRoute = () => {
 	const evm = new EvmChainAdapter();
 	/** In-memory build context keyed by tx id — the inputs a replace rebuilds from. */
 	const pending = /* @__PURE__ */ new Map();
-	const send = async (ctx, params) => {
-		const { account, network, to, amount, fee, verify } = params;
+	const prepare = async (ctx, params) => {
+		const { account, network, to, amount, fee } = params;
 		const { networks } = ctx.options;
 		if (account.kind !== "hd") throw new Error("imported accounts are not yet supported");
 		const info = networks.info(network);
 		const client = networks.client(network);
+		const independent = networks.independentClient(network);
 		const apis = ctx.options.chains ?? chains(ctx.options.wallet);
 		const evmAccount = await apis.account({
 			walletId: account.walletId,
@@ -4459,6 +5505,15 @@ const createEvmRoute = () => {
 			network
 		});
 		const from = "address" in evmAccount ? evmAccount.address : "";
+		const flags = [independent.kind === "unavailable" ? "reads-unverified" : void 0];
+		let nonce = await evm.nextNonce(client, network, from);
+		if (independent.kind === "available") try {
+			const [primary, other] = await Promise.all([evm.pendingCount(client, from), evm.pendingCount(independent.client, from)]);
+			nonce = Math.max(nonce, other);
+			flags.push(primary === other ? void 0 : "nonce-mismatch");
+		} catch {
+			flags.push("reads-unverified");
+		}
 		const unsigned = await evm.build(client, network, from, params.token === void 0 ? {
 			kind: "native",
 			to,
@@ -4468,81 +5523,124 @@ const createEvmRoute = () => {
 			token: params.token,
 			to,
 			value: amount
-		});
+		}, nonce);
 		const quotes = await evm.estimateFee(client);
-		const quote = quotes.find((q) => q.tier === fee) ?? quotes[1];
+		let quote = quotes.find((q) => q.tier === fee) ?? quotes[1];
 		if (quote === void 0) throw new Error("no fee quote");
+		if (independent.kind === "available") try {
+			const other = (await evm.estimateFee(independent.client)).find((q) => q.tier === quote?.tier);
+			if (other === void 0) flags.push("reads-unverified");
+			else {
+				const merged = mergeEvmQuote(quote, other);
+				({quote} = merged);
+				flags.push(merged.mismatch ? "fee-mismatch" : void 0, exceedsNetworkCap(quote.maxFeePerGas, other.maxFeePerGas) ? "fee-above-network" : void 0);
+			}
+		} catch {
+			flags.push("reads-unverified");
+		}
 		const feed = evm.applyFee(unsigned, quote);
+		if (params.token === void 0 && feeReachesAmount(feed.gas * (feed.maxFeePerGas ?? feed.gasPrice ?? 0n), amount)) flags.push("fee-exceeds-amount");
 		const request = evm.toSignRequest(feed, account, info.chainId);
 		const intent = decodeEvm(request);
-		const id = newId(ctx.options.random);
-		pending.set(id, {
-			unsigned: feed,
-			request,
-			quote,
-			chainId: info.chainId
-		});
-		let tx = {
-			id,
-			family: "evm",
+		const txId = newId(ctx.options.random);
+		const chosen = quote;
+		const submit = async (verify) => {
+			pending.set(txId, {
+				unsigned: feed,
+				request,
+				quote: chosen,
+				chainId: info.chainId
+			});
+			let tx = {
+				id: txId,
+				family: "evm",
+				network,
+				account: account.walletId,
+				hash: void 0,
+				state: "draft",
+				intent,
+				nonce: unsigned.nonce,
+				submittedAt: ctx.options.now(),
+				error: void 0
+			};
+			tx = await ctx.transition(tx, {});
+			let signed;
+			try {
+				const result = await apis.sign({
+					request,
+					verify
+				});
+				tx = await ctx.transition(tx, { state: "signed" });
+				signed = result;
+			} catch (error) {
+				await ctx.transition(tx, {
+					state: "rejected",
+					error: errorMessage$1(error)
+				});
+				throw error;
+			}
+			try {
+				const raw = evm.finalize(feed, signed);
+				const hash = await evm.broadcast(client, raw);
+				evm.commitNonce(network, from, unsigned.nonce);
+				tx = await ctx.transition(tx, {
+					state: "submitted",
+					hash,
+					submittedAt: ctx.options.now()
+				});
+				ctx.track(tx.id, hash);
+				return tx;
+			} catch (error) {
+				await ctx.transition(tx, {
+					state: "failed",
+					error: errorMessage$1(error)
+				});
+				throw error;
+			}
+		};
+		return {
+			txId,
+			account,
 			network,
-			account: account.walletId,
-			hash: void 0,
-			state: "draft",
 			intent,
-			nonce: unsigned.nonce,
-			submittedAt: ctx.options.now(),
-			error: void 0
+			checks: collectChecks(flags),
+			staleReason: () => evm.nonceConsumed(network, from, unsigned.nonce) ? "nonce already used by a newer transaction — start over" : void 0,
+			submit,
+			release: () => void 0
 		};
-		tx = await ctx.transition(tx, {});
-		let signed;
-		try {
-			const result = await apis.sign({
-				request,
-				verify
-			});
-			tx = await ctx.transition(tx, { state: "signed" });
-			signed = result;
-		} catch (error) {
-			await ctx.transition(tx, {
-				state: "rejected",
-				error: errorMessage(error)
-			});
-			throw error;
-		}
-		try {
-			const raw = evm.finalize(feed, signed);
-			const hash = await evm.broadcast(client, raw);
-			tx = await ctx.transition(tx, {
-				state: "submitted",
-				hash,
-				submittedAt: ctx.options.now()
-			});
-			ctx.track(tx.id, hash);
-			return tx;
-		} catch (error) {
-			await ctx.transition(tx, {
-				state: "failed",
-				error: errorMessage(error)
-			});
-			throw error;
-		}
 	};
 	/**
 	* EVM speed-up/cancel — replaces a pending tx at the same nonce with a bumped fee (cancel = a
-	* 0-value transfer to self). The new tx carries `replaces` and needs a fresh signature; a
-	* rejected one never reaches the network and leaves the original.
+	* 0-value transfer to self). The fee is cross-checked and merged first, then the replacement
+	* floor (+10% on both fee fields, never below the merged estimate) is applied on top, so a low
+	* quote can never push the replacement under the node's replacement rule. A rejected signature
+	* never reaches the network and leaves the original.
 	*/
-	const replace = async (ctx, old, mode, verify) => {
+	const prepareReplace = async (ctx, old, mode) => {
 		const stash = pending.get(old.id);
 		if (stash === void 0) throw new Error("the original build context is gone — cannot replace after restart");
 		const { networks } = ctx.options;
 		const client = networks.client(old.network);
+		const independent = networks.independentClient(old.network);
 		const apis = ctx.options.chains ?? chains(ctx.options.wallet);
 		const { tier } = stash.quote;
 		const estimates = await evm.estimateFee(client);
-		const estimate = estimates.find((q) => q.tier === tier) ?? estimates[1];
+		let estimate = estimates.find((q) => q.tier === tier) ?? estimates[1];
 		if (estimate === void 0) throw new Error("no fee quote");
+		const flags = [independent.kind === "unavailable" ? "reads-unverified" : void 0];
+		let independentCap;
+		if (independent.kind === "available") try {
+			const other = (await evm.estimateFee(independent.client)).find((q) => q.tier === estimate?.tier);
+			if (other === void 0) flags.push("reads-unverified");
+			else {
+				const merged = mergeEvmQuote(estimate, other);
+				({quote: estimate} = merged);
+				independentCap = other.maxFeePerGas;
+				flags.push(merged.mismatch ? "fee-mismatch" : void 0);
+			}
+		} catch {
+			flags.push("reads-unverified");
+		}
 		const oldFee = stash.unsigned;
 		const bumpedFee = bump(oldFee.maxFeePerGas ?? oldFee.gasPrice ?? 0n);
 		const maxFeePerGas = bumpedFee > estimate.maxFeePerGas ? bumpedFee : estimate.maxFeePerGas;
@@ -4551,6 +5649,7 @@ const createEvmRoute = () => {
 			maxFeePerGas,
 			maxPriorityFeePerGas: priorityBump
 		};
+		if (independentCap !== void 0) flags.push(exceedsNetworkCap(maxFeePerGas, independentCap) ? "fee-above-network" : void 0);
 		const unsigned = mode === "cancel" ? {
 			...stash.unsigned,
 			to: stash.unsigned.from,
@@ -4564,59 +5663,72 @@ const createEvmRoute = () => {
 		};
 		const request = evm.toSignRequest(unsigned, stash.request.account, stash.chainId);
 		const intent = decodeEvm(request);
-		const id = newId(ctx.options.random);
-		pending.set(id, {
-			unsigned,
-			request,
-			quote: stash.quote,
-			chainId: stash.chainId
-		});
-		let tx = {
-			id,
-			family: "evm",
+		const txId = newId(ctx.options.random);
+		const submit = async (verify) => {
+			pending.set(txId, {
+				unsigned,
+				request,
+				quote: stash.quote,
+				chainId: stash.chainId
+			});
+			let tx = {
+				id: txId,
+				family: "evm",
+				network: old.network,
+				account: old.account,
+				hash: void 0,
+				state: "draft",
+				intent,
+				nonce: old.nonce,
+				replaces: old.id,
+				submittedAt: ctx.options.now(),
+				error: void 0
+			};
+			tx = await ctx.transition(tx, {});
+			let signed;
+			try {
+				const result = await apis.sign({
+					request,
+					verify
+				});
+				tx = await ctx.transition(tx, { state: "signed" });
+				signed = result;
+			} catch (error) {
+				await ctx.transition(tx, {
+					state: "rejected",
+					error: errorMessage$1(error)
+				});
+				throw error;
+			}
+			try {
+				const raw = evm.finalize(unsigned, signed);
+				const hash = await evm.broadcast(client, raw);
+				tx = await ctx.transition(tx, {
+					state: "submitted",
+					hash,
+					submittedAt: ctx.options.now()
+				});
+				ctx.track(tx.id, hash);
+				return tx;
+			} catch (error) {
+				await ctx.transition(tx, {
+					state: "failed",
+					error: errorMessage$1(error)
+				});
+				throw error;
+			}
+		};
+		return {
+			txId,
+			account: stash.request.account,
 			network: old.network,
-			account: old.account,
-			hash: void 0,
-			state: "draft",
+			target: old.id,
 			intent,
-			nonce: old.nonce,
-			replaces: old.id,
-			submittedAt: ctx.options.now(),
-			error: void 0
+			checks: collectChecks(flags),
+			staleReason: () => replacementStaleReason(ctx, old.id),
+			submit,
+			release: () => void 0
 		};
-		tx = await ctx.transition(tx, {});
-		let signed;
-		try {
-			const result = await apis.sign({
-				request,
-				verify
-			});
-			tx = await ctx.transition(tx, { state: "signed" });
-			signed = result;
-		} catch (error) {
-			await ctx.transition(tx, {
-				state: "rejected",
-				error: errorMessage(error)
-			});
-			throw error;
-		}
-		try {
-			const raw = evm.finalize(unsigned, signed);
-			const hash = await evm.broadcast(client, raw);
-			tx = await ctx.transition(tx, {
-				state: "submitted",
-				hash,
-				submittedAt: ctx.options.now()
-			});
-			ctx.track(tx.id, hash);
-			return tx;
-		} catch (error) {
-			await ctx.transition(tx, {
-				state: "failed",
-				error: errorMessage(error)
-			});
-			throw error;
-		}
 	};
 	/** Returns the terminal state once the receipt lands, or `undefined` to keep polling. */
 	const poll = async (ctx, tx) => {
@@ -4627,9 +5739,9 @@ const createEvmRoute = () => {
 		return state === "finalized" ? "confirmed" : state;
 	};
 	return {
-		send,
+		prepare,
 		poll,
-		replace
+		prepareReplace
 	};
 };
 PROGRAM_IDS.token2022;
@@ -4819,16 +5931,19 @@ var SolanaChainAdapter = class {
 //#endregion
 //#region src/transactions/solana.ts
 /** Solana route: SOL/SPL send → sign → broadcast, plus status poll with rebroadcast/drop. */
+/** The network's base signature fee, lamports per signature. */
+const BASE_FEE_LAMPORTS = 5000n;
 const isObject$1 = (v) => typeof v === "object" && v !== null;
 const obj = (v) => isObject$1(v) ? v : void 0;
 const arr = (v) => Array.isArray(v) ? v : void 0;
 const solana = new SolanaChainAdapter();
 /** Signed wire transactions kept for re-broadcast until the tx confirms or drops. */
 const wires = /* @__PURE__ */ new Map();
-const sendSolana = async (ctx, params) => {
-	const { account, network, to, amount, fee, verify } = params;
+const prepareSolana = async (ctx, params) => {
+	const { account, network, to, amount, fee } = params;
 	if (account.kind !== "hd") throw new Error("imported accounts are not yet supported");
 	const rpc = ctx.options.networks.solanaRpc(network);
+	const independent = ctx.options.networks.independentSolanaRpc(network);
 	const apis = ctx.options.chains ?? chains(ctx.options.wallet);
 	const solAccount = await apis.account({
 		walletId: account.walletId,
@@ -4870,8 +5985,25 @@ const sendSolana = async (ctx, params) => {
 		...tokenProgram === void 0 ? {} : { tokenProgram }
 	});
 	const quotes = await solana.estimateFee(rpc, unsigned.writable);
-	const quote = quotes.find((q) => q.tier === fee) ?? quotes[1];
+	let quote = quotes.find((q) => q.tier === fee) ?? quotes[1];
 	if (quote === void 0) throw new Error("no fee quote");
+	const flags = [independent.kind === "unavailable" ? "reads-unverified" : void 0];
+	if (independent.kind === "available") try {
+		const other = (await solana.estimateFee(independent.client, unsigned.writable)).find((q) => q.tier === quote?.tier);
+		if (other === void 0) flags.push("reads-unverified");
+		else {
+			const merged = mergeSolanaQuote(quote, other);
+			({quote} = merged);
+			flags.push(merged.mismatch ? "fee-mismatch" : void 0, exceedsNetworkCap(quote.microLamportsPerCu, other.microLamportsPerCu) ? "fee-above-network" : void 0);
+		}
+	} catch {
+		flags.push("reads-unverified");
+	}
+	if (params.token === void 0) {
+		const units = BigInt(Math.ceil((unsigned.unitsConsumed === 0 ? 14e5 : unsigned.unitsConsumed) * 1.1));
+		const maxFee = BASE_FEE_LAMPORTS + (units * quote.microLamportsPerCu + 999999n) / 1000000n;
+		flags.push(feeReachesAmount(maxFee, amount) ? "fee-exceeds-amount" : void 0);
+	}
 	const messageBytes = solana.applyFee(unsigned, quote);
 	const request = {
 		kind: "solana.transaction",
@@ -4881,45 +6013,57 @@ const sendSolana = async (ctx, params) => {
 	};
 	const intent = ext === void 0 || params.token === void 0 ? decodeSolana(request, from) : token2022Intent(decodeSolana(request, from), ext, params.token, amount);
 	const id = newId(ctx.options.random);
-	let tx = {
-		id,
-		family: "solana",
+	const submit = async (verify) => {
+		let tx = {
+			id,
+			family: "solana",
+			network,
+			account: account.walletId,
+			hash: void 0,
+			state: "draft",
+			intent,
+			nonce: 0,
+			lastValidBlockHeight: Number(unsigned.lastValidBlockHeight),
+			submittedAt: ctx.options.now(),
+			error: void 0
+		};
+		tx = await ctx.transition(tx, {});
+		try {
+			const result = await apis.sign({
+				request,
+				verify
+			});
+			tx = await ctx.transition(tx, { state: "signed" });
+			if (result.kind !== "solana.transaction" || !(result.signature instanceof Uint8Array)) throw new Error("unexpected solana sign result");
+			const wire = solana.finalize(messageBytes, [result.signature]);
+			const hash = await solana.broadcast(rpc, wire);
+			wires.set(id, wire);
+			tx = await ctx.transition(tx, {
+				state: "submitted",
+				hash,
+				submittedAt: ctx.options.now()
+			});
+			ctx.track(tx.id, hash);
+			return tx;
+		} catch (error) {
+			const failed = tx.state === "signed" ? "failed" : "rejected";
+			await ctx.transition(tx, {
+				state: failed,
+				error: errorMessage$1(error)
+			});
+			throw error;
+		}
+	};
+	return {
+		txId: id,
+		account,
 		network,
-		account: account.walletId,
-		hash: void 0,
-		state: "draft",
 		intent,
-		nonce: 0,
-		lastValidBlockHeight: Number(unsigned.lastValidBlockHeight),
-		submittedAt: ctx.options.now(),
-		error: void 0
+		checks: collectChecks(flags),
+		staleReason: async () => await solana.blockHeight(rpc) > unsigned.lastValidBlockHeight ? "blockhash expired — start over" : void 0,
+		submit,
+		release: () => void 0
 	};
-	tx = await ctx.transition(tx, {});
-	try {
-		const result = await apis.sign({
-			request,
-			verify
-		});
-		tx = await ctx.transition(tx, { state: "signed" });
-		if (result.kind !== "solana.transaction" || !(result.signature instanceof Uint8Array)) throw new Error("unexpected solana sign result");
-		const wire = solana.finalize(messageBytes, [result.signature]);
-		const hash = await solana.broadcast(rpc, wire);
-		wires.set(id, wire);
-		tx = await ctx.transition(tx, {
-			state: "submitted",
-			hash,
-			submittedAt: ctx.options.now()
-		});
-		ctx.track(tx.id, hash);
-		return tx;
-	} catch (error) {
-		const failed = tx.state === "signed" ? "failed" : "rejected";
-		await ctx.transition(tx, {
-			state: failed,
-			error: errorMessage(error)
-		});
-		throw error;
-	}
 };
 /** Returns the terminal state, `dropped` on blockhash expiry, or `undefined` to keep polling. */
 const pollSolana = async (ctx, tx) => {
@@ -5044,6 +6188,7 @@ var TransactionController = class extends Controller {
 	async init() {
 		this.locked = false;
 		this.engineStore = await this.options.openStore();
+		await this.bitcoinRoute.unlock(this.engineStore);
 		const collection = this.engineStore.collection("transactions");
 		const keys = await collection.list();
 		const rows = await Promise.all(keys.map(async (key) => collection.get(key)));
@@ -5070,10 +6215,16 @@ var TransactionController = class extends Controller {
 		this.timers.clear();
 		this.engineStore = void 0;
 		this.evmRoute = createEvmRoute();
+		this.bitcoinRoute.lock();
+		this.bitcoinRoute = createBitcoinRoute();
 	}
 	async persist(tx) {
 		const store = this.engineStore;
-		if (store !== void 0) await store.collection("transactions").put(tx.id, encode(tx));
+		if (store === void 0) {
+			this.options.logger.warn(`transaction ${tx.id} (${tx.state}) not persisted: vault locked`);
+			return;
+		}
+		await store.collection("transactions").put(tx.id, encode(tx));
 	}
 	async transition(tx, next) {
 		const updated = {
@@ -5095,45 +6246,48 @@ var TransactionController = class extends Controller {
 			options: this.options,
 			transition: async (tx, next) => this.transition(tx, next),
 			track: (id, hash) => this.track(id, hash),
+			txs: () => this.getState().txs,
 			newId: () => newId(this.options.random)
 		};
 	}
-	async send(params) {
+	/**
+	* Internal entry for the request pipeline: builds, estimates and cross-checks a send without
+	* signing it. Bitcoin outputs it selects stay locked under `requestId` until the returned
+	* `release` runs or the broadcast moves them to the transaction.
+	*/
+	async prepareSend(params, requestId) {
 		if (this.locked) throw new Error("transactions require an unlocked vault");
 		const { account, network } = params;
 		const info = this.options.networks.info(network);
 		if (account.kind !== "hd") throw new Error("imported accounts are not yet supported");
 		const ctx = this.routeCtx();
-		if (info.family === "solana") return sendSolana(ctx, params);
-		if (info.family === "bitcoin") return this.bitcoinRoute.send(ctx, params);
-		return this.evmRoute.send(ctx, params);
-	}
-	/**
-	* Speed up or cancel a pending/submitted EVM transaction at the same nonce — a fresh signature is
-	* required and a rejection leaves the original untouched.
-	*/
-	async replace(id, mode, verify) {
-		if (this.locked) throw new Error("transactions require an unlocked vault");
-		const old = this.getState().txs[id];
-		if (old === void 0) throw new Error(`unknown transaction ${id}`);
-		if (old.family === "bitcoin") return this.bitcoinRoute.replace(this.routeCtx(), old, mode, verify);
-		if (old.family !== "evm") throw new Error("replace is EVM-only in this layer");
-		if (old.state !== "pending" && old.state !== "submitted") throw new Error(`cannot replace a ${old.state} transaction`);
-		return this.evmRoute.replace(this.routeCtx(), old, mode, verify);
+		if (info.family === "solana") return prepareSolana(ctx, params);
+		if (info.family === "bitcoin") return this.bitcoinRoute.prepare(ctx, params, requestId);
+		return this.evmRoute.prepare(ctx, params);
 	}
 	/**
-	* CPFP — spend an unconfirmed tx's own outputs into a higher-fee child so the package mines.
-	* Bitcoin only; the child is linked via `parentId`.
+	* Internal entry for replacements and CPFP: builds, cross-checks and reserves what the
+	* replacement needs without signing it. The original must be `submitted` or `pending`.
 	*/
-	async bumpChild(id, targetRate, verify) {
+	async prepareReplacement(input, requestId) {
 		if (this.locked) throw new Error("transactions require an unlocked vault");
-		const old = this.getState().txs[id];
-		if (old === void 0) throw new Error(`unknown transaction ${id}`);
-		if (old.family !== "bitcoin") throw new Error("bumpChild is Bitcoin-only in this layer");
-		if (old.state !== "pending" && old.state !== "submitted") throw new Error(`cannot bump a ${old.state} transaction`);
-		return this.bitcoinRoute.bumpChild(this.routeCtx(), old, targetRate, verify);
+		const old = this.getState().txs[input.txId];
+		if (old === void 0) throw new Error(`unknown transaction ${input.txId}`);
+		if (old.state !== "pending" && old.state !== "submitted") throw new Error(`cannot ${input.method} a ${old.state} transaction`);
+		const ctx = this.routeCtx();
+		if (input.method === "cpfp") {
+			if (old.family !== "bitcoin") throw new Error("cpfp is Bitcoin-only");
+			return this.bitcoinRoute.prepareCpfp(ctx, old, input.feeRate, requestId);
+		}
+		if (old.family === "bitcoin") return this.bitcoinRoute.prepareReplace(ctx, old, input.method, requestId);
+		if (old.family === "evm") return this.evmRoute.prepareReplace(ctx, old, input.method);
+		throw new Error(`${input.method} is EVM and Bitcoin only`);
 	}
 	track(id, hash) {
+		if (this.locked) {
+			this.options.logger.warn(`transaction ${id} was broadcast after the vault locked; it is neither persisted nor tracked`);
+			return;
+		}
 		if (this.timers.has(id) || hash === "") return;
 		const poll = this.options.pollMs ?? 4e3;
 		const stop = this.options.setTimer(poll, async () => {
@@ -5193,7 +6347,8 @@ function createWalletEngine(options) {
 		fetch: options.fetch,
 		rpc: options.rpc ?? {},
 		openStore: options.openStore,
-		logger: options.logger
+		logger: options.logger,
+		gateway: options.gateway
 	});
 	const assets = new AssetsController({
 		networks,
@@ -5220,6 +6375,28 @@ function createWalletEngine(options) {
 		now: options.now,
 		logger: options.logger
 	});
+	const addressBook = new AddressBookController({
+		openStore: options.openStore,
+		random: options.random,
+		now: options.now,
+		logger: options.logger
+	});
+	const requests = new RequestController({
+		transactions,
+		addressBook,
+		openStore: options.openStore,
+		spark: controller,
+		fetch: options.fetch,
+		random: options.random,
+		now: options.now,
+		setTimer: options.setTimer ?? ((ms, fn) => {
+			const id = setTimeout(() => {
+				fn();
+			}, ms);
+			return () => clearTimeout(id);
+		}),
+		logger: options.logger
+	});
 	const accounts = new AccountTreeController({
 		wallet: options.wallet,
 		spark: controller,
@@ -5231,6 +6408,7 @@ function createWalletEngine(options) {
 	const metaSync = new MetaSyncController({
 		wallet: options.wallet,
 		accounts,
+		addressBook,
 		nostr: { signer: (ref) => nostr(options.wallet).signer(ref) },
 		metaSync: options.metaSync,
 		logger: options.logger,
@@ -5257,12 +6435,16 @@ function createWalletEngine(options) {
 			backup.trigger();
 			await accounts.init();
 			await controller.init();
+			await addressBook.init();
 			await metaSync.init();
 			await networks.init();
 			await assets.init();
 			await transactions.init();
+			await requests.init();
 		} else if (!unlocked && started) {
 			started = false;
+			requests.lock();
+			addressBook.lock();
 			transactions.lock();
 			assets.lock();
 			networks.lock();
@@ -5302,20 +6484,16 @@ function createWalletEngine(options) {
 		networks,
 		assets,
 		transactions,
+		requests,
+		addressBook,
 		spark: controller,
 		accounts,
 		metaSync,
 		backup,
-		zaps: {
-			prepare: async (params) => prepareZap(params, {
-				fetch: options.fetch,
-				now: options.now
-			}),
-			pay: async (account, prepared, payOptions) => payZap(controller, account, prepared, {
-				...payOptions,
-				now: options.now
-			})
-		},
+		zaps: { prepare: async (params) => prepareZap(params, {
+			fetch: options.fetch,
+			now: options.now
+		}) },
 		payments: {
 			parse: (input, network) => parsePayment(input, {
 				network,
@@ -5326,7 +6504,7 @@ function createWalletEngine(options) {
 				now: options.now(),
 				fetch: options.fetch
 			}),
-			pay: async (params) => pay({
+			withdrawLnurl: async (params) => withdrawLnurl({
 				spark: controller,
 				fetch: options.fetch,
 				now: options.now
@@ -5369,6 +6547,6 @@ function createMemoryCloudStore(backing) {
 	};
 }
 //#endregion
-export { AccountTreeController, AccountTreeError, BackupController, BackupControllerError, Controller, EngineStoreError, MetaSyncController, MetaSyncError, PaymentError, SparkController, SparkControllerError, createEventBus, createMemoryCloudStore, createMemoryEngineStore, createWalletEngine, decodeExitChain, encodeExitChain, parsePayment, payZap, prepareZap, resolvePayment, sparkStore };
+export { AccountTreeController, AccountTreeError, AddressBookController, AddressBookError, BackupController, BackupControllerError, Controller, EngineStoreError, MetaSyncController, MetaSyncError, PaymentError, REQUEST_TTL_MS, RequestController, SparkController, SparkControllerError, createEventBus, createMemoryCloudStore, createMemoryEngineStore, createWalletEngine, decodeExitChain, encodeExitChain, parsePayment, prepareZap, resolvePayment, sparkStore };
 
 //# sourceMappingURL=index.mjs.map