@qntx/wallet-engine 0.5.2 → 0.7.0

package/dist/index.mjs

@@ -1,27 +1,29 @@
+import { A as rpcPath, C as EVM_RPC_METHODS, I as parseWith, c as networkById, i as servedNetworksResponse, t as networksPath, u as esploraBasePath, v as INSTALL_ID_HEADER } from "./contract-CEsgLme3.mjs";
 import { createStore } from "zustand/vanilla";
+import { bytesToHex, hexToBytes, utf8ToBytes } from "@noble/hashes/utils.js";
+import { ChainError } from "@qntx/wallet-chains";
+import { WalletError, parseBackupHeader } from "@qntx/wallet";
+import { Address, OutScript, Transaction } from "@scure/btc-signer";
 import { SparkInputError, bitcoinAddressScript, createSparkClient, decodeBolt11, decodeSparkAddress, encodeSparkAddress, parseSparkInvoice, uuidv7 } from "@qntx/spark";
+import { BITCOIN_NETWORKS, bitcoinAddressFromXpub, bitcoinNetwork, bitcoinPubkeyFromXpub, decodeBitcoinPsbt } from "@qntx/wallet-chains/bitcoin";
+import { checksumEvmAddress, decodeEvm, isEvmAddress, normalizeEvm } from "@qntx/wallet-chains/evm";
+import { PROGRAM_IDS, decodeSolana, isSolanaAddress, netAfterTransferFee, parseMintExtensions } from "@qntx/wallet-chains/solana";
+import { decodeLnurl, encodeLnurl, lightningAddressUrl, registerLightningAddress, requestInvoice, resolveLnurl, submitWithdraw, unregisterLightningAddress } from "@qntx/spark/lnurl";
+import { signedMatchesUnsigned, verifyEvent } from "@qntx/nostr";
+import { makeZapRequest } from "@qntx/nostr/nips/nip57";
+import { chains } from "@qntx/wallet/chains";
 import { nostr } from "@qntx/wallet/nostr";
 import { spark } from "@qntx/wallet/spark";
 import { createPublicClient, decodeFunctionResult, encodeFunctionData, fallback, http, isAddress, isHex, numberToHex } from "viem";
-import { bitcoinAddressFromXpub, bitcoinNetwork, bitcoinPubkeyFromXpub, decodeBitcoinPsbt } from "@qntx/wallet-chains/bitcoin";
-import { chains } from "@qntx/wallet/chains";
 import { sha256 } from "@noble/hashes/sha2.js";
-import { Address, OutScript, Transaction } from "@scure/btc-signer";
-import { checksumEvmAddress, decodeEvm } from "@qntx/wallet-chains/evm";
-import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
-import { parseBackupHeader } from "@qntx/wallet";
-import { signedMatchesUnsigned, verifyEvent } from "@qntx/nostr";
 import { base64, hex } from "@scure/base";
 import { p2wpkh } from "@scure/btc-signer/payment.js";
 import { selectUTXO } from "@scure/btc-signer/utxo.js";
-import { decodeLnurl, encodeLnurl, lightningAddressUrl, registerLightningAddress, requestInvoice, resolveLnurl, submitWithdraw, unregisterLightningAddress } from "@qntx/spark/lnurl";
-import { makeZapRequest } from "@qntx/nostr/nips/nip57";
-import { PROGRAM_IDS, decodeSolana, netAfterTransferFee, parseMintExtensions } from "@qntx/wallet-chains/solana";
 import { getSetComputeUnitLimitInstruction, getSetComputeUnitPriceInstruction } from "@solana-program/compute-budget";
 import { getTransferSolInstruction } from "@solana-program/system";
 import { TOKEN_PROGRAM_ADDRESS, findAssociatedTokenPda, getCreateAssociatedTokenIdempotentInstruction, getTransferCheckedInstruction } from "@solana-program/token";
 import { address, appendTransactionMessageInstructions, blockhash, compileTransactionMessage, createNoopSigner, createTransactionMessage, getCompiledTransactionMessageEncoder, setTransactionMessageFeePayer, setTransactionMessageLifetimeUsingBlockhash } from "@solana/kit";
-//#region src/controller.ts
+// src/controller.ts
 /**
 * Controller base: a zustand vanilla store plus lifecycle. `update` applies a recipe that must
 * return a NEW state object; returning the same reference is a no-op (no set, no notification).
@@ -41,8 +43,7 @@ var Controller = class {
 		this.store.setState((state) => recipe(state));
 	}
 };
-//#endregion
-//#region src/events.ts
+// src/events.ts
 function createEventBus(logger) {
 	const listeners = /* @__PURE__ */ new Map();
 	return {
@@ -67,73 +68,1938 @@ function createEventBus(logger) {
 				set.delete(stored);
 			};
 		}
-	};
+	};
+}
+// src/errors.ts
+/** Typed engine errors: store codes are `closed` and `integrity` (decrypt or bind failure). */
+var EngineStoreError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "EngineStoreError";
+		this.code = code;
+	}
+};
+// src/store/guard.ts
+/** NUL is the composite-key/AAD separator — a name or key containing it collides. */
+function checkName(kind, value) {
+	if (value.includes("\0")) throw new EngineStoreError("invalid-input", `${kind} must not contain NUL`);
+}
+// src/store/memory.ts
+/** In-memory EngineStore: the Node/test implementation — same contract, no durability. */
+function createMemoryEngineStore(backing) {
+	const collections = backing?.collections ?? /* @__PURE__ */ new Map();
+	let closed = false;
+	const guard = () => {
+		if (closed) throw new EngineStoreError("closed", "engine store is closed");
+	};
+	return {
+		collection(name) {
+			checkName("collection", name);
+			let table = collections.get(name);
+			if (table === void 0) {
+				table = /* @__PURE__ */ new Map();
+				collections.set(name, table);
+			}
+			return {
+				get: async (key) => {
+					guard();
+					checkName("key", key);
+					const value = table.get(key);
+					return value === void 0 ? void 0 : new Uint8Array(value);
+				},
+				put: async (key, bytes) => {
+					guard();
+					checkName("key", key);
+					table.set(key, new Uint8Array(bytes));
+				},
+				delete: async (key) => {
+					guard();
+					checkName("key", key);
+					table.delete(key);
+				},
+				list: async () => {
+					guard();
+					return [...table.keys()];
+				}
+			};
+		},
+		close: async () => {
+			closed = true;
+			collections.clear();
+		}
+	};
+}
+// src/connect/errors.ts
+/** EIP-1193 / EIP-1474 / EIP-3326 error: `code` is what the page's promise rejects with. */
+var ProviderError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "ProviderError";
+		this.code = code;
+	}
+};
+const userRejectedRequest = (message = "user rejected the request") => new ProviderError(4001, message);
+const unauthorized = (message = "not authorized") => new ProviderError(4100, message);
+const unsupportedMethod = (method) => new ProviderError(4200, `${method} is not supported`);
+const unrecognizedChain = (message = "unrecognized chain") => new ProviderError(4902, message);
+const invalidParams = (message) => new ProviderError(-32602, message);
+const requestPending = (message) => new ProviderError(-32002, message);
+const internalError = (message) => new ProviderError(-32603, message);
+// src/connect/controller.ts
+/**
+* DApp connections (CAIP-25 style sessions): one session per origin, authorization by network,
+* account and method, persisted in the engine store and cleared from memory on lock. A connection
+* is approved from a pending queue, by id, like any other request; locking rejects all of it.
+*/
+const COLLECTION$4 = "connections";
+/** `lastUsedAt` is rewritten at most this often. */
+const TOUCH_INTERVAL_MS = 6e4;
+/** Granted for every network a session covers. */
+const SESSION_METHODS = [
+	"eth_sendTransaction",
+	"personal_sign",
+	"eth_signTypedData_v4"
+];
+const SESSION_NOTIFICATIONS = ["accountsChanged", "chainChanged"];
+/** `eip155:1` → 1; `undefined` for anything that is not an EVM network. */
+const evmChainId = (network) => {
+	const match = /^eip155:(\d+)$/.exec(network);
+	const id = match?.[1] === void 0 ? void 0 : Number(match[1]);
+	return id !== void 0 && Number.isSafeInteger(id) ? id : void 0;
+};
+const caip10 = (network, address) => `${network}:${address}`;
+const addressOf$1 = (account) => account.slice(account.lastIndexOf(":") + 1);
+const isObject$14 = (v) => typeof v === "object" && v !== null;
+const isSession = (value) => {
+	if (!isObject$14(value) || !isObject$14(value["origin"]) || !isObject$14(value["scopes"])) return false;
+	return typeof value["id"] === "string" && value["origin"]["kind"] === "browser" && typeof value["origin"]["origin"] === "string" && typeof value["currentNetwork"] === "string" && typeof value["createdAt"] === "number" && typeof value["lastUsedAt"] === "number";
+};
+var ConnectionController = class extends Controller {
+	options;
+	engineStore;
+	waiters = /* @__PURE__ */ new Map();
+	group;
+	constructor(options) {
+		super({
+			name: "connections",
+			defaultState: () => ({
+				sessions: {},
+				pending: {}
+			})
+		});
+		this.options = options;
+	}
+	async init() {
+		const store = await this.options.openStore();
+		this.engineStore = store;
+		this.group = void 0;
+		const collection = store.collection(COLLECTION$4);
+		const keys = await collection.list();
+		const rows = await Promise.all(keys.map(async (key) => collection.get(key)));
+		const now = this.options.now();
+		const sessions = {};
+		const expired = [];
+		for (const [index, raw] of rows.entries()) {
+			const key = keys[index];
+			if (raw === void 0 || key === void 0) continue;
+			const parsed = JSON.parse(new TextDecoder().decode(raw));
+			if (!isSession(parsed)) {
+				this.options.logger.warn("connection session skipped: malformed");
+				expired.push(key);
+			} else if (now - parsed.lastUsedAt > 7776e6) expired.push(key);
+			else sessions[parsed.id] = parsed;
+		}
+		await Promise.all(expired.map(async (key) => collection.delete(key)));
+		this.update(() => ({
+			sessions,
+			pending: {}
+		}));
+	}
+	async destroy() {
+		this.lock();
+		await Promise.resolve();
+	}
+	/** Locking is not consent: every pending connection is rejected. */
+	lock() {
+		this.engineStore = void 0;
+		this.group = void 0;
+		for (const waiter of this.waiters.values()) waiter.reject(userRejectedRequest("the wallet was locked"));
+		this.waiters.clear();
+		this.update(() => ({
+			sessions: {},
+			pending: {}
+		}));
+	}
+	/** Throws `4100` unless `origin` is `https://host[:port]` (or localhost in development). */
+	checkOrigin(origin) {
+		let url;
+		try {
+			url = new URL(origin);
+		} catch {
+			throw unauthorized("invalid origin");
+		}
+		const localhost = url.protocol === "http:" && url.hostname === "localhost";
+		if (url.origin !== origin || url.protocol !== "https:" && !(localhost && this.options.allowLocalhost)) throw unauthorized("origin not allowed");
+		return {
+			kind: "browser",
+			origin
+		};
+	}
+	session(origin) {
+		return Object.values(this.getState().sessions).find((s) => s.origin.origin === origin);
+	}
+	pending() {
+		return Object.values(this.getState().pending);
+	}
+	/** The group sessions are bound to: the host's last `setActiveGroup`, else the app's selection. */
+	activeGroup() {
+		return this.group ?? this.options.selectedGroup();
+	}
+	/** Whether `network` is an EVM network the wallet has enabled. */
+	isEnabled(network) {
+		return this.options.enabledNetworks().includes(network);
+	}
+	/** The origin's authorized addresses on its current network; empty when not connected. */
+	accounts(origin) {
+		const session = this.session(origin);
+		return session?.scopes[session.currentNetwork]?.accounts.map(addressOf$1) ?? [];
+	}
+	/** Throws `4100` unless the origin's session covers `method` on `network`. */
+	authorize(origin, network, method) {
+		const session = this.session(origin);
+		const scope = session?.scopes[network];
+		if (session === void 0 || scope === void 0 || !scope.methods.includes(method)) throw unauthorized();
+		return session;
+	}
+	/** Resolves with the session once the host approves; rejects with `4001` when it refuses. */
+	async request(origin, kind, network) {
+		if (this.engineStore === void 0) throw userRejectedRequest("the wallet is locked");
+		if (this.pending().some((p) => p.origin.origin === origin)) throw requestPending("a connection request is already pending");
+		const id = `conn-${[...this.options.random(8)].map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+		const entry = {
+			id,
+			origin: {
+				kind: "browser",
+				origin
+			},
+			kind,
+			...network === void 0 ? {} : { network },
+			createdAt: this.options.now()
+		};
+		return new Promise((resolve, reject) => {
+			this.waiters.set(id, {
+				resolve,
+				reject
+			});
+			this.update((s) => ({
+				...s,
+				pending: {
+					...s.pending,
+					[id]: entry
+				}
+			}));
+		});
+	}
+	/**
+	* The host's approval, by id: the accounts granted (EVM addresses of the active group) and the
+	* network.
+	*/
+	async approveConnection(id, grant) {
+		const store = this.requireStore();
+		const entry = this.getState().pending[id];
+		const waiter = this.waiters.get(id);
+		if (entry === void 0 || waiter === void 0) throw new Error(`unknown connection request ${id}`);
+		if (entry.kind === "network" && entry.network !== grant.network) throw new Error(`connection request ${id} is for ${String(entry.network)}`);
+		if (evmChainId(grant.network) === void 0 || !this.options.enabledNetworks().includes(grant.network)) throw invalidParams(`${grant.network} is not an enabled EVM network`);
+		const group = this.activeGroup();
+		if (group === void 0) throw new Error("no account group is selected");
+		const own = (await this.options.evmAddress(group, grant.network)).toLowerCase();
+		if (grant.accounts.length === 0 || grant.accounts.some((a) => a.toLowerCase() !== own)) throw invalidParams("only the active group's account can be granted");
+		if (this.getState().pending[id] === void 0) throw new Error(`connection request ${id} is no longer pending`);
+		const now = this.options.now();
+		const existing = this.session(entry.origin.origin);
+		const scope = {
+			accounts: [caip10(grant.network, own)],
+			methods: SESSION_METHODS,
+			notifications: SESSION_NOTIFICATIONS
+		};
+		const session = {
+			id: existing?.id ?? `session-${[...this.options.random(8)].map((b) => b.toString(16).padStart(2, "0")).join("")}`,
+			origin: entry.origin,
+			scopes: {
+				...existing?.scopes,
+				[grant.network]: scope
+			},
+			currentNetwork: grant.network,
+			createdAt: existing?.createdAt ?? now,
+			lastUsedAt: now
+		};
+		await this.persist(store, session);
+		this.dropPending(id);
+		if (existing !== void 0 && existing.currentNetwork !== grant.network) this.options.invalidate(entry.origin.origin);
+		waiter.resolve(session);
+		return session;
+	}
+	rejectConnection(id) {
+		const waiter = this.waiters.get(id);
+		if (this.getState().pending[id] === void 0 || waiter === void 0) throw new Error(`unknown connection request ${id}`);
+		this.dropPending(id);
+		waiter.reject(userRejectedRequest());
+	}
+	/** Ends the origin's session; its pending connection and unfinished requests are void. */
+	async revoke(origin) {
+		const store = this.requireStore();
+		for (const p of this.pending().filter((x) => x.origin.origin === origin)) {
+			const waiter = this.waiters.get(p.id);
+			this.dropPending(p.id);
+			waiter?.reject(userRejectedRequest("the connection was revoked"));
+		}
+		const session = this.session(origin);
+		if (session !== void 0) {
+			await store.collection(COLLECTION$4).delete(session.id);
+			this.update((s) => {
+				const { [session.id]: _gone, ...sessions } = s.sessions;
+				return {
+					...s,
+					sessions
+				};
+			});
+		}
+		this.options.invalidate(origin);
+	}
+	/** Switches within the session's scope; the origin's unfinished requests are void. */
+	async setCurrentNetwork(origin, network) {
+		const store = this.requireStore();
+		const session = this.session(origin);
+		if (session === void 0 || session.scopes[network] === void 0) throw unauthorized();
+		await this.persist(store, {
+			...session,
+			currentNetwork: network
+		});
+		this.options.invalidate(origin);
+	}
+	async touch(origin) {
+		const store = this.engineStore;
+		const session = this.session(origin);
+		const now = this.options.now();
+		if (store === void 0 || session === void 0 || now - session.lastUsedAt < TOUCH_INTERVAL_MS) return;
+		await this.persist(store, {
+			...session,
+			lastUsedAt: now
+		});
+	}
+	/**
+	* The host switched account group: every session's accounts become the new group's addresses. A
+	* session that cannot get one (no address derivable) is left with an empty list and has to be
+	* authorized again.
+	*/
+	async setActiveGroup(walletId, groupIndex) {
+		const store = this.requireStore();
+		const group = {
+			walletId,
+			groupIndex
+		};
+		this.group = group;
+		await Promise.all(Object.values(this.getState().sessions).map(async (session) => {
+			const entries = await Promise.all(Object.entries(session.scopes).map(async ([network, scope]) => {
+				if (scope.accounts.length === 0) return [network, scope];
+				try {
+					const address = await this.options.evmAddress(group, network);
+					return [network, {
+						...scope,
+						accounts: [caip10(network, address.toLowerCase())]
+					}];
+				} catch (error) {
+					this.options.logger.warn("connection account unavailable in the new group", error);
+					return [network, {
+						...scope,
+						accounts: []
+					}];
+				}
+			}));
+			await this.persist(store, {
+				...session,
+				scopes: Object.fromEntries(entries)
+			});
+		}));
+	}
+	dropPending(id) {
+		this.waiters.delete(id);
+		this.update((s) => {
+			const { [id]: _gone, ...pending } = s.pending;
+			return {
+				...s,
+				pending
+			};
+		});
+	}
+	async persist(store, session) {
+		try {
+			await store.collection(COLLECTION$4).put(session.id, new TextEncoder().encode(JSON.stringify(session)));
+		} catch (error) {
+			throw internalError(error instanceof Error ? error.message : String(error));
+		}
+		this.update((s) => ({
+			...s,
+			sessions: {
+				...s.sessions,
+				[session.id]: session
+			}
+		}));
+	}
+	requireStore() {
+		if (this.engineStore === void 0) throw userRejectedRequest("the wallet is locked");
+		return this.engineStore;
+	}
+};
+// src/addresses/normalize.ts
+/**
+* The canonical form of `address` for its family — EIP-55 for EVM, the re-encoded form for bitcoin
+* (accepted on any known bitcoin network, since a contact is not tied to the wallet's network) and
+* Spark (identity key only, no invoice fields) — or `undefined` when it is not a valid address.
+*/
+function normalizeAddress(family, address) {
+	try {
+		if (family === "evm") return isEvmAddress(address) ? checksumEvmAddress(address) : void 0;
+		if (family === "solana") return isSolanaAddress(address) ? address : void 0;
+		if (family === "spark") {
+			const decoded = decodeSparkAddress(address);
+			return encodeSparkAddress({
+				network: decoded.network,
+				identityPublicKey: decoded.identityPublicKey
+			});
+		}
+		for (const network of Object.values(BITCOIN_NETWORKS)) try {
+			const codec = Address(network.params);
+			return codec.encode(codec.decode(address));
+		} catch {}
+		return;
+	} catch {
+		return;
+	}
+}
+// src/spark/errors.ts
+var SparkControllerError = class extends Error {
+	category;
+	constructor(category, message, cause) {
+		super(message, { cause });
+		this.name = "SparkControllerError";
+		this.category = category;
+	}
+};
+/** Maps a thrown client/kernel error into a category without leaking payloads. */
+function categorize(error) {
+	const name = error instanceof Error ? error.name : "";
+	const message = error instanceof Error ? error.message : "";
+	if (/approval|denied|rejected/i.test(message)) return /required/i.test(message) ? "approval-required" : "rejected";
+	if (/insufficient|not enough|balance/i.test(message)) return "insufficient-funds";
+	if (name === "SparkRequestError" || /fetch|network|timeout|unavailable|closed/i.test(message)) return "network";
+	return "internal";
+}
+const feeCheck = (amountSats, maxFeeSats) => maxFeeSats !== void 0 && maxFeeSats >= amountSats ? ["fee-exceeds-amount"] : [];
+// src/payments/errors.ts
+var PaymentError = class extends Error {
+	category;
+	constructor(category, message, cause) {
+		super(message, { cause });
+		this.name = "PaymentError";
+		this.category = category;
+	}
+};
+// src/payments/pay.ts
+const lightningDetails = (invoice) => {
+	const decoded = decodeBolt11(invoice);
+	return {
+		payee: bytesToHex(decoded.payee),
+		expiresAt: (decoded.timestamp + decoded.expirySeconds) * 1e3
+	};
+};
+/**
+* Validates one parsed payment option and fixes everything the approval needs — including the
+* LNURL-pay invoice, fetched here exactly once. Every input validation happens before the approval
+* round, so a `PaymentError` here never consumed a verification. `lnurl-withdraw` receives funds
+* and has its own entry, {@link withdrawLnurl}.
+*/
+async function preparePay(context, params) {
+	const ref = params.account;
+	const { network } = ref;
+	if (params.option.kind === "lnurl-withdraw") throw new PaymentError("invalid-input", "lnurl-withdraw receives funds: use payments.withdrawLnurl");
+	switch (params.option.kind) {
+		case "spark": {
+			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "spark payment: amountSats is required");
+			const { address } = params.option;
+			const { amountSats } = params;
+			return {
+				display: {
+					family: "spark",
+					network,
+					kind: "transfer",
+					amountSats,
+					receiver: address
+				},
+				checks: [],
+				staleReason: () => void 0,
+				execute: async (spark, verify) => ({
+					kind: "spark",
+					transfer: await spark.send(ref, {
+						receiver: address,
+						amountSats,
+						verify
+					})
+				})
+			};
+		}
+		case "spark-invoice": {
+			const { option } = params;
+			if (option.expiresAt !== void 0 && option.expiresAt <= context.now()) throw new PaymentError("rejected", "spark invoice expired");
+			if (option.amountSats !== void 0 && params.amountSats !== void 0 && params.amountSats !== option.amountSats) throw new PaymentError("invalid-input", "spark invoice: amountSats conflicts with the invoice amount");
+			const amountSats = option.amountSats ?? params.amountSats;
+			if (amountSats === void 0) throw new PaymentError("invalid-input", "spark invoice: amountless invoice requires amountSats");
+			const openAmount = option.amountSats === void 0 ? params.amountSats : void 0;
+			const parsed = parseSparkInvoice(option.invoice, {
+				network,
+				now: context.now()
+			});
+			const { expiresAt } = option;
+			return {
+				display: {
+					family: "spark",
+					network,
+					kind: "transfer",
+					amountSats,
+					receiver: encodeSparkAddress({
+						network,
+						identityPublicKey: parsed.receiverIdentityPublicKey
+					}),
+					...option.memo === void 0 ? {} : { description: option.memo }
+				},
+				checks: [],
+				staleReason: (now) => expiresAt !== void 0 && expiresAt <= now ? "spark invoice expired" : void 0,
+				execute: async (spark, verify) => ({
+					kind: "spark",
+					transfer: await spark.paySparkInvoice(ref, {
+						invoice: option.invoice,
+						...openAmount === void 0 ? {} : { amountSats: openAmount },
+						verify
+					})
+				})
+			};
+		}
+		case "lightning": {
+			const { option } = params;
+			if (option.amountSats === void 0 && params.amountSats === void 0) throw new PaymentError("invalid-input", "amountless invoice: amountSats is required");
+			if (params.maxFeeSats === void 0) throw new PaymentError("invalid-input", "lightning payment: maxFeeSats is required");
+			if (option.expiresAt <= context.now() + 6e4) throw new PaymentError("rejected", "lightning invoice expired");
+			if (option.amountSats !== void 0 && params.amountSats !== void 0 && params.amountSats !== option.amountSats) throw new PaymentError("invalid-input", "amountSats conflicts with the invoice amount");
+			const { maxFeeSats } = params;
+			const openAmount = option.amountSats === void 0 ? params.amountSats : void 0;
+			const amountSats = option.amountSats ?? params.amountSats ?? 0;
+			const { payee } = lightningDetails(option.invoice);
+			const { expiresAt } = option;
+			return {
+				display: {
+					family: "spark",
+					network,
+					kind: "lightning",
+					amountSats,
+					maxFeeSats,
+					receiver: payee,
+					...option.description === void 0 ? {} : { description: option.description }
+				},
+				checks: feeCheck(amountSats, maxFeeSats),
+				staleReason: (now) => expiresAt <= now + 6e4 ? "lightning invoice expired" : void 0,
+				execute: async (spark, verify) => ({
+					kind: "lightning",
+					payment: await spark.payInvoice(ref, {
+						invoice: option.invoice,
+						maxFeeSats,
+						...openAmount === void 0 ? {} : { amountSats: openAmount },
+						verify
+					})
+				})
+			};
+		}
+		case "lnurl-pay": {
+			const { request } = params.option;
+			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "lnurl-pay: amountSats is required");
+			if (params.maxFeeSats === void 0) throw new PaymentError("invalid-input", "lnurl-pay: maxFeeSats is required");
+			const { amountSats, maxFeeSats } = params;
+			const amountMsat = amountSats * 1e3;
+			if (amountMsat < request.minSendableMsat || amountMsat > request.maxSendableMsat) throw new PaymentError("rejected", "lnurl-pay: amount outside the service's range");
+			if (request.commentAllowed === 0 && params.comment !== void 0) throw new PaymentError("rejected", "lnurl-pay: comments not accepted by this service");
+			if (params.comment !== void 0 && params.comment.length > request.commentAllowed) throw new PaymentError("rejected", "lnurl-pay: comment exceeds the service's limit");
+			let requested;
+			try {
+				requested = await requestInvoice(request, {
+					fetch: context.fetch,
+					network,
+					amountMsat,
+					...params.comment === void 0 ? {} : { comment: params.comment }
+				});
+			} catch (error) {
+				if (error instanceof PaymentError || error instanceof SparkControllerError) throw error;
+				throw new PaymentError("network", "lnurl-pay: invoice request failed", error);
+			}
+			const { invoice } = requested;
+			const { payee, expiresAt } = lightningDetails(invoice);
+			return {
+				display: {
+					family: "spark",
+					network,
+					kind: "lightning",
+					amountSats,
+					maxFeeSats,
+					receiver: payee,
+					description: request.description
+				},
+				checks: feeCheck(amountSats, maxFeeSats),
+				staleReason: (now) => expiresAt <= now + 6e4 ? "lightning invoice expired" : void 0,
+				execute: async (spark, verify) => ({
+					kind: "lightning",
+					payment: await spark.payInvoice(ref, {
+						invoice,
+						maxFeeSats,
+						verify
+					})
+				})
+			};
+		}
+		default: {
+			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "bitcoin payment: amountSats is required");
+			const { address } = params.option;
+			const { amountSats, maxFeeSats } = params;
+			const speed = params.speed ?? "MEDIUM";
+			return {
+				display: {
+					family: "spark",
+					network,
+					kind: "exit",
+					amountSats,
+					...maxFeeSats === void 0 ? {} : { maxFeeSats },
+					receiver: address
+				},
+				checks: feeCheck(amountSats, maxFeeSats),
+				staleReason: () => void 0,
+				execute: async (spark, verify) => ({
+					kind: "withdraw",
+					exit: await spark.withdraw(ref, {
+						address,
+						speed,
+						verify,
+						amountSats,
+						...maxFeeSats === void 0 ? {} : { maxFeeSats }
+					})
+				})
+			};
+		}
+	}
+}
+/**
+* LNURL-withdraw: asks the service to pay an invoice this wallet creates. It receives funds, so it
+* needs no verification factor and does not go through the request pipeline.
+*/
+async function withdrawLnurl(context, params) {
+	const { request } = params.option;
+	const amountMsat = params.amountSats * 1e3;
+	if (amountMsat < request.minWithdrawableMsat || amountMsat > request.maxWithdrawableMsat) throw new PaymentError("rejected", "lnurl-withdraw: amount outside the service's range");
+	const invoice = await context.spark.createInvoice(params.account, {
+		amountSats: params.amountSats,
+		memo: request.defaultDescription
+	});
+	try {
+		await submitWithdraw(request, {
+			fetch: context.fetch,
+			invoice: invoice.invoice
+		});
+	} catch (error) {
+		if (error instanceof PaymentError || error instanceof SparkControllerError) throw error;
+		throw new PaymentError("network", "lnurl-withdraw: submission failed", error);
+	}
+	return {
+		kind: "lnurl-withdraw",
+		invoice
+	};
+}
+// src/payments/zap.ts
+/** Everything up to payment: resolve LNURL, sign the 9734, request the invoice. */
+async function prepareZap(params, context) {
+	const amountMsat = params.amountSats * 1e3;
+	if (!Number.isSafeInteger(params.amountSats) || params.amountSats <= 0 || !Number.isSafeInteger(amountMsat)) throw new PaymentError("invalid-input", "zap amount is not a positive safe integer");
+	try {
+		const resolved = await resolveLnurl(params.recipient.lightning, { fetch: context.fetch });
+		if (resolved.tag !== "payRequest") throw new PaymentError("rejected", "recipient is not an LNURL-pay endpoint");
+		if (!resolved.allowsNostr || resolved.nostrPubkey === void 0) throw new PaymentError("rejected", "LNURL service does not accept nostr zaps");
+		if (amountMsat < resolved.minSendableMsat || amountMsat > resolved.maxSendableMsat) throw new PaymentError("rejected", "zap amount outside the service's bounds");
+		if (params.comment !== void 0) {
+			if (resolved.commentAllowed === 0) throw new PaymentError("rejected", "the service does not accept comments");
+			if (params.comment.length > resolved.commentAllowed) throw new PaymentError("rejected", "comment exceeds the service's limit");
+		}
+		const lnurl = params.recipient.lightning.toLowerCase().startsWith("lnurl1") ? params.recipient.lightning.toLowerCase() : encodeLnurl(lightningAddressUrl(params.recipient.lightning));
+		const base = {
+			amount: amountMsat,
+			relays: [...params.relays],
+			comment: params.comment,
+			lnurl
+		};
+		const unsigned = {
+			..."event" in params.recipient ? makeZapRequest({
+				event: params.recipient.event,
+				...base
+			}) : makeZapRequest({
+				pubkey: params.recipient.pubkey,
+				...base
+			}),
+			pubkey: await params.signer.getPublicKey()
+		};
+		const zapRequest = await params.signer.signEvent(unsigned);
+		if (!verifyEvent(zapRequest) || !signedMatchesUnsigned(zapRequest, unsigned)) throw new PaymentError("rejected", "signer returned a zap request that does not match");
+		const { invoice } = await requestInvoice(resolved, {
+			fetch: context.fetch,
+			network: params.network,
+			amountMsat,
+			...params.comment === void 0 ? {} : { comment: params.comment },
+			zapRequest: JSON.stringify(zapRequest)
+		});
+		const decoded = decodeBolt11(invoice);
+		const expiresAt = (decoded.timestamp + decoded.expirySeconds) * 1e3;
+		if (expiresAt <= context.now() + 6e4) throw new PaymentError("rejected", "zap invoice expires too soon");
+		const eventId = "event" in params.recipient ? params.recipient.event.id : void 0;
+		return {
+			zapRequest,
+			invoice,
+			paymentHash: bytesToHex(decoded.paymentHash),
+			expiresAt,
+			amountSats: params.amountSats,
+			receiptPubkey: bytesToHex(resolved.nostrPubkey),
+			recipientPubkey: "event" in params.recipient ? params.recipient.event.pubkey : params.recipient.pubkey,
+			...eventId === void 0 ? {} : { eventId },
+			...params.comment === void 0 ? {} : { comment: params.comment },
+			lightning: params.recipient.lightning
+		};
+	} catch (error) {
+		if (error instanceof PaymentError) throw error;
+		if (error instanceof SparkInputError || error instanceof Error && error.cause instanceof SparkInputError) throw new PaymentError("rejected", "zap failed invoice validation");
+		throw new PaymentError(categorizePayment(error), "zap failed");
+	}
+}
+/**
+* Fixes a prepared zap for approval: the invoice (fetched by {@link prepareZap}) is paid as-is, and
+* the zap note is written under the payment's transfer id afterwards. A nearly-expired invoice is
+* refused here and again at approval — the user may sit on the confirm screen.
+*/
+function prepareZapAction(account, prepared, options) {
+	if (prepared.expiresAt <= options.now() + 6e4) throw new PaymentError("rejected", "zap invoice expired");
+	const { maxFeeSats } = options;
+	const { payee } = lightningInvoiceDetails(prepared.invoice);
+	return {
+		display: {
+			family: "spark",
+			network: account.network,
+			kind: "lightning",
+			amountSats: prepared.amountSats,
+			maxFeeSats,
+			receiver: payee,
+			...prepared.comment === void 0 ? {} : { description: prepared.comment }
+		},
+		checks: feeCheck(prepared.amountSats, maxFeeSats),
+		staleReason: (now) => prepared.expiresAt <= now + 6e4 ? "zap invoice expired" : void 0,
+		execute: async (spark, verify) => ({
+			kind: "lightning",
+			payment: await spark.payInvoice(account, {
+				invoice: prepared.invoice,
+				maxFeeSats,
+				verify,
+				note: {
+					kind: "zap",
+					recipientPubkey: prepared.recipientPubkey,
+					...prepared.eventId === void 0 ? {} : { eventId: prepared.eventId },
+					...prepared.comment === void 0 ? {} : { comment: prepared.comment },
+					lightning: prepared.lightning
+				}
+			})
+		})
+	};
+}
+const lightningInvoiceDetails = (invoice) => ({ payee: bytesToHex(decodeBolt11(invoice).payee) });
+function categorizePayment(error) {
+	return categorize(error) === "network" ? "network" : "rejected";
+}
+// src/spark/l1.ts
+/** The bitcoin network each Spark network settles on; deposits and exits must agree with it. */
+const SPARK_L1_NETWORK = {
+	mainnet: "bip122:000000000019d6689c085ae165831e93",
+	regtest: "bip122:0f9188f13cb7b2c71f2a335e3a4fc328"
+};
+// src/transactions/route.ts
+const hexId = (prefix, random) => `${prefix}-${[...random(8)].map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+const newId = (random) => hexId("tx", random);
+const newRequestId = (random) => hexId("req", random);
+const errorMessage$1 = (error) => error instanceof Error ? error.message : String(error);
+const LIVE_REPLACEMENT_STATES = /* @__PURE__ */ new Set([
+	"draft",
+	"signed",
+	"submitted",
+	"pending"
+]);
+/**
+* Approval-time check for a replacement: the original must still be unconfirmed and no other
+* replacement of it may already be on its way.
+*/
+const replacementStaleReason = (ctx, originalId) => {
+	const txs = ctx.txs();
+	const original = txs[originalId];
+	if (original?.state !== "submitted" && original?.state !== "pending") return "original transaction already finished — nothing to replace";
+	return Object.values(txs).some((t) => t.replaces === originalId && LIVE_REPLACEMENT_STATES.has(t.state)) ? "original transaction was already replaced — start over" : void 0;
+};
+const submitTx = async (ctx, tx, hash) => {
+	const tracked = await ctx.transition(tx, {
+		state: "submitted",
+		hash,
+		submittedAt: ctx.options.now()
+	});
+	ctx.track(tracked.id, hash);
+	return tracked;
+};
+const failTx = async (ctx, tx, error) => {
+	const failed = tx.state === "signed" ? "failed" : "rejected";
+	await ctx.transition(tx, {
+		state: failed,
+		error: errorMessage$1(error)
+	});
+};
+// src/requests/checks.ts
+/** Two reads of one fee differ by more than this share of the smaller one. */
+const FEE_MISMATCH_PERCENT = 25n;
+/** A fee ceiling above this multiple of the independent estimate is flagged. */
+const FEE_CAP_MULTIPLIER = 2n;
+/**
+* `|a − b| / min(a, b)` is strictly above {@link FEE_MISMATCH_PERCENT}; a zero against a non-zero
+* always is.
+*/
+const feesDiffer = (a, b) => {
+	const low = a < b ? a : b;
+	return ((a < b ? b : a) - low) * 100n > low * FEE_MISMATCH_PERCENT;
+};
+/**
+* The final ceiling exceeds {@link FEE_CAP_MULTIPLIER} times the independent estimate of the same
+* tier.
+*/
+const exceedsNetworkCap = (final, independent) => final > independent * FEE_CAP_MULTIPLIER;
+/** The worst-case fee is not below the amount sent (native-asset sends only). */
+const feeReachesAmount = (maxFee, amount) => maxFee >= amount;
+const min = (a, b) => a < b ? a : b;
+const max = (a, b) => a > b ? a : b;
+/** EIP-1559 quotes are `maxFee = baseFee × 2 + priority`; this recovers the base fee. */
+const baseFeeOf = (quote) => (quote.maxFeePerGas - (quote.maxPriorityFeePerGas ?? 0n)) / 2n;
+/**
+* EIP-1559: priority fee is the lower of the two, `maxFeePerGas = max(baseFee) × 2 + priority` (a
+* high ceiling only prevents a stuck transaction, the base fee actually paid is the chain's).
+* Legacy: the lower gas price. Two different shapes cannot be merged — the independent quote wins.
+*/
+const mergeEvmQuote = (primary, independent) => {
+	const a = primary.maxPriorityFeePerGas;
+	const b = independent.maxPriorityFeePerGas;
+	if (a !== void 0 && b !== void 0) {
+		const priority = min(a, b);
+		const maxFeePerGas = max(baseFeeOf(primary), baseFeeOf(independent)) * 2n + priority;
+		return {
+			quote: {
+				tier: primary.tier,
+				wei: maxFeePerGas,
+				maxFeePerGas,
+				maxPriorityFeePerGas: priority
+			},
+			mismatch: feesDiffer(a, b) || feesDiffer(baseFeeOf(primary), baseFeeOf(independent))
+		};
+	}
+	if (a === void 0 && b === void 0) {
+		const price = min(primary.maxFeePerGas, independent.maxFeePerGas);
+		return {
+			quote: {
+				tier: primary.tier,
+				wei: price,
+				maxFeePerGas: price,
+				maxPriorityFeePerGas: void 0
+			},
+			mismatch: feesDiffer(primary.maxFeePerGas, independent.maxFeePerGas)
+		};
+	}
+	return {
+		quote: independent,
+		mismatch: true
+	};
+};
+const mergeSolanaQuote = (primary, independent) => ({
+	quote: {
+		tier: primary.tier,
+		microLamportsPerCu: min(primary.microLamportsPerCu, independent.microLamportsPerCu)
+	},
+	mismatch: feesDiffer(primary.microLamportsPerCu, independent.microLamportsPerCu)
+});
+/** Bitcoin fee rates (sat/vB) per confirmation target. */
+const mergeSatPerByte = (primary, independent) => ({
+	rate: Math.min(primary, independent),
+	mismatch: feesDiffer(BigInt(Math.ceil(primary)), BigInt(Math.ceil(independent)))
+});
+/** The checks a prepared build carries, in a stable order and without duplicates. */
+const collectChecks = (flags) => [...new Set(flags.filter((f) => f !== void 0))];
+/** EVM addresses compare without the `0x` prefix and case-insensitively. */
+const comparable = (family, address) => family === "evm" ? address.replace(/^0x/i, "").toLowerCase() : address;
+const looksLike = (a, b) => a !== b && a.length >= 8 && b.length >= 8 && a.slice(0, 4) === b.slice(0, 4) && a.slice(-4) === b.slice(-4);
+/** Findings for every recipient of one request, deduplicated, `danger` first. */
+function assessRecipients(family, recipients, known) {
+	const knownSet = new Set(known.map((a) => comparable(family, a)));
+	const found = /* @__PURE__ */ new Map();
+	for (const recipient of recipients) {
+		const candidate = comparable(family, recipient);
+		if (knownSet.has(candidate)) continue;
+		found.set("first-recipient", {
+			code: "first-recipient",
+			level: "warning"
+		});
+		if ([...knownSet].some((k) => looksLike(candidate, k))) found.set("address-poisoning", {
+			code: "address-poisoning",
+			level: "danger"
+		});
+	}
+	return [...found.values()].sort((a, b) => Number(b.level === "danger") - Number(a.level === "danger"));
+}
+// src/requests/sign-log.ts
+const SIGN_LOG_LIMIT = 1e3;
+const COLLECTION$3 = "sign-log";
+const isObject$13 = (v) => typeof v === "object" && v !== null;
+const METHODS = /* @__PURE__ */ new Set([
+	"send",
+	"speed-up",
+	"cancel",
+	"cpfp",
+	"pay",
+	"zap",
+	"evm-sign",
+	"spark-deposit",
+	"spark-exit"
+]);
+const OUTCOMES = /* @__PURE__ */ new Set([
+	"submitted",
+	"rejected",
+	"failed",
+	"expired",
+	"invalidated"
+]);
+const FAMILIES = /* @__PURE__ */ new Set([
+	"evm",
+	"solana",
+	"bitcoin"
+]);
+const isAccount = (value) => {
+	if (!isObject$13(value)) return false;
+	if (value["kind"] === "hd") return typeof value["walletId"] === "string" && typeof value["groupIndex"] === "number" && typeof value["template"] === "string";
+	if (value["kind"] === "imported") return typeof value["keyId"] === "string" && FAMILIES.has(value["family"]);
+	return value["kind"] === void 0 && typeof value["walletId"] === "string" && typeof value["groupIndex"] === "number" && typeof value["network"] === "string";
+};
+const isOrigin = (value) => isObject$13(value) && (value["kind"] === "internal" || value["kind"] === "browser" && typeof value["origin"] === "string");
+const isEntry = (value) => isObject$13(value) && typeof value["id"] === "string" && typeof value["at"] === "number" && isOrigin(value["origin"]) && METHODS.has(value["method"]) && OUTCOMES.has(value["outcome"]) && isAccount(value["account"]);
+/** Sortable key: time first, request id as the tiebreak. */
+const keyOf = (entry) => `${String(entry.at).padStart(16, "0")}-${entry.id}`;
+function createSignLog(logger) {
+	let store;
+	return {
+		open: (next) => {
+			store = next;
+		},
+		close: () => {
+			store = void 0;
+		},
+		append: async (entry) => {
+			const current = store;
+			if (current === void 0) {
+				logger.warn(`sign log entry for request ${entry.id} (${entry.outcome}) not written: vault locked`);
+				return;
+			}
+			const collection = current.collection(COLLECTION$3);
+			await collection.put(keyOf(entry), new TextEncoder().encode(JSON.stringify(entry)));
+			const keys = [...await collection.list()].sort();
+			await Promise.all(keys.slice(0, Math.max(0, keys.length - SIGN_LOG_LIMIT)).map(async (k) => collection.delete(k)));
+		},
+		list: async () => {
+			if (store === void 0) return [];
+			const collection = store.collection(COLLECTION$3);
+			const keys = [...await collection.list()].sort();
+			const rows = await Promise.all(keys.map(async (k) => collection.get(k)));
+			const entries = [];
+			for (const raw of rows) {
+				if (raw === void 0) continue;
+				const parsed = JSON.parse(new TextDecoder().decode(raw));
+				if (isEntry(parsed)) entries.push(parsed);
+			}
+			return entries.reverse();
+		},
+		clear: async () => {
+			if (store === void 0) return;
+			const collection = store.collection(COLLECTION$3);
+			const keys = [...await collection.list()].sort();
+			await Promise.all(keys.map(async (k) => collection.delete(k)));
+		}
+	};
+}
+// src/requests/controller.ts
+/** A request that ended without a result: `stage` says how, `message` is the failure if any. */
+var RequestEndedError = class extends Error {
+	stage;
+	constructor(stage, message) {
+		super(message ?? `request ${stage}`);
+		this.name = "RequestEndedError";
+		this.stage = stage;
+	}
+};
+/** The origin already has a request in flight; a dApp gets one at a time. */
+var OriginBusyError = class extends Error {
+	constructor(origin) {
+		super(`${origin} already has an unfinished request`);
+		this.name = "OriginBusyError";
+	}
+};
+/** Requests expire this long after creation. */
+const REQUEST_TTL_MS = 6e5;
+const originKey = (origin) => `origin:${origin.origin}`;
+const LIVE = /* @__PURE__ */ new Set(["awaiting-approval", "signing"]);
+const errorMessage = (error) => error instanceof Error ? error.message : String(error);
+var RequestController = class extends Controller {
+	options;
+	entries = /* @__PURE__ */ new Map();
+	log;
+	settlers = /* @__PURE__ */ new Map();
+	/** Original transaction id → the unfinished request replacing or accelerating it. */
+	targets = /* @__PURE__ */ new Map();
+	locked = true;
+	/** Bumped on every unlock and lock so work that outlives a session never touches the next one. */
+	session = 0;
+	constructor(options) {
+		super({
+			name: "requests",
+			defaultState: () => ({ requests: {} })
+		});
+		this.options = options;
+		this.log = createSignLog(options.logger);
+	}
+	async init() {
+		this.session += 1;
+		this.locked = false;
+		this.entries.clear();
+		this.targets.clear();
+		this.settlers.clear();
+		this.update(() => ({ requests: {} }));
+		this.log.open(await this.options.openStore());
+	}
+	async destroy() {
+		this.lock();
+		await Promise.resolve();
+	}
+	/** Locking is not consent: every unfinished request becomes `invalidated` and frees its resources. */
+	lock() {
+		this.session += 1;
+		this.locked = true;
+		for (const [id, request] of Object.entries(this.getState().requests)) if (LIVE.has(request.stage)) this.finish(id, "invalidated");
+		this.log.close();
+	}
+	/** A page navigated away, was revoked or changed network: its unfinished requests are void. */
+	invalidateOrigin(origin) {
+		for (const [id, request] of Object.entries(this.getState().requests)) if (LIVE.has(request.stage) && request.origin.kind === "browser" && request.origin.origin === origin) this.finish(id, "invalidated");
+	}
+	/** The signature record, newest first. */
+	async signLog() {
+		return this.log.list();
+	}
+	async clearSignLog() {
+		await this.log.clear();
+	}
+	async prepare(input) {
+		if (this.locked) throw new Error("requests require an unlocked vault");
+		const { session } = this;
+		const id = newRequestId(this.options.random);
+		const target = "txId" in input ? input.txId : void 0;
+		if (input.method === "evm-sign") {
+			const key = originKey(input.origin);
+			if (this.targets.has(key)) throw new OriginBusyError(input.origin.origin);
+			this.targets.set(key, id);
+		}
+		if (target !== void 0) {
+			if (this.targets.has(target)) throw new Error(`transaction ${target} already has an unfinished replacement request`);
+			this.targets.set(target, id);
+		}
+		let built;
+		try {
+			built = await this.build(input, id);
+		} catch (error) {
+			this.unclaim(id);
+			throw error;
+		}
+		if (session !== this.session) {
+			built.run.release();
+			this.unclaim(id);
+			throw new Error("the vault was locked while the request was being prepared");
+		}
+		const { checks } = built;
+		const createdAt = this.options.now();
+		const request = {
+			id,
+			origin: input.method === "evm-sign" ? input.origin : { kind: "internal" },
+			method: input.method,
+			account: built.account,
+			network: built.network,
+			...target === void 0 ? {} : { target },
+			stage: "awaiting-approval",
+			display: built.display,
+			verification: checks.length > 0 ? "unverifiable" : "verified",
+			checks,
+			risk: built.risk,
+			createdAt,
+			expiresAt: createdAt + REQUEST_TTL_MS
+		};
+		const stopTimer = this.options.setTimer(REQUEST_TTL_MS, () => {
+			if (this.getState().requests[id]?.stage === "awaiting-approval") this.finish(id, "expired");
+		});
+		this.entries.set(id, {
+			prepared: built.run,
+			stopTimer
+		});
+		this.put(request);
+		this.openSettler(id);
+		return request;
+	}
+	/**
+	* Resolves with what `approve` returned, or rejects with `RequestEndedError` when the request
+	* ends any other way — how a dApp's pending call learns the outcome.
+	*/
+	async outcome(id) {
+		const settler = this.settlers.get(id);
+		if (settler === void 0) throw new Error(`unknown request ${id}`);
+		return settler.promise;
+	}
+	openSettler(id) {
+		const holder = {};
+		const promise = new Promise((resolve, reject) => {
+			holder.resolve = resolve;
+			holder.reject = reject;
+		});
+		Promise.allSettled([promise]);
+		this.settlers.set(id, {
+			promise,
+			resolve: (value) => holder.resolve?.(value),
+			reject: (error) => holder.reject?.(error)
+		});
+	}
+	settle(id, result) {
+		const settler = this.settlers.get(id);
+		if (settler === void 0) return;
+		if (result instanceof Error) settler.reject(result);
+		else settler.resolve(result);
+	}
+	/** The bitcoin network `account`'s Spark network settles on; any other pairing is refused. */
+	l1Network(account) {
+		const network = SPARK_L1_NETWORK[account.network];
+		if (network === void 0) throw new Error(`unknown Spark network ${account.network}`);
+		return network;
+	}
+	sparkBuilt(account, action) {
+		return {
+			account,
+			network: action.display.network,
+			display: action.display,
+			checks: collectChecks(action.checks),
+			risk: this.sparkRisk(action.display),
+			run: {
+				staleReason: () => action.staleReason(this.options.now()),
+				submit: async (verify) => action.execute(this.options.spark, verify),
+				release: () => void 0
+			}
+		};
+	}
+	async build(input, id) {
+		if (input.method === "pay" || input.method === "zap") {
+			const action = input.method === "pay" ? await preparePay({
+				fetch: this.options.fetch,
+				now: this.options.now
+			}, input) : prepareZapAction(input.account, input.zap, {
+				maxFeeSats: input.maxFeeSats,
+				now: this.options.now
+			});
+			return this.sparkBuilt(input.account, action);
+		}
+		if (input.method === "spark-deposit") {
+			const l1 = this.l1Network(input.account);
+			if (input.from.kind !== "hd" || input.from.walletId !== input.account.walletId) throw new Error("a Spark deposit must come from the same wallet");
+			const to = await this.options.spark.newDepositAddress(input.account);
+			const prepared = await this.options.transactions.prepareSend({
+				account: input.from,
+				network: l1,
+				to,
+				amount: BigInt(input.amountSats),
+				fee: input.fee
+			}, id, {
+				walletId: input.account.walletId,
+				groupIndex: input.account.groupIndex,
+				network: input.account.network
+			});
+			return {
+				account: prepared.account,
+				network: prepared.network,
+				display: prepared.intent,
+				checks: collectChecks([prepared.intent.verifiability === "full" ? void 0 : "decode-partial", ...prepared.checks]),
+				risk: [],
+				run: prepared
+			};
+		}
+		if (input.method === "spark-exit") {
+			const l1 = this.l1Network(input.account);
+			const address = await this.options.transactions.nextReceiveAddress(input.account.walletId, input.account.groupIndex, l1);
+			const action = await preparePay({
+				fetch: this.options.fetch,
+				now: this.options.now
+			}, {
+				account: input.account,
+				option: {
+					kind: "bitcoin",
+					address
+				},
+				amountSats: input.amountSats,
+				maxFeeSats: input.maxFeeSats,
+				...input.speed === void 0 ? {} : { speed: input.speed }
+			});
+			return this.sparkBuilt(input.account, action);
+		}
+		if (input.method === "evm-sign") {
+			const prepared = await this.options.transactions.prepareDapp(input.account, input.request);
+			const isTransaction = input.request.kind === "evm.transaction";
+			return {
+				account: prepared.account,
+				network: prepared.network,
+				display: prepared.intent,
+				checks: collectChecks([isTransaction && prepared.intent.verifiability !== "full" ? "decode-partial" : void 0, ...prepared.checks]),
+				risk: isTransaction ? this.chainRisk(prepared.intent) : [],
+				run: prepared
+			};
+		}
+		const prepared = input.method === "send" ? await this.options.transactions.prepareSend(input, id) : await this.options.transactions.prepareReplacement(input, id);
+		return {
+			account: prepared.account,
+			network: prepared.network,
+			display: prepared.intent,
+			checks: collectChecks([prepared.intent.verifiability === "full" ? void 0 : "decode-partial", ...prepared.checks]),
+			risk: input.method === "send" ? this.chainRisk(prepared.intent) : [],
+			run: prepared
+		};
+	}
+	async approve(id, method, verify) {
+		const request = this.getState().requests[id];
+		if (request === void 0) throw new Error(`unknown request ${id}`);
+		if (request.method !== method) throw new Error(`request ${id} is a ${request.method} request, not ${method}`);
+		const entry = this.entries.get(id);
+		if (request.stage !== "awaiting-approval" || entry === void 0) throw new Error(`request ${id} is ${request.stage}, not awaiting approval`);
+		if (this.options.now() >= request.expiresAt) {
+			this.finish(id, "expired");
+			throw new Error(`request ${id} expired`);
+		}
+		const { session } = this;
+		this.put({
+			...request,
+			stage: "signing"
+		});
+		let stale;
+		try {
+			stale = await entry.prepared.staleReason();
+		} catch (error) {
+			stale = errorMessage(error);
+		}
+		if (session !== this.session) throw new Error(`request ${id} was invalidated`);
+		if (stale !== void 0) {
+			this.finish(id, "failed", stale);
+			throw new Error(stale);
+		}
+		try {
+			const result = await entry.prepared.submit(verify);
+			if (session === this.session) {
+				entry.stopTimer();
+				this.entries.delete(id);
+				this.unclaim(id);
+				const done = {
+					...this.requireRequest(id),
+					stage: "submitted",
+					..."id" in result ? { txId: result.id } : {}
+				};
+				this.put(done);
+				this.record(done, "submitted");
+			} else this.record(request, "submitted");
+			this.settle(id, result);
+			return result;
+		} catch (error) {
+			if (session === this.session) this.finish(id, this.failureStage(entry.prepared, error), errorMessage(error));
+			else this.record(request, "failed", errorMessage(error));
+			throw error;
+		}
+	}
+	/**
+	* A cancelled or refused verification is `rejected`; anything after it is `failed`. Chain
+	* requests record which step failed on the tracked transaction; for Spark, the approval round is
+	* the only source of `WalletError`.
+	*/
+	failureStage(run, error) {
+		if (run.txId === void 0) return error instanceof WalletError ? "rejected" : "failed";
+		return this.options.transactions.getState().txs[run.txId]?.state === "rejected" ? "rejected" : "failed";
+	}
+	reject(id) {
+		const request = this.getState().requests[id];
+		if (request === void 0) throw new Error(`unknown request ${id}`);
+		if (request.stage !== "awaiting-approval") throw new Error(`request ${id} is ${request.stage}, not awaiting approval`);
+		this.finish(id, "rejected");
+	}
+	requireRequest(id) {
+		const request = this.getState().requests[id];
+		if (request === void 0) throw new Error(`unknown request ${id}`);
+		return request;
+	}
+	put(request) {
+		this.update((s) => ({
+			...s,
+			requests: {
+				...s.requests,
+				[request.id]: request
+			}
+		}));
+	}
+	unclaim(requestId) {
+		for (const [target, holder] of this.targets) if (holder === requestId) this.targets.delete(target);
+	}
+	/** Ends a request in a terminal stage and frees what it reserved. */
+	finish(id, stage, error) {
+		this.unclaim(id);
+		const entry = this.entries.get(id);
+		if (entry !== void 0) {
+			entry.stopTimer();
+			this.entries.delete(id);
+			try {
+				entry.prepared.release();
+			} catch (releaseError) {
+				this.options.logger.warn("request release failed", releaseError);
+			}
+		}
+		const request = this.getState().requests[id];
+		if (request !== void 0) {
+			const ended = {
+				...request,
+				stage,
+				...error === void 0 ? {} : { error }
+			};
+			this.put(ended);
+			this.record(ended, stage, error);
+			this.settle(id, new RequestEndedError(stage, error));
+		}
+	}
+	/** Appends the final stage to the signature record; a failed write is a warning, not an error. */
+	record(request, outcome, error) {
+		const { display } = request;
+		const entry = {
+			id: request.id,
+			at: this.options.now(),
+			origin: request.origin,
+			method: request.method,
+			account: request.account,
+			network: request.network,
+			summary: "summary" in display ? display.summary : `${display.kind} ${display.amountSats}`,
+			verification: request.verification,
+			checks: request.checks,
+			risk: request.risk,
+			outcome,
+			...error === void 0 ? {} : { error }
+		};
+		this.appendLog(entry);
+	}
+	async appendLog(entry) {
+		try {
+			await this.log.append(entry);
+		} catch (error) {
+			this.options.logger.warn("sign log write failed", error);
+		}
+	}
+	/**
+	* Addresses the wallet already knows for a family: contacts, plus recipients of tracked chain
+	* sends (Spark payments are not tracked).
+	*/
+	knownAddresses(family) {
+		const contacts = Object.values(this.options.addressBook.getState().entries).filter((e) => e.family === family).map((e) => e.address);
+		if (family === "spark") return contacts;
+		const paid = Object.values(this.options.transactions.getState().txs).filter((tx) => tx.family === family && (tx.state === "submitted" || tx.state === "pending" || tx.state === "confirmed")).flatMap((tx) => tx.intent?.outflows.map((o) => o.to) ?? []);
+		return [...contacts, ...paid];
+	}
+	chainRisk(intent) {
+		return assessRecipients(intent.family, intent.outflows.map((o) => o.to), this.knownAddresses(intent.family));
+	}
+	/** Only a Spark transfer has a recipient to check; Lightning and exits are not assessed. */
+	sparkRisk(display) {
+		if (display.kind !== "transfer") return [];
+		return assessRecipients("spark", [normalizeAddress("spark", display.receiver) ?? display.receiver], this.knownAddresses("spark"));
+	}
+};
+// src/connect/eip1193.ts
+/**
+* Platform-neutral EIP-1193 provider logic: it knows nothing about WebViews. The host hands it a
+* page's origin (computed from the WebView's top-level URL, never from the page) and a JSON-RPC
+* call; signing goes through the request pipeline and waits for the host's approval by id.
+*/
+/** Refused outright, whatever the session. */
+const REFUSED = /* @__PURE__ */ new Set([
+	"eth_sign",
+	"eth_signTypedData",
+	"eth_signTypedData_v3",
+	"eth_signTransaction",
+	"eth_sendRawTransaction"
+]);
+/** Planned for later layers; answered `4200` until then. */
+const DEFERRED = /* @__PURE__ */ new Set([
+	"wallet_addEthereumChain",
+	"wallet_watchAsset",
+	"wallet_sendCalls",
+	"wallet_getCallsStatus",
+	"wallet_getCapabilities",
+	"wallet_showCallsStatus"
+]);
+const READ_ONLY = new Set(EVM_RPC_METHODS.filter((m) => m !== "eth_sendRawTransaction" && m !== "eth_chainId"));
+const hexChainId = (network) => `0x${(evmChainId(network) ?? 0).toString(16)}`;
+const isObject$12 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const paramList = (params) => {
+	if (params === void 0) return [];
+	if (!Array.isArray(params)) throw invalidParams("params must be an array");
+	return params;
+};
+const textBytes = (value) => {
+	if (typeof value !== "string") throw invalidParams("message must be a string");
+	if (/^0x(?:[0-9a-fA-F]{2})*$/.test(value)) {
+		const bytes = hexToBytes(value.slice(2));
+		try {
+			new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+		} catch {
+			throw new ProviderError(4200, "blind signing is not enabled: the message is not UTF-8 text");
+		}
+		return bytes;
+	}
+	return new TextEncoder().encode(value);
+};
+const quantityOf = (value, field, fallback) => {
+	if (value === void 0) return fallback;
+	if (typeof value !== "string" || !/^0x[0-9a-fA-F]+$/.test(value)) throw invalidParams(`${field} must be a 0x quantity`);
+	return value;
+};
+var Eip1193Handler = class {
+	options;
+	listeners = /* @__PURE__ */ new Set();
+	unsubscribe;
+	constructor(options) {
+		this.options = options;
+	}
+	/** Events for the host to forward to pages; derived from changes to the sessions. */
+	subscribe(listener) {
+		this.listeners.add(listener);
+		if (this.unsubscribe === void 0) {
+			let previous = this.options.connections.getState().sessions;
+			this.unsubscribe = this.options.connections.store.subscribe((state) => {
+				for (const event of diffSessions(previous, state.sessions)) for (const l of this.listeners) l(event);
+				previous = state.sessions;
+			});
+		}
+		return () => {
+			this.listeners.delete(listener);
+			if (this.listeners.size === 0) {
+				this.unsubscribe?.();
+				this.unsubscribe = void 0;
+			}
+		};
+	}
+	async handle(origin, request) {
+		const { connections } = this.options;
+		connections.checkOrigin(origin);
+		const { method } = request;
+		const params = paramList(request.params);
+		if (REFUSED.has(method) || DEFERRED.has(method)) throw unsupportedMethod(method);
+		switch (method) {
+			case "eth_accounts": return connections.accounts(origin);
+			case "eth_chainId": return hexChainId(connections.session(origin)?.currentNetwork ?? this.options.defaultNetwork());
+			case "eth_requestAccounts": return this.requestAccounts(origin);
+			case "wallet_requestPermissions":
+				await this.requestAccounts(origin);
+				return this.permissions(origin);
+			case "wallet_getPermissions": return this.permissions(origin);
+			case "wallet_revokePermissions":
+				await connections.revoke(origin);
+				return null;
+			case "wallet_switchEthereumChain": return this.switchChain(origin, params[0]);
+			case "personal_sign": return this.personalSign(origin, params);
+			case "eth_signTypedData_v4": return this.typedData(origin, params);
+			case "eth_sendTransaction": return this.sendTransaction(origin, params[0]);
+		}
+		if (READ_ONLY.has(method)) return this.read(origin, method, params);
+		throw new ProviderError(-32601, `${method} does not exist`);
+	}
+	async requestAccounts(origin) {
+		const { connections } = this.options;
+		if (connections.accounts(origin).length === 0) await connections.request(origin, "connect");
+		await connections.touch(origin);
+		return connections.accounts(origin);
+	}
+	permissions(origin) {
+		const accounts = this.options.connections.accounts(origin);
+		if (accounts.length === 0) return [];
+		return [{
+			parentCapability: "eth_accounts",
+			invoker: origin,
+			caveats: [{
+				type: "restrictReturnedAccounts",
+				value: accounts
+			}]
+		}];
+	}
+	async switchChain(origin, arg) {
+		const { connections } = this.options;
+		const chainId = isObject$12(arg) ? arg["chainId"] : void 0;
+		if (typeof chainId !== "string" || !/^0x[0-9a-fA-F]+$/.test(chainId)) throw invalidParams("chainId must be a 0x quantity");
+		const network = `eip155:${Number.parseInt(chainId, 16)}`;
+		if (!connections.isEnabled(network)) throw unrecognizedChain(`chain ${chainId} is not enabled`);
+		const session = connections.session(origin);
+		if (session === void 0) throw unauthorized();
+		if (session.scopes[network] === void 0) await connections.request(origin, "network", network);
+		else if (session.currentNetwork !== network) await connections.setCurrentNetwork(origin, network);
+		return null;
+	}
+	authorizedAccount(session, address) {
+		const accounts = this.options.connections.accounts(session.origin.origin);
+		const wanted = typeof address === "string" ? address.toLowerCase() : accounts[0];
+		if (wanted === void 0 || !accounts.some((a) => a.toLowerCase() === wanted.toLowerCase())) throw unauthorized("account not authorized");
+		return wanted;
+	}
+	async personalSign(origin, params) {
+		const session = this.signingSession(origin, "personal_sign");
+		this.authorizedAccount(session, params[1]);
+		const message = textBytes(params[0]);
+		return this.sign(origin, session, (account) => ({
+			kind: "evm.personal-message",
+			network: session.currentNetwork,
+			account,
+			message
+		}));
+	}
+	async typedData(origin, params) {
+		const session = this.signingSession(origin, "eth_signTypedData_v4");
+		this.authorizedAccount(session, params[0]);
+		const [, source] = params;
+		const typedData = typeof source === "string" ? source : JSON.stringify(source);
+		return this.sign(origin, session, (account) => ({
+			kind: "evm.typed-data",
+			network: session.currentNetwork,
+			account,
+			typedData
+		}));
+	}
+	async sendTransaction(origin, arg) {
+		const session = this.signingSession(origin, "eth_sendTransaction");
+		if (!isObject$12(arg)) throw invalidParams("transaction must be an object");
+		this.authorizedAccount(session, arg["from"]);
+		const chainId = evmChainId(session.currentNetwork);
+		if (chainId === void 0) throw internalError("session network is not an EVM network");
+		if (arg["chainId"] !== void 0 && Number(arg["chainId"]) !== chainId) throw invalidParams("transaction chainId does not match the session network");
+		const data = arg["data"] ?? arg["input"] ?? "0x";
+		if (typeof data !== "string") throw invalidParams("data must be a hex string");
+		const { to } = arg;
+		if (to !== void 0 && typeof to !== "string") throw invalidParams("to must be an address");
+		return this.sign(origin, session, (account) => ({
+			kind: "evm.transaction",
+			network: session.currentNetwork,
+			account,
+			tx: {
+				type: "eip1559",
+				chainId,
+				nonce: 0,
+				gas: quantityOf(arg["gas"], "gas", "0x0"),
+				value: quantityOf(arg["value"], "value", "0x0"),
+				data,
+				...to === void 0 ? {} : { to },
+				accessList: [],
+				maxFeePerGas: "0x0",
+				maxPriorityFeePerGas: "0x0"
+			}
+		}));
+	}
+	signingSession(origin, method) {
+		const { connections } = this.options;
+		const session = connections.session(origin);
+		if (session === void 0) throw unauthorized();
+		return connections.authorize(origin, session.currentNetwork, method);
+	}
+	async sign(origin, session, build) {
+		const { connections, requests } = this.options;
+		const group = connections.activeGroup();
+		if (group === void 0) throw internalError("no account group is selected");
+		const account = {
+			kind: "hd",
+			...group,
+			template: "evm.bip44"
+		};
+		try {
+			const pending = await requests.prepare({
+				method: "evm-sign",
+				origin: {
+					kind: "browser",
+					origin
+				},
+				account,
+				network: session.currentNetwork,
+				request: build(account)
+			});
+			const result = await requests.outcome(pending.id);
+			await connections.touch(origin);
+			if ("signature" in result && result.signature instanceof Uint8Array) return `0x${bytesToHex(result.signature)}`;
+			if (!("hash" in result) || typeof result.hash !== "string") throw internalError("the transaction has no hash");
+			return result.hash;
+		} catch (error) {
+			throw toProviderError(error);
+		}
+	}
+	async read(origin, method, params) {
+		const { connections, networks } = this.options;
+		const network = connections.session(origin)?.currentNetwork ?? this.options.defaultNetwork();
+		try {
+			return await networks.client(network).transport.request({
+				method,
+				params: [...params]
+			});
+		} catch (error) {
+			throw toProviderError(error);
+		}
+	}
+};
+function toProviderError(error) {
+	if (error instanceof ProviderError) return error;
+	if (error instanceof OriginBusyError) return userRejectedRequest(error.message);
+	if (error instanceof RequestEndedError) return error.stage === "failed" ? internalError(error.message) : userRejectedRequest(error.message);
+	if (error instanceof ChainError) return invalidParams(error.message);
+	return internalError(error instanceof Error ? error.message : String(error));
 }
-//#endregion
-//#region src/errors.ts
-/** Typed engine errors: store codes are `closed` and `integrity` (decrypt or bind failure). */
-var EngineStoreError = class extends Error {
-	code;
-	constructor(code, message) {
+function currentAccounts(session) {
+	return session.scopes[session.currentNetwork]?.accounts.map((a) => a.slice(a.lastIndexOf(":") + 1)) ?? [];
+}
+const byOrigin = (sessions) => new Map(Object.values(sessions).map((s) => [s.origin.origin, s]));
+function diffSessions(before, after) {
+	const events = [];
+	const prev = byOrigin(before);
+	const next = byOrigin(after);
+	for (const [origin, session] of prev) {
+		const now = next.get(origin);
+		if (now === void 0) {
+			events.push({
+				name: "disconnect",
+				origin
+			});
+			continue;
+		}
+		if (now.currentNetwork !== session.currentNetwork) events.push({
+			name: "chainChanged",
+			origin,
+			chainId: hexChainId(now.currentNetwork)
+		});
+		if (currentAccounts(session).join(",") !== currentAccounts(now).join(",")) events.push({
+			name: "accountsChanged",
+			origin,
+			accounts: currentAccounts(now)
+		});
+	}
+	for (const [origin, session] of next) if (!prev.has(origin)) events.push({
+		name: "connect",
+		origin,
+		chainId: hexChainId(session.currentNetwork)
+	});
+	return events;
+}
+// src/addresses/errors.ts
+var AddressBookError = class extends Error {
+	category;
+	constructor(category, message) {
 		super(message);
-		this.name = "EngineStoreError";
-		this.code = code;
+		this.name = "AddressBookError";
+		this.category = category;
 	}
 };
-//#endregion
-//#region src/store/guard.ts
-/** NUL is the composite-key/AAD separator — a name or key containing it collides. */
-function checkName(kind, value) {
-	if (value.includes("\0")) throw new EngineStoreError("invalid-input", `${kind} must not contain NUL`);
-}
-//#endregion
-//#region src/store/memory.ts
-/** In-memory EngineStore: the Node/test implementation — same contract, no durability. */
-function createMemoryEngineStore(backing) {
-	const collections = backing?.collections ?? /* @__PURE__ */ new Map();
-	let closed = false;
-	const guard = () => {
-		if (closed) throw new EngineStoreError("closed", "engine store is closed");
+// src/addresses/record.ts
+/**
+* The address-book record shared by the controller, the sync merge and the metadata document: a
+* live entry, or a tombstone that carries a deletion to the other devices.
+*/
+const isTombstone = (record) => "deleted" in record;
+const isFamily = (v) => v === "evm" || v === "solana" || v === "bitcoin" || v === "spark";
+const ENTRY_KEYS = /* @__PURE__ */ new Set([
+	"id",
+	"name",
+	"family",
+	"address",
+	"note",
+	"createdAt",
+	"updatedAt"
+]);
+const TOMBSTONE_KEYS = /* @__PURE__ */ new Set([
+	"id",
+	"deleted",
+	"updatedAt"
+]);
+const isObject$11 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const isNonNegativeInt$2 = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+/** Trimmed name, or `undefined` when it is not 1 to {@link NAME_MAX} characters. */
+const cleanName = (raw) => {
+	const name = raw.trim();
+	return name.length > 0 && name.length <= 32 ? name : void 0;
+};
+/** Trimmed note; an empty one means no note. `undefined` return with `ok: false` when too long. */
+const cleanNote = (raw) => {
+	const note = raw?.trim();
+	if (note === void 0 || note.length === 0) return {
+		ok: true,
+		note: void 0
 	};
+	return note.length <= 120 ? {
+		ok: true,
+		note
+	} : { ok: false };
+};
+const hasOnly = (value, keys) => Object.keys(value).every((k) => keys.has(k));
+/**
+* Strict decode with the controller's rules; the address is re-normalized. Anything else is
+* `undefined`.
+*/
+function decodeRecord(value) {
+	if (!isObject$11(value) || typeof value["id"] !== "string" || !isNonNegativeInt$2(value["updatedAt"])) return;
+	if ("deleted" in value) return value["deleted"] === true && hasOnly(value, TOMBSTONE_KEYS) ? {
+		id: value["id"],
+		deleted: true,
+		updatedAt: value["updatedAt"]
+	} : void 0;
+	const { family, name, address, note } = value;
+	if (!hasOnly(value, ENTRY_KEYS) || !isFamily(family) || typeof name !== "string" || typeof address !== "string" || !isNonNegativeInt$2(value["createdAt"]) || note !== void 0 && typeof note !== "string") return;
+	const cleanedName = cleanName(name);
+	const normalized = normalizeAddress(family, address);
+	const cleanedNote = cleanNote(note);
+	if (cleanedName === void 0 || normalized === void 0 || !cleanedNote.ok || note !== void 0 && cleanedNote.note === void 0) return;
 	return {
-		collection(name) {
-			checkName("collection", name);
-			let table = collections.get(name);
-			if (table === void 0) {
-				table = /* @__PURE__ */ new Map();
-				collections.set(name, table);
-			}
-			return {
-				get: async (key) => {
-					guard();
-					checkName("key", key);
-					const value = table.get(key);
-					return value === void 0 ? void 0 : new Uint8Array(value);
-				},
-				put: async (key, bytes) => {
-					guard();
-					checkName("key", key);
-					table.set(key, new Uint8Array(bytes));
-				},
-				delete: async (key) => {
-					guard();
-					checkName("key", key);
-					table.delete(key);
-				},
-				list: async () => {
-					guard();
-					return [...table.keys()];
-				}
-			};
-		},
-		close: async () => {
-			closed = true;
-			collections.clear();
+		id: value["id"],
+		name: cleanedName,
+		family,
+		address: normalized,
+		...cleanedNote.note === void 0 ? {} : { note: cleanedNote.note },
+		createdAt: value["createdAt"],
+		updatedAt: value["updatedAt"]
+	};
+}
+const serialized = (record) => JSON.stringify(record);
+/** The winner of two versions of one id: larger `updatedAt`, then the larger serialization. */
+function pickWinner(a, b) {
+	if (a.updatedAt !== b.updatedAt) return a.updatedAt > b.updatedAt ? a : b;
+	return serialized(a) >= serialized(b) ? a : b;
+}
+const pruneTombstones = (records, now) => records.filter((r) => !isTombstone(r) || now - r.updatedAt <= 7776e6);
+/** Newest first, id as the tiebreak, so every device orders (and truncates) the same way. */
+const newestFirst = (a, b) => b.updatedAt - a.updatedAt || (a.id < b.id ? -1 : 1);
+/** Drops the oldest tombstones until at most `max` records remain, or no tombstone is left. */
+function evictTombstones(records, max) {
+	const excess = records.length - max;
+	if (excess <= 0) return records;
+	const oldest = new Set(records.filter(isTombstone).sort((a, b) => a.updatedAt - b.updatedAt || (a.id < b.id ? -1 : 1)).slice(0, excess).map((r) => r.id));
+	return records.filter((r) => !oldest.has(r.id));
+}
+/** {@link mergeRecords}, also counting the live entries the cap forced out. */
+function mergeWithReport(local, remote, now) {
+	const byId = /* @__PURE__ */ new Map();
+	for (const record of [...local, ...remote]) {
+		const existing = byId.get(record.id);
+		byId.set(record.id, existing === void 0 ? record : pickWinner(existing, record));
+	}
+	const live = /* @__PURE__ */ new Map();
+	const kept = [];
+	for (const record of [...pruneTombstones([...byId.values()], now)].sort(newestFirst)) {
+		if (isTombstone(record)) {
+			kept.push(record);
+			continue;
 		}
+		const key = `${record.family}:${record.address}`;
+		if (!live.has(key)) {
+			live.set(key, record);
+			kept.push(record);
+		}
+	}
+	const evicted = evictTombstones(kept, 128);
+	return {
+		records: [...evicted.slice(0, 128)].sort((a, b) => a.id < b.id ? -1 : 1),
+		droppedLive: evicted.slice(128).filter((r) => !isTombstone(r)).length
 	};
 }
-//#endregion
-//#region src/chains/bitcoin-scan.ts
+// src/addresses/controller.ts
+/**
+* Address book: named recipients, validated and normalized per chain family, persisted in the
+* engine store and cleared from memory on lock. Deletions are kept as tombstones so they reach the
+* other devices; `syncEntries`/`merge` are the whole surface the metadata sync needs. Request risk
+* checks treat its addresses as known.
+*/
+const COLLECTION$2 = "contacts";
+const entriesOf = (records) => Object.fromEntries(records.flatMap((r) => isTombstone(r) ? [] : [[r.id, r]]));
+var AddressBookController = class extends Controller {
+	options;
+	engineStore;
+	/** Every record, tombstones included, by id. */
+	records = /* @__PURE__ */ new Map();
+	constructor(options) {
+		super({
+			name: "address-book",
+			defaultState: () => ({ entries: {} })
+		});
+		this.options = options;
+	}
+	async init() {
+		const store = await this.options.openStore();
+		this.engineStore = store;
+		const collection = store.collection(COLLECTION$2);
+		const keys = await collection.list();
+		const rows = await Promise.all(keys.map(async (key) => collection.get(key)));
+		const records = /* @__PURE__ */ new Map();
+		for (const raw of rows) {
+			if (raw === void 0) continue;
+			const record = decodeRecord(JSON.parse(new TextDecoder().decode(raw)));
+			if (record === void 0) this.options.logger.warn("address book record skipped: malformed");
+			else records.set(record.id, record);
+		}
+		this.records = records;
+		this.update(() => ({ entries: entriesOf([...records.values()]) }));
+	}
+	async destroy() {
+		this.lock();
+		await Promise.resolve();
+	}
+	lock() {
+		this.engineStore = void 0;
+		this.records = /* @__PURE__ */ new Map();
+		this.update(() => ({ entries: {} }));
+	}
+	/** Entries and tombstones, for the metadata document. */
+	syncEntries() {
+		return [...this.records.values()].sort((a, b) => a.id < b.id ? -1 : 1);
+	}
+	/**
+	* Merges records from another device (last writer wins, tombstones win over older entries).
+	* Returns whether anything local changed and whether the merged set holds something `remote`
+	* lacks, i.e. whether the remote copy needs a newer publish.
+	*/
+	async merge(remote) {
+		const store = this.requireStore();
+		const before = JSON.stringify(this.syncEntries());
+		const { records: merged, droppedLive } = mergeWithReport(this.syncEntries(), remote, this.options.now());
+		if (droppedLive > 0) this.options.logger.warn(`address book sync: ${droppedLive} contacts dropped, over the 128-record cap`);
+		const remoteSorted = JSON.stringify([...remote].sort((a, b) => a.id < b.id ? -1 : 1));
+		const localNewer = JSON.stringify(merged) !== remoteSorted;
+		if (JSON.stringify(merged) === before) return {
+			changed: false,
+			localNewer
+		};
+		const collection = store.collection(COLLECTION$2);
+		const next = new Map(merged.map((r) => [r.id, r]));
+		await Promise.all([...merged.map(async (r) => collection.put(r.id, new TextEncoder().encode(JSON.stringify(r)))), ...[...this.records.keys()].filter((id) => !next.has(id)).map(async (id) => collection.delete(id))]);
+		this.records = next;
+		this.update(() => ({ entries: entriesOf(merged) }));
+		return {
+			changed: true,
+			localNewer
+		};
+	}
+	async add(params) {
+		const store = this.requireStore();
+		const name = cleanName(params.name);
+		if (name === void 0) throw new AddressBookError("invalid-input", `name must be 1 to 32 characters`);
+		const note = this.checkedNote(params.note);
+		const address = normalizeAddress(params.family, params.address.trim());
+		if (address === void 0) throw new AddressBookError("invalid-input", `not a valid ${params.family} address`);
+		if (Object.values(this.getState().entries).some((e) => e.family === params.family && e.address === address)) throw new AddressBookError("duplicate", "this address is already in the address book");
+		if (this.records.size >= 128) {
+			const kept = evictTombstones([...this.records.values()], 127);
+			if (kept.length >= 128) throw new AddressBookError("limit", `the address book holds at most 128 contacts`);
+			const keptIds = new Set(kept.map((r) => r.id));
+			await Promise.all([...this.records.keys()].filter((id) => !keptIds.has(id)).map(async (id) => store.collection(COLLECTION$2).delete(id)));
+			this.records = new Map(kept.map((r) => [r.id, r]));
+		}
+		const now = this.options.now();
+		const entry = {
+			id: `contact-${[...this.options.random(8)].map((b) => b.toString(16).padStart(2, "0")).join("")}`,
+			name,
+			family: params.family,
+			address,
+			...note === void 0 ? {} : { note },
+			createdAt: now,
+			updatedAt: now
+		};
+		await this.persist(store, entry);
+		return entry;
+	}
+	async rename(id, name) {
+		const store = this.requireStore();
+		const existing = this.requireEntry(id);
+		const cleaned = cleanName(name);
+		if (cleaned === void 0) throw new AddressBookError("invalid-input", `name must be 1 to 32 characters`);
+		const entry = {
+			...existing,
+			name: cleaned,
+			updatedAt: this.options.now()
+		};
+		await this.persist(store, entry);
+		return entry;
+	}
+	/** Sets or clears (empty or `undefined`) the note. */
+	async setNote(id, note) {
+		const store = this.requireStore();
+		const existing = this.requireEntry(id);
+		const cleaned = this.checkedNote(note);
+		const { note: _previous, ...rest } = existing;
+		const entry = {
+			...rest,
+			...cleaned === void 0 ? {} : { note: cleaned },
+			updatedAt: this.options.now()
+		};
+		await this.persist(store, entry);
+		return entry;
+	}
+	/** Removes the entry, leaving a tombstone so other devices drop it too. */
+	async remove(id) {
+		const store = this.requireStore();
+		this.requireEntry(id);
+		await this.persist(store, {
+			id,
+			deleted: true,
+			updatedAt: this.options.now()
+		});
+	}
+	checkedNote(note) {
+		const cleaned = cleanNote(note);
+		if (!cleaned.ok) throw new AddressBookError("invalid-input", `note must be at most 120 characters`);
+		return cleaned.note;
+	}
+	requireEntry(id) {
+		const entry = this.getState().entries[id];
+		if (entry === void 0) throw new AddressBookError("not-found", `unknown contact ${id}`);
+		return entry;
+	}
+	async persist(store, record) {
+		await store.collection(COLLECTION$2).put(record.id, new TextEncoder().encode(JSON.stringify(record)));
+		this.records.set(record.id, record);
+		this.update(() => ({ entries: entriesOf([...this.records.values()]) }));
+	}
+	requireStore() {
+		if (this.engineStore === void 0) throw new AddressBookError("locked", "the address book requires an unlocked vault");
+		return this.engineStore;
+	}
+};
+// src/chains/bitcoin-scan.ts
 /**
 * Gap-20 BIP-44/86 account scanning over Esplora — derives /0/* and /1/* from the account xpub,
 * walks each chain in windows until 20 consecutive unused addresses, persists the discovered
@@ -141,6 +2007,7 @@ function createMemoryEngineStore(backing) {
 * receive/change address.
 */
 const GAP = 20;
+const COLL = "btc-scan";
 const isObject$10 = (v) => typeof v === "object" && v !== null;
 const isUnknownArray = (v) => Array.isArray(v);
 const asArray = (v) => isUnknownArray(v) ? v : [];
@@ -193,8 +2060,45 @@ const scanUtxos = async (es, addresses, params) => {
 	const candidates = addresses.filter((a) => a.used || a.chain === 1 || a.index < GAP);
 	return Promise.all(candidates.map(async (a) => scanAddressUtxos(es, a, params))).then((r) => r.flat());
 };
+var BitcoinScanStore = class {
+	engineStore;
+	async unlock(store) {
+		this.engineStore = store;
+		const raw = await store.collection(COLL).get("state");
+		const parsed = raw === void 0 ? void 0 : JSON.parse(new TextDecoder().decode(raw));
+		if (!isObject$10(parsed) || !Array.isArray(parsed["addresses"]) || !Array.isArray(parsed["utxos"])) return;
+		return {
+			addresses: asArray(parsed["addresses"]).flatMap((a) => toScanAddress(a)),
+			utxos: asArray(parsed["utxos"]).flatMap((u) => toScanUtxo(u)),
+			scannedAt: typeof parsed["scannedAt"] === "number" ? parsed["scannedAt"] : 0
+		};
+	}
+	async persist(state) {
+		const store = this.engineStore;
+		if (store !== void 0) await store.collection(COLL).put("state", new TextEncoder().encode(JSON.stringify(state)));
+	}
+	nextUnused(state, chain) {
+		return state.addresses.find((a) => a.chain === chain && !a.used);
+	}
+	lock() {
+		this.engineStore = void 0;
+	}
+};
 const str$1 = (v) => typeof v === "string" ? v : void 0;
 const num = (v) => typeof v === "number" ? v : void 0;
+const toScanAddress = (v) => {
+	if (!isObject$10(v)) return [];
+	const chain = num(v["chain"]);
+	const index = num(v["index"]);
+	const address = str$1(v["address"]);
+	const used = v["used"] === true;
+	return chain !== void 0 && index !== void 0 && address !== void 0 && (chain === 0 || chain === 1) ? [{
+		chain: chain === 0 ? 0 : 1,
+		index,
+		address,
+		used
+	}] : [];
+};
 const toScanUtxo = (v) => {
 	if (!isObject$10(v)) return [];
 	const txid = str$1(v["txid"]);
@@ -280,6 +2184,10 @@ var BtcUtxoStore = class BtcUtxoStore {
 		});
 		this.persist();
 	}
+	/** True while a pending request or an unconfirmed transaction holds this output. */
+	isLocked(u) {
+		return this.utxos.get(BtcUtxoStore.key(u))?.status === "locked";
+	}
 	/** Released on failed/rejected/dropped; spent-removed on confirmed. */
 	endTx(txId, final) {
 		if (final === "confirmed") {
@@ -307,12 +2215,7 @@ var BtcUtxoStore = class BtcUtxoStore {
 		this.engineStore = void 0;
 	}
 };
-//#endregion
-//#region src/transactions/route.ts
-const newId = (random) => `tx-${[...random(8)].map((b) => b.toString(16).padStart(2, "0")).join("")}`;
-const errorMessage = (error) => error instanceof Error ? error.message : String(error);
-//#endregion
-//#region src/accounts/errors.ts
+// src/accounts/errors.ts
 var AccountTreeError = class extends Error {
 	category;
 	constructor(category, message, cause) {
@@ -321,8 +2224,7 @@ var AccountTreeError = class extends Error {
 		this.category = category;
 	}
 };
-//#endregion
-//#region src/accounts/controller.ts
+// src/accounts/controller.ts
 const EMPTY_TREE = {
 	wallets: {},
 	groups: {},
@@ -461,7 +2363,7 @@ const check = async (family, run) => {
 	} catch (error) {
 		return [family, {
 			used: false,
-			error: errorMessage(error)
+			error: errorMessage$1(error)
 		}];
 	}
 };
@@ -726,7 +2628,6 @@ var AccountTreeController = class extends Controller {
 			...g.boundPubkey === void 0 ? {} : { boundPubkey: g.boundPubkey }
 		});
 		return {
-			v: 1,
 			wallet,
 			groups
 		};
@@ -1138,14 +3039,14 @@ function persistedToState(tree) {
 		totals: tree.totals
 	};
 }
-//#endregion
-//#region src/chains/evm.ts
+// src/chains/evm.ts
 /**
 * EVM chain adapter: native transfers through a viem PublicClient injected by NetworkController.
 * Fee tiers come from eth_feeHistory (20 blocks, p10/p50/p90 → slow/normal/fast, maxFee = 2×baseFee +
 * priority); networks that cannot answer feeHistory fall back to eth_gasPrice. gas = estimateGas ×
-* 1.2 (ceil). Nonces are allocated on a per-(network, from) serial queue as max(pending count, last
-* submitted + 1). Finalization uses the `finalized` block tag; receipts with status 0 fail.
+* 1.2 (ceil). The next nonce is read on a per-(network, from) serial queue as max(pending count,
+* last broadcast + 1) and is only recorded once a broadcast succeeds. Finalization uses the
+* `finalized` block tag; receipts with status 0 fail.
 */
 const ERC20_ABI = [
 	{
@@ -1203,6 +3104,15 @@ const checkedAddress = (v) => {
 	return v;
 };
 const hex$1 = (v) => numberToHex(v);
+const evmRpc = async (client, method, params) => client.transport.request({
+	method,
+	params
+});
+const evmRpcHex = async (client, method, params) => {
+	const result = await evmRpc(client, method, params);
+	if (typeof result !== "string") throw new TypeError(`${method} returned a malformed result`);
+	return result;
+};
 var EvmChainAdapter = class {
 	family = "evm";
 	nonces = /* @__PURE__ */ new Map();
@@ -1218,31 +3128,35 @@ var EvmChainAdapter = class {
 		this.nonces.set(key, next);
 		return next;
 	}
-	async rpc(client, method, params) {
-		return client.transport.request({
-			method,
-			params
-		});
-	}
-	async rpcHex(client, method, params) {
-		const result = await this.rpc(client, method, params);
-		if (typeof result !== "string") throw new TypeError(`${method} returned a malformed result`);
-		return result;
+	/** The endpoint's pending transaction count for `from`. */
+	async pendingCount(client, from) {
+		return Number(await evmRpcHex(client, "eth_getTransactionCount", [from, "pending"]));
 	}
-	/** Allocate the next nonce for (network, from) — serial per key. */
-	async nonce(client, network, from) {
+	/**
+	* The next nonce for (network, from): the larger of the endpoint's pending count and one past the
+	* highest nonce this engine already broadcast. Reading it reserves nothing — only
+	* {@link commitNonce} after a successful broadcast advances the local record.
+	*/
+	async nextNonce(client, network, from) {
 		const key = `${network}:${from}`;
 		return this.serial(key, async () => {
-			const pending = Number(await this.rpcHex(client, "eth_getTransactionCount", [from, "pending"]));
+			const pending = await this.pendingCount(client, from);
 			const local = this.lastNonce.get(key);
-			const nonce = Math.max(pending, local === void 0 ? 0 : local + 1);
-			this.lastNonce.set(key, nonce);
-			return nonce;
+			return Math.max(pending, local === void 0 ? 0 : local + 1);
 		});
 	}
+	/** True once a broadcast at `nonce` or later is recorded for (network, from). */
+	nonceConsumed(network, from, nonce) {
+		const local = this.lastNonce.get(`${network}:${from}`);
+		return local !== void 0 && local >= nonce;
+	}
+	commitNonce(network, from, nonce) {
+		const key = `${network}:${from}`;
+		this.lastNonce.set(key, Math.max(this.lastNonce.get(key) ?? nonce, nonce));
+	}
 	/** ERC-20 gas is buffered ×1.1 instead of the native ×1.2 (chains.mdx "EVM"). */
-	async build(client, network, from, intent) {
-		const nonce = await this.nonce(client, network, from);
+	async build(client, network, from, intent, nonceOverride) {
+		const nonce = nonceOverride ?? await this.nextNonce(client, network, from);
 		const erc20 = intent.kind === "erc20";
 		const to = checksumEvmAddress(erc20 ? intent.token : intent.to);
 		const value = erc20 ? 0n : intent.value;
@@ -1250,14 +3164,16 @@ var EvmChainAdapter = class {
 			abi: ERC20_ABI,
 			functionName: "transfer",
 			args: [checkedAddress(intent.to), intent.value]
-		}) : "0x";
-		const estimate = BigInt(await this.rpcHex(client, "eth_estimateGas", [{
+		}) : intent.kind === "call" ? intent.data : "0x";
+		const estimate = BigInt(await evmRpcHex(client, "eth_estimateGas", [{
 			from,
 			to,
 			value: hex$1(value),
 			data
 		}]));
 		const scale = erc20 ? 11n : 12n;
+		const buffered = estimate * scale / 10n + (estimate * scale % 10n === 0n ? 0n : 1n);
+		const minGas = intent.kind === "call" ? intent.minGas ?? 0n : 0n;
 		return {
 			family: "evm",
 			network,
@@ -1266,12 +3182,12 @@ var EvmChainAdapter = class {
 			value,
 			data,
 			nonce,
-			gas: estimate * scale / 10n + (estimate * scale % 10n === 0n ? 0n : 1n)
+			gas: buffered > minGas ? buffered : minGas
 		};
 	}
 	async estimateFee(client) {
 		try {
-			const history = await this.rpc(client, "eth_feeHistory", [
+			const history = await evmRpc(client, "eth_feeHistory", [
 				"0x14",
 				"latest",
 				[
@@ -1301,7 +3217,7 @@ var EvmChainAdapter = class {
 				tier(2, "fast")
 			];
 		} catch {
-			const price = BigInt(await this.rpcHex(client, "eth_gasPrice", []));
+			const price = BigInt(await evmRpcHex(client, "eth_gasPrice", []));
 			return [
 				"slow",
 				"normal",
@@ -1358,21 +3274,20 @@ var EvmChainAdapter = class {
 		return `0x${[...bytes].map((b) => b.toString(16).padStart(2, "0")).join("")}`;
 	}
 	async broadcast(client, raw) {
-		return this.rpcHex(client, "eth_sendRawTransaction", [raw]);
+		return evmRpcHex(client, "eth_sendRawTransaction", [raw]);
 	}
 	async status(client, hash) {
-		const receipt = await this.rpc(client, "eth_getTransactionReceipt", [hash]);
+		const receipt = await evmRpc(client, "eth_getTransactionReceipt", [hash]);
 		if (receipt === null || typeof receipt !== "object") return "pending";
 		if ("status" in receipt && typeof receipt.status === "string" && BigInt(receipt.status) === 0n) return "failed";
 		try {
-			const finalized = await this.rpc(client, "eth_getBlockByNumber", ["finalized", false]);
+			const finalized = await evmRpc(client, "eth_getBlockByNumber", ["finalized", false]);
 			if (finalized !== null && typeof finalized === "object" && "number" in finalized && typeof finalized.number === "string" && "blockNumber" in receipt && typeof receipt.blockNumber === "string" && BigInt(receipt.blockNumber) <= BigInt(finalized.number)) return "finalized";
 		} catch {}
 		return "confirmed";
 	}
 };
-//#endregion
-//#region src/assets/controller.ts
+// src/assets/controller.ts
 /**
 * EVM balances per (account address, network). Native via eth_getBalance; token balanceOf calls go
 * through the network's Multicall3 (one aggregate eth_call) when the registry declares it,
@@ -1504,7 +3419,7 @@ var AssetsController = class extends Controller {
 			return;
 		}
 		const client = this.options.networks.client(network);
-		const native = BigInt(await this.rpcHex(client, "eth_getBalance", [address, "latest"])).toString();
+		const native = BigInt(await evmRpcHex(client, "eth_getBalance", [address, "latest"])).toString();
 		const custom = this.customTokens.get(network) ?? [];
 		const tokens = await this.readTokens(client, info.multicall3, address, custom.map((t) => ({
 			address: t.address,
@@ -1556,8 +3471,8 @@ var AssetsController = class extends Controller {
 		const balances = multicall3 === void 0 ? await Promise.all(tokens.map(async (t) => this.balanceOf(client, t.address, owner))) : await this.balanceOfBatch(client, multicall3, owner, tokens.map((t) => t.address));
 		return Promise.all(tokens.map(async (t, i) => ({
 			address: t.address,
-			symbol: await this.callString(client, t.address, "symbol") ?? "?",
-			decimals: await this.callNumber(client, t.address, "decimals") ?? 18,
+			symbol: await this.callToken(client, t.address, "symbol") ?? "?",
+			decimals: await this.callToken(client, t.address, "decimals") ?? 18,
 			balance: balances[i]?.toString() ?? "0",
 			verified: t.verified
 		})));
@@ -1576,7 +3491,7 @@ var AssetsController = class extends Controller {
 				})
 			}))]
 		});
-		const result = await this.rpcHex(client, "eth_call", [{
+		const result = await evmRpcHex(client, "eth_call", [{
 			to: multicall3,
 			data
 		}, "latest"]);
@@ -1597,7 +3512,7 @@ var AssetsController = class extends Controller {
 			functionName: "balanceOf",
 			args: [checked(owner)]
 		});
-		const result = await this.rpcHex(client, "eth_call", [{
+		const result = await evmRpcHex(client, "eth_call", [{
 			to: token,
 			data
 		}, "latest"]);
@@ -1608,32 +3523,12 @@ var AssetsController = class extends Controller {
 			data: result
 		});
 	}
-	async callString(client, token, fn) {
-		const data = encodeFunctionData({
-			abi: ERC20_ABI,
-			functionName: fn
-		});
-		const result = await this.rpcHex(client, "eth_call", [{
-			to: token,
-			data
-		}, "latest"]);
-		if (!isHex(result)) return;
-		try {
-			return decodeFunctionResult({
-				abi: ERC20_ABI,
-				functionName: fn,
-				data: result
-			});
-		} catch {
-			return;
-		}
-	}
-	async callNumber(client, token, fn) {
+	async callToken(client, token, fn) {
 		const data = encodeFunctionData({
 			abi: ERC20_ABI,
 			functionName: fn
 		});
-		const result = await this.rpcHex(client, "eth_call", [{
+		const result = await evmRpcHex(client, "eth_call", [{
 			to: token,
 			data
 		}, "latest"]);
@@ -1659,8 +3554,8 @@ var AssetsController = class extends Controller {
 			return;
 		}
 		const client = this.options.networks.client(network);
-		await this.callString(client, address, "symbol");
-		await this.callNumber(client, address, "decimals");
+		await this.callToken(client, address, "symbol");
+		await this.callToken(client, address, "decimals");
 		await this.persistToken(network, address);
 	}
 	async persistToken(network, address) {
@@ -1677,17 +3572,6 @@ var AssetsController = class extends Controller {
 			await this.engineStore.collection(COLLECTION$1).put("customTokens", new TextEncoder().encode(JSON.stringify(merged)));
 		}
 	}
-	async rpc(client, method, params) {
-		return client.transport.request({
-			method,
-			params
-		});
-	}
-	async rpcHex(client, method, params) {
-		const result = await this.rpc(client, method, params);
-		if (typeof result !== "string") throw new TypeError(`${method} returned a malformed result`);
-		return result;
-	}
 	/** BTC balance = confirmed spendable + own unconfirmed change; frozen 546/330 shown separately. */
 	async refreshBitcoin(xpub, network) {
 		const es = this.options.networks.esplora(network);
@@ -1722,8 +3606,7 @@ var AssetsController = class extends Controller {
 		}));
 	}
 };
-//#endregion
-//#region src/backup/errors.ts
+// src/backup/errors.ts
 var BackupControllerError = class extends Error {
 	category;
 	constructor(category, message) {
@@ -1732,8 +3615,7 @@ var BackupControllerError = class extends Error {
 		this.category = category;
 	}
 };
-//#endregion
-//#region src/backup/controller.ts
+// src/backup/controller.ts
 /**
 * The backup reconcile loop (design/backup.mdx "同步"): keeps the cloud file
 * `qntx-wallet-backup-<id>.json` in step with the vault. Single-flight — a trigger during a run
@@ -1772,17 +3654,15 @@ function parseRecord(bytes) {
 		const { digest } = o;
 		const { uploadedAt } = o;
 		const { walletIds } = o;
-		const { nostrKeyIds } = o;
 		if (typeof id !== "string" || !/^[0-9a-f]{32}$/.test(id)) return;
 		if (digest !== void 0 && (typeof digest !== "string" || !/^[0-9a-f]{64}$/.test(digest))) return;
 		if (uploadedAt !== void 0 && (typeof uploadedAt !== "number" || !Number.isSafeInteger(uploadedAt))) return;
-		if (!isStringArray(walletIds) || !isStringArray(nostrKeyIds)) return;
+		if (!isStringArray(walletIds)) return;
 		return {
 			id,
 			digest,
 			uploadedAt,
-			walletIds,
-			nostrKeyIds
+			walletIds
 		};
 	} catch {
 		return;
@@ -1899,8 +3779,7 @@ var BackupController = class extends Controller {
 				id,
 				digest: digestOf(text),
 				uploadedAt: previous?.uploadedAt,
-				walletIds: [],
-				nostrKeyIds: []
+				walletIds: []
 			});
 		}
 		try {
@@ -1930,20 +3809,10 @@ var BackupController = class extends Controller {
 	}
 	unprotected(snapshot, record) {
 		const covered = snapshot.backup !== null && record !== void 0 && record.id === snapshot.backup.id && record.digest !== void 0;
-		const wallets = snapshot.wallets.filter((w) => w.backup !== "mnemonic");
-		const keys = snapshot.nostr.keys.filter((k) => k.ref.kind === "standalone" && k.backedUp === false);
-		const walletIds = wallets.map((w) => w.walletId).filter((id) => !covered || !record.walletIds.includes(id));
-		const nostrKeyIds = keys.map((k) => k.publicKey).filter((id) => !covered || !record.nostrKeyIds.includes(id));
-		return {
-			walletIds: sorted(walletIds),
-			nostrKeyIds: sorted(nostrKeyIds)
-		};
+		return { walletIds: sorted(snapshot.wallets.filter((w) => w.backup !== "mnemonic").map((w) => w.walletId).filter((id) => !covered || !record.walletIds.includes(id))) };
 	}
 	coverage(snapshot) {
-		return {
-			walletIds: sorted(snapshot.wallets.map((w) => w.walletId)),
-			nostrKeyIds: sorted(snapshot.nostr.keys.filter((k) => k.ref.kind === "standalone").map((k) => k.publicKey))
-		};
+		return { walletIds: sorted(snapshot.wallets.map((w) => w.walletId)) };
 	}
 	setStatus(generation, status, error, record) {
 		if (generation !== this.generation) return;
@@ -1995,8 +3864,7 @@ var BackupController = class extends Controller {
 					id: adoption.id,
 					digest: adoption.digest,
 					uploadedAt: void 0,
-					walletIds: [],
-					nostrKeyIds: []
+					walletIds: []
 				};
 				if (generation !== this.generation) return;
 				await this.writeRecord(record);
@@ -2019,7 +3887,7 @@ var BackupController = class extends Controller {
 		}
 		const baseline = record !== void 0 && record.id === backup.id ? record.digest : void 0;
 		const cov = this.coverage(snapshot);
-		if (baseline !== void 0 && record !== void 0 && sameSet(cov.walletIds, record.walletIds) && sameSet(cov.nostrKeyIds, record.nostrKeyIds)) {
+		if (baseline !== void 0 && record !== void 0 && sameSet(cov.walletIds, record.walletIds)) {
 			this.setStatus(generation, "synced", void 0, record);
 			return;
 		}
@@ -2044,8 +3912,7 @@ var BackupController = class extends Controller {
 				id: backup.id,
 				digest,
 				uploadedAt: this.now(),
-				walletIds: cov.walletIds,
-				nostrKeyIds: cov.nostrKeyIds
+				walletIds: cov.walletIds
 			};
 			if (generation !== this.generation) return;
 			await this.writeRecord(next);
@@ -2068,10 +3935,7 @@ function defaultState() {
 		status: "locked",
 		backup: null,
 		uploadedAt: void 0,
-		unprotected: {
-			walletIds: [],
-			nostrKeyIds: []
-		},
+		unprotected: { walletIds: [] },
 		error: void 0
 	};
 }
@@ -2085,7 +3949,8 @@ const PUBKEY_RE = /^[0-9a-f]{64}$/;
 const KNOWN_DOC_KEYS = /* @__PURE__ */ new Set([
 	"v",
 	"wallet",
-	"groups"
+	"groups",
+	"contacts"
 ]);
 const KNOWN_WALLET_KEYS = /* @__PURE__ */ new Set(["name", "updatedAt"]);
 const KNOWN_GROUP_KEYS = /* @__PURE__ */ new Set([
@@ -2099,11 +3964,14 @@ const isObject$7 = (v) => typeof v === "object" && v !== null && !Array.isArray(
 const isNonNegativeInt = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
 const validName = (v) => v === void 0 || typeof v === "string" && v.trim().length > 0 && v.trim().length <= NAME_MAX;
 const trimmedName = (v) => typeof v === "string" ? v.trim() : void 0;
-/** Strict decode — any malformed shape, unknown key or duplicate index returns `undefined`. */
+/**
+* Strict decode — any malformed shape, unknown key, duplicate index or id, or invalid contact
+* returns `undefined`; only `v: 2` is read.
+*/
 function decodeMetaDoc(value) {
 	if (!isObject$7(value)) return;
 	for (const k of Object.keys(value)) if (!KNOWN_DOC_KEYS.has(k)) return;
-	if (value["v"] !== 1) return;
+	if (value["v"] !== 2) return;
 	const { wallet } = value;
 	if (!isObject$7(wallet)) return;
 	for (const k of Object.keys(wallet)) if (!KNOWN_WALLET_KEYS.has(k)) return;
@@ -2132,9 +4000,18 @@ function decodeMetaDoc(value) {
 		});
 	}
 	out.sort((a, b) => a.index - b.index);
+	const { contacts } = value;
+	if (!Array.isArray(contacts) || contacts.length > 128) return;
+	const records = /* @__PURE__ */ new Map();
+	for (const item of contacts) {
+		const record = decodeRecord(item);
+		if (record === void 0 || records.has(record.id)) return;
+		records.set(record.id, record);
+	}
 	const name = trimmedName(wallet["name"]);
 	return {
-		v: 1,
+		v: 2,
+		contacts: [...records.values()].sort((a, b) => a.id < b.id ? -1 : 1),
 		wallet: {
 			updatedAt: wallet["updatedAt"],
 			...name === void 0 ? {} : { name }
@@ -2155,8 +4032,7 @@ function decodeMetaDocBytes(bytes) {
 		return;
 	}
 }
-//#endregion
-//#region src/meta/errors.ts
+// src/meta/errors.ts
 var MetaSyncError = class extends Error {
 	category;
 	constructor(category, message, cause) {
@@ -2165,15 +4041,15 @@ var MetaSyncError = class extends Error {
 		this.category = category;
 	}
 };
-//#endregion
-//#region src/meta/controller.ts
+// src/meta/controller.ts
 const META_SYNC_KIND = 30078;
 const PUBLISH_DEBOUNCE_MS = 2e3;
 /**
 * Wallet-metadata sync over kind-30078 addressable events: one NIP-44-encrypted document per
-* wallet, authored by its group-0 derived key. Pull always precedes publish in an unlock session —
-* replaceable events would otherwise let a stale local tree overwrite a newer remote document.
-* Debounced publishes are per wallet; a generation counter cancels in-flight write-backs on lock.
+* wallet, authored by its dedicated sync key (WD-070). Pull always precedes publish in an unlock
+* session — replaceable events would otherwise let a stale local tree overwrite a newer remote
+* document. Debounced publishes are per wallet; a generation counter cancels in-flight write-backs
+* on lock.
 */
 var MetaSyncController = class extends Controller {
 	options;
@@ -2184,6 +4060,7 @@ var MetaSyncController = class extends Controller {
 	timers = /* @__PURE__ */ new Map();
 	inflight = /* @__PURE__ */ new Set();
 	accountsUnsubscribe;
+	addressBookUnsubscribe;
 	constructor(options) {
 		super({
 			name: "metaSync",
@@ -2197,6 +4074,9 @@ var MetaSyncController = class extends Controller {
 		this.accountsUnsubscribe = this.options.accounts.store.subscribe(() => {
 			this.onTreeChange();
 		});
+		this.addressBookUnsubscribe = this.options.addressBook.store.subscribe(() => {
+			this.onTreeChange();
+		});
 		await this.pullAll(gen);
 	}
 	async destroy() {
@@ -2207,6 +4087,8 @@ var MetaSyncController = class extends Controller {
 		this.generation += 1;
 		this.accountsUnsubscribe?.();
 		this.accountsUnsubscribe = void 0;
+		this.addressBookUnsubscribe?.();
+		this.addressBookUnsubscribe = void 0;
 		for (const timer of this.timers.values()) clearTimeout(timer);
 		this.timers.clear();
 		this.pulled.clear();
@@ -2239,19 +4121,6 @@ var MetaSyncController = class extends Controller {
 		const snap = this.options.wallet.getSnapshot();
 		await Promise.all(snap.wallets.map(async (w) => this.pullOne(w.walletId, gen)));
 	}
-	async pubkeyFor(signer) {
-		return signer.getPublicKey();
-	}
-	signerFor(walletId) {
-		const snap = this.options.wallet.getSnapshot();
-		const ref = {
-			kind: "derived",
-			walletId,
-			groupIndex: 0
-		};
-		if (!snap.nostr.keys.some((k) => k.ref.kind === "derived" && k.ref.walletId === walletId && k.ref.groupIndex === 0)) return;
-		return this.options.nostr.signer(ref);
-	}
 	setStatus(walletId, status) {
 		this.update((s) => ({
 			...s,
@@ -2264,15 +4133,11 @@ var MetaSyncController = class extends Controller {
 	async pullOne(walletId, gen) {
 		const config = this.options.metaSync;
 		if (config === void 0 || this.inflight.has(walletId)) return;
-		const signer = this.signerFor(walletId);
-		if (signer === void 0) {
-			if (gen === this.generation) this.setStatus(walletId, { status: "unavailable" });
-			return;
-		}
+		const signer = this.options.nostr.syncSigner(walletId);
 		this.inflight.add(walletId);
 		this.setStatus(walletId, { status: "syncing" });
 		try {
-			const pubkey = await this.pubkeyFor(signer);
+			const pubkey = await signer.getPublicKey();
 			const events = await config.relays.fetch(this.filterFor(pubkey, config.tag));
 			let remote;
 			let remoteSkipped = 0;
@@ -2284,16 +4149,15 @@ var MetaSyncController = class extends Controller {
 				if (remote === void 0 || e.created_at > remote.created_at) remote = e;
 			}
 			if (remote === void 0) {
-				const local = this.options.accounts.exportMeta(walletId);
-				const hasEdits = local.wallet.updatedAt > 0 || local.groups.some((g) => g.updatedAt > 0);
+				const local = this.exportDoc(walletId);
+				const hasEdits = local.wallet.updatedAt > 0 || local.groups.some((g) => g.updatedAt > 0) || local.contacts.length > 0;
 				if (gen !== this.generation) return;
 				this.pulled.add(walletId);
 				this.rememberExport(walletId);
 				this.setStatus(walletId, { status: "synced" });
 				if (hasEdits) await this.publishNow(walletId, gen);
 			} else {
-				const decrypt = signer.nip44Decrypt;
-				const plaintext = decrypt === void 0 ? void 0 : await decrypt.call(signer, pubkey, remote.content).catch(() => void 0);
+				const plaintext = await signer.decrypt(remote.content).catch(() => void 0);
 				const doc = plaintext === void 0 ? void 0 : decodeMetaDocBytes(new TextEncoder().encode(plaintext));
 				if (doc === void 0) {
 					if (gen !== this.generation) return;
@@ -2306,12 +4170,13 @@ var MetaSyncController = class extends Controller {
 					return;
 				}
 				const merge = this.options.accounts.mergeMeta(walletId, doc);
+				const contacts = await this.options.addressBook.merge(doc.contacts);
 				if (gen !== this.generation) return;
 				this.lastRemoteCreatedAt.set(walletId, remote.created_at);
 				this.pulled.add(walletId);
 				this.rememberExport(walletId);
 				this.setStatus(walletId, { status: "synced" });
-				if (merge.localNewer) await this.publishNow(walletId, gen);
+				if (merge.localNewer || contacts.localNewer) await this.publishNow(walletId, gen);
 			}
 			if (remoteSkipped > 0) this.options.logger.warn(`meta sync: ignored ${remoteSkipped} invalid remote events`);
 		} catch (error) {
@@ -2326,6 +4191,14 @@ var MetaSyncController = class extends Controller {
 			this.inflight.delete(walletId);
 		}
 	}
+	/** The wallet's tree plus the shared address book — every wallet's document carries both. */
+	exportDoc(walletId) {
+		return {
+			v: 2,
+			...this.options.accounts.exportMeta(walletId),
+			contacts: this.options.addressBook.syncEntries()
+		};
+	}
 	filterFor(pubkey, tag) {
 		return {
 			kinds: [META_SYNC_KIND],
@@ -2341,8 +4214,7 @@ var MetaSyncController = class extends Controller {
 	/** Snapshot the wallet's exported doc — the debounce publishes only on a real change. */
 	rememberExport(walletId) {
 		try {
-			const doc = this.options.accounts.exportMeta(walletId);
-			this.lastExported.set(walletId, JSON.stringify(doc));
+			this.lastExported.set(walletId, JSON.stringify(this.exportDoc(walletId)));
 		} catch {}
 	}
 	onTreeChange() {
@@ -2350,7 +4222,7 @@ var MetaSyncController = class extends Controller {
 		for (const walletId of this.pulled) {
 			let current;
 			try {
-				current = JSON.stringify(this.options.accounts.exportMeta(walletId));
+				current = JSON.stringify(this.exportDoc(walletId));
 			} catch {
 				continue;
 			}
@@ -2368,18 +4240,12 @@ var MetaSyncController = class extends Controller {
 	async publishNow(walletId, gen) {
 		const config = this.options.metaSync;
 		if (config === void 0 || !this.pulled.has(walletId)) return;
-		const signer = this.signerFor(walletId);
-		if (signer === void 0) {
-			this.setStatus(walletId, { status: "unavailable" });
-			return;
-		}
+		const signer = this.options.nostr.syncSigner(walletId);
 		try {
-			const bytes = encodeMetaDoc(this.options.accounts.exportMeta(walletId));
+			const bytes = encodeMetaDoc(this.exportDoc(walletId));
 			if (bytes === void 0) throw new MetaSyncError("internal", "meta doc exceeds 64 KB");
-			const encrypt = signer.nip44Encrypt;
-			if (encrypt === void 0) throw new MetaSyncError("internal", "signer lacks nip44 encryption");
-			const pubkey = await this.pubkeyFor(signer);
-			const content = await encrypt.call(signer, pubkey, new TextDecoder().decode(bytes));
+			const pubkey = await signer.getPublicKey();
+			const content = await signer.encrypt(new TextDecoder().decode(bytes));
 			const lastRemote = this.lastRemoteCreatedAt.get(walletId) ?? 0;
 			const created_at = Math.max(Math.floor(this.options.now() / 1e3), lastRemote + 1);
 			const event = await signer.signEvent({
@@ -2405,17 +4271,16 @@ var MetaSyncController = class extends Controller {
 function categorizeSync(error) {
 	return error instanceof MetaSyncError ? error.category : "network";
 }
-/** A decrypted doc that parses as JSON with a numeric `v` above 1 is a newer schema, not garbage. */
+/** A decrypted doc that parses as JSON with a numeric `v` above 2 is a newer schema, not garbage. */
 function isUnsupportedDoc(plaintext) {
 	try {
 		const doc = JSON.parse(plaintext);
-		return typeof doc === "object" && doc !== null && "v" in doc && typeof doc.v === "number" && doc.v > 1;
+		return typeof doc === "object" && doc !== null && "v" in doc && typeof doc.v === "number" && doc.v > 2;
 	} catch {
 		return false;
 	}
 }
-//#endregion
-//#region src/chains/bitcoin.ts
+// src/chains/bitcoin.ts
 const DUST = {
 	p2wpkh: 294,
 	p2tr: 330,
@@ -2550,8 +4415,8 @@ var BitcoinChainAdapter = class {
 				entry.nonWitnessUtxo = raw;
 			}
 			if (template === "btc.bip86") {
-				entry.tapInternalKey = pub.subarray(1);
-				entry.tapBip32Derivation = [[pub.subarray(1), {
+				entry.tapInternalKey = pub;
+				entry.tapBip32Derivation = [[pub, {
 					hashes: [],
 					der: {
 						fingerprint,
@@ -2607,104 +4472,7 @@ var BitcoinChainAdapter = class {
 		};
 	}
 };
-//#endregion
-//#region src/networks/registry.ts
-const entry = (chainId, name, symbol, testnet, _source) => ({
-	id: `eip155:${chainId}`,
-	chainId,
-	name,
-	symbol,
-	decimals: 18,
-	testnet,
-	family: "evm",
-	multicall3: "0xcA11bde05977b3631167028862bE2a173976CA11"
-});
-const NETWORKS = [
-	entry(1, "Ethereum", "ETH", false, "https://ethereum.org/en/developers/docs/networks/"),
-	entry(8453, "Base", "ETH", false, "https://docs.base.org/docs/network-information"),
-	entry(42161, "Arbitrum One", "ETH", false, "https://docs.arbitrum.io/for-devs/dev-tools-and-resources/chain-info"),
-	entry(10, "OP Mainnet", "ETH", false, "https://docs.optimism.io/chain/networks"),
-	entry(137, "Polygon", "POL", false, "https://docs.polygon.technology/pos/reference/rpc-endpoints/"),
-	entry(56, "BNB Smart Chain", "BNB", false, "https://docs.bnbchain.org/bnb-smart-chain/developers/json_rpc/"),
-	entry(999, "HyperEVM", "HYPE", false, "https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/hyperevm"),
-	entry(43114, "Avalanche C-Chain", "AVAX", false, "https://build.avax.network/docs/tooling/rpc-providers"),
-	entry(11155111, "Sepolia", "ETH", true, "https://ethereum.org/en/developers/docs/networks/"),
-	entry(84532, "Base Sepolia", "ETH", true, "https://docs.base.org/docs/network-information"),
-	entry(421614, "Arbitrum Sepolia", "ETH", true, "https://docs.arbitrum.io/for-devs/dev-tools-and-resources/chain-info"),
-	entry(11155420, "OP Sepolia", "ETH", true, "https://docs.optimism.io/chain/networks"),
-	entry(80002, "Polygon Amoy", "POL", true, "https://docs.polygon.technology/pos/reference/rpc-endpoints/"),
-	entry(97, "BNB Smart Chain Testnet", "tBNB", true, "https://docs.bnbchain.org/bnb-smart-chain/developers/json_rpc/"),
-	entry(998, "HyperEVM Testnet", "HYPE", true, "https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/hyperevm"),
-	entry(43113, "Avalanche Fuji", "AVAX", true, "https://build.avax.network/docs/tooling/rpc-providers")
-];
-const networkById = (id) => [
-	...NETWORKS,
-	...SOLANA_NETWORKS,
-	...BITCOIN_NETWORKS
-].find((n) => n.id === id);
-const BITCOIN_NETWORKS = [
-	{
-		id: "bip122:000000000019d6689c085ae165831e93",
-		chainId: 0,
-		name: "Bitcoin",
-		symbol: "BTC",
-		decimals: 8,
-		testnet: false,
-		family: "bitcoin",
-		genesisHash: "000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f"
-	},
-	{
-		id: "bip122:00000000da84f2bafbbc53dee25a72ae",
-		chainId: 0,
-		name: "Bitcoin Testnet4",
-		symbol: "tBTC",
-		decimals: 8,
-		testnet: true,
-		family: "bitcoin",
-		genesisHash: "00000000da84f2bafbbc53dee25a72ae507ff4914b867c565be350b0da8bf043"
-	},
-	{
-		id: "bip122:00000008819873e925422c1ff0f99f7c",
-		chainId: 0,
-		name: "Bitcoin Signet",
-		symbol: "sBTC",
-		decimals: 8,
-		testnet: true,
-		family: "bitcoin",
-		genesisHash: "00000008819873e925422c1ff0f99f7cc9bbb232af63a077a480a3633bee1ef6"
-	},
-	{
-		id: "bip122:0f9188f13cb7b2c71f2a335e3a4fc328",
-		chainId: 0,
-		name: "Bitcoin Regtest",
-		symbol: "rBTC",
-		decimals: 8,
-		testnet: true,
-		family: "bitcoin",
-		genesisHash: "0f9188f13cb7b2c71f2a335e3a4fc328bf5beb436012afca590b1a11466e2206"
-	}
-];
-const SOLANA_NETWORKS = [{
-	id: "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
-	chainId: 0,
-	name: "Solana",
-	symbol: "SOL",
-	decimals: 9,
-	testnet: false,
-	family: "solana",
-	genesisHash: "5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpWvDVGok8cUQPCbq9AzdTQvpNbNvyq4qDvMNTrDDezsFapSihepu2eQEdje"
-}, {
-	id: "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1",
-	chainId: 0,
-	name: "Solana Devnet",
-	symbol: "SOL",
-	decimals: 9,
-	testnet: true,
-	family: "solana",
-	genesisHash: "EtWTRABZaYq6iMfeYKouRu166VU2xqa1wcaWoxPkrZBGGSWgX4GwCJRmgdcvRaRmFbXfw3nDZBTqsr"
-}];
-//#endregion
-//#region src/networks/controller.ts
+// src/networks/controller.ts
 /**
 * EVM network controller: the built-in registry plus host-provided and user-added RPC endpoints.
 * Each network gets a lazily-created viem PublicClient on a `fallback` transport — endpoints are
@@ -2715,21 +4483,86 @@ const SOLANA_NETWORKS = [{
 const esploraSleep = async (ms) => new Promise((resolve) => {
 	setTimeout(resolve, ms);
 });
+/** Bound on the unlock-time `/v1/networks` read so a dead gateway cannot stall unlocking. */
+const GATEWAY_PROBE_TIMEOUT_MS = 5e3;
 const isObject$5 = (v) => typeof v === "object" && v !== null;
+const makeClient = (info, urls, fetchFn) => createPublicClient({
+	chain: {
+		id: info.chainId,
+		name: info.name,
+		nativeCurrency: {
+			name: info.symbol,
+			symbol: info.symbol,
+			decimals: info.decimals
+		},
+		rpcUrls: { default: { http: [...urls] } }
+	},
+	transport: fallback(urls.map((url) => http(url, { fetchFn }))),
+	batch: { multicall: true }
+});
+const esploraClient = (urls, fetchFn) => esplora(urls, async (url, init) => {
+	const r = await fetchFn(url, init);
+	return {
+		ok: r.ok,
+		status: r.status,
+		headers: { get: (h) => r.headers.get(h) ?? void 0 },
+		json: async () => r.json(),
+		text: async () => r.text()
+	};
+}, esploraSleep);
+const solanaCaller = (urls, fetchFn) => ({ call: async (method, params) => {
+	const attempt = async (rest, last) => {
+		const [url, ...next] = rest;
+		if (url === void 0) throw last instanceof Error ? last : new Error(typeof last === "string" ? last : method);
+		try {
+			const body = await (await fetchFn(url, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					jsonrpc: "2.0",
+					id: 1,
+					method,
+					params
+				})
+			})).json();
+			if (!isObject$5(body)) return await attempt(next, /* @__PURE__ */ new Error(`malformed response from ${url}`));
+			if (body["error"] !== void 0) {
+				const msg = isObject$5(body["error"]) ? body["error"]["message"] : void 0;
+				return await attempt(next, new Error(typeof msg === "string" ? msg : method));
+			}
+			return body["result"];
+		} catch (error) {
+			return attempt(next, error);
+		}
+	};
+	return attempt(urls, void 0);
+} });
 var NetworkController = class extends Controller {
 	options;
 	engineStore;
 	clients = /* @__PURE__ */ new Map();
+	gatewayBase;
+	gatewayOrigin;
+	/** Networks the gateway reported at unlock; empty while locked or when the read failed. */
+	gatewayServed = /* @__PURE__ */ new Set();
 	constructor(options) {
 		super({
 			name: "networks",
 			defaultState: () => ({ customRpc: {} })
 		});
 		this.options = options;
+		if (options.gateway !== void 0) {
+			this.gatewayBase = options.gateway.url.replace(/\/+$/, "");
+			this.gatewayOrigin = new URL(options.gateway.url).origin;
+		}
 	}
 	async init() {
 		this.engineStore = await this.options.openStore();
-		const raw = await this.engineStore.collection("networks").get("customRpc");
+		await this.loadCustomRpc(this.engineStore);
+		await this.loadGatewayNetworks();
+	}
+	async loadCustomRpc(store) {
+		const raw = await store.collection("networks").get("customRpc");
 		if (raw === void 0) return;
 		const parsed = JSON.parse(new TextDecoder().decode(raw));
 		if (typeof parsed === "object" && parsed !== null) {
@@ -2741,16 +4574,56 @@ var NetworkController = class extends Controller {
 			}));
 		}
 	}
+	/** Reads the gateway's served networks; any failure leaves the gateway unused until next unlock. */
+	async loadGatewayNetworks() {
+		if (this.gatewayBase === void 0) return;
+		const url = `${this.gatewayBase}${networksPath}`;
+		try {
+			const res = await this.gatewayFetch(url, { signal: AbortSignal.timeout(GATEWAY_PROBE_TIMEOUT_MS) });
+			if (!res.ok) throw new Error(`status ${res.status}`);
+			const body = await res.json();
+			const served = parseWith(servedNetworksResponse, body);
+			if (served === void 0) throw new Error("malformed response");
+			this.gatewayServed = new Set(served.networks);
+		} catch {
+			this.gatewayServed = /* @__PURE__ */ new Set();
+			this.options.logger.warn(`gateway unavailable, not used for this session: ${url}`);
+		}
+	}
+	/** `fetch` that adds the install id to requests bound for the gateway's origin only. */
+	gatewayFetch = async (input, init) => {
+		const { gateway } = this.options;
+		const target = input instanceof Request ? input.url : String(input);
+		if (gateway === void 0 || new URL(target).origin !== this.gatewayOrigin) return this.options.fetch(input, init);
+		const headers = new Headers(init?.headers);
+		headers.set(INSTALL_ID_HEADER, gateway.installId);
+		return this.options.fetch(input, {
+			...init,
+			headers
+		});
+	};
 	async destroy() {
 		this.lock();
 		await Promise.resolve();
 	}
 	lock() {
+		this.gatewayServed = /* @__PURE__ */ new Set();
 		this.clients.clear();
 		this.engineStore = void 0;
 	}
+	/**
+	* Ordered endpoints: a network with custom endpoints uses custom → host and never the gateway;
+	* otherwise a gateway-served network uses gateway → host; else host only.
+	*/
 	endpoints(network) {
-		return [...this.getState().customRpc[network] ?? [], ...this.options.rpc[network] ?? []];
+		const custom = this.getState().customRpc[network] ?? [];
+		const host = this.options.rpc[network] ?? [];
+		if (custom.length > 0) return [...custom, ...host];
+		if (this.gatewayBase !== void 0 && this.gatewayServed.has(network)) {
+			const path = networkById(network)?.family === "bitcoin" ? esploraBasePath(network) : rpcPath(network);
+			return [`${this.gatewayBase}${path}`, ...host];
+		}
+		return host;
 	}
 	info(network) {
 		const info = networkById(network);
@@ -2763,78 +4636,56 @@ var NetworkController = class extends Controller {
 		if (cached !== void 0) return cached;
 		const urls = this.endpoints(network);
 		if (urls.length === 0) throw new Error(`no rpc endpoint for ${network}`);
-		const client = createPublicClient({
-			chain: {
-				id: info.chainId,
-				name: info.name,
-				nativeCurrency: {
-					name: info.symbol,
-					symbol: info.symbol,
-					decimals: info.decimals
-				},
-				rpcUrls: { default: { http: urls } }
-			},
-			transport: fallback(urls.map((url) => http(url, { fetchFn: this.options.fetch }))),
-			batch: { multicall: true }
-		});
+		const client = makeClient(info, urls, this.gatewayFetch);
 		this.clients.set(network, client);
 		return client;
 	}
-	/** Validate a custom endpoint's reported chain id, then persist it first in the list. */
-	/** Solana JSON-RPC over the ordered endpoint list — kit's transport is single-endpoint. */
-	/** Networks with at least one configured endpoint, filtered by family. */
+	/** True when the gateway heads this network's endpoint list (no custom endpoints, gateway-served). */
+	gatewayFirst(network) {
+		return (this.getState().customRpc[network] ?? []).length === 0 && this.gatewayBase !== void 0 && this.gatewayServed.has(network);
+	}
+	independent(network, make) {
+		if (!this.gatewayFirst(network)) return { kind: "not-needed" };
+		const hosts = this.options.rpc[network] ?? [];
+		return hosts.length === 0 ? { kind: "unavailable" } : {
+			kind: "available",
+			client: make(hosts)
+		};
+	}
+	/** Host-endpoint EVM client for cross-checking reads; never sends the install id. */
+	independentClient(network) {
+		return this.independent(network, (hosts) => makeClient(this.info(network), hosts, this.options.fetch));
+	}
+	independentSolanaRpc(network) {
+		return this.independent(network, (hosts) => solanaCaller(hosts, this.options.fetch));
+	}
+	independentEsplora(network) {
+		return this.independent(network, (hosts) => esploraClient(hosts, this.options.fetch));
+	}
+	/** Networks with at least one configured endpoint or served by the gateway, by family. */
 	enabled(family) {
-		return [.../* @__PURE__ */ new Set([...Object.keys(this.options.rpc), ...Object.keys(this.getState().customRpc)])].filter((id) => {
+		return [.../* @__PURE__ */ new Set([
+			...Object.keys(this.options.rpc),
+			...Object.keys(this.getState().customRpc),
+			...this.gatewayServed
+		])].filter((id) => {
 			const info = networkById(id);
 			return info !== void 0 && info.family === family;
 		});
 	}
+	/** Solana JSON-RPC over the ordered endpoint list — kit's transport is single-endpoint. */
 	solanaRpc(network) {
 		const urls = this.endpoints(network);
 		if (urls.length === 0) throw new Error(`no rpc endpoint for ${network}`);
-		return { call: async (method, params) => {
-			const attempt = async (rest, last) => {
-				const [url, ...next] = rest;
-				if (url === void 0) throw last instanceof Error ? last : new Error(typeof last === "string" ? last : method);
-				try {
-					const body = await (await this.options.fetch(url, {
-						method: "POST",
-						headers: { "content-type": "application/json" },
-						body: JSON.stringify({
-							jsonrpc: "2.0",
-							id: 1,
-							method,
-							params
-						})
-					})).json();
-					if (!isObject$5(body)) return await attempt(next, /* @__PURE__ */ new Error(`malformed response from ${url}`));
-					if (body["error"] !== void 0) {
-						const msg = isObject$5(body["error"]) ? body["error"]["message"] : void 0;
-						return await attempt(next, new Error(typeof msg === "string" ? msg : method));
-					}
-					return body["result"];
-				} catch (error) {
-					return attempt(next, error);
-				}
-			};
-			return attempt(urls, void 0);
-		} };
+		return solanaCaller(urls, this.gatewayFetch);
 	}
 	/** Bounded-concurrency + 429-aware ordered-failover Esplora client. */
 	esplora(network) {
 		const urls = this.endpoints(network);
 		if (urls.length === 0) throw new Error(`no esplora endpoint for ${network}`);
-		return esplora(urls, async (url, init) => {
-			const r = await this.options.fetch(url, init);
-			return {
-				ok: r.ok,
-				status: r.status,
-				headers: { get: (h) => r.headers.get(h) ?? void 0 },
-				json: async () => r.json(),
-				text: async () => r.text()
-			};
-		}, esploraSleep);
+		return esploraClient(urls, this.gatewayFetch);
 	}
+	/** Validate a custom endpoint's reported chain id, then persist it first in the list. */
 	async addRpc(network, url) {
 		const info = this.info(network);
 		if (info.family === "bitcoin") {
@@ -2894,8 +4745,7 @@ var NetworkController = class extends Controller {
 		if (store !== void 0) await store.collection("networks").put("customRpc", new TextEncoder().encode(JSON.stringify(customRpc)));
 	}
 };
-//#endregion
-//#region src/payments/parse.ts
+// src/payments/parse.ts
 /** Invoices with less than this much life left are treated as already expired. */
 const BOLT11_EXPIRY_GRACE_MS = 6e4;
 const invalid = (reason) => ({
@@ -3165,158 +5015,7 @@ function parsePayment(input, options) {
 		return invalid("malformed");
 	}
 }
-//#endregion
-//#region src/spark/errors.ts
-var SparkControllerError = class extends Error {
-	category;
-	constructor(category, message, cause) {
-		super(message, { cause });
-		this.name = "SparkControllerError";
-		this.category = category;
-	}
-};
-/** Maps a thrown client/kernel error into a category without leaking payloads. */
-function categorize(error) {
-	const name = error instanceof Error ? error.name : "";
-	const message = error instanceof Error ? error.message : "";
-	if (/approval|denied|rejected/i.test(message)) return /required/i.test(message) ? "approval-required" : "rejected";
-	if (/insufficient|not enough|balance/i.test(message)) return "insufficient-funds";
-	if (name === "SparkRequestError" || /fetch|network|timeout|unavailable|closed/i.test(message)) return "network";
-	return "internal";
-}
-//#endregion
-//#region src/payments/errors.ts
-var PaymentError = class extends Error {
-	category;
-	constructor(category, message, cause) {
-		super(message, { cause });
-		this.name = "PaymentError";
-		this.category = category;
-	}
-};
-//#endregion
-//#region src/payments/pay.ts
-/**
-* Executes one parsed payment option. Every input validation happens before the approval round — a
-* `PaymentError` here never consumed a verification. `SparkControllerError` and `WalletError` pass
-* through untouched.
-*/
-async function pay(context, params) {
-	const { spark } = context;
-	const ref = params.account;
-	let result;
-	switch (params.option.kind) {
-		case "spark":
-			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "spark payment: amountSats is required");
-			result = {
-				kind: "spark",
-				transfer: await spark.send(ref, {
-					receiver: params.option.address,
-					amountSats: params.amountSats,
-					verify: params.verify
-				})
-			};
-			break;
-		case "spark-invoice": {
-			if (params.option.expiresAt !== void 0 && params.option.expiresAt <= context.now()) throw new PaymentError("rejected", "spark invoice expired");
-			if (params.option.amountSats !== void 0 && params.amountSats !== void 0 && params.amountSats !== params.option.amountSats) throw new PaymentError("invalid-input", "spark invoice: amountSats conflicts with the invoice amount");
-			const invoiceAmount = params.option.amountSats === void 0 ? params.amountSats : void 0;
-			result = {
-				kind: "spark",
-				transfer: await spark.paySparkInvoice(ref, {
-					invoice: params.option.invoice,
-					...invoiceAmount === void 0 ? {} : { amountSats: invoiceAmount },
-					verify: params.verify
-				})
-			};
-			break;
-		}
-		case "lightning":
-			if (params.option.amountSats === void 0 && params.amountSats === void 0) throw new PaymentError("invalid-input", "amountless invoice: amountSats is required");
-			if (params.maxFeeSats === void 0) throw new PaymentError("invalid-input", "lightning payment: maxFeeSats is required");
-			if (params.option.expiresAt <= context.now() + 6e4) throw new PaymentError("rejected", "lightning invoice expired");
-			if (params.option.amountSats !== void 0 && params.amountSats !== void 0 && params.amountSats !== params.option.amountSats) throw new PaymentError("invalid-input", "amountSats conflicts with the invoice amount");
-			result = {
-				kind: "lightning",
-				payment: await spark.payInvoice(ref, {
-					invoice: params.option.invoice,
-					maxFeeSats: params.maxFeeSats,
-					...params.option.amountSats === void 0 && params.amountSats !== void 0 ? { amountSats: params.amountSats } : {},
-					verify: params.verify
-				})
-			};
-			break;
-		case "lnurl-pay": {
-			const { request } = params.option;
-			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "lnurl-pay: amountSats is required");
-			if (params.maxFeeSats === void 0) throw new PaymentError("invalid-input", "lnurl-pay: maxFeeSats is required");
-			const amountMsat = params.amountSats * 1e3;
-			if (amountMsat < request.minSendableMsat || amountMsat > request.maxSendableMsat) throw new PaymentError("rejected", "lnurl-pay: amount outside the service's range");
-			if (request.commentAllowed === 0 && params.comment !== void 0) throw new PaymentError("rejected", "lnurl-pay: comments not accepted by this service");
-			if (params.comment !== void 0 && params.comment.length > request.commentAllowed) throw new PaymentError("rejected", "lnurl-pay: comment exceeds the service's limit");
-			let requested;
-			try {
-				requested = await requestInvoice(request, {
-					fetch: context.fetch,
-					network: ref.network,
-					amountMsat,
-					...params.comment === void 0 ? {} : { comment: params.comment }
-				});
-			} catch (error) {
-				if (error instanceof PaymentError || error instanceof SparkControllerError) throw error;
-				throw new PaymentError("network", "lnurl-pay: invoice request failed", error);
-			}
-			result = {
-				kind: "lightning",
-				payment: await spark.payInvoice(ref, {
-					invoice: requested.invoice,
-					maxFeeSats: params.maxFeeSats,
-					verify: params.verify
-				})
-			};
-			break;
-		}
-		case "lnurl-withdraw": {
-			const { request } = params.option;
-			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "lnurl-withdraw: amountSats is required");
-			const amountMsat = params.amountSats * 1e3;
-			if (amountMsat < request.minWithdrawableMsat || amountMsat > request.maxWithdrawableMsat) throw new PaymentError("rejected", "lnurl-withdraw: amount outside the service's range");
-			const invoice = await spark.createInvoice(ref, {
-				amountSats: params.amountSats,
-				memo: request.defaultDescription
-			});
-			try {
-				await submitWithdraw(request, {
-					fetch: context.fetch,
-					invoice: invoice.invoice
-				});
-			} catch (error) {
-				if (error instanceof PaymentError || error instanceof SparkControllerError) throw error;
-				throw new PaymentError("network", "lnurl-withdraw: submission failed", error);
-			}
-			result = {
-				kind: "lnurl-withdraw",
-				invoice
-			};
-			break;
-		}
-		case "bitcoin":
-			if (params.amountSats === void 0) throw new PaymentError("invalid-input", "bitcoin payment: amountSats is required");
-			result = {
-				kind: "withdraw",
-				exit: await spark.withdraw(ref, {
-					address: params.option.address,
-					speed: params.speed ?? "MEDIUM",
-					verify: params.verify,
-					amountSats: params.amountSats,
-					...params.maxFeeSats === void 0 ? {} : { maxFeeSats: params.maxFeeSats }
-				})
-			};
-	}
-	return result;
-}
-//#endregion
-//#region src/payments/resolve.ts
+// src/payments/resolve.ts
 /**
 * `parsePayment` plus LNURL dereferencing: an `lnurl` result is fetched and turned into a concrete
 * `lnurl-pay` / `lnurl-withdraw` request (`tag=login` endpoints report as unsupported). Network
@@ -3351,93 +5050,7 @@ async function resolvePayment(input, options) {
 		format: "lnurl-auth"
 	};
 }
-//#endregion
-//#region src/payments/zap.ts
-/** Everything up to payment: resolve LNURL, sign the 9734, request the invoice. */
-async function prepareZap(params, context) {
-	const amountMsat = params.amountSats * 1e3;
-	if (!Number.isSafeInteger(params.amountSats) || params.amountSats <= 0 || !Number.isSafeInteger(amountMsat)) throw new PaymentError("invalid-input", "zap amount is not a positive safe integer");
-	try {
-		const resolved = await resolveLnurl(params.recipient.lightning, { fetch: context.fetch });
-		if (resolved.tag !== "payRequest") throw new PaymentError("rejected", "recipient is not an LNURL-pay endpoint");
-		if (!resolved.allowsNostr || resolved.nostrPubkey === void 0) throw new PaymentError("rejected", "LNURL service does not accept nostr zaps");
-		if (amountMsat < resolved.minSendableMsat || amountMsat > resolved.maxSendableMsat) throw new PaymentError("rejected", "zap amount outside the service's bounds");
-		if (params.comment !== void 0) {
-			if (resolved.commentAllowed === 0) throw new PaymentError("rejected", "the service does not accept comments");
-			if (params.comment.length > resolved.commentAllowed) throw new PaymentError("rejected", "comment exceeds the service's limit");
-		}
-		const lnurl = params.recipient.lightning.toLowerCase().startsWith("lnurl1") ? params.recipient.lightning.toLowerCase() : encodeLnurl(lightningAddressUrl(params.recipient.lightning));
-		const base = {
-			amount: amountMsat,
-			relays: [...params.relays],
-			comment: params.comment,
-			lnurl
-		};
-		const unsigned = {
-			..."event" in params.recipient ? makeZapRequest({
-				event: params.recipient.event,
-				...base
-			}) : makeZapRequest({
-				pubkey: params.recipient.pubkey,
-				...base
-			}),
-			pubkey: await params.signer.getPublicKey()
-		};
-		const zapRequest = await params.signer.signEvent(unsigned);
-		if (!verifyEvent(zapRequest) || !signedMatchesUnsigned(zapRequest, unsigned)) throw new PaymentError("rejected", "signer returned a zap request that does not match");
-		const { invoice } = await requestInvoice(resolved, {
-			fetch: context.fetch,
-			network: params.network,
-			amountMsat,
-			...params.comment === void 0 ? {} : { comment: params.comment },
-			zapRequest: JSON.stringify(zapRequest)
-		});
-		const decoded = decodeBolt11(invoice);
-		const expiresAt = (decoded.timestamp + decoded.expirySeconds) * 1e3;
-		if (expiresAt <= context.now() + 6e4) throw new PaymentError("rejected", "zap invoice expires too soon");
-		const eventId = "event" in params.recipient ? params.recipient.event.id : void 0;
-		return {
-			zapRequest,
-			invoice,
-			paymentHash: bytesToHex(decoded.paymentHash),
-			expiresAt,
-			amountSats: params.amountSats,
-			receiptPubkey: bytesToHex(resolved.nostrPubkey),
-			recipientPubkey: "event" in params.recipient ? params.recipient.event.pubkey : params.recipient.pubkey,
-			...eventId === void 0 ? {} : { eventId },
-			...params.comment === void 0 ? {} : { comment: params.comment },
-			lightning: params.recipient.lightning
-		};
-	} catch (error) {
-		if (error instanceof PaymentError) throw error;
-		if (error instanceof SparkInputError || error instanceof Error && error.cause instanceof SparkInputError) throw new PaymentError("rejected", "zap failed invoice validation");
-		throw new PaymentError(categorizePayment(error), "zap failed");
-	}
-}
-/**
-* Pays a prepared zap through the controller's approve-first path. A nearly-expired invoice is
-* rejected before approval — the user may have sat on the confirm screen since `prepareZap`.
-*/
-async function payZap(spark, account, prepared, options) {
-	if (prepared.expiresAt <= options.now() + 6e4) throw new PaymentError("rejected", "zap invoice expired");
-	return spark.payInvoice(account, {
-		invoice: prepared.invoice,
-		maxFeeSats: options.maxFeeSats,
-		verify: options.verify,
-		note: {
-			kind: "zap",
-			recipientPubkey: prepared.recipientPubkey,
-			...prepared.eventId === void 0 ? {} : { eventId: prepared.eventId },
-			...prepared.comment === void 0 ? {} : { comment: prepared.comment },
-			lightning: prepared.lightning
-		}
-	});
-}
-function categorizePayment(error) {
-	return categorize(error) === "network" ? "network" : "rejected";
-}
-//#endregion
-//#region src/spark/notes.ts
+// src/spark/notes.ts
 const HEX64 = /^[0-9a-f]{64}$/;
 const isObject$4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 const NOTE_FIELDS = /* @__PURE__ */ new Set([
@@ -3468,8 +5081,7 @@ function parsePaymentNote(value) {
 function encodePaymentNote(note) {
 	return new TextEncoder().encode(JSON.stringify(note));
 }
-//#endregion
-//#region src/spark/exit-chain-codec.ts
+// src/spark/exit-chain-codec.ts
 /**
 * SparkExitChain persistence codec: JSON with Uint8Arrays tagged `{ $b64: "…" }` — small and
 * explicit rather than schema-bound, so upstream field additions survive a round-trip.
@@ -3496,8 +5108,7 @@ function encodeExitChain(chain) {
 function decodeExitChain(bytes) {
 	return decodeValue(JSON.parse(new TextDecoder().decode(bytes)));
 }
-//#endregion
-//#region src/spark/store.ts
+// src/spark/store.ts
 const ALL = "__all__";
 /**
 * SparkStore over one EngineCollection: chains keyed by leafId, plus an index record listing them
@@ -3541,8 +5152,7 @@ function sparkStore(col) {
 		}
 	};
 }
-//#endregion
-//#region src/spark/controller.ts
+// src/spark/controller.ts
 const key = (ref) => `${ref.walletId}:${ref.groupIndex}:${ref.network}`;
 /** TransferId: the client and SO expect a UUIDv7 — mint it from the injected clock+random. */
 const transferId = (random, now) => uuidv7(random, now);
@@ -3959,6 +5569,14 @@ var SparkController = class extends Controller {
 			...params.memo === void 0 ? {} : { memo: params.memo }
 		}));
 	}
+	/** A fresh single-use L1 deposit address (with the SO's proof of possession). */
+	async newDepositAddress(ref) {
+		return this.guarded(async () => this.clientFor(ref).deposits.newAddress());
+	}
+	/** Claims a confirmed L1 deposit paying one of the account's unused deposit addresses. */
+	async claimDeposit(ref, transaction) {
+		await this.guarded(async () => this.clientFor(ref).deposits.claim({ transaction }));
+	}
 	async receiveAddress(ref) {
 		const state = this.getState().accounts[key(ref)];
 		await Promise.resolve();
@@ -4006,10 +5624,77 @@ var SparkController = class extends Controller {
 		});
 	}
 };
-//#endregion
-//#region src/transactions/bitcoin.ts
+// src/spark/deposit-claim.ts
+/**
+* Claims Spark deposits: once a transaction tagged `sparkDeposit` is confirmed, its raw bytes are
+* read from Esplora and handed to the Spark account's `deposits.claim`. Claiming too early (the SO
+* wants enough confirmations) just fails and is retried with backoff; locking stops everything.
+* Works only from the transaction state, so a restart resumes whatever is confirmed and unclaimed.
+*/
+const pending = (tx) => tx.sparkDeposit !== void 0 && tx.state === "confirmed" && tx.sparkDeposit.claimed !== true;
+var DepositClaimer = class {
+	options;
+	active = /* @__PURE__ */ new Map();
+	unsubscribe;
+	constructor(options) {
+		this.options = options;
+	}
+	/** Starts watching; every confirmed, unclaimed deposit already in the state is picked up. */
+	start() {
+		this.stop();
+		this.unsubscribe = this.options.transactions.store.subscribe(() => {
+			this.scan();
+		});
+		this.scan();
+	}
+	stop() {
+		this.unsubscribe?.();
+		this.unsubscribe = void 0;
+		for (const abort of this.active.values()) abort.abort();
+		this.active.clear();
+	}
+	scan() {
+		for (const tx of Object.values(this.options.transactions.getState().txs)) if (pending(tx) && !this.active.has(tx.id)) {
+			const abort = new AbortController();
+			this.active.set(tx.id, abort);
+			this.claim(tx.id, abort.signal);
+		}
+	}
+	async claim(id, signal) {
+		for (let failures = 0; !signal.aborted; failures += 1) {
+			const tx = this.options.transactions.getState().txs[id];
+			if (tx === void 0 || !pending(tx) || tx.sparkDeposit === void 0) break;
+			const { walletId, groupIndex, network: sparkNetwork } = tx.sparkDeposit;
+			try {
+				if (tx.hash === void 0) throw new Error("the deposit has no transaction id");
+				const raw = await this.options.networks.esplora(tx.network).get(`/tx/${tx.hash}/hex`);
+				if (typeof raw !== "string") throw new TypeError("esplora returned a malformed transaction");
+				await this.options.spark.claimDeposit({
+					walletId,
+					groupIndex,
+					network: sparkNetwork
+				}, hex.decode(raw.trim()));
+				if (signal.aborted) break;
+				await this.options.transactions.markDepositClaimed(id);
+				break;
+			} catch (error) {
+				this.options.logger.warn(`spark deposit ${id} not claimed yet`, error);
+				await eventsBackoff(failures, signal);
+			}
+		}
+		if (this.active.get(id)?.signal === signal) this.active.delete(id);
+	}
+};
+// src/transactions/bitcoin.ts
 /** Bitcoin route: scan → coin-select → PSBT → sign → broadcast, plus esplora status poll. */
 const isObject$3 = (v) => typeof v === "object" && v !== null;
+const broadcastPsbt = async (es, result) => {
+	if (result.kind !== "bitcoin.psbt" || !(result.signedPsbt instanceof Uint8Array)) throw new Error("unexpected bitcoin sign result");
+	const signed = Transaction.fromPSBT(result.signedPsbt);
+	signed.finalize();
+	const raw = signed.extract();
+	return String(await es.post("/tx", hex.encode(raw)));
+};
 const fetchRawTxes = async (es, utxos) => {
 	const out = /* @__PURE__ */ new Map();
 	await Promise.all(utxos.map(async (u) => {
@@ -4033,15 +5718,49 @@ const poll = async (ctx, tx) => {
 	if (!(isObject$3(status) && status["confirmed"] === true)) return;
 	return "confirmed";
 };
+const nextReceiveAddress = async (ctx, walletId, groupIndex, network) => {
+	const account = await (ctx.options.chains ?? chains(ctx.options.wallet)).account({
+		walletId,
+		groupIndex,
+		template: "btc.bip84",
+		network
+	});
+	if (!("xpub" in account) || account.xpub === void 0) throw new Error("bitcoin account carries no xpub");
+	const receive = await scanChain(ctx.options.networks.esplora(network), account.xpub, "btc.bip84", network, bitcoinNetwork(network).params, 0);
+	const next = new BitcoinScanStore().nextUnused({
+		addresses: receive,
+		utxos: [],
+		scannedAt: ctx.options.now()
+	}, 0);
+	if (next === void 0) throw new Error("no unused receive address");
+	return next.address;
+};
 /** Per-controller route — the UTXO store and the build stash are engine state. */
 const createBitcoinRoute = () => {
 	const bitcoin = new BitcoinChainAdapter();
 	const bitcoinUtxos = new BtcUtxoStore();
 	const pending = /* @__PURE__ */ new Map();
-	const send = async (ctx, params) => {
-		const { account, network, to, amount, fee, verify } = params;
+	/**
+	* Outputs held by a request that has not been broadcast yet ("txid:vout" → request id). Memory
+	* only: the request queue is not persisted, so a crash must not leave anything locked. The
+	* persistent lock (keyed by tx id) is written only once a broadcast succeeds.
+	*/
+	const reserved = /* @__PURE__ */ new Map();
+	const isHeld = (key) => {
+		const [txid = "", vout = "0"] = key.split(":");
+		return reserved.has(key) || bitcoinUtxos.isLocked({
+			txid,
+			vout: Number(vout)
+		});
+	};
+	const releaseReservation = (requestId) => {
+		for (const [key, holder] of reserved) if (holder === requestId) reserved.delete(key);
+	};
+	const prepare = async (ctx, params, requestId, sparkDeposit) => {
+		const { account, network, to, amount, fee } = params;
 		if (account.kind !== "hd") throw new Error("imported accounts are not yet supported");
 		const es = ctx.options.networks.esplora(network);
+		const independent = ctx.options.networks.independentEsplora(network);
 		const apis = ctx.options.chains ?? chains(ctx.options.wallet);
 		const template = [
 			"btc.bip44",
@@ -4103,9 +5822,25 @@ const createBitcoinRoute = () => {
 		const quotes = await feeTiers(es);
 		const quote = quotes.find((q) => q.tier === (fee === "fast" ? "fast" : fee === "slow" ? "slow" : "normal")) ?? quotes[1];
 		if (quote === void 0) throw new Error("no fee quote");
-		const { psbt, inputs: selected } = bitcoin.buildPsbt(inputs, to, amount, BigInt(quote.satPerByte), changeAddr, net.params);
+		const flags = [independent.kind === "unavailable" ? "reads-unverified" : void 0];
+		let rate = quote.satPerByte;
+		let independentRate;
+		if (independent.kind === "available") try {
+			independentRate = (await feeTiers(independent.client)).find((q) => q.tier === quote.tier)?.satPerByte;
+			if (independentRate === void 0) flags.push("reads-unverified");
+			else {
+				const merged = mergeSatPerByte(quote.satPerByte, independentRate);
+				({rate} = merged);
+				flags.push(merged.mismatch ? "fee-mismatch" : void 0);
+			}
+		} catch {
+			flags.push("reads-unverified");
+		}
+		const free = inputs.filter((i) => !isHeld(`${String(i.txid ?? "")}:${String(i.index ?? 0)}`));
+		const { psbt, inputs: selected } = bitcoin.buildPsbt(free, to, amount, BigInt(rate), changeAddr, net.params);
 		const selectedKeys = new Set(selected.map((i) => `${String(i.txid ?? "")}:${String(i.index ?? 0)}`));
 		const selectedUtxos = utxos.filter((u) => selectedKeys.has(`${u.txid}:${u.vout}`));
+		for (const key of selectedKeys) reserved.set(key, requestId);
 		const txP = Transaction.fromPSBT(psbt);
 		const ownScripts = new Set(change.filter((a) => !a.used).map((a) => hex.encode(scriptPubKey(a.address, net.params))));
 		const request = {
@@ -4130,7 +5865,7 @@ const createBitcoinRoute = () => {
 		const inTotal = selectedUtxos.reduce((a, u) => a + u.value, 0);
 		const outTotal = outValues.reduce((a, o) => a + o.value, 0);
 		const id0 = newId(ctx.options.random);
-		pending.set(id0, {
+		const stash = {
 			inputs,
 			allUtxos: utxos,
 			pathOf: (u) => {
@@ -4152,62 +5887,73 @@ const createBitcoinRoute = () => {
 			tier: fee === "fast" ? "fast" : fee === "slow" ? "slow" : "normal",
 			template,
 			network
-		});
-		let tx = {
-			id: id0,
-			family: "bitcoin",
+		};
+		const record = {
+			inputs: selectedUtxos.map((u) => ({
+				txid: u.txid,
+				vout: u.vout,
+				value: u.value,
+				address: u.address
+			})),
+			outputs: outValues,
+			vsize,
+			fee: inTotal - outTotal,
+			feeRate: Math.ceil((inTotal - outTotal) / vsize)
+		};
+		if (independentRate !== void 0) flags.push(exceedsNetworkCap(BigInt(record.feeRate), BigInt(Math.ceil(independentRate))) ? "fee-above-network" : void 0);
+		flags.push(feeReachesAmount(BigInt(record.fee), amount) ? "fee-exceeds-amount" : void 0);
+		const submit = async (verify) => {
+			pending.set(id0, stash);
+			let tx = {
+				id: id0,
+				family: "bitcoin",
+				network,
+				account: account.walletId,
+				hash: void 0,
+				state: "draft",
+				intent,
+				nonce: 0,
+				btc: record,
+				...sparkDeposit === void 0 ? {} : { sparkDeposit },
+				submittedAt: ctx.options.now(),
+				error: void 0
+			};
+			tx = await ctx.transition(tx, {});
+			try {
+				const result = await apis.sign({
+					request,
+					verify
+				});
+				tx = await ctx.transition(tx, { state: "signed" });
+				const hash = await broadcastPsbt(es, result);
+				bitcoinUtxos.lock(selectedUtxos, tx.id);
+				releaseReservation(requestId);
+				return await submitTx(ctx, tx, hash);
+			} catch (error) {
+				await failTx(ctx, tx, error);
+				throw error;
+			}
+		};
+		return {
+			txId: id0,
+			account,
 			network,
-			account: account.walletId,
-			hash: void 0,
-			state: "draft",
 			intent,
-			nonce: 0,
-			btc: {
-				inputs: selectedUtxos.map((u) => ({
-					txid: u.txid,
-					vout: u.vout,
-					value: u.value,
-					address: u.address
-				})),
-				outputs: outValues,
-				vsize,
-				fee: inTotal - outTotal,
-				feeRate: Math.ceil((inTotal - outTotal) / vsize)
-			},
-			submittedAt: ctx.options.now(),
-			error: void 0
+			checks: collectChecks(flags),
+			staleReason: () => void 0,
+			submit,
+			release: () => {
+				releaseReservation(requestId);
+			}
 		};
-		tx = await ctx.transition(tx, {});
-		try {
-			const result = await apis.sign({
-				request,
-				verify
-			});
-			tx = await ctx.transition(tx, { state: "signed" });
-			if (result.kind !== "bitcoin.psbt" || !(result.signedPsbt instanceof Uint8Array)) throw new Error("unexpected bitcoin sign result");
-			bitcoinUtxos.lock(selectedUtxos, tx.id);
-			const signed = Transaction.fromPSBT(result.signedPsbt);
-			signed.finalize();
-			const raw = signed.extract();
-			const hash = String(await es.post("/tx", hex.encode(raw)));
-			tx = await ctx.transition(tx, {
-				state: "submitted",
-				hash,
-				submittedAt: ctx.options.now()
-			});
-			ctx.track(tx.id, hash);
-			return tx;
-		} catch (error) {
-			const failed = tx.state === "signed" ? "failed" : "rejected";
-			await ctx.transition(tx, {
-				state: failed,
-				error: errorMessage(error)
-			});
-			throw error;
-		}
 	};
 	/** Esplora `/tx/:txid/status` → terminal state or `undefined` to keep polling. */
-	const finish = async (ctx, stash, es, account, old, psbt, record, link, verify) => {
+	/**
+	* Builds the approval-ready request for a replacement or CPFP child. `held` are the extra outputs
+	* it spends beyond the original's own inputs; they are reserved in memory here and only locked
+	* persistently, under the new transaction id, once the broadcast succeeds.
+	*/
+	const prepareFinish = (ctx, stash, es, account, old, psbt, record, link, requestId, held, flags) => {
 		const apis = ctx.options.chains ?? chains(ctx.options.wallet);
 		const txP = Transaction.fromPSBT(psbt);
 		const request = {
@@ -4217,61 +5963,66 @@ const createBitcoinRoute = () => {
 			psbt,
 			sign: Array.from({ length: txP.inputsLength }, (_, i) => i)
 		};
-		const ownScripts = new Set(stash.changeAddresses.map((a) => hex.encode(scriptPubKey(a, bitcoinNetwork(stash.network).params))));
-		const intent = decodeBitcoinPsbt(request, ownScripts);
-		let tx = {
-			id: newId(ctx.options.random),
-			family: "bitcoin",
+		const ownScripts = new Set(stash.changeAddresses.map((a) => hex.encode(scriptPubKey(a, bitcoinNetwork(stash.network).params))));
+		const intent = decodeBitcoinPsbt(request, ownScripts);
+		const txId = newId(ctx.options.random);
+		for (const key of held) reserved.set(key, requestId);
+		const submit = async (verify) => {
+			let tx = {
+				id: txId,
+				family: "bitcoin",
+				network: old.network,
+				account: old.account,
+				hash: void 0,
+				state: "draft",
+				intent,
+				nonce: 0,
+				btc: record,
+				submittedAt: ctx.options.now(),
+				error: void 0,
+				...link
+			};
+			tx = await ctx.transition(tx, {});
+			try {
+				const result = await apis.sign({
+					request,
+					verify
+				});
+				tx = await ctx.transition(tx, { state: "signed" });
+				const hash = await broadcastPsbt(es, result);
+				if (link.replaces !== void 0) bitcoinUtxos.endTx(old.id, "dropped");
+				bitcoinUtxos.lock(record.inputs.map((i) => ({
+					...i,
+					status: "confirmed",
+					height: 0
+				})), tx.id);
+				releaseReservation(requestId);
+				return await submitTx(ctx, tx, hash);
+			} catch (error) {
+				await failTx(ctx, tx, error);
+				throw error;
+			}
+		};
+		return {
+			txId,
+			account,
 			network: old.network,
-			account: old.account,
-			hash: void 0,
-			state: "draft",
+			target: old.id,
 			intent,
-			nonce: 0,
-			btc: record,
-			submittedAt: ctx.options.now(),
-			error: void 0,
-			...link
+			checks: collectChecks(flags),
+			staleReason: () => link.replaces === void 0 ? void 0 : replacementStaleReason(ctx, old.id),
+			submit,
+			release: () => {
+				releaseReservation(requestId);
+			}
 		};
-		tx = await ctx.transition(tx, {});
-		try {
-			const result = await apis.sign({
-				request,
-				verify
-			});
-			tx = await ctx.transition(tx, { state: "signed" });
-			if (result.kind !== "bitcoin.psbt" || !(result.signedPsbt instanceof Uint8Array)) throw new Error("unexpected bitcoin sign result");
-			bitcoinUtxos.endTx(old.id, "dropped");
-			const signed = Transaction.fromPSBT(result.signedPsbt);
-			signed.finalize();
-			const raw = signed.extract();
-			const hash = String(await es.post("/tx", hex.encode(raw)));
-			bitcoinUtxos.lock(record.inputs.map((i) => ({
-				...i,
-				status: "confirmed",
-				height: 0
-			})), tx.id);
-			tx = await ctx.transition(tx, {
-				state: "submitted",
-				hash,
-				submittedAt: ctx.options.now()
-			});
-			ctx.track(tx.id, hash);
-			return tx;
-		} catch (error) {
-			const failed = tx.state === "signed" ? "failed" : "rejected";
-			await ctx.transition(tx, {
-				state: failed,
-				error: errorMessage(error)
-			});
-			throw error;
-		}
 	};
-	const replace = async (ctx, old, mode, verify) => {
+	const prepareReplace = async (ctx, old, mode, requestId) => {
 		const stash = pending.get(old.id);
 		const { btc } = old;
 		if (stash === void 0 || btc === void 0) throw new Error("the original build context is gone — cannot replace after restart");
 		const es = ctx.options.networks.esplora(old.network);
+		const independent = ctx.options.networks.independentEsplora(old.network);
 		const apis = ctx.options.chains ?? chains(ctx.options.wallet);
 		const { template } = stash;
 		if (!("xpub" in await apis.account({
@@ -4288,7 +6039,20 @@ const createBitcoinRoute = () => {
 		};
 		const tiers = await feeTiers(es);
 		const tierQuote = tiers.find((t) => t.tier === stash.tier) ?? tiers[1];
-		const rate = tierQuote === void 0 ? 1 : tierQuote.satPerByte;
+		let rate = tierQuote === void 0 ? 1 : tierQuote.satPerByte;
+		const flags = [independent.kind === "unavailable" ? "reads-unverified" : void 0];
+		let independentRate;
+		if (independent.kind === "available") try {
+			independentRate = (await feeTiers(independent.client)).find((q) => q.tier === tierQuote?.tier)?.satPerByte;
+			if (independentRate === void 0) flags.push("reads-unverified");
+			else {
+				const merged = mergeSatPerByte(rate, independentRate);
+				({rate} = merged);
+				flags.push(merged.mismatch ? "fee-mismatch" : void 0);
+			}
+		} catch {
+			flags.push("reads-unverified");
+		}
 		const newFee = Math.max(btc.fee + btc.vsize, Math.ceil(btc.vsize * rate));
 		const [changeAddr] = stash.changeAddresses;
 		if (changeAddr === void 0) throw new Error("no unused change address");
@@ -4300,7 +6064,7 @@ const createBitcoinRoute = () => {
 			amount: BigInt(o.value)
 		}));
 		const usedKeys = new Set(btc.inputs.map((i) => `${i.txid}:${i.vout}`));
-		const spare = stash.allUtxos.filter((u) => !usedKeys.has(`${u.txid}:${u.vout}`));
+		const spare = stash.allUtxos.filter((u) => !usedKeys.has(`${u.txid}:${u.vout}`) && !isHeld(`${u.txid}:${u.vout}`));
 		const extraInputs = [];
 		const extraUtxos = [];
 		const feeNeeded = (o) => BigInt(newFee) - (BigInt(inTotal) + extraUtxos.reduce((a, u) => a + BigInt(u.value), 0n) - o.reduce((a, x) => a + x.amount, 0n));
@@ -4371,13 +6135,15 @@ const createBitcoinRoute = () => {
 			fee: newFee,
 			feeRate: Math.ceil(newFee / vsize)
 		};
-		return finish(ctx, stash, es, account, old, psbt, record, { replaces: old.id }, verify);
+		if (independentRate !== void 0) flags.push(exceedsNetworkCap(BigInt(record.feeRate), BigInt(Math.ceil(independentRate))) ? "fee-above-network" : void 0);
+		return prepareFinish(ctx, stash, es, account, old, psbt, record, { replaces: old.id }, requestId, extraUtxos.map((u) => `${u.txid}:${u.vout}`), flags);
 	};
-	const bumpChild = async (ctx, old, targetRate, verify) => {
+	const prepareCpfp = async (ctx, old, targetRate, requestId) => {
 		const stash = pending.get(old.id);
 		const { btc } = old;
 		if (stash === void 0 || btc === void 0) throw new Error("the parent build context is gone — cannot bump after restart");
 		const es = ctx.options.networks.esplora(old.network);
+		const independent = ctx.options.networks.independentEsplora(old.network);
 		const { template } = stash;
 		const account = {
 			kind: "hd",
@@ -4390,6 +6156,15 @@ const createBitcoinRoute = () => {
 			vout
 		}] : []);
 		if (own.length === 0) throw new Error("parent has no own outputs to bump");
+		const parentKeys = own.map((o) => `${old.hash ?? ""}:${o.vout}`);
+		if (parentKeys.some((key) => isHeld(key))) throw new Error("the parent's outputs are already reserved by another request");
+		const flags = [independent.kind === "unavailable" ? "reads-unverified" : void 0];
+		if (independent.kind === "available") try {
+			const fastest = (await feeTiers(independent.client)).find((q) => q.tier === "fast");
+			flags.push(fastest === void 0 ? "reads-unverified" : exceedsNetworkCap(BigInt(Math.ceil(targetRate)), BigInt(Math.ceil(fastest.satPerByte))) ? "fee-above-network" : void 0);
+		} catch {
+			flags.push("reads-unverified");
+		}
 		const childInputs = bitcoin.toInputs(own.map((o) => ({
 			txid: old.hash ?? "",
 			vout: o.vout,
@@ -4412,9 +6187,9 @@ const createBitcoinRoute = () => {
 			amount: BigInt(inTotal - childFee)
 		}], net.params);
 		const record = {
-			inputs: own.map((o, i) => ({
+			inputs: own.map((o) => ({
 				txid: old.hash ?? "",
-				vout: i,
+				vout: o.vout,
 				value: o.value,
 				address: o.address
 			})),
@@ -4427,30 +6202,75 @@ const createBitcoinRoute = () => {
 			fee: childFee,
 			feeRate: Math.ceil(childFee / vsize)
 		};
-		return finish(ctx, stash, es, account, old, psbt, record, { parentId: old.id }, verify);
+		return prepareFinish(ctx, stash, es, account, old, psbt, record, { parentId: old.id }, requestId, parentKeys, flags);
+	};
+	const pollAndRelease = async (ctx, tx) => {
+		const state = await poll(ctx, tx);
+		if (state === "confirmed") bitcoinUtxos.endTx(tx.id, "confirmed");
+		return state;
 	};
 	return {
-		send,
-		poll,
-		replace,
-		bumpChild
+		prepare,
+		nextReceiveAddress,
+		poll: pollAndRelease,
+		prepareReplace,
+		prepareCpfp,
+		unlock: async (store) => bitcoinUtxos.unlock(store),
+		lock: () => {
+			reserved.clear();
+			bitcoinUtxos.lockStore();
+		}
 	};
 };
-//#endregion
-//#region src/transactions/evm.ts
+// src/transactions/evm.ts
 /** EVM route: native/ERC-20 send build → fee → decode → sign → broadcast, plus status poll. */
 const bump = (v) => (v * 11n + 9n) / 10n;
+const signSubmit = async (ctx, tx, apis, request, verify, broadcast) => {
+	let signed;
+	let tracked = tx;
+	try {
+		const result = await apis.sign({
+			request,
+			verify
+		});
+		tracked = await ctx.transition(tracked, { state: "signed" });
+		signed = result;
+	} catch (error) {
+		await ctx.transition(tracked, {
+			state: "rejected",
+			error: errorMessage$1(error)
+		});
+		throw error;
+	}
+	try {
+		const hash = await broadcast(signed);
+		tracked = await ctx.transition(tracked, {
+			state: "submitted",
+			hash,
+			submittedAt: ctx.options.now()
+		});
+		ctx.track(tracked.id, hash);
+		return tracked;
+	} catch (error) {
+		await ctx.transition(tracked, {
+			state: "failed",
+			error: errorMessage$1(error)
+		});
+		throw error;
+	}
+};
 /** Per-controller route — the adapter's nonce queue and the replace stash are engine state. */
 const createEvmRoute = () => {
 	const evm = new EvmChainAdapter();
 	/** In-memory build context keyed by tx id — the inputs a replace rebuilds from. */
 	const pending = /* @__PURE__ */ new Map();
-	const send = async (ctx, params) => {
-		const { account, network, to, amount, fee, verify } = params;
+	const prepareSpec = async (ctx, spec) => {
+		const { account, network, fee } = spec;
 		const { networks } = ctx.options;
 		if (account.kind !== "hd") throw new Error("imported accounts are not yet supported");
 		const info = networks.info(network);
 		const client = networks.client(network);
+		const independent = networks.independentClient(network);
 		const apis = ctx.options.chains ?? chains(ctx.options.wallet);
 		const evmAccount = await apis.account({
 			walletId: account.walletId,
@@ -4459,90 +6279,144 @@ const createEvmRoute = () => {
 			network
 		});
 		const from = "address" in evmAccount ? evmAccount.address : "";
-		const unsigned = await evm.build(client, network, from, params.token === void 0 ? {
-			kind: "native",
-			to,
-			value: amount
-		} : {
-			kind: "erc20",
-			token: params.token,
-			to,
-			value: amount
-		});
+		const flags = [independent.kind === "unavailable" ? "reads-unverified" : void 0];
+		let nonce = await evm.nextNonce(client, network, from);
+		if (independent.kind === "available") try {
+			const [primary, other] = await Promise.all([evm.pendingCount(client, from), evm.pendingCount(independent.client, from)]);
+			nonce = Math.max(nonce, other);
+			flags.push(primary === other ? void 0 : "nonce-mismatch");
+		} catch {
+			flags.push("reads-unverified");
+		}
+		const unsigned = await evm.build(client, network, from, spec.intent, nonce);
 		const quotes = await evm.estimateFee(client);
-		const quote = quotes.find((q) => q.tier === fee) ?? quotes[1];
+		let quote = quotes.find((q) => q.tier === fee) ?? quotes[1];
 		if (quote === void 0) throw new Error("no fee quote");
+		if (independent.kind === "available") try {
+			const other = (await evm.estimateFee(independent.client)).find((q) => q.tier === quote?.tier);
+			if (other === void 0) flags.push("reads-unverified");
+			else {
+				const merged = mergeEvmQuote(quote, other);
+				({quote} = merged);
+				flags.push(merged.mismatch ? "fee-mismatch" : void 0, exceedsNetworkCap(quote.maxFeePerGas, other.maxFeePerGas) ? "fee-above-network" : void 0);
+			}
+		} catch {
+			flags.push("reads-unverified");
+		}
 		const feed = evm.applyFee(unsigned, quote);
+		if (spec.nativeValue !== void 0 && feeReachesAmount(feed.gas * (feed.maxFeePerGas ?? feed.gasPrice ?? 0n), spec.nativeValue)) flags.push("fee-exceeds-amount");
 		const request = evm.toSignRequest(feed, account, info.chainId);
 		const intent = decodeEvm(request);
-		const id = newId(ctx.options.random);
-		pending.set(id, {
-			unsigned: feed,
-			request,
-			quote,
-			chainId: info.chainId
-		});
-		let tx = {
-			id,
-			family: "evm",
-			network,
-			account: account.walletId,
-			hash: void 0,
-			state: "draft",
-			intent,
-			nonce: unsigned.nonce,
-			submittedAt: ctx.options.now(),
-			error: void 0
-		};
-		tx = await ctx.transition(tx, {});
-		let signed;
-		try {
-			const result = await apis.sign({
+		const txId = newId(ctx.options.random);
+		const chosen = quote;
+		const submit = async (verify) => {
+			pending.set(txId, {
+				unsigned: feed,
 				request,
-				verify
-			});
-			tx = await ctx.transition(tx, { state: "signed" });
-			signed = result;
-		} catch (error) {
-			await ctx.transition(tx, {
-				state: "rejected",
-				error: errorMessage(error)
-			});
-			throw error;
-		}
-		try {
-			const raw = evm.finalize(feed, signed);
-			const hash = await evm.broadcast(client, raw);
-			tx = await ctx.transition(tx, {
-				state: "submitted",
-				hash,
-				submittedAt: ctx.options.now()
+				quote: chosen,
+				chainId: info.chainId
 			});
-			ctx.track(tx.id, hash);
-			return tx;
-		} catch (error) {
-			await ctx.transition(tx, {
-				state: "failed",
-				error: errorMessage(error)
+			let tx = {
+				id: txId,
+				family: "evm",
+				network,
+				account: account.walletId,
+				hash: void 0,
+				state: "draft",
+				intent,
+				nonce: unsigned.nonce,
+				submittedAt: ctx.options.now(),
+				error: void 0
+			};
+			tx = await ctx.transition(tx, {});
+			return signSubmit(ctx, tx, apis, request, verify, async (signed) => {
+				const raw = evm.finalize(feed, signed);
+				const hash = await evm.broadcast(client, raw);
+				evm.commitNonce(network, from, unsigned.nonce);
+				return hash;
 			});
-			throw error;
-		}
+		};
+		return {
+			txId,
+			account,
+			network,
+			intent,
+			checks: collectChecks(flags),
+			staleReason: () => evm.nonceConsumed(network, from, unsigned.nonce) ? "nonce already used by a newer transaction — start over" : void 0,
+			submit,
+			release: () => void 0
+		};
+	};
+	const prepare = async (ctx, params) => prepareSpec(ctx, {
+		account: params.account,
+		network: params.network,
+		fee: params.fee,
+		intent: params.token === void 0 ? {
+			kind: "native",
+			to: params.to,
+			value: params.amount
+		} : {
+			kind: "erc20",
+			token: params.token,
+			to: params.to,
+			value: params.amount
+		},
+		nativeValue: params.token === void 0 ? params.amount : void 0
+	});
+	/**
+	* A dApp transaction, already normalized: only `to`, `value` and `data` are kept; nonce and fees
+	* are read again and the dApp's `gas` only raises the floor under our own estimate.
+	*/
+	const prepareCall = async (ctx, request) => {
+		const { tx } = request;
+		if (tx.to === void 0) throw new Error("contract creation is not supported");
+		const value = BigInt(tx.value);
+		return prepareSpec(ctx, {
+			account: request.account,
+			network: request.network,
+			fee: "normal",
+			intent: {
+				kind: "call",
+				to: tx.to,
+				value,
+				data: tx.data,
+				minGas: BigInt(tx.gas)
+			},
+			nativeValue: value > 0n ? value : void 0
+		});
 	};
 	/**
 	* EVM speed-up/cancel — replaces a pending tx at the same nonce with a bumped fee (cancel = a
-	* 0-value transfer to self). The new tx carries `replaces` and needs a fresh signature; a
-	* rejected one never reaches the network and leaves the original.
+	* 0-value transfer to self). The fee is cross-checked and merged first, then the replacement
+	* floor (+10% on both fee fields, never below the merged estimate) is applied on top, so a low
+	* quote can never push the replacement under the node's replacement rule. A rejected signature
+	* never reaches the network and leaves the original.
 	*/
-	const replace = async (ctx, old, mode, verify) => {
+	const prepareReplace = async (ctx, old, mode) => {
 		const stash = pending.get(old.id);
 		if (stash === void 0) throw new Error("the original build context is gone — cannot replace after restart");
 		const { networks } = ctx.options;
 		const client = networks.client(old.network);
+		const independent = networks.independentClient(old.network);
 		const apis = ctx.options.chains ?? chains(ctx.options.wallet);
 		const { tier } = stash.quote;
 		const estimates = await evm.estimateFee(client);
-		const estimate = estimates.find((q) => q.tier === tier) ?? estimates[1];
+		let estimate = estimates.find((q) => q.tier === tier) ?? estimates[1];
 		if (estimate === void 0) throw new Error("no fee quote");
+		const flags = [independent.kind === "unavailable" ? "reads-unverified" : void 0];
+		let independentCap;
+		if (independent.kind === "available") try {
+			const other = (await evm.estimateFee(independent.client)).find((q) => q.tier === estimate?.tier);
+			if (other === void 0) flags.push("reads-unverified");
+			else {
+				const merged = mergeEvmQuote(estimate, other);
+				({quote: estimate} = merged);
+				independentCap = other.maxFeePerGas;
+				flags.push(merged.mismatch ? "fee-mismatch" : void 0);
+			}
+		} catch {
+			flags.push("reads-unverified");
+		}
 		const oldFee = stash.unsigned;
 		const bumpedFee = bump(oldFee.maxFeePerGas ?? oldFee.gasPrice ?? 0n);
 		const maxFeePerGas = bumpedFee > estimate.maxFeePerGas ? bumpedFee : estimate.maxFeePerGas;
@@ -4551,6 +6425,7 @@ const createEvmRoute = () => {
 			maxFeePerGas,
 			maxPriorityFeePerGas: priorityBump
 		};
+		if (independentCap !== void 0) flags.push(exceedsNetworkCap(maxFeePerGas, independentCap) ? "fee-above-network" : void 0);
 		const unsigned = mode === "cancel" ? {
 			...stash.unsigned,
 			to: stash.unsigned.from,
@@ -4564,59 +6439,41 @@ const createEvmRoute = () => {
 		};
 		const request = evm.toSignRequest(unsigned, stash.request.account, stash.chainId);
 		const intent = decodeEvm(request);
-		const id = newId(ctx.options.random);
-		pending.set(id, {
-			unsigned,
-			request,
-			quote: stash.quote,
-			chainId: stash.chainId
-		});
-		let tx = {
-			id,
-			family: "evm",
+		const txId = newId(ctx.options.random);
+		const submit = async (verify) => {
+			pending.set(txId, {
+				unsigned,
+				request,
+				quote: stash.quote,
+				chainId: stash.chainId
+			});
+			let tx = {
+				id: txId,
+				family: "evm",
+				network: old.network,
+				account: old.account,
+				hash: void 0,
+				state: "draft",
+				intent,
+				nonce: old.nonce,
+				replaces: old.id,
+				submittedAt: ctx.options.now(),
+				error: void 0
+			};
+			tx = await ctx.transition(tx, {});
+			return signSubmit(ctx, tx, apis, request, verify, async (signed) => evm.broadcast(client, evm.finalize(unsigned, signed)));
+		};
+		return {
+			txId,
+			account: stash.request.account,
 			network: old.network,
-			account: old.account,
-			hash: void 0,
-			state: "draft",
+			target: old.id,
 			intent,
-			nonce: old.nonce,
-			replaces: old.id,
-			submittedAt: ctx.options.now(),
-			error: void 0
+			checks: collectChecks(flags),
+			staleReason: () => replacementStaleReason(ctx, old.id),
+			submit,
+			release: () => void 0
 		};
-		tx = await ctx.transition(tx, {});
-		let signed;
-		try {
-			const result = await apis.sign({
-				request,
-				verify
-			});
-			tx = await ctx.transition(tx, { state: "signed" });
-			signed = result;
-		} catch (error) {
-			await ctx.transition(tx, {
-				state: "rejected",
-				error: errorMessage(error)
-			});
-			throw error;
-		}
-		try {
-			const raw = evm.finalize(unsigned, signed);
-			const hash = await evm.broadcast(client, raw);
-			tx = await ctx.transition(tx, {
-				state: "submitted",
-				hash,
-				submittedAt: ctx.options.now()
-			});
-			ctx.track(tx.id, hash);
-			return tx;
-		} catch (error) {
-			await ctx.transition(tx, {
-				state: "failed",
-				error: errorMessage(error)
-			});
-			throw error;
-		}
 	};
 	/** Returns the terminal state once the receipt lands, or `undefined` to keep polling. */
 	const poll = async (ctx, tx) => {
@@ -4627,9 +6484,10 @@ const createEvmRoute = () => {
 		return state === "finalized" ? "confirmed" : state;
 	};
 	return {
-		send,
+		prepare,
+		prepareCall,
 		poll,
-		replace
+		prepareReplace
 	};
 };
 PROGRAM_IDS.token2022;
@@ -4816,19 +6674,21 @@ var SolanaChainAdapter = class {
 		return BigInt(str(result, "0"));
 	}
 };
-//#endregion
-//#region src/transactions/solana.ts
+// src/transactions/solana.ts
 /** Solana route: SOL/SPL send → sign → broadcast, plus status poll with rebroadcast/drop. */
+/** The network's base signature fee, lamports per signature. */
+const BASE_FEE_LAMPORTS = 5000n;
 const isObject$1 = (v) => typeof v === "object" && v !== null;
 const obj = (v) => isObject$1(v) ? v : void 0;
 const arr = (v) => Array.isArray(v) ? v : void 0;
 const solana = new SolanaChainAdapter();
 /** Signed wire transactions kept for re-broadcast until the tx confirms or drops. */
 const wires = /* @__PURE__ */ new Map();
-const sendSolana = async (ctx, params) => {
-	const { account, network, to, amount, fee, verify } = params;
+const prepareSolana = async (ctx, params) => {
+	const { account, network, to, amount, fee } = params;
 	if (account.kind !== "hd") throw new Error("imported accounts are not yet supported");
 	const rpc = ctx.options.networks.solanaRpc(network);
+	const independent = ctx.options.networks.independentSolanaRpc(network);
 	const apis = ctx.options.chains ?? chains(ctx.options.wallet);
 	const solAccount = await apis.account({
 		walletId: account.walletId,
@@ -4870,8 +6730,25 @@ const sendSolana = async (ctx, params) => {
 		...tokenProgram === void 0 ? {} : { tokenProgram }
 	});
 	const quotes = await solana.estimateFee(rpc, unsigned.writable);
-	const quote = quotes.find((q) => q.tier === fee) ?? quotes[1];
+	let quote = quotes.find((q) => q.tier === fee) ?? quotes[1];
 	if (quote === void 0) throw new Error("no fee quote");
+	const flags = [independent.kind === "unavailable" ? "reads-unverified" : void 0];
+	if (independent.kind === "available") try {
+		const other = (await solana.estimateFee(independent.client, unsigned.writable)).find((q) => q.tier === quote?.tier);
+		if (other === void 0) flags.push("reads-unverified");
+		else {
+			const merged = mergeSolanaQuote(quote, other);
+			({quote} = merged);
+			flags.push(merged.mismatch ? "fee-mismatch" : void 0, exceedsNetworkCap(quote.microLamportsPerCu, other.microLamportsPerCu) ? "fee-above-network" : void 0);
+		}
+	} catch {
+		flags.push("reads-unverified");
+	}
+	if (params.token === void 0) {
+		const units = BigInt(Math.ceil((unsigned.unitsConsumed === 0 ? 14e5 : unsigned.unitsConsumed) * 1.1));
+		const maxFee = BASE_FEE_LAMPORTS + (units * quote.microLamportsPerCu + 999999n) / 1000000n;
+		flags.push(feeReachesAmount(maxFee, amount) ? "fee-exceeds-amount" : void 0);
+	}
 	const messageBytes = solana.applyFee(unsigned, quote);
 	const request = {
 		kind: "solana.transaction",
@@ -4881,45 +6758,47 @@ const sendSolana = async (ctx, params) => {
 	};
 	const intent = ext === void 0 || params.token === void 0 ? decodeSolana(request, from) : token2022Intent(decodeSolana(request, from), ext, params.token, amount);
 	const id = newId(ctx.options.random);
-	let tx = {
-		id,
-		family: "solana",
+	const submit = async (verify) => {
+		let tx = {
+			id,
+			family: "solana",
+			network,
+			account: account.walletId,
+			hash: void 0,
+			state: "draft",
+			intent,
+			nonce: 0,
+			lastValidBlockHeight: Number(unsigned.lastValidBlockHeight),
+			submittedAt: ctx.options.now(),
+			error: void 0
+		};
+		tx = await ctx.transition(tx, {});
+		try {
+			const result = await apis.sign({
+				request,
+				verify
+			});
+			tx = await ctx.transition(tx, { state: "signed" });
+			if (result.kind !== "solana.transaction" || !(result.signature instanceof Uint8Array)) throw new Error("unexpected solana sign result");
+			const wire = solana.finalize(messageBytes, [result.signature]);
+			const hash = await solana.broadcast(rpc, wire);
+			wires.set(id, wire);
+			return await submitTx(ctx, tx, hash);
+		} catch (error) {
+			await failTx(ctx, tx, error);
+			throw error;
+		}
+	};
+	return {
+		txId: id,
+		account,
 		network,
-		account: account.walletId,
-		hash: void 0,
-		state: "draft",
 		intent,
-		nonce: 0,
-		lastValidBlockHeight: Number(unsigned.lastValidBlockHeight),
-		submittedAt: ctx.options.now(),
-		error: void 0
+		checks: collectChecks(flags),
+		staleReason: async () => await solana.blockHeight(rpc) > unsigned.lastValidBlockHeight ? "blockhash expired — start over" : void 0,
+		submit,
+		release: () => void 0
 	};
-	tx = await ctx.transition(tx, {});
-	try {
-		const result = await apis.sign({
-			request,
-			verify
-		});
-		tx = await ctx.transition(tx, { state: "signed" });
-		if (result.kind !== "solana.transaction" || !(result.signature instanceof Uint8Array)) throw new Error("unexpected solana sign result");
-		const wire = solana.finalize(messageBytes, [result.signature]);
-		const hash = await solana.broadcast(rpc, wire);
-		wires.set(id, wire);
-		tx = await ctx.transition(tx, {
-			state: "submitted",
-			hash,
-			submittedAt: ctx.options.now()
-		});
-		ctx.track(tx.id, hash);
-		return tx;
-	} catch (error) {
-		const failed = tx.state === "signed" ? "failed" : "rejected";
-		await ctx.transition(tx, {
-			state: failed,
-			error: errorMessage(error)
-		});
-		throw error;
-	}
 };
 /** Returns the terminal state, `dropped` on blockhash expiry, or `undefined` to keep polling. */
 const pollSolana = async (ctx, tx) => {
@@ -4979,13 +6858,7 @@ const token2022Intent = (intent, ext, mint, amount) => {
 		warnings
 	};
 };
-//#endregion
-//#region src/transactions/controller.ts
-/**
-* Transaction controller: orchestrates lifecycle, persistence and polling; each chain family routes
-* through its own module (`evm.ts`, `solana.ts`, `bitcoin.ts`). A rejected signature (wrong
-* password, cancelled presence) never broadcasts.
-*/
+// src/transactions/controller.ts
 const encode = (tx) => new TextEncoder().encode(JSON.stringify(tx));
 const isObject = (v) => typeof v === "object" && v !== null;
 const TX_STATES = /* @__PURE__ */ new Set([
@@ -5005,11 +6878,12 @@ const isBtcRecord = (v) => {
 	const { inputs, outputs, vsize, fee, feeRate } = v;
 	return Array.isArray(inputs) && Array.isArray(outputs) && typeof vsize === "number" && typeof fee === "number" && typeof feeRate === "number" && inputs.every((i) => isObject(i) && typeof i["txid"] === "string" && typeof i["vout"] === "number" && typeof i["value"] === "number" && typeof i["address"] === "string") && outputs.every((o) => isObject(o) && typeof o["address"] === "string" && typeof o["value"] === "number" && typeof o["own"] === "boolean");
 };
+const isSparkDeposit = (v) => isObject(v) && typeof v["walletId"] === "string" && typeof v["groupIndex"] === "number" && (v["network"] === "mainnet" || v["network"] === "regtest") && (v["claimed"] === void 0 || typeof v["claimed"] === "boolean");
 const isIntent = (v) => isObject(v) && typeof v["summary"] === "string" && Array.isArray(v["outflows"]) && typeof v["verifiability"] === "string";
 const decode = (raw) => {
 	const parsed = JSON.parse(new TextDecoder().decode(raw));
 	if (!isObject(parsed)) return;
-	const { id, family, network, account, hash, state, intent, nonce, replaces, parentId, btc, submittedAt, error } = parsed;
+	const { id, family, network, account, hash, state, intent, nonce, replaces, parentId, btc, sparkDeposit, submittedAt, error } = parsed;
 	if (typeof id !== "string" || family !== "evm" && family !== "solana" && family !== "bitcoin" || typeof network !== "string" || typeof account !== "string" || !isTxState(state) || typeof nonce !== "number" || typeof submittedAt !== "number") return;
 	return {
 		id,
@@ -5023,6 +6897,7 @@ const decode = (raw) => {
 		...typeof replaces === "string" ? { replaces } : {},
 		...typeof parentId === "string" ? { parentId } : {},
 		...isBtcRecord(btc) ? { btc } : {},
+		...isSparkDeposit(sparkDeposit) ? { sparkDeposit } : {},
 		submittedAt,
 		error: typeof error === "string" ? error : void 0
 	};
@@ -5044,6 +6919,7 @@ var TransactionController = class extends Controller {
 	async init() {
 		this.locked = false;
 		this.engineStore = await this.options.openStore();
+		await this.bitcoinRoute.unlock(this.engineStore);
 		const collection = this.engineStore.collection("transactions");
 		const keys = await collection.list();
 		const rows = await Promise.all(keys.map(async (key) => collection.get(key)));
@@ -5070,10 +6946,16 @@ var TransactionController = class extends Controller {
 		this.timers.clear();
 		this.engineStore = void 0;
 		this.evmRoute = createEvmRoute();
+		this.bitcoinRoute.lock();
+		this.bitcoinRoute = createBitcoinRoute();
 	}
 	async persist(tx) {
 		const store = this.engineStore;
-		if (store !== void 0) await store.collection("transactions").put(tx.id, encode(tx));
+		if (store === void 0) {
+			this.options.logger.warn(`transaction ${tx.id} (${tx.state}) not persisted: vault locked`);
+			return;
+		}
+		await store.collection("transactions").put(tx.id, encode(tx));
 	}
 	async transition(tx, next) {
 		const updated = {
@@ -5095,45 +6977,109 @@ var TransactionController = class extends Controller {
 			options: this.options,
 			transition: async (tx, next) => this.transition(tx, next),
 			track: (id, hash) => this.track(id, hash),
+			txs: () => this.getState().txs,
 			newId: () => newId(this.options.random)
 		};
 	}
-	async send(params) {
+	/**
+	* Internal entry for the request pipeline: builds, estimates and cross-checks a send without
+	* signing it. Bitcoin outputs it selects stay locked under `requestId` until the returned
+	* `release` runs or the broadcast moves them to the transaction.
+	*/
+	async prepareSend(params, requestId, sparkDeposit) {
 		if (this.locked) throw new Error("transactions require an unlocked vault");
 		const { account, network } = params;
 		const info = this.options.networks.info(network);
 		if (account.kind !== "hd") throw new Error("imported accounts are not yet supported");
 		const ctx = this.routeCtx();
-		if (info.family === "solana") return sendSolana(ctx, params);
-		if (info.family === "bitcoin") return this.bitcoinRoute.send(ctx, params);
-		return this.evmRoute.send(ctx, params);
+		if (info.family === "solana") return prepareSolana(ctx, params);
+		if (info.family === "bitcoin") return this.bitcoinRoute.prepare(ctx, params, requestId, sparkDeposit);
+		return this.evmRoute.prepare(ctx, params);
+	}
+	/** The group's next unused `btc.bip84` receive address on a bitcoin `network`. */
+	async nextReceiveAddress(walletId, groupIndex, network) {
+		if (this.locked) throw new Error("transactions require an unlocked vault");
+		return this.bitcoinRoute.nextReceiveAddress(this.routeCtx(), walletId, groupIndex, network);
+	}
+	/** Records that a Spark deposit was credited; persisted with the transaction. */
+	async markDepositClaimed(id) {
+		const tx = this.getState().txs[id];
+		if (tx?.sparkDeposit === void 0) throw new Error(`transaction ${id} is not a Spark deposit`);
+		await this.transition(tx, { sparkDeposit: {
+			...tx.sparkDeposit,
+			claimed: true
+		} });
 	}
 	/**
-	* Speed up or cancel a pending/submitted EVM transaction at the same nonce — a fresh signature is
-	* required and a rejection leaves the original untouched.
+	* Internal entry for a dApp's EVM signature request: the request is normalized first, a
+	* transaction is rebuilt with fresh nonce and fees (the dApp's own are discarded), and a message
+	* is decoded and signed as is.
 	*/
-	async replace(id, mode, verify) {
+	async prepareDapp(account, request) {
 		if (this.locked) throw new Error("transactions require an unlocked vault");
-		const old = this.getState().txs[id];
-		if (old === void 0) throw new Error(`unknown transaction ${id}`);
-		if (old.family === "bitcoin") return this.bitcoinRoute.replace(this.routeCtx(), old, mode, verify);
-		if (old.family !== "evm") throw new Error("replace is EVM-only in this layer");
-		if (old.state !== "pending" && old.state !== "submitted") throw new Error(`cannot replace a ${old.state} transaction`);
-		return this.evmRoute.replace(this.routeCtx(), old, mode, verify);
+		const normalized = normalizeEvm(request);
+		if (account.kind !== "hd") throw new Error("imported accounts are not yet supported");
+		if (normalized.kind === "evm.transaction") return this.evmRoute.prepareCall(this.routeCtx(), {
+			account,
+			network: normalized.network,
+			tx: normalized.tx
+		});
+		if (normalized.kind !== "evm.personal-message" && normalized.kind !== "evm.typed-data") throw new Error(`unsupported dApp request ${normalized.kind}`);
+		const { kind, network } = normalized;
+		const apis = this.options.chains ?? chains(this.options.wallet);
+		return {
+			account,
+			network,
+			intent: decodeEvm(normalized),
+			checks: [],
+			staleReason: () => void 0,
+			release: () => void 0,
+			submit: async (verify) => {
+				const result = await apis.sign({
+					request: normalized.kind === "evm.personal-message" ? {
+						kind: normalized.kind,
+						network,
+						account,
+						message: normalized.message
+					} : {
+						kind: normalized.kind,
+						network,
+						account,
+						typedData: normalized.typedData
+					},
+					verify
+				});
+				if (result.kind !== kind || !("signature" in result)) throw new Error("unexpected sign result");
+				return {
+					kind,
+					signature: result.signature
+				};
+			}
+		};
 	}
 	/**
-	* CPFP — spend an unconfirmed tx's own outputs into a higher-fee child so the package mines.
-	* Bitcoin only; the child is linked via `parentId`.
+	* Internal entry for replacements and CPFP: builds, cross-checks and reserves what the
+	* replacement needs without signing it. The original must be `submitted` or `pending`.
 	*/
-	async bumpChild(id, targetRate, verify) {
+	async prepareReplacement(input, requestId) {
 		if (this.locked) throw new Error("transactions require an unlocked vault");
-		const old = this.getState().txs[id];
-		if (old === void 0) throw new Error(`unknown transaction ${id}`);
-		if (old.family !== "bitcoin") throw new Error("bumpChild is Bitcoin-only in this layer");
-		if (old.state !== "pending" && old.state !== "submitted") throw new Error(`cannot bump a ${old.state} transaction`);
-		return this.bitcoinRoute.bumpChild(this.routeCtx(), old, targetRate, verify);
+		const old = this.getState().txs[input.txId];
+		if (old === void 0) throw new Error(`unknown transaction ${input.txId}`);
+		if (old.state !== "pending" && old.state !== "submitted") throw new Error(`cannot ${input.method} a ${old.state} transaction`);
+		const ctx = this.routeCtx();
+		if (input.method === "cpfp") {
+			if (old.family !== "bitcoin") throw new Error("cpfp is Bitcoin-only");
+			return this.bitcoinRoute.prepareCpfp(ctx, old, input.feeRate, requestId);
+		}
+		if (old.family === "bitcoin") return this.bitcoinRoute.prepareReplace(ctx, old, input.method, requestId);
+		if (old.family === "evm") return this.evmRoute.prepareReplace(ctx, old, input.method);
+		throw new Error(`${input.method} is EVM and Bitcoin only`);
 	}
 	track(id, hash) {
+		if (this.locked) {
+			this.options.logger.warn(`transaction ${id} was broadcast after the vault locked; it is neither persisted nor tracked`);
+			return;
+		}
 		if (this.timers.has(id) || hash === "") return;
 		const poll = this.options.pollMs ?? 4e3;
 		const stop = this.options.setTimer(poll, async () => {
@@ -5161,8 +7107,7 @@ var TransactionController = class extends Controller {
 		this.timers.set(id, stop);
 	}
 };
-//#endregion
-//#region src/engine.ts
+// src/engine.ts
 /**
 * Composition root: wires the Wallet's lock state to the SparkController's lifecycle. Unlocked →
 * open the EngineStore and start every declared account; locked → abort event loops, close every
@@ -5193,7 +7138,8 @@ function createWalletEngine(options) {
 		fetch: options.fetch,
 		rpc: options.rpc ?? {},
 		openStore: options.openStore,
-		logger: options.logger
+		logger: options.logger,
+		gateway: options.gateway
 	});
 	const assets = new AssetsController({
 		networks,
@@ -5220,6 +7166,28 @@ function createWalletEngine(options) {
 		now: options.now,
 		logger: options.logger
 	});
+	const addressBook = new AddressBookController({
+		openStore: options.openStore,
+		random: options.random,
+		now: options.now,
+		logger: options.logger
+	});
+	const requests = new RequestController({
+		transactions,
+		addressBook,
+		openStore: options.openStore,
+		spark: controller,
+		fetch: options.fetch,
+		random: options.random,
+		now: options.now,
+		setTimer: options.setTimer ?? ((ms, fn) => {
+			const id = setTimeout(() => {
+				fn();
+			}, ms);
+			return () => clearTimeout(id);
+		}),
+		logger: options.logger
+	});
 	const accounts = new AccountTreeController({
 		wallet: options.wallet,
 		spark: controller,
@@ -5231,11 +7199,45 @@ function createWalletEngine(options) {
 	const metaSync = new MetaSyncController({
 		wallet: options.wallet,
 		accounts,
-		nostr: { signer: (ref) => nostr(options.wallet).signer(ref) },
+		addressBook,
+		nostr: { syncSigner: (walletId) => nostr(options.wallet).syncSigner(walletId) },
 		metaSync: options.metaSync,
 		logger: options.logger,
 		now: options.now
 	});
+	const depositClaimer = new DepositClaimer({
+		transactions,
+		spark: controller,
+		networks,
+		logger: options.logger
+	});
+	const connections = new ConnectionController({
+		openStore: options.openStore,
+		random: options.random,
+		now: options.now,
+		logger: options.logger,
+		allowLocalhost: options.allowLocalhostOrigins ?? false,
+		selectedGroup: () => accounts.getState().selected ?? void 0,
+		evmAddress: async (group, network) => {
+			const account = await chains(options.wallet).account({
+				...group,
+				template: "evm.bip44",
+				network
+			});
+			if (!("address" in account)) throw new Error("no EVM address for the group");
+			return account.address;
+		},
+		enabledNetworks: () => networks.enabled("evm"),
+		invalidate: (origin) => {
+			requests.invalidateOrigin(origin);
+		}
+	});
+	const eip1193 = new Eip1193Handler({
+		connections,
+		requests,
+		networks,
+		defaultNetwork: () => networks.enabled("evm")[0] ?? "eip155:1"
+	});
 	let chain = Promise.resolve();
 	let store;
 	let started = false;
@@ -5257,12 +7259,20 @@ function createWalletEngine(options) {
 			backup.trigger();
 			await accounts.init();
 			await controller.init();
+			await addressBook.init();
 			await metaSync.init();
 			await networks.init();
 			await assets.init();
 			await transactions.init();
+			await requests.init();
+			await connections.init();
+			depositClaimer.start();
 		} else if (!unlocked && started) {
 			started = false;
+			depositClaimer.stop();
+			connections.lock();
+			requests.lock();
+			addressBook.lock();
 			transactions.lock();
 			assets.lock();
 			networks.lock();
@@ -5302,20 +7312,18 @@ function createWalletEngine(options) {
 		networks,
 		assets,
 		transactions,
+		requests,
+		addressBook,
+		connections,
+		eip1193,
 		spark: controller,
 		accounts,
 		metaSync,
 		backup,
-		zaps: {
-			prepare: async (params) => prepareZap(params, {
-				fetch: options.fetch,
-				now: options.now
-			}),
-			pay: async (account, prepared, payOptions) => payZap(controller, account, prepared, {
-				...payOptions,
-				now: options.now
-			})
-		},
+		zaps: { prepare: async (params) => prepareZap(params, {
+			fetch: options.fetch,
+			now: options.now
+		}) },
 		payments: {
 			parse: (input, network) => parsePayment(input, {
 				network,
@@ -5326,7 +7334,7 @@ function createWalletEngine(options) {
 				now: options.now(),
 				fetch: options.fetch
 			}),
-			pay: async (params) => pay({
+			withdrawLnurl: async (params) => withdrawLnurl({
 				spark: controller,
 				fetch: options.fetch,
 				now: options.now
@@ -5335,8 +7343,7 @@ function createWalletEngine(options) {
 		unsubscribe
 	};
 }
-//#endregion
-//#region src/backup/memory.ts
+// src/backup/memory.ts
 const tick = Promise.resolve();
 /** In-memory CloudStore for tests and the playground; swap the Map for cross-engine sharing. */
 function createMemoryCloudStore(backing) {
@@ -5368,7 +7375,6 @@ function createMemoryCloudStore(backing) {
 		}
 	};
 }
-//#endregion
-export { AccountTreeController, AccountTreeError, BackupController, BackupControllerError, Controller, EngineStoreError, MetaSyncController, MetaSyncError, PaymentError, SparkController, SparkControllerError, createEventBus, createMemoryCloudStore, createMemoryEngineStore, createWalletEngine, decodeExitChain, encodeExitChain, parsePayment, payZap, prepareZap, resolvePayment, sparkStore };
+export { AccountTreeController, AccountTreeError, AddressBookController, AddressBookError, BackupController, BackupControllerError, ConnectionController, Controller, Eip1193Handler, EngineStoreError, MetaSyncController, MetaSyncError, PaymentError, ProviderError, REQUEST_TTL_MS, RequestController, SparkController, SparkControllerError, createEventBus, createMemoryCloudStore, createMemoryEngineStore, createWalletEngine, decodeExitChain, encodeExitChain, parsePayment, prepareZap, resolvePayment, sparkStore };
 
 //# sourceMappingURL=index.mjs.map