@totalis/hip4-client 0.65.2 → 0.73.0

package/dist/stream.d.ts

@@ -64,12 +64,18 @@ type Listeners = {
     frame: (frame: StreamFrame) => void;
     error: (error: unknown) => void;
 };
-/** The server closed the stream with a NEVER reason (for example SUBSCRIPTION_DENIED); it will not reconnect. */
+/**
+ * The stream closed for good: the server's NEVER reason (for example
+ * SUBSCRIPTION_DENIED or STREAM_REPLACED), or `closed` after `close()`. It
+ * will not reconnect. `commandSent`: it cut off a follow of a command already
+ * sent, which may still execute.
+ */
 export declare class StreamClosedError extends Error {
     readonly reason: string;
     readonly closeCode: number;
+    readonly commandSent: boolean;
     readonly name = "StreamClosedError";
-    constructor(reason: string, closeCode: number);
+    constructor(reason: string, closeCode: number, commandSent?: boolean);
 }
 /** The account and maker stream subprotocol. */
 export declare const realtimeProtocol = "totalis.realtime.v2";
@@ -95,6 +101,7 @@ export declare class TotalisStream {
     /** The last applied cursor. Persist it to resume after a restart. */
     cursor: RealtimeCursor | undefined;
     private clockOffsetMs;
+    private closedWith;
     private socket;
     private attempt;
     private nextDelayMs;
@@ -109,6 +116,8 @@ export declare class TotalisStream {
     on<K extends keyof Listeners>(type: K, listener: Listeners[K]): () => void;
     start(): this;
     close(): void;
+    /** Why the stream closed for good, as an error; `commandSent` marks a follow of a command already sent. */
+    closeError(commandSent?: boolean): StreamClosedError;
     /** The venue clock in ms, from the last subscription response or publication checkpoint's `server_time`. */
     serverNow(): number;
     /** Resolves once the stream is live (starting it if needed); rejects if it closes for good. */

package/dist/stream.js

@@ -4,15 +4,22 @@ import { backoffDelay } from "./request.js";
 const inBrowser = () => typeof globalThis.document !== "undefined";
 // Node's WebSocket (undici) and Bun accept `{ protocols, headers }` in place of protocols.
 const openWebSocket = (url, protocols, headers) => inBrowser() ? new WebSocket(url, protocols) : new WebSocket(url, { protocols, headers });
-/** The server closed the stream with a NEVER reason (for example SUBSCRIPTION_DENIED); it will not reconnect. */
+/**
+ * The stream closed for good: the server's NEVER reason (for example
+ * SUBSCRIPTION_DENIED or STREAM_REPLACED), or `closed` after `close()`. It
+ * will not reconnect. `commandSent`: it cut off a follow of a command already
+ * sent, which may still execute.
+ */
 export class StreamClosedError extends Error {
     reason;
     closeCode;
+    commandSent;
     name = "StreamClosedError";
-    constructor(reason, closeCode) {
+    constructor(reason, closeCode, commandSent = false) {
         super(`stream closed: ${reason || closeCode}`);
         this.reason = reason;
         this.closeCode = closeCode;
+        this.commandSent = commandSent;
     }
 }
 /** The account and maker stream subprotocol. */
@@ -50,6 +57,7 @@ export class TotalisStream {
     /** The last applied cursor. Persist it to resume after a restart. */
     cursor;
     clockOffsetMs = 0;
+    closedWith;
     socket;
     attempt = 0;
     nextDelayMs;
@@ -83,6 +91,10 @@ export class TotalisStream {
         this.socket = undefined;
         socket?.close(1000);
     }
+    /** Why the stream closed for good, as an error; `commandSent` marks a follow of a command already sent. */
+    closeError(commandSent = false) {
+        return new StreamClosedError(this.closedWith?.reason ?? "closed", this.closedWith?.code ?? 1000, commandSent);
+    }
     /** The venue clock in ms, from the last subscription response or publication checkpoint's `server_time`. */
     serverNow() {
         return Date.now() + this.clockOffsetMs;
@@ -115,7 +127,7 @@ export class TotalisStream {
                 if (value !== undefined)
                     done(() => resolve(value));
                 else if (this.status === "closed")
-                    done(() => reject(new StreamClosedError("closed", 1000)));
+                    done(() => reject(this.closeError()));
             };
             const abort = () => done(() => reject(signal?.reason));
             if (signal?.aborted)
@@ -281,8 +293,9 @@ export class TotalisStream {
         // A renewable session may retry a revoked credential once with a fresh token.
         const renew = reason === "AUTHORIZATION_REVOKED" && typeof this.options.accessToken === "function" && !this.reauthorized;
         if (retry === "NEVER" && !renew) {
+            this.closedWith = { reason, code };
             this.close();
-            this.emit("error", new StreamClosedError(reason, code));
+            this.emit("error", this.closeError());
             return;
         }
         if (renew)

package/dist/totalis.d.ts

@@ -115,8 +115,11 @@ export type SignedAcceptance = SignedEntry | SignedCashout;
 /** Awaited with an entry record whose `bridgeState` changed; persist it over the stored one. */
 export type RecordListener = (record: SignedEntry) => void | Promise<void>;
 /**
- * Where an acceptance ended. `ACCEPTED` carries `operationId`; `NOT_ADMITTED`
- * means the venue never took the accept and nothing traded. `bridged` is set
+ * Where an acceptance ended. `ACCEPTED` carries `operationId`; so do
+ * `FILLED` (it committed) and `FAILED` (it reverted or expired unexecuted;
+ * the operation's `failure_reason` says why when it is known), which a later read, such as
+ * `recoverAcceptance`'s, can return. `NOT_ADMITTED` means the venue never
+ * took the accept and nothing traded. `bridged` is set
  * for an entry whose bridge was sent: unless its operation `COMMITTED`, that
  * cash is in the HyperEVM wallet, not on HyperCore. `bridging` is set when
  * this call sent the bridge, which never holds up the result.
@@ -130,6 +133,7 @@ export type AcceptanceResult = {
     readonly status: (Acceptance | NotAdmitted)["status"];
     readonly operationId: string | undefined;
     readonly outcome: Acceptance | NotAdmitted;
+    /** Read as the bridge stands now: `landed` turns `yes` once Hyperliquid's `ok` is recorded, and a bridge refused or discarded unsent reads undefined. */
     readonly bridged?: BridgedCash;
     /**
      * Hyperliquid's answer to the bridge, once `onRecord` has recorded it;
@@ -145,15 +149,17 @@ export type AcceptanceResult = {
  * `CORE_MOVE_MISSED`: it fell short with Core cash planned to cover it that
  * Hyperliquid never confirmed moving in time (never sent, discarded, refused,
  * or sent without an `ok`); that cash is on HyperCore or, if `bridged`, in
- * the wallet.
+ * the wallet. Any other value is the operation's own `failure_reason`, such as
+ * `DEADLINE_BEFORE_CLAIM` when the venue reached it too late; nothing traded
+ * and its cash stayed where it was.
  */
-export type EntryFailure = "INSUFFICIENT_CASH" | "CORE_MOVE_MISSED";
+export type EntryFailure = "CORE_MOVE_MISSED" | NonNullable<Operation["failure_reason"]>;
 /**
- * An entry's `EntryFailure`; undefined unless its operation ended with
- * `failure_reason` `INSUFFICIENT_CASH`. Pass the record as `onRecord` last
- * handed it back (or `openPosition`'s `record`): only `LANDED` shows the Core
- * cash moved before `fund_by`. `PROCESSED` only says the nonce is spent, which
- * a refused or expired send also does, so it does not show the move.
+ * An entry's `EntryFailure`; undefined unless its operation ended with a
+ * `failure_reason`. Pass the record as `onRecord` last handed it back (or
+ * `openPosition`'s `record`): only `LANDED` shows the Core cash moved before
+ * `fund_by`. `PROCESSED` only says the nonce is spent, which a refused or
+ * expired send also does, so it does not show the move.
  */
 export declare function entryFailure(record: SignedEntry | LegacySignedEntry, operation: Pick<Operation, "failure_reason">): EntryFailure | undefined;
 /** When an entry quote stops being acceptable, in ms on the venue clock: its `accept_before`. A quote without a readable one never is. */
@@ -166,8 +172,11 @@ export declare function acceptBefore(quote: EntryQuote): number;
 export type Chooser<Offer> = (offers: readonly Offer[], serverNowMs: number) => Offer | undefined;
 /** The highest payout among quotes still before their `accept_before` (ties go to the earliest). */
 export declare function bestQuote(): Chooser<EntryQuote>;
-/** The highest price with at least `minLifeSeconds` left: execution needs 20 s after confirmation. */
-export declare function bestBid(minLifeSeconds?: number): Chooser<CashoutBid>;
+/**
+ * The highest price with at least `minLifeSeconds` left (execution needs 20 s
+ * after confirmation) and, given `minPrice` in USDC base units, no lower than it.
+ */
+export declare function bestBid(minLifeSeconds?: number, minPrice?: bigint): Chooser<CashoutBid>;
 export type TotalisOptions = Omit<ApiClientOptions, "accessToken"> & {
     readonly environment: PublicEnvironment;
     /** The WebSocket origin for the stream. Defaults to `baseUrl` if set, else the environment's stream host (`wss://hip4-ws.totalis.trade` in production). */
@@ -259,6 +268,7 @@ export declare function createTotalis(options: TotalisOptions): {
             readonly expiry: import("./generated/openapi.js").components["schemas"]["UInt64String"];
             readonly salt: import("./generated/openapi.js").components["schemas"]["Uint256"];
         };
+        bridged: BridgedCash | undefined;
         record: SignedEntry;
         acceptanceId: string;
         rfqId: string;
@@ -267,7 +277,6 @@ export declare function createTotalis(options: TotalisOptions): {
         status: (Acceptance | NotAdmitted)["status"];
         operationId: string | undefined;
         outcome: Acceptance | NotAdmitted;
-        bridged?: BridgedCash;
         bridging?: Promise<HypercoreAnswer>;
     }>;
     cashOut: (request: {
@@ -365,6 +374,60 @@ export declare function createTotalis(options: TotalisOptions): {
             };
         };
     }>;
+    signRunOffClaim: (request: {
+        readonly vaultAddress: string;
+        readonly claimId?: string;
+    }) => Promise<{
+        claimId: string;
+        account: `0x${string}`;
+        body: {
+            readonly schema_version: 1;
+            readonly request_id: import("./generated/openapi.js").components["schemas"]["Uuid"];
+            readonly sent_at: import("./generated/openapi.js").components["schemas"]["$defs-Timestamp"];
+            readonly command: {
+                readonly vault_address: import("./generated/openapi.js").components["schemas"]["LowercaseNonZeroAddress"];
+                readonly account: import("./generated/openapi.js").components["schemas"]["LowercaseNonZeroAddress"];
+                readonly to: import("./generated/openapi.js").components["schemas"]["LowercaseNonZeroAddress"];
+                readonly amount: import("./generated/openapi.js").components["schemas"]["$defs-Amount"];
+                readonly expiry: import("./generated/openapi.js").components["schemas"]["UInt64String"];
+                readonly salt: import("./generated/openapi.js").components["schemas"]["Uint"];
+                readonly signature: import("./generated/openapi.js").components["schemas"]["ContractSignature"];
+            };
+        };
+    }>;
+    sendRunOffClaim: (signed: Awaited<ReturnType<(request: {
+        readonly vaultAddress: string;
+        readonly claimId?: string;
+    }) => Promise<{
+        claimId: string;
+        account: `0x${string}`;
+        body: {
+            readonly schema_version: 1;
+            readonly request_id: import("./generated/openapi.js").components["schemas"]["Uuid"];
+            readonly sent_at: import("./generated/openapi.js").components["schemas"]["$defs-Timestamp"];
+            readonly command: {
+                readonly vault_address: import("./generated/openapi.js").components["schemas"]["LowercaseNonZeroAddress"];
+                readonly account: import("./generated/openapi.js").components["schemas"]["LowercaseNonZeroAddress"];
+                readonly to: import("./generated/openapi.js").components["schemas"]["LowercaseNonZeroAddress"];
+                readonly amount: import("./generated/openapi.js").components["schemas"]["$defs-Amount"];
+                readonly expiry: import("./generated/openapi.js").components["schemas"]["UInt64String"];
+                readonly salt: import("./generated/openapi.js").components["schemas"]["Uint"];
+                readonly signature: import("./generated/openapi.js").components["schemas"]["ContractSignature"];
+            };
+        };
+    }>>>) => Promise<{
+        readonly vault_address: import("./generated/openapi.js").components["schemas"]["LowercaseNonZeroAddress"];
+        readonly operation: {
+            readonly operation_id: import("./generated/openapi.js").components["schemas"]["Bytes32"];
+            readonly kind: string;
+            readonly amount: import("./generated/openapi.js").components["schemas"]["$defs-Amount"] | null;
+            readonly status: import("./generated/openapi.js").components["schemas"]["OperationState"];
+            readonly transaction_hash: import("./generated/openapi.js").components["schemas"]["Bytes32"] | null;
+            readonly failure_reason?: import("./generated/openapi.js").components["schemas"]["OperationFailureReason"];
+            readonly created_at: import("./generated/openapi.js").components["schemas"]["$defs-Timestamp"];
+            readonly updated_at: import("./generated/openapi.js").components["schemas"]["$defs-Timestamp"];
+        };
+    }>;
     sendCoreExit: (signed: {
         exitId: string;
         account: `0x${string}`;

package/dist/totalis.js

@@ -4,9 +4,9 @@ import { audienceClient, headerRecord } from "./base.js";
 import { bridgeAction, bridgeGasBuffer, hyperliquidExchange, hyperliquidNetwork, settleHypercore, signSendAsset, usdcUnits, } from "./hypercore.js";
 import { BalanceUnknownError, EntryError, ExitUnavailableError, normalizeError } from "./flow-errors.js";
 import { spendableCash } from "./money.js";
-import { ApiError, backoffDelay, envelope, NetworkError, randomBytes32, resendable, sendOnce, singleFetch, sleep, unwrap, uuidv7 } from "./request.js";
+import { ApiError, backoffDelay, envelope, NetworkError, randomBytes32, resendable, retryingFetch, sendOnce, singleFetch, sleep, unwrap, uuidv7 } from "./request.js";
 import { toTotalisSigner } from "./signer.js";
-import { StreamClosedError, TotalisStream } from "./stream.js";
+import { TotalisStream } from "./stream.js";
 import { address, cashoutTransferTypedData, exitTypedData, receiveWithAuthorizationTypedData, sellBackTypedData, takerAcceptTypedData, payoutNonce, transferWithAuthorizationTypedData, } from "./typed-data.js";
 /**
  * What an entry's bridge may have moved to its wallet, by its state: nothing
@@ -21,15 +21,15 @@ function bridgedCash(signed) {
     return landed === undefined ? undefined : { amount: usdcUnits(signed.bridge.action.amount).toString(), landed };
 }
 /**
- * An entry's `EntryFailure`; undefined unless its operation ended with
- * `failure_reason` `INSUFFICIENT_CASH`. Pass the record as `onRecord` last
- * handed it back (or `openPosition`'s `record`): only `LANDED` shows the Core
- * cash moved before `fund_by`. `PROCESSED` only says the nonce is spent, which
- * a refused or expired send also does, so it does not show the move.
+ * An entry's `EntryFailure`; undefined unless its operation ended with a
+ * `failure_reason`. Pass the record as `onRecord` last handed it back (or
+ * `openPosition`'s `record`): only `LANDED` shows the Core cash moved before
+ * `fund_by`. `PROCESSED` only says the nonce is spent, which a refused or
+ * expired send also does, so it does not show the move.
  */
 export function entryFailure(record, operation) {
     if (operation.failure_reason !== "INSUFFICIENT_CASH")
-        return undefined;
+        return operation.failure_reason;
     if (record.bridge === undefined || "version" in record && record.bridgeState === "LANDED")
         return "INSUFFICIENT_CASH";
     return "CORE_MOVE_MISSED";
@@ -96,13 +96,15 @@ export function bestQuote() {
         .filter((quote) => acceptBefore(quote) > now)
         .reduce((best, quote) => best === undefined || BigInt(quote.entry.payout) > BigInt(best.entry.payout) ? quote : best, undefined);
 }
-/** The highest price with at least `minLifeSeconds` left: execution needs 20 s after confirmation. */
-export function bestBid(minLifeSeconds = 25) {
+/**
+ * The highest price with at least `minLifeSeconds` left (execution needs 20 s
+ * after confirmation) and, given `minPrice` in USDC base units, no lower than it.
+ */
+export function bestBid(minLifeSeconds = 25, minPrice) {
     return (bids, now) => bids
-        .filter((bid) => Number(termsOf(bid).expiry) * 1000 - now >= minLifeSeconds * 1000)
+        .filter((bid) => Number(termsOf(bid).expiry) * 1000 - now >= minLifeSeconds * 1000 && (minPrice === undefined || BigInt(termsOf(bid).price) >= minPrice))
         .reduce((best, bid) => best === undefined || BigInt(termsOf(bid).price) > BigInt(termsOf(best).price) ? bid : best, undefined);
 }
-const now = () => Math.floor(Date.now() / 1000);
 /** ABI calldata for a call whose arguments are all static words (addresses and integers). */
 function callData(signature, ...words) {
     const selector = Array.from(keccak_256(new TextEncoder().encode(signature)).slice(0, 4), (byte) => byte.toString(16).padStart(2, "0")).join("");
@@ -191,7 +193,11 @@ function recoveryReads(stream, read, onValue, fail, stop, retry = {}) {
 export function follow(stream, read, done, wake, signal, retry) {
     return followUntil(stream, read, done, wake, () => undefined, signal, retry);
 }
-function followUntil(stream, read, done, wake, recheckMs, signal, retry) {
+/** `follow` of a command already sent: a stream closed for good rejects with `commandSent`, as the command may still execute. */
+function followSent(stream, read, done, wake, signal, retry) {
+    return followUntil(stream, read, done, wake, () => undefined, signal, retry, true);
+}
+function followUntil(stream, read, done, wake, recheckMs, signal, retry, commandSent = false) {
     stream.start();
     return new Promise((resolve, reject) => {
         const stop = new AbortController();
@@ -220,18 +226,21 @@ function followUntil(stream, read, done, wake, recheckMs, signal, retry) {
         const abort = () => finish(() => reject(signal?.reason));
         if (signal?.aborted)
             return abort();
+        // A stream already closed for good never reports it again.
+        if (stream.status === "closed")
+            return finish(() => reject(stream.closeError(commandSent)));
         signal?.addEventListener("abort", abort, { once: true });
         offs.push(stream.on("event", (event) => void (wake(event) && check())), stream.on("status", (status) => {
             if (status === "live")
                 void check();
             else if (status === "closed")
-                finish(() => reject(new StreamClosedError("closed", 1000)));
+                finish(() => reject(stream.closeError(commandSent)));
         }));
         void check();
     });
 }
 // An RFQ that ends drops its quotes too, so rendered quotes empty with it.
-const rfqEnded = (event) => event.event_type === "RFQ_CANCELLED" || event.event_type === "RFQ_FAILED" || event.event_type === "RFQ_ACCEPTED";
+const rfqEnded = (event) => event.event_type === "RFQ_CANCELLED" || event.event_type === "RFQ_FAILED" || event.event_type === "RFQ_ACCEPTED" || event.event_type === "RFQ_DECLINED";
 const quotesChanged = (rfqId) => (event) => (event.event_type === "QUOTE_CREATED" || event.event_type === "QUOTE_REMOVED" || rfqEnded(event)) && event.payload.rfq_id === rfqId;
 /** The venue refuses to accept a cash-out quote with this much signed life left or less. */
 const cashoutAcceptLifeMs = 22_000;
@@ -314,8 +323,18 @@ export function createTotalis(options) {
         ...(clientOptions.baseUrl === undefined ? {} : { baseUrl: clientOptions.baseUrl }),
         ...(streamBaseUrl === undefined ? {} : { streamBaseUrl }),
     });
+    // Signing windows (deposit, withdrawal, exit) are judged by the venue, so they are set on its clock once the stream has synced. Signing never waits for the stream, so a window signed before its first sync is on the device clock.
+    const now = () => Math.floor(stream.serverNow() / 1000);
     const retry = clientOptions.retry || undefined;
     const recoveryFetch = singleFetch(clientOptions.fetch);
+    const countedFetch = (sending) => {
+        const base = clientOptions.fetch ?? ((request) => globalThis.fetch(request));
+        const counted = (request) => {
+            sending();
+            return base(request);
+        };
+        return clientOptions.retry === false ? counted : retryingFetch(counted, clientOptions.retry);
+    };
     const signer = signerInput === undefined ? undefined : toTotalisSigner(signerInput);
     const requireSigner = () => signer ?? Promise.reject(new Error("this flow needs a signer"));
     let deploymentRead;
@@ -476,13 +495,15 @@ export function createTotalis(options) {
             throw new Error(`the venue answered for acceptance ${acceptance.acceptance_id} on quote ${acceptance.quote_id}, not this record's`);
         }
     }
-    const resultOf = (signed, outcome, bridge) => ({
-        acceptanceId: signed.acceptanceId, rfqId: signed.rfqId, quoteId: signed.quoteId,
-        positionId: signed.kind === "ENTRY" ? signed.quoteId : signed.positionId,
-        status: outcome.status, operationId: outcome.status === "NOT_ADMITTED" ? undefined : outcome.operation_id, outcome,
-        ...(bridge.bridged === undefined ? {} : { bridged: bridge.bridged }),
-        ...(bridge.bridging === undefined ? {} : { bridging: bridge.bridging }),
-    });
+    const resultOf = (signed, outcome, bridge) => {
+        const result = {
+            acceptanceId: signed.acceptanceId, rfqId: signed.rfqId, quoteId: signed.quoteId,
+            positionId: signed.kind === "ENTRY" ? signed.quoteId : signed.positionId,
+            status: outcome.status, operationId: outcome.status === "NOT_ADMITTED" ? undefined : outcome.operation_id, outcome,
+            ...(bridge.bridging === undefined ? {} : { bridging: bridge.bridging }),
+        };
+        return bridge.bridged?.() === undefined ? result : Object.defineProperty(result, "bridged", { get: bridge.bridged, enumerable: true });
+    };
     /** A bridge this SDK signed and never sent, which may go only before `fund_by`. */
     const bridgeUnsent = (signed) => signed.kind === "ENTRY" && "version" in signed && signed.bridge !== undefined && signed.bridgeState === undefined;
     /** Record a never-sent bridge as discarded. Recovery derives the discard from the acceptance again, so a failed save loses nothing. */
@@ -512,19 +533,19 @@ export function createTotalis(options) {
         if (signed.kind !== "ENTRY" || signed.bridge === undefined)
             return {};
         if (!("version" in signed))
-            return { bridged: bridgedCash(signed) };
+            return { bridged: () => bridgedCash(signed) };
         const { bridge, bridgeState } = signed;
         if (bridgeState !== undefined && bridgeState !== "SENT")
-            return { bridged: bridgedCash(signed) };
+            return { bridged: () => bridgedCash(signed) };
         const ours = outcome.status === "NOT_ADMITTED" || outcome.acceptance_id === signed.acceptanceId;
         if (!ours && bridgeState === "SENT")
-            return { bridged: bridgedCash(signed) };
+            return { bridged: () => bridgedCash(signed) };
         const until = ours && outcome.status === "ACCEPTED" ? fundBy(outcome) : undefined;
         if (until === undefined || clock.latest() >= until) {
             if (ours && outcome.status === "PENDING_CONFIRM")
                 return {};
             await discardBridge(signed, options.onRecord);
-            return { bridged: bridgedCash(signed) };
+            return { bridged: () => bridgedCash(signed) };
         }
         const sent = { ...signed, bridgeState: "SENT" };
         if (bridgeState === undefined) {
@@ -543,16 +564,21 @@ export function createTotalis(options) {
         }
         const transport = options.transport ?? defaultTransport;
         let attempted = false;
+        let latest = sent;
         const bridging = settleHypercore(bridge, { transport: (action, signal) => { attempted = true; return transport(action, signal); }, deadline: until, now: clock.latest })
             .then(async (answer) => {
-            if (answer.kind !== "unknown")
-                await options.onRecord?.({ ...sent, bridgeState: answered[answer.kind] });
-            else if (!attempted && bridgeState === undefined)
+            if (answer.kind !== "unknown") {
+                latest = { ...sent, bridgeState: answered[answer.kind] };
+                await options.onRecord?.(latest);
+            }
+            else if (!attempted && bridgeState === undefined) {
+                latest = { ...signed, bridgeState: "DISCARDED" };
                 await saveDiscard(signed, options.onRecord);
+            }
             return answer;
         });
         bridging.catch(() => undefined);
-        return { bridged: bridgedCash(sent), bridging };
+        return { bridged: () => bridgedCash(latest), bridging };
     }
     /** The signer, account and deployment a new record is signed under. */
     async function recordScope() {
@@ -561,9 +587,11 @@ export function createTotalis(options) {
         const chain = await deployment();
         return { signer, account, chain, scope: { account, chainId: chain.chain_id, vault: address(chain.vault_address.toLowerCase()) } };
     }
+    /** A stored record signs nothing more, so without a signer the session's wallet (GET /v1/me) stands for the account. */
     async function checkScope(signed) {
-        const { scope } = await recordScope();
-        if (scope.account !== signed.account || scope.chainId !== signed.chainId || scope.vault !== signed.vault) {
+        const account = signer === undefined ? unwrap(await client.GET("/v1/me")).wallet : await signer.address();
+        const chain = await deployment();
+        if (account !== signed.account || chain.chain_id !== signed.chainId || address(chain.vault_address.toLowerCase()) !== signed.vault) {
             throw new Error("this acceptance was signed by another wallet or on another deployment");
         }
     }
@@ -691,20 +719,31 @@ export function createTotalis(options) {
             }, () => undefined);
         }
         let outcome;
+        let sends = 0;
+        const fetch = countedFetch(() => { sends += 1; });
+        const post = () => client.POST("/v1/quotes/{quote_id}/accept", { params: { path: { quote_id: signed.quoteId }, header: idempotency(signed.acceptanceId) }, body: signed.command, fetch });
         try {
             const stamped = clock.sending();
-            const answer = await sendOnce(() => client.POST("/v1/quotes/{quote_id}/accept", { params: { path: { quote_id: signed.quoteId }, header: idempotency(signed.acceptanceId) }, body: signed.command }));
+            const answer = await sendOnce(post);
             checkEcho(signed, answer, true);
             stamped(answer.server_time);
             outcome = answer;
         }
         catch (error) {
-            if (!(error instanceof NetworkError)) {
+            // A resend's refusal answers for an earlier send whose answer was lost only if the venue checks it after replaying a stored acceptance (a gone price, a bad signature). The session (401, 403) and the quota (429) are checked before the replay, and a 5xx or a cut-off body is no answer, so those read the acceptance.
+            const replayed = error instanceof ApiError && error.status >= 400 && error.status < 500 && ![401, 403, 429].includes(error.status);
+            if (!(error instanceof NetworkError) && (sends <= 1 || replayed)) {
                 if (!normalizeError(error).mayStillRun)
                     await discardBridge(signed, options.onRecord);
                 throw error;
             }
-            outcome = await fenceAcceptance(signed, clock, error, true, bridgeUnsent(signed));
+            const lost = error instanceof NetworkError ? error : Object.assign(new NetworkError({ method: "POST", url: `/v1/quotes/${signed.quoteId}/accept` }, { cause: error }), { resend: () => sendOnce(post) });
+            // A read refused too (the same lapsed session) leaves the outcome unknown: the bridge stays unsent and the error says the accept may still run.
+            outcome = await fenceAcceptance(signed, clock, lost, true, bridgeUnsent(signed)).catch((failed) => {
+                if (failed instanceof ApiError && failed.resend === undefined)
+                    failed.resend = () => sendOnce(post);
+                throw failed;
+            });
         }
         return resultOf(signed, outcome, await moveBridge(signed, outcome, clock, options));
     }
@@ -738,12 +777,15 @@ export function createTotalis(options) {
      * Open a combo position: create the RFQ, take a quote from those the stream
      * pushes, sign it (`signEntry`), hand the record to `onSigned` to persist,
      * then `sendAcceptance`. Returns the acceptance's status (`ACCEPTED` with
-     * `operationId`, `DECLINED` / `TIMED_OUT` / `CANCELLED`, or `NOT_ADMITTED`
-     * when a lost accept never arrived). The position opens under `positionId`,
-     * the quote's ID, once `waitForOperation(operationId)` resolves `COMMITTED`;
-     * pass its operation and the result's `record` to `entryFailure` to name a
-     * failure. Any vault shortfall is funded from the wallet, and from `core`
-     * by bridge, unless `funding` says otherwise.
+     * `operationId`; `FILLED` or `FAILED`, also with it, when a lost answer was
+     * read after the trade settled; `DECLINED` / `TIMED_OUT` / `CANCELLED`; or
+     * `NOT_ADMITTED` when a lost accept never arrived). The position opens
+     * under `positionId`, the quote's ID, once `waitForOperation(operationId)`
+     * resolves `COMMITTED`; pass its operation and the result's `record` to
+     * `entryFailure` to name a failure. Any vault shortfall is funded from the
+     * wallet, and from `core` by bridge, unless `funding` says otherwise. An accept refused with
+     * `QUOTE_EXPIRED` or `QUOTE_REPLACED` takes and signs a fresh quote once
+     * (`onSigned` gets the new record); a second refusal is thrown.
      */
     async function openPosition(request) {
         const { legs, stake, choose = bestQuote(), collectMs = defaultCollectMs, funding = "wallet", intent, quoteTimeoutMs = 20_000, signal } = request;
@@ -759,16 +801,18 @@ export function createTotalis(options) {
         const matches = (quote) => quote.kind === "ENTRY" && quote.rfq_id === rfqId &&
             quote.entry.taker.toLowerCase() === wanted.taker && quote.entry.stake === wanted.stake &&
             JSON.stringify(quote.entry.legs.map(({ outcome_id, side }) => ({ outcome_id, side }))) === JSON.stringify(wanted.legs);
-        const { selected, signed } = await signedOrCancel(rfqId, async () => {
-            const selected = await awaitOffer(rfqId, matches, choose, collectMs, quoteTimeoutMs, signal);
-            if (!matches(selected))
+        const take = (refused) => signedOrCancel(rfqId, async () => {
+            const offered = (quote) => matches(quote) && quote.quote_id !== refused;
+            const selected = await awaitOffer(rfqId, offered, choose, collectMs, quoteTimeoutMs, signal);
+            if (!offered(selected))
                 throw new Error("the chosen quote is not for the requested position");
             const signed = await signEntryWith({ quote: selected, core: request.core, cash: request.cash ?? await reading, sourceDex: request.sourceDex }, funding === "wallet" ? "plan" : funding);
             await request.onSigned?.(signed);
             return { selected, signed };
         });
+        let { selected, signed } = await take();
         let record = signed;
-        const result = await sendAcceptance(signed, {
+        const send = () => sendAcceptance(signed, {
             ...(request.transport === undefined ? {} : { transport: request.transport }),
             ...(signal === undefined ? {} : { signal }),
             onRecord: async (next) => {
@@ -776,9 +820,26 @@ export function createTotalis(options) {
                 await request.onSigned?.(next);
             },
         });
+        let result;
+        try {
+            result = await send();
+        }
+        catch (error) {
+            if (!(error instanceof ApiError) || error.code !== "QUOTE_EXPIRED" && error.code !== "QUOTE_REPLACED")
+                throw error;
+            // The quote went away before the accept (sendAcceptance discarded its bridge): sign a fresh one, once. No fresh quote in time is still that refusal.
+            ({ selected, signed } = await take(signed.quoteId).catch((retried) => Promise.reject(retried instanceof Error && retried.name === "TimeoutError" ? error : retried)));
+            record = signed;
+            result = await send();
+        }
+        const { bridged: _bridged, ...settled } = result;
         return {
-            ...result,
+            ...settled,
             entry: selected.entry,
+            /** As in `AcceptanceResult`, read as the bridge stands now. */
+            get bridged() {
+                return result.bridged;
+            },
             /** The entry record as it stands now, with each bridge update `onSigned` gets: pass it to `entryFailure`. */
             get record() {
                 return record;
@@ -826,7 +887,7 @@ export function createTotalis(options) {
      */
     function waitForOperation(operationId, signal) {
         const terminal = new Set(["COMMITTED", "REVERTED", "EXPIRED_UNEXECUTED"]);
-        return follow(stream, async (stop) => unwrap(await client.GET("/v1/me/operations/{operation_id}", { params: { path: { operation_id: operationId } }, signal: stop, fetch: recoveryFetch })).operation, (operation) => terminal.has(operation.status), (event) => event.event_type === "VAULT_BALANCE_CHANGED" ||
+        return followSent(stream, async (stop) => unwrap(await client.GET("/v1/me/operations/{operation_id}", { params: { path: { operation_id: operationId } }, signal: stop, fetch: recoveryFetch })).operation, (operation) => terminal.has(operation.status), (event) => event.event_type === "VAULT_BALANCE_CHANGED" ||
             (event.event_type === "OPERATION_UPDATED" && event.payload.operation_id === operationId && terminal.has(event.payload.status)), signal, retry);
     }
     /**
@@ -919,7 +980,7 @@ export function createTotalis(options) {
                 if (status === "live" && !live)
                     void recover();
                 else if (status === "closed")
-                    finish(() => reject(new StreamClosedError("closed", 1000)));
+                    finish(() => reject(stream.closeError(true)));
                 live = status === "live";
             }));
             for (const withdrawal of known)
@@ -967,7 +1028,8 @@ export function createTotalis(options) {
     }
     /** Follow a withdrawal after a restart: one recovery read (retried while it fails transiently), then the stream. */
     async function waitForWithdrawal(withdrawalId, signal) {
-        await stream.live(signal);
+        // The withdrawal was admitted, so a stream closed for good may still leave it to pay out.
+        await stream.live(signal).catch((error) => Promise.reject(stream.status === "closed" ? stream.closeError(true) : error));
         return followWithdrawal(withdrawalId, [], signal);
     }
     /**
@@ -1007,6 +1069,33 @@ export function createTotalis(options) {
         const body = envelope({ account, to, ...exit, signature, purpose: request.purpose ?? "ORDER", ...(request.activationFeeAccepted ? { activation_fee_accepted: true } : {}) });
         return { exitId, account, body };
     }
+    /**
+     * Sign a claim of the account's free cash in a vault running off (`run_off`
+     * in `GET /v1/me/balances`) without sending it: one Exit for that vault's
+     * domain to the account's own wallet, so the cash lands in Cash. Persist
+     * `{ claimId, body }`, then `sendRunOffClaim` it; a resend sends the same
+     * bytes. A Privy account's run-off cash moves on its own; a wallet-only
+     * account moves at least 1 USDC. A vault with no listed cash throws
+     * `ExitUnavailableError`.
+     */
+    async function signRunOffClaim(request) {
+        const vault = request.vaultAddress.toLowerCase();
+        const cash = unwrap(await client.GET("/v1/me/balances")).run_off.find((item) => item.vault_address === vault);
+        if (cash === undefined || cash.vault_free === "0")
+            throw new ExitUnavailableError();
+        const signer = await requireSigner();
+        const account = address((await signer.address()).toLowerCase());
+        const runOff = { chain_id: (await deployment()).chain_id, vault_address: cash.vault_address };
+        const claimId = request.claimId ?? uuidv7();
+        const exit = { amount: cash.vault_free, expiry: String(now() + 600), salt: BigInt(randomBytes32()).toString() };
+        const signature = await signer.signTypedData(exitTypedData(runOff, { account, to: account, ...exit }));
+        const body = envelope({ vault_address: address(cash.vault_address), account, to: account, ...exit, signature });
+        return { claimId, account, body };
+    }
+    /** POST a signed run-off claim under its claim ID, resending the same bytes on a lost answer. The 202 is admission: follow `operation` with `waitForOperation`. */
+    async function sendRunOffClaim(signed) {
+        return sendOnce(() => client.POST("/v1/me/run-off-claims", { params: { header: { "Idempotency-Key": signed.claimId } }, body: signed.body }));
+    }
     /**
      * POST a signed exit under its exit ID, resending the same bytes on a lost
      * answer. The 202 is admission: follow it with `waitForCoreExit`.
@@ -1096,7 +1185,7 @@ export function createTotalis(options) {
     /** Follow an exit on the stream until its cash is credited on HyperCore; it rejects if the exit ends any other way. */
     async function waitForCoreExit(exitId, signal) {
         const terminal = new Set(["CREDITED", "RECOVERED", "FAILED", "ABANDONED"]);
-        const exit = await follow(stream, async (stop) => unwrap(await client.GET("/v1/core-exits/{exit_id}", { params: { path: { exit_id: exitId } }, signal: stop, fetch: recoveryFetch })), (value) => terminal.has(value.status), (event) => event.event_type === "CORE_EXIT_UPDATED" && event.payload.exit_id === exitId, signal, retry);
+        const exit = await followSent(stream, async (stop) => unwrap(await client.GET("/v1/core-exits/{exit_id}", { params: { path: { exit_id: exitId } }, signal: stop, fetch: recoveryFetch })), (value) => terminal.has(value.status), (event) => event.event_type === "CORE_EXIT_UPDATED" && event.payload.exit_id === exitId, signal, retry);
         if (exit.status !== "CREDITED")
             throw new Error(`core exit ${exitId} ended ${exit.status}, not credited on HyperCore`);
         return exit;
@@ -1139,6 +1228,8 @@ export function createTotalis(options) {
         waitForWithdrawal,
         waitForOperation,
         signCoreExit,
+        signRunOffClaim,
+        sendRunOffClaim,
         sendCoreExit,
         exitToCore,
         waitForCoreExit,