arkade-os/ts-sdk @arkade-os/sdk/0.4.60

on GitHub

What's Changed

This release merges the Arkade Swap feature branch into the SDK, shipping the new @arkade-os/swap package alongside improvements to the VHTLC and contract subsystems.

New Package: @arkade-os/swap

The @arkade-os/swap package is now part of the ts-sdk monorepo. It provides the full RFQ (Request-For-Quote) swap infrastructure:

• Maker-side RFQ — submit intents and manage offer covenants with the contract manager
• Taker-side RFQ — quote, then fill without further server interaction
• Lightning send/receive corridors — drive funded RFQ swaps to completion via RfqSwapManager
• Onchain BTC corridor — onchain HTLC leg for the maker-side RFQ layer
• Nostr RFQ transport — bring Nostr-based RFQ into the package
• Lockup registration — register RFQ lockups before funding, retryable on its own
• Lightning-receive claim — client-side claim driven by the swap manager arm
• Derived secrets — RFQ swap secrets derived from seed instead of stored

VHTLC

• feat(vhtlc): ScriptV2 — a new HTLC construct for swap corridors
• feat(vhtlc): non-interactive claim and refund leaves; packages/swap adopts VHTLC.Script
• fix(vhtlc): nonInteractiveRefund is immediate, gated by server+receiver, not a timelock
• fix(vhtlc): validate P2TR destination scripts by content, not just length
• fix(contracts): refuse an explicit settle of a VHTLC before its refund window opens

Contract System

• feat(contracts): gate generic spending on a per-contract predicate
• feat(contracts): retained-but-unwatched contract watch state
• feat(worker): service-worker bus accepts an intentRepository
• fix(contracts): handlerless contract row no longer fails the whole sync
• fix(contracts): contain a contract whose params its handler rejects
• fix(contracts): PathContext receives the block height it declares
• fix(contracts): judge timelocks by chain time, and CSV per input

SDK Fixes

• fix(sdk): honour withUnrolled in the worker's getVtxos
• fix(sdk): report every spendability exclusion from one snapshot
• fix(sdk): stop a look-ahead drain from outliving dispose()

Security

• fix(swap): closed a nonce-reuse vulnerability in ClaimPacket handling; HTTP transport hardened (class: replay / nonce-reuse; location: packages/swap ClaimPacket path)

Other

• fix(vtxo-manager): price the intent fee in renewVtxos and recoverVtxos
• fix(ts-sdk): declare typescript/tsup as devDependencies for standalone builds
• feat(arkade): pin the emulator co-signer key per network

Full Changelog: https://github.com/arkade-os/ts-sdk/compare/@arkade-os/sdk/0.4.59...@arkade-os/sdk/0.4.60