@arkade-os/sdk 0.4.65 → 0.4.67

package/dist/{index-fDDiA1-L.d.ts → index-BiACuWaf.d.ts}

@@ -1,5 +1,5 @@
-import { bb as ContractHandler, q as RelativeTimelock, bm as Discoverable, V as VtxoScript, r as TapLeafScript, cP as TapscriptDeriving } from './index-CFOMyVMt.js';
-import { D as DefaultVtxo, a as DelegateVtxo } from './delegate-Dv_9OVHv.js';
+import { bg as ContractHandler, s as RelativeTimelock, bs as Discoverable, V as VtxoScript, t as TapLeafScript, d4 as TapscriptDeriving } from './index-DU5o_hz7.js';
+import { D as DefaultVtxo, a as DelegateVtxo } from './delegate-cdmzb2f9.js';
 import { Bytes } from '@scure/btc-signer/utils.js';
 
 /**
@@ -185,6 +185,25 @@ declare namespace VHTLC {
         nonInteractiveRefund?: {
             senderPkScript: Bytes;
             emulatorPubkey: Bytes;
+            /**
+             * Also emit the timelocked twin: `server` plus the SAME
+             * covenant-tweaked co-signer, spendable after `refundLocktime`
+             * with no receiver signature and no sender signature.
+             *
+             * This is the only refund tier that needs nobody: `refund` and
+             * `refundWithoutReceiver` need the sender's key,
+             * `nonInteractiveRefund` needs the receiver's. A sender who
+             * funded a lockup and vanished is refundable through this leaf
+             * alone, by anyone, to their pre-committed address.
+             *
+             * Off by default: it is an additional leaf, appended last, so
+             * enabling it changes the taproot merkle root and therefore the
+             * address. `nonInteractiveClaim` and `nonInteractiveRefund` are
+             * independently optional, so this is the NINTH leaf only in the
+             * full swap-corridor configuration where both are set — on its
+             * own, it is the eighth.
+             */
+            withoutReceiver?: boolean;
         };
         /**
          * Optional: denominate this contract in an Arkade ASSET rather than in
@@ -256,6 +275,8 @@ declare namespace VHTLC {
         readonly nonInteractiveClaimArkadeScript?: Bytes;
         readonly nonInteractiveRefundScript?: string;
         readonly nonInteractiveRefundArkadeScript?: Bytes;
+        readonly nonInteractiveRefundWithoutReceiverScript?: string;
+        readonly nonInteractiveRefundWithoutReceiverArkadeScript?: Bytes;
         protected constructor(options: Options, preimageCondition: (hash: Bytes) => Bytes);
         /** Return the collaborative claim tapleaf script. */
         claim(): TapLeafScript;
@@ -273,6 +294,59 @@ declare namespace VHTLC {
         nonInteractiveClaim(): [TapLeafScript, Bytes];
         /** Return the non-interactive refund tapleaf script as well as the ArkadeScript. */
         nonInteractiveRefund(): [TapLeafScript, Bytes];
+        /**
+         * Return the timelocked non-interactive refund tapleaf and its ArkadeScript.
+         *
+         * SPENDING THIS LEAF, CONCRETELY — confirmed from this SDK's own
+         * emulator client and covenant-spend builder ({@link
+         * EmulatorProvider} in `src/providers/emulator.ts`, and {@link
+         * ArkadeTransactionBuilder} in `src/arkade/contract.ts`), which is
+         * the general machinery every covenant leaf in this file goes
+         * through:
+         *
+         *  1. Build the ark tx spending this leaf (this method's {@link
+         *     TapLeafScript} as `tapLeafScript`, this script's {@link
+         *     VtxoScript.encode} as `tapTree`), plus its checkpoint tx.
+         *  2. Attach the ArkadeScript this method returns to the spent
+         *     input via an `EmulatorPacket` (type 1) — `{ vin, script:
+         *     <this ArkadeScript>, witness: <empty> }`, empty because the
+         *     script pushes its own input/output index with
+         *     `PUSHCURRENTINPUTINDEX` rather than reading one from the
+         *     witness — wrapped in an `Extension` OP_RETURN output on the
+         *     ark tx.
+         *  3. Attach the spent input's OWN creating ark tx as `PrevArkTx` on
+         *     input 0 — required so the emulator can resolve that input's
+         *     prevout pkScript/value; it does not otherwise have them.
+         *  4. POST the (base64-PSBT) ark tx and checkpoint(s) as `{ arkTx,
+         *     checkpointTxs }` to the emulator's `POST /v1/tx`.
+         *
+         * THE COVENANT CHECK the emulator runs against that ArkadeScript —
+         * `enforcePayTo(senderPkScript)`, see that function above — is: the
+         * output at this SAME input's index is a v1 P2TR output paying
+         * `senderPkScript`, with a value at least the input's. Only on that
+         * check passing does the emulator sign for `nirCosigner` (the
+         * `emulatorPubkey` tweaked by this ArkadeScript's hash); the
+         * response carries the fully co-signed `signedArkTx` and
+         * `signedCheckpointTxs` — `ArkadeTransactionBuilder.send()`'s own
+         * comment on this path: "the emulator executes the arkade script
+         * and finalizes with arkd" — no separate call to arkd is made by
+         * this SDK for a covenant spend.
+         * Neither `server` nor `receiver` play any part in that check: this
+         * leaf's tapscript still requires `server`'s own signature
+         * alongside `nirCosigner`'s (see the class doc above), but that is
+         * consensus-level multisig, not something the covenant enforces.
+         *
+         * NOT SPENDABLE UNTIL `refundLocktime` MATURES — the tapscript's
+         * `OP_CHECKLOCKTIMEVERIFY` is arkd's concern, not the emulator's;
+         * the emulator will happily co-sign an immature spend and arkd will
+         * then refuse it. A block-height-typed `refundLocktime` (below the
+         * standard height/timestamp boundary this SDK names
+         * `CLTV_HEIGHT_THRESHOLD`, 500,000,000, in
+         * `src/contracts/handlers/helpers.ts`) is refused by arkd for a
+         * forfeit-eligible leaf independent of maturity — use a
+         * seconds-typed (absolute Unix timestamp) value.
+         */
+        nonInteractiveRefundWithoutReceiver(): [TapLeafScript, Bytes];
     }
     /**
      * Virtual Hash Time Lock Contract (VHTLC) script implementation.
@@ -292,11 +366,30 @@ declare namespace VHTLC {
      *   can push the sender's refund immediately, no timelock, pinned to a
      *   pre-committed destination — recoverable even if the sender's own key
      *   is lost
+     * - **nonInteractiveRefundWithoutReceiver** (optional): server + emulator
+     *   can push the sender's refund after `refundLocktime`, pinned to a
+     *   pre-committed destination — the only refund tier needing no
+     *   participant signature at all
      *
      * See {@link ScriptV2} for the current recommended construction — same
      * leaf ladder, same options shape, an added length check on the claim
      * preimage. This class is unchanged and stays available as-is.
      *
+     * **Pre-existing limitation, widened rather than introduced by
+     * `nonInteractiveRefundWithoutReceiver`.** `nonInteractiveClaim` and
+     * `nonInteractiveRefund` (and now its `withoutReceiver` leaf) build on
+     * this class exactly as they do on {@link ScriptV2} — both extend the
+     * same `BaseScript` where these leaves are constructed. But the `vhtlc`
+     * contract handler (`src/contracts/handlers/vhtlc.ts`) round-trips none
+     * of them: its params type carries no covenant fields, and
+     * `createScript` only ever builds the six signature-only leaves. A V1
+     * script built with either covenant option therefore compiles and can
+     * be funded, but cannot be registered as a `vhtlc` contract — the
+     * handler would derive a different (six-leaf) script for the same
+     * params and `ContractManager` refuses the mismatch. This was already
+     * true before `withoutReceiver` existed; it now applies to one more
+     * option than before, not to a newly-exposed one.
+     *
      * @example
      * ```typescript
      * const vhtlc = new VHTLC.Script({
@@ -405,6 +498,8 @@ interface VHTLCV2ContractParams {
     nonInteractiveRefund?: {
         senderPkScript: Uint8Array;
         emulatorPubkey: Uint8Array;
+        /** @see VHTLC.Options.nonInteractiveRefund.withoutReceiver */
+        withoutReceiver?: boolean;
     };
 }
 /**
@@ -426,21 +521,22 @@ interface VHTLCV2ContractParams {
  * the same ScriptV2 the two uses would fight over one row.
  *
  * **Which leaves this offers, and why the set is smaller than the ladder.**
- * ScriptV2 has eight leaves; a wallet holding ONE of the two participant keys
+ * ScriptV2 has nine leaves; a wallet holding ONE of the two participant keys
  * can satisfy four of them, and offering a leaf whose signature the caller
  * cannot produce is worse than offering fewer — it turns a refusal into a
  * transaction that gets built and then rejected.
  *
- * | leaf                              | needs                          | offered |
- * |-----------------------------------|--------------------------------|---------|
- * | `claim`                           | receiver + server, preimage    | yes, to the receiver |
- * | `refund`                          | sender + receiver + server     | no — needs the counterparty live |
- * | `refundWithoutReceiver`           | sender + server, CLTV          | yes, to the sender |
- * | `unilateralClaim`                 | receiver, CSV                  | yes, to the receiver |
- * | `unilateralRefund`                | sender + receiver, CSV         | no — needs the counterparty live |
- * | `unilateralRefundWithoutReceiver` | sender, CSV                    | yes, to the sender |
- * | `nonInteractiveClaim`             | server + emulator              | no — the wallet holds neither key |
- * | `nonInteractiveRefund`            | server + receiver + emulator   | no — the wallet holds neither key |
+ * | leaf                                  | needs                          | offered |
+ * |---------------------------------------|--------------------------------|---------|
+ * | `claim`                               | receiver + server, preimage    | yes, to the receiver |
+ * | `refund`                              | sender + receiver + server     | no — needs the counterparty live |
+ * | `refundWithoutReceiver`               | sender + server, CLTV          | yes, to the sender |
+ * | `unilateralClaim`                     | receiver, CSV                  | yes, to the receiver |
+ * | `unilateralRefund`                    | sender + receiver, CSV         | no — needs the counterparty live |
+ * | `unilateralRefundWithoutReceiver`     | sender, CSV                    | yes, to the sender |
+ * | `nonInteractiveClaim`                 | server + emulator              | no — the wallet holds neither key |
+ * | `nonInteractiveRefund`                | server + receiver + emulator   | no — the wallet holds neither key |
+ * | `nonInteractiveRefundWithoutReceiver` | server + emulator, CLTV        | no — the wallet holds neither key |
  *
  * The two omitted interactive leaves are the same two the `vhtlc` handler
  * omits, for the same reason: `refund` and `unilateralRefund` both need the

package/dist/{index-BtTtQFUX.d.cts → index-D2GjZxBr.d.cts}

@@ -1,5 +1,5 @@
-import { bb as ContractHandler, q as RelativeTimelock, bm as Discoverable, V as VtxoScript, r as TapLeafScript, cP as TapscriptDeriving } from './index-CFOMyVMt.cjs';
-import { D as DefaultVtxo, a as DelegateVtxo } from './delegate-BBQW61ym.cjs';
+import { bg as ContractHandler, s as RelativeTimelock, bs as Discoverable, V as VtxoScript, t as TapLeafScript, d4 as TapscriptDeriving } from './index-DU5o_hz7.cjs';
+import { D as DefaultVtxo, a as DelegateVtxo } from './delegate-Bz2e2zXY.cjs';
 import { Bytes } from '@scure/btc-signer/utils.js';
 
 /**
@@ -185,6 +185,25 @@ declare namespace VHTLC {
         nonInteractiveRefund?: {
             senderPkScript: Bytes;
             emulatorPubkey: Bytes;
+            /**
+             * Also emit the timelocked twin: `server` plus the SAME
+             * covenant-tweaked co-signer, spendable after `refundLocktime`
+             * with no receiver signature and no sender signature.
+             *
+             * This is the only refund tier that needs nobody: `refund` and
+             * `refundWithoutReceiver` need the sender's key,
+             * `nonInteractiveRefund` needs the receiver's. A sender who
+             * funded a lockup and vanished is refundable through this leaf
+             * alone, by anyone, to their pre-committed address.
+             *
+             * Off by default: it is an additional leaf, appended last, so
+             * enabling it changes the taproot merkle root and therefore the
+             * address. `nonInteractiveClaim` and `nonInteractiveRefund` are
+             * independently optional, so this is the NINTH leaf only in the
+             * full swap-corridor configuration where both are set — on its
+             * own, it is the eighth.
+             */
+            withoutReceiver?: boolean;
         };
         /**
          * Optional: denominate this contract in an Arkade ASSET rather than in
@@ -256,6 +275,8 @@ declare namespace VHTLC {
         readonly nonInteractiveClaimArkadeScript?: Bytes;
         readonly nonInteractiveRefundScript?: string;
         readonly nonInteractiveRefundArkadeScript?: Bytes;
+        readonly nonInteractiveRefundWithoutReceiverScript?: string;
+        readonly nonInteractiveRefundWithoutReceiverArkadeScript?: Bytes;
         protected constructor(options: Options, preimageCondition: (hash: Bytes) => Bytes);
         /** Return the collaborative claim tapleaf script. */
         claim(): TapLeafScript;
@@ -273,6 +294,59 @@ declare namespace VHTLC {
         nonInteractiveClaim(): [TapLeafScript, Bytes];
         /** Return the non-interactive refund tapleaf script as well as the ArkadeScript. */
         nonInteractiveRefund(): [TapLeafScript, Bytes];
+        /**
+         * Return the timelocked non-interactive refund tapleaf and its ArkadeScript.
+         *
+         * SPENDING THIS LEAF, CONCRETELY — confirmed from this SDK's own
+         * emulator client and covenant-spend builder ({@link
+         * EmulatorProvider} in `src/providers/emulator.ts`, and {@link
+         * ArkadeTransactionBuilder} in `src/arkade/contract.ts`), which is
+         * the general machinery every covenant leaf in this file goes
+         * through:
+         *
+         *  1. Build the ark tx spending this leaf (this method's {@link
+         *     TapLeafScript} as `tapLeafScript`, this script's {@link
+         *     VtxoScript.encode} as `tapTree`), plus its checkpoint tx.
+         *  2. Attach the ArkadeScript this method returns to the spent
+         *     input via an `EmulatorPacket` (type 1) — `{ vin, script:
+         *     <this ArkadeScript>, witness: <empty> }`, empty because the
+         *     script pushes its own input/output index with
+         *     `PUSHCURRENTINPUTINDEX` rather than reading one from the
+         *     witness — wrapped in an `Extension` OP_RETURN output on the
+         *     ark tx.
+         *  3. Attach the spent input's OWN creating ark tx as `PrevArkTx` on
+         *     input 0 — required so the emulator can resolve that input's
+         *     prevout pkScript/value; it does not otherwise have them.
+         *  4. POST the (base64-PSBT) ark tx and checkpoint(s) as `{ arkTx,
+         *     checkpointTxs }` to the emulator's `POST /v1/tx`.
+         *
+         * THE COVENANT CHECK the emulator runs against that ArkadeScript —
+         * `enforcePayTo(senderPkScript)`, see that function above — is: the
+         * output at this SAME input's index is a v1 P2TR output paying
+         * `senderPkScript`, with a value at least the input's. Only on that
+         * check passing does the emulator sign for `nirCosigner` (the
+         * `emulatorPubkey` tweaked by this ArkadeScript's hash); the
+         * response carries the fully co-signed `signedArkTx` and
+         * `signedCheckpointTxs` — `ArkadeTransactionBuilder.send()`'s own
+         * comment on this path: "the emulator executes the arkade script
+         * and finalizes with arkd" — no separate call to arkd is made by
+         * this SDK for a covenant spend.
+         * Neither `server` nor `receiver` play any part in that check: this
+         * leaf's tapscript still requires `server`'s own signature
+         * alongside `nirCosigner`'s (see the class doc above), but that is
+         * consensus-level multisig, not something the covenant enforces.
+         *
+         * NOT SPENDABLE UNTIL `refundLocktime` MATURES — the tapscript's
+         * `OP_CHECKLOCKTIMEVERIFY` is arkd's concern, not the emulator's;
+         * the emulator will happily co-sign an immature spend and arkd will
+         * then refuse it. A block-height-typed `refundLocktime` (below the
+         * standard height/timestamp boundary this SDK names
+         * `CLTV_HEIGHT_THRESHOLD`, 500,000,000, in
+         * `src/contracts/handlers/helpers.ts`) is refused by arkd for a
+         * forfeit-eligible leaf independent of maturity — use a
+         * seconds-typed (absolute Unix timestamp) value.
+         */
+        nonInteractiveRefundWithoutReceiver(): [TapLeafScript, Bytes];
     }
     /**
      * Virtual Hash Time Lock Contract (VHTLC) script implementation.
@@ -292,11 +366,30 @@ declare namespace VHTLC {
      *   can push the sender's refund immediately, no timelock, pinned to a
      *   pre-committed destination — recoverable even if the sender's own key
      *   is lost
+     * - **nonInteractiveRefundWithoutReceiver** (optional): server + emulator
+     *   can push the sender's refund after `refundLocktime`, pinned to a
+     *   pre-committed destination — the only refund tier needing no
+     *   participant signature at all
      *
      * See {@link ScriptV2} for the current recommended construction — same
      * leaf ladder, same options shape, an added length check on the claim
      * preimage. This class is unchanged and stays available as-is.
      *
+     * **Pre-existing limitation, widened rather than introduced by
+     * `nonInteractiveRefundWithoutReceiver`.** `nonInteractiveClaim` and
+     * `nonInteractiveRefund` (and now its `withoutReceiver` leaf) build on
+     * this class exactly as they do on {@link ScriptV2} — both extend the
+     * same `BaseScript` where these leaves are constructed. But the `vhtlc`
+     * contract handler (`src/contracts/handlers/vhtlc.ts`) round-trips none
+     * of them: its params type carries no covenant fields, and
+     * `createScript` only ever builds the six signature-only leaves. A V1
+     * script built with either covenant option therefore compiles and can
+     * be funded, but cannot be registered as a `vhtlc` contract — the
+     * handler would derive a different (six-leaf) script for the same
+     * params and `ContractManager` refuses the mismatch. This was already
+     * true before `withoutReceiver` existed; it now applies to one more
+     * option than before, not to a newly-exposed one.
+     *
      * @example
      * ```typescript
      * const vhtlc = new VHTLC.Script({
@@ -405,6 +498,8 @@ interface VHTLCV2ContractParams {
     nonInteractiveRefund?: {
         senderPkScript: Uint8Array;
         emulatorPubkey: Uint8Array;
+        /** @see VHTLC.Options.nonInteractiveRefund.withoutReceiver */
+        withoutReceiver?: boolean;
     };
 }
 /**
@@ -426,21 +521,22 @@ interface VHTLCV2ContractParams {
  * the same ScriptV2 the two uses would fight over one row.
  *
  * **Which leaves this offers, and why the set is smaller than the ladder.**
- * ScriptV2 has eight leaves; a wallet holding ONE of the two participant keys
+ * ScriptV2 has nine leaves; a wallet holding ONE of the two participant keys
  * can satisfy four of them, and offering a leaf whose signature the caller
  * cannot produce is worse than offering fewer — it turns a refusal into a
  * transaction that gets built and then rejected.
  *
- * | leaf                              | needs                          | offered |
- * |-----------------------------------|--------------------------------|---------|
- * | `claim`                           | receiver + server, preimage    | yes, to the receiver |
- * | `refund`                          | sender + receiver + server     | no — needs the counterparty live |
- * | `refundWithoutReceiver`           | sender + server, CLTV          | yes, to the sender |
- * | `unilateralClaim`                 | receiver, CSV                  | yes, to the receiver |
- * | `unilateralRefund`                | sender + receiver, CSV         | no — needs the counterparty live |
- * | `unilateralRefundWithoutReceiver` | sender, CSV                    | yes, to the sender |
- * | `nonInteractiveClaim`             | server + emulator              | no — the wallet holds neither key |
- * | `nonInteractiveRefund`            | server + receiver + emulator   | no — the wallet holds neither key |
+ * | leaf                                  | needs                          | offered |
+ * |---------------------------------------|--------------------------------|---------|
+ * | `claim`                               | receiver + server, preimage    | yes, to the receiver |
+ * | `refund`                              | sender + receiver + server     | no — needs the counterparty live |
+ * | `refundWithoutReceiver`               | sender + server, CLTV          | yes, to the sender |
+ * | `unilateralClaim`                     | receiver, CSV                  | yes, to the receiver |
+ * | `unilateralRefund`                    | sender + receiver, CSV         | no — needs the counterparty live |
+ * | `unilateralRefundWithoutReceiver`     | sender, CSV                    | yes, to the sender |
+ * | `nonInteractiveClaim`                 | server + emulator              | no — the wallet holds neither key |
+ * | `nonInteractiveRefund`                | server + receiver + emulator   | no — the wallet holds neither key |
+ * | `nonInteractiveRefundWithoutReceiver` | server + emulator, CLTV        | no — the wallet holds neither key |
  *
  * The two omitted interactive leaves are the same two the `vhtlc` handler
  * omits, for the same reason: `refund` and `unilateralRefund` both need the