@arkade-os/sdk 0.4.66 → 0.4.67

package/dist/{wallet-CNibc3yJ.d.ts → hdWalletCapable-BSjuUYOO.d.cts}

@@ -1,129 +1,8 @@
-import { a as Identity, K as DescriptorProvider, q as RelativeTimelock, L as Network, M as CSVMultisigTapscript, P as BatchStartedEvent, Q as TreeSigningStartedEvent, U as TxTree, X as TreeNoncesEvent, Y as BatchFinalizationEvent, Z as BatchFinalizedEvent, _ as BatchFailedEvent, $ as TreeTxEvent, a0 as TreeSignatureEvent, i as SettlementEvent, b as WalletConfig, W as WalletRepository, C as ContractRepository, f as IContractManager, a1 as IReadonlyWallet, a2 as ReadonlyIdentity, a3 as OnchainProvider, p as IndexerProvider, a4 as DelegateProvider, a5 as ReadonlyWalletConfig, y as IntentRepository, D as VirtualTxRepository, a6 as ExitCaptureMode, a7 as ExitDataSource, d as ActivityRegistry, a8 as IReadonlyAssetManager, a9 as ContractSyncState, aa as RecipientAddressContext, o as ArkProvider, ab as NetworkName, ac as ArkInfo, ad as ArkAddress, c as WalletBalance, G as GetVtxosFilter, N as NormalizedExtendedVirtualCoin, ae as ContractWithVtxos, af as selectPendingRecoveryOutpoints, A as ArkTransaction, e as Activity, E as ExtendedCoin, ag as Coin, u as ExtendedVirtualCoin, ah as ContractManager, ai as ContractManagerConfig, I as IWallet, aj as SettlementConfig, k as IAssetManager, ak as VtxoManager, g as IDelegateManager, S as SendBitcoinParams, h as SettleParams, R as Recipient, al as SignerSession, am as SignedIntent, an as Intent, j as SendParams, ao as TimeHeight } from './index-uUE_uQPn.js';
+import { s as RelativeTimelock, M as Network, P as CSVMultisigTapscript, Q as BatchStartedEvent, U as TreeSigningStartedEvent, X as TxTree, Y as TreeNoncesEvent, Z as BatchFinalizationEvent, _ as BatchFinalizedEvent, $ as BatchFailedEvent, a0 as TreeTxEvent, a1 as TreeSignatureEvent, k as SettlementEvent, b as WalletConfig, W as WalletRepository, C as ContractRepository, a2 as DescriptorProvider, f as IContractManager, a3 as IReadonlyWallet, a4 as ReadonlyIdentity, a5 as OnchainProvider, r as IndexerProvider, a6 as DelegateProvider, a7 as ReadonlyWalletConfig, B as IntentRepository, H as VirtualTxRepository, a8 as ExitCaptureMode, a9 as ExitDataSource, d as ActivityRegistry, aa as IReadonlyAssetManager, ab as ContractSyncState, ac as RecipientAddressContext, q as ArkProvider, ad as NetworkName, ae as ArkInfo, af as ArkAddress, c as WalletBalance, G as GetVtxosFilter, N as NormalizedExtendedVirtualCoin, ag as ContractWithVtxos, ah as selectPendingRecoveryOutpoints, A as ArkTransaction, e as Activity, E as ExtendedCoin, ai as Coin, w as ExtendedVirtualCoin, aj as ContractManager, ak as ContractManagerConfig, I as IWallet, a as Identity, g as GetNewAddressesOptions, h as NewAddress, al as SettlementConfig, m as IAssetManager, am as VtxoManager, i as IDelegateManager, S as SendBitcoinParams, j as SettleParams, R as Recipient, an as SignerSession, ao as SignedIntent, ap as Intent, l as SendParams, aq as TimeHeight } from './index-DU5o_hz7.cjs';
 import { Transaction } from '@scure/btc-signer';
 import { TransactionOutput } from '@scure/btc-signer/psbt.js';
 import { Bytes } from '@scure/btc-signer/utils.js';
-import { D as DefaultVtxo, a as DelegateVtxo } from './delegate-T-vgxMYZ.js';
-
-/**
- * Capability a wallet exposes so descriptor-blind consumers — Boltz swaps and
- * other plugins — can bind the artifacts they create to the wallet's current
- * HD index and later enumerate every index that has been used.
- *
- * Probed structurally ({@link isHDWalletCapable}) rather than widening
- * `IWallet`: plugins must keep working against wallets that predate it, and a
- * static wallet answers "no HD state" through the same three methods.
- */
-interface HDWalletCapable {
-    /**
-     * The descriptor at the wallet's current receive index, or `undefined` for
-     * static / `auto` wallets and HD wallets that have never rotated. Callers
-     * fall back to the identity key.
-     */
-    getCurrentSigningDescriptor(): Promise<string | undefined>;
-    /**
-     * Every descriptor the wallet may hold keys under, ascending by index:
-     * the allocation watermark's band plus any descriptor persisted on a
-     * contract. Empty for static wallets.
-     *
-     * `lookAhead` appends that many descriptors past the watermark without
-     * advancing it, for a restore that must probe indices no local state
-     * mentions yet.
-     */
-    getUsedSigningDescriptors(opts?: {
-        lookAhead?: number;
-    }): Promise<string[]>;
-    /**
-     * An {@link Identity} whose keys and signatures are those of `descriptor`.
-     * Returns the wallet identity itself when `descriptor` is the identity's
-     * own key (a static wallet's descriptor, or an HD wallet's baseline key).
-     *
-     * Throws {@link ForeignDescriptorError} for a descriptor this wallet
-     * cannot sign for. Never silently substitutes another key: an identity
-     * handed out for a foreign descriptor signs happily with the wrong key,
-     * and that surfaces only as a rejected transaction or a dead script —
-     * far from the call that caused it.
-     *
-     * The returned identity must actually sign — `sign`, `signMessage` and
-     * `signerSession`, not just `xOnlyPublicKey`. A watch-only identity
-     * carrying the right key is not a signer, and `contractSigner` refuses it
-     * as `WalletCannotSignError`: returning one here would otherwise pass
-     * every check and throw at push time, after the contract is funded.
-     */
-    signerForDescriptor(descriptor: string): Promise<Identity>;
-}
-/**
- * Thrown by {@link HDWalletCapable.signerForDescriptor} when the wallet holds
- * no key for the requested descriptor — it belongs to another seed, or to an
- * identity this wallet does not carry. A typed refusal so callers can tell
- * "not my key" from transient signing failures.
- */
-declare class ForeignDescriptorError extends Error {
-    readonly descriptor: string;
-    readonly name = "ForeignDescriptorError";
-    constructor(descriptor: string, options?: {
-        cause?: unknown;
-    });
-}
-/** Anything that can derive and sign for a descriptor it claims. */
-type DescriptorOwner = Pick<DescriptorProvider, "isOurs" | "signWithDescriptor" | "signMessageWithDescriptor">;
-/**
- * The identity that signs `descriptor`, or {@link ForeignDescriptorError}.
- *
- * Shared by every {@link HDWalletCapable.signerForDescriptor} implementation
- * so they cannot drift: the page-side and worker-side wallets answering
- * differently for one descriptor is a signer that passes a public-key check
- * and then throws on every signature — after the artifact is funded.
- */
-declare function resolveDescriptorSigner(descriptor: string, identity: Identity, provider?: DescriptorOwner): Promise<Identity>;
-/** Structural type guard for {@link HDWalletCapable}. */
-declare function isHDWalletCapable(value: unknown): value is HDWalletCapable;
-/**
- * Allocating a *fresh* index, which is strictly more than
- * {@link HDWalletCapable}'s descriptor awareness.
- *
- * Deliberately a separate probe rather than three more methods on
- * `HDWalletCapable`: widening that guard would silently demote every wallet
- * implementing only its original surface — including one built by an older
- * SDK — from HD-capable to static, which is exactly the breakage it documents
- * itself as avoiding. Consumers that only read descriptors keep the narrow
- * probe; anything deriving per-artifact secrets asks for this one.
- */
-interface HDAllocationCapable {
-    /**
-     * The signing descriptor a new artifact (a swap, an invoice, a contract)
-     * should bind to. **The wallet decides what that means**: an HD wallet
-     * allocates a fresh index, advancing the watermark; a static wallet
-     * answers with its one `tr(pubkey)` descriptor every time. Consumers must
-     * not probe the wallet's shape or mint key material of their own — they
-     * ask, and use what comes back with
-     * {@link HDWalletCapable.signerForDescriptor}.
-     *
-     * `undefined` only for implementations that genuinely cannot answer;
-     * `Wallet` always answers. Callers that must work against such wallets
-     * fall back to the identity key — never to a random one.
-     *
-     * Distinct from {@link HDWalletCapable.getCurrentSigningDescriptor}, which
-     * peeks: on an HD wallet, two artifacts bound to a peek share a key.
-     * Whether the returned descriptor is unique per call is a property of the
-     * wallet, not of this method — anything deriving per-artifact secrets
-     * from the descriptor must check the descriptor's shape, not the wallet's.
-     */
-    getNextSigningDescriptor(): Promise<string | undefined>;
-    /**
-     * Move the allocation watermark to `descriptor`'s index so later
-     * allocations cannot reissue it. Monotonic — a lower index is a no-op.
-     * On a static wallet there is no watermark: the wallet's own descriptor
-     * is accepted as a no-op.
-     *
-     * Throws on a descriptor this wallet cannot derive, or an HD descriptor
-     * with no parseable trailing child index: silently mapping those to index
-     * 0 would move the watermark nowhere and let a restored artifact's index
-     * be handed out again.
-     */
-    advanceSigningDescriptorWatermark(descriptor: string): Promise<void>;
-}
-/** Structural type guard for {@link HDAllocationCapable}. */
-declare function isHDAllocationCapable(value: unknown): value is HDAllocationCapable;
+import { D as DefaultVtxo, a as DelegateVtxo } from './delegate-Bz2e2zXY.cjs';
 
 /** Wall-clock floor for `batchExpiry` outside regtest. */
 declare const DEFAULT_MIN_BATCH_EXPIRY_SECONDS = 86400n;
@@ -779,10 +658,12 @@ interface BoardingUtxoGroup {
  * - `subdust` — below dust, so it sits at an OP_RETURN script with no spendable
  *   leaf. Unspendable as cash; `createCash` prevents minting these.
  * - `already-spent` — someone else claimed it first.
+ * - `exited` — unilaterally exited onchain, so the offchain sweep cannot reach it;
+ *   `Unroll.completeUnroll` is the remedy.
  * - `has-assets` — asset-bearing; the BTC-only sweep would burn the assets.
  * - `sweep-failed` — spendable, but its own sweep was rejected.
  */
-type ArkadeCashUnclaimedReason = "swept" | "subdust" | "already-spent" | "has-assets" | "sweep-failed";
+type ArkadeCashUnclaimedReason = "swept" | "subdust" | "already-spent" | "exited" | "has-assets" | "sweep-failed";
 /** A VTXO {@link Wallet.claimCash} left behind, with the reason why. */
 interface ArkadeCashUnclaimedVtxo {
     txid: string;
@@ -1342,7 +1223,7 @@ declare class ReadonlyWallet implements IReadonlyWallet {
  * });
  * ```
  */
-declare class Wallet extends ReadonlyWallet implements IWallet, HDWalletCapable {
+declare class Wallet extends ReadonlyWallet implements IWallet, HDWalletCapable, AddressAllocationCapable {
     readonly arkProvider: ArkProvider;
     readonly forfeitOutputScript: Bytes;
     readonly forfeitPubkey: Bytes;
@@ -1388,6 +1269,25 @@ declare class Wallet extends ReadonlyWallet implements IWallet, HDWalletCapable
      * are logged, never thrown back into the provider's emit loop.
      */
     private handleServerInfoChanged;
+    /**
+     * Await an `onServerInfoChanged` handler still applying a rotation.
+     *
+     * The provider emits synchronously but {@link handleServerInfoChanged} runs
+     * off the emit, so between the two a caller can observe a half-applied
+     * rotation: {@link rotateServerSigner} persists the active signer's contract
+     * rows *before* committing the tapscripts, so `arkServerPublicKey` still
+     * reads the old key while the new key's rows are already in the repository.
+     * A path that refreshes server info and then reads signer-derived state must
+     * drain the chain first, or it both reads that torn state and races the
+     * handler for the rotation itself.
+     *
+     * Resolves once the chain is idle; a handler that threw already logged, and
+     * its rejection is swallowed here.
+     *
+     * @internal Invoked by {@link dispose} and the {@link VtxoManager} migration
+     * pass; not part of the stable public API.
+     */
+    settleServerInfoChanges(): Promise<void>;
     private _receiveRotatorInstalled;
     /**
      * Descriptor-aware signer used by {@link _signerRouter} to sign
@@ -1492,8 +1392,130 @@ declare class Wallet extends ReadonlyWallet implements IWallet, HDWalletCapable
      * provider and keeps a single index-0 boarding address for its lifetime,
      * so this returns the existing {@link getBoardingAddress} unchanged
      * (no rotation, no index burned).
+     *
+     * **Behaviour change.** A wallet configured with a custom
+     * {@link DescriptorProvider} (`walletMode: <provider>`) now rotates here.
+     * It previously did not: allocation went through the contract manager,
+     * which only wires an `allocate` hook for {@link HDDescriptorProvider}, so
+     * such a wallet read as "declined to allocate" and silently kept its
+     * index-0 boarding address forever. Those wallets now burn an index per
+     * call — including via {@link maybeRotateBoardingAfterBoard}, which fires
+     * on every settle that consumes a boarding UTXO. Funds at retired
+     * addresses stay reachable: each rotation persists its `boarding` contract
+     * before swapping, and {@link getBoardingUtxos} fans out over the full
+     * historical set.
+     *
+     * @deprecated Use {@link getNewAddresses} — it mints any combination of
+     * address types at one shared index, and reports the contract row behind
+     * each. Note the difference in display behaviour: this method *swaps* the
+     * advertised boarding address, where `getNewAddresses` mints side
+     * addresses and leaves {@link getBoardingAddress} alone. To keep this
+     * method's behaviour, keep calling this method.
      */
     getNewBoardingAddress(): Promise<string>;
+    /**
+     * Allocate a *fresh* address of each requested type, all derived from one
+     * newly allocated HD index.
+     *
+     * This is the explicit allocator the receive path otherwise lacks:
+     * {@link getAddress} and {@link getBoardingAddress} are stable reads of the
+     * wallet's display addresses, and the display receive address only advances
+     * when a payment arrives ({@link WalletReceiveRotator} rotates on
+     * `vtxo_received`). Issuing a second address before the first is paid — one
+     * invoice for Alice, another for Bob — has to go through here.
+     *
+     * Each call:
+     *
+     * - allocates **one** index from the shared HD stream, however many types
+     *   were asked for, so a `default` + `boarding` pair are siblings rather
+     *   than two burnt indices;
+     * - builds each requested script at that index, preserving every other
+     *   option of the wallet's current script for that flavour (including a
+     *   delegate wallet's `delegate` shape);
+     * - persists each as an `active` contract carrying its `signingDescriptor`,
+     *   so the ContractWatcher monitors it, the balance counts it, and
+     *   {@link signerForDescriptor} can recover the key;
+     * - slides the look-ahead band, since the watermark moved past indices an
+     *   external issuer may still be handing out.
+     *
+     * The minted rows are deliberately left **untagged**: the boot lookups
+     * adopt the newest {@link WALLET_RECEIVE_SOURCE}-tagged row as the display
+     * address, and a side address issued to one counterparty must not become
+     * the address the wallet advertises to everyone else. {@link getAddress}
+     * and {@link getBoardingAddress} are unchanged by this call.
+     *
+     * A wallet with no HD stream (`walletMode: 'static'` / `'auto'`) has one
+     * address per flavour for its lifetime. Without `forceNew` it returns those
+     * — the real persisted rows, no index burned; with `forceNew` it throws
+     * {@link WalletCannotAllocateAddressError} rather than hand back an address
+     * that is not in fact fresh.
+     *
+     * @example
+     * ```typescript
+     * const [invoice] = await wallet.getNewAddresses({ forceNew: true });
+     * // hand `invoice.address` to Alice, keep the descriptor with the invoice
+     * const signer = await wallet.signerForDescriptor(invoice.signingDescriptor);
+     * ```
+     */
+    getNewAddresses(opts?: GetNewAddressesOptions): Promise<NewAddress[]>;
+    /**
+     * Shared allocation core behind {@link getNewAddresses} and the deprecated
+     * {@link getNewBoardingAddress}, so the two cannot drift on what an
+     * allocation costs or what gets persisted.
+     *
+     * @param tagSource - Tag the persisted rows {@link WALLET_RECEIVE_SOURCE},
+     * making the next boot adopt them as the display address. Only the
+     * deprecated boarding allocator passes `true`; `getNewAddresses` mints side
+     * addresses and must not hijack what the wallet advertises.
+     */
+    private allocateAddresses;
+    /**
+     * The wallet's existing display addresses, as persisted contract rows —
+     * the honest answer for a wallet with no index to burn.
+     *
+     * Each type is minted from the descriptor that already owns its display
+     * script ({@link displayDescriptor}), not from the identity key, so the
+     * returned `signingDescriptor` is the one that signs for the returned
+     * `address` even on a wallet that has rotated.
+     */
+    private currentAddresses;
+    /**
+     * The descriptor that owns the wallet's current display script for `type`,
+     * read off the row the wallet persisted when it adopted that script.
+     *
+     * Deriving it from the identity instead is only correct for a wallet that
+     * never rotates. On one that has — an HD wallet whose provider later
+     * declines to allocate — the display script belongs to an HD child, and
+     * pairing its address with the identity descriptor hands the caller a
+     * {@link NewAddress} whose `signingDescriptor` resolves, via
+     * {@link signerForDescriptor}, to a signer holding the wrong key.
+     *
+     * Falls back to the identity's pathless `tr(pubkey)` when no row carries a
+     * descriptor: the static / `auto` case, where the identity key genuinely
+     * owns the display script and this is what `getNextSigningDescriptor`
+     * answers too. (The index-0 baselines registered at construction carry no
+     * `signingDescriptor` metadata, so those wallets take this path.)
+     */
+    private displayDescriptor;
+    /**
+     * Build, persist and shape one address of `type` owned by `descriptor` —
+     * the single build-and-register path behind both {@link allocateAddresses}
+     * and {@link currentAddresses}, so a freshly allocated address and a
+     * re-registered display address cannot disagree on what gets written.
+     *
+     * The descriptor is the sole source of the script's owner key in both
+     * branches. Deriving one flavour from the descriptor and the other from a
+     * tapscript field is what lets `address` and `signingDescriptor` drift
+     * apart.
+     */
+    private mintAddress;
+    /**
+     * Build the boarding contract owned by `pubKey`, keeping every other option
+     * of the wallet's current boarding tapscript (notably the boarding-exit
+     * CSV, which is index-independent). The offchain analogue lives in
+     * {@link buildReceiveContract}.
+     */
+    private buildBoardingContract;
     /**
      * @see HDWalletCapable.getCurrentSigningDescriptor
      */
@@ -1701,7 +1723,10 @@ declare class Wallet extends ReadonlyWallet implements IWallet, HDWalletCapable
      * `typeof` guard skips the arknote strings settle also accepts.
      *
      * No-ops for static / `auto` wallets (no descriptor provider — boarding
-     * stays on its fixed index-0 address). Best-effort and non-fatal: the
+     * stays on its fixed index-0 address). Wallets on a custom
+     * {@link DescriptorProvider} DO rotate here now, where they previously
+     * no-opped — see the behaviour-change note on {@link
+     * getNewBoardingAddress}. Best-effort and non-fatal: the
      * settle has already committed and its txid must be returned, so a
      * rotation failure is logged and swallowed rather than thrown. Funds at
      * the retired boarding address remain discoverable — the old `boarding`
@@ -1919,4 +1944,170 @@ declare function selectVirtualCoins(coins: ExtendedVirtualCoin[], targetAmount:
  */
 declare function waitForIncomingFunds(wallet: Wallet): Promise<IncomingFunds>;
 
-export { ArkError as A, type BatchExpiryPolicy as B, type CheckpointExitDelayPolicy as C, DEFAULT_MIN_BATCH_EXPIRY_SECONDS as D, maybeArkError as E, ForeignDescriptorError as F, resolveBatchExpiryPolicy as G, type HDWalletCapable as H, type IncomingFunds as I, resolveCheckpointExitDelayPolicy as J, resolveDescriptorSigner as K, selectVirtualCoins as L, MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD as M, signingDescriptorIndex as N, strictSigningDescriptorIndex as O, type ProviderConnectionState as P, waitForIncomingFunds as Q, ReadonlyWallet as R, SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as S, Wallet as W, type HDAllocationCapable as a, type ReceiveRotatorFactory as b, type ReceiveRotatorBootOpts as c, type ReceiveRotatorBoot as d, Batch as e, ArkErrorName as f, type ArkadeCashClaimResult as g, ArkadeCashCreateError as h, type ArkadeCashUnclaimedReason as i, type ArkadeCashUnclaimedVtxo as j, type BoardingUtxoGroup as k, DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as l, MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as m, type ProviderKind as n, ProviderUnavailableError as o, REGTEST_MIN_BATCH_EXPIRY_SECONDS as p, REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as q, type ServerInfoSource as r, ServerResponseMismatchError as s, assertValidBatchExpiry as t, assertValidServerUnrollScript as u, defaultBatchExpiryPolicy as v, defaultCheckpointExitDelayPolicy as w, isArkError as x, isHDAllocationCapable as y, isHDWalletCapable as z };
+/**
+ * Capability a wallet exposes so descriptor-blind consumers — Boltz swaps and
+ * other plugins — can bind the artifacts they create to the wallet's current
+ * HD index and later enumerate every index that has been used.
+ *
+ * Probed structurally ({@link isHDWalletCapable}) rather than widening
+ * `IWallet`: plugins must keep working against wallets that predate it, and a
+ * static wallet answers "no HD state" through the same three methods.
+ */
+interface HDWalletCapable {
+    /**
+     * The descriptor at the wallet's current receive index, or `undefined` for
+     * static / `auto` wallets and HD wallets that have never rotated. Callers
+     * fall back to the identity key.
+     */
+    getCurrentSigningDescriptor(): Promise<string | undefined>;
+    /**
+     * Every descriptor the wallet may hold keys under, ascending by index:
+     * the allocation watermark's band plus any descriptor persisted on a
+     * contract. Empty for static wallets.
+     *
+     * `lookAhead` appends that many descriptors past the watermark without
+     * advancing it, for a restore that must probe indices no local state
+     * mentions yet.
+     */
+    getUsedSigningDescriptors(opts?: {
+        lookAhead?: number;
+    }): Promise<string[]>;
+    /**
+     * An {@link Identity} whose keys and signatures are those of `descriptor`.
+     * Returns the wallet identity itself when `descriptor` is the identity's
+     * own key (a static wallet's descriptor, or an HD wallet's baseline key).
+     *
+     * Throws {@link ForeignDescriptorError} for a descriptor this wallet
+     * cannot sign for. Never silently substitutes another key: an identity
+     * handed out for a foreign descriptor signs happily with the wrong key,
+     * and that surfaces only as a rejected transaction or a dead script —
+     * far from the call that caused it.
+     *
+     * The returned identity must actually sign — `sign`, `signMessage` and
+     * `signerSession`, not just `xOnlyPublicKey`. A watch-only identity
+     * carrying the right key is not a signer, and `contractSigner` refuses it
+     * as `WalletCannotSignError`: returning one here would otherwise pass
+     * every check and throw at push time, after the contract is funded.
+     */
+    signerForDescriptor(descriptor: string): Promise<Identity>;
+}
+/**
+ * Thrown by {@link HDWalletCapable.signerForDescriptor} when the wallet holds
+ * no key for the requested descriptor — it belongs to another seed, or to an
+ * identity this wallet does not carry. A typed refusal so callers can tell
+ * "not my key" from transient signing failures.
+ */
+declare class ForeignDescriptorError extends Error {
+    readonly descriptor: string;
+    readonly name = "ForeignDescriptorError";
+    constructor(descriptor: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Thrown by `Wallet.getNewAddresses({ forceNew: true })` when the wallet has
+ * no HD stream to advance — `walletMode: 'static'` / `'auto'`, or a
+ * {@link DescriptorProvider} that declined to allocate.
+ *
+ * A typed refusal rather than a silent repeat: a caller that asked for a
+ * *fresh* address is issuing one per counterparty, and quietly returning the
+ * address it already handed out surfaces only as two payers sharing a script.
+ */
+declare class WalletCannotAllocateAddressError extends Error {
+    readonly name = "WalletCannotAllocateAddressError";
+    constructor(reason: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Anything that can derive and sign for a descriptor it claims. */
+type DescriptorOwner = Pick<DescriptorProvider, "isOurs" | "signWithDescriptor" | "signMessageWithDescriptor">;
+/**
+ * The identity that signs `descriptor`, or {@link ForeignDescriptorError}.
+ *
+ * Shared by every {@link HDWalletCapable.signerForDescriptor} implementation
+ * so they cannot drift: the page-side and worker-side wallets answering
+ * differently for one descriptor is a signer that passes a public-key check
+ * and then throws on every signature — after the artifact is funded.
+ */
+declare function resolveDescriptorSigner(descriptor: string, identity: Identity, provider?: DescriptorOwner): Promise<Identity>;
+/** Structural type guard for {@link HDWalletCapable}. */
+declare function isHDWalletCapable(value: unknown): value is HDWalletCapable;
+/**
+ * Allocating a *fresh* index, which is strictly more than
+ * {@link HDWalletCapable}'s descriptor awareness.
+ *
+ * Deliberately a separate probe rather than three more methods on
+ * `HDWalletCapable`: widening that guard would silently demote every wallet
+ * implementing only its original surface — including one built by an older
+ * SDK — from HD-capable to static, which is exactly the breakage it documents
+ * itself as avoiding. Consumers that only read descriptors keep the narrow
+ * probe; anything deriving per-artifact secrets asks for this one.
+ */
+interface HDAllocationCapable {
+    /**
+     * The signing descriptor a new artifact (a swap, an invoice, a contract)
+     * should bind to. **The wallet decides what that means**: an HD wallet
+     * allocates a fresh index, advancing the watermark; a static wallet
+     * answers with its one `tr(pubkey)` descriptor every time. Consumers must
+     * not probe the wallet's shape or mint key material of their own — they
+     * ask, and use what comes back with
+     * {@link HDWalletCapable.signerForDescriptor}.
+     *
+     * `undefined` only for implementations that genuinely cannot answer;
+     * `Wallet` always answers. Callers that must work against such wallets
+     * fall back to the identity key — never to a random one.
+     *
+     * Distinct from {@link HDWalletCapable.getCurrentSigningDescriptor}, which
+     * peeks: on an HD wallet, two artifacts bound to a peek share a key.
+     * Whether the returned descriptor is unique per call is a property of the
+     * wallet, not of this method — anything deriving per-artifact secrets
+     * from the descriptor must check the descriptor's shape, not the wallet's.
+     */
+    getNextSigningDescriptor(): Promise<string | undefined>;
+    /**
+     * Move the allocation watermark to `descriptor`'s index so later
+     * allocations cannot reissue it. Monotonic — a lower index is a no-op.
+     * On a static wallet there is no watermark: the wallet's own descriptor
+     * is accepted as a no-op.
+     *
+     * Throws on a descriptor this wallet cannot derive, or an HD descriptor
+     * with no parseable trailing child index: silently mapping those to index
+     * 0 would move the watermark nowhere and let a restored artifact's index
+     * be handed out again.
+     */
+    advanceSigningDescriptorWatermark(descriptor: string): Promise<void>;
+}
+/** Structural type guard for {@link HDAllocationCapable}. */
+declare function isHDAllocationCapable(value: unknown): value is HDAllocationCapable;
+/**
+ * Minting addresses to hand out, which is strictly more than
+ * {@link HDAllocationCapable}'s bare index allocation: the wallet also builds
+ * the scripts at that index, persists them as watched contracts, and reports
+ * the rows.
+ *
+ * A third probe rather than another method on `HDAllocationCapable`, for the
+ * same reason that interface exists separately from {@link HDWalletCapable}:
+ * widening an existing guard silently demotes every wallet implementing only
+ * its older surface.
+ */
+interface AddressAllocationCapable {
+    /**
+     * Fresh addresses of each requested type, all derived from one newly
+     * allocated HD index, persisted and watched. **The wallet decides what
+     * "fresh" means**: an HD wallet burns an index, a wallet with no stream
+     * answers with its existing display addresses — or, under
+     * `forceNew`, refuses with {@link WalletCannotAllocateAddressError}
+     * rather than repeat an address it already handed out.
+     *
+     * Distinct from {@link HDAllocationCapable.getNextSigningDescriptor},
+     * which yields only an index and leaves the caller to build and register
+     * the script — two steps that must not be split across a process
+     * boundary, since a page that allocated an index and then failed to
+     * register the script holds a burnt index and an unwatched address.
+     */
+    getNewAddresses(opts?: GetNewAddressesOptions): Promise<NewAddress[]>;
+}
+/** Structural type guard for {@link AddressAllocationCapable}. */
+declare function isAddressAllocationCapable(value: unknown): value is AddressAllocationCapable;
+
+export { type AddressAllocationCapable as A, type BatchExpiryPolicy as B, type CheckpointExitDelayPolicy as C, DEFAULT_MIN_BATCH_EXPIRY_SECONDS as D, isArkError as E, ForeignDescriptorError as F, isHDAllocationCapable as G, type HDWalletCapable as H, type IncomingFunds as I, isHDWalletCapable as J, maybeArkError as K, resolveBatchExpiryPolicy as L, MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD as M, resolveCheckpointExitDelayPolicy as N, resolveDescriptorSigner as O, type ProviderConnectionState as P, selectVirtualCoins as Q, ReadonlyWallet as R, SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as S, signingDescriptorIndex as T, strictSigningDescriptorIndex as U, waitForIncomingFunds as V, Wallet as W, type HDAllocationCapable as a, type ReceiveRotatorFactory as b, type ReceiveRotatorBootOpts as c, type ReceiveRotatorBoot as d, Batch as e, ArkError as f, ArkErrorName as g, type ArkadeCashClaimResult as h, ArkadeCashCreateError as i, type ArkadeCashUnclaimedReason as j, type ArkadeCashUnclaimedVtxo as k, type BoardingUtxoGroup as l, DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as m, MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as n, type ProviderKind as o, ProviderUnavailableError as p, REGTEST_MIN_BATCH_EXPIRY_SECONDS as q, REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as r, type ServerInfoSource as s, ServerResponseMismatchError as t, WalletCannotAllocateAddressError as u, assertValidBatchExpiry as v, assertValidServerUnrollScript as w, defaultBatchExpiryPolicy as x, defaultCheckpointExitDelayPolicy as y, isAddressAllocationCapable as z };