@arkade-os/sdk 0.4.67 → 0.5.0-rc.0

package/dist/{hdWalletCapable-Hi12xjCJ.d.ts → hdWalletCapable-Dt3MUiGE.d.cts}

@@ -1,8 +1,8 @@
-import { s as RelativeTimelock, M as Network, P as CSVMultisigTapscript, Q as BatchStartedEvent, U as TreeSigningStartedEvent, X as TxTree, Y as TreeNoncesEvent, Z as BatchFinalizationEvent, _ as BatchFinalizedEvent, $ as BatchFailedEvent, a0 as TreeTxEvent, a1 as TreeSignatureEvent, k as SettlementEvent, b as WalletConfig, W as WalletRepository, C as ContractRepository, a2 as DescriptorProvider, f as IContractManager, a3 as IReadonlyWallet, a4 as ReadonlyIdentity, a5 as OnchainProvider, r as IndexerProvider, a6 as DelegateProvider, a7 as ReadonlyWalletConfig, B as IntentRepository, H as VirtualTxRepository, a8 as ExitCaptureMode, a9 as ExitDataSource, d as ActivityRegistry, aa as IReadonlyAssetManager, ab as ContractSyncState, ac as RecipientAddressContext, q as ArkProvider, ad as NetworkName, ae as ArkInfo, af as ArkAddress, c as WalletBalance, G as GetVtxosFilter, N as NormalizedExtendedVirtualCoin, ag as ContractWithVtxos, ah as selectPendingRecoveryOutpoints, A as ArkTransaction, e as Activity, E as ExtendedCoin, ai as Coin, w as ExtendedVirtualCoin, aj as ContractManager, ak as ContractManagerConfig, I as IWallet, a as Identity, g as GetNewAddressesOptions, h as NewAddress, al as SettlementConfig, m as IAssetManager, am as VtxoManager, i as IDelegateManager, S as SendBitcoinParams, j as SettleParams, R as Recipient, an as SignerSession, ao as SignedIntent, ap as Intent, l as SendParams, aq as TimeHeight } from './index-DU5o_hz7.js';
+import { w as RelativeTimelock, X as Network, Y as CSVMultisigTapscript, Z as BatchStartedEvent, _ as TreeSigningStartedEvent, $ as TxTree, a0 as TreeNoncesEvent, a1 as BatchFinalizationEvent, a2 as BatchFinalizedEvent, a3 as BatchFailedEvent, a4 as TreeTxEvent, a5 as TreeSignatureEvent, o as SettlementEvent, b as WalletConfig, W as WalletRepository, C as ContractRepository, a6 as DescriptorProvider, j as IContractManager, a7 as IReadonlyWallet, a8 as ReadonlyIdentity, a9 as OnchainProvider, u as ArkProvider, v as IndexerProvider, aa as DelegateProvider, ab as ReadonlyWalletConfig, J as IntentRepository, M as VirtualTxRepository, ac as ExitCaptureMode, ad as ExitDataSource, h as ActivityRegistry, ae as IReadonlyAssetManager, af as ContractSyncState, ag as RecipientArkadeAddressContext, G as GetArkadeInfoOptions, A as ArkadeInfo, c as ArkadeReader, ah as NetworkName, ai as ArkAddress, e as WalletBalance, f as GetVtxosFilter, N as NormalizedExtendedVirtualCoin, aj as ContractWithVtxos, ak as selectPendingRecoveryOutpoints, g as ArkTransaction, i as Activity, E as ExtendedCoin, al as Coin, B as ExtendedVirtualCoin, am as ContractManager, an as ContractManagerConfig, I as IWallet, a as Identity, k as GetNewAddressesOptions, l as NewAddress, ao as SettlementConfig, d as ArkadeBroadcaster, q as IAssetManager, ap as VtxoManager, m as IDelegateManager, S as SendBitcoinParams, n as SettleParams, R as Recipient, aq as SignerSession, ar as SignedIntent, as as Intent, p as SendParams, at as TimeHeight } from './index-Udm5V2xW.cjs';
 import { Transaction } from '@scure/btc-signer';
 import { TransactionOutput } from '@scure/btc-signer/psbt.js';
 import { Bytes } from '@scure/btc-signer/utils.js';
-import { D as DefaultVtxo, a as DelegateVtxo } from './delegate-cdmzb2f9.js';
+import { D as DefaultVtxo, a as DelegateVtxo } from './delegate-DLIOBQ5x.cjs';
 
 /** Wall-clock floor for `batchExpiry` outside regtest. */
 declare const DEFAULT_MIN_BATCH_EXPIRY_SECONDS = 86400n;
@@ -48,10 +48,11 @@ declare const DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS = 86400n;
 /**
  * Wall-clock floor for the checkpoint exit delay on regtest (~2 blocks nominal).
  *
- * Deliberately lower than {@link REGTEST_MIN_BATCH_EXPIRY_SECONDS "../wallet/batchExpiry"} — this
- * repo's own regtest envs run `ARKD_CHECKPOINT_EXIT_DELAY` as low as 5 blocks
- * (`packages/boltz-swap/.env.regtest`), so the floor must clear that while still rejecting a
- * 1-block attack.
+ * Deliberately lower than {@link REGTEST_MIN_BATCH_EXPIRY_SECONDS "../wallet/batchExpiry"} — it
+ * was sized to clear an `ARKD_CHECKPOINT_EXIT_DELAY` of 5 blocks while still rejecting a 1-block
+ * attack. No env in this repo goes below 20 any more (the 5-block one shipped with the removed
+ * boltz-swap package), so there is room to tighten this; left as-is until someone confirms no
+ * external regtest deployment relies on the lower bound.
  */
 declare const REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS = 1200n;
 /**
@@ -75,7 +76,7 @@ declare const MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS = 4096n;
  * mutinynet does.
  */
 declare const SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS = 86016n;
-/** Bounds applied to a server-supplied `ArkInfo.checkpointTapscript`. */
+/** Bounds applied to a server-supplied `ArkadeInfo.checkpointTapscript`. */
 type CheckpointExitDelayPolicy = {
     /** Minimum wall-clock delay in seconds, after normalization. */
     minSeconds: bigint;
@@ -90,7 +91,7 @@ type CheckpointExitDelayPolicy = {
      * arkd always builds the checkpoint tapscript from its own `forfeitPubkey`
      * (`internal/core/application/service.go`), so this should be the
      * `forfeitPubkey` the caller already trusts — pinned wallet state where one
-     * exists, otherwise the same `ArkInfo` response's own `forfeitPubkey` field
+     * exists, otherwise the same `ArkadeInfo` response's own `forfeitPubkey` field
      * as a self-consistency check.
      */
     advertisedForfeitPubkey?: Bytes;
@@ -211,7 +212,7 @@ declare class ServerResponseMismatchError extends Error {
  */
 declare function maybeArkError(error: any): ArkError | undefined;
 
-/** Where the {@link ArkInfo} used to construct a wallet came from. */
+/** Where the {@link ArkadeInfo} used to construct a wallet came from. */
 type ServerInfoSource = "live" | "cache";
 
 /**
@@ -729,6 +730,13 @@ declare class ReadonlyWallet implements IReadonlyWallet {
     readonly identity: ReadonlyIdentity;
     readonly network: Network;
     readonly onchainProvider: OnchainProvider;
+    /**
+     * Narrowed to what a readonly wallet legitimately needs — the only use
+     * here is {@link getArkadeInfo}. `protected` stops an outside caller
+     * reaching it; the `Pick` stops this class growing a use for
+     * `submitTx`. `Wallet` re-widens both below.
+     */
+    protected readonly arkProvider: Pick<ArkProvider, "getInfo">;
     readonly indexerProvider: IndexerProvider;
     readonly dustAmount: bigint;
     readonly walletRepository: WalletRepository;
@@ -793,26 +801,33 @@ declare class ReadonlyWallet implements IReadonlyWallet {
      */
     protected _arkServerPublicKey: Bytes;
     /**
-     * Whether this wallet was constructed from live operator server-info
-     * (`"live"`) or from a cached snapshot because the operator was unreachable
-     * (`"cache"`). Freshness signal for {@link getProviderConnectionState}.
+     * Whether the LATEST server-info resolution answered live (`"live"`) or
+     * from the cached snapshot because the operator was unreachable
+     * (`"cache"`). Seeded at construction and updated by every
+     * {@link getArkadeInfo} read, so a wallet that booted offline and
+     * recovered stops reporting degraded — and one that just fell back stops
+     * claiming online. Freshness signal for
+     * {@link getProviderConnectionState}.
      */
     protected _serverInfoSource: ServerInfoSource;
     /**
-     * Epoch-ms of the last known live operator contact: construction time on the
-     * `live` boot path, the cached snapshot's `savedAt` on the `cache` path.
+     * Epoch-ms of the last known live operator contact: the most recent live
+     * resolution (construction or a later {@link getArkadeInfo}), or the
+     * cached snapshot's `savedAt` when the latest resolution fell back.
      */
     protected _serverInfoLastOnlineAt?: number;
     /** @see {@link _serverInfoSource} */
     get serverInfoSource(): ServerInfoSource;
     /**
-     * Composed provider-connection freshness: the boot server-info source
-     * (Arkade) combined with the contract-manager's indexer-sync health, if the
-     * manager has been initialized. Reads no live provider state — it never
-     * forces a `ContractManager` to construct — so it is safe for readonly
-     * callers that only use address/balance APIs.
+     * Composed provider-connection freshness: the LATEST server-info
+     * resolution (boot, or any later {@link getArkadeInfo} read) combined with
+     * the contract-manager's indexer-sync health, if the manager has been
+     * initialized. Reads no live provider state — it never forces a
+     * `ContractManager` to construct — so it is safe for readonly callers
+     * that only use address/balance APIs.
      *
-     *  - Boot fell back to a cached snapshot → degraded on `arkade` (`cache`).
+     *  - Latest resolution fell back to the cached snapshot → degraded on
+     *    `arkade` (`cache`).
      *  - Otherwise, if the contract manager has degraded to repository data →
      *    degraded on `indexer` (`repository`).
      *  - Otherwise online.
@@ -829,10 +844,17 @@ declare class ReadonlyWallet implements IReadonlyWallet {
      * (e.g. the service-worker sync-state message).
      */
     getContractSyncState(): ContractSyncState;
-    protected constructor(identity: ReadonlyIdentity, network: Network, onchainProvider: OnchainProvider, indexerProvider: IndexerProvider, arkServerPublicKey: Bytes, offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script, boardingTapscript: DefaultVtxo.Script, dustAmount: bigint, walletRepository: WalletRepository, contractRepository: ContractRepository, delegateProvider?: DelegateProvider | undefined, watcherConfig?: ReadonlyWalletConfig["watcherConfig"], walletContractTimelocks?: RelativeTimelock[]);
+    protected constructor(identity: ReadonlyIdentity, network: Network, onchainProvider: OnchainProvider, 
+    /**
+     * Narrowed to what a readonly wallet legitimately needs — the only use
+     * here is {@link getArkadeInfo}. `protected` stops an outside caller
+     * reaching it; the `Pick` stops this class growing a use for
+     * `submitTx`. `Wallet` re-widens both below.
+     */
+    arkProvider: Pick<ArkProvider, "getInfo">, indexerProvider: IndexerProvider, arkServerPublicKey: Bytes, offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script, boardingTapscript: DefaultVtxo.Script, dustAmount: bigint, walletRepository: WalletRepository, contractRepository: ContractRepository, delegateProvider?: DelegateProvider | undefined, watcherConfig?: ReadonlyWalletConfig["watcherConfig"], walletContractTimelocks?: RelativeTimelock[]);
     /**
      * x-only hex of the operator's deprecated signer keys (from
-     * `ArkInfo.deprecatedSigners`), cached for the OFFLINE read/watch paths.
+     * `ArkadeInfo.deprecatedSigners`), cached for the OFFLINE read/watch paths.
      * The boarding watch/history surfaces ({@link getBoardingAddresses},
      * {@link getBoardingTxs}) fan out over {current} ∪ this set so a deposit at
      * a boarding address minted under a now-rotated operator signer keeps being
@@ -869,7 +891,7 @@ declare class ReadonlyWallet implements IReadonlyWallet {
      * against mid-flight rotation pass their snapshot, so the check reads from
      * one rotation epoch.
      */
-    protected recipientAddressContext(serverPubKey?: Bytes): RecipientAddressContext;
+    protected recipientAddressContext(serverPubKey?: Bytes): RecipientArkadeAddressContext;
     /**
      * Currently-active receive tapscript. Read-only from the outside;
      * mutated only via {@link Wallet.setOffchainTapscriptForRotation}
@@ -884,6 +906,45 @@ declare class ReadonlyWallet implements IReadonlyWallet {
      * span a rotation.
      */
     get arkServerPublicKey(): Bytes;
+    /**
+     * Server info for the Arkade server this wallet is connected to, resolved
+     * exactly as construction resolves it: live wins, a retryable failure
+     * falls back to the snapshot persisted at boot, a terminal one propagates.
+     *
+     * Live rather than the pinned boot snapshot because the fields callers
+     * come here for — `signerPubkey`, `checkpointTapscript`, `fees` — are the
+     * ones a mid-session rotation moves, and a covenant built against a
+     * superseded signer is unspendable.
+     *
+     * One rotation caveat: reading does NOT re-pin the wallet —
+     * {@link arkServerPublicKey}, {@link dustAmount} and the tapscripts move
+     * only through `handleServerInfoChanged`/`rotateServerSigner` — so inside
+     * a rotation window this can report epoch N+1 while the wallet still
+     * spends on N. The window closes on its own: a read that observes a moved
+     * digest makes the provider emit `onServerInfoChanged`, which is what
+     * drives that rotation. A caller about to bind the answer into a covenant
+     * passes `{ requireLive: true }` and fails closed instead of receiving
+     * the boot snapshot.
+     *
+     * @returns The Arkade server's info
+     * @see ArkadeInfo
+     */
+    getArkadeInfo(opts?: GetArkadeInfoOptions): Promise<ArkadeInfo>;
+    /**
+     * Chain reads against this wallet's server for scripts it does not own.
+     *
+     * Binds the wallet's own `indexerProvider` — which may be an Expo or
+     * injected one that a caller's hand-built `RestIndexerProvider` would
+     * silently bypass. `getVtxos` goes through
+     * {@link getNormalizedVtxos}, which is what makes every VTXO leaving the
+     * seam carry its canonical facts.
+     *
+     * A bound object rather than the provider itself, so an `IReadonlyWallet`
+     * holder gets `getVtxos`/`getVirtualTxs` and nothing else at runtime.
+     * (`indexerProvider` is still public on the concrete classes, unlike
+     * `arkProvider`, so this narrows the interface rather than the field.)
+     */
+    getArkadeReader(): Promise<ArkadeReader>;
     /**
      * The wallet's current boarding tapscript (the on-chain onboarding
      * target). Read-only from the outside; mutated only via
@@ -931,7 +992,7 @@ declare class ReadonlyWallet implements IReadonlyWallet {
         dustAmount: bigint;
         walletRepository: WalletRepository;
         contractRepository: ContractRepository;
-        info: ArkInfo;
+        info: ArkadeInfo;
         serverInfoSource: ServerInfoSource;
         serverInfoLastOnlineAt: number | undefined;
         delegateProvider: DelegateProvider | undefined;
@@ -1224,7 +1285,6 @@ declare class ReadonlyWallet implements IReadonlyWallet {
  * ```
  */
 declare class Wallet extends ReadonlyWallet implements IWallet, HDWalletCapable, AddressAllocationCapable {
-    readonly arkProvider: ArkProvider;
     readonly forfeitOutputScript: Bytes;
     readonly forfeitPubkey: Bytes;
     /** Overrides for the `batchExpiry` bounds; defaults derive from `network`. */
@@ -1346,7 +1406,7 @@ declare class Wallet extends ReadonlyWallet implements IWallet, HDWalletCapable,
     /**
      * Output script for checkpoint transactions, decoded from the server's
      * `checkpointTapscript`. Server-controlled state: pinned at construction
-     * and re-sourced from a fresh `ArkInfo` on server-signer rotation. Read it
+     * and re-sourced from a fresh `ArkadeInfo` on server-signer rotation. Read it
      * through {@link serverUnrollScript}; write it only through
      * {@link setServerUnrollScriptForRotation}.
      */
@@ -1355,7 +1415,7 @@ declare class Wallet extends ReadonlyWallet implements IWallet, HDWalletCapable,
     /**
      * @internal Sole write path for `serverUnrollScript` after construction.
      * Called by {@link Wallet._doRotateServerSigner} with the checkpoint script
-     * sourced from the fresh `ArkInfo` that triggered the rotation, so the send
+     * sourced from the fresh `ArkadeInfo` that triggered the rotation, so the send
      * path builds checkpoints against the new server epoch. External code must
      * treat `serverUnrollScript` as read-only.
      */
@@ -1638,6 +1698,21 @@ declare class Wallet extends ReadonlyWallet implements IWallet, HDWalletCapable,
         thresholdMs: number;
     };
     readonly settlementConfig: SettlementConfig | false;
+    /**
+     * Re-widened to public: a full wallet's provider is part of its API
+     * (`ExpoWallet` and the delegate manager read it), while `ReadonlyWallet`
+     * keeps it protected so a readonly view cannot hand out `submitTx`.
+     */
+    readonly arkProvider: ArkProvider;
+    /**
+     * Broadcast access bound to this wallet's server, so a plugin needs only
+     * the wallet.
+     *
+     * Defined here and not on {@link ReadonlyWallet} for the same reason
+     * `arkProvider` is protected there: a readonly wallet, and every
+     * `toReadonly()` view, must not be able to submit.
+     */
+    getArkadeBroadcaster(): Promise<ArkadeBroadcaster>;
     protected constructor(identity: Identity, network: Network, onchainProvider: OnchainProvider, arkProvider: ArkProvider, indexerProvider: IndexerProvider, arkServerPublicKey: Bytes, offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script, boardingTapscript: DefaultVtxo.Script, serverUnrollScript: CSVMultisigTapscript.Type, forfeitOutputScript: Bytes, forfeitPubkey: Bytes, dustAmount: bigint, walletRepository: WalletRepository, contractRepository: ContractRepository, 
     /** @deprecated Use settlementConfig */
     renewalConfig?: WalletConfig["renewalConfig"], delegateProvider?: DelegateProvider, watcherConfig?: WalletConfig["watcherConfig"], settlementConfig?: WalletConfig["settlementConfig"], walletContractTimelocks?: RelativeTimelock[], receiveRotator?: WalletReceiveRotator, descriptorProvider?: DescriptorProvider, lookAheadWindow?: number, 

package/dist/{index-BiACuWaf.d.ts → index-D3hmsuKs.d.cts}

@@ -1,5 +1,5 @@
-import { bg as ContractHandler, s as RelativeTimelock, bs as Discoverable, V as VtxoScript, t as TapLeafScript, d4 as TapscriptDeriving } from './index-DU5o_hz7.js';
-import { D as DefaultVtxo, a as DelegateVtxo } from './delegate-cdmzb2f9.js';
+import { bn as ContractHandler, w as RelativeTimelock, bz as Discoverable, V as VtxoScript, x as TapLeafScript, df as TapscriptDeriving } from './index-Udm5V2xW.cjs';
+import { D as DefaultVtxo, a as DelegateVtxo } from './delegate-DLIOBQ5x.cjs';
 import { Bytes } from '@scure/btc-signer/utils.js';
 
 /**
@@ -114,96 +114,79 @@ declare namespace VHTLC {
         unilateralRefundDelay: RelativeTimelock;
         unilateralRefundWithoutReceiverDelay: RelativeTimelock;
         /**
-         * Optional non-interactive claim leaf: `server` plus a covenant-tweaked
-         * emulator co-signer, pinned to `receiverPkScript`. Lets the receiver's
-         * claim be pushed by the emulator without the receiver being online.
+         * The emulator covenant leaves, ALL OR NOTHING. Present, this adds the
+         * three non-interactive leaves the emulator co-signs under a covenant
+         * pinning the payout to a pre-committed destination:
+         *
+         *  - `nonInteractiveClaim`: `server` + a covenant-tweaked emulator
+         *    co-signer, paying `receiverPkScript` — the receiver's claim can
+         *    be pushed without the receiver being online.
+         *  - `nonInteractiveRefund`: `server` + `receiver` + a covenant-tweaked
+         *    emulator co-signer, paying `senderPkScript`, no timelock — lets
+         *    server and receiver release the refund the moment they agree the
+         *    swap has failed, and recoverable even if the sender's own key is
+         *    lost, since no OTHER refund-side leaf survives that.
+         *  - `nonInteractiveRefundWithoutReceiver`: `server` + the SAME
+         *    covenant-tweaked co-signer as `nonInteractiveRefund`, paying
+         *    `senderPkScript` after `refundLocktime` — the only refund tier
+         *    needing no participant signature at all, so a sender who funded
+         *    a lockup and vanished is refundable through it alone.
+         *
+         * WHY ONE FLAG AND NOT A SWITCH PER LEAF. The three are one mechanism
+         * — the same emulator key, the same `enforcePayTo` covenant pointed
+         * at a per-role destination — and they protect opposite directions of
+         * the same swap, so no real configuration wants a subset. A subset
+         * would cost, not buy: every optional leaf multiplies the tree shapes
+         * a counterparty must derive to verify an address (nothing on the
+         * wire says which leaves a quote carries), so per-leaf toggling turns
+         * one address comparison into a combinatorial guess. All-or-nothing
+         * keeps the shape count at two: suite, or no suite.
+         *
+         * Leaf order fixes the taproot merkle root, so the suite is appended
+         * after the six signature leaves in a fixed order (claim, refund,
+         * timelocked refund) and a script built with this option NEVER
+         * collides with one built without it — which is what makes "did this
+         * quote opt in" a question an address comparison answers.
+         *
+         * STABLE PER RELEASE: what this option builds does not change within
+         * a published SDK version. A future covenant leaf joins the suite
+         * only behind a NEW option, so re-deriving a lockup with the SDK
+         * that quoted it reproduces its address byte-for-byte.
          */
-        nonInteractiveClaim?: {
-            receiverPkScript: Bytes;
+        nonInteractiveParameters?: {
+            /**
+             * The emulator service's public key, 32-byte x-only or 33-byte
+             * compressed. ONE key, tweaked per covenant destination, becomes
+             * the co-signer of every leaf in the suite — the leaves share it
+             * structurally, and BIP-341 tapscript sighashes committing to the
+             * tapleaf hash are what keep a signature for one leaf from
+             * replaying against another.
+             */
             emulatorPubkey: Bytes;
             /**
-             * OPT-IN: also require the claim to pay at least these amounts.
-             *
-             * The covenant's default bound is conservation (`out >= in`) — see
-             * {@link enforcePayTo} for why a quote is normally not the
-             * covenant's business. This is the escape hatch for a consumer that
-             * wants the quote enforced in script rather than at its own
-             * admission layer.
-             *
-             * ADDITIVE, NEVER A REPLACEMENT. The conservation bound stays. On
-             * its own, `out >= quoted` leaves everything ABOVE the quote
-             * unconstrained, so an overfunded lockup's surplus could be routed
-             * anywhere by whoever assembles the spend — trading an underfunding
-             * hole for a skimming one. Both bounds together admit neither.
-             *
-             * WHAT IT COSTS, and it is not only opcodes:
-             *
-             *  - THE ADDRESS BECOMES A FUNCTION OF THE QUOTE. These amounts
-             *    compile into the leaf, hence the emulator key, hence the
-             *    pkScript. A re-quote is a different address, and cannot be
-             *    applied to a lockup already funded.
-             *  - AN UNDERFUNDED LOCKUP BECOMES UNCLAIMABLE. Its only exit is the
-             *    refund path, which waits out the CLTV. That is the intended
-             *    incentive and it lands on whoever misfunded — but it converts
-             *    "claim the short amount now and settle up" into "wait for the
-             *    timelock".
-             *
-             * Omit for the default. Omitting leaves every script byte unchanged,
-             * so contracts already funded keep their addresses.
+             * Where the claim covenant pays: the receiver's own P2TR
+             * pkScript, 34 bytes.
+             */
+            receiverPkScript: Bytes;
+            /**
+             * Where BOTH refund covenants pay: the sender's own P2TR
+             * pkScript, 34 bytes. One destination shared by both refund
+             * leaves, so they cannot diverge on where a refund goes.
              */
-            strict?: {
-                /** Sats the claim must pay. Positive. */
-                amount: bigint;
-                /**
-                 * Asset base units the claim must pay.
-                 *
-                 * Required iff {@link VHTLC.Options.asset} is set, and refused
-                 * otherwise. Strict-on-sats-only against an asset-denominated
-                 * contract would pin the sat CARRIER and say nothing about the
-                 * asset that is the actual amount — half-enforcement that reads
-                 * like enforcement, which is the failure this option exists to
-                 * avoid rather than introduce.
-                 */
-                assetAmount?: bigint;
-            };
-        };
-        /**
-         * Optional non-interactive refund leaf: `server` + `receiver` + a
-         * covenant-tweaked emulator co-signer, pinned to `senderPkScript`, no
-         * timelock. Every OTHER refund-side leaf in this contract requires
-         * the sender's own signature — if the sender permanently loses that
-         * key, none of them are reachable. This leaf is the one exception:
-         * it needs neither the sender's presence nor their key, so funds
-         * remain recoverable to the sender's pre-committed address even
-         * then. It still needs the receiver (unlike `nonInteractiveClaim`,
-         * which needs only server + emulator) — deliberately: this is what
-         * lets server + receiver release the refund immediately, the moment
-         * they agree the swap has failed, rather than making the sender wait
-         * out `refundLocktime` the way {@link Script.refundWithoutReceiver}
-         * does.
-         */
-        nonInteractiveRefund?: {
             senderPkScript: Bytes;
-            emulatorPubkey: Bytes;
             /**
-             * Also emit the timelocked twin: `server` plus the SAME
-             * covenant-tweaked co-signer, spendable after `refundLocktime`
-             * with no receiver signature and no sender signature.
+             * LEGACY REBUILD ONLY — never for a new lockup.
              *
-             * This is the only refund tier that needs nobody: `refund` and
-             * `refundWithoutReceiver` need the sender's key,
-             * `nonInteractiveRefund` needs the receiver's. A sender who
-             * funded a lockup and vanished is refundable through this leaf
-             * alone, by anyone, to their pre-committed address.
-             *
-             * Off by default: it is an additional leaf, appended last, so
-             * enabling it changes the taproot merkle root and therefore the
-             * address. `nonInteractiveClaim` and `nonInteractiveRefund` are
-             * independently optional, so this is the NINTH leaf only in the
-             * full swap-corridor configuration where both are set — on its
-             * own, it is the eighth.
+             * `"preTimelockedRefund"` builds the suite WITHOUT its timelocked
+             * refund leaf: the shape every emulator-covenant lockup funded
+             * before that leaf shipped carries. Lockups already funded in that
+             * shape keep it permanently — a leaf cannot be retrofitted onto an
+             * address already committed — so re-deriving such a lockup (to
+             * spend it, or to verify an old quote's address) needs this. A new
+             * lockup that omits the leaf gives up the one refund tier needing
+             * nobody, for nothing.
              */
-            withoutReceiver?: boolean;
+            legacy?: "preTimelockedRefund";
         };
         /**
          * Optional: denominate this contract in an Arkade ASSET rather than in
@@ -360,35 +343,33 @@ declare namespace VHTLC {
      * - **unilateralClaim**: Receiver can claim unilaterally after delay
      * - **unilateralRefund**: Sender and receiver can refund unilaterally after delay
      * - **unilateralRefundWithoutReceiver**: Sender can refund unilaterally after delay
-     * - **nonInteractiveClaim** (optional): server + emulator can push the
-     *   receiver's claim, pinned to a pre-committed destination
-     * - **nonInteractiveRefund** (optional): server + receiver + emulator
-     *   can push the sender's refund immediately, no timelock, pinned to a
-     *   pre-committed destination — recoverable even if the sender's own key
-     *   is lost
-     * - **nonInteractiveRefundWithoutReceiver** (optional): server + emulator
-     *   can push the sender's refund after `refundLocktime`, pinned to a
-     *   pre-committed destination — the only refund tier needing no
-     *   participant signature at all
+     * - **nonInteractiveClaim** (with `nonInteractiveParameters`): server + emulator
+     *   can push the receiver's claim, pinned to a pre-committed destination
+     * - **nonInteractiveRefund** (with `nonInteractiveParameters`): server + receiver
+     *   + emulator can push the sender's refund immediately, no timelock,
+     *   pinned to a pre-committed destination — recoverable even if the
+     *   sender's own key is lost
+     * - **nonInteractiveRefundWithoutReceiver** (with `nonInteractiveParameters`):
+     *   server + emulator can push the sender's refund after `refundLocktime`,
+     *   pinned to a pre-committed destination — the only refund tier needing
+     *   no participant signature at all
      *
      * See {@link ScriptV2} for the current recommended construction — same
      * leaf ladder, same options shape, an added length check on the claim
      * preimage. This class is unchanged and stays available as-is.
      *
-     * **Pre-existing limitation, widened rather than introduced by
-     * `nonInteractiveRefundWithoutReceiver`.** `nonInteractiveClaim` and
-     * `nonInteractiveRefund` (and now its `withoutReceiver` leaf) build on
-     * this class exactly as they do on {@link ScriptV2} — both extend the
-     * same `BaseScript` where these leaves are constructed. But the `vhtlc`
+     * **Pre-existing limitation: the `vhtlc` contract handler registers none
+     * of the covenant leaves.** `nonInteractiveParameters` builds on this class
+     * exactly as it does on {@link ScriptV2} — both extend the same
+     * `BaseScript` where those leaves are constructed. But the `vhtlc`
      * contract handler (`src/contracts/handlers/vhtlc.ts`) round-trips none
      * of them: its params type carries no covenant fields, and
      * `createScript` only ever builds the six signature-only leaves. A V1
-     * script built with either covenant option therefore compiles and can
+     * script built with the covenant suite therefore compiles and can
      * be funded, but cannot be registered as a `vhtlc` contract — the
      * handler would derive a different (six-leaf) script for the same
-     * params and `ContractManager` refuses the mismatch. This was already
-     * true before `withoutReceiver` existed; it now applies to one more
-     * option than before, not to a newly-exposed one.
+     * params and `ContractManager` refuses the mismatch. Register through
+     * the `vhtlc-v2` handler instead, which round-trips the suite.
      *
      * @example
      * ```typescript
@@ -460,9 +441,9 @@ declare const VHTLCContractHandler: ContractHandler<VHTLCContractParams, VHTLC.S
  * The eight mandatory fields are `VHTLCContractParams` verbatim — the two
  * script versions take the same {@link VHTLC.Options}, so a divergent shape
  * here would be a difference with no cause. What V1's handler has no field for
- * is the two optional covenant leaves, and those are exactly what the swap
- * corridor's lockup carries, so leaving them out would make this handler unable
- * to round-trip the contract it exists to serve.
+ * is the emulator covenant suite, and that is exactly what the swap corridor's
+ * lockup carries, so leaving it out would make this handler unable to
+ * round-trip the contract it exists to serve.
  */
 interface VHTLCV2ContractParams {
     sender: Uint8Array;
@@ -484,28 +465,24 @@ interface VHTLCV2ContractParams {
         /** The asset group index within that genesis transaction. */
         groupIndex: number;
     };
-    /** @see VHTLC.Options.nonInteractiveClaim */
-    nonInteractiveClaim?: {
+    /**
+     * The emulator covenant suite, all or nothing — mirrors {@link
+     * VHTLC.Options.nonInteractiveParameters} exactly, including the legacy selector:
+     * a row funded before the timelocked refund leaf shipped round-trips with
+     * `legacy: "preTimelockedRefund"` and re-derives its eight-leaf shape.
+     */
+    nonInteractiveParameters?: {
         receiverPkScript: Uint8Array;
         emulatorPubkey: Uint8Array;
-        /** @see VHTLC.Options.nonInteractiveClaim.strict */
-        strict?: {
-            amount: bigint;
-            assetAmount?: bigint;
-        };
-    };
-    /** @see VHTLC.Options.nonInteractiveRefund */
-    nonInteractiveRefund?: {
         senderPkScript: Uint8Array;
-        emulatorPubkey: Uint8Array;
-        /** @see VHTLC.Options.nonInteractiveRefund.withoutReceiver */
-        withoutReceiver?: boolean;
+        /** @see VHTLC.Options.nonInteractiveParameters.legacy */
+        legacy?: "preTimelockedRefund";
     };
 }
 /**
  * Handler for {@link VHTLC.ScriptV2} — the VHTLC whose preimage leaves carry an
  * explicit `OP_SIZE 32 OP_EQUALVERIFY` before the hash check, and which the RFQ
- * swap corridor builds (`@arkade-os/swap`'s `lightningSendVtxoScript`).
+ * swap corridor builds (`@arkade-os/swap`'s `lightningSendContract`).
  *
  * **Why a separate type string rather than a flag on `vhtlc`.** A handler's
  * `type` names the script class it derives, the way every other registered type
@@ -564,7 +541,7 @@ declare const VHTLCV2ContractHandler: ContractHandler<VHTLCV2ContractParams, VHT
  * (`pubKey` / `serverPubKey` / `csvTimelock`) rather than inventing
  * boarding-specific names — the boarding semantics come from the
  * contract type and from populating `csvTimelock` with the server's
- * boarding-exit delay (`ArkInfo.boardingExitDelay`) instead of the
+ * boarding-exit delay (`ArkadeInfo.boardingExitDelay`) instead of the
  * offchain unilateral-exit delay.
  */
 type BoardingContractParams = DefaultContractParams;
@@ -580,8 +557,8 @@ type BoardingContractParams = DefaultContractParams;
  *
  * Boarding semantics come entirely from the contract type and from
  * sourcing the CSV timelock from the server's boarding-exit delay
- * (`ArkInfo.boardingExitDelay`), not from renamed parameters. The
- * offchain `default` contract is built from `ArkInfo.unilateralExitDelay`
+ * (`ArkadeInfo.boardingExitDelay`), not from renamed parameters. The
+ * offchain `default` contract is built from `ArkadeInfo.unilateralExitDelay`
  * instead, so the two share a script shape but differ in their CSV
  * timelock value. Parameters round-trip through the same
  * `timelockToSequence` / `sequenceToTimelock` helpers and BIP68 sequence