@arkade-os/sdk 0.5.0-rc.11 → 0.5.0-rc.13

package/dist/wallet-DXNiCmq8.d.ts

@@ -0,0 +1,1542 @@
+import { l as GetNewAddressesOptions, m as NewAddress, a as Identity, a2 as DescriptorProvider, w as RelativeTimelock, a3 as Network, a4 as CSVMultisigTapscript, a5 as BatchStartedEvent, a6 as TreeSigningStartedEvent, a7 as TxTree, a8 as TreeNoncesEvent, a9 as BatchFinalizationEvent, aa as BatchFinalizedEvent, ab as BatchFailedEvent, ac as TreeTxEvent, ad as TreeSignatureEvent, o as SettlementEvent, b as WalletConfig, W as WalletRepository, C as ContractRepository, k as IContractManager, ae as IReadonlyWallet, af as ReadonlyIdentity, ag as OnchainProvider, u as ArkProvider, v as IndexerProvider, ah as DelegateProvider, ai as ReadonlyWalletConfig, X as IntentRepository, _ as VirtualTxRepository, aj as ExitCaptureMode, ak as ExitDataSource, i as ActivityRegistry, al as IReadonlyAssetManager, am as ContractSyncState, an as RecipientArkadeAddressContext, G as GetArkadeInfoOptions, A as ArkadeInfo, c as ArkadeReader, ao as NetworkName, ap as ArkAddress, e as WalletBalance, f as GetVtxosFilter, N as NormalizedExtendedVirtualCoin, g as GetSpendableVtxosFilter, aq as ContractWithVtxos, ar as selectPendingRecoveryOutpoints, h as ArkTransaction, j as Activity, E as ExtendedCoin, as as Coin, B as ExtendedVirtualCoin, at as ContractManager, au as ContractManagerConfig, I as IWallet, av as SettlementConfig, d as ArkadeBroadcaster, q as IAssetManager, aw as VtxoManager, n as IDelegateManager, S as SettleParams, R as Recipient, ax as SignerSession, ay as SignedIntent, az as Intent, p as SendParams, aA as TimeHeight } from './index-CKmB14Yu.js';
+import { Transaction } from '@scure/btc-signer';
+import { TransactionOutput } from '@scure/btc-signer/psbt.js';
+import { Bytes } from '@scure/btc-signer/utils.js';
+import { D as DefaultVtxo, a as DelegateVtxo } from './delegate-BuagcGnG.js';
+
+/**
+ * Capability a wallet exposes so descriptor-blind consumers (Boltz swaps, other plugins) can bind
+ * artifacts to the wallet's current HD index and later enumerate every used index. Probed
+ * structurally ({@link isHDWalletCapable}) rather than widening `IWallet`, so plugins keep working
+ * against older wallets; a static wallet answers "no HD state" through the same methods.
+ */
+interface HDWalletCapable {
+    /**
+     * The descriptor at the wallet's current receive index, or `undefined` for
+     * static / `auto` wallets and HD wallets that have never rotated. Callers
+     * fall back to the identity key.
+     */
+    getCurrentSigningDescriptor(): Promise<string | undefined>;
+    /**
+     * Every descriptor the wallet may hold keys under, ascending by index: the allocation
+     * watermark's band plus any descriptor persisted on a contract. Empty for static wallets.
+     * `lookAhead` appends that many past the watermark without advancing it, for restore probing.
+     */
+    getUsedSigningDescriptors(opts?: {
+        lookAhead?: number;
+    }): Promise<string[]>;
+    /**
+     * An {@link Identity} whose keys and signatures are those of `descriptor`; the wallet
+     * identity itself when `descriptor` is the identity's own key.
+     *
+     * Throws {@link ForeignDescriptorError} for a descriptor this wallet cannot sign for — never
+     * substitutes another key, which would sign happily and surface only as a rejected tx or a
+     * dead script. The returned identity must actually sign (`sign`, `signMessage`,
+     * `signerSession`): `contractSigner` refuses a watch-only one as `WalletCannotSignError`,
+     * which would otherwise pass every check and throw after the contract is funded.
+     */
+    signerForDescriptor(descriptor: string): Promise<Identity>;
+}
+/**
+ * Thrown by {@link HDWalletCapable.signerForDescriptor} when the wallet holds no key for the
+ * descriptor, so callers can tell "not my key" from transient signing failures.
+ */
+declare class ForeignDescriptorError extends Error {
+    readonly descriptor: string;
+    readonly name = "ForeignDescriptorError";
+    constructor(descriptor: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Thrown by `Wallet.getNewAddresses({ forceNew: true })` when there is no HD stream to advance
+ * (`walletMode: 'static'` / `'auto'`, or a {@link DescriptorProvider} that declined). Typed
+ * rather than a silent repeat, which would surface only as two payers sharing a script.
+ */
+declare class WalletCannotAllocateAddressError extends Error {
+    readonly name = "WalletCannotAllocateAddressError";
+    constructor(reason: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Anything that can derive and sign for a descriptor it claims. */
+type DescriptorOwner = Pick<DescriptorProvider, "isOurs" | "signWithDescriptor" | "signMessageWithDescriptor">;
+/**
+ * The identity that signs `descriptor`, or {@link ForeignDescriptorError}. Shared by every
+ * {@link HDWalletCapable.signerForDescriptor} so page- and worker-side wallets cannot drift into
+ * a signer that passes a pubkey check and then throws on every signature, after funding.
+ */
+declare function resolveDescriptorSigner(descriptor: string, identity: Identity, provider?: DescriptorOwner): Promise<Identity>;
+/** Structural type guard for {@link HDWalletCapable}. */
+declare function isHDWalletCapable(value: unknown): value is HDWalletCapable;
+/**
+ * Allocating a *fresh* index — strictly more than {@link HDWalletCapable}'s descriptor awareness.
+ * A separate probe because widening that guard would silently demote every wallet implementing
+ * only its original surface (including older SDKs') from HD-capable to static.
+ */
+interface HDAllocationCapable {
+    /**
+     * The signing descriptor a new artifact (swap, invoice, contract) should bind to. **The
+     * wallet decides**: an HD wallet allocates a fresh index, advancing the watermark; a static
+     * wallet answers with its one `tr(pubkey)` every time. Consumers must not probe the wallet's
+     * shape or mint key material; they use the answer with
+     * {@link HDWalletCapable.signerForDescriptor}.
+     *
+     * `undefined` only for implementations that genuinely cannot answer (`Wallet` always
+     * answers); callers then fall back to the identity key — never a random one.
+     *
+     * Unlike {@link HDWalletCapable.getCurrentSigningDescriptor}, which peeks (two artifacts bound
+     * to a peek share a key). Per-call uniqueness is a wallet property, so anything deriving
+     * per-artifact secrets must check the descriptor's shape, not the wallet's.
+     */
+    getNextSigningDescriptor(): Promise<string | undefined>;
+    /**
+     * Move the allocation watermark to `descriptor`'s index so later allocations cannot reissue
+     * it. Monotonic; a static wallet accepts its own descriptor as a no-op.
+     *
+     * Throws on a descriptor this wallet cannot derive, or an HD descriptor with no parseable
+     * trailing index: mapping those to index 0 would let a restored artifact's index be reissued.
+     */
+    advanceSigningDescriptorWatermark(descriptor: string): Promise<void>;
+}
+/** Structural type guard for {@link HDAllocationCapable}. */
+declare function isHDAllocationCapable(value: unknown): value is HDAllocationCapable;
+/**
+ * Minting addresses to hand out: beyond {@link HDAllocationCapable}'s bare index, the wallet
+ * builds the scripts, persists them as watched contracts, and reports the rows. A third probe
+ * for the same no-silent-demotion reason.
+ */
+interface AddressAllocationCapable {
+    /**
+     * Fresh addresses of each requested type from one newly allocated HD index, persisted and
+     * watched. An HD wallet burns an index; a wallet with no stream answers with its existing
+     * display addresses or, under `forceNew`, throws {@link WalletCannotAllocateAddressError}.
+     *
+     * Unlike {@link HDAllocationCapable.getNextSigningDescriptor}, allocation and script
+     * registration happen together: split across a process boundary, a failed registration
+     * leaves a burnt index and an unwatched address.
+     */
+    getNewAddresses(opts?: GetNewAddressesOptions): Promise<NewAddress[]>;
+}
+/** Structural type guard for {@link AddressAllocationCapable}. */
+declare function isAddressAllocationCapable(value: unknown): value is AddressAllocationCapable;
+
+/** Wall-clock floor for `batchExpiry` outside regtest. */
+declare const DEFAULT_MIN_BATCH_EXPIRY_SECONDS = 86400n;
+/** Wall-clock floor for `batchExpiry` on regtest (~10 blocks). */
+declare const REGTEST_MIN_BATCH_EXPIRY_SECONDS = 6000n;
+/** Bounds applied to a server-supplied `BatchStartedEvent.batchExpiry`. */
+type BatchExpiryPolicy = {
+    /** Minimum wall-clock delay in seconds, after normalization. */
+    minSeconds: bigint;
+    /**
+     * Reject block-typed timelocks. Mirrors arkd, which allows a block-typed
+     * vtxo tree expiry only on regtest.
+     */
+    requireSeconds: boolean;
+    /** When advertised by the operator, `batchExpiry` must equal it exactly. */
+    advertisedVtxoTreeExpiry?: bigint;
+};
+/**
+ * Default policy for a network.
+ *
+ * Derive it from the locally held {@link Network} — pinned at wallet setup —
+ * rather than from a per-round server field, so the permissive regtest branch
+ * can't be selected by the operator at event time.
+ */
+declare function defaultBatchExpiryPolicy(network: Network): BatchExpiryPolicy;
+/** Resolve a policy for `network`, applying any caller overrides on top. */
+declare function resolveBatchExpiryPolicy(network: Network, overrides?: Partial<BatchExpiryPolicy>): BatchExpiryPolicy;
+/**
+ * Check a server-supplied batch expiry against `policy` and return the timelock
+ * to commit to.
+ *
+ * The sweep leaf of the shared batch output is derived from this value, so it
+ * is never reconstructible from anything else the server sends: validating the
+ * tree only proves it is consistent with whatever value was chosen. Callers
+ * must encode the returned timelock rather than re-deriving their own.
+ *
+ * @throws {ServerResponseMismatchError} if the value is out of policy.
+ */
+declare function assertValidBatchExpiry(batchExpiry: bigint, policy: BatchExpiryPolicy): RelativeTimelock;
+
+/** Wall-clock floor for the checkpoint exit delay outside regtest. Matches arkd's own default. */
+declare const DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS = 86400n;
+/**
+ * Wall-clock floor for the checkpoint exit delay on regtest (~2 blocks nominal).
+ *
+ * Deliberately lower than {@link REGTEST_MIN_BATCH_EXPIRY_SECONDS "../wallet/batchExpiry"}: sized
+ * to clear a 5-block `ARKD_CHECKPOINT_EXIT_DELAY` while still rejecting a 1-block attack. Could be
+ * tightened once no external regtest deployment is known to rely on the lower bound.
+ */
+declare const REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS = 1200n;
+/**
+ * Wall-clock floor for the checkpoint exit delay on mutinynet: exactly the hosted Arkade Service's
+ * advertised 4096s (8 * 512) CSV, sized for ~30s blocks.
+ */
+declare const MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS = 4096n;
+/**
+ * Wall-clock floor for the checkpoint exit delay on signet: the hosted Arkade Service's advertised
+ * 86016s (168 * 512), i.e. 24h rounded down to BIP-68's 512s granularity (86400 is not a multiple
+ * of 512, so it cannot be encoded). That is 384s under the default floor.
+ */
+declare const SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS = 86016n;
+/** Bounds applied to a server-supplied `ArkadeInfo.checkpointTapscript`. */
+type CheckpointExitDelayPolicy = {
+    /** Minimum wall-clock delay in seconds, after normalization. */
+    minSeconds: bigint;
+    /** Reject block-typed timelocks. Mirrors arkd, which allows them only on regtest. */
+    requireSeconds: boolean;
+    /**
+     * When set, the script's embedded pubkey must equal this x-only key.
+     *
+     * arkd always builds the checkpoint tapscript from its own `forfeitPubkey`, so pass the one the
+     * caller already trusts: pinned wallet state where it exists, otherwise the same `ArkadeInfo`
+     * response's `forfeitPubkey` as a self-consistency check.
+     */
+    advertisedForfeitPubkey?: Bytes;
+};
+/**
+ * Default policy for a network. Derived from the locally pinned {@link Network}, not server data,
+ * so the operator cannot select the permissive regtest branch.
+ */
+declare function defaultCheckpointExitDelayPolicy(network: Network): CheckpointExitDelayPolicy;
+/** Resolve a policy for `network`, applying any caller overrides on top. */
+declare function resolveCheckpointExitDelayPolicy(network: Network, overrides?: Partial<CheckpointExitDelayPolicy>): CheckpointExitDelayPolicy;
+/**
+ * Decode and validate a server-supplied `checkpointTapscript` against `policy`.
+ *
+ * Every offchain send/claim builds its checkpoint outputs' server-claim leaf from this script, so
+ * a sub-floor or wrong-pubkey value lets the operator sweep an in-flight checkpoint before it
+ * settles. This is the sole gate: callers must use the returned script, not decode their own.
+ *
+ * @throws {ServerResponseMismatchError} if the script fails to decode, its
+ *   timelock is out of policy, or its pubkey does not match
+ *   `policy.advertisedForfeitPubkey` (when set).
+ */
+declare function assertValidServerUnrollScript(checkpointTapscript: string, policy: CheckpointExitDelayPolicy): CSVMultisigTapscript.Type;
+
+declare class ArkError extends Error {
+    readonly code: number;
+    readonly message: string;
+    readonly name: string;
+    readonly metadata?: Record<string, string> | undefined;
+    constructor(code: number, message: string, name: string, metadata?: Record<string, string> | undefined);
+}
+/**
+ * Structured arkd error `name`s the SDK branches on, centralized so call sites don't
+ * hardcode string literals. Not an exhaustive mirror of the server's codes — only the
+ * ones the SDK acts on.
+ */
+declare const ArkErrorName: {
+    readonly DIGEST_MISMATCH: "DIGEST_MISMATCH";
+    readonly VTXO_ALREADY_SPENT: "VTXO_ALREADY_SPENT";
+    readonly INVALID_TX_FILTER: "INVALID_TX_FILTER";
+    readonly TX_FILTERS_LIMIT_EXCEEDED: "TX_FILTERS_LIMIT_EXCEEDED";
+    /**
+     * A CLTV closure was spent before its absolute locktime matured. `submitTx` only, with
+     * metadata `{ locktime, current_locktime, type: "height" | "time" }`. Self-healing, so defer
+     * and retry: the server matures a seconds-locktime against the **chain tip block's
+     * timestamp**, not wall clock, so a prompt spend is rejected until a later block lands.
+     */
+    readonly FORFEIT_CLOSURE_LOCKED: "FORFEIT_CLOSURE_LOCKED";
+};
+type ArkErrorName = (typeof ArkErrorName)[keyof typeof ArkErrorName];
+/**
+ * Type guard for a structured {@link ArkError}, optionally narrowing to a cataloged
+ * {@link ArkErrorName}; for an uncataloged name, add it there or compare `err.name` after the
+ * one-argument form.
+ *
+ * @example
+ * if (isArkError(maybeArkError(err), ArkErrorName.DIGEST_MISMATCH)) { ... }
+ */
+declare function isArkError(error: unknown, name?: ArkErrorName): error is ArkError;
+/**
+ * Which remote dependency an availability failure refers to; labels the
+ * {@link ProviderUnavailableError} message and `ProviderConnectionState`. Deliberately *not* a
+ * field on the error: structured clone across the service-worker `postMessage` boundary keeps
+ * `message`, `stack` and `cause` but drops own-properties and normalizes a custom `name` to
+ * `"Error"`.
+ */
+type ProviderKind = "arkade" | "indexer";
+/**
+ * A remote provider (Arkade operator or its indexer) is temporarily unreachable: transport
+ * failure, timeout, or a 5xx/429. Retryable, unlike terminal config/auth/schema errors, which
+ * stay a plain `Error`/{@link ArkError}. The low-level error is kept as {@link Error.cause}.
+ */
+declare class ProviderUnavailableError extends Error {
+    /** Always `true`: this error type only ever wraps retryable conditions. */
+    readonly retryable = true;
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * A response doesn't reconcile with what the SDK submitted or validated (a checkpoint txid not
+ * among those submitted, a commitment tx differing from the one validated at tree signing).
+ * Terminal: the two are equal by construction in a well-formed exchange. `retryable` and `name`
+ * don't cross the SW boundary (see {@link ProviderKind}), so every distinguishing detail belongs
+ * in `message`.
+ */
+declare class ServerResponseMismatchError extends Error {
+    readonly retryable = false;
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Try to convert an error to an ArkError class, returning undefined if the error is not an ArkError
+ * @param error - The error to parse
+ * @returns The parsed ArkError, or undefined if the error is not an ArkError
+ */
+declare function maybeArkError(error: any): ArkError | undefined;
+
+/** Where the {@link ArkadeInfo} used to construct a wallet came from. */
+type ServerInfoSource = "live" | "cache";
+
+/**
+ * Batch namespace provides utilities for joining and processing batch session.
+ * The batch settlement process involves multiple events, this namespace provides abstractions and types to handle them.
+ * @see https://docs.arkadeos.com/learn/pillars/batch-swaps
+ * @example
+ * ```typescript
+ * // use wallet handler or create a custom one
+ * const handler = wallet.createBatchHandler(intentId, inputs, expectedRecipients, musig2session);
+ *
+ * const abortController = new AbortController();
+ * // Get event stream from the Arkade provider
+ * const eventStream = arkProvider.getEventStream(
+ *   abortController.signal,
+ *   ['your-topic-1', 'your-topic-2']
+ * );
+ *
+ * // Join the batch and process events
+ * try {
+ *   const commitmentTxid = await Batch.join(eventStream, handler);
+ *   console.log('Batch completed with commitment:', commitmentTxid);
+ * } catch (error) {
+ *   console.error('Batch processing failed:', error);
+ * } finally {
+ *   abortController.abort();
+ * }
+ * ```
+ */
+declare namespace Batch {
+    interface Handler {
+        /**
+         * Called on BatchStarted event.
+         * @returns { skip: boolean } indicating whether the batch should be skipped or not.
+         */
+        onBatchStarted(event: BatchStartedEvent): Promise<{
+            skip: boolean;
+        }>;
+        /**
+         * Called when tree signing starts.
+         * @param event The tree signing started event.
+         * @param vtxoTree The unsigned virtual output tree, reconstructed from the TreeTxEvent events.
+         * @returns Promise resolving to a boolean indicating whether to continue processing.
+         */
+        onTreeSigningStarted(event: TreeSigningStartedEvent, vtxoTree: TxTree): Promise<{
+            skip: boolean;
+        }>;
+        /**
+         * Called when tree nonces are received.
+         * @param event The tree nonces event.
+         * @returns Promise resolving to a boolean indicating whether signing is complete.
+         */
+        onTreeNonces(event: TreeNoncesEvent): Promise<{
+            fullySigned: boolean;
+        }>;
+        /**
+         * Called during batch finalization.
+         * @param event The batch finalization event.
+         * @param vtxoTree The signed virtual output tree, reconstructed from the TreeTxEvent events.
+         * @param connectorTree The connector transaction tree, reconstructed from the TreeTxEvent events.
+         */
+        onBatchFinalization(event: BatchFinalizationEvent, vtxoTree?: TxTree, connectorTree?: TxTree): Promise<void>;
+        /**
+         * Called when batch finalization completes successfully.
+         *
+         * @param event - Batch finalized event
+         */
+        onBatchFinalized?(event: BatchFinalizedEvent): Promise<void>;
+        /**
+         * Called when batch processing fails.
+         *
+         * @param event - Batch failed event
+         */
+        onBatchFailed?(event: BatchFailedEvent): Promise<void>;
+        /**
+         * Called for each virtual output tree transaction chunk received during batch processing.
+         *
+         * @param event - Tree transaction event
+         */
+        onTreeTxEvent?(event: TreeTxEvent): Promise<void>;
+        /**
+         * Called for each tree signature event received during batch processing.
+         *
+         * @param event - Tree signature event
+         */
+        onTreeSignatureEvent?(event: TreeSignatureEvent): Promise<void>;
+    }
+    /**
+     * Options for the join function.
+     *
+     * @property abortController - Abort controller used to cancel batch processing.
+     * @property skipVtxoTreeSigning - Ignore events related to the virtual output tree musig2 signing session.
+     * @property eventCallback - Callback invoked for each settlement event received while joining the batch.
+     */
+    type JoinOptions = Partial<{
+        abortController: AbortController;
+        skipVtxoTreeSigning: boolean;
+        eventCallback: (event: SettlementEvent) => Promise<void>;
+    }>;
+    /**
+     * Start the state machine that will process the batch events and join a batch.
+     * @param eventIterator - The events stream to process.
+     * @param handler - How to react to events.
+     * @param options - Options.
+     */
+    function join(eventIterator: AsyncIterableIterator<SettlementEvent>, handler: Handler, options?: JoinOptions): Promise<string>;
+}
+
+/**
+ * Inputs a {@link ReceiveRotatorFactory} gets at boot to find the current display contract or
+ * allocate a fresh descriptor. Allocation only: `resolveBoot` rebuilds the tapscript afterwards.
+ */
+interface ReceiveRotatorBootOpts {
+    walletRepository: WalletRepository;
+    contractRepository: ContractRepository;
+    serverPubKey: Uint8Array;
+    /** When set, only this contract family is considered for the current display contract. */
+    expectedContractType?: "default" | "delegate";
+    /**
+     * The wallet's baseline (index-0) x-only receive pubkey, used by {@link
+     * WalletReceiveRotator.defaultBoot} when no tagged receive row exists. Such a wallet never
+     * rotated L2, and the raw watermark can't be used: boarding shares the HD index stream, so a
+     * boarding-only allocation may have advanced it.
+     */
+    baselineReceivePubKey?: Uint8Array;
+    /** Receives rotation-failure and backoff diagnostics. Defaults to `console`. */
+    logger?: Logger;
+}
+/**
+ * Output of {@link ReceiveRotatorFactory.createReceiveRotator}: the rotator plus the receive
+ * pubkey resolved at boot (existing tagged display contract's, or freshly allocated).
+ */
+interface ReceiveRotatorBoot {
+    rotator: WalletReceiveRotator;
+    receivePubkey: Uint8Array;
+}
+/**
+ * What {@link WalletReceiveRotator.resolveBoot} returns: the rotator, the offchain tapscript to
+ * use (rebuilt to the boot pubkey if it differs), and the provider, which the wallet keeps so
+ * spends route per-input signing through {@link DescriptorProvider.signWithDescriptor}.
+ */
+interface ReceiveRotatorBootResult {
+    rotator: WalletReceiveRotator;
+    offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script;
+    provider: DescriptorProvider;
+}
+/**
+ * Opt-in {@link DescriptorProvider} extension for providers driving HD receive rotation
+ * (implemented by {@link HDDescriptorProvider}). Kept out of the core interface so
+ * allocate-and-sign providers needn't know the receive lifecycle; without it the wallet uses
+ * {@link WalletReceiveRotator.defaultBoot}.
+ */
+interface ReceiveRotatorFactory {
+    createReceiveRotator(opts: ReceiveRotatorBootOpts): Promise<ReceiveRotatorBoot | undefined>;
+}
+/**
+ * Parse the trailing HD child index from a materialized signing descriptor
+ * (`tr(...xpub.../0/<index>)`). Returns 0 when absent or unparseable: restore registers the
+ * index-0 baseline untagged, so a missing descriptor legitimately means 0.
+ */
+declare function signingDescriptorIndex(descriptor: unknown): number;
+/**
+ * Strict {@link signingDescriptorIndex}: `undefined` instead of the 0 fallback, for callers
+ * (e.g. watermark moves) where mapping "unparseable" to 0 would silently do nothing.
+ */
+declare function strictSigningDescriptorIndex(descriptor: string): number | undefined;
+/** Minimal logging surface the rotator needs; `console` or any structured logger satisfies it. */
+interface Logger {
+    error(message: string, ...args: unknown[]): void;
+}
+/**
+ * The wallet surface the rotator needs at runtime. An interface to avoid a circular dependency on
+ * `wallet.ts`; `Wallet` satisfies it structurally.
+ */
+interface RotatableWallet {
+    readonly defaultContractScript: string;
+    readonly network: {
+        hrp: string;
+    };
+    readonly arkServerPublicKey: Uint8Array;
+    readonly offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script;
+    /**
+     * @internal Sole sanctioned write path for `offchainTapscript` after construction; called
+     * once per rotation after the new display contract is persisted.
+     */
+    setOffchainTapscriptForRotation(tapscript: DefaultVtxo.Script | DelegateVtxo.Script): void;
+    getContractManager(): Promise<IContractManager>;
+    getAddress(): Promise<string>;
+}
+/**
+ * Owns the wallet's HD receive-rotation lifecycle; exists only when `walletMode` resolves to a
+ * {@link DescriptorProvider}.
+ *
+ * 1. `resolveBoot()` (before Wallet construction): reuse the display contract's pubkey or
+ *    allocate the first descriptor.
+ * 2. `install(wallet)`: subscribe to `vtxo_received` and rotate on matching events.
+ * 3. `dispose()`: unsubscribe and drain any in-flight rotation.
+ *
+ * NArk parity: the provider is a pure allocator; the current address comes from the contract
+ * repository, not the provider.
+ */
+declare class WalletReceiveRotator {
+    private readonly provider;
+    private unsubscribe?;
+    private chain;
+    /**
+     * Script of the latest tagged display contract, retired by the next `rotate()`. `undefined`
+     * means the untagged index-0 baseline is displayed, which must NOT be deactivated.
+     */
+    private currentTaggedScript;
+    /** Drives exponential backoff so a broken provider isn't hammered on every inbound VTXO. */
+    private consecutiveFailures;
+    /** Unix ms before which `vtxo_received` events skip rotation; 0 = no backoff. */
+    private nextRotationAllowedAt;
+    private readonly logger;
+    private constructor();
+    /**
+     * Resolve `walletMode` to a provider and build the rotator (via its
+     * {@link ReceiveRotatorFactory}, else {@link defaultBoot}). Returns `undefined` for the
+     * static path.
+     *
+     * Resolution errors propagate for `'hd'` and explicit providers (degrading would hide
+     * misconfig); a {@link NonRangeableDescriptorError} is swallowed only under `'auto'`, for
+     * back-compat with identities whose descriptor isn't rangeable.
+     */
+    static resolveBoot(config: WalletConfig, setup: ReceiveRotatorBootOpts & {
+        offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script;
+    }): Promise<ReceiveRotatorBootResult | undefined>;
+    /**
+     * Default boot any {@link ReceiveRotatorFactory.createReceiveRotator} can delegate to: take
+     * the current display contract from the repository, else allocate/derive the receive pubkey.
+     * Tapscript construction is deliberately left to `resolveBoot`.
+     */
+    static defaultBoot(provider: DescriptorProvider, opts: ReceiveRotatorBootOpts): Promise<ReceiveRotatorBoot>;
+    /**
+     * Subscribe to `vtxo_received` and rotate whenever the current display contract receives
+     * funds. Old display contracts stay watched, so earlier shared addresses keep crediting.
+     */
+    install(wallet: RotatableWallet): Promise<void>;
+    /**
+     * One rotation attempt with exponential backoff. Errors are logged, not rethrown, so `chain`
+     * never rejects and the next `vtxo_received` still runs.
+     */
+    private runRotateWithBackoff;
+    /** Wait for any in-flight rotation to complete (mainly for tests). */
+    drain(): Promise<void>;
+    /**
+     * Run `fn` on the rotation chain. {@link Wallet.rotateServerSigner} uses it because both it
+     * and `rotate()` swap `offchainTapscript`; interleaving could tear the visible receive state.
+     * The chain advances even if `fn` rejects (the caller still sees the rejection).
+     */
+    runExclusive<T>(fn: () => Promise<T>): Promise<T>;
+    /**
+     * Unsubscribe first so no late event queues work, then drain so an in-flight
+     * `createContract` finishes before the contract manager disposes.
+     */
+    dispose(): Promise<void>;
+    /**
+     * Allocate the next descriptor, register it as the new tagged display contract (same
+     * default/delegate shape), swap it in, and mark the previous tagged one `inactive` (still
+     * watched; it just stops being advertised). The untagged index-0 baseline is never retired.
+     */
+    private rotate;
+}
+
+/**
+ * Cap on HD descriptors getUsedSigningDescriptors() materializes past the watermark (bounds
+ * plugin/restore probes; the watermark itself is not moved).
+ */
+declare const MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD = 1000;
+type IncomingFunds = {
+    type: "utxo";
+    coins: Coin[];
+} | {
+    type: "vtxo";
+    newVtxos: ExtendedVirtualCoin[];
+    spentVtxos: ExtendedVirtualCoin[];
+};
+
+/**
+ * Structural rather than {@link ContractWithVtxos} so the worker's repository-built snapshot
+ * (VTXOs without `contractScript`) classifies without a parallel array.
+ */
+type PendingRecoverySnapshot = Parameters<typeof selectPendingRecoveryOutpoints>[0];
+/**
+ * Boarding UTXOs grouped by boarding address, with that address's signer. A flat
+ * {@link ExtendedCoin} can't carry it: it keeps only the encoded leaves, not the owning script's
+ * `serverPubKey` or CSV delay, which deprecated-signer classification needs.
+ */
+interface BoardingUtxoGroup {
+    /** Tapscript of the boarding address the coins sit on. */
+    tapscript: DefaultVtxo.Script;
+    /** Server key of that address, normalized x-only hex. */
+    serverPubKey: string;
+    /** CSV exit timelock decoded from THIS tapscript's exit leaf. */
+    csvTimelock: RelativeTimelock;
+    coins: ExtendedCoin[];
+}
+/**
+ * Why a VTXO at an arkadeCash address could not be swept by {@link Wallet.claimCash}.
+ *
+ * - `swept` — the server swept the batch at expiry. Recoverable in principle,
+ *   but only through a settlement, which the thin sweep cannot do.
+ * - `subdust` — below dust, so it sits at an OP_RETURN script with no spendable
+ *   leaf. Unspendable as cash; `createCash` prevents minting these.
+ * - `already-spent` — someone else claimed it first.
+ * - `exited` — unilaterally exited onchain, so the offchain sweep cannot reach it;
+ *   `Unroll.completeUnroll` is the remedy.
+ * - `has-assets` — asset-bearing; the BTC-only sweep would burn the assets.
+ * - `sweep-failed` — spendable, but its own sweep was rejected.
+ */
+type ArkadeCashUnclaimedReason = "swept" | "subdust" | "already-spent" | "exited" | "has-assets" | "sweep-failed";
+/** A VTXO {@link Wallet.claimCash} left behind, with the reason why. */
+interface ArkadeCashUnclaimedVtxo {
+    txid: string;
+    vout: number;
+    /** Value in satoshis. */
+    value: number;
+    reason: ArkadeCashUnclaimedReason;
+}
+/**
+ * Outcome of {@link Wallet.claimCash}: what was swept, and what was not.
+ *
+ * The shape is open — further buckets may be added alongside `unclaimed` as
+ * more of the non-sweepable states become claimable.
+ */
+interface ArkadeCashClaimResult {
+    /** Satoshis swept to this wallet. */
+    swept: number;
+    unclaimed: {
+        /** Satoshis left behind. */
+        amount: number;
+        vtxos: ArkadeCashUnclaimedVtxo[];
+    };
+}
+/**
+ * Thrown when {@link Wallet.createCash}'s `send` fails after the transaction may already have been
+ * submitted. `cash` carries the private key of the funded output: discard it and the sats may be
+ * stranded. Persist it; {@link Wallet.claimCash} recovers the funds whether or not the send landed.
+ */
+declare class ArkadeCashCreateError extends Error {
+    /** The encoded arkadeCash token controlling the funded output. */
+    readonly cash: string;
+    /** The original failure from `send`. */
+    readonly cause: unknown;
+    constructor(
+    /** The encoded arkadeCash token controlling the funded output. */
+    cash: string, 
+    /** The original failure from `send`. */
+    cause: unknown);
+}
+/**
+ * Freshness of provider-backed sync (server-info source + indexer-sync health). Balances/VTXOs
+ * are always served from the repository regardless.
+ */
+type ProviderConnectionState = {
+    mode: "online";
+    source: "live";
+    lastOnlineAt: number;
+} | {
+    mode: "degraded";
+    source: "cache" | "repository";
+    provider: ProviderKind;
+    reason: string;
+    lastOnlineAt?: number;
+};
+declare class ReadonlyWallet implements IReadonlyWallet {
+    readonly identity: ReadonlyIdentity;
+    readonly network: Network;
+    readonly onchainProvider: OnchainProvider;
+    /** Narrowed so a readonly wallet can't grow a `submitTx` use; `Wallet` re-widens it. */
+    protected readonly arkProvider: Pick<ArkProvider, "getInfo">;
+    readonly indexerProvider: IndexerProvider;
+    readonly dustAmount: bigint;
+    readonly walletRepository: WalletRepository;
+    readonly contractRepository: ContractRepository;
+    readonly delegateProvider?: DelegateProvider | undefined;
+    private _contractManager?;
+    private _contractManagerInitializing?;
+    protected readonly watcherConfig?: ReadonlyWalletConfig["watcherConfig"];
+    /** Opt-in intent-lifecycle repository; `undefined` ⇒ intent persistence is a no-op. */
+    intentRepository?: IntentRepository;
+    /**
+     * **Experimental / inert.** Opt-in virtual-tx repository, exposed so callers can pass it to
+     * {@link Unroll.Session.create} as a best-effort raw-tx cache. Normal sync never writes it.
+     */
+    virtualTxRepository?: VirtualTxRepository;
+    /** Opt-in exit-data capture settings; see {@link StorageConfig.exitDataCapture}. */
+    exitDataCapture?: {
+        mode?: ExitCaptureMode;
+        minExitWorthSats?: number;
+        sources?: ExitDataSource[];
+    };
+    private readonly _assetManager;
+    readonly walletContractTimelocks: RelativeTimelock[];
+    protected _pendingSpendOutpoints: Set<string>;
+    /** Activity resolvers consumed by {@link getActivityHistory}. */
+    readonly activity: ActivityRegistry;
+    get assetManager(): IReadonlyAssetManager;
+    /**
+     * Active receive tapscript; written only by {@link Wallet.setOffchainTapscriptForRotation}
+     * (sole intended caller: {@link WalletReceiveRotator.rotate}).
+     */
+    protected _offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script;
+    /**
+     * Current boarding tapscript (QR / onboarding target); written only by
+     * {@link Wallet.setBoardingTapscriptForRotation}. Static / `auto` wallets never rotate it.
+     */
+    protected _boardingTapscript: DefaultVtxo.Script;
+    /**
+     * Active server signer (x-only); written only by
+     * {@link Wallet.setArkServerPublicKeyForRotation} when arkd rotates its signer mid-session.
+     */
+    protected _arkServerPublicKey: Bytes;
+    /**
+     * Whether the LATEST server-info resolution was live or fell back to the cached snapshot.
+     * Updated on every {@link getArkadeInfo} read so recovery (or a fresh fallback) is reflected.
+     */
+    protected _serverInfoSource: ServerInfoSource;
+    /**
+     * Epoch-ms of the last live operator contact, or the cached snapshot's `savedAt` when the
+     * latest resolution fell back.
+     */
+    protected _serverInfoLastOnlineAt?: number;
+    /** @see {@link _serverInfoSource} */
+    get serverInfoSource(): ServerInfoSource;
+    /**
+     * Composed provider-connection freshness: degraded on `arkade` (`cache`) when the latest
+     * server-info resolution fell back, else degraded on `indexer` (`repository`) when an
+     * initialized contract manager has, else online. Never forces a `ContractManager` to
+     * construct, so it is safe for readonly callers.
+     */
+    getProviderConnectionState(): ProviderConnectionState;
+    /**
+     * The contract manager's sync health **without initializing it** (`online` if none exists),
+     * so unlike {@link getContractManager} it never triggers a remote sync.
+     */
+    getContractSyncState(): ContractSyncState;
+    protected constructor(identity: ReadonlyIdentity, network: Network, onchainProvider: OnchainProvider, 
+    /** Narrowed so a readonly wallet can't grow a `submitTx` use; `Wallet` re-widens it. */
+    arkProvider: Pick<ArkProvider, "getInfo">, indexerProvider: IndexerProvider, arkServerPublicKey: Bytes, offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script, boardingTapscript: DefaultVtxo.Script, dustAmount: bigint, walletRepository: WalletRepository, contractRepository: ContractRepository, delegateProvider?: DelegateProvider | undefined, watcherConfig?: ReadonlyWalletConfig["watcherConfig"], walletContractTimelocks?: RelativeTimelock[]);
+    /**
+     * x-only hex → cutoff of the operator's deprecated signers, cached for OFFLINE read/watch.
+     * Boarding watch/history fan out over {current} ∪ this set so deposits at addresses minted
+     * under a rotated signer stay watched. Deliberately NOT used by the spend path:
+     * {@link getBoardingUtxos} stays current-signer-only (a deprecated-signer input in a plain
+     * settle() is rejected; recovery goes through the migration API).
+     */
+    protected _deprecatedSigners: Map<string, bigint>;
+    /**
+     * Refresh the cached deprecated-signer set from server info; feeds
+     * {@link pendingRecoveryOutpoints}. Lenient: a malformed entry is skipped, never fatal.
+     */
+    refreshDeprecatedSigners(info: {
+        deprecatedSigners?: readonly {
+            pubkey?: string;
+            cutoffDate?: bigint;
+        }[];
+    }): void;
+    /** Boarding WATCH/HISTORY signer set: current ∪ deprecated (spend stays current-only). */
+    protected watchedBoardingSigners(): Set<string>;
+    /**
+     * `serverPubKey` defaults to the live key; spend paths that snapshot it
+     * against mid-flight rotation pass their snapshot, so the check reads from
+     * one rotation epoch.
+     */
+    protected recipientAddressContext(serverPubKey?: Bytes): RecipientArkadeAddressContext;
+    /** Currently-active receive tapscript; changes only on receive rotation. */
+    get offchainTapscript(): DefaultVtxo.Script | DelegateVtxo.Script;
+    /** Current active server signer (x-only, 32 bytes); changes only on server-signer rotation. */
+    get arkServerPublicKey(): Bytes;
+    /**
+     * Server info for the connected Arkade server: live wins, a retryable failure falls back to
+     * the boot snapshot, a terminal one propagates. Live because `signerPubkey`,
+     * `checkpointTapscript` and `fees` move on rotation, and a covenant built against a
+     * superseded signer is unspendable.
+     *
+     * @remarks Reading does NOT re-pin the wallet ({@link arkServerPublicKey}, {@link dustAmount},
+     * tapscripts), so inside a rotation window this can report epoch N+1 while the wallet spends
+     * on N; the provider's `onServerInfoChanged` closes the window. Pass `{ requireLive: true }`
+     * before binding the answer into a covenant to fail closed instead of getting the snapshot.
+     *
+     * @returns The Arkade server's info
+     * @see ArkadeInfo
+     */
+    getArkadeInfo(opts?: GetArkadeInfoOptions): Promise<ArkadeInfo>;
+    /**
+     * Chain reads against this wallet's server for scripts it does not own, bound to the wallet's
+     * own (possibly Expo/injected) `indexerProvider`. `getVtxos` normalizes via
+     * {@link getNormalizedVtxos}. A bound object, not the provider, so an `IReadonlyWallet`
+     * holder gets these two reads and nothing else.
+     */
+    getArkadeReader(): Promise<ArkadeReader>;
+    /**
+     * Current boarding tapscript (on-chain onboarding target); changes only when a fresh boarding
+     * address is explicitly allocated.
+     */
+    get boardingTapscript(): DefaultVtxo.Script;
+    /**
+     * Fired after boarding rotation so a live {@link notifyIncomingFunds} watcher re-subscribes
+     * to the fresh address in-session instead of missing deposits until its next re-init.
+     */
+    private readonly _boardingRotationListeners;
+    /** Register a listener invoked synchronously after each boarding rotation. */
+    protected onBoardingRotation(listener: () => void): () => void;
+    /** A throwing listener is isolated: it can't break the rotation or starve siblings. */
+    protected notifyBoardingRotation(): void;
+    /** Shared setup for ReadonlyWallet.create() and Wallet.create(). */
+    protected static setupWalletConfig(config: ReadonlyWalletConfig, pubKey: Uint8Array): Promise<{
+        arkProvider: ArkProvider;
+        indexerProvider: IndexerProvider;
+        onchainProvider: OnchainProvider;
+        network: Network;
+        networkName: NetworkName;
+        serverPubKey: Uint8Array<ArrayBufferLike>;
+        offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script;
+        boardingTapscript: DefaultVtxo.Script;
+        dustAmount: bigint;
+        walletRepository: WalletRepository;
+        contractRepository: ContractRepository;
+        info: ArkadeInfo;
+        serverInfoSource: ServerInfoSource;
+        serverInfoLastOnlineAt: number | undefined;
+        delegateProvider: DelegateProvider | undefined;
+        walletContractTimelocks: RelativeTimelock[];
+    }>;
+    /**
+     * Create a readonly wallet for querying balances, addresses, and history.
+     *
+     * @param config - Readonly wallet configuration
+     * @returns A readonly wallet instance
+     */
+    static create(config: ReadonlyWalletConfig): Promise<ReadonlyWallet>;
+    get arkAddress(): ArkAddress;
+    /**
+     * Get the pkScript hex for the wallet's primary offchain address.
+     * For the full wallet-owned script set registered in ContractManager, use getWalletScripts().
+     */
+    get defaultContractScript(): string;
+    /** Returns the wallet's Arkade address. */
+    getAddress(): Promise<string>;
+    /** Returns the onchain boarding address used to move funds into Arkade. */
+    getBoardingAddress(): Promise<string>;
+    /**
+     * Return the wallet's combined onchain and offchain balances.
+     */
+    getBalance(): Promise<WalletBalance>;
+    /**
+     * Return virtual outputs tracked by the wallet, including escrowed, locked and
+     * awaiting-recovery funds. Coin selection must use {@link getSpendableVtxos}: feeding this
+     * into `settle({ inputs })` or `send({ selectedVtxos })` bypasses the generic-spending gate.
+     *
+     * @param filter - Optional flags controlling whether recoverable or unrolled VTXOs are included
+     */
+    getVtxos(filter?: GetVtxosFilter): Promise<NormalizedExtendedVirtualCoin[]>;
+    /** @inheritdoc */
+    getSpendableVtxos(filter?: GetSpendableVtxosFilter): Promise<NormalizedExtendedVirtualCoin[]>;
+    /**
+     * Debug-log any explicit input generic selection would have excluded. Explicit-input APIs stay
+     * ungated on purpose (naming an outpoint *is* the intent, and is how an escrowed deposit is
+     * recovered), so this only makes the crossing visible — notably
+     * `settle({ inputs: await wallet.getVtxos() })`. Never throws. Public for worker and plugins.
+     */
+    logUngatedInputs(source: string, inputs: readonly {
+        txid: string;
+        vout: number;
+        script?: string;
+    }[]): Promise<void>;
+    /**
+     * Past-cutoff-signer contracts as a script-level exclusion: the `pendingRecovery` answer for a
+     * caller-supplied input without a synced snapshot (a swept outpoint is unspendable anyway).
+     */
+    private expiredSignerExclusion;
+    /** The intent store's lock set. Fails open, like every other read of it. */
+    private lockedOutpoints;
+    /**
+     * One contract+VTXO read (which may sync against the indexer). Callers needing several views
+     * derive them all from one snapshot so they answer about the same instant.
+     */
+    protected contractSnapshot(filter?: GetSpendableVtxosFilter, options?: {
+        unspentOnly?: boolean;
+    }): Promise<ContractWithVtxos[]>;
+    /**
+     * The two exclusion sets the gate is made of, derived from one snapshot so
+     * {@link getSpendableVtxos} and the balance answer about the same instant.
+     */
+    private spendabilityView;
+    /** The capability probes {@link computeOffchainBalance} needs, over one snapshot. */
+    private balanceCapabilities;
+    /**
+     * Outpoints of not-yet-swept VTXOs whose deprecated signer is past its cutoff (EXPIRED) —
+     * unspendable until they recover; excluded by {@link getBalance} and {@link getSpendableVtxos}.
+     * Takes a fresh (syncing) snapshot; callers that hold one or must not sync use
+     * {@link pendingRecoveryOutpointsIn}.
+     */
+    pendingRecoveryOutpoints(): Promise<Set<string>>;
+    /** {@link pendingRecoveryOutpoints} over a caller-held snapshot; no I/O of its own. */
+    pendingRecoveryOutpointsIn(snapshot: PendingRecoverySnapshot): Set<string>;
+    private selectPendingRecovery;
+    /**
+     * Return wallet transaction history derived from Arkade state and boarding transactions.
+     */
+    getTransactionHistory(): Promise<ArkTransaction[]>;
+    /**
+     * Wallet history grouped by registered activity resolvers. With no resolver match,
+     * rows bucket by transaction key so send/change pairs stay together.
+     */
+    getActivityHistory(): Promise<Activity[]>;
+    /**
+     * Clear the global VTXO sync cursor, forcing a full re-bootstrap on next sync.
+     * Useful for recovery after indexer reprocessing or debugging.
+     */
+    clearSyncCursor(): Promise<void>;
+    /**
+     * Wipe all locally persisted wallet data (VTXOs, UTXOs, history, sync
+     * cursor, contracts). Create a fresh wallet instance afterward.
+     */
+    clear(): Promise<void>;
+    /**
+     * On-chain (P2TR) addresses of every boarding tapscript this wallet uses, current plus
+     * historical rotated, so deposits at old addresses still surface; {@link getBoardingAddress}
+     * stays single-valued.
+     */
+    getBoardingAddresses(): Promise<string[]>;
+    /** Transaction history across the wallet's boarding addresses (current + historical). */
+    getBoardingTxs(): Promise<{
+        boardingTxs: ArkTransaction[];
+        commitmentsToIgnore: Set<string>;
+    }>;
+    /**
+     * Every boarding tapscript whose UTXOs belong to this wallet (rotation spreads them over
+     * several addresses), deduplicated by scriptPubKey. Always includes the index-0 baseline,
+     * which covers the equal-delay case where that row coalesced onto `default`.
+     *
+     * @param allowedSigners - x-only server keys whose persisted boarding rows are included;
+     *   defaults to the current signer (the foreign-ASP guard). Migration widens it to old signers.
+     *   The baseline and current display tapscript are included regardless.
+     */
+    protected getBoardingTapscripts(allowedSigners?: Set<string>): Promise<DefaultVtxo.Script[]>;
+    /**
+     * Fetch and cache boarding UTXOs for the given signer set, grouped per address (see
+     * {@link BoardingUtxoGroup} for why). No `getInfo()`: the only network calls are the
+     * per-address `getCoins`.
+     *
+     * @param allowedSigners - x-only-hex server keys whose boarding addresses to
+     *   fetch (passed through to {@link getBoardingTapscripts}).
+     */
+    getBoardingUtxosForSigners(allowedSigners: Set<string>): Promise<BoardingUtxoGroup[]>;
+    /**
+     * Fetch and cache boarding UTXOs at current and historical boarding addresses, each annotated
+     * with its own address's tapscript so spends use the right per-index leaves. Current-signer
+     * only: old-signer inputs would make a plain `settle()` the server must reject, so their
+     * recovery goes through the deprecated-signer migration API.
+     */
+    getBoardingUtxos(): Promise<ExtendedCoin[]>;
+    /**
+     * Subscribe to onchain and offchain notifications for newly received funds.
+     *
+     * The onchain watcher tracks every boarding address (current + historical) and re-subscribes
+     * automatically when boarding rotates after subscribing, so deposits to a fresh address fire
+     * within the same session.
+     *
+     * @param eventCallback - Callback invoked when matching funds are detected
+     * @returns A function that stops the subscriptions
+     */
+    notifyIncomingFunds(eventCallback: (coins: IncomingFunds) => void): Promise<() => void>;
+    /** Fetch Arkade transaction ids that are still pending final settlement. */
+    fetchPendingTxs(): Promise<string[]>;
+    /**
+     * Get all pkScript hex strings for the wallet's own addresses
+     * (both delegate and non-delegate, current and historical).
+     */
+    getWalletScripts(): Promise<string[]>;
+    /**
+     * Build a map of scriptHex → VtxoScript for all wallet contracts,
+     * so virtual outputs can be extended with the correct tapscript per contract.
+     */
+    getScriptMap(): Promise<Map<string, DefaultVtxo.Script | DelegateVtxo.Script>>;
+    /**
+     * Get the ContractManager, which manages the wallet's own receive contracts and external ones
+     * (Boltz swaps, HTLCs, …) with resilient multi-contract watching.
+     *
+     * @example
+     * ```typescript
+     * const manager = await wallet.getContractManager();
+     *
+     * // Create a contract for a Boltz swap
+     * const contract = await manager.createContract({
+     *   label: "Boltz Swap",
+     *   type: "vhtlc",
+     *   params: { ... },
+     *   script: swapScript,
+     *   address: swapAddress,
+     * });
+     *
+     * // Start watching for events (includes wallet's default address)
+     * const stop = await manager.onContractEvent((event) => {
+     *   console.log(`${event.type} on ${event.contractScript}`);
+     * });
+     * ```
+     */
+    getContractManager(): Promise<ContractManager>;
+    /**
+     * HD look-ahead configuration for the contract manager. Readonly wallets
+     * have no descriptor provider, hence no watermark to look ahead of.
+     * @see Wallet.lookAheadConfig
+     */
+    protected lookAheadConfig(): ContractManagerConfig["lookAhead"];
+    private initializeContractManager;
+    /** Dispose wallet-owned managers and release background resources. */
+    dispose(): Promise<void>;
+    /** Async-dispose hook that forwards to `dispose()`. */
+    [Symbol.asyncDispose](): Promise<void>;
+}
+/**
+ * Main wallet implementation for Bitcoin transactions with Arkade protocol support.
+ *
+ * @example
+ * ```typescript
+ * // Create a wallet with providers
+ * const wallet = await Wallet.create({
+ *   identity: MnemonicIdentity.fromMnemonic('abandon abandon...'),
+ *   arkProvider: new RestArkProvider(),
+ *   onchainProvider: new EsploraProvider()
+ * });
+ *
+ * // Use custom providers and/or URLs (e.g., for Expo/React Native)
+ * const wallet = await Wallet.create({
+ *   identity: MnemonicIdentity.fromMnemonic('abandon abandon...'),
+ *   arkProvider: new ExpoArkProvider('https://arkade.computer'),
+ *   indexerProvider: new ExpoIndexerProvider('https://arkade.computer'),
+ *   onchainProvider: new EsploraProvider('https://mempool.space/api')
+ * });
+ *
+ * // Get addresses
+ * const arkAddress = await wallet.getAddress();
+ * const boardingAddress = await wallet.getBoardingAddress();
+ *
+ * // Send bitcoin
+ * const txid = await wallet.send({
+ *   address: 'ark1q...',
+ *   amount: 50000,
+ * });
+ * ```
+ */
+declare class Wallet extends ReadonlyWallet implements IWallet, HDWalletCapable, AddressAllocationCapable {
+    readonly forfeitOutputScript: Bytes;
+    readonly forfeitPubkey: Bytes;
+    /** Overrides for the `batchExpiry` bounds; defaults derive from `network`. */
+    protected readonly batchExpiryPolicy?: Partial<BatchExpiryPolicy> | undefined;
+    /** Overrides for the checkpoint exit delay bounds; defaults derive from `network`. */
+    protected readonly checkpointExitDelayPolicy?: Partial<CheckpointExitDelayPolicy> | undefined;
+    static MIN_FEE_RATE: number;
+    readonly identity: Identity;
+    private readonly _delegateManager?;
+    private _vtxoManager?;
+    private _vtxoManagerInitializing?;
+    private _walletAssetManager?;
+    /**
+     * HD receive rotator; absent for `static` and SingleKey-under-`auto` wallets. Its subscription
+     * installs lazily on first `getVtxoManager()` so the contract manager is up first.
+     */
+    private _receiveRotator?;
+    /** Unsubscribe for `onServerInfoChanged` (mid-session signer rotation). */
+    private _serverInfoUnsub?;
+    /**
+     * Tail of the serialized {@link handleServerInfoChanged} chain; {@link dispose} awaits it so an
+     * in-flight rotation settles before the contract manager is torn down.
+     */
+    private _serverInfoInFlight;
+    /**
+     * React to a mid-session server-info change (`DIGEST_MISMATCH`): refresh deprecated signers
+     * first so boarding watch widens immediately, then rotate via {@link rotateServerSigner} only
+     * if the active signer changed. Old-signer rows stay active. Never throws into the emit loop.
+     */
+    private handleServerInfoChanged;
+    /**
+     * Await an `onServerInfoChanged` handler still applying a rotation. {@link rotateServerSigner}
+     * persists the new signer's rows *before* committing the tapscripts, so a path that refreshes
+     * server info then reads signer-derived state must drain first or it reads torn state and
+     * races the handler. Resolves once idle; handler rejections are swallowed (already logged).
+     *
+     * @internal Invoked by {@link dispose} and the {@link VtxoManager} migration
+     * pass; not part of the stable public API.
+     */
+    settleServerInfoChanges(): Promise<void>;
+    private _receiveRotatorInstalled;
+    /**
+     * Descriptor-aware signer for inputs locked by rotated pubkeys (the rotator's instance).
+     * Undefined for static / non-HD wallets, which only sign with the identity.
+     */
+    private readonly _descriptorProvider?;
+    /** Per-side width of the HD look-ahead band. @see WalletConfig.lookAheadWindow */
+    private readonly _lookAheadWindow;
+    /**
+     * Watch a band of receive scripts around the HD watermark so payments to an externally-issued
+     * address land without a `restore()`. HD only. `candidateDeps` is read at refill time, so a
+     * band rebuilt after {@link rotateServerSigner} fans the new signer set.
+     */
+    protected lookAheadConfig(): ContractManagerConfig["lookAhead"];
+    /**
+     * Every axis an externally issued receive script could use: an issuer sharing the seed (NArk,
+     * a merchant backend) picks its own contract type. From cached state (no `getInfo`) to stay
+     * synchronous and offline-safe.
+     */
+    private receiveCandidateDeps;
+    private readonly _signerRouter;
+    /**
+     * @internal Sole write path for `offchainTapscript`; called by
+     * {@link WalletReceiveRotator.rotate} after the rotated contract is persisted.
+     */
+    setOffchainTapscriptForRotation(tapscript: DefaultVtxo.Script | DelegateVtxo.Script): void;
+    /**
+     * @internal Sole write path for `boardingTapscript`; called by
+     * {@link Wallet.getNewBoardingAddress} after the rotated contract is persisted.
+     */
+    setBoardingTapscriptForRotation(tapscript: DefaultVtxo.Script): void;
+    /**
+     * @internal Sole write path for `arkServerPublicKey`; called by
+     * {@link Wallet.rotateServerSigner} after the rotated rows are persisted.
+     */
+    setArkServerPublicKeyForRotation(serverPubKey: Bytes): void;
+    /**
+     * Checkpoint output script from the server's `checkpointTapscript`; pinned at construction,
+     * re-sourced only via {@link setServerUnrollScriptForRotation}.
+     */
+    protected _serverUnrollScript: CSVMultisigTapscript.Type;
+    get serverUnrollScript(): CSVMultisigTapscript.Type;
+    /**
+     * @internal Sole write path for `serverUnrollScript`; called by
+     * {@link Wallet._doRotateServerSigner} with the rotating `ArkadeInfo`'s checkpoint script.
+     */
+    setServerUnrollScriptForRotation(script: CSVMultisigTapscript.Type): void;
+    /**
+     * Serializes {@link rotateServerSigner} for static / non-HD wallets so two callers can't both
+     * swap the tapscripts; HD wallets use {@link WalletReceiveRotator.runExclusive} instead.
+     */
+    private _serverRotationChain;
+    /**
+     * Allocate a *fresh* on-chain boarding address at the next index of the shared HD stream and
+     * make it the displayed one (NArk: `GetNextContract(NextContractPurpose.Boarding)`).
+     * Persists an `active` `boarding` contract tagged {@link WALLET_RECEIVE_SOURCE} so it is
+     * watched, restored at boot and signable per index.
+     *
+     * A static / `auto` wallet returns {@link getBoardingAddress} unchanged (no index burned). A
+     * custom {@link DescriptorProvider} wallet burns an index per call, including via
+     * {@link maybeRotateBoardingAfterBoard} on every settle consuming a boarding UTXO; retired
+     * addresses stay reachable through {@link getBoardingUtxos}.
+     *
+     * @deprecated Use {@link getNewAddresses} — it mints any combination of
+     * address types at one shared index, and reports the contract row behind
+     * each. Note the difference in display behaviour: this method *swaps* the
+     * advertised boarding address, where `getNewAddresses` mints side
+     * addresses and leaves {@link getBoardingAddress} alone. To keep this
+     * method's behaviour, keep calling this method.
+     */
+    getNewBoardingAddress(): Promise<string>;
+    /**
+     * Allocate a *fresh* address of each requested type, all at **one** new HD index. The way to
+     * issue a second address before the first is paid ({@link getAddress} only advances on
+     * receipt). Each is persisted `active` with its `signingDescriptor`, so it is watched,
+     * counted, and signable via {@link signerForDescriptor}; the look-ahead band slides.
+     *
+     * Rows are deliberately **untagged**: boot adopts the newest {@link WALLET_RECEIVE_SOURCE} row
+     * as the display address, and a side address must not become what the wallet advertises.
+     * {@link getAddress} and {@link getBoardingAddress} are unchanged.
+     *
+     * A wallet with no HD stream (`static` / `auto`) returns its persisted display rows, or with
+     * `forceNew` throws {@link WalletCannotAllocateAddressError} rather than return a stale one.
+     *
+     * @example
+     * ```typescript
+     * const [invoice] = await wallet.getNewAddresses({ forceNew: true });
+     * // hand `invoice.address` to Alice, keep the descriptor with the invoice
+     * const signer = await wallet.signerForDescriptor(invoice.signingDescriptor);
+     * ```
+     */
+    getNewAddresses(opts?: GetNewAddressesOptions): Promise<NewAddress[]>;
+    /**
+     * Shared core of {@link getNewAddresses} and {@link getNewBoardingAddress}.
+     *
+     * @param tagSource - Tag rows {@link WALLET_RECEIVE_SOURCE} so boot adopts them as the display
+     * address; only the deprecated boarding allocator passes `true`.
+     */
+    private allocateAddresses;
+    /**
+     * The wallet's existing display addresses as persisted rows, each minted from the descriptor
+     * that owns its display script ({@link displayDescriptor}) so it signs for `address`.
+     */
+    private currentAddresses;
+    /**
+     * The descriptor owning the current display script for `type`, from its persisted row. Not
+     * derived from the identity: on a rotated wallet that would pair the address with a signer
+     * holding the wrong key. Falls back to the identity's `tr(pubkey)` when no row carries one
+     * (static / `auto`; index-0 baselines have no `signingDescriptor`).
+     */
+    private displayDescriptor;
+    /**
+     * Build, persist and shape one address of `type` owned by `descriptor`. The descriptor is the
+     * sole source of the owner key in both branches, so `address` and `signingDescriptor` can't
+     * drift apart.
+     */
+    private mintAddress;
+    /**
+     * Boarding contract owned by `pubKey`, keeping the current tapscript's other options
+     * (offchain analogue: {@link buildReceiveContract}).
+     */
+    private buildBoardingContract;
+    /**
+     * @see HDWalletCapable.getCurrentSigningDescriptor
+     */
+    getCurrentSigningDescriptor(): Promise<string | undefined>;
+    /**
+     * @see HDAllocationCapable.getNextSigningDescriptor
+     *
+     * Every `Wallet` answers, so consumers never branch on wallet shape: HD allocates through the
+     * contract manager; otherwise the identity key as `tr(pubkey)`, the same every call.
+     */
+    getNextSigningDescriptor(): Promise<string | undefined>;
+    /**
+     * @see HDAllocationCapable.advanceSigningDescriptorWatermark
+     */
+    advanceSigningDescriptorWatermark(descriptor: string): Promise<void>;
+    /**
+     * @see HDWalletCapable.getUsedSigningDescriptors
+     *
+     * Union of the watermark band (covers indices allocated for unpersisted things, e.g. swaps)
+     * and descriptors persisted on contracts (covers rows a restore scan wrote).
+     */
+    getUsedSigningDescriptors(opts?: {
+        lookAhead?: number;
+    }): Promise<string[]>;
+    /**
+     * @see HDWalletCapable.signerForDescriptor
+     *
+     * Fail-loud: a descriptor this wallet can't sign for throws {@link ForeignDescriptorError}
+     * rather than substituting the baseline identity, which would sign with the wrong key.
+     */
+    signerForDescriptor(descriptor: string): Promise<Identity>;
+    /**
+     * Mid-session server-signer rotation. A wallet built before arkd rotated keeps deriving
+     * old-signer receive addresses, and a migration output to one yields a VTXO the server must
+     * reject, so receive state is re-derived under the new signer first.
+     *
+     * Same write-path as {@link WalletReceiveRotator.rotate} with the server key swapped: build the
+     * new tapscripts, register their rows (carrying signing metadata so a descriptor-backed
+     * pubkey still signs), and only then commit visible state. Old-signer rows stay `active` for
+     * the migration pass to drain. Idempotent; serialized against HD receive rotation.
+     *
+     * @internal Invoked by the {@link VtxoManager} migration pass; not part of
+     * the stable public API.
+     */
+    rotateServerSigner(newServerPubKey: Bytes, checkpointTapscript: string): Promise<void>;
+    private _doRotateServerSigner;
+    /**
+     * Serializes `settle`/`send` so VtxoManager's background renewal can't race user
+     * transactions for the same inputs.
+     */
+    private _txLock;
+    /** Coalesces concurrent {@link restore} calls into one scan; cleared on settle. */
+    private _restoreInFlight?;
+    private _addPendingSpends;
+    private _removePendingSpends;
+    private _withTxLock;
+    /**
+     * Explicitly recover this wallet's contracts and balance on a fresh repo: a gap-limit scan
+     * for HD wallets, the single default pubkey otherwise. Throws on operational failure (a
+     * truncated restore is loud), never because of identity/mode. Idempotent.
+     *
+     * Ordering: scan → advance the HD watermark → inline VTXO pull → only THEN surface handler
+     * errors, so safely-discovered funds are recovered even when one handler failed.
+     *
+     * @param opts.gapLimit - Consecutive-unused-index window. Default 20. A non-positive /
+     * non-integer value throws synchronously.
+     *
+     * @note Concurrent calls coalesce onto the running scan; their `gapLimit` is ignored.
+     */
+    restore(opts?: {
+        gapLimit?: number;
+    }): Promise<void>;
+    private _runRestore;
+    readonly settlementConfig: SettlementConfig | false;
+    /** Public here; `ReadonlyWallet` keeps it protected so a readonly view can't submit. */
+    readonly arkProvider: ArkProvider;
+    /**
+     * Broadcast access bound to this wallet's server, so a plugin needs only the wallet. Not on
+     * {@link ReadonlyWallet}: a readonly wallet or `toReadonly()` view must not be able to submit.
+     */
+    getArkadeBroadcaster(): Promise<ArkadeBroadcaster>;
+    protected constructor(identity: Identity, network: Network, onchainProvider: OnchainProvider, arkProvider: ArkProvider, indexerProvider: IndexerProvider, arkServerPublicKey: Bytes, offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script, boardingTapscript: DefaultVtxo.Script, serverUnrollScript: CSVMultisigTapscript.Type, forfeitOutputScript: Bytes, forfeitPubkey: Bytes, dustAmount: bigint, walletRepository: WalletRepository, contractRepository: ContractRepository, delegateProvider?: DelegateProvider, watcherConfig?: WalletConfig["watcherConfig"], settlementConfig?: WalletConfig["settlementConfig"], walletContractTimelocks?: RelativeTimelock[], receiveRotator?: WalletReceiveRotator, descriptorProvider?: DescriptorProvider, lookAheadWindow?: number, 
+    /** Overrides for the `batchExpiry` bounds; defaults derive from `network`. */
+    batchExpiryPolicy?: Partial<BatchExpiryPolicy> | undefined, 
+    /** Overrides for the checkpoint exit delay bounds; defaults derive from `network`. */
+    checkpointExitDelayPolicy?: Partial<CheckpointExitDelayPolicy> | undefined);
+    get assetManager(): IAssetManager;
+    getVtxoManager(): Promise<VtxoManager>;
+    dispose(): Promise<void>;
+    /**
+     * Create a full wallet and initialize its background managers.
+     *
+     * @param config - Wallet configuration
+     * @returns A wallet ready to query balances and send transactions
+     * @example
+     * ```typescript
+     * const wallet = await Wallet.create({
+     *   identity,
+     *   arkProvider: new RestArkProvider(),
+     * });
+     * ```
+     */
+    static create(config: WalletConfig): Promise<Wallet>;
+    /**
+     * Convert this wallet to a readonly wallet.
+     *
+     * @returns A readonly wallet with the same configuration but readonly identity
+     * @example
+     * ```typescript
+     * const wallet = await Wallet.create({ identity: MnemonicIdentity.fromMnemonic('abandon abandon...'), ... });
+     * const readonlyWallet = await wallet.toReadonly();
+     *
+     * // Can query balance and addresses
+     * const balance = await readonlyWallet.getBalance();
+     * const address = await readonlyWallet.getAddress();
+     *
+     * // But cannot send transactions (type error)
+     * // readonlyWallet.send(...); // TypeScript error
+     * ```
+     */
+    toReadonly(): Promise<ReadonlyWallet>;
+    /** Returns the delegate manager when delegation support is configured. */
+    getDelegateManager(): Promise<IDelegateManager | undefined>;
+    /**
+     * Settle boarding inputs and/or virtual outputs into a finalized mainnet transaction.
+     *
+     * `params.inputs` is **ungated** (how an escrowed deposit is recovered by hand), so
+     * `settle({ inputs: await wallet.getVtxos() })` bypasses the gate; pass
+     * {@link getSpendableVtxos} to settle "whatever is spendable".
+     *
+     * @param params - Optional settlement inputs and outputs. When omitted, the wallet settles all eligible funds.
+     * @param eventCallback - Optional callback invoked for settlement stream events.
+     * @returns The finalized Arkade transaction id
+     */
+    settle(params?: SettleParams, eventCallback?: (event: SettlementEvent) => void): Promise<string>;
+    private _settleImpl;
+    /**
+     * Rotate-on-board: the boarding analogue of {@link WalletReceiveRotator}'s L2 rotation.
+     * Boarding has no on-chain receive event (the watcher sees only the L2 indexer), so a settle
+     * consuming a boarding UTXO (a non-VTXO, non-arknote input) is the trigger. No-op without a
+     * descriptor provider. Best-effort: the settle has committed, so failures are only logged.
+     */
+    private maybeRotateBoardingAfterBoard;
+    private handleSettlementFinalizationEvent;
+    private unsignableBoardingInputError;
+    /**
+     * Create a batch event handler for settlement flows.
+     *
+     * @param intentId - The intent ID.
+     * @param inputs - Inputs used by the intent.
+     * @param expectedRecipients - Expected recipients to validate in the virtual output tree.
+     * @param session - Optional musig2 signing session. When omitted, signing steps are skipped.
+     */
+    createBatchHandler(intentId: string, inputs: ExtendedCoin[], expectedRecipients: Recipient[], session?: SignerSession): Batch.Handler;
+    /**
+     * Signing jobs keyed by each input's own `witnessUtxo.script`; inputs without one
+     * (cosigner/connector) are silently omitted.
+     */
+    private inputSigningJobsFromWitnessUtxos;
+    /**
+     * Best-effort upsert into {@link intentRepository}; never throws into the settle path.
+     * Preserves fields the event reducer already wrote.
+     */
+    private persistIntentSnapshot;
+    signInputsByWitnessScript(tx: Transaction): Promise<Transaction>;
+    signOnchainBoardingTx(tx: Transaction): Promise<Transaction>;
+    safeRegisterIntent(intent: SignedIntent<Intent.RegisterMessage>, inputs: ExtendedCoin[]): Promise<string>;
+    makeRegisterIntentSignature(coins: ExtendedCoin[], outputs: TransactionOutput[], onchainOutputsIndexes: number[], cosignerPubKeys: string[], validAt?: number): Promise<SignedIntent<Intent.RegisterMessage>>;
+    makeDeleteIntentSignature(coins: ExtendedCoin[]): Promise<SignedIntent<Intent.DeleteMessage>>;
+    makeGetPendingTxIntentSignature(coins: ExtendedVirtualCoin[]): Promise<SignedIntent<Intent.GetPendingTxMessage>>;
+    /**
+     * Finalizes pending transactions by retrieving them from the server and finalizing each one.
+     * Skips the server check entirely when no send was interrupted (no pending tx flag set).
+     * @param vtxos - Optional list of virtual outputs to use instead of retrieving them from the server
+     * @returns Array of transaction IDs that were finalized
+     */
+    finalizePendingTxs(vtxos?: ExtendedVirtualCoin[]): Promise<{
+        finalized: string[];
+        pending: string[];
+    }>;
+    /**
+     * Server unroll scripts a pending checkpoint may have been built under: configured, current,
+     * and one per deprecated signer — else a pre-rotation tx would stay pending forever.
+     */
+    private checkpointUnrollCandidates;
+    private hasPendingTxFlag;
+    private setPendingTxFlag;
+    /**
+     * Create an ArkadeCash bearer instrument: sends `amount` to a DefaultVtxo controlled by a fresh
+     * key and returns the encoded token, claimable via `claimCash()` without sharing an address.
+     *
+     * Short-lived: it carries a private key, so hand it over and claim it promptly. Unclaimed past
+     * its batch expiry it is swept, and `claimCash` can only report it.
+     *
+     * @param amount - Whole sats at or above dust (below dust mints an unspendable OP_RETURN).
+     * @returns The encoded arkadeCash string (e.g., "arkadecash1...")
+     */
+    createCash(amount: number): Promise<string>;
+    /**
+     * Claim an ArkadeCash bearer instrument: sweep each spendable VTXO to this wallet in its own
+     * offchain tx signed with the token's key, and report the rest in `unclaimed` with a
+     * per-VTXO reason. Nothing is persisted (no contract imported, key not stored).
+     *
+     * The token is the recovery handle: re-running `claimCash` completes an interrupted claim by
+     * draining pending arkadeCash txs before sweeping.
+     *
+     * @param cashStr - The encoded arkadeCash string (e.g., "arkadecash1...")
+     * @returns The swept total and the report of what was left behind. The
+     * shape is open: further buckets may be added alongside `unclaimed`.
+     */
+    claimCash(cashStr: string): Promise<ArkadeCashClaimResult>;
+    /**
+     * Split the VTXOs at an arkadeCash address into the ones the thin sweep can
+     * move and the ones it can only report.
+     */
+    private classifyCashVtxos;
+    /** Read every page of an unfiltered VTXO query for the given scripts. */
+    private fetchAllVtxos;
+    /**
+     * Complete sweeps a previous `claimCash` registered but never finalized: a thin
+     * {@link finalizePendingTxs} signed with the arkadeCash key. A drained tx pays whoever
+     * registered it, so finalizing is still right, but only value paid to `myPkScript` counts.
+     *
+     * @param vtxos - VTXOs at the cash contract's own pkScript, spent included; any other
+     * outpoint (subdust above all) would invalidate the proof.
+     * @returns Txs finalized, sats paid to this wallet, and the outpoints consumed to pay it.
+     */
+    private finalizePendingCashTxs;
+    /** Sum the outputs of an ark tx PSBT that pay the given scriptPubKey. */
+    private arkTxAmountPaidTo;
+    /**
+     * Send BTC and/or assets to one or more recipients, passed either as
+     * variadic `Recipient`s or as a single `SendParams` object — the latter
+     * also carries the virtual outputs to spend.
+     *
+     * @param args - Recipients, or a `SendParams` object
+     * @returns Promise resolving to the Arkade transaction ID
+     * @see SendParams
+     *
+     * @example
+     * ```typescript
+     * const txid = await wallet.send({
+     *     address: 'ark1q...',
+     *     amount: 1000, // (optional, default to dust) btc amount to send to the output
+     *     assets: [{ assetId: 'abc123...', amount: 50n }] // (optional) list of assets to send
+     * });
+     *
+     * // choosing the inputs as well as the outputs
+     * const txid = await wallet.send({
+     *     recipients: [{ address: 'ark1q...', amount: 1000 }],
+     *     selectedVtxos: mine, // spent as given, nothing added
+     * });
+     * ```
+     */
+    send(...args: [SendParams] | [Recipient, ...Recipient[]]): Promise<string>;
+    private _sendImpl;
+    /**
+     * Shared submit/persist tail of `send` and {@link sendSelectedVtxosToSelf}; callers own coin
+     * selection, outputs and the synchronous epoch snapshot.
+     */
+    private _submitOffchainSpend;
+    /**
+     * @internal Migration primitive for {@link VtxoManager}: spend the wallet's own
+     * deprecated-signer VTXOs into one full-value output on the *active* signer, via the Ark send
+     * path (not `settle`) so arkd builds checkpoints against the active epoch. No boarding inputs.
+     * The caller must already be on the active signer and have sized the batch. Preserves all
+     * input assets; records no `TxSent` history.
+     */
+    sendSelectedVtxosToSelf(inputs: ExtendedVirtualCoin[], now?: TimeHeight): Promise<string>;
+    /**
+     * Build an offchain transaction from the given inputs and outputs,
+     * sign it, submit to the Arkade provider, and finalize.
+     *
+     * Signs whatever it is handed, ungated — see {@link settle} for the trade.
+     *
+     * @returns The Arkade transaction id and server-signed checkpoint PSBTs (for bookkeeping)
+     */
+    buildAndSubmitOffchainTx(inputs: ExtendedVirtualCoin[], outputs: TransactionOutput[], serverUnrollScript?: CSVMultisigTapscript.Type): Promise<{
+        arkTxid: string;
+        signedCheckpointTxs: string[];
+    }>;
+    private updateDbAfterOffchainTx;
+    private updateDbAfterSettle;
+}
+/**
+ * Select virtual outputs to reach a target amount, prioritizing those closer to expiry
+ * @param coins List of virtual outputs to select from
+ * @param targetAmount Target amount to reach in satoshis
+ * @returns Selected virtual outputs and change amount
+ */
+declare function selectVirtualCoins(coins: ExtendedVirtualCoin[], targetAmount: number): {
+    inputs: ExtendedVirtualCoin[];
+    changeAmount: bigint;
+};
+/**
+ * Raised when a wait is cancelled through its `AbortSignal` or `timeoutMs`. `name` is
+ * `"AbortError"`, so DOM and SDK aborts can be handled identically.
+ */
+declare class AbortError extends Error {
+    constructor(message?: string);
+}
+/** Options for {@link waitForIncomingFunds}. */
+interface WaitForIncomingFundsOptions {
+    /**
+     * Cancels the wait. On abort the underlying subscription is stopped and
+     * the returned promise rejects — with the signal's `reason` when the
+     * caller supplied an `Error`, otherwise an {@link AbortError}.
+     */
+    signal?: AbortSignal;
+    /**
+     * Cancels the wait after this many milliseconds, rejecting with an
+     * {@link AbortError}. Equivalent to passing an `AbortSignal.timeout`
+     * signal, without requiring that API on the target platform.
+     */
+    timeoutMs?: number;
+}
+/**
+ * Wait for incoming funds to the wallet.
+ *
+ * Keeps live network watchers open until it settles. **Cancel it if you won't await it to
+ * completion** (`signal` / `timeoutMs`): a `Promise.race` against a timer abandons the loser
+ * without stopping its watchers, and in a loop stacks subscriptions until the process exits.
+ *
+ * @param wallet - The wallet to wait for incoming funds
+ * @param options - Cancellation options; see {@link WaitForIncomingFundsOptions}
+ * @returns A promise that resolves the next new coins received by the wallet's address
+ * @throws {AbortError} If cancelled via `signal` or `timeoutMs`
+ * @example
+ * ```typescript
+ * // Wake early on a deposit, but give up after 30s and release the watchers.
+ * try {
+ *   const funds = await waitForIncomingFunds(wallet, { timeoutMs: 30_000 })
+ * } catch (e) {
+ *   if ((e as Error).name !== "AbortError") throw e
+ * }
+ * ```
+ */
+declare function waitForIncomingFunds(wallet: Wallet, options?: WaitForIncomingFundsOptions): Promise<IncomingFunds>;
+
+export { type AddressAllocationCapable as A, type BatchExpiryPolicy as B, type CheckpointExitDelayPolicy as C, DEFAULT_MIN_BATCH_EXPIRY_SECONDS as D, defaultCheckpointExitDelayPolicy as E, ForeignDescriptorError as F, isAddressAllocationCapable as G, type HDWalletCapable as H, type IncomingFunds as I, isArkError as J, isHDAllocationCapable as K, isHDWalletCapable as L, MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD as M, maybeArkError as N, resolveBatchExpiryPolicy as O, type ProviderConnectionState as P, resolveCheckpointExitDelayPolicy as Q, ReadonlyWallet as R, SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as S, resolveDescriptorSigner as T, selectVirtualCoins as U, signingDescriptorIndex as V, Wallet as W, strictSigningDescriptorIndex as X, waitForIncomingFunds as Y, type HDAllocationCapable as a, type ReceiveRotatorFactory as b, type ReceiveRotatorBootOpts as c, type ReceiveRotatorBoot as d, Batch as e, AbortError as f, ArkError as g, ArkErrorName as h, type ArkadeCashClaimResult as i, ArkadeCashCreateError as j, type ArkadeCashUnclaimedReason as k, type ArkadeCashUnclaimedVtxo as l, type BoardingUtxoGroup as m, DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as n, MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as o, type ProviderKind as p, ProviderUnavailableError as q, REGTEST_MIN_BATCH_EXPIRY_SECONDS as r, REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as s, type ServerInfoSource as t, ServerResponseMismatchError as u, type WaitForIncomingFundsOptions as v, WalletCannotAllocateAddressError as w, assertValidBatchExpiry as x, assertValidServerUnrollScript as y, defaultBatchExpiryPolicy as z };