@arkade-os/sdk 0.5.0-rc.2 → 0.5.0-rc.21

package/dist/hdWalletCapable-eJgaT-ec.d.cts

@@ -1,2232 +0,0 @@
-import { w as RelativeTimelock, X as Network, Y as CSVMultisigTapscript, Z as BatchStartedEvent, _ as TreeSigningStartedEvent, $ as TxTree, a0 as TreeNoncesEvent, a1 as BatchFinalizationEvent, a2 as BatchFinalizedEvent, a3 as BatchFailedEvent, a4 as TreeTxEvent, a5 as TreeSignatureEvent, o as SettlementEvent, b as WalletConfig, W as WalletRepository, C as ContractRepository, a6 as DescriptorProvider, j as IContractManager, a7 as IReadonlyWallet, a8 as ReadonlyIdentity, a9 as OnchainProvider, u as ArkProvider, v as IndexerProvider, aa as DelegateProvider, ab as ReadonlyWalletConfig, J as IntentRepository, M as VirtualTxRepository, ac as ExitCaptureMode, ad as ExitDataSource, h as ActivityRegistry, ae as IReadonlyAssetManager, af as ContractSyncState, ag as RecipientArkadeAddressContext, G as GetArkadeInfoOptions, A as ArkadeInfo, c as ArkadeReader, ah as NetworkName, ai as ArkAddress, e as WalletBalance, f as GetVtxosFilter, N as NormalizedExtendedVirtualCoin, aj as ContractWithVtxos, ak as selectPendingRecoveryOutpoints, g as ArkTransaction, i as Activity, E as ExtendedCoin, al as Coin, B as ExtendedVirtualCoin, am as ContractManager, an as ContractManagerConfig, I as IWallet, a as Identity, k as GetNewAddressesOptions, l as NewAddress, ao as SettlementConfig, d as ArkadeBroadcaster, q as IAssetManager, ap as VtxoManager, m as IDelegateManager, S as SendBitcoinParams, n as SettleParams, R as Recipient, aq as SignerSession, ar as SignedIntent, as as Intent, p as SendParams, at as TimeHeight } from './index-DUxufw76.cjs';
-import { Transaction } from '@scure/btc-signer';
-import { TransactionOutput } from '@scure/btc-signer/psbt.js';
-import { Bytes } from '@scure/btc-signer/utils.js';
-import { D as DefaultVtxo, a as DelegateVtxo } from './delegate-1yp1HyP7.cjs';
-
-/** Wall-clock floor for `batchExpiry` outside regtest. */
-declare const DEFAULT_MIN_BATCH_EXPIRY_SECONDS = 86400n;
-/** Wall-clock floor for `batchExpiry` on regtest (~10 blocks). */
-declare const REGTEST_MIN_BATCH_EXPIRY_SECONDS = 6000n;
-/** Bounds applied to a server-supplied `BatchStartedEvent.batchExpiry`. */
-type BatchExpiryPolicy = {
-    /** Minimum wall-clock delay in seconds, after normalization. */
-    minSeconds: bigint;
-    /**
-     * Reject block-typed timelocks. Mirrors arkd, which allows a block-typed
-     * vtxo tree expiry only on regtest.
-     */
-    requireSeconds: boolean;
-    /** When advertised by the operator, `batchExpiry` must equal it exactly. */
-    advertisedVtxoTreeExpiry?: bigint;
-};
-/**
- * Default policy for a network.
- *
- * Derive it from the locally held {@link Network} — pinned at wallet setup —
- * rather than from a per-round server field, so the permissive regtest branch
- * can't be selected by the operator at event time.
- */
-declare function defaultBatchExpiryPolicy(network: Network): BatchExpiryPolicy;
-/** Resolve a policy for `network`, applying any caller overrides on top. */
-declare function resolveBatchExpiryPolicy(network: Network, overrides?: Partial<BatchExpiryPolicy>): BatchExpiryPolicy;
-/**
- * Check a server-supplied batch expiry against `policy` and return the timelock
- * to commit to.
- *
- * The sweep leaf of the shared batch output is derived from this value, so it
- * is never reconstructible from anything else the server sends: validating the
- * tree only proves it is consistent with whatever value was chosen. Callers
- * must encode the returned timelock rather than re-deriving their own.
- *
- * @throws {ServerResponseMismatchError} if the value is out of policy.
- */
-declare function assertValidBatchExpiry(batchExpiry: bigint, policy: BatchExpiryPolicy): RelativeTimelock;
-
-/** Wall-clock floor for the checkpoint exit delay outside regtest. Matches arkd's own default. */
-declare const DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS = 86400n;
-/**
- * Wall-clock floor for the checkpoint exit delay on regtest (~2 blocks nominal).
- *
- * Deliberately lower than {@link REGTEST_MIN_BATCH_EXPIRY_SECONDS "../wallet/batchExpiry"} — it
- * was sized to clear an `ARKD_CHECKPOINT_EXIT_DELAY` of 5 blocks while still rejecting a 1-block
- * attack. No env in this repo goes below 20 any more (the 5-block one shipped with the removed
- * boltz-swap package), so there is room to tighten this; left as-is until someone confirms no
- * external regtest deployment relies on the lower bound.
- */
-declare const REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS = 1200n;
-/**
- * Wall-clock floor for the checkpoint exit delay on mutinynet.
- *
- * The hosted mutinynet Arkade Service advertises exactly this: its
- * `checkpointTapscript` decodes to a 4096s (8 * 512) CSV, sized for a chain
- * that mines ~30s blocks. {@link DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS}
- * rejects it, which left mutinynet unusable until the caller went and found
- * `minCheckpointExitDelaySeconds` and then this number.
- */
-declare const MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS = 4096n;
-/**
- * Wall-clock floor for the checkpoint exit delay on signet.
- *
- * The hosted signet Arkade Service advertises 86016s (168 * 512): a 24h
- * setting rounded down to BIP-68's 512s granularity, since 86400 is not a
- * multiple of 512 and so cannot be encoded in a seconds-typed timelock at all.
- * That lands 384s under {@link DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS} and
- * is rejected by it, so signet needs its own floor for the same reason
- * mutinynet does.
- */
-declare const SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS = 86016n;
-/** Bounds applied to a server-supplied `ArkadeInfo.checkpointTapscript`. */
-type CheckpointExitDelayPolicy = {
-    /** Minimum wall-clock delay in seconds, after normalization. */
-    minSeconds: bigint;
-    /**
-     * Reject block-typed timelocks. Mirrors arkd, which allows a block-typed
-     * checkpoint exit delay only on regtest.
-     */
-    requireSeconds: boolean;
-    /**
-     * When set, the script's embedded pubkey must equal this x-only key.
-     *
-     * arkd always builds the checkpoint tapscript from its own `forfeitPubkey`
-     * (`internal/core/application/service.go`), so this should be the
-     * `forfeitPubkey` the caller already trusts — pinned wallet state where one
-     * exists, otherwise the same `ArkadeInfo` response's own `forfeitPubkey` field
-     * as a self-consistency check.
-     */
-    advertisedForfeitPubkey?: Bytes;
-};
-/**
- * Default policy for a network.
- *
- * Derive it from the locally held {@link Network} — pinned at wallet setup —
- * rather than from server data, so the permissive regtest branch can't be
- * selected by the operator.
- */
-declare function defaultCheckpointExitDelayPolicy(network: Network): CheckpointExitDelayPolicy;
-/** Resolve a policy for `network`, applying any caller overrides on top. */
-declare function resolveCheckpointExitDelayPolicy(network: Network, overrides?: Partial<CheckpointExitDelayPolicy>): CheckpointExitDelayPolicy;
-/**
- * Decode and validate a server-supplied `checkpointTapscript` against `policy`.
- *
- * Every offchain send/claim builds its checkpoint outputs' server-claim leaf
- * straight from this script — undecodable, sub-floor or wrong-pubkey values
- * let the operator sweep an in-flight checkpoint before it settles. This is
- * the sole gate: callers must use the returned script rather than decoding
- * their own copy.
- *
- * @throws {ServerResponseMismatchError} if the script fails to decode, its
- *   timelock is out of policy, or its pubkey does not match
- *   `policy.advertisedForfeitPubkey` (when set).
- */
-declare function assertValidServerUnrollScript(checkpointTapscript: string, policy: CheckpointExitDelayPolicy): CSVMultisigTapscript.Type;
-
-declare class ArkError extends Error {
-    readonly code: number;
-    readonly message: string;
-    readonly name: string;
-    readonly metadata?: Record<string, string> | undefined;
-    constructor(code: number, message: string, name: string, metadata?: Record<string, string> | undefined);
-}
-/**
- * Structured arkd error `name`s the SDK branches on, centralized so call sites don't
- * hardcode string literals. Not an exhaustive mirror of the server's codes — only the
- * ones the SDK acts on.
- */
-declare const ArkErrorName: {
-    readonly DIGEST_MISMATCH: "DIGEST_MISMATCH";
-    readonly VTXO_ALREADY_SPENT: "VTXO_ALREADY_SPENT";
-    readonly INVALID_TX_FILTER: "INVALID_TX_FILTER";
-    readonly TX_FILTERS_LIMIT_EXCEEDED: "TX_FILTERS_LIMIT_EXCEEDED";
-    /**
-     * A CLTV closure was spent before its absolute locktime matured. Raised only by
-     * `submitTx` (never `finalizeTx`), with metadata
-     * `{ locktime, current_locktime, type: "height" | "time" }`.
-     *
-     * Self-healing, so defer and retry rather than fail: the server matures a
-     * seconds-locktime against the **chain tip block's timestamp**, not its wall clock,
-     * so a spend attempted promptly at maturity is rejected until a later block lands.
-     */
-    readonly FORFEIT_CLOSURE_LOCKED: "FORFEIT_CLOSURE_LOCKED";
-};
-type ArkErrorName = (typeof ArkErrorName)[keyof typeof ArkErrorName];
-/**
- * Type guard for a structured {@link ArkError}, optionally narrowing to a specific
- * `name`. Prefer it over comparing `err.name` literals.
- *
- * `name` accepts only cataloged {@link ArkErrorName} values; to branch on a name the
- * catalog does not cover, either add it there or compare `err.name` after guarding
- * with the one-argument form.
- *
- * @example
- * if (isArkError(maybeArkError(err), ArkErrorName.DIGEST_MISMATCH)) { ... }
- */
-declare function isArkError(error: unknown, name?: ArkErrorName): error is ArkError;
-/**
- * Which remote dependency an availability failure refers to. Used to label the
- * {@link ProviderUnavailableError} message and the wallet's
- * `ProviderConnectionState`; it is deliberately *not* carried as a structured
- * field on the error, since custom `Error` own-properties do not survive the
- * service-worker `postMessage` boundary. Structured clone keeps `message`,
- * `stack` and `cause`, drops own-properties, and normalizes a custom `name` to
- * `"Error"` — only the built-in error names survive it.
- */
-type ProviderKind = "arkade" | "indexer";
-/**
- * A remote provider (Arkade operator or its indexer) is temporarily
- * unreachable. This is a *retryable* condition — transport failure, request
- * timeout, or a 5xx/429-style temporary HTTP response — as opposed to a
- * terminal configuration/authorization/schema error, which stays a plain
- * `Error`/{@link ArkError}. The original low-level error is preserved as
- * {@link Error.cause}.
- */
-declare class ProviderUnavailableError extends Error {
-    /** Always `true`: this error type only ever wraps retryable conditions. */
-    readonly retryable = true;
-    constructor(message: string, options?: {
-        cause?: unknown;
-    });
-}
-/**
- * A response does not reconcile with what the SDK submitted or already
- * validated — a checkpoint tx whose txid is not among those submitted, a
- * commitment tx that differs from the one validated at tree signing. Terminal
- * rather than retryable: the two are equal by construction in a well-formed
- * exchange, so the same request would produce the same outcome.
- *
- * Neither own-properties nor a custom `name` cross the service-worker
- * `postMessage` boundary (see {@link ProviderKind}), so `retryable` and `name`
- * are in-process conveniences and every distinguishing detail belongs in
- * `message` — the one field a consumer past the boundary can still branch on.
- */
-declare class ServerResponseMismatchError extends Error {
-    readonly retryable = false;
-    constructor(message: string, options?: {
-        cause?: unknown;
-    });
-}
-/**
- * Try to convert an error to an ArkError class, returning undefined if the error is not an ArkError
- * @param error - The error to parse
- * @returns The parsed ArkError, or undefined if the error is not an ArkError
- */
-declare function maybeArkError(error: any): ArkError | undefined;
-
-/** Where the {@link ArkadeInfo} used to construct a wallet came from. */
-type ServerInfoSource = "live" | "cache";
-
-/**
- * Batch namespace provides utilities for joining and processing batch session.
- * The batch settlement process involves multiple events, this namespace provides abstractions and types to handle them.
- * @see https://docs.arkadeos.com/learn/pillars/batch-swaps
- * @example
- * ```typescript
- * // use wallet handler or create a custom one
- * const handler = wallet.createBatchHandler(intentId, inputs, expectedRecipients, musig2session);
- *
- * const abortController = new AbortController();
- * // Get event stream from the Arkade provider
- * const eventStream = arkProvider.getEventStream(
- *   abortController.signal,
- *   ['your-topic-1', 'your-topic-2']
- * );
- *
- * // Join the batch and process events
- * try {
- *   const commitmentTxid = await Batch.join(eventStream, handler);
- *   console.log('Batch completed with commitment:', commitmentTxid);
- * } catch (error) {
- *   console.error('Batch processing failed:', error);
- * } finally {
- *   abortController.abort();
- * }
- * ```
- */
-declare namespace Batch {
-    interface Handler {
-        /**
-         * Called on BatchStarted event.
-         * @returns { skip: boolean } indicating whether the batch should be skipped or not.
-         */
-        onBatchStarted(event: BatchStartedEvent): Promise<{
-            skip: boolean;
-        }>;
-        /**
-         * Called when tree signing starts.
-         * @param event The tree signing started event.
-         * @param vtxoTree The unsigned virtual output tree, reconstructed from the TreeTxEvent events.
-         * @returns Promise resolving to a boolean indicating whether to continue processing.
-         */
-        onTreeSigningStarted(event: TreeSigningStartedEvent, vtxoTree: TxTree): Promise<{
-            skip: boolean;
-        }>;
-        /**
-         * Called when tree nonces are received.
-         * @param event The tree nonces event.
-         * @returns Promise resolving to a boolean indicating whether signing is complete.
-         */
-        onTreeNonces(event: TreeNoncesEvent): Promise<{
-            fullySigned: boolean;
-        }>;
-        /**
-         * Called during batch finalization.
-         * @param event The batch finalization event.
-         * @param vtxoTree The signed virtual output tree, reconstructed from the TreeTxEvent events.
-         * @param connectorTree The connector transaction tree, reconstructed from the TreeTxEvent events.
-         */
-        onBatchFinalization(event: BatchFinalizationEvent, vtxoTree?: TxTree, connectorTree?: TxTree): Promise<void>;
-        /**
-         * Called when batch finalization completes successfully.
-         *
-         * @param event - Batch finalized event
-         */
-        onBatchFinalized?(event: BatchFinalizedEvent): Promise<void>;
-        /**
-         * Called when batch processing fails.
-         *
-         * @param event - Batch failed event
-         */
-        onBatchFailed?(event: BatchFailedEvent): Promise<void>;
-        /**
-         * Called for each virtual output tree transaction chunk received during batch processing.
-         *
-         * @param event - Tree transaction event
-         */
-        onTreeTxEvent?(event: TreeTxEvent): Promise<void>;
-        /**
-         * Called for each tree signature event received during batch processing.
-         *
-         * @param event - Tree signature event
-         */
-        onTreeSignatureEvent?(event: TreeSignatureEvent): Promise<void>;
-    }
-    /**
-     * Options for the join function.
-     *
-     * @property abortController - Abort controller used to cancel batch processing.
-     * @property skipVtxoTreeSigning - Ignore events related to the virtual output tree musig2 signing session.
-     * @property eventCallback - Callback invoked for each settlement event received while joining the batch.
-     */
-    type JoinOptions = Partial<{
-        abortController: AbortController;
-        skipVtxoTreeSigning: boolean;
-        eventCallback: (event: SettlementEvent) => Promise<void>;
-    }>;
-    /**
-     * Start the state machine that will process the batch events and join a batch.
-     * @param eventIterator - The events stream to process.
-     * @param handler - How to react to events.
-     * @param options - Options.
-     */
-    function join(eventIterator: AsyncIterableIterator<SettlementEvent>, handler: Handler, options?: JoinOptions): Promise<string>;
-}
-
-/**
- * Inputs the wallet hands to a {@link ReceiveRotatorFactory} when
- * asking it to construct the rotator at boot. The factory uses these
- * to look up the wallet's current display contract (or allocate a
- * fresh receive descriptor). Note: no `offchainTapscript` here — the
- * factory's job is allocation, not script construction. The wallet's
- * orchestrator (`WalletReceiveRotator.resolveBoot`) handles the
- * tapscript rebuild on top of the factory's result.
- */
-interface ReceiveRotatorBootOpts {
-    walletRepository: WalletRepository;
-    contractRepository: ContractRepository;
-    serverPubKey: Uint8Array;
-    /**
-     * Expected contract family ("default" or "delegate"). When provided,
-     * boot will only consider contracts of this type when looking up the
-     * wallet's current display contract, preventing a default wallet from
-     * accidentally picking up a delegate contract or vice versa.
-     */
-    expectedContractType?: "default" | "delegate";
-    /**
-     * The wallet's baseline (index-0) receive pubkey — the x-only key the
-     * initial offchain tapscript is built from. Used by {@link
-     * WalletReceiveRotator.defaultBoot} as the no-tagged-row fallback:
-     * because boarding shares the single HD index stream, the raw watermark
-     * may have been advanced by a boarding-only allocation, so the boot must
-     * NOT derive the receive pubkey from it. A wallet with no tagged receive
-     * row has never rotated L2, so its correct current receive *is* the
-     * baseline index-0 key (plan §6-II.5).
-     */
-    baselineReceivePubKey?: Uint8Array;
-    /**
-     * Logger to receive rotation-failure + backoff diagnostics. Defaults
-     * to `console` when omitted. Any object implementing
-     * {@link Logger.error} works (winston, pino, Sentry breadcrumbs,
-     * the runtime's own logger).
-     */
-    logger?: Logger;
-}
-/**
- * Output of {@link ReceiveRotatorFactory.createReceiveRotator}: the
- * constructed rotator paired with the receive pubkey it resolved at
- * boot (either the existing tagged display contract's pubkey, or a
- * freshly allocated one).
- */
-interface ReceiveRotatorBoot {
-    rotator: WalletReceiveRotator;
-    receivePubkey: Uint8Array;
-}
-/**
- * Result returned by {@link WalletReceiveRotator.resolveBoot} to the
- * wallet: the rotator plus the offchain tapscript the wallet should
- * actually use (rebuilt to the resolved boot pubkey when it differs
- * from the identity's static pubkey), plus the {@link DescriptorProvider}
- * the rotator was built around. The wallet retains the provider so
- * spending paths can route per-input signing through
- * {@link DescriptorProvider.signWithDescriptor} instead of the
- * identity's index-0 key.
- */
-interface ReceiveRotatorBootResult {
-    rotator: WalletReceiveRotator;
-    offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script;
-    provider: DescriptorProvider;
-}
-/**
- * Opt-in extension to {@link DescriptorProvider} for providers that
- * drive HD receive rotation. Implemented by {@link HDDescriptorProvider}
- * out of the box; custom providers (HSMs, external signers, …) can also
- * implement it when they want to participate.
- *
- * Kept out of the core `DescriptorProvider` interface so providers that
- * only do allocation + signing don't have to know about the wallet's
- * receive lifecycle. The wallet detects support via
- * {@link hasReceiveRotatorFactory} (a duck-typed `instanceof`-style
- * check) and falls back to {@link WalletReceiveRotator.defaultBoot}
- * when the provider doesn't implement the extension.
- */
-interface ReceiveRotatorFactory {
-    createReceiveRotator(opts: ReceiveRotatorBootOpts): Promise<ReceiveRotatorBoot | undefined>;
-}
-/**
- * Parse the trailing HD child index from a materialized signing
- * descriptor (`tr(...xpub.../0/<index>)`). Returns 0 when the
- * descriptor is absent or carries no parseable child index — restore
- * registers the index-0 baseline untagged, so a missing descriptor
- * legitimately maps to 0.
- */
-declare function signingDescriptorIndex(descriptor: unknown): number;
-/**
- * Strict sibling of {@link signingDescriptorIndex}: `undefined` instead of
- * the 0 fallback, for callers that must tell "no parseable index" apart from
- * index 0 — a watermark move mapped to 0 would move nothing while reporting
- * success.
- */
-declare function strictSigningDescriptorIndex(descriptor: string): number | undefined;
-/**
- * Minimal logging surface the rotator needs. `console` satisfies it
- * out of the box; SDK consumers can pass a structured logger
- * (winston / pino / Sentry adapter) via {@link ReceiveRotatorBootOpts}
- * to capture rotation failures + backoff diagnostics through their
- * own pipeline.
- */
-interface Logger {
-    error(message: string, ...args: unknown[]): void;
-}
-/**
- * Narrow surface the rotator needs from the wallet at runtime: the
- * mutable display tapscript, the display contract's script hex, the
- * contract manager (for subscribing + registering rotated contracts),
- * and the display address (for the contract's `address` field).
- *
- * Kept as an interface so the rotator module avoids a circular
- * dependency on `wallet.ts`. `Wallet` implements this surface
- * structurally — no `implements` clause is required.
- */
-interface RotatableWallet {
-    readonly defaultContractScript: string;
-    readonly network: {
-        hrp: string;
-    };
-    readonly arkServerPublicKey: Uint8Array;
-    readonly offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script;
-    /**
-     * @internal Sole sanctioned write path for `offchainTapscript`
-     * after construction. The rotator calls this once per rotation
-     * after persisting the new display contract.
-     */
-    setOffchainTapscriptForRotation(tapscript: DefaultVtxo.Script | DelegateVtxo.Script): void;
-    getContractManager(): Promise<IContractManager>;
-    getAddress(): Promise<string>;
-}
-/**
- * Owns the wallet's HD receive-rotation lifecycle.
- *
- * The rotator is constructed only when the wallet's `walletMode`
- * resolves to a {@link DescriptorProvider}; static wallets and
- * non-HD-capable wallets under `'auto'` never see one.
- *
- * Lifecycle:
- * 1. `resolveBoot()` — pre-Wallet-construction. Resolves the provider
- *    from `walletMode`, then either reuses the existing display
- *    contract's pubkey (if any) or allocates the first descriptor.
- *    Returns the rotator paired with the boot pubkey.
- * 2. `install(wallet)` — post-`getVtxoManager()`. Subscribes to
- *    `vtxo_received` on the contract manager and routes matching events
- *    through the rotation chain.
- * 3. `dispose()` — tears down the subscription and drains any in-flight
- *    rotation so the contract manager can be disposed cleanly.
- *
- * This class follows the dotnet-sdk's split of responsibilities: the
- * provider is a pure rotating allocator; "what address am I currently
- * bound to?" is answered by querying the contract repository, not by
- * asking the provider.
- */
-declare class WalletReceiveRotator {
-    private readonly provider;
-    private unsubscribe?;
-    private chain;
-    /**
-     * Script of the most-recent tagged display contract — populated
-     * either from the boot-time repo lookup or from the previous
-     * `rotate()` call within this session. The next `rotate()` marks
-     * this contract `inactive` once the new tagged contract is in
-     * place. `undefined` means the wallet's current display is the
-     * untagged index-0 baseline (no rotation has happened yet on this
-     * repo), and the baseline must NOT be deactivated.
-     */
-    private currentTaggedScript;
-    /**
-     * Consecutive rotation failures since the last successful rotate.
-     * Drives an exponential backoff (capped at
-     * {@link ROTATION_MAX_BACKOFF_MS}) so a broken provider can't make
-     * the rotator hammer `getNextSigningDescriptor` + `createContract`
-     * on every inbound VTXO. Reset to zero on a successful rotate.
-     */
-    private consecutiveFailures;
-    /**
-     * Unix-ms timestamp before which incoming `vtxo_received` events
-     * skip the rotation attempt entirely. Zero means "no backoff
-     * active" — the next event can rotate immediately.
-     */
-    private nextRotationAllowedAt;
-    private readonly logger;
-    private constructor();
-    /**
-     * Phase 1 — pre-Wallet-construction. Resolves `walletMode` to a
-     * {@link DescriptorProvider}, then asks that provider to construct
-     * the rotator (delegated through
-     * {@link DescriptorProvider.createReceiveRotator}, which falls back
-     * to {@link defaultBoot} when the provider doesn't override it).
-     *
-     * Returns the rotator paired with the offchain tapscript the wallet
-     * should actually install (rebuilt to the resolved receive pubkey
-     * when it differs from the identity's static pubkey), or
-     * `undefined` when the wallet should stay on the static path.
-     *
-     * Errors during pubkey resolution propagate when:
-     * - `walletMode === 'hd'` (caller asked for HD; loud failure expected).
-     * - `walletMode` is a {@link DescriptorProvider} (caller supplied an
-     *   explicit allocator; silently degrading would hide misconfig).
-     *
-     * Errors are silently swallowed (returning `undefined`) only under
-     * `walletMode: 'auto'` with the built-in HD provider, to preserve
-     * backwards compatibility with wallets whose identity descriptor
-     * isn't actually rangeable.
-     */
-    static resolveBoot(config: WalletConfig, setup: ReceiveRotatorBootOpts & {
-        offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script;
-    }): Promise<ReceiveRotatorBootResult | undefined>;
-    /**
-     * Default factory-shaped boot any
-     * {@link ReceiveRotatorFactory.createReceiveRotator} implementation
-     * can delegate to. Pulls the wallet's current display contract from
-     * the contract repository (or allocates a fresh receive descriptor
-     * via the provider when no tagged display contract exists), and
-     * returns the rotator paired with the resolved receive pubkey.
-     *
-     * Used internally by `resolveBoot` when the provider doesn't
-     * implement {@link ReceiveRotatorFactory}. Exported so providers
-     * that *do* override can still invoke the default work for the
-     * parts of the boot path they don't want to customise. Tapscript
-     * construction is intentionally NOT in here — that's the
-     * orchestrator's job.
-     */
-    static defaultBoot(provider: DescriptorProvider, opts: ReceiveRotatorBootOpts): Promise<ReceiveRotatorBoot>;
-    /**
-     * Phase 2 — post-`getVtxoManager()`. Subscribe to `vtxo_received`
-     * and trigger a rotation whenever the currently-active display
-     * contract receives funds. Old display contracts remain `active`
-     * in the repo so earlier shared addresses keep crediting this
-     * wallet.
-     */
-    install(wallet: RotatableWallet): Promise<void>;
-    /**
-     * Run a single rotation attempt, applying exponential backoff on
-     * failure. Public-shaped behavior:
-     * - During a backoff window: log + skip (no `rotate()` call).
-     * - On success: reset failure count and backoff.
-     * - On failure: increment counter, schedule next attempt at
-     *   `min(2^consecutiveFailures * 1s, ROTATION_MAX_BACKOFF_MS)`.
-     *
-     * Errors are deliberately swallowed (logged, not rethrown) so the
-     * surrounding `chain` Promise never settles to rejected — the next
-     * `vtxo_received` event must still get a chance to run.
-     */
-    private runRotateWithBackoff;
-    /**
-     * Wait for any in-flight rotation to complete. Useful in tests
-     * that need to observe the post-rotation state after dispatching
-     * a `vtxo_received` event synchronously; production code rarely
-     * needs to call this directly.
-     */
-    drain(): Promise<void>;
-    /**
-     * Run `fn` on the rotator's serialization chain, so it cannot interleave
-     * with a receive `rotate()`. Used by {@link Wallet.rotateServerSigner} to
-     * serialize server-signer rotation against HD receive rotation: both
-     * rebuild and swap `offchainTapscript`, so running them concurrently could
-     * tear the wallet's visible receive state. The chain keeps advancing even
-     * if `fn` rejects (its own caller still sees the rejection).
-     */
-    runExclusive<T>(fn: () => Promise<T>): Promise<T>;
-    /**
-     * Tear down the subscription first so no late `vtxo_received` event
-     * can queue work on a disposing wallet, then drain any in-flight
-     * rotation so its `createContract` finishes before the contract
-     * manager itself disposes.
-     */
-    dispose(): Promise<void>;
-    /**
-     * Allocate the next descriptor, swap it into the wallet's active
-     * offchain tapscript, register the new tagged contract, and retire
-     * the previous tagged contract (if any) by setting its state to
-     * `inactive`. The contract watcher keeps watching inactive
-     * contracts until their VTXOs are spent, so funds in flight at the
-     * old display address are not lost — only the address stops being
-     * advertised.
-     *
-     * Contract type matches the wallet's tapscript shape: a default
-     * wallet rotates to a new `default` contract, a delegate wallet to
-     * a new `delegate` contract.
-     *
-     * The first rotation on a fresh wallet does NOT deactivate
-     * anything: `currentTaggedScript` is `undefined` because the wallet
-     * was displaying the untagged index-0 baseline, which must stay
-     * active forever.
-     */
-    private rotate;
-}
-
-/**
- * Maximum caller-requested HD descriptors materialized past the watermark by
- * getUsedSigningDescriptors(). Bounds plugin/restore probes without changing
- * the wallet's actual allocation watermark.
- */
-declare const MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD = 1000;
-type IncomingFunds = {
-    type: "utxo";
-    coins: Coin[];
-} | {
-    type: "vtxo";
-    newVtxos: ExtendedVirtualCoin[];
-    spentVtxos: ExtendedVirtualCoin[];
-};
-
-/**
- * What signer classification needs of a snapshot: contract params and the coins
- * under them. Structural rather than {@link ContractWithVtxos} so a repository-
- * built snapshot — the worker's, whose VTXOs carry no `contractScript` — can be
- * classified without allocating a parallel array to satisfy the nominal type.
- */
-type PendingRecoverySnapshot = Parameters<typeof selectPendingRecoveryOutpoints>[0];
-/**
- * Boarding UTXOs grouped by the boarding address they sit on, carrying that
- * address's signer association explicitly. Returned by
- * {@link ReadonlyWallet.getBoardingUtxosForSigners} because a flat
- * {@link ExtendedCoin} cannot carry the signer: it retains only the encoded
- * leaves/tapTree the spend needs, not the owning `DefaultVtxo.Script` (and so
- * not its `serverPubKey` or CSV delay). The deprecated-signer boarding
- * classification reads both back from this group (Section 7).
- */
-interface BoardingUtxoGroup {
-    /** Tapscript of the boarding address the coins sit on. */
-    tapscript: DefaultVtxo.Script;
-    /** Server key of that address, normalized x-only hex. */
-    serverPubKey: string;
-    /** CSV exit timelock decoded from THIS tapscript's exit leaf. */
-    csvTimelock: RelativeTimelock;
-    coins: ExtendedCoin[];
-}
-/**
- * Why a VTXO at an arkadeCash address could not be swept by {@link Wallet.claimCash}.
- *
- * - `swept` — the server swept the batch at expiry. Recoverable in principle,
- *   but only through a settlement, which the thin sweep cannot do.
- * - `subdust` — below dust, so it sits at an OP_RETURN script with no spendable
- *   leaf. Unspendable as cash; `createCash` prevents minting these.
- * - `already-spent` — someone else claimed it first.
- * - `exited` — unilaterally exited onchain, so the offchain sweep cannot reach it;
- *   `Unroll.completeUnroll` is the remedy.
- * - `has-assets` — asset-bearing; the BTC-only sweep would burn the assets.
- * - `sweep-failed` — spendable, but its own sweep was rejected.
- */
-type ArkadeCashUnclaimedReason = "swept" | "subdust" | "already-spent" | "exited" | "has-assets" | "sweep-failed";
-/** A VTXO {@link Wallet.claimCash} left behind, with the reason why. */
-interface ArkadeCashUnclaimedVtxo {
-    txid: string;
-    vout: number;
-    /** Value in satoshis. */
-    value: number;
-    reason: ArkadeCashUnclaimedReason;
-}
-/**
- * Outcome of {@link Wallet.claimCash}: what was swept, and what was not.
- *
- * The shape is open — further buckets may be added alongside `unclaimed` as
- * more of the non-sweepable states become claimable.
- */
-interface ArkadeCashClaimResult {
-    /** Satoshis swept to this wallet. */
-    swept: number;
-    unclaimed: {
-        /** Satoshis left behind. */
-        amount: number;
-        vtxos: ArkadeCashUnclaimedVtxo[];
-    };
-}
-/**
- * Thrown when {@link Wallet.createCash} funds the note but its `send` call
- * fails after the transaction may already have been submitted.
- *
- * The whole value of the note lives in `cash`: it carries the private key that
- * controls the funded output. If `send` committed and this error is discarded,
- * the sats are stranded at an address only this token can reach. Callers that
- * cannot rule out a post-submit failure must persist `cash` — passing it to
- * {@link Wallet.claimCash} recovers the funds whether or not the send landed.
- */
-declare class ArkadeCashCreateError extends Error {
-    /** The encoded arkadeCash token controlling the funded output. */
-    readonly cash: string;
-    /** The original failure from `send`. */
-    readonly cause: unknown;
-    constructor(
-    /** The encoded arkadeCash token controlling the funded output. */
-    cash: string, 
-    /** The original failure from `send`. */
-    cause: unknown);
-}
-/**
- * Freshness of the wallet's provider-backed sync, composed from the boot
- * server-info source and the contract-manager's indexer-sync health. It
- * describes only how fresh provider data is — never the wallet balances/VTXOs
- * themselves, which are always served from the repository (system of record).
- */
-type ProviderConnectionState = {
-    mode: "online";
-    source: "live";
-    lastOnlineAt: number;
-} | {
-    mode: "degraded";
-    source: "cache" | "repository";
-    provider: ProviderKind;
-    reason: string;
-    lastOnlineAt?: number;
-};
-declare class ReadonlyWallet implements IReadonlyWallet {
-    readonly identity: ReadonlyIdentity;
-    readonly network: Network;
-    readonly onchainProvider: OnchainProvider;
-    /**
-     * Narrowed to what a readonly wallet legitimately needs — the only use
-     * here is {@link getArkadeInfo}. `protected` stops an outside caller
-     * reaching it; the `Pick` stops this class growing a use for
-     * `submitTx`. `Wallet` re-widens both below.
-     */
-    protected readonly arkProvider: Pick<ArkProvider, "getInfo">;
-    readonly indexerProvider: IndexerProvider;
-    readonly dustAmount: bigint;
-    readonly walletRepository: WalletRepository;
-    readonly contractRepository: ContractRepository;
-    readonly delegateProvider?: DelegateProvider | undefined;
-    private _contractManager?;
-    private _contractManagerInitializing?;
-    protected readonly watcherConfig?: ReadonlyWalletConfig["watcherConfig"];
-    /**
-     * Opt-in intent-lifecycle repository. Assigned by the `create()`
-     * factories from `config.storage.intentRepository`; `undefined` ⇒ all
-     * intent-persistence code paths are no-ops (default behaviour unchanged).
-     */
-    intentRepository?: IntentRepository;
-    /**
-     * **Experimental / inert.** Opt-in virtual-tx / exit-branch repository,
-     * exposed so callers can pass it to {@link Unroll.Session.create} as a
-     * best-effort raw-tx cache. Assigned by `create()` from
-     * `config.storage.virtualTxRepository`. Normal sync never writes it
-     * (ContractManager isn't given it); `undefined` ⇒ no-op.
-     */
-    virtualTxRepository?: VirtualTxRepository;
-    /** Opt-in exit-data capture settings; see {@link StorageConfig.exitDataCapture}. */
-    exitDataCapture?: {
-        mode?: ExitCaptureMode;
-        minExitWorthSats?: number;
-        sources?: ExitDataSource[];
-    };
-    private readonly _assetManager;
-    readonly walletContractTimelocks: RelativeTimelock[];
-    protected _pendingSpendOutpoints: Set<string>;
-    /** Activity resolvers consumed by {@link getActivityHistory}. */
-    readonly activity: ActivityRegistry;
-    get assetManager(): IReadonlyAssetManager;
-    /**
-     * Backing field for the active receive tapscript. Read via the
-     * public `offchainTapscript` getter; written only by
-     * {@link Wallet.setOffchainTapscriptForRotation}, which
-     * {@link WalletReceiveRotator.rotate} is the sole intended caller of.
-     */
-    protected _offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script;
-    /**
-     * Backing field for the current boarding tapscript (the QR / onboarding
-     * target). Read via the public `boardingTapscript` getter; written only
-     * by {@link Wallet.setBoardingTapscriptForRotation}, the sanctioned
-     * boarding-rotation write path (analogue of `_offchainTapscript`). It is
-     * a *current value*, not a fixed setup constant, because per-derivation
-     * boarding rotation (plan §6-II) swaps it when a fresh boarding address
-     * is explicitly allocated. Static / `auto` wallets never rotate it, so
-     * it stays the index-0 baseline for their lifetime.
-     */
-    protected _boardingTapscript: DefaultVtxo.Script;
-    /**
-     * Backing field for the active server signer (x-only, 32 bytes). Read via
-     * the public {@link arkServerPublicKey} getter; written only by
-     * {@link Wallet.setArkServerPublicKeyForRotation}, the sanctioned
-     * server-signer rotation write path (analogue of `_offchainTapscript`). It
-     * is a *current value*, not a fixed constructor constant, because
-     * mid-session server-signer rotation (plan §4) swaps it when arkd rotates
-     * its active signer. Wallets that never span a rotation keep their
-     * construction-time snapshot for their lifetime.
-     */
-    protected _arkServerPublicKey: Bytes;
-    /**
-     * Whether the LATEST server-info resolution answered live (`"live"`) or
-     * from the cached snapshot because the operator was unreachable
-     * (`"cache"`). Seeded at construction and updated by every
-     * {@link getArkadeInfo} read, so a wallet that booted offline and
-     * recovered stops reporting degraded — and one that just fell back stops
-     * claiming online. Freshness signal for
-     * {@link getProviderConnectionState}.
-     */
-    protected _serverInfoSource: ServerInfoSource;
-    /**
-     * Epoch-ms of the last known live operator contact: the most recent live
-     * resolution (construction or a later {@link getArkadeInfo}), or the
-     * cached snapshot's `savedAt` when the latest resolution fell back.
-     */
-    protected _serverInfoLastOnlineAt?: number;
-    /** @see {@link _serverInfoSource} */
-    get serverInfoSource(): ServerInfoSource;
-    /**
-     * Composed provider-connection freshness: the LATEST server-info
-     * resolution (boot, or any later {@link getArkadeInfo} read) combined with
-     * the contract-manager's indexer-sync health, if the manager has been
-     * initialized. Reads no live provider state — it never forces a
-     * `ContractManager` to construct — so it is safe for readonly callers
-     * that only use address/balance APIs.
-     *
-     *  - Latest resolution fell back to the cached snapshot → degraded on
-     *    `arkade` (`cache`).
-     *  - Otherwise, if the contract manager has degraded to repository data →
-     *    degraded on `indexer` (`repository`).
-     *  - Otherwise online.
-     *
-     * This only describes sync freshness; wallet balances/VTXOs are always read
-     * from the repository regardless of this state.
-     */
-    getProviderConnectionState(): ProviderConnectionState;
-    /**
-     * The contract-manager's current provider-sync health **without forcing it
-     * to initialize** — reads the already-constructed manager, or reports
-     * `online` when none exists yet. Unlike {@link getContractManager}, this
-     * never triggers a remote sync, so it is safe on a pure diagnostics path
-     * (e.g. the service-worker sync-state message).
-     */
-    getContractSyncState(): ContractSyncState;
-    protected constructor(identity: ReadonlyIdentity, network: Network, onchainProvider: OnchainProvider, 
-    /**
-     * Narrowed to what a readonly wallet legitimately needs — the only use
-     * here is {@link getArkadeInfo}. `protected` stops an outside caller
-     * reaching it; the `Pick` stops this class growing a use for
-     * `submitTx`. `Wallet` re-widens both below.
-     */
-    arkProvider: Pick<ArkProvider, "getInfo">, indexerProvider: IndexerProvider, arkServerPublicKey: Bytes, offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script, boardingTapscript: DefaultVtxo.Script, dustAmount: bigint, walletRepository: WalletRepository, contractRepository: ContractRepository, delegateProvider?: DelegateProvider | undefined, watcherConfig?: ReadonlyWalletConfig["watcherConfig"], walletContractTimelocks?: RelativeTimelock[]);
-    /**
-     * x-only hex of the operator's deprecated signer keys (from
-     * `ArkadeInfo.deprecatedSigners`), cached for the OFFLINE read/watch paths.
-     * The boarding watch/history surfaces ({@link getBoardingAddresses},
-     * {@link getBoardingTxs}) fan out over {current} ∪ this set so a deposit at
-     * a boarding address minted under a now-rotated operator signer keeps being
-     * watched. Refreshed from the server-info snapshot at construction (via the
-     * create() factories) and on a detected signer change. Deliberately NOT
-     * consulted by the spend path — {@link getBoardingUtxos} stays
-     * current-signer-only (a deprecated-signer input in a plain settle() is
-     * rejected; old-signer recovery goes through the migration API).
-     */
-    protected _deprecatedSigners: Map<string, bigint>;
-    /**
-     * Refresh the cached deprecated-signer set from a fresh server-info
-     * snapshot. Called by the create() factories at construction, by the
-     * server-info-change handler mid-session, and by the deprecated-signer
-     * migration pass (`VtxoManager.migrateDeprecatedSignerVtxos`). This set feeds
-     * {@link pendingRecoveryOutpoints}, which drops EXPIRED (past-cutoff)
-     * deprecated-signer VTXOs from the wallet's own coin selection. Lenient: a
-     * malformed deprecated entry is skipped, never fatal to wallet creation.
-     */
-    refreshDeprecatedSigners(info: {
-        deprecatedSigners?: readonly {
-            pubkey?: string;
-            cutoffDate?: bigint;
-        }[];
-    }): void;
-    /**
-     * The signer set the boarding WATCH/HISTORY paths fan out over: the wallet's
-     * current signer plus every cached deprecated signer. Distinct from the
-     * spend path, which is current-signer-only.
-     */
-    protected watchedBoardingSigners(): Set<string>;
-    /**
-     * `serverPubKey` defaults to the live key; spend paths that snapshot it
-     * against mid-flight rotation pass their snapshot, so the check reads from
-     * one rotation epoch.
-     */
-    protected recipientAddressContext(serverPubKey?: Bytes): RecipientArkadeAddressContext;
-    /**
-     * Currently-active receive tapscript. Read-only from the outside;
-     * mutated only via {@link Wallet.setOffchainTapscriptForRotation}
-     * by {@link WalletReceiveRotator.rotate}.
-     */
-    get offchainTapscript(): DefaultVtxo.Script | DelegateVtxo.Script;
-    /**
-     * The wallet's current active server signer (x-only, 32 bytes). Read-only
-     * from the outside; mutated only via
-     * {@link Wallet.setArkServerPublicKeyForRotation} during mid-session
-     * server-signer rotation (plan §4). Single-valued for wallets that never
-     * span a rotation.
-     */
-    get arkServerPublicKey(): Bytes;
-    /**
-     * Server info for the Arkade server this wallet is connected to, resolved
-     * exactly as construction resolves it: live wins, a retryable failure
-     * falls back to the snapshot persisted at boot, a terminal one propagates.
-     *
-     * Live rather than the pinned boot snapshot because the fields callers
-     * come here for — `signerPubkey`, `checkpointTapscript`, `fees` — are the
-     * ones a mid-session rotation moves, and a covenant built against a
-     * superseded signer is unspendable.
-     *
-     * One rotation caveat: reading does NOT re-pin the wallet —
-     * {@link arkServerPublicKey}, {@link dustAmount} and the tapscripts move
-     * only through `handleServerInfoChanged`/`rotateServerSigner` — so inside
-     * a rotation window this can report epoch N+1 while the wallet still
-     * spends on N. The window closes on its own: a read that observes a moved
-     * digest makes the provider emit `onServerInfoChanged`, which is what
-     * drives that rotation. A caller about to bind the answer into a covenant
-     * passes `{ requireLive: true }` and fails closed instead of receiving
-     * the boot snapshot.
-     *
-     * @returns The Arkade server's info
-     * @see ArkadeInfo
-     */
-    getArkadeInfo(opts?: GetArkadeInfoOptions): Promise<ArkadeInfo>;
-    /**
-     * Chain reads against this wallet's server for scripts it does not own.
-     *
-     * Binds the wallet's own `indexerProvider` — which may be an Expo or
-     * injected one that a caller's hand-built `RestIndexerProvider` would
-     * silently bypass. `getVtxos` goes through
-     * {@link getNormalizedVtxos}, which is what makes every VTXO leaving the
-     * seam carry its canonical facts.
-     *
-     * A bound object rather than the provider itself, so an `IReadonlyWallet`
-     * holder gets `getVtxos`/`getVirtualTxs` and nothing else at runtime.
-     * (`indexerProvider` is still public on the concrete classes, unlike
-     * `arkProvider`, so this narrows the interface rather than the field.)
-     */
-    getArkadeReader(): Promise<ArkadeReader>;
-    /**
-     * The wallet's current boarding tapscript (the on-chain onboarding
-     * target). Read-only from the outside; mutated only via
-     * {@link Wallet.setBoardingTapscriptForRotation} when a fresh boarding
-     * address is explicitly allocated. Single-valued for static / `auto`
-     * wallets.
-     */
-    get boardingTapscript(): DefaultVtxo.Script;
-    /**
-     * Listeners fired after the boarding tapscript rotates to a fresh index
-     * (see {@link Wallet.setBoardingTapscriptForRotation}). A live
-     * {@link notifyIncomingFunds} onchain watcher registers one so it can
-     * re-subscribe to include the newly allocated boarding address within the
-     * same session — without it, a deposit to the fresh address wouldn't fire
-     * a notification until the watcher's next re-init. Always empty for
-     * readonly / static / `auto` wallets, which never rotate boarding.
-     */
-    private readonly _boardingRotationListeners;
-    /**
-     * Register a listener invoked synchronously after each boarding rotation.
-     * Returns an unsubscribe function. Protected: only internal subscribers
-     * (the incoming-funds watcher) participate.
-     */
-    protected onBoardingRotation(listener: () => void): () => void;
-    /**
-     * Notify boarding-rotation listeners. Called by the boarding-rotation
-     * write path ({@link Wallet.setBoardingTapscriptForRotation}) once the new
-     * tapscript is in place. A throwing listener is isolated so it can neither
-     * break the rotation nor starve sibling listeners.
-     */
-    protected notifyBoardingRotation(): void;
-    /**
-     * Protected helper to set up shared wallet configuration.
-     * Extracts common logic used by both ReadonlyWallet.create() and Wallet.create().
-     */
-    protected static setupWalletConfig(config: ReadonlyWalletConfig, pubKey: Uint8Array): Promise<{
-        arkProvider: ArkProvider;
-        indexerProvider: IndexerProvider;
-        onchainProvider: OnchainProvider;
-        network: Network;
-        networkName: NetworkName;
-        serverPubKey: Uint8Array<ArrayBufferLike>;
-        offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script;
-        boardingTapscript: DefaultVtxo.Script;
-        dustAmount: bigint;
-        walletRepository: WalletRepository;
-        contractRepository: ContractRepository;
-        info: ArkadeInfo;
-        serverInfoSource: ServerInfoSource;
-        serverInfoLastOnlineAt: number | undefined;
-        delegateProvider: DelegateProvider | undefined;
-        /** @deprecated alias for `delegateProvider` */
-        delegatorProvider: DelegateProvider | undefined;
-        walletContractTimelocks: RelativeTimelock[];
-    }>;
-    /**
-     * Create a readonly wallet for querying balances, addresses, and history.
-     *
-     * @param config - Readonly wallet configuration
-     * @returns A readonly wallet instance
-     */
-    static create(config: ReadonlyWalletConfig): Promise<ReadonlyWallet>;
-    get arkAddress(): ArkAddress;
-    /**
-     * Get the pkScript hex for the wallet's primary offchain address.
-     * For the full wallet-owned script set registered in ContractManager, use getWalletScripts().
-     */
-    get defaultContractScript(): string;
-    /** Returns the wallet's Arkade address. */
-    getAddress(): Promise<string>;
-    /** Returns the onchain boarding address used to move funds into Arkade. */
-    getBoardingAddress(): Promise<string>;
-    /**
-     * Return the wallet's combined onchain and offchain balances.
-     */
-    getBalance(): Promise<WalletBalance>;
-    /**
-     * Return virtual outputs tracked by the wallet.
-     *
-     * The raw reporting/recovery read: escrowed, locked and awaiting-recovery
-     * funds are all present. Coin selection must use
-     * {@link getSpendableVtxos} instead — feeding this straight into
-     * `settle({ inputs })` or `sendBitcoin({ selectedVtxos })` bypasses the
-     * generic-spending gate.
-     *
-     * @param filter - Optional flags controlling whether recoverable or unrolled VTXOs are included
-     */
-    getVtxos(filter?: GetVtxosFilter): Promise<NormalizedExtendedVirtualCoin[]>;
-    /** @inheritdoc */
-    getSpendableVtxos(filter?: GetVtxosFilter): Promise<NormalizedExtendedVirtualCoin[]>;
-    /**
-     * Debug-log any explicit input generic selection would have excluded, for
-     * each of the three reasons it excludes on. Explicit-input APIs stay ungated
-     * on purpose (naming an outpoint *is* the intent the gate protects, and it
-     * is how an escrowed deposit is recovered once generic selection stops
-     * covering it), so this only makes the crossing visible — notably
-     * `settle({ inputs: await wallet.getVtxos() })`, which launders the raw read
-     * into a spend. Never throws into a spend path.
-     *
-     * Public so the worker handler and plugins can report their own
-     * explicit-input crossings through the same three checks.
-     */
-    logUngatedInputs(source: string, inputs: readonly {
-        txid: string;
-        vout: number;
-        script?: string;
-    }[]): Promise<void>;
-    /**
-     * Contracts whose operator signer is past its rotation cutoff, as an
-     * exclusion over scripts. The outpoint-level `pendingRecovery` set needs a
-     * synced VTXO snapshot to also drop already-swept coins; this answers the
-     * same question about a caller-supplied input without one, and a swept
-     * outpoint is unspendable regardless.
-     */
-    private expiredSignerExclusion;
-    /** The intent store's lock set. Fails open, like every other read of it. */
-    private lockedOutpoints;
-    /**
-     * One contract+VTXO read. `getContractsWithVtxos` opportunistically syncs
-     * against the indexer, so every caller that needs more than one view of the
-     * wallet's coins takes a single snapshot and derives them all from it —
-     * otherwise the gate and the pending-recovery set answer about two different
-     * points in time, and each read costs another sync.
-     */
-    protected contractSnapshot(): Promise<ContractWithVtxos[]>;
-    /**
-     * The two exclusion sets the gate is made of, derived from one snapshot so
-     * {@link getSpendableVtxos} and the balance answer about the same instant.
-     */
-    private spendabilityView;
-    /** The capability probes {@link computeOffchainBalance} needs, over one snapshot. */
-    private balanceCapabilities;
-    /**
-     * Outpoints of VTXOs whose deprecated signer is past its cutoff (EXPIRED) and
-     * which have not yet been swept — unspendable until they recover. Offline:
-     * classifies the repo's contracts against the cached signer set (active +
-     * {@link _deprecatedSigners}, cutoffs included). Empty fast-path when no
-     * signer is deprecated. Consumed by {@link getBalance} (the `pendingRecovery`
-     * bucket) and by {@link getSpendableVtxos} so neither counts nor spends them.
-     *
-     * Takes a fresh {@link contractSnapshot}, which syncs against the indexer.
-     * Callers that already hold a snapshot — or that must not sync at all, like
-     * the worker's balance read — pass it to
-     * {@link pendingRecoveryOutpointsIn} instead.
-     */
-    pendingRecoveryOutpoints(): Promise<Set<string>>;
-    /**
-     * {@link pendingRecoveryOutpoints} over a snapshot the caller already has:
-     * pure classification against the cached signer set, no repository or
-     * network read of its own.
-     */
-    pendingRecoveryOutpointsIn(snapshot: PendingRecoverySnapshot): Set<string>;
-    private selectPendingRecovery;
-    /**
-     * Return wallet transaction history derived from Arkade state and boarding transactions.
-     */
-    getTransactionHistory(): Promise<ArkTransaction[]>;
-    /**
-     * Wallet history grouped by registered activity resolvers. With no resolver match,
-     * rows bucket by transaction key so send/change pairs stay together.
-     */
-    getActivityHistory(): Promise<Activity[]>;
-    /**
-     * Clear the global VTXO sync cursor, forcing a full re-bootstrap on next sync.
-     * Useful for recovery after indexer reprocessing or debugging.
-     */
-    clearSyncCursor(): Promise<void>;
-    /**
-     * Wipe all locally persisted wallet data (VTXOs, UTXOs, history, sync
-     * cursor, contracts). Create a fresh wallet instance afterward.
-     */
-    clear(): Promise<void>;
-    /**
-     * The on-chain (P2TR) addresses of every boarding tapscript this wallet
-     * uses — the current address plus any historical rotated boarding
-     * addresses. The aggregating boarding readers (history, notifications) fan
-     * out over this set so deposits at previous boarding addresses are still
-     * surfaced (plan §6-IV); {@link getBoardingAddress} stays single-valued.
-     */
-    getBoardingAddresses(): Promise<string[]>;
-    /**
-     * Build a transaction history view across the wallet's boarding addresses
-     * (current + historical rotated; plan §6-IV.1).
-     */
-    getBoardingTxs(): Promise<{
-        boardingTxs: ArkTransaction[];
-        commitmentsToIgnore: Set<string>;
-    }>;
-    /**
-     * The set of boarding tapscripts whose on-chain UTXOs belong to this
-     * wallet — the current display tapscript plus every historical boarding
-     * address it has used. Under per-derivation rotation (plan §6-II) a wallet
-     * can hold unspent boarding UTXOs at several addresses at once, so fund
-     * discovery / spending must enumerate them all, not just the current one
-     * (plan §6-III.1). Deduplicated by scriptPubKey.
-     *
-     * Always includes the index-0 baseline (identity x-only key), which covers
-     * the degenerate equal-delay case where the index-0 boarding row is
-     * coalesced onto a `default` row and so isn't a `boarding`-typed contract.
-     *
-     * @param allowedSigners - Optional set of x-only-hex server keys whose
-     *   persisted boarding rows are included. Defaults to `{current x-only
-     *   signer}`, preserving today's current-signer-only discovery (and the
-     *   foreign-ASP guard). The deprecated-signer migration path widens this to
-     *   reach old-signer boarding addresses. The index-0 baseline and the
-     *   current display tapscript are always included regardless of the set.
-     */
-    protected getBoardingTapscripts(allowedSigners?: Set<string>): Promise<DefaultVtxo.Script[]>;
-    /**
-     * Fetch and cache onchain inputs (UTXOs) received at the boarding addresses
-     * of the given signer set, grouped per boarding address so the caller keeps
-     * the address↔signer association that {@link ExtendedCoin} cannot carry
-     * (it retains only the encoded leaves/tapTree the spend needs, not the
-     * `DefaultVtxo.Script` and its `serverPubKey`/CSV delay).
-     *
-     * Per group it does exactly what {@link getBoardingUtxos} does per tapscript:
-     * `getCoins` → {@link extendCoinWithTapscript} → `saveUtxos`. Offline-first:
-     * it does not call `getInfo()`; the caller supplies the allowed signer set,
-     * so the only network calls are the per-address `getCoins`.
-     *
-     * @param allowedSigners - x-only-hex server keys whose boarding addresses to
-     *   fetch (passed through to {@link getBoardingTapscripts}).
-     */
-    getBoardingUtxosForSigners(allowedSigners: Set<string>): Promise<BoardingUtxoGroup[]>;
-    /**
-     * Fetch and cache onchain inputs (UTXOs) received at the wallet's boarding
-     * addresses — the current address plus any historical rotated boarding
-     * addresses that still hold unspent UTXOs (plan §6-III.1). Each UTXO is
-     * annotated with the tapscript of the address it actually sits on, so the
-     * spending path forfeits / exits it with the correct per-index leaves.
-     *
-     * Current-signer only: a flatten of {@link getBoardingUtxosForSigners} over
-     * the wallet's current signer, so the two paths cannot drift. Old-signer
-     * boarding recovery goes through the deprecated-signer migration API
-     * instead (it would otherwise pull EXPIRED-signer inputs into a plain
-     * `settle()` that the server must reject).
-     */
-    getBoardingUtxos(): Promise<ExtendedCoin[]>;
-    /**
-     * Subscribe to onchain and offchain notifications for newly received funds.
-     *
-     * The onchain watcher tracks the full boarding-address set (current +
-     * historical rotated). When boarding rotates *after* subscribing — e.g.
-     * rotate-on-board allocates a fresh address via
-     * {@link getNewBoardingAddress} — the watcher automatically re-subscribes
-     * to widen its set, so a deposit to the new address fires a notification
-     * within the same session (no watcher re-init required). The re-subscribe
-     * is driven by {@link onBoardingRotation}; static / `auto` / readonly
-     * wallets never rotate boarding, so it never fires for them.
-     *
-     * @param eventCallback - Callback invoked when matching funds are detected
-     * @returns A function that stops the subscriptions
-     */
-    notifyIncomingFunds(eventCallback: (coins: IncomingFunds) => void): Promise<() => void>;
-    /** Fetch Arkade transaction ids that are still pending final settlement. */
-    fetchPendingTxs(): Promise<string[]>;
-    /**
-     * Get all pkScript hex strings for the wallet's own addresses
-     * (both delegate and non-delegate, current and historical).
-     */
-    getWalletScripts(): Promise<string[]>;
-    /**
-     * Build a map of scriptHex → VtxoScript for all wallet contracts,
-     * so virtual outputs can be extended with the correct tapscript per contract.
-     */
-    getScriptMap(): Promise<Map<string, DefaultVtxo.Script | DelegateVtxo.Script>>;
-    /**
-     * Get the ContractManager for managing contracts including the wallet's default address.
-     *
-     * The ContractManager handles:
-     * - The wallet's default receiving address (as a "default" contract)
-     * - External contracts (Boltz swaps, HTLCs, etc.)
-     * - Multi-contract watching with resilient connections
-     *
-     * @example
-     * ```typescript
-     * const manager = await wallet.getContractManager();
-     *
-     * // Create a contract for a Boltz swap
-     * const contract = await manager.createContract({
-     *   label: "Boltz Swap",
-     *   type: "vhtlc",
-     *   params: { ... },
-     *   script: swapScript,
-     *   address: swapAddress,
-     * });
-     *
-     * // Start watching for events (includes wallet's default address)
-     * const stop = await manager.onContractEvent((event) => {
-     *   console.log(`${event.type} on ${event.contractScript}`);
-     * });
-     * ```
-     */
-    getContractManager(): Promise<ContractManager>;
-    /**
-     * HD look-ahead configuration for the contract manager. Readonly wallets
-     * have no descriptor provider, hence no watermark to look ahead of.
-     * @see Wallet.lookAheadConfig
-     */
-    protected lookAheadConfig(): ContractManagerConfig["lookAhead"];
-    private initializeContractManager;
-    /** Dispose wallet-owned managers and release background resources. */
-    dispose(): Promise<void>;
-    /** Async-dispose hook that forwards to `dispose()`. */
-    [Symbol.asyncDispose](): Promise<void>;
-}
-/**
- * Main wallet implementation for Bitcoin transactions with Arkade protocol support.
- * The wallet does not store any data locally and relies on Arkade and onchain
- * providers to fetch onchain and virtual outputs.
- *
- * @example
- * ```typescript
- * // Create a wallet with providers
- * const wallet = await Wallet.create({
- *   identity: MnemonicIdentity.fromMnemonic('abandon abandon...'),
- *   arkProvider: new RestArkProvider(),
- *   onchainProvider: new EsploraProvider()
- * });
- *
- * // Use custom providers and/or URLs (e.g., for Expo/React Native)
- * const wallet = await Wallet.create({
- *   identity: MnemonicIdentity.fromMnemonic('abandon abandon...'),
- *   arkProvider: new ExpoArkProvider('https://arkade.computer'),
- *   indexerProvider: new ExpoIndexerProvider('https://arkade.computer'),
- *   onchainProvider: new EsploraProvider('https://mempool.space/api')
- * });
- *
- * // Get addresses
- * const arkAddress = await wallet.getAddress();
- * const boardingAddress = await wallet.getBoardingAddress();
- *
- * // Send bitcoin
- * const txid = await wallet.send({
- *   address: 'ark1q...',
- *   amount: 50000,
- * });
- * ```
- */
-declare class Wallet extends ReadonlyWallet implements IWallet, HDWalletCapable, AddressAllocationCapable {
-    readonly forfeitOutputScript: Bytes;
-    readonly forfeitPubkey: Bytes;
-    /** Overrides for the `batchExpiry` bounds; defaults derive from `network`. */
-    protected readonly batchExpiryPolicy?: Partial<BatchExpiryPolicy> | undefined;
-    /** Overrides for the checkpoint exit delay bounds; defaults derive from `network`. */
-    protected readonly checkpointExitDelayPolicy?: Partial<CheckpointExitDelayPolicy> | undefined;
-    static MIN_FEE_RATE: number;
-    readonly identity: Identity;
-    private readonly _delegateManager?;
-    private _vtxoManager?;
-    private _vtxoManagerInitializing?;
-    private _walletAssetManager?;
-    /**
-     * HD receive rotator. Owns the {@link DescriptorProvider}, the
-     * `vtxo_received` subscription, and the rotate-and-register
-     * lifecycle. Absent in `walletMode: 'static'` and for SingleKey
-     * wallets under `'auto'`. Wired in via the constructor; the actual
-     * subscription is installed lazily on first `getVtxoManager()` so
-     * the contract manager is up first.
-     */
-    private _receiveRotator?;
-    /**
-     * Unsubscribe handle for the arkProvider's `onServerInfoChanged` stream
-     * (mid-session signer-rotation detection). Torn down in {@link dispose}.
-     */
-    private _serverInfoUnsub?;
-    /**
-     * Tail of the serialized {@link handleServerInfoChanged} chain. Each
-     * `onServerInfoChanged` event chains onto it so handlers run one at a time,
-     * and {@link dispose} awaits it so an in-flight re-derive/rotation settles
-     * before the contract manager is torn down underneath it.
-     */
-    private _serverInfoInFlight;
-    /**
-     * React to a mid-session server-info change (driven by the arkProvider's
-     * `DIGEST_MISMATCH` detection). First refresh the cached deprecated-signer
-     * set so the boarding WATCH path immediately widens to the just-deprecated
-     * signer, then — only if the active signer actually changed — rotate the
-     * wallet onto it via {@link rotateServerSigner} (re-deriving the offchain +
-     * boarding display tapscripts and registering the current-signer rows).
-     * Old-signer rows stay active, so existing funds remain watched. Failures
-     * are logged, never thrown back into the provider's emit loop.
-     */
-    private handleServerInfoChanged;
-    /**
-     * Await an `onServerInfoChanged` handler still applying a rotation.
-     *
-     * The provider emits synchronously but {@link handleServerInfoChanged} runs
-     * off the emit, so between the two a caller can observe a half-applied
-     * rotation: {@link rotateServerSigner} persists the active signer's contract
-     * rows *before* committing the tapscripts, so `arkServerPublicKey` still
-     * reads the old key while the new key's rows are already in the repository.
-     * A path that refreshes server info and then reads signer-derived state must
-     * drain the chain first, or it both reads that torn state and races the
-     * handler for the rotation itself.
-     *
-     * Resolves once the chain is idle; a handler that threw already logged, and
-     * its rejection is swallowed here.
-     *
-     * @internal Invoked by {@link dispose} and the {@link VtxoManager} migration
-     * pass; not part of the stable public API.
-     */
-    settleServerInfoChanges(): Promise<void>;
-    private _receiveRotatorInstalled;
-    /**
-     * Descriptor-aware signer used by {@link _signerRouter} to sign
-     * inputs locked by rotated pubkeys. Same instance the rotator owns;
-     * stashed here so the spending paths don't have to reach inside the
-     * rotator. Undefined for static / non-HD-capable wallets — those
-     * paths only ever take the identity-sign branch.
-     */
-    private readonly _descriptorProvider?;
-    /** Per-side width of the HD look-ahead band. @see WalletConfig.lookAheadWindow */
-    private readonly _lookAheadWindow;
-    /**
-     * Watch a band of missing offchain receive scripts around the HD watermark
-     * so payments to an externally-issued address land without a `restore()`.
-     * Only HD wallets have a watermark to look ahead of; static / `auto`
-     * wallets keep a single index-0 receive address, so the feature stays off.
-     *
-     * `candidateDeps` is read at refill time, so a band rebuilt after
-     * {@link rotateServerSigner} fans the active signer set (persisted
-     * old-signer rows stay watched through the repository).
-     */
-    protected lookAheadConfig(): ContractManagerConfig["lookAhead"];
-    /**
-     * Every axis an externally issued receive script could be anchored to, not
-     * just the wallet's own current shape: an issuer sharing the seed (NArk, a
-     * merchant backend) picks its own contract type, and a band derived from one
-     * variant silently misses the rest until a `restore()`.
-     *
-     * Read from cached state, not a fresh `getInfo`, to stay synchronous and
-     * offline-safe; {@link refreshDeprecatedSigners} and
-     * {@link rotateServerSigner} keep it current and re-trigger a refill.
-     */
-    private receiveCandidateDeps;
-    private readonly _signerRouter;
-    /**
-     * @internal Sole write path for `offchainTapscript` after construction.
-     * Called by {@link WalletReceiveRotator.rotate} once the rotated
-     * display contract has been persisted. External code must treat
-     * `offchainTapscript` as read-only.
-     */
-    setOffchainTapscriptForRotation(tapscript: DefaultVtxo.Script | DelegateVtxo.Script): void;
-    /**
-     * @internal Sole write path for `boardingTapscript` after construction.
-     * Called by {@link Wallet.getNewBoardingAddress} once the rotated
-     * boarding contract has been persisted. External code must treat
-     * `boardingTapscript` as read-only.
-     */
-    setBoardingTapscriptForRotation(tapscript: DefaultVtxo.Script): void;
-    /**
-     * @internal Sole write path for `arkServerPublicKey` after construction.
-     * Called by {@link Wallet.rotateServerSigner} once the rotated offchain and
-     * boarding contract rows have been persisted. External code must treat
-     * `arkServerPublicKey` as read-only.
-     */
-    setArkServerPublicKeyForRotation(serverPubKey: Bytes): void;
-    /**
-     * Output script for checkpoint transactions, decoded from the server's
-     * `checkpointTapscript`. Server-controlled state: pinned at construction
-     * and re-sourced from a fresh `ArkadeInfo` on server-signer rotation. Read it
-     * through {@link serverUnrollScript}; write it only through
-     * {@link setServerUnrollScriptForRotation}.
-     */
-    protected _serverUnrollScript: CSVMultisigTapscript.Type;
-    get serverUnrollScript(): CSVMultisigTapscript.Type;
-    /**
-     * @internal Sole write path for `serverUnrollScript` after construction.
-     * Called by {@link Wallet._doRotateServerSigner} with the checkpoint script
-     * sourced from the fresh `ArkadeInfo` that triggered the rotation, so the send
-     * path builds checkpoints against the new server epoch. External code must
-     * treat `serverUnrollScript` as read-only.
-     */
-    setServerUnrollScriptForRotation(script: CSVMultisigTapscript.Type): void;
-    /**
-     * Serializes {@link rotateServerSigner} for static / non-HD wallets (which
-     * have no {@link WalletReceiveRotator} chain to ride). Coalesces concurrent
-     * migration passes so two callers cannot both rebuild and swap the
-     * tapscripts. HD wallets serialize on the rotator's chain instead, via
-     * {@link WalletReceiveRotator.runExclusive}.
-     */
-    private _serverRotationChain;
-    /**
-     * Allocate and return a *fresh* on-chain boarding address, rotating the
-     * wallet's current boarding tapscript to a new HD index.
-     *
-     * This is the explicit boarding allocator — the analogue of dotnet's
-     * `GetNextContract(NextContractPurpose.Boarding)`. Unlike
-     * {@link getBoardingAddress} (a stable read of the current display
-     * address that never burns an index), each call here:
-     *
-     * - allocates the next index from the shared HD stream (so boarding and
-     *   L2 receive interleave on one monotonic index);
-     * - builds the boarding tapscript at that index with the boarding-exit
-     *   CSV;
-     * - persists an `active` `boarding` contract tagged
-     *   {@link WALLET_RECEIVE_SOURCE} (with its `signingDescriptor`) so the
-     *   ContractWatcher monitors it, boot can restore it as the current
-     *   boarding address, and descriptor-aware signing can recover the
-     *   per-index key;
-     * - swaps the wallet's current `boardingTapscript`.
-     *
-     * Gated by `walletMode`: a static / `auto` wallet has no descriptor
-     * provider and keeps a single index-0 boarding address for its lifetime,
-     * so this returns the existing {@link getBoardingAddress} unchanged
-     * (no rotation, no index burned).
-     *
-     * **Behaviour change.** A wallet configured with a custom
-     * {@link DescriptorProvider} (`walletMode: <provider>`) now rotates here.
-     * It previously did not: allocation went through the contract manager,
-     * which only wires an `allocate` hook for {@link HDDescriptorProvider}, so
-     * such a wallet read as "declined to allocate" and silently kept its
-     * index-0 boarding address forever. Those wallets now burn an index per
-     * call — including via {@link maybeRotateBoardingAfterBoard}, which fires
-     * on every settle that consumes a boarding UTXO. Funds at retired
-     * addresses stay reachable: each rotation persists its `boarding` contract
-     * before swapping, and {@link getBoardingUtxos} fans out over the full
-     * historical set.
-     *
-     * @deprecated Use {@link getNewAddresses} — it mints any combination of
-     * address types at one shared index, and reports the contract row behind
-     * each. Note the difference in display behaviour: this method *swaps* the
-     * advertised boarding address, where `getNewAddresses` mints side
-     * addresses and leaves {@link getBoardingAddress} alone. To keep this
-     * method's behaviour, keep calling this method.
-     */
-    getNewBoardingAddress(): Promise<string>;
-    /**
-     * Allocate a *fresh* address of each requested type, all derived from one
-     * newly allocated HD index.
-     *
-     * This is the explicit allocator the receive path otherwise lacks:
-     * {@link getAddress} and {@link getBoardingAddress} are stable reads of the
-     * wallet's display addresses, and the display receive address only advances
-     * when a payment arrives ({@link WalletReceiveRotator} rotates on
-     * `vtxo_received`). Issuing a second address before the first is paid — one
-     * invoice for Alice, another for Bob — has to go through here.
-     *
-     * Each call:
-     *
-     * - allocates **one** index from the shared HD stream, however many types
-     *   were asked for, so a `default` + `boarding` pair are siblings rather
-     *   than two burnt indices;
-     * - builds each requested script at that index, preserving every other
-     *   option of the wallet's current script for that flavour (including a
-     *   delegate wallet's `delegate` shape);
-     * - persists each as an `active` contract carrying its `signingDescriptor`,
-     *   so the ContractWatcher monitors it, the balance counts it, and
-     *   {@link signerForDescriptor} can recover the key;
-     * - slides the look-ahead band, since the watermark moved past indices an
-     *   external issuer may still be handing out.
-     *
-     * The minted rows are deliberately left **untagged**: the boot lookups
-     * adopt the newest {@link WALLET_RECEIVE_SOURCE}-tagged row as the display
-     * address, and a side address issued to one counterparty must not become
-     * the address the wallet advertises to everyone else. {@link getAddress}
-     * and {@link getBoardingAddress} are unchanged by this call.
-     *
-     * A wallet with no HD stream (`walletMode: 'static'` / `'auto'`) has one
-     * address per flavour for its lifetime. Without `forceNew` it returns those
-     * — the real persisted rows, no index burned; with `forceNew` it throws
-     * {@link WalletCannotAllocateAddressError} rather than hand back an address
-     * that is not in fact fresh.
-     *
-     * @example
-     * ```typescript
-     * const [invoice] = await wallet.getNewAddresses({ forceNew: true });
-     * // hand `invoice.address` to Alice, keep the descriptor with the invoice
-     * const signer = await wallet.signerForDescriptor(invoice.signingDescriptor);
-     * ```
-     */
-    getNewAddresses(opts?: GetNewAddressesOptions): Promise<NewAddress[]>;
-    /**
-     * Shared allocation core behind {@link getNewAddresses} and the deprecated
-     * {@link getNewBoardingAddress}, so the two cannot drift on what an
-     * allocation costs or what gets persisted.
-     *
-     * @param tagSource - Tag the persisted rows {@link WALLET_RECEIVE_SOURCE},
-     * making the next boot adopt them as the display address. Only the
-     * deprecated boarding allocator passes `true`; `getNewAddresses` mints side
-     * addresses and must not hijack what the wallet advertises.
-     */
-    private allocateAddresses;
-    /**
-     * The wallet's existing display addresses, as persisted contract rows —
-     * the honest answer for a wallet with no index to burn.
-     *
-     * Each type is minted from the descriptor that already owns its display
-     * script ({@link displayDescriptor}), not from the identity key, so the
-     * returned `signingDescriptor` is the one that signs for the returned
-     * `address` even on a wallet that has rotated.
-     */
-    private currentAddresses;
-    /**
-     * The descriptor that owns the wallet's current display script for `type`,
-     * read off the row the wallet persisted when it adopted that script.
-     *
-     * Deriving it from the identity instead is only correct for a wallet that
-     * never rotates. On one that has — an HD wallet whose provider later
-     * declines to allocate — the display script belongs to an HD child, and
-     * pairing its address with the identity descriptor hands the caller a
-     * {@link NewAddress} whose `signingDescriptor` resolves, via
-     * {@link signerForDescriptor}, to a signer holding the wrong key.
-     *
-     * Falls back to the identity's pathless `tr(pubkey)` when no row carries a
-     * descriptor: the static / `auto` case, where the identity key genuinely
-     * owns the display script and this is what `getNextSigningDescriptor`
-     * answers too. (The index-0 baselines registered at construction carry no
-     * `signingDescriptor` metadata, so those wallets take this path.)
-     */
-    private displayDescriptor;
-    /**
-     * Build, persist and shape one address of `type` owned by `descriptor` —
-     * the single build-and-register path behind both {@link allocateAddresses}
-     * and {@link currentAddresses}, so a freshly allocated address and a
-     * re-registered display address cannot disagree on what gets written.
-     *
-     * The descriptor is the sole source of the script's owner key in both
-     * branches. Deriving one flavour from the descriptor and the other from a
-     * tapscript field is what lets `address` and `signingDescriptor` drift
-     * apart.
-     */
-    private mintAddress;
-    /**
-     * Build the boarding contract owned by `pubKey`, keeping every other option
-     * of the wallet's current boarding tapscript (notably the boarding-exit
-     * CSV, which is index-independent). The offchain analogue lives in
-     * {@link buildReceiveContract}.
-     */
-    private buildBoardingContract;
-    /**
-     * @see HDWalletCapable.getCurrentSigningDescriptor
-     */
-    getCurrentSigningDescriptor(): Promise<string | undefined>;
-    /**
-     * @see HDAllocationCapable.getNextSigningDescriptor
-     *
-     * Every `Wallet` answers — this is where the wallet's key-provisioning
-     * policy lives, so consumers never have to branch on wallet shape:
-     * - HD: allocate a fresh index through the contract manager (which owns
-     *   cross-context serialization and the look-ahead band).
-     * - custom provider: whatever the provider allocates.
-     * - static / `auto`: the identity key as a bare `tr(pubkey)` descriptor —
-     *   the same answer every call, because that IS the static policy.
-     */
-    getNextSigningDescriptor(): Promise<string | undefined>;
-    /**
-     * @see HDAllocationCapable.advanceSigningDescriptorWatermark
-     */
-    advanceSigningDescriptorWatermark(descriptor: string): Promise<void>;
-    /**
-     * @see HDWalletCapable.getUsedSigningDescriptors
-     *
-     * Union of the watermark band and the descriptors persisted on contracts:
-     * the band alone would miss rows a restore scan wrote, and the contracts
-     * alone would miss indices allocated for something the wallet never
-     * persisted (a swap, an externally issued invoice).
-     */
-    getUsedSigningDescriptors(opts?: {
-        lookAhead?: number;
-    }): Promise<string[]>;
-    /**
-     * @see HDWalletCapable.signerForDescriptor
-     *
-     * Fail-loud contract: the returned identity is always the descriptor's
-     * own key. A descriptor this wallet cannot sign for throws
-     * {@link ForeignDescriptorError} instead of silently substituting the
-     * baseline identity — that identity would sign happily with the wrong
-     * key, and the failure would only surface as a rejected transaction or a
-     * dead script, far from the call that caused it.
-     */
-    signerForDescriptor(descriptor: string): Promise<Identity>;
-    /**
-     * Mid-session server-signer rotation (plan §4). When arkd rotates its
-     * active signer mid-session — the case the long-lived service worker and
-     * Expo background processes that own automatic migration must handle — a
-     * wallet constructed before the rotation keeps deriving old-signer receive
-     * addresses. Building a migration output to such an address would produce a
-     * VTXO the server must reject, so the wallet must first re-derive its own
-     * receive state under the new active signer.
-     *
-     * Follows the {@link WalletReceiveRotator.rotate} write-path pattern with
-     * the server key swapped instead of the user key: build the new offchain
-     * and boarding tapscripts locally (preserving every other option),
-     * register the matching `default`/`delegate` and `boarding` contract rows
-     * through {@link ContractManager.createContract}, and only then commit the
-     * new tapscripts and server key to the wallet's visible state. The signing
-     * metadata of the current receive/boarding rows is carried onto the new
-     * rows so a rotated (descriptor-backed) receive pubkey can still sign.
-     *
-     * The old-signer contract rows are intentionally left `active` and watched
-     * — they are exactly the deprecated-signer contracts the migration pass
-     * drains. Idempotent: a no-op when the wallet already tracks `xonly`.
-     *
-     * Serialized against HD receive rotation so the two paths (both of which
-     * rebuild and swap `offchainTapscript`) cannot interleave.
-     *
-     * @internal Invoked by the {@link VtxoManager} migration pass; not part of
-     * the stable public API.
-     */
-    rotateServerSigner(newServerPubKey: Bytes, checkpointTapscript: string): Promise<void>;
-    private _doRotateServerSigner;
-    /**
-     * Async mutex that serializes all operations submitting VTXOs to the Arkade
-     * server (`settle`, `send`, `sendBitcoin`). This prevents VtxoManager's
-     * background renewal from racing with user-initiated transactions for the
-     * same VTXO inputs.
-     */
-    private _txLock;
-    /**
-     * In-flight guard for {@link restore}. A second `restore()` while one
-     * is running returns the same promise so concurrent callers coalesce
-     * into a single scan (spec §3.E). Cleared on settle so a later
-     * explicit `restore()` re-runs.
-     */
-    private _restoreInFlight?;
-    private _addPendingSpends;
-    private _removePendingSpends;
-    private _withTxLock;
-    /**
-     * Explicitly recover this wallet's contracts and balance on a fresh
-     * repo. HD wallets run a gap-limit scan across the index range;
-     * static / non-HD wallets restore based on the single default
-     * pubkey. Never throws because of identity/mode (a static identity
-     * is a valid, narrower restore); throws on operational failure (so a
-     * truncated restore is loud, not silent — the gap window may have
-     * closed early). Idempotent and safe to call concurrently (calls
-     * coalesce into one scan).
-     *
-     * Ordering is deliberate (spec §3.B / §4): scan → advance the HD
-     * watermark → inline VTXO pull → only THEN surface aggregated
-     * handler errors, so safely-discovered funds are always recovered
-     * even when one discovery handler failed.
-     *
-     * @param opts.gapLimit - Consecutive-unused-index window. Default
-     * 20. A non-positive / non-integer value is a programmer error and
-     * throws synchronously (distinct from operational failure).
-     *
-     * @note Concurrent calls coalesce: if a restore is already in flight,
-     * subsequent callers receive the same promise and their `gapLimit` is
-     * ignored — the first caller's value governs the running scan.
-     */
-    restore(opts?: {
-        gapLimit?: number;
-    }): Promise<void>;
-    private _runRestore;
-    /** @deprecated Use settlementConfig instead */
-    readonly renewalConfig: Required<Omit<WalletConfig["renewalConfig"], "enabled">> & {
-        enabled: boolean;
-        thresholdMs: number;
-    };
-    readonly settlementConfig: SettlementConfig | false;
-    /**
-     * Re-widened to public: a full wallet's provider is part of its API
-     * (`ExpoWallet` and the delegate manager read it), while `ReadonlyWallet`
-     * keeps it protected so a readonly view cannot hand out `submitTx`.
-     */
-    readonly arkProvider: ArkProvider;
-    /**
-     * Broadcast access bound to this wallet's server, so a plugin needs only
-     * the wallet.
-     *
-     * Defined here and not on {@link ReadonlyWallet} for the same reason
-     * `arkProvider` is protected there: a readonly wallet, and every
-     * `toReadonly()` view, must not be able to submit.
-     */
-    getArkadeBroadcaster(): Promise<ArkadeBroadcaster>;
-    protected constructor(identity: Identity, network: Network, onchainProvider: OnchainProvider, arkProvider: ArkProvider, indexerProvider: IndexerProvider, arkServerPublicKey: Bytes, offchainTapscript: DefaultVtxo.Script | DelegateVtxo.Script, boardingTapscript: DefaultVtxo.Script, serverUnrollScript: CSVMultisigTapscript.Type, forfeitOutputScript: Bytes, forfeitPubkey: Bytes, dustAmount: bigint, walletRepository: WalletRepository, contractRepository: ContractRepository, 
-    /** @deprecated Use settlementConfig */
-    renewalConfig?: WalletConfig["renewalConfig"], delegateProvider?: DelegateProvider, watcherConfig?: WalletConfig["watcherConfig"], settlementConfig?: WalletConfig["settlementConfig"], walletContractTimelocks?: RelativeTimelock[], receiveRotator?: WalletReceiveRotator, descriptorProvider?: DescriptorProvider, lookAheadWindow?: number, 
-    /** Overrides for the `batchExpiry` bounds; defaults derive from `network`. */
-    batchExpiryPolicy?: Partial<BatchExpiryPolicy> | undefined, 
-    /** Overrides for the checkpoint exit delay bounds; defaults derive from `network`. */
-    checkpointExitDelayPolicy?: Partial<CheckpointExitDelayPolicy> | undefined);
-    get assetManager(): IAssetManager;
-    getVtxoManager(): Promise<VtxoManager>;
-    dispose(): Promise<void>;
-    /**
-     * Create a full wallet and initialize its background managers.
-     *
-     * @param config - Wallet configuration
-     * @returns A wallet ready to query balances and send transactions
-     * @example
-     * ```typescript
-     * const wallet = await Wallet.create({
-     *   identity,
-     *   arkProvider: new RestArkProvider(),
-     * });
-     * ```
-     */
-    static create(config: WalletConfig): Promise<Wallet>;
-    /**
-     * Convert this wallet to a readonly wallet.
-     *
-     * @returns A readonly wallet with the same configuration but readonly identity
-     * @example
-     * ```typescript
-     * const wallet = await Wallet.create({ identity: MnemonicIdentity.fromMnemonic('abandon abandon...'), ... });
-     * const readonlyWallet = await wallet.toReadonly();
-     *
-     * // Can query balance and addresses
-     * const balance = await readonlyWallet.getBalance();
-     * const address = await readonlyWallet.getAddress();
-     *
-     * // But cannot send transactions (type error)
-     * // readonlyWallet.send(...); // TypeScript error
-     * ```
-     */
-    toReadonly(): Promise<ReadonlyWallet>;
-    /** Returns the delegate manager when delegation support is configured. */
-    getDelegateManager(): Promise<IDelegateManager | undefined>;
-    /** @deprecated alias for @see Wallet.getDelegateManager */
-    getDelegatorManager(): Promise<IDelegateManager | undefined>;
-    /**
-     * Send bitcoin to an Arkade address.
-     *
-     * @deprecated Use `send`.
-     * @param params - Send parameters
-     */
-    sendBitcoin(params: SendBitcoinParams): Promise<string>;
-    /**
-     * Settle boarding inputs and/or virtual outputs into a finalized mainnet transaction.
-     *
-     * `params.inputs` is **ungated**: whatever the caller names is settled,
-     * including VTXOs generic selection would skip. That is what makes an
-     * escrowed or otherwise gated deposit recoverable by hand — but it also
-     * means `settle({ inputs: await wallet.getVtxos() })` silently bypasses the
-     * gate. Pass {@link getSpendableVtxos} instead when the intent is "settle
-     * whatever is spendable".
-     *
-     * @param params - Optional settlement inputs and outputs. When omitted, the wallet settles all eligible funds.
-     * @param eventCallback - Optional callback invoked for settlement stream events.
-     * @returns The finalized Arkade transaction id
-     */
-    settle(params?: SettleParams, eventCallback?: (event: SettlementEvent) => void): Promise<string>;
-    private _settleImpl;
-    /**
-     * Rotate the boarding address after a board (rotate-on-board trigger).
-     *
-     * Mirrors {@link WalletReceiveRotator}'s L2 rotation, but driven by a
-     * board instead of a `vtxo_received` event: when a settle consumes at
-     * least one boarding (on-chain) UTXO, the current boarding address has
-     * served its purpose, so we allocate a fresh one via
-     * {@link getNewBoardingAddress}. A settle that consumed only VTXOs (a
-     * renewal / offboard) is not a board and leaves the boarding address
-     * untouched.
-     *
-     * Boarding inputs are the non-VTXO coins (no `script`), the same
-     * discriminator {@link handleSettlementFinalizationEvent} uses; the
-     * `typeof` guard skips the arknote strings settle also accepts.
-     *
-     * No-ops for static / `auto` wallets (no descriptor provider — boarding
-     * stays on its fixed index-0 address). Wallets on a custom
-     * {@link DescriptorProvider} DO rotate here now, where they previously
-     * no-opped — see the behaviour-change note on {@link
-     * getNewBoardingAddress}. Best-effort and non-fatal: the
-     * settle has already committed and its txid must be returned, so a
-     * rotation failure is logged and swallowed rather than thrown. Funds at
-     * the retired boarding address remain discoverable — the old `boarding`
-     * contract stays active and {@link getBoardingUtxos} fans out over the
-     * full historical boarding set.
-     */
-    private maybeRotateBoardingAfterBoard;
-    private handleSettlementFinalizationEvent;
-    private unsignableBoardingInputError;
-    /**
-     * Create a batch event handler for settlement flows.
-     *
-     * @param intentId - The intent ID.
-     * @param inputs - Inputs used by the intent.
-     * @param expectedRecipients - Expected recipients to validate in the virtual output tree.
-     * @param session - Optional musig2 signing session. When omitted, signing steps are skipped.
-     */
-    createBatchHandler(intentId: string, inputs: ExtendedCoin[], expectedRecipients: Recipient[], session?: SignerSession): Batch.Handler;
-    /**
-     * Build {@link InputSigningJob}s for a tx whose signable inputs can be
-     * resolved from their own `witnessUtxo.script`. Inputs without a
-     * `witnessUtxo` are silently omitted, mirroring the wallet's
-     * historical silent-skip behaviour for cosigner/connector inputs.
-     */
-    private inputSigningJobsFromWitnessUtxos;
-    /**
-     * Best-effort upsert of the current settlement intent into the optional
-     * {@link intentRepository}. Never throws into the settle path — intent
-     * persistence is observational and must not break money flow. Preserves
-     * fields already written by the event reducer (state-event ordering).
-     */
-    private persistIntentSnapshot;
-    /**
-     * @internal Sign an on-chain boarding exit / sweep transaction, routing
-     * each input to the correct key by its `witnessUtxo.script`: the identity
-     * for index-0 / static boarding, the per-index descriptor for a rotated
-     * boarding UTXO (plan §6-III.3). Used by
-     * {@link VtxoManager.sweepExpiredBoardingUtxos}; without it, the
-     * unilateral exit of a rotated boarding UTXO would be signed with the
-     * wrong (index-0) key and rejected.
-     */
-    signOnchainBoardingTx(tx: Transaction): Promise<Transaction>;
-    safeRegisterIntent(intent: SignedIntent<Intent.RegisterMessage>, inputs: ExtendedCoin[]): Promise<string>;
-    makeRegisterIntentSignature(coins: ExtendedCoin[], outputs: TransactionOutput[], onchainOutputsIndexes: number[], cosignerPubKeys: string[], validAt?: number): Promise<SignedIntent<Intent.RegisterMessage>>;
-    makeDeleteIntentSignature(coins: ExtendedCoin[]): Promise<SignedIntent<Intent.DeleteMessage>>;
-    makeGetPendingTxIntentSignature(coins: ExtendedVirtualCoin[]): Promise<SignedIntent<Intent.GetPendingTxMessage>>;
-    /**
-     * Finalizes pending transactions by retrieving them from the server and finalizing each one.
-     * Skips the server check entirely when no send was interrupted (no pending tx flag set).
-     * @param vtxos - Optional list of virtual outputs to use instead of retrieving them from the server
-     * @returns Array of transaction IDs that were finalized
-     */
-    finalizePendingTxs(vtxos?: ExtendedVirtualCoin[]): Promise<{
-        finalized: string[];
-        pending: string[];
-    }>;
-    /**
-     * The server unroll scripts a pending checkpoint may legitimately have been
-     * built under: this wallet's configured one, the server's current one, and
-     * one per deprecated signer (same closure, deprecated key). A tx submitted
-     * before a signer rotation was built under the old key, so rebuilding
-     * against the current key alone would leave it pending forever.
-     */
-    private checkpointUnrollCandidates;
-    private hasPendingTxFlag;
-    private setPendingTxFlag;
-    /**
-     * Create an ArkadeCash bearer instrument.
-     *
-     * Generates a fresh keypair, sends the specified amount to a DefaultVtxo
-     * controlled by the new key, and returns the encoded arkadeCash string.
-     * The receiver can claim the funds using `claimCash()` without ever
-     * sharing their address.
-     *
-     * ArkadeCash is a short-lived instrument: it carries a private key, so it is
-     * meant to be handed over and claimed promptly, not held. A note left
-     * unclaimed past its batch expiry is swept by the server and `claimCash`
-     * can only report it, not move it.
-     *
-     * @param amount - Amount in satoshis to send. Must be a whole number of
-     * sats at or above the dust threshold — a below-dust amount would mint an
-     * OP_RETURN output that is unspendable as cash.
-     * @returns The encoded arkadeCash string (e.g., "arkadecash1...")
-     */
-    createCash(amount: number): Promise<string>;
-    /**
-     * Claim an ArkadeCash bearer instrument: sweep what can be swept, report the
-     * rest.
-     *
-     * Every spendable VTXO at the arkadeCash address is swept to this wallet in
-     * its own offchain transaction, signed with the key carried by the arkadeCash
-     * string. Nothing is ever persisted: no contract is imported, and the
-     * arkadeCash key is not stored. Anything that cannot be swept — server-swept,
-     * subdust, already claimed, or asset-bearing — is returned in `unclaimed`
-     * with a per-VTXO reason and otherwise ignored.
-     *
-     * The arkadeCash string is the recovery token: a claim interrupted between
-     * submit and finalize is completed by simply re-running `claimCash`, which
-     * drains any pending arkadeCash transaction on the server before sweeping.
-     *
-     * @param cashStr - The encoded arkadeCash string (e.g., "arkadecash1...")
-     * @returns The swept total and the report of what was left behind. The
-     * shape is open: further buckets may be added alongside `unclaimed`.
-     */
-    claimCash(cashStr: string): Promise<ArkadeCashClaimResult>;
-    /**
-     * Split the VTXOs at an arkadeCash address into the ones the thin sweep can
-     * move and the ones it can only report.
-     */
-    private classifyCashVtxos;
-    /** Read every page of an unfiltered VTXO query for the given scripts. */
-    private fetchAllVtxos;
-    /**
-     * Complete any sweep a previous `claimCash` registered but never finalized.
-     * A thin variant of {@link finalizePendingTxs}, scoped to the arkadeCash key:
-     * the intent is signed with it, and so are the returned checkpoints.
-     *
-     * A drained sweep is not automatically *ours*. Whoever registered it chose
-     * the destination, so a tx a different claimer left half-finished pays that
-     * claimer — finalizing it is still right (the input is spent either way, and
-     * completing it unsticks the funds), but only the value it actually pays to
-     * `myPkScript` may be counted as claimed here.
-     *
-     * @param vtxos - VTXOs at the arkadeCash contract's own pkScript, spent ones
-     * included (a registered sweep marks its input spent). Any other outpoint —
-     * subdust above all — would make the proof invalid, since it describes every
-     * input by that pkScript.
-     * @returns The number of pending txs finalized, the sats among them paid to
-     * this wallet, and the outpoints those txs consumed to pay it.
-     */
-    private finalizePendingCashTxs;
-    /** Sum the outputs of an ark tx PSBT that pay the given scriptPubKey. */
-    private arkTxAmountPaidTo;
-    /**
-     * Send BTC and/or assets to one or more recipients, passed either as
-     * variadic `Recipient`s or as a single `SendParams` object — the latter
-     * also carries the virtual outputs to spend.
-     *
-     * @param args - Recipients, or a `SendParams` object
-     * @returns Promise resolving to the Arkade transaction ID
-     * @see SendParams
-     *
-     * @example
-     * ```typescript
-     * const txid = await wallet.send({
-     *     address: 'ark1q...',
-     *     amount: 1000, // (optional, default to dust) btc amount to send to the output
-     *     assets: [{ assetId: 'abc123...', amount: 50n }] // (optional) list of assets to send
-     * });
-     *
-     * // choosing the inputs as well as the outputs
-     * const txid = await wallet.send({
-     *     recipients: [{ address: 'ark1q...', amount: 1000 }],
-     *     selectedVtxos: mine, // spent as given, nothing added
-     * });
-     * ```
-     */
-    send(...args: [SendParams] | [Recipient, ...Recipient[]]): Promise<string>;
-    private _sendImpl;
-    /**
-     * Shared tail of every Ark-transaction spend path (`send`, selected-VTXO
-     * `sendBitcoin`, and {@link sendSelectedVtxosToSelf}): hide the inputs from
-     * concurrent `getVtxos()`, build+submit the offchain tx, persist the spent
-     * inputs and any wallet-owned (change / self) output, then release the
-     * pending-spend hold. Callers own coin selection, output construction, and
-     * the synchronous epoch snapshot; this owns the submit/persist sequence.
-     */
-    private _submitOffchainSpend;
-    /**
-     * @internal Migration primitive (deprecated-signer plan, step 1). Spend an
-     * explicit set of the wallet's own deprecated-signer VTXOs into a single
-     * full-value output on the wallet's *active* signer, through the Ark send
-     * path (not `settle`) so arkd builds checkpoints against the active server
-     * epoch. Consumed in-process by {@link VtxoManager}'s migration pass; not
-     * part of the public `IWallet` API and never accepts boarding `ExtendedCoin`
-     * inputs.
-     *
-     * The caller (`migrateCore`) must have already moved the wallet onto the
-     * active signer (`ensureReceiveOnActiveSigner`) and sized the batch (caps +
-     * dust floor); this method validates the inputs, preserves all input assets
-     * on the self output, and persists the new active-signer VTXO even though
-     * there is no separate change output. It records no `TxSent` history — the
-     * funds never leave the wallet.
-     */
-    sendSelectedVtxosToSelf(inputs: ExtendedVirtualCoin[], now?: TimeHeight): Promise<string>;
-    /**
-     * Build an offchain transaction from the given inputs and outputs,
-     * sign it, submit to the Arkade provider, and finalize.
-     *
-     * Signs whatever it is handed, ungated — see {@link settle} for the trade.
-     *
-     * @returns The Arkade transaction id and server-signed checkpoint PSBTs (for bookkeeping)
-     */
-    buildAndSubmitOffchainTx(inputs: ExtendedVirtualCoin[], outputs: TransactionOutput[], serverUnrollScript?: CSVMultisigTapscript.Type): Promise<{
-        arkTxid: string;
-        signedCheckpointTxs: string[];
-    }>;
-    private updateDbAfterOffchainTx;
-    private updateDbAfterSettle;
-}
-/**
- * Select virtual outputs to reach a target amount, prioritizing those closer to expiry
- * @param coins List of virtual outputs to select from
- * @param targetAmount Target amount to reach in satoshis
- * @returns Selected virtual outputs and change amount
- */
-declare function selectVirtualCoins(coins: ExtendedVirtualCoin[], targetAmount: number): {
-    inputs: ExtendedVirtualCoin[];
-    changeAmount: bigint;
-};
-/**
- * Raised when a wait is cancelled through its `AbortSignal` or `timeoutMs`.
- *
- * `name` is `"AbortError"`, matching both the platform convention and the
- * `error.name === "AbortError"` checks the provider layer already makes, so a
- * caller can treat DOM and SDK aborts identically.
- */
-declare class AbortError extends Error {
-    constructor(message?: string);
-}
-/** Options for {@link waitForIncomingFunds}. */
-interface WaitForIncomingFundsOptions {
-    /**
-     * Cancels the wait. On abort the underlying subscription is stopped and
-     * the returned promise rejects — with the signal's `reason` when the
-     * caller supplied an `Error`, otherwise an {@link AbortError}.
-     */
-    signal?: AbortSignal;
-    /**
-     * Cancels the wait after this many milliseconds, rejecting with an
-     * {@link AbortError}. Equivalent to passing an `AbortSignal.timeout`
-     * signal, without requiring that API on the target platform.
-     */
-    timeoutMs?: number;
-}
-/**
- * Wait for incoming funds to the wallet.
- *
- * This opens live network watchers (an onchain address subscription plus the
- * wallet's indexer stream) and keeps them open until it settles. **Cancel it
- * if you are not going to await it to completion** — pass a `signal` or a
- * `timeoutMs`. Racing an uncancelled call against a timer (`Promise.race`)
- * abandons the loser without stopping its watchers, and repeating that in a
- * loop stacks subscriptions until the process exits.
- *
- * @param wallet - The wallet to wait for incoming funds
- * @param options - Cancellation options; see {@link WaitForIncomingFundsOptions}
- * @returns A promise that resolves the next new coins received by the wallet's address
- * @throws {AbortError} If cancelled via `signal` or `timeoutMs`
- * @example
- * ```typescript
- * // Wake early on a deposit, but give up after 30s and release the watchers.
- * try {
- *   const funds = await waitForIncomingFunds(wallet, { timeoutMs: 30_000 })
- * } catch (e) {
- *   if ((e as Error).name !== "AbortError") throw e
- * }
- * ```
- */
-declare function waitForIncomingFunds(wallet: Wallet, options?: WaitForIncomingFundsOptions): Promise<IncomingFunds>;
-
-/**
- * Capability a wallet exposes so descriptor-blind consumers — Boltz swaps and
- * other plugins — can bind the artifacts they create to the wallet's current
- * HD index and later enumerate every index that has been used.
- *
- * Probed structurally ({@link isHDWalletCapable}) rather than widening
- * `IWallet`: plugins must keep working against wallets that predate it, and a
- * static wallet answers "no HD state" through the same three methods.
- */
-interface HDWalletCapable {
-    /**
-     * The descriptor at the wallet's current receive index, or `undefined` for
-     * static / `auto` wallets and HD wallets that have never rotated. Callers
-     * fall back to the identity key.
-     */
-    getCurrentSigningDescriptor(): Promise<string | undefined>;
-    /**
-     * Every descriptor the wallet may hold keys under, ascending by index:
-     * the allocation watermark's band plus any descriptor persisted on a
-     * contract. Empty for static wallets.
-     *
-     * `lookAhead` appends that many descriptors past the watermark without
-     * advancing it, for a restore that must probe indices no local state
-     * mentions yet.
-     */
-    getUsedSigningDescriptors(opts?: {
-        lookAhead?: number;
-    }): Promise<string[]>;
-    /**
-     * An {@link Identity} whose keys and signatures are those of `descriptor`.
-     * Returns the wallet identity itself when `descriptor` is the identity's
-     * own key (a static wallet's descriptor, or an HD wallet's baseline key).
-     *
-     * Throws {@link ForeignDescriptorError} for a descriptor this wallet
-     * cannot sign for. Never silently substitutes another key: an identity
-     * handed out for a foreign descriptor signs happily with the wrong key,
-     * and that surfaces only as a rejected transaction or a dead script —
-     * far from the call that caused it.
-     *
-     * The returned identity must actually sign — `sign`, `signMessage` and
-     * `signerSession`, not just `xOnlyPublicKey`. A watch-only identity
-     * carrying the right key is not a signer, and `contractSigner` refuses it
-     * as `WalletCannotSignError`: returning one here would otherwise pass
-     * every check and throw at push time, after the contract is funded.
-     */
-    signerForDescriptor(descriptor: string): Promise<Identity>;
-}
-/**
- * Thrown by {@link HDWalletCapable.signerForDescriptor} when the wallet holds
- * no key for the requested descriptor — it belongs to another seed, or to an
- * identity this wallet does not carry. A typed refusal so callers can tell
- * "not my key" from transient signing failures.
- */
-declare class ForeignDescriptorError extends Error {
-    readonly descriptor: string;
-    readonly name = "ForeignDescriptorError";
-    constructor(descriptor: string, options?: {
-        cause?: unknown;
-    });
-}
-/**
- * Thrown by `Wallet.getNewAddresses({ forceNew: true })` when the wallet has
- * no HD stream to advance — `walletMode: 'static'` / `'auto'`, or a
- * {@link DescriptorProvider} that declined to allocate.
- *
- * A typed refusal rather than a silent repeat: a caller that asked for a
- * *fresh* address is issuing one per counterparty, and quietly returning the
- * address it already handed out surfaces only as two payers sharing a script.
- */
-declare class WalletCannotAllocateAddressError extends Error {
-    readonly name = "WalletCannotAllocateAddressError";
-    constructor(reason: string, options?: {
-        cause?: unknown;
-    });
-}
-/** Anything that can derive and sign for a descriptor it claims. */
-type DescriptorOwner = Pick<DescriptorProvider, "isOurs" | "signWithDescriptor" | "signMessageWithDescriptor">;
-/**
- * The identity that signs `descriptor`, or {@link ForeignDescriptorError}.
- *
- * Shared by every {@link HDWalletCapable.signerForDescriptor} implementation
- * so they cannot drift: the page-side and worker-side wallets answering
- * differently for one descriptor is a signer that passes a public-key check
- * and then throws on every signature — after the artifact is funded.
- */
-declare function resolveDescriptorSigner(descriptor: string, identity: Identity, provider?: DescriptorOwner): Promise<Identity>;
-/** Structural type guard for {@link HDWalletCapable}. */
-declare function isHDWalletCapable(value: unknown): value is HDWalletCapable;
-/**
- * Allocating a *fresh* index, which is strictly more than
- * {@link HDWalletCapable}'s descriptor awareness.
- *
- * Deliberately a separate probe rather than three more methods on
- * `HDWalletCapable`: widening that guard would silently demote every wallet
- * implementing only its original surface — including one built by an older
- * SDK — from HD-capable to static, which is exactly the breakage it documents
- * itself as avoiding. Consumers that only read descriptors keep the narrow
- * probe; anything deriving per-artifact secrets asks for this one.
- */
-interface HDAllocationCapable {
-    /**
-     * The signing descriptor a new artifact (a swap, an invoice, a contract)
-     * should bind to. **The wallet decides what that means**: an HD wallet
-     * allocates a fresh index, advancing the watermark; a static wallet
-     * answers with its one `tr(pubkey)` descriptor every time. Consumers must
-     * not probe the wallet's shape or mint key material of their own — they
-     * ask, and use what comes back with
-     * {@link HDWalletCapable.signerForDescriptor}.
-     *
-     * `undefined` only for implementations that genuinely cannot answer;
-     * `Wallet` always answers. Callers that must work against such wallets
-     * fall back to the identity key — never to a random one.
-     *
-     * Distinct from {@link HDWalletCapable.getCurrentSigningDescriptor}, which
-     * peeks: on an HD wallet, two artifacts bound to a peek share a key.
-     * Whether the returned descriptor is unique per call is a property of the
-     * wallet, not of this method — anything deriving per-artifact secrets
-     * from the descriptor must check the descriptor's shape, not the wallet's.
-     */
-    getNextSigningDescriptor(): Promise<string | undefined>;
-    /**
-     * Move the allocation watermark to `descriptor`'s index so later
-     * allocations cannot reissue it. Monotonic — a lower index is a no-op.
-     * On a static wallet there is no watermark: the wallet's own descriptor
-     * is accepted as a no-op.
-     *
-     * Throws on a descriptor this wallet cannot derive, or an HD descriptor
-     * with no parseable trailing child index: silently mapping those to index
-     * 0 would move the watermark nowhere and let a restored artifact's index
-     * be handed out again.
-     */
-    advanceSigningDescriptorWatermark(descriptor: string): Promise<void>;
-}
-/** Structural type guard for {@link HDAllocationCapable}. */
-declare function isHDAllocationCapable(value: unknown): value is HDAllocationCapable;
-/**
- * Minting addresses to hand out, which is strictly more than
- * {@link HDAllocationCapable}'s bare index allocation: the wallet also builds
- * the scripts at that index, persists them as watched contracts, and reports
- * the rows.
- *
- * A third probe rather than another method on `HDAllocationCapable`, for the
- * same reason that interface exists separately from {@link HDWalletCapable}:
- * widening an existing guard silently demotes every wallet implementing only
- * its older surface.
- */
-interface AddressAllocationCapable {
-    /**
-     * Fresh addresses of each requested type, all derived from one newly
-     * allocated HD index, persisted and watched. **The wallet decides what
-     * "fresh" means**: an HD wallet burns an index, a wallet with no stream
-     * answers with its existing display addresses — or, under
-     * `forceNew`, refuses with {@link WalletCannotAllocateAddressError}
-     * rather than repeat an address it already handed out.
-     *
-     * Distinct from {@link HDAllocationCapable.getNextSigningDescriptor},
-     * which yields only an index and leaves the caller to build and register
-     * the script — two steps that must not be split across a process
-     * boundary, since a page that allocated an index and then failed to
-     * register the script holds a burnt index and an unwatched address.
-     */
-    getNewAddresses(opts?: GetNewAddressesOptions): Promise<NewAddress[]>;
-}
-/** Structural type guard for {@link AddressAllocationCapable}. */
-declare function isAddressAllocationCapable(value: unknown): value is AddressAllocationCapable;
-
-export { type AddressAllocationCapable as A, type BatchExpiryPolicy as B, type CheckpointExitDelayPolicy as C, DEFAULT_MIN_BATCH_EXPIRY_SECONDS as D, defaultCheckpointExitDelayPolicy as E, ForeignDescriptorError as F, isAddressAllocationCapable as G, type HDWalletCapable as H, type IncomingFunds as I, isArkError as J, isHDAllocationCapable as K, isHDWalletCapable as L, MAX_USED_SIGNING_DESCRIPTORS_LOOK_AHEAD as M, maybeArkError as N, resolveBatchExpiryPolicy as O, type ProviderConnectionState as P, resolveCheckpointExitDelayPolicy as Q, ReadonlyWallet as R, SIGNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as S, resolveDescriptorSigner as T, selectVirtualCoins as U, signingDescriptorIndex as V, Wallet as W, strictSigningDescriptorIndex as X, waitForIncomingFunds as Y, type HDAllocationCapable as a, type ReceiveRotatorFactory as b, type ReceiveRotatorBootOpts as c, type ReceiveRotatorBoot as d, Batch as e, AbortError as f, ArkError as g, ArkErrorName as h, type ArkadeCashClaimResult as i, ArkadeCashCreateError as j, type ArkadeCashUnclaimedReason as k, type ArkadeCashUnclaimedVtxo as l, type BoardingUtxoGroup as m, DEFAULT_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as n, MUTINYNET_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as o, type ProviderKind as p, ProviderUnavailableError as q, REGTEST_MIN_BATCH_EXPIRY_SECONDS as r, REGTEST_MIN_CHECKPOINT_EXIT_DELAY_SECONDS as s, type ServerInfoSource as t, ServerResponseMismatchError as u, type WaitForIncomingFundsOptions as v, WalletCannotAllocateAddressError as w, assertValidBatchExpiry as x, assertValidServerUnrollScript as y, defaultBatchExpiryPolicy as z };