@arkade-os/sdk 0.5.0-rc.2 → 0.5.0-rc.21

package/dist/index-Bem5vKzX.d.ts

@@ -1,850 +0,0 @@
-import { bn as ContractHandler, w as RelativeTimelock, bz as Discoverable, V as VtxoScript, x as TapLeafScript, df as TapscriptDeriving } from './index-DUxufw76.js';
-import { D as DefaultVtxo, a as DelegateVtxo } from './delegate-BAX5QftB.js';
-import { Bytes } from '@scure/btc-signer/utils.js';
-
-/**
- * Registry for contract handlers.
- *
- * Each contract type ("default", "vhtlc", etc.) has a handler that knows
- * how to create VtxoScripts, serialize params, and select spending paths.
- *
- * @example
- * ```typescript
- * // Register a custom handler
- * contractHandlers.register(myCustomHandler);
- *
- * // Get handler for a type
- * const handler = contractHandlers.get("vhtlc");
- * const script = handler.createScript(contract.params);
- * ```
- */
-declare class ContractHandlerRegistry {
-    private handlers;
-    /**
-     * Register a contract handler.
-     *
-     * @param handler - The handler to register
-     * @throws If a handler for this type is already registered
-     */
-    register(handler: ContractHandler<unknown>): void;
-    /**
-     * Get a handler by type.
-     *
-     * @param type - The contract type
-     * @returns The handler, or undefined if not found
-     */
-    get(type: string): ContractHandler<unknown> | undefined;
-    /**
-     * Get a handler by type, throwing if not found.
-     *
-     * @param type - The contract type
-     * @returns The handler
-     * @throws If no handler is registered for this type
-     */
-    getOrThrow(type: string): ContractHandler<unknown>;
-    /**
-     * Check if a handler is registered.
-     *
-     * @param type - The contract type
-     */
-    has(type: string): boolean;
-    /**
-     * Get all registered types.
-     */
-    getRegisteredTypes(): string[];
-    /**
-     * Unregister a handler (mainly for testing).
-     */
-    unregister(type: string): boolean;
-    /**
-     * Clear all handlers (mainly for testing).
-     */
-    clear(): void;
-}
-/**
- * Global registry of contract handlers.
- */
-declare const contractHandlers: ContractHandlerRegistry;
-
-/**
- * Typed parameters for DefaultVtxo contracts.
- */
-interface DefaultContractParams {
-    pubKey: Uint8Array;
-    serverPubKey: Uint8Array;
-    csvTimelock: RelativeTimelock;
-}
-/**
- * Handler for default wallet VTXOs.
- *
- * Default contracts use the standard forfeit + exit tapscript:
- * - forfeit: (Alice + Server) multisig for collaborative spending
- * - exit: (Alice) + CSV timelock for unilateral exit
- */
-declare const DefaultContractHandler: ContractHandler<DefaultContractParams, DefaultVtxo.Script> & Discoverable;
-
-/**
- * Typed parameters for DelegateVtxo contracts.
- */
-interface DelegateContractParams {
-    pubKey: Uint8Array;
-    serverPubKey: Uint8Array;
-    delegatePubKey: Uint8Array;
-    csvTimelock: RelativeTimelock;
-}
-/**
- * Handler for delegate wallet virtual outputs.
- *
- * Delegate contracts extend the default tapscript with an additional delegate path:
- * - forfeit: (Alice + Server) multisig for collaborative spending
- * - exit: (Alice) + CSV timelock for unilateral exit
- * - delegate: (Alice + Delegate + Server) multisig for delegated renewal
- */
-declare const DelegateContractHandler: ContractHandler<DelegateContractParams, DelegateVtxo.Script> & Discoverable;
-
-/** Virtual Hash Time Lock Contract (VHTLC) namespace. */
-declare namespace VHTLC {
-    export interface Options {
-        sender: Bytes;
-        receiver: Bytes;
-        server: Bytes;
-        preimageHash: Bytes;
-        refundLocktime: bigint;
-        unilateralClaimDelay: RelativeTimelock;
-        unilateralRefundDelay: RelativeTimelock;
-        unilateralRefundWithoutReceiverDelay: RelativeTimelock;
-        /**
-         * The emulator covenant leaves, ALL OR NOTHING. Present, this adds the
-         * three non-interactive leaves the emulator co-signs under a covenant
-         * pinning the payout to a pre-committed destination:
-         *
-         *  - `nonInteractiveClaim`: `server` + a covenant-tweaked emulator
-         *    co-signer, paying `receiverPkScript` — the receiver's claim can
-         *    be pushed without the receiver being online.
-         *  - `nonInteractiveRefund`: `server` + `receiver` + a covenant-tweaked
-         *    emulator co-signer, paying `senderPkScript`, no timelock — lets
-         *    server and receiver release the refund the moment they agree the
-         *    swap has failed, and recoverable even if the sender's own key is
-         *    lost, since no OTHER refund-side leaf survives that.
-         *  - `nonInteractiveRefundWithoutReceiver`: `server` + the SAME
-         *    covenant-tweaked co-signer as `nonInteractiveRefund`, paying
-         *    `senderPkScript` after `refundLocktime` — the only refund tier
-         *    needing no participant signature at all, so a sender who funded
-         *    a lockup and vanished is refundable through it alone.
-         *
-         * WHY ONE FLAG AND NOT A SWITCH PER LEAF. The three are one mechanism
-         * — the same emulator key, the same `enforcePayTo` covenant pointed
-         * at a per-role destination — and they protect opposite directions of
-         * the same swap, so no real configuration wants a subset. A subset
-         * would cost, not buy: every optional leaf multiplies the tree shapes
-         * a counterparty must derive to verify an address (nothing on the
-         * wire says which leaves a quote carries), so per-leaf toggling turns
-         * one address comparison into a combinatorial guess. All-or-nothing
-         * keeps the shape count at two: suite, or no suite.
-         *
-         * Leaf order fixes the taproot merkle root, so the suite is appended
-         * after the six signature leaves in a fixed order (claim, refund,
-         * timelocked refund) and a script built with this option NEVER
-         * collides with one built without it — which is what makes "did this
-         * quote opt in" a question an address comparison answers.
-         *
-         * STABLE PER RELEASE: what this option builds does not change within
-         * a published SDK version. A future covenant leaf joins the suite
-         * only behind a NEW option, so re-deriving a lockup with the SDK
-         * that quoted it reproduces its address byte-for-byte.
-         */
-        nonInteractiveParameters?: {
-            /**
-             * The emulator service's public key, 32-byte x-only or 33-byte
-             * compressed. ONE key, tweaked per covenant destination, becomes
-             * the co-signer of every leaf in the suite — the leaves share it
-             * structurally, and BIP-341 tapscript sighashes committing to the
-             * tapleaf hash are what keep a signature for one leaf from
-             * replaying against another.
-             */
-            emulatorPubkey: Bytes;
-            /**
-             * Where the claim covenant pays: the receiver's own P2TR
-             * pkScript, 34 bytes.
-             */
-            receiverPkScript: Bytes;
-            /**
-             * Where BOTH refund covenants pay: the sender's own P2TR
-             * pkScript, 34 bytes. One destination shared by both refund
-             * leaves, so they cannot diverge on where a refund goes.
-             */
-            senderPkScript: Bytes;
-            /**
-             * LEGACY REBUILD ONLY — never for a new lockup.
-             *
-             * `"preTimelockedRefund"` builds the suite WITHOUT its timelocked
-             * refund leaf: the shape every emulator-covenant lockup funded
-             * before that leaf shipped carries. Lockups already funded in that
-             * shape keep it permanently — a leaf cannot be retrofitted onto an
-             * address already committed — so re-deriving such a lockup (to
-             * spend it, or to verify an old quote's address) needs this. A new
-             * lockup that omits the leaf gives up the one refund tier needing
-             * nobody, for nothing.
-             */
-            legacy?: "preTimelockedRefund";
-        };
-        /**
-         * Optional: denominate this contract in an Arkade ASSET rather than in
-         * sats alone.
-         *
-         * Only the two NON-INTERACTIVE leaves change. Every other leaf is a
-         * signature path that asserts nothing about value, so an asset makes no
-         * difference to them — which is why this option reaches exactly the
-         * leaves whose covenant the emulator enforces.
-         *
-         * When set, those covenants additionally require the output to carry at
-         * least the input's amount of THIS asset, and to carry exactly one
-         * asset. The sat clause is RETAINED, not replaced: an asset-carrying
-         * VTXO carries sats too, so dropping it would let a spend satisfy the
-         * asset covenant while stripping the sats — exactly as the sat-only
-         * covenant lets a spend strip the asset.
-         *
-         * ONE ASSET IS BOUND, AND ONLY THAT ONE IS PROTECTED. If a VTXO funded to
-         * this contract carries ADDITIONAL assets alongside the bound one, those
-         * are not covered: whoever assembles a covenant spend chooses where they
-         * go, and can send them anywhere.
-         *
-         * `INSPECTOUTASSETCOUNT == 1` does not close that. It constrains the
-         * covenant's OUTPUT to exactly one asset — so the extras cannot ride
-         * along with the bound asset — but arkd's conservation rule is satisfied
-         * by routing them to a different output, which the covenant says nothing
-         * about. The bound asset arrives; the rest is the spender's to direct.
-         *
-         * So fund an asset contract with the asset it names and nothing else. A
-         * multi-asset VTXO behind this covenant is a loss waiting for whoever
-         * pushes the spend.
-         *
-         * The id is the pair the introspection opcodes take. A canonical Asset
-         * ID is `(genesis txid, group index)`, never a single blob.
-         */
-        asset?: {
-            /**
-             * The asset's genesis transaction id, 32 bytes, in CANONICAL order
-             * — exactly the leading 32 bytes of a serialized Asset ID, no flip.
-             *
-             * The covenant reverses it internally because the introspection
-             * opcodes match wire order; callers never do that themselves, and a
-             * caller who pre-reverses gets a contract that is unspendable on its
-             * covenant leaves with nothing in the error naming why.
-             */
-            txid: Bytes;
-            /** The asset group index within that genesis transaction. */
-            groupIndex: number;
-        };
-    }
-    /**
-     * Shared construction and accessors for every VHTLC script version. The
-     * only thing that varies between versions is which preimage-condition
-     * fragment `claim`/`unilateralClaim`/`nonInteractiveClaim` are built
-     * from — everything else (the multisig/timelock leaves, the
-     * non-interactive covenant leaves, the accessor methods) is identical,
-     * so versions are expressed as thin subclasses over one builder rather
-     * than as separate, independently-maintained copies of this class.
-     */
-    abstract class BaseScript extends VtxoScript {
-        readonly options: Options;
-        readonly claimScript: string;
-        readonly refundScript: string;
-        readonly refundWithoutReceiverScript: string;
-        readonly unilateralClaimScript: string;
-        readonly unilateralRefundScript: string;
-        readonly unilateralRefundWithoutReceiverScript: string;
-        readonly nonInteractiveClaimScript?: string;
-        readonly nonInteractiveClaimArkadeScript?: Bytes;
-        readonly nonInteractiveRefundScript?: string;
-        readonly nonInteractiveRefundArkadeScript?: Bytes;
-        readonly nonInteractiveRefundWithoutReceiverScript?: string;
-        readonly nonInteractiveRefundWithoutReceiverArkadeScript?: Bytes;
-        protected constructor(options: Options, preimageCondition: (hash: Bytes) => Bytes);
-        /** Return the collaborative claim tapleaf script. */
-        claim(): TapLeafScript;
-        /** Return the collaborative refund tapleaf script. */
-        refund(): TapLeafScript;
-        /** Return the refund-without-receiver tapleaf script. */
-        refundWithoutReceiver(): TapLeafScript;
-        /** Return the unilateral claim tapleaf script. */
-        unilateralClaim(): TapLeafScript;
-        /** Return the unilateral refund tapleaf script. */
-        unilateralRefund(): TapLeafScript;
-        /** Return the unilateral refund-without-receiver tapleaf script. */
-        unilateralRefundWithoutReceiver(): TapLeafScript;
-        /** Return the non-interactive claim tapleaf script as well as the ArkadeScript. */
-        nonInteractiveClaim(): [TapLeafScript, Bytes];
-        /** Return the non-interactive refund tapleaf script as well as the ArkadeScript. */
-        nonInteractiveRefund(): [TapLeafScript, Bytes];
-        /**
-         * Return the timelocked non-interactive refund tapleaf and its ArkadeScript.
-         *
-         * SPENDING THIS LEAF, CONCRETELY — confirmed from this SDK's own
-         * emulator client and covenant-spend builder ({@link
-         * EmulatorProvider} in `src/providers/emulator.ts`, and {@link
-         * ArkadeTransactionBuilder} in `src/arkade/contract.ts`), which is
-         * the general machinery every covenant leaf in this file goes
-         * through:
-         *
-         *  1. Build the ark tx spending this leaf (this method's {@link
-         *     TapLeafScript} as `tapLeafScript`, this script's {@link
-         *     VtxoScript.encode} as `tapTree`), plus its checkpoint tx.
-         *  2. Attach the ArkadeScript this method returns to the spent
-         *     input via an `EmulatorPacket` (type 1) — `{ vin, script:
-         *     <this ArkadeScript>, witness: <empty> }`, empty because the
-         *     script pushes its own input/output index with
-         *     `PUSHCURRENTINPUTINDEX` rather than reading one from the
-         *     witness — wrapped in an `Extension` OP_RETURN output on the
-         *     ark tx.
-         *  3. Attach the spent input's OWN creating ark tx as `PrevArkTx` on
-         *     input 0 — required so the emulator can resolve that input's
-         *     prevout pkScript/value; it does not otherwise have them.
-         *  4. POST the (base64-PSBT) ark tx and checkpoint(s) as `{ arkTx,
-         *     checkpointTxs }` to the emulator's `POST /v1/tx`.
-         *
-         * THE COVENANT CHECK the emulator runs against that ArkadeScript —
-         * `enforcePayTo(senderPkScript)`, see that function above — is: the
-         * output at this SAME input's index is a v1 P2TR output paying
-         * `senderPkScript`, with a value at least the input's. Only on that
-         * check passing does the emulator sign for `nirCosigner` (the
-         * `emulatorPubkey` tweaked by this ArkadeScript's hash); the
-         * response carries the fully co-signed `signedArkTx` and
-         * `signedCheckpointTxs` — `ArkadeTransactionBuilder.send()`'s own
-         * comment on this path: "the emulator executes the arkade script
-         * and finalizes with arkd" — no separate call to arkd is made by
-         * this SDK for a covenant spend.
-         * Neither `server` nor `receiver` play any part in that check: this
-         * leaf's tapscript still requires `server`'s own signature
-         * alongside `nirCosigner`'s (see the class doc above), but that is
-         * consensus-level multisig, not something the covenant enforces.
-         *
-         * NOT SPENDABLE UNTIL `refundLocktime` MATURES — the tapscript's
-         * `OP_CHECKLOCKTIMEVERIFY` is arkd's concern, not the emulator's;
-         * the emulator will happily co-sign an immature spend and arkd will
-         * then refuse it. A block-height-typed `refundLocktime` (below the
-         * standard height/timestamp boundary this SDK names
-         * `CLTV_HEIGHT_THRESHOLD`, 500,000,000, in
-         * `src/contracts/handlers/helpers.ts`) is refused by arkd for a
-         * forfeit-eligible leaf independent of maturity — use a
-         * seconds-typed (absolute Unix timestamp) value.
-         */
-        nonInteractiveRefundWithoutReceiver(): [TapLeafScript, Bytes];
-    }
-    /**
-     * Virtual Hash Time Lock Contract (VHTLC) script implementation.
-     *
-     * VHTLC enables atomic swaps and conditional payments in the Arkade protocol.
-     * It provides multiple spending paths:
-     *
-     * - **claim**: Receiver can claim funds by revealing the preimage
-     * - **refund**: Sender and receiver can collaboratively refund
-     * - **refundWithoutReceiver**: Sender can refund after locktime expires
-     * - **unilateralClaim**: Receiver can claim unilaterally after delay
-     * - **unilateralRefund**: Sender and receiver can refund unilaterally after delay
-     * - **unilateralRefundWithoutReceiver**: Sender can refund unilaterally after delay
-     * - **nonInteractiveClaim** (with `nonInteractiveParameters`): server + emulator
-     *   can push the receiver's claim, pinned to a pre-committed destination
-     * - **nonInteractiveRefund** (with `nonInteractiveParameters`): server + receiver
-     *   + emulator can push the sender's refund immediately, no timelock,
-     *   pinned to a pre-committed destination — recoverable even if the
-     *   sender's own key is lost
-     * - **nonInteractiveRefundWithoutReceiver** (with `nonInteractiveParameters`):
-     *   server + emulator can push the sender's refund after `refundLocktime`,
-     *   pinned to a pre-committed destination — the only refund tier needing
-     *   no participant signature at all
-     *
-     * See {@link ScriptV2} for the current recommended construction — same
-     * leaf ladder, same options shape, an added length check on the claim
-     * preimage. This class is unchanged and stays available as-is.
-     *
-     * **Pre-existing limitation: the `vhtlc` contract handler registers none
-     * of the covenant leaves.** `nonInteractiveParameters` builds on this class
-     * exactly as it does on {@link ScriptV2} — both extend the same
-     * `BaseScript` where those leaves are constructed. But the `vhtlc`
-     * contract handler (`src/contracts/handlers/vhtlc.ts`) round-trips none
-     * of them: its params type carries no covenant fields, and
-     * `createScript` only ever builds the six signature-only leaves. A V1
-     * script built with the covenant suite therefore compiles and can
-     * be funded, but cannot be registered as a `vhtlc` contract — the
-     * handler would derive a different (six-leaf) script for the same
-     * params and `ContractManager` refuses the mismatch. Register through
-     * the `vhtlc-v2` handler instead, which round-trips the suite.
-     *
-     * @example
-     * ```typescript
-     * const vhtlc = new VHTLC.Script({
-     *   sender: alicePubKey,
-     *   receiver: bobPubKey,
-     *   server: serverPubKey,
-     *   preimageHash: hash160(secret),
-     *   refundLocktime: BigInt(chainTip + 10),
-     *   unilateralClaimDelay: { type: 'blocks', value: 100n },
-     *   unilateralRefundDelay: { type: 'blocks', value: 102n },
-     *   unilateralRefundWithoutReceiverDelay: { type: 'blocks', value: 103n }
-     * });
-     * ```
-     */
-    export class Script extends BaseScript {
-        constructor(options: Options);
-    }
-    /**
-     * Same leaf ladder as {@link Script}, built with {@link
-     * preimageConditionScriptV2} instead of {@link preimageConditionScript}
-     * for every leaf that gates on the preimage (`claim`, `unilateralClaim`,
-     * and, when present, `nonInteractiveClaim`) — see that function's doc
-     * comment for what differs and why. A distinct class rather than a flag
-     * on {@link Script}: the two produce different script bytes (and so
-     * different addresses) for the same participant keys, and keeping them
-     * as separate types makes that a compile-time-visible choice at every
-     * call site instead of a runtime option that's easy to get wrong.
-     */
-    export class ScriptV2 extends BaseScript {
-        constructor(options: Options);
-    }
-    export {  };
-}
-
-/**
- * Typed parameters for VHTLC contracts.
- */
-interface VHTLCContractParams {
-    sender: Uint8Array;
-    receiver: Uint8Array;
-    server: Uint8Array;
-    preimageHash: Uint8Array;
-    refundLocktime: bigint;
-    unilateralClaimDelay: RelativeTimelock;
-    unilateralRefundDelay: RelativeTimelock;
-    unilateralRefundWithoutReceiverDelay: RelativeTimelock;
-}
-/**
- * Handler for Virtual Hash Time Lock Contract (VHTLC).
- *
- * VHTLC supports multiple spending paths:
- *
- * Collaborative paths (with server):
- * - claim: Receiver + Server with preimage
- * - refund: Sender + Receiver + Server
- * - refundWithoutReceiver: Sender + Server after CLTV locktime
- *
- * Unilateral paths (without server):
- * - unilateralClaim: Receiver with preimage after CSV delay
- * - unilateralRefund: Sender + Receiver after CSV delay
- * - unilateralRefundWithoutReceiver: Sender after CSV delay
- */
-declare const VHTLCContractHandler: ContractHandler<VHTLCContractParams, VHTLC.Script> & TapscriptDeriving<VHTLC.Script>;
-
-/**
- * Typed parameters for {@link VHTLC.ScriptV2} contracts.
- *
- * The eight mandatory fields are `VHTLCContractParams` verbatim — the two
- * script versions take the same {@link VHTLC.Options}, so a divergent shape
- * here would be a difference with no cause. What V1's handler has no field for
- * is the emulator covenant suite, and that is exactly what the swap corridor's
- * lockup carries, so leaving it out would make this handler unable to
- * round-trip the contract it exists to serve.
- */
-interface VHTLCV2ContractParams {
-    sender: Uint8Array;
-    receiver: Uint8Array;
-    server: Uint8Array;
-    preimageHash: Uint8Array;
-    refundLocktime: bigint;
-    unilateralClaimDelay: RelativeTimelock;
-    unilateralRefundDelay: RelativeTimelock;
-    unilateralRefundWithoutReceiverDelay: RelativeTimelock;
-    /**
-     * The Arkade asset the covenant leaves bind, if any.
-     *
-     * @see VHTLC.Options.asset
-     */
-    asset?: {
-        /** The asset's genesis txid, 32 bytes, canonical order — as the serialized Asset ID carries it. */
-        txid: Uint8Array;
-        /** The asset group index within that genesis transaction. */
-        groupIndex: number;
-    };
-    /**
-     * The emulator covenant suite, all or nothing — mirrors {@link
-     * VHTLC.Options.nonInteractiveParameters} exactly, including the legacy selector:
-     * a row funded before the timelocked refund leaf shipped round-trips with
-     * `legacy: "preTimelockedRefund"` and re-derives its eight-leaf shape.
-     */
-    nonInteractiveParameters?: {
-        receiverPkScript: Uint8Array;
-        emulatorPubkey: Uint8Array;
-        senderPkScript: Uint8Array;
-        /** @see VHTLC.Options.nonInteractiveParameters.legacy */
-        legacy?: "preTimelockedRefund";
-    };
-}
-/**
- * Handler for {@link VHTLC.ScriptV2} — the VHTLC whose preimage leaves carry an
- * explicit `OP_SIZE 32 OP_EQUALVERIFY` before the hash check, and which the RFQ
- * swap corridor builds (`@arkade-os/swap`'s `lightningSendContract`).
- *
- * **Why a separate type string rather than a flag on `vhtlc`.** A handler's
- * `type` names the script class it derives, the way every other registered type
- * does (`default` → `DefaultVtxo.Script`, `vhtlc` → `VHTLC.Script`, `boarding`,
- * `arkade`). V1 and V2 produce different script bytes — and so different
- * pkScripts — for identical participant keys, and `upsertContractRow` derives
- * the script from `params` and refuses any row whose supplied `script` does not
- * match. One type cannot serve both. `vhtlc-v2` also cannot COLLIDE with
- * `vhtlc`: a colliding row needs one pkScript claimed by two types, and the two
- * versions' preimage conditions differ in every tree, so no parameters make
- * them equal. A use-named type (`swap-lockup`) was the alternative and is
- * worse: contracts are keyed by script, so the moment a second use registered
- * the same ScriptV2 the two uses would fight over one row.
- *
- * **Which leaves this offers, and why the set is smaller than the ladder.**
- * ScriptV2 has nine leaves; a wallet holding ONE of the two participant keys
- * can satisfy four of them, and offering a leaf whose signature the caller
- * cannot produce is worse than offering fewer — it turns a refusal into a
- * transaction that gets built and then rejected.
- *
- * | leaf                                  | needs                          | offered |
- * |---------------------------------------|--------------------------------|---------|
- * | `claim`                               | receiver + server, preimage    | yes, to the receiver |
- * | `refund`                              | sender + receiver + server     | no — needs the counterparty live |
- * | `refundWithoutReceiver`               | sender + server, CLTV          | yes, to the sender |
- * | `unilateralClaim`                     | receiver, CSV                  | yes, to the receiver |
- * | `unilateralRefund`                    | sender + receiver, CSV         | no — needs the counterparty live |
- * | `unilateralRefundWithoutReceiver`     | sender, CSV                    | yes, to the sender |
- * | `nonInteractiveClaim`                 | server + emulator              | no — the wallet holds neither key |
- * | `nonInteractiveRefund`                | server + receiver + emulator   | no — the wallet holds neither key |
- * | `nonInteractiveRefundWithoutReceiver` | server + emulator, CLTV        | no — the wallet holds neither key |
- *
- * The two omitted interactive leaves are the same two the `vhtlc` handler
- * omits, for the same reason: `refund` and `unilateralRefund` both need the
- * OTHER party's signature, and this protocol has no message that asks for one
- * (see `@arkade-os/swap`'s `refund.ts` module doc). The two covenant leaves are
- * pushed by the emulator on the counterparty's behalf and are not this wallet's
- * to build at all.
- *
- * So `refundWithoutReceiver` is the sender's only collaborative way out, gated
- * on the CLTV the quote committed to — which is exactly the leaf
- * `pushRefundWithoutReceiver` builds. The CSV leaves are offered only in the
- * non-collaborative context, where the caller has already accepted that
- * spending them means a real unilateral exit first.
- *
- * The selection discipline is deliberately identical to the `vhtlc` handler's,
- * and `test/contracts/vhtlcV2-handler.test.ts` pins the two against each other
- * rung-for-rung across every role and timelock context so they cannot drift.
- */
-declare const VHTLCV2ContractHandler: ContractHandler<VHTLCV2ContractParams, VHTLC.ScriptV2> & TapscriptDeriving<VHTLC.ScriptV2>;
-
-/**
- * Typed parameters for boarding contracts.
- *
- * Boarding reuses the exact `default` contract parameter shape
- * (`pubKey` / `serverPubKey` / `csvTimelock`) rather than inventing
- * boarding-specific names — the boarding semantics come from the
- * contract type and from populating `csvTimelock` with the server's
- * boarding-exit delay (`ArkadeInfo.boardingExitDelay`) instead of the
- * offchain unilateral-exit delay.
- */
-type BoardingContractParams = DefaultContractParams;
-/**
- * Handler for the boarding contract (registered type `boarding`).
- *
- * The boarding contract derives the on-chain Bitcoin address used to
- * board funds onto Arkade. It shares the exact `DefaultVtxo.Script`
- * shape with the `default` contract — a Taproot output co-owned by the
- * wallet and the Ark server, with a CSV exit path back to the wallet —
- * and therefore reuses the `default` handler's path logic (forfeit via
- * server cooperation, exit after the boarding CSV).
- *
- * Boarding semantics come entirely from the contract type and from
- * sourcing the CSV timelock from the server's boarding-exit delay
- * (`ArkadeInfo.boardingExitDelay`), not from renamed parameters. The
- * offchain `default` contract is built from `ArkadeInfo.unilateralExitDelay`
- * instead, so the two share a script shape but differ in their CSV
- * timelock value. Parameters round-trip through the same
- * `timelockToSequence` / `sequenceToTimelock` helpers and BIP68 sequence
- * encoding as `default` / `delegate`.
- *
- * Like `default` / `delegate`, the boarding handler implements
- * {@link Discoverable.discoverAt} so `wallet.restore()` can rediscover
- * used boarding indices from authoritative on-chain data. It differs from
- * the L2 handlers in its source of truth: boarding probes the **on-chain**
- * UTXO set at its P2TR address (`OnchainProvider.getCoins`) rather than the
- * Ark indexer, and builds its candidate from the boarding-exit CSV
- * (`deps.boardingTimelock`). When boarding discovery is not plumbed (no
- * `deps.boardingTimelock` / `deps.onchainNetwork`) `discoverAt` no-ops.
- *
- * Identity & the default/boarding collision: a contract's `script` (pkScript)
- * is its unique identity — a script owns exactly one repository row. `boarding`
- * is a first-class type with its own row **when its script is distinct** from
- * the wallet's `default` baseline — the real-world case, since a sound Ark
- * server keeps boardingExitDelay strictly longer than unilateralExitDelay (equal
- * delays would expose the provider to a double-spend). Should those delays ever
- * coincide (a misconfigured/malicious server), the boarding script is
- * byte-identical to the default script. `discoverAt` does NOT pre-coalesce that
- * collision: it always emits `type: "boarding"`, and the single shared row is
- * resolved FIRST-WINS at the persistence layer
- * ({@link ContractManager.upsertContract}) — whichever purpose is persisted
- * first keeps the row, and the scan deliberately probes boarding first
- * (see docs/hd-wallets_onchain_rotation_collision_fix.md §5.1–5.2). Either way
- * the funds are equally spendable through the shared `DefaultVtxo.Script` paths.
- * Consumers must NOT rely on `contract.type === "boarding"` to identify the
- * boarding purpose — resolve the boarding script via
- * `wallet.getBoardingAddress()` / `wallet.boardingTapscript` (which never depend
- * on the persisted contract's type) and match by script when needed.
- */
-declare const BoardingContractHandler: ContractHandler<BoardingContractParams, DefaultVtxo.Script> & Discoverable;
-
-/**
- * Arkade Program model & compiler.
- *
- * A {@link Program} is the artifact shape shared with the ArkadeScript
- * compiler: named functions, each split into a `tapscript` segment enforced
- * on-chain and an optional `arkadeScript` segment emulated by the co-signing
- * service. This module owns everything that is *pure data → script*:
- *
- * - the Program/segment/token types,
- * - `$param` resolution ({@link resolveAsm}), witness and timelock resolution,
- * - program validation ({@link validateProgram}) — typed constructor params
- *   are authoritative when present,
- * - {@link ArkadeProgramScript} — a {@link VtxoScript} compiled from a
- *   program, its constructor args and the signer keys,
- * - artifact JSON (de)serialization ({@link parseArtifact} /
- *   {@link stringifyArtifact}) and the string-keyed contract params used to
- *   persist a program contract through the `src/contracts` pipeline.
- *
- * Keeping this free of provider/transaction imports lets the generic
- * `arkade` contract handler (src/contracts/handlers/arkade.ts) and the
- * high-level `ArkadeContract` client share one compilation path.
- *
- * @module arkade/program
- */
-
-/** A token in an `asm` array: an opcode name, a number/bigint push, raw bytes, or a `$param` placeholder. */
-type AsmToken = string | number | bigint | Uint8Array;
-/** A constructor argument or resolved value. */
-type ArkadeParamValue = Uint8Array | bigint | number;
-/** A function call argument (function input). */
-type ArkadeArgValue = Uint8Array | bigint | number;
-/**
- * The declared type of a function input, used to derive the static TS type of
- * the corresponding `functions.<name>(...)` argument. Byte-like types map to
- * `Uint8Array`; `int` maps to `bigint | number`.
- */
-type ArkadeArgType = "bytes" | "pubkey" | "sig" | "hash" | "int";
-/**
- * Maps an {@link ArkadeArgType} to its TypeScript argument type.
- * @internal
- */
-interface ArkadeValueType {
-    bytes: Uint8Array;
-    pubkey: Uint8Array;
-    sig: Uint8Array;
-    hash: Uint8Array;
-    int: bigint | number;
-}
-/** A typed function input or constructor param: a name plus its {@link ArkadeArgType}. */
-interface InputDef {
-    name: string;
-    type: ArkadeArgType;
-}
-/**
- * A function input or constructor param declaration: either a typed descriptor
- * `{ name, type }` (the argument is statically typed and its bound value is
- * validated) or a bare name string (the argument falls back to the loose
- * {@link ArkadeArgValue}).
- */
-type InputRef = string | InputDef;
-/** Reference to a signer key: a `"$param"` reference or literal x-only bytes. */
-type SignerRef = string | Uint8Array;
-/** A witness-stack item: a function-input name, a `"$param"`, a literal number/bigint (minimal script-num), or raw bytes. */
-type WitnessRef = string | number | bigint | Uint8Array;
-/** Bitcoin Script segment of a spending path — enforced on-chain. */
-interface TapscriptSegment {
-    /** Required signers. The tweaked co-signer is appended automatically when the path has an `arkadeScript`. */
-    signers: SignerRef[];
-    /**
-     * Optional standard-opcode condition (e.g. a hashlock), encoded into a
-     * ConditionMultisig leaf — or ConditionCSVMultisig when combined with `csv`.
-     */
-    asm?: AsmToken[];
-    /**
-     * Relative timelock (CSV). The value is a literal or a `"$param"` reference
-     * resolved against the constructor args (same convention as {@link SignerRef}).
-     * Combinable with `asm` (condition + CSV); mutually exclusive with `cltv`.
-     */
-    csv?: {
-        type: "blocks" | "seconds";
-        value: bigint | string;
-    };
-    /**
-     * Absolute timelock (CLTV): a literal or a `"$param"` reference.
-     * Mutually exclusive with `csv`/`asm`.
-     */
-    cltv?: bigint | string;
-    /** Items satisfying the condition (e.g. an HTLC preimage); set via the ConditionWitness PSBT field. */
-    witness?: WitnessRef[];
-}
-/** Arkade Script segment of a spending path — emulated, bound via the key tweak. */
-interface ArkadeSegment {
-    /** Raw Arkade opcodes with `$param` placeholders. */
-    asm: AsmToken[];
-    /** The arkade-script witness stack (e.g. an output index). */
-    witness?: WitnessRef[];
-}
-/** One named spending path. */
-interface ArkadeFunction {
-    /**
-     * The function ABI: an ordered list of call arguments. Each entry is a typed
-     * descriptor `{ name, type }` (which gives the matching `functions.<name>`
-     * argument a precise static type) or a bare name string (loose
-     * {@link ArkadeArgValue}). Absent for nullary paths (e.g. exit/cancel).
-     */
-    inputs?: readonly InputRef[];
-    tapscript: TapscriptSegment;
-    /** Present for covenant paths; absent for pure-tapscript paths (cancel/exit). */
-    arkadeScript?: ArkadeSegment;
-}
-declare const SUPPORTED_PROGRAM_VERSION = 0;
-/** An Arkade contract program (hand-written or compiler-emitted). */
-interface Program {
-    version: number;
-    /**
-     * Optional program name — metadata only: round-tripped through the
-     * artifact JSON, never used in compilation or the taproot tree.
-     */
-    name?: string;
-    /**
-     * Ordered constructor parameters. Bare name strings are documentation only
-     * (the legacy hand-written form); typed descriptors `{ name, type }` make
-     * the list authoritative — see {@link validateProgram}.
-     */
-    params?: readonly InputRef[];
-    functions: Record<string, ArkadeFunction>;
-}
-/**
- * Resolve an `asm` array to bytes: substitute `$param` placeholders from `bind`,
- * pass everything else (opcode names, numbers, raw byte pushes) through to the
- * Arkade script encoder. The SDK does not interpret opcodes — this is pure
- * substitution + encoding. To embed a signer key (server, user, or any
- * other), pass it as a `$param` in the constructor args; there is no
- * `<SERVER_KEY>`/`<COSIGNER_KEY>` token.
- */
-declare function resolveAsm(asm: AsmToken[], bind: Record<string, ArkadeParamValue>): Uint8Array;
-/**
- * Resolve one witness-stack item to bytes.
- *
- * - raw bytes pass through;
- * - numbers/bigints encode as minimal script-nums;
- * - `"$param"` strings resolve against the program's constructor args;
- * - any other string is a function-input name and resolves against `callArgs`
- *   (throws when the input is unbound — e.g. outside a function call).
- */
-declare function witnessRefToBytes(ref: WitnessRef, callArgs: Record<string, ArkadeArgValue>, programArgs: Record<string, ArkadeParamValue>): Uint8Array;
-/**
- * Validate a program's constructor-parameter declarations against the bound
- * args. A `params` list of bare name strings is documentation only (the
- * legacy hand-written form — no checks). When at least one entry is a typed
- * descriptor (the compiler-emitted form), the list is authoritative: every
- * declared param must be bound in `args`, every `"$name"` reference in the
- * program must be declared, and typed entries validate their bound value
- * (bytes-like types require a Uint8Array — 32 bytes for `pubkey`, 64 for
- * `sig`; `int` requires a bigint/number).
- */
-declare function validateProgram(program: Program, args: Record<string, ArkadeParamValue>): void;
-/** The signer keys a program is compiled against. */
-interface ProgramKeys {
-    /** The Arkade Service signer key (x-only) — used for address derivation and collaborative-path detection, not for `$param` resolution. */
-    serverKey: Uint8Array;
-    /** The wallet's x-only key — identifies which inputs the wallet signs. */
-    userKey?: Uint8Array;
-    /** The co-signer (emulator) key — required only for covenant (`arkadeScript`) functions. */
-    emulatorKey?: Uint8Array;
-}
-/**
- * A single spending path, fully resolved at compilation: its definition, the
- * committed leaf body, the per-path arkade-script bytes (covenant paths only),
- * and the {@link TapLeafScript} (control block) for spending it.
- */
-interface CompiledProgramFunction {
-    name: string;
-    def: ArkadeFunction;
-    /** The committed leaf script (body). */
-    leafScript: Uint8Array;
-    /** Resolved arkade-script bytes; undefined for pure-tapscript paths. */
-    arkadeScript?: Uint8Array;
-    /** Resolved signer keys (x-only), in the declared `signers` order. */
-    signerKeys: Uint8Array[];
-    /** Resolved once — the taproot leaf + control block for this path. */
-    tapLeafScript: TapLeafScript;
-}
-/**
- * A {@link VtxoScript} compiled from an Arkade {@link Program}, its
- * constructor args and the signer keys.
- *
- * This is the single compilation path shared by the high-level
- * `ArkadeContract` client and the `"arkade"` contract handler: both produce
- * byte-identical taproot trees for the same (program, args, keys), so a
- * contract registered through the `src/contracts` pipeline re-derives the
- * exact script it was created with.
- */
-declare class ArkadeProgramScript extends VtxoScript {
-    readonly program: Program;
-    readonly args: Record<string, ArkadeParamValue>;
-    readonly keys: ProgramKeys;
-    /** Spending paths in declaration order. */
-    readonly compiled: CompiledProgramFunction[];
-    constructor(program: Program, args: Record<string, ArkadeParamValue>, keys: ProgramKeys);
-    /** The compiled spending path with the given function name, if any. */
-    functionByName(name: string): CompiledProgramFunction | undefined;
-}
-/**
- * Convert a compiler-style JSON artifact into a {@link Program}. Byte values are
- * encoded as `0x`-prefixed hex strings in `asm`/`witness`/`signers`; opcode names,
- * `$param` placeholders and numbers pass through unchanged.
- */
-declare function parseArtifact(artifact: {
-    version?: number;
-    name?: string;
-    params?: readonly InputRef[];
-    functions: Record<string, any>;
-}): Program;
-/**
- * Serialize a {@link Program} to compiler-artifact JSON — the inverse of
- * {@link parseArtifact}: bytes become `0x`-hex strings; bigint tokens become
- * plain numbers (or, above `Number.MAX_SAFE_INTEGER`, `0x`-hex of their
- * minimal script-num bytes, which the script encoder pushes identically);
- * literal timelock values serialize as decimal strings while `"$param"`
- * timelock references are emitted as-is.
- */
-declare function stringifyArtifact(program: Program): string;
-/**
- * Typed parameters of an `"arkade"` contract as persisted through the
- * `src/contracts` pipeline. The program serializes as artifact JSON, args as
- * a JSON map (`0x`-hex bytes, decimal-string bigints), keys as hex — so a
- * stored contract row re-derives its script fully offline.
- */
-interface ArkadeContractParams {
-    program: Program;
-    args: Record<string, ArkadeParamValue>;
-    serverKey: Uint8Array;
-    userKey?: Uint8Array;
-    emulatorKey?: Uint8Array;
-}
-/** Serialize {@link ArkadeContractParams} to the string map `Contract.params` requires. */
-declare function serializeArkadeContractParams(typed: ArkadeContractParams): Record<string, string>;
-/** Parse the string map persisted in `Contract.params` back into typed params. */
-declare function deserializeArkadeContractParams(params: Record<string, string>): ArkadeContractParams;
-
-/**
- * Generic handler for artifact/program-based Arkade contracts.
- *
- * Persists the full {@link ArkadeContractParams} (program artifact JSON, args,
- * signer keys) as string params, so any contract created via
- * `arkade.contract(program, args)` participates in the standard contract
- * pipeline: ContractManager persistence and validation, watcher events,
- * repository-backed balances, and offline script re-derivation. Rebuild a
- * callable contract from a stored row with `ArkadeContract.fromContract`.
- */
-declare const ArkadeContractHandler: ContractHandler<ArkadeContractParams, ArkadeProgramScript> & TapscriptDeriving<ArkadeProgramScript>;
-
-export { type ArkadeParamValue as A, BoardingContractHandler as B, type CompiledProgramFunction as C, DefaultContractHandler as D, type VHTLCV2ContractParams as E, contractHandlers as F, type InputRef as I, type Program as P, SUPPORTED_PROGRAM_VERSION as S, type TapscriptSegment as T, VHTLC as V, type WitnessRef as W, ArkadeProgramScript as a, type ProgramKeys as b, type ArkadeArgValue as c, type ArkadeFunction as d, type InputDef as e, type ArkadeValueType as f, type ArkadeArgType as g, type ArkadeContractParams as h, type ArkadeSegment as i, type AsmToken as j, type SignerRef as k, deserializeArkadeContractParams as l, stringifyArtifact as m, ArkadeContractHandler as n, type BoardingContractParams as o, parseArtifact as p, type DefaultContractParams as q, resolveAsm as r, serializeArkadeContractParams as s, DelegateContractHandler as t, type DelegateContractParams as u, validateProgram as v, witnessRefToBytes as w, VHTLCContractHandler as x, type VHTLCContractParams as y, VHTLCV2ContractHandler as z };