@arkade-os/swap 0.0.1

package/dist/rfq-CRgIOQ_y.d.cts

@@ -0,0 +1,1219 @@
+import { ReadonlyIdentity, IWallet, Identity, asset, VHTLC } from '@arkade-os/sdk';
+import { DiscoveredMarket } from '@arkade-os/solver-discovery';
+
+type AssetSwapStatus = "pending" | "cancelling" | "fulfilled" | "cancelled" | "recoverable" | "awaiting_fill" | "claimable" | "claimed" | "refunded_l1";
+/** The sentinel asset id for BTC itself, as opposed to a 68-hex asset id.
+ * Lives here with the {@link AssetSwap} fields it describes so the market and
+ * restore layers share one spelling instead of re-typing the literal. */
+declare const BTC_ASSET_ID = "btc";
+interface AssetSwapFallbackSecretsV1 {
+    version: 1;
+    type: "stored";
+    senderPrivateKeyHex: string;
+    /** Onchain-send only. A lightning send's preimage belongs to the payee. */
+    preimageHex?: string;
+}
+type AssetSwapFallbackSecrets = AssetSwapFallbackSecretsV1;
+interface AssetSwap {
+    /** Funding txid — the swap's identity. */
+    id: string;
+    /** 'btc' or a 68-hex asset id. */
+    fromAsset: string;
+    toAsset: string;
+    /** Atomic amounts as strings (bigint is not JSON-safe). */
+    fromAmount: string;
+    /** The covenant wantAmount — a floor, the fill pays >= this. */
+    toAmount: string;
+    swapAddress: string;
+    /** Hex pkScript of the swap contract — the indexer monitoring key. */
+    swapPkScript: string;
+    /** TLV offer — needed to rebuild the contract for cancel. */
+    offerHex: string;
+    fundingTxid: string;
+    spentTxid?: string;
+    status: AssetSwapStatus;
+    createdAt: number;
+    completedAt?: number;
+    /** RFQ pair string, e.g. `arkade:BTC->onchain:BTC`. */
+    pair?: string;
+    /** `sha256(P)`, hex. Public, and how a restore confirms a candidate
+     * derivation is the right one. */
+    paymentHash?: string;
+    /**
+     * The HD descriptor this swap's secrets derive from. Public — it is what
+     * lets the record carry no secrets at all. Present iff the swap was
+     * created on a wallet that can allocate.
+     */
+    signingDescriptor?: string;
+    /** P, hex, when the user supplied a preimage that is not seed-derived. */
+    preimageHex?: string;
+    /**
+     * Complete stored-arm secrets for wallets that cannot derive. Versioned
+     * and discriminated so restore can rebuild both the sender identity and,
+     * for onchain sends, P.
+     */
+    fallbackSecrets?: AssetSwapFallbackSecrets;
+    /** The L1 HTLC's pkScript, hex — the chain-watch key. */
+    htlcPkScriptHex?: string;
+    htlcLocktime?: number;
+    /** The L1 funding txid, once observed. */
+    l1Txid?: string;
+}
+/** All swaps, newest-first. Insertion order is not chronological — the restore
+ * scan rebuilds records in tx-scan order — so sort at read to keep
+ * newest-first canonical for every consumer. */
+declare const getAssetSwapsOrThrow: (repository: AssetSwapRepository) => Promise<AssetSwap[]>;
+/** The consumer read: a broken backend reads as no swaps rather than crashing
+ * a history view. Mutations must use {@link getAssetSwapsOrThrow} instead —
+ * swallowing the read there would let "the backend is gone" masquerade as "no
+ * such swap" and skip the write silently. */
+declare const getAssetSwaps: (repository: AssetSwapRepository) => Promise<AssetSwap[]>;
+/** Add a swap; no-op if the id is already stored. Returns the updated list.
+ * THROWS on a failed write — nothing irreversible may happen until this record
+ * is durable, so the caller must not fund on a failure. */
+declare const addAssetSwap: (repository: AssetSwapRepository, swap: AssetSwap) => Promise<AssetSwap[]>;
+/** Merge changes into a swap by id. Returns the updated list.
+ * THROWS on a failed read or write, like {@link addAssetSwap} — use this for a
+ * write that gates something irreversible. Transitions written *after* the
+ * irreversible act belong on {@link updateAssetSwapBestEffort}. */
+declare const updateAssetSwap: (repository: AssetSwapRepository, id: string, changes: Partial<Omit<AssetSwap, "id">>) => Promise<AssetSwap[]>;
+/**
+ * {@link updateAssetSwap} for transitions that follow an irreversible action (a
+ * broadcast claim, a spent lockup): failing the caller there would report as
+ * failed a swap whose funds already moved, and a stale status is recoverable —
+ * crash recovery re-derives the true state from the chain
+ * (`classifyOnchainHtlc`).
+ *
+ * `persisted` is the part that must not be hidden: a caller that notifies on a
+ * change, or treats one as terminal, has to know the store did not agree.
+ */
+declare const updateAssetSwapBestEffort: (repository: AssetSwapRepository, id: string, changes: Partial<Omit<AssetSwap, "id">>) => Promise<{
+    swaps: AssetSwap[];
+    persisted: boolean;
+}>;
+
+/** A registry discovery result held for reuse. Refetchable — unlike a swap
+ * record, losing it costs one network round trip — but it must survive a cold
+ * boot: serving it stale is what keeps quoting alive while a registry is down. */
+interface MarketsCacheEntry {
+    markets: DiscoveredMarket[];
+    fetchedAt: number;
+}
+/**
+ * Everything the package persists, following the monorepo repository
+ * convention (versioned interface, AsyncDisposable, one backend per
+ * platform — see the Boltz plugin's SwapRepository). Consumers construct
+ * exactly one of these; there is no second storage seam.
+ *
+ * Durable records (swaps) and rebuildable state (the restore scan's txid
+ * cursor, the markets cache) live side by side because they share a
+ * lifetime: all three belong to one wallet on one device, and a consumer
+ * that wipes one wants all three gone.
+ *
+ * ponytail: no query filters — every consumer reads all swaps and filters
+ * in memory; mirror the Boltz plugin's GetSwapsFilter when a consumer needs
+ * subset queries.
+ */
+interface AssetSwapRepository extends AsyncDisposable {
+    readonly version: 1;
+    /** Insert or replace a swap by id. Store the record whole: `fallbackSecrets`
+     * is secret-bearing, and a field-mapped backend that drops it loses the
+     * stored arm's claim and refund keys. */
+    saveSwap(swap: AssetSwap): Promise<void>;
+    /** All stored swaps, in no particular order — `getAssetSwaps` is the
+     * canonical newest-first read. */
+    getAllSwaps(): Promise<AssetSwap[]>;
+    /** Sent txids already checked for offer packets (see restore.ts). */
+    getScannedTxids(): Promise<Set<string>>;
+    markTxidsScanned(txids: Iterable<string>): Promise<void>;
+    /** Cached registry markets, or undefined on a miss. */
+    getCachedMarkets(network: string, registry: string): Promise<MarketsCacheEntry | undefined>;
+    saveCachedMarkets(network: string, registry: string, entry: MarketsCacheEntry): Promise<void>;
+    clear(): Promise<void>;
+}
+declare class InMemoryAssetSwapRepository implements AssetSwapRepository {
+    readonly version: 1;
+    private readonly swaps;
+    private readonly scanned;
+    private readonly markets;
+    saveSwap(swap: AssetSwap): Promise<void>;
+    getAllSwaps(): Promise<AssetSwap[]>;
+    getScannedTxids(): Promise<Set<string>>;
+    markTxidsScanned(txids: Iterable<string>): Promise<void>;
+    getCachedMarkets(network: string, registry: string): Promise<MarketsCacheEntry | undefined>;
+    saveCachedMarkets(network: string, registry: string, entry: MarketsCacheEntry): Promise<void>;
+    clear(): Promise<void>;
+    [Symbol.asyncDispose](): Promise<void>;
+}
+
+/** L1 confirmation-depth and reorg margin between dependent timelocks. */
+declare const ONCHAIN_ORDER_MARGIN_SECONDS: number;
+/** Don't broadcast a claim with less than this before the refund leaf opens:
+ * MTP lag plus confirmation time. Past this point the safe move is to let the
+ * swap die and take the covenant refund — claiming into the counterparty's
+ * live refund window risks losing the race AND publishing P. */
+declare const ONCHAIN_CLAIM_MARGIN_SECONDS: number;
+/** Bounds on the confirmation depth a quote may demand. */
+declare const MAX_MIN_CONFIRMATIONS = 6;
+/** Conservative block interval for converting depths into wall-clock time. */
+declare const ONCHAIN_SECONDS_PER_BLOCK = 600;
+/**
+ * Outputs below this are unspendable in practice; builders refuse them.
+ *
+ * 330, not 546: Bitcoin Core's dust threshold is a function of the OUTPUT
+ * type, and 546 is the P2PKH figure. Both payout scripts on this corridor are
+ * taproot — the claim pays the user's Arkade-side L1 address and the refund
+ * pays the trader's — for which the threshold is 330 (the same number
+ * `FALLBACK_WALLET_DUST_AMOUNT` already uses in the core SDK). Holding the
+ * P2PKH number here rejects payouts between 330 and 546 that the network
+ * would relay perfectly well, which on a refund path means refusing to return
+ * funds that could have been returned.
+ *
+ * Should a caller ever pass a legacy `payoutPkScript`, this floor is too low
+ * for that output and the spend would be non-standard; the threshold would
+ * then have to be derived from the script rather than fixed.
+ *
+ * `BigInt(330)` rather than a `330n` literal, matching the rest of the
+ * package: a bigint literal needs an ES2020 target, and this source is read
+ * directly by consumers that target lower — forcing every one of them to
+ * raise their own target for a single constant. The compiled output is
+ * identical.
+ */
+declare const ONCHAIN_DUST_SATS: bigint;
+/** 32 random bytes. The user generates P for BOTH onchain directions. */
+declare const newPreimage: () => Uint8Array;
+/** `sha256(P)`, hex — the wire `payment_hash`, same convention as BOLT11. */
+declare const paymentHashOf: (preimage: Uint8Array) => string;
+type OnchainNetwork = "bitcoin" | "testnet" | "regtest";
+interface OnchainHtlcParams {
+    /** `sha256(P)`, hex; the HASH160 commitment is derived internally. */
+    paymentHash: string;
+    /** x-only key that claims with the preimage. */
+    claimKey: Uint8Array;
+    /** x-only key that refunds after the locktime. */
+    refundKey: Uint8Array;
+    /** Absolute unix seconds (consensus matures it against median-time-past). */
+    refundLocktime: number;
+}
+interface OnchainHtlc {
+    address: string;
+    /** `0x5120…` — the P2TR output script. */
+    pkScript: Uint8Array;
+    leaves: {
+        claim: Uint8Array;
+        refund: Uint8Array;
+    };
+    /** Serialized control blocks per leaf, ready for a script-path witness. */
+    controlBlocks: {
+        claim: Uint8Array;
+        refund: Uint8Array;
+    };
+    paymentHash: string;
+    refundLocktime: number;
+}
+/**
+ * Derive the two-leaf taproot HTLC. Internal key is the BIP-341 NUMS point, so
+ * there is no key-path spend, ever:
+ *
+ *   claim:  `OP_SIZE 32 OP_EQUALVERIFY OP_HASH160 <h160> OP_EQUALVERIFY <claimKey> OP_CHECKSIG`
+ *   refund: `<locktime> OP_CHECKLOCKTIMEVERIFY OP_DROP <refundKey> OP_CHECKSIG`
+ *
+ * The claim leaf's `OP_SIZE 32 OP_EQUALVERIFY` prefix pins the witness
+ * preimage to exactly 32 bytes before it's hashed — the same shape real HTLC
+ * scripts (e.g. BOLT3's) carry, and this contract's preimage is always
+ * exactly 32 bytes by construction.
+ *
+ * Pure derivation — pinned byte-for-byte by the golden test; any drift here
+ * changes addresses on BOTH sides of a swap.
+ */
+declare function onchainHtlcScript(params: OnchainHtlcParams, network: OnchainNetwork): OnchainHtlc;
+interface HtlcUtxo {
+    txid: string;
+    vout: number;
+    amount: bigint;
+}
+interface SpendResult {
+    txHex: string;
+    txid: string;
+    /** `utxo.amount − fee` — what actually lands at the payout script. */
+    payoutAmount: bigint;
+}
+/** Script-path spend of the claim leaf; the witness reveals P — that is how
+ * the counterparty learns it, so never build this unless the claim will win
+ * (see {@link claimOnchainFill}). `sign` is BIP340 over the claim key. */
+declare const buildHtlcClaim: (input: {
+    htlc: OnchainHtlc;
+    utxo: HtlcUtxo;
+    preimage: Uint8Array;
+    payoutPkScript: Uint8Array;
+    feeRateSatVb: number;
+    sign: (sighash: Uint8Array) => Promise<Uint8Array>;
+}) => Promise<SpendResult>;
+/** Script-path spend of the refund leaf; consensus-valid only once nLockTime
+ * has matured against median-time-past — gate on {@link ChainSource.getMtp},
+ * not wall clock. `sign` is BIP340 over the refund key. */
+declare const buildHtlcRefund: (input: {
+    htlc: OnchainHtlc;
+    utxo: HtlcUtxo;
+    payoutPkScript: Uint8Array;
+    feeRateSatVb: number;
+    sign: (sighash: Uint8Array) => Promise<Uint8Array>;
+}) => Promise<SpendResult>;
+interface ChainUtxo extends HtlcUtxo {
+    confirmations: number;
+}
+/** The package's whole view of Bitcoin L1. An esplora-backed implementation
+ * belongs to the caller (a reference one lives in the test suite); the package
+ * itself stays backend-free. */
+interface ChainSource {
+    /** Confirmed+mempool outputs paying a script; used to detect the fill. */
+    getScriptUtxos(pkScript: Uint8Array): Promise<ChainUtxo[]>;
+    /** The spend of an outpoint, if any — where P is extracted from. */
+    getSpendingTx(txid: string, vout: number): Promise<{
+        txHex: string;
+    } | null>;
+    broadcast(txHex: string): Promise<string>;
+    /** Current median-time-past, unix seconds — gates refund broadcasting. */
+    getMtp(): Promise<number>;
+}
+/** Read P out of a claim spend's witness: the 32-byte item whose sha256 is the
+ * payment hash. Null when the tx reveals no matching preimage (e.g. a refund
+ * spend, or an unrelated tx). */
+declare function extractPreimage(txHex: string, paymentHash: string): Uint8Array | null;
+/** Poll {@link ChainSource} until the HTLC is funded to the required depth.
+ * Picks the largest qualifying output when several exist. Throws (reason
+ * `fill_timeout`) once `deadline` (unix seconds) passes without one. */
+declare function awaitOnchainFill(chain: ChainSource, htlc: OnchainHtlc, minConfirmations: number, options?: {
+    pollMs?: number;
+    deadline?: number;
+}): Promise<ChainUtxo>;
+/**
+ * Claim the fill: build the claim spend and broadcast it. Broadcasting
+ * publishes P (mempool) — by design, it is how the solver gets paid — so this
+ * refuses (reason `claim_window_closed`) when less than
+ * {@link ONCHAIN_CLAIM_MARGIN_SECONDS} remains before the refund leaf opens:
+ * past that point, let the swap die and take the covenant refund instead of
+ * racing the counterparty's refund with P exposed.
+ */
+declare function claimOnchainFill(chain: ChainSource, input: {
+    htlc: OnchainHtlc;
+    utxo: HtlcUtxo;
+    preimage: Uint8Array;
+    payoutPkScript: Uint8Array;
+    feeRateSatVb: number;
+    sign: (sighash: Uint8Array) => Promise<Uint8Array>;
+    /** Injected for tests; defaults to wall clock. */
+    now?: number;
+}): Promise<{
+    txid: string;
+    payoutAmount: bigint;
+}>;
+/** Where an onchain HTLC stands, for crash recovery (see the store docs:
+ * persisting the record BEFORE funding is what makes this classification —
+ * and the claim — possible after a restart). */
+type OnchainHtlcPhase = {
+    phase: "unfunded";
+} | {
+    phase: "awaiting_confirmations";
+    utxo: ChainUtxo;
+} | {
+    phase: "claimable";
+    utxo: ChainUtxo;
+}
+/**
+ * The refund leaf has matured, which means the CLAIM WINDOW IS CLOSED —
+ * `claimOnchainFill` throws `claim_window_closed` from here, by design.
+ * A recovery caller reading this phase must not try to claim: the correct
+ * action is to let the counterparty's L1 refund settle and take the
+ * Arkade-side covenant refund. Reaching this phase on a swap you expected
+ * to claim means the claim was missed, not that it is still available.
+ */
+ | {
+    phase: "refundable";
+    utxo: ChainUtxo;
+} | {
+    phase: "claimed";
+    txid: string;
+    preimage: Uint8Array;
+} | {
+    phase: "swept";
+    txid: string;
+};
+/**
+ * Classify an HTLC from chain state alone. `funding` (the known outpoint from
+ * the stored record) is what distinguishes "never funded" from "funded and
+ * already spent": without it a spent HTLC looks unfunded.
+ *
+ * `claimed` carries the preimage read from the spend's witness — the receipt;
+ * `swept` is a spend that reveals no preimage (the counterparty's refund).
+ */
+declare function classifyOnchainHtlc(chain: ChainSource, input: {
+    htlc: OnchainHtlc;
+    minConfirmations: number;
+    funding?: {
+        txid: string;
+        vout: number;
+    };
+}): Promise<OnchainHtlcPhase>;
+
+/**
+ * Domain separator for the preimage derivation.
+ *
+ * NArk scopes its tag by protocol+provider (`Arkade-Boltz-Preimage-v1`,
+ * `SwapsManagementService.cs:128`) so any Arkade SDK reproduces the same
+ * preimage. NArk has no RFQ corridor yet, so this tag defines the scheme
+ * rather than mirroring one; it is deliberately distinct from the Boltz tag,
+ * or the same wallet key would derive one preimage for both corridors.
+ */
+declare const RFQ_PREIMAGE_TAG = "Arkade-RFQ-Preimage-v1";
+/**
+ * `TAG ‖ xonly(32) ‖ u32le(index)` — the message that gets BIP-340 signed.
+ *
+ * Anchored on the canonical x-only key rather than the descriptor string:
+ * restore reconstructs a bare descriptor that serialises differently from the
+ * signing descriptor used at create time, and only the key agrees across both.
+ */
+declare function buildPreimageMessage(xonly: Uint8Array, index: number): Uint8Array;
+/** No secrets at rest: everything re-derives from the seed plus this. */
+interface DerivedSwapSecrets {
+    derivable: true;
+    /** Public. Persist it on the swap record; it is what restore keys off. */
+    signingDescriptor: string;
+    /** Onchain-send only, when the caller supplied P instead of deriving it. */
+    preimage?: Uint8Array;
+}
+/** The wallet could not allocate. These are real secrets — persist them. */
+interface StoredSwapSecrets {
+    derivable: false;
+    senderPrivateKey: Uint8Array;
+    /** Onchain-send only. A lightning send's preimage belongs to the payee. */
+    preimage?: Uint8Array;
+}
+/**
+ * Which arm a swap got. The discriminant makes the persistence obligation a
+ * type-level fact: a consumer written against {@link DerivedSwapSecrets} alone
+ * fails to compile when handed the stored arm.
+ */
+type SwapSecrets = DerivedSwapSecrets | StoredSwapSecrets;
+/**
+ * Allocate a descriptor for one swap, or `undefined` when the wallet cannot.
+ *
+ * Allocates — never peeks. `getCurrentSigningDescriptor` returns the same
+ * descriptor until the wallet rotates, and two swaps sharing a descriptor
+ * derive the *identical* preimage, so one solver learning its own preimage
+ * would learn the other swap's.
+ *
+ * Cost of allocating: the index is consumed even when the quote is later
+ * refused, and a swap index never turns into a funded receive contract, so a
+ * long run of swaps widens the "unused" gap a seed-only `restore()` scan sees
+ * (see the README's gap-limit note). Restores that keep the swap repository
+ * are unaffected — `adoptSwapDescriptor` re-claims each record's index.
+ */
+declare function deriveSwapSecrets(wallet: IWallet): Promise<DerivedSwapSecrets | undefined>;
+/**
+ * The fallback arm. Separate from {@link deriveSwapSecrets} so nothing can
+ * fabricate a preimage while probing for a derived one.
+ */
+declare function randomSwapSecrets(opts?: {
+    preimage?: boolean | Uint8Array;
+}): StoredSwapSecrets;
+/**
+ * Serialize or restore the secrets arm a persisted record describes. Normal
+ * HD swaps store only `signingDescriptor`; caller-supplied preimages add
+ * `preimageHex`; fallback swaps use `fallbackSecrets` so both P and the
+ * sender identity survive a restart.
+ */
+declare function rfqSecretsToRecord(secrets: SwapSecrets): {
+    signingDescriptor?: string;
+    preimageHex?: string;
+    fallbackSecrets?: AssetSwapFallbackSecrets;
+};
+declare function rfqSecretsOfRecord(record: {
+    signingDescriptor?: string;
+    preimageHex?: string;
+    fallbackSecrets?: AssetSwapFallbackSecrets;
+}): SwapSecrets | undefined;
+/**
+ * Claim a restored swap's index so a later allocation cannot reissue it —
+ * which would derive that swap's preimage a second time, for a different swap.
+ * Monotonic; a no-op on a wallet that cannot allocate.
+ */
+declare function adoptSwapDescriptor(wallet: IWallet, signingDescriptor: string): Promise<void>;
+/** Why a wallet cannot produce a swap's sender key. Different instructions to
+ * a user: restore the other wallet, or accept that this record never carried
+ * the secrets at all. */
+type RefundBlockedReason = 
+/** The record names no arm: neither `signingDescriptor` nor `fallbackSecrets`. */
+"no-secrets"
+/** It names an arm this version cannot read. */
+ | "unreadable-secrets"
+/** The descriptor belongs to another seed, or this wallet is static. */
+ | "foreign-descriptor";
+/**
+ * The wallet cannot produce this swap's sender key, so no local refund is
+ * possible: not a failure to retry, a capability this wallet does not have.
+ *
+ * Thrown where the cause is discovered rather than translated at the edge, so
+ * a `refundArkade` wired through {@link senderIdentityForSwapRecord} reports it
+ * to `RfqSwapManager` unwrapped — which is what stops the manager grinding
+ * against a push that can never work for the whole refund window.
+ */
+declare class RefundNotLocallyPossibleError extends Error {
+    readonly reason: RefundBlockedReason;
+    readonly name = "RefundNotLocallyPossibleError";
+    constructor(reason: RefundBlockedReason, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * The VHTLC `sender` identity — the signer for every interactive refund.
+ *
+ * The capability probe is not the check that matters: `signerForDescriptor`
+ * falls back to the plain wallet identity for a descriptor it cannot derive —
+ * a different seed, a static wallet — and that identity signs happily with the
+ * wrong key, which surfaces only as a solver rejection or a dead claim script.
+ * So the check is on what comes back: only a descriptor-bound signer carries
+ * `signSchnorrDeterministic`.
+ */
+declare function senderIdentityForRfqSecrets(wallet: IWallet, secrets: SwapSecrets): Promise<Identity>;
+/**
+ * The VHTLC `sender` identity for a stored swap record, or a typed refusal.
+ *
+ * The record→identity composition {@link rfqSecretsOfRecord} deliberately does
+ * not do: it stays total so history iteration can call it, so *this* is where
+ * "no secrets on the record" becomes a refusal rather than an `undefined` the
+ * caller has to remember to check.
+ *
+ * **Wire `refundArkade` here, not to {@link senderIdentityForRfqSecrets}.**
+ * Only two of the three causes are throws; a caller one level down would skip
+ * the third silently and turn it into a `TypeError` at the push site, which
+ * `RfqSwapManager` then treats as retryable and grinds against for the whole
+ * refund window.
+ *
+ * Takes the record shape structurally, matching {@link rfqSecretsOfRecord}, so
+ * either record type can be passed.
+ */
+declare function senderIdentityForSwapRecord(wallet: IWallet, record: {
+    signingDescriptor?: string;
+    preimageHex?: string;
+    fallbackSecrets?: AssetSwapFallbackSecrets;
+}): Promise<Identity>;
+/** The `sender` x-only pubkey, the only half the request flow needs. */
+declare function senderPubkeyForRfqSecrets(wallet: IWallet, secrets: SwapSecrets): Promise<Uint8Array>;
+/**
+ * An identity that signs with `aux_rand = 0`, which is what makes the
+ * derivation reproducible. `DescriptorIdentity` satisfies it and throws rather
+ * than degrading to a random-aux signer.
+ */
+interface DeterministicSigner extends ReadonlyIdentity {
+    signSchnorrDeterministic(messageHash: Uint8Array): Promise<Uint8Array>;
+}
+declare function isDeterministicSigner(value: unknown): value is DeterministicSigner;
+/**
+ * `sha256(sign(sha256(msg)))`, with the signing key and the message key being
+ * the same identity — passing a key in separately is how this silently derives
+ * an unrecoverable preimage.
+ */
+declare function derivePreimage(signer: DeterministicSigner): Promise<Uint8Array>;
+/** The onchain-send preimage, re-derived or read back off the stored arm. */
+declare function preimageForRfqSecrets(wallet: IWallet, secrets: SwapSecrets): Promise<Uint8Array>;
+
+/** Legs are `<corridor>:<asset>`; a pair is directional, `from->to`. Arkade
+ * asset legs stay coarse (`arkade:ASSET`) — the exact asset ids ride the
+ * request profile, mirroring how the offer TLV identifies assets. */
+declare const ARKADE_BTC = "arkade:BTC";
+declare const ARKADE_ASSET = "arkade:ASSET";
+declare const LIGHTNING_BTC = "lightning:BTC";
+declare const ONCHAIN_BTC = "onchain:BTC";
+declare const rfqPair: (from: string, to: string) => string;
+/** The implemented pair: pay a BOLT11 invoice out of an Arkade balance. */
+declare const LIGHTNING_SEND_PAIR: string;
+/** On-board via Lightning: pay the solver's hold invoice, land on Arkade. */
+declare const LIGHTNING_RECEIVE_PAIR: string;
+/** Off-board: Arkade sats out to a Bitcoin-L1 HTLC. */
+declare const ONCHAIN_SEND_PAIR: string;
+/** On-board: a Bitcoin-L1 HTLC in, Arkade sats out. */
+declare const ONCHAIN_RECEIVE_PAIR: string;
+/** The closed refusal set. Treat any unknown reason as a generic decline. */
+type RfqRefusalReason = "unsupported_pair" | "unsupported_payload" | "amount_out_of_range" | "exposure_cap" | "invoice_expired" | "quote_conflict" | "pricing_unavailable";
+/** Lifecycle vocabulary; states after which nothing more will happen. */
+declare const RFQ_TERMINAL_STATES: readonly ["settled", "refused", "expired", "refunded", "stuck"];
+/** A refusal from the solver, carrying its closed-set reason. */
+declare class SwapRefusal extends Error {
+    readonly reason: string;
+    readonly rfqId: string | undefined;
+    constructor(reason: string, rfqId?: string);
+}
+/** The solver's address does not match the local derivation. NEVER fund past this. */
+declare class AddressMismatch extends Error {
+    readonly derived: string;
+    readonly quoted: string | undefined;
+    constructor(derived: string, quoted?: string);
+}
+/** A fresh client-chosen negotiation id: 32 random bytes, lowercase hex. */
+declare const newRfqId: () => string;
+interface RfqQuote {
+    v: 1;
+    type: "rfq_quote";
+    rfq_id: string;
+    pair: string;
+    from_amount: number;
+    to_amount: number;
+    solver_pubkey: string;
+    valid_until: number;
+    /** HTLC-class quotes only; absent for arkade↔arkade. */
+    refund_locktime?: number;
+    profile: {
+        [key: string]: unknown;
+        payment_hash?: string;
+        lockup_address?: string;
+    };
+    [key: string]: unknown;
+}
+interface RfqStatus {
+    v: 1;
+    type: "rfq_status";
+    rfq_id: string;
+    state: string;
+    updated_at: number;
+    profile: Record<string, unknown>;
+    [key: string]: unknown;
+}
+/** The rfq_request for the lightning send profile. A BOLT11 profile is always
+ * exact-out: the invoice fixes the amount, so none is restated here.
+ * `senderPubkey` is the trader's own key for the VHTLC's sender-side leaves
+ * (see {@link lightningSendVtxoScript}) — required, never sent anywhere else,
+ * never trusted by the solver as anything but a pubkey to bind into the
+ * script. On the wire it's `client_refund_pubkey` (docs/rfq-protocol.md —
+ * the solver's schema is `.strict()`, so both the wrong name AND the missing
+ * required field would refuse every request). */
+declare const lightningSendRequest: (input: {
+    rfqId: string;
+    invoice: string;
+    refundAddress: string;
+    senderPubkey: Uint8Array;
+}) => Record<string, unknown>;
+/** The rfq_request for an arkade↔arkade swap. Exactly one side may name an
+ * asset id per direction (BTC has none); the pair string stays coarse and the
+ * ids ride the profile, like the offer TLV. Forward-looking: the wire shape is
+ * specified, the reference solver does not serve it yet. */
+declare const arkadeSwapRequest: (input: {
+    rfqId: string;
+    /** Asset the trader deposits; omit when depositing BTC. */
+    offerAsset?: asset.AssetId;
+    /** Asset the trader wants; omit when wanting BTC. */
+    wantAsset?: asset.AssetId;
+    amountSide: "from" | "to";
+    /** Integer base units of the side named by `amountSide`. */
+    amount: number;
+}) => Record<string, unknown>;
+/** Funding gate: refuse unless ≥90 min remain before the refund path opens.
+ * 90 because the refund CLTV matures against median-time-past (BIP-113),
+ * which lags wall clock by ~1h — a smaller wall-clock margin is no margin. */
+declare const MIN_HEADROOM_SECONDS: number;
+/** Compare-only check of the solver's address against YOUR derivation.
+ * Throws {@link AddressMismatch}; returns the address so calls chain. */
+declare const verifyLockupAddress: (quote: RfqQuote, derivedAddress: string) => string;
+/** The user's gates, checked immediately before funding — never at quote
+ * time. Throws with a stable `reason` property. `invoiceExpiresAt` applies to
+ * BOLT11 profiles only; `onchain` adds the L1-HTLC gates (§ guardrails of the
+ * onchain spec) and is required for the onchain pairs.
+ *
+ * The lightning-receive leg does NOT use this: see {@link assertReceivable}.
+ * `refund_locktime` is the SOLVER's on both receive corridors, so
+ * `MIN_HEADROOM_SECONDS` gates the wrong side on either — but only the
+ * lightning leg has a second clock that can actually run out (the hold
+ * invoice's), which is what the split buys. The onchain-receive leg stays here
+ * until its own deadline gets the same treatment; the headroom check is merely
+ * over-strict there, never unsafe. */
+declare const assertFundable: (input: {
+    quote: RfqQuote;
+    invoiceExpiresAt?: number;
+    now: number;
+    onchain?: {
+        htlcLocktime: number;
+        minConfirmations: number;
+        /** "send" = arkade->onchain (the L1 timelock-order gate applies). */
+        direction: "send" | "receive";
+    };
+}) => void;
+interface RfqTransport {
+    requestQuote(payload: Record<string, unknown>): Promise<RfqQuote>;
+    status(rfqId: string): Promise<RfqStatus | null>;
+    close(): Promise<void>;
+}
+/** HTTP: POST /v1/swap for quotes, GET /v1/rfq/<rfq_id> for status.
+ * `fetchImpl` is injectable for tests and non-global-fetch runtimes. */
+declare const httpTransport: (baseUrl: string, options?: {
+    fetchImpl?: typeof fetch;
+}) => RfqTransport;
+/** Minimal WebSocket surface the relay transport needs — satisfied by the DOM
+ * WebSocket and by `ws` alike, so neither becomes a dependency. */
+interface RelaySocket {
+    send(data: string): void;
+    close(): void;
+    addEventListener(type: "open" | "message" | "error", listener: (event: any) => void): void;
+}
+/** Relay: both parties outbound, addressed by x-only pubkey, speaking the dev
+ * broker framing. Nostr (directed kind + NIP-44) replaces only this function.
+ * One socket; replies correlated by rfq_id. */
+declare const relayTransport: (relayUrl: string, options: {
+    solverPubkey: string;
+    clientPubkey: string;
+    WebSocketCtor?: new (url: string) => RelaySocket;
+    timeoutMs?: number;
+}) => RfqTransport;
+/** The solver's unilateral-claim delay, derived from the Ark server's reported
+ * exit delay exactly as the reference solver derives it — both sides read the
+ * SAME server, so the derivation (not a quote field) is what keeps the two
+ * scripts identical. */
+declare const unilateralClaimDelay: (serverExitDelaySeconds: number) => number;
+/** VHTLC's `unilateralRefund` tier: sender + solver, no server, one 512s step
+ * past `claimDelay` — the middle rung between the fully-collaborative paths
+ * and the sender's last-resort `unilateralRefundWithoutReceiver`. Same
+ * already-rounded `claimDelay` input as {@link unilateralClaimDelay}
+ * produces — one rounding, shared across all three tiers. */
+declare const unilateralRefundDelay: (claimDelay: number) => number;
+/** VHTLC's `unilateralRefundWithoutReceiver` tier: sender alone, needs
+ * nobody — two 512s steps past `claimDelay`, past {@link
+ * unilateralRefundDelay}. */
+declare const unilateralRefundWithoutReceiverDelay: (claimDelay: number) => number;
+/** Compile the lightning-send VHTLC from the quote's binding fields plus the
+ * trader's own data. `paymentHash` is the BOLT11 payment hash (`sha256(P)`,
+ * hex); the script's HASH160 commitment is derived from it here, which is why
+ * the trader never needs to see `P`.
+ *
+ * Every quote gets the full eight-leaf contract: VHTLC's own six
+ * (`claim`/`refund`/`refundWithoutReceiver`/`unilateralClaim`/
+ * `unilateralRefund`/`unilateralRefundWithoutReceiver`), plus two more the
+ * emulator co-signs under a covenant pinning the payout to a pre-committed
+ * destination — `nonInteractiveClaim` (server + emulator, pays the solver's
+ * own `receiverPkScript`, no solver signature needed) and
+ * `nonInteractiveRefund` (server + solver + emulator, pays the trader's own
+ * `refundPkScript`, no timelock and no trader signature needed — see {@link
+ * VHTLC.Options.nonInteractiveRefund}'s doc comment for why that matters).
+ */
+declare function lightningSendVtxoScript(params: {
+    /** Binding field #1: the solver's x-only key, from the quote. */
+    solverPubkey: Uint8Array;
+    /** Binding field #2: when the trader's refund path opens, from the quote. */
+    refundLocktime: number;
+    /** The Ark server's x-only key — the trader's OWN connection. */
+    serverPubkey: Uint8Array;
+    /** BOLT11 payment hash, hex — from the trader's OWN invoice decode. */
+    paymentHash: string;
+    /** From {@link unilateralClaimDelay} over the trader's OWN server info.
+     * {@link unilateralRefundDelay} and {@link unilateralRefundWithoutReceiverDelay}
+     * derive from this same value — one rounding, shared across all three tiers. */
+    claimDelay: number;
+    /** Emulator x-only key — the SOLVER's deployment, not the trader's own.
+     * Not fetched here or anywhere in this package; see {@link
+     * requestLightningSend}'s `emulatorPubkey` parameter for where it comes
+     * from and why. */
+    emulatorPubkey: Uint8Array;
+    /** Where a refund must pay: the trader's P2TR pkScript (34 bytes). Also
+     * `nonInteractiveRefund`'s covenant destination. */
+    refundPkScript: Uint8Array;
+    /** The trader's own key — VHTLC's `sender` role. Required on every
+     * interactive refund-side leaf; the trader generates and persists it
+     * (see {@link requestLightningSend}'s own obligations). */
+    senderPubkey: Uint8Array;
+    /** The solver's own claim destination, from the quote
+     * (`profile.receiver_pk_script`) — needed only so `nonInteractiveClaim`'s
+     * covenant key can be derived; the trader does not otherwise use or trust
+     * this value. P2TR pkScript, 34 bytes. */
+    receiverPkScript: Uint8Array;
+}): InstanceType<typeof VHTLC.ScriptV2>;
+/** The BOLT11 facts the trader read from its OWN decode — this module takes
+ * the facts, not the decoder, so any wallet's existing decoder serves. */
+interface InvoiceFacts {
+    /** The raw BOLT11 — what travels in the request profile. */
+    raw: string;
+    /** `sha256(P)`, LOWERCASE hex (64 chars) — {@link verifyReceiveInvoice}
+     * compares it byte-for-byte against `paymentHashOf`, which emits lowercase. */
+    paymentHash: string;
+    amountSats: number;
+    /** Absolute expiry, unix seconds. */
+    expiresAt: number;
+}
+/**
+ * The lightning-send user flow, mirroring `createOffer`'s shape: quote →
+ * derive locally → verify → gate. Pure of funding on purpose — it returns the
+ * address and amount, and the caller funds with its own wallet
+ * (`wallet.send({ address, amount })`) before `quote.valid_until`, after
+ * which the user may go OFFLINE: filling is non-interactive. Success reveals
+ * the preimage in the solver's claim witness (also served via status as
+ * `settled`); failure refunds to `refundAddress`.
+ *
+ * Throws {@link SwapRefusal} (closed reason), {@link AddressMismatch} (never
+ * fund), a gate error with a stable `reason`, or
+ * {@link LockupRegistrationFailed} — the last one alone means the quote is
+ * still good and the same call can be retried once local storage is.
+ *
+ * Broadcasts nothing, but does write locally: the lockup is registered with the
+ * wallet's contract manager before the address is returned, exactly as
+ * `createOffer` registers its covenant — so the lockup is watched from the
+ * moment it lands and out of generic coin selection, and a persistence failure
+ * throws while nothing is funded. `RfqSwapManager` re-registers as a backstop
+ * for older records; a repeat write is a no-op.
+ *
+ * Allocates a fresh `sender` key per call and returns it as `senderPubkey`
+ * plus `secrets`. On an HD wallet `secrets` holds only a public descriptor and
+ * nothing needs protecting; otherwise it holds the raw key and the caller MUST
+ * persist it, or every interactive refund path is gone. `nonInteractiveRefund`
+ * still recovers the funds without it — but it needs the SOLVER's active
+ * cooperation, not just infrastructure uptime, so losing the key with an
+ * unwilling solver is a total loss.
+ */
+declare function requestLightningSend(wallet: IWallet, arkServerUrl: string, 
+/** Covenant co-signer (emulator) x-only key — the SOLVER's deployment,
+ * not the trader's. This library does NOT fetch or verify it: clients
+ * have no network path to the emulator, only the solver and covclaimd
+ * do. The caller must obtain this out-of-band, before calling this
+ * function, from the solver's signed registry/corridor card (its
+ * `emulator_pubkey`, added in arkade-os/solver-registry#18) or an
+ * equivalent source it
+ * independently trusts, and is responsible for having checked it against
+ * that trusted value itself — the same never-trust-only-compare rule as
+ * {@link verifyLockupAddress}, just applied by the caller instead of
+ * here, because there is nothing in this module to derive it against. */
+emulatorPubkey: Uint8Array, transport: RfqTransport, params: {
+    invoice: InvoiceFacts;
+    rfqId?: string;
+}): Promise<{
+    rfqId: string;
+    quote: RfqQuote;
+    /** The trader's OWN derivation — the only address to fund. */
+    address: string;
+    /** What the lockup must carry: the quote's `from_amount` (the invoice
+     * amount plus the corridor's fee), in sats. */
+    fundAmount: number;
+    /** The covenant's scriptPubKey, for watching the lockup and its spend. */
+    swapPkScript: Uint8Array;
+    /** The covenant itself. Hand it to `RfqSwapManager` as the record's
+     * `lockup` (with `address`): without it the manager can only poll, and
+     * cannot retire the row this call just wrote. */
+    script: InstanceType<typeof VHTLC.ScriptV2>;
+    /** Where a failed swap refunds. */
+    refundAddress: string;
+    /** The VHTLC `sender` x-only key, bound into the covenant. Public. */
+    senderPubkey: Uint8Array;
+    /** How the `sender` key is recovered later. Persist it with the record —
+     * on the derivable arm it holds nothing secret. */
+    secrets: SwapSecrets;
+}>;
+/**
+ * Map an arkade↔arkade quote onto `createOffer` terms. The trader takes the
+ * quote by creating and funding the offer covenant before `valid_until` —
+ * the non-interactive fill: the covenant only releases the deposit to a
+ * transaction that delivers the quoted want-amount to the trader, so the
+ * solver fills or nothing moves. There is no rfq_fill message and no refund
+ * timelock; an unfilled offer is cancelled cooperatively (`cancelOffer`).
+ */
+declare const offerTermsFromQuote: (quote: RfqQuote, assets: {
+    wantAsset?: asset.AssetId;
+    offerAsset?: asset.AssetId;
+}) => {
+    wantAmount: bigint;
+    wantAsset?: asset.AssetId;
+    offerAsset?: asset.AssetId;
+};
+/** The rfq_request for `arkade:BTC->onchain:BTC`. Exact-out means "this much
+ * lands in the L1 HTLC". `senderPubkey` is the user's own key for the
+ * VHTLC's sender-side leaves — same role as in {@link lightningSendRequest}.
+ * On the wire it's `client_refund_pubkey`, same as there. */
+declare const onchainSendRequest: (input: {
+    rfqId: string;
+    /** `sha256(P)`, hex — user-chosen; see {@link paymentHashOf}. */
+    paymentHash: string;
+    /** User's x-only L1 key for the HTLC's claim leaf. */
+    payoutPubkey: Uint8Array;
+    /** User's arkade address — where the covenant refund must pay. */
+    refundAddress: string;
+    senderPubkey: Uint8Array;
+    amount: number;
+    amountSide: "from" | "to";
+}) => Record<string, unknown>;
+/** The rfq_request for `lightning:BTC->arkade:BTC`: pay the solver's hold
+ * invoice, land on Arkade. The trader generates `P`, keeps it, and sends only
+ * `H` plus `P` sealed to covclaimd — the solver never sees `P` until it
+ * appears in a claim witness. `payoutPubkey` is the trader's own x-only
+ * Arkade key — the covenant's `receiver` role on this leg, so the trader can
+ * claim the lockup itself without covclaimd. */
+declare const lightningReceiveRequest: (input: {
+    rfqId: string;
+    /** `H = sha256(P)`, hex — trader-chosen; see {@link paymentHashOf}. */
+    paymentHash: string;
+    /** Trader's arkade address — where the swapped sats land. */
+    payoutAddress: string;
+    /** Trader's x-only arkade key — the covenant's `receiver` role. */
+    payoutPubkey: Uint8Array;
+    /** `P` sealed to covclaimd, base64 — `sealClaimPacket(...).ciphertext`. */
+    claimPacket: string;
+    amount: number;
+    amountSide: "from" | "to";
+}) => Record<string, unknown>;
+/** The rfq_request for `onchain:BTC->arkade:BTC`. The user funds the L1 HTLC
+ * (holding its refund role) and receives Arkade; P travels sealed to
+ * covclaimd (see `sealClaimPacket`) so the user can go offline after
+ * funding. `payoutPubkey` is the trader's own x-only Arkade key — the
+ * covenant's `receiver` role, same as the Lightning receive leg's. */
+declare const onchainReceiveRequest: (input: {
+    rfqId: string;
+    paymentHash: string;
+    /** Trader's arkade address — where the swapped sats land. */
+    payoutAddress: string;
+    /** Trader's x-only arkade key — the covenant's `receiver` role. */
+    payoutPubkey: Uint8Array;
+    /** Trader's x-only L1 key for the HTLC's refund leaf. */
+    refundPubkey: Uint8Array;
+    /** `P` sealed to covclaimd, base64 — `sealClaimPacket(...).ciphertext`. */
+    claimPacket: string;
+    amount: number;
+    amountSide: "from" | "to";
+}) => Record<string, unknown>;
+/**
+ * The pure core of {@link requestOnchainSend}: derive BOTH contracts locally
+ * from the quote's binding fields plus the user's own data, and refuse on any
+ * mismatch. Binding: `solver_pubkey`, `refund_locktime`, `htlc_pubkey`,
+ * `htlc_locktime`, `min_confirmations`; `lockup_address` and `htlc_address`
+ * are compare-only.
+ */
+declare function deriveOnchainSend(input: {
+    quote: RfqQuote;
+    paymentHash: string;
+    payoutPubkey: Uint8Array;
+    serverPubkey: Uint8Array;
+    emulatorPubkey: Uint8Array;
+    claimDelay: number;
+    hrp: string;
+    l1Network: OnchainNetwork;
+    refundAddress: string;
+    /** The user's own key for the VHTLC's sender-side leaves — same role as
+     * in {@link requestLightningSend}. */
+    senderPubkey: Uint8Array;
+}): {
+    address: string;
+    swapPkScript: Uint8Array;
+    /** The lockup covenant itself — what the contract row is registered from,
+     * so the row can never key on a script other than the derived one. */
+    script: InstanceType<typeof VHTLC.ScriptV2>;
+    htlc: OnchainHtlc;
+    refundLocktime: number;
+    htlcLocktime: number;
+    minConfirmations: number;
+};
+/**
+ * The `arkade:BTC->onchain:BTC` user flow, mirroring `requestLightningSend`:
+ * quote → derive BOTH contracts locally → verify → gate. Pure of funding —
+ * the caller funds `address` with its own wallet before `quote.valid_until`.
+ *
+ * Registers the arkade lockup before returning the address, on the same terms
+ * as {@link requestLightningSend} — including {@link LockupRegistrationFailed},
+ * the one throw here that does not mean "walk away from this quote". The L1
+ * HTLC is not a contract row: it lives on bitcoin, not on Ark, and the wallet's
+ * contract manager knows nothing of it.
+ *
+ * Two obligations, both LOUD:
+ * - **Persist `secrets` (with the record) BEFORE funding.** On an HD wallet it
+ *   is a public descriptor and both the preimage and the `sender` key
+ *   re-derive from the seed; otherwise it carries the raw secrets, and losing
+ *   them forfeits the L1 claim and every interactive refund path — leaving
+ *   recovery dependent on the solver via `nonInteractiveRefund`.
+ * - **Stay claim-capable.** Unlike lightning-send the user cannot go fully
+ *   offline: it must claim the L1 HTLC (`awaitOnchainFill` →
+ *   `claimOnchainFill`) before `htlc.refundLocktime`. Missing that window
+ *   forfeits the fill and falls back to the Arkade covenant refund.
+ */
+declare function requestOnchainSend(wallet: IWallet, arkServerUrl: string, 
+/** Covenant co-signer (emulator) x-only key — same parameter, same
+ * caller obligation, as {@link requestLightningSend}'s. */
+emulatorPubkey: Uint8Array, transport: RfqTransport, params: {
+    amount: number;
+    amountSide: "from" | "to";
+    /** User's x-only L1 key that will claim the HTLC. */
+    payoutPubkey: Uint8Array;
+    /** Optional caller-owned P. Persist it with the returned secrets before funding. */
+    preimage?: Uint8Array;
+    rfqId?: string;
+}): Promise<{
+    rfqId: string;
+    quote: RfqQuote;
+    /** The user's OWN arkade lockup derivation — the only address to fund. */
+    address: string;
+    fundAmount: number;
+    swapPkScript: Uint8Array;
+    /** The arkade covenant itself — the record's `lockup` for
+     * `RfqSwapManager`, same role as {@link requestLightningSend}'s. */
+    script: InstanceType<typeof VHTLC.ScriptV2>;
+    refundAddress: string;
+    /** The EXPECTED L1 fill, derived locally — watch and claim against this. */
+    htlc: OnchainHtlc;
+    /** The VHTLC `sender` x-only key, bound into the covenant. Public. */
+    senderPubkey: Uint8Array;
+    /** How the preimage and the `sender` key are recovered later. Persist it
+     * with the record BEFORE funding. */
+    secrets: SwapSecrets;
+}>;
+/** Default floor for the window between the last moment the hold invoice can
+ * be paid and the solver's refund leaf opening. */
+declare const MIN_CLAIM_WINDOW_SECONDS: number;
+/**
+ * Bind the SOLVER's hold invoice to the quote and to the trader's own `H`.
+ *
+ * This is the only field the trader hands to a third party, and the only
+ * attack on this corridor with no on-chain trace: an invoice on some other
+ * payment hash is paid to the solver in full and no lockup on `H` is ever
+ * funded. NEVER publish an invoice that has not passed this.
+ *
+ * The decoder is injected — `@arkade-os/swap` takes no BOLT11 dependency — but
+ * unlike {@link requestLightningSend}, which takes the caller's facts about
+ * the caller's OWN invoice, the comparison lives here: a caller-supplied
+ * summary of an adversary's invoice checks nothing.
+ *
+ * There is no check for "is this actually a hold invoice": on the wire it is
+ * indistinguishable from an ordinary one.
+ *
+ * Reasons: `invoice_undecodable` | `invoice_hash_mismatch` |
+ * `invoice_amount_mismatch` | `quote_malformed`.
+ */
+declare const verifyReceiveInvoice: (input: {
+    invoice: string;
+    decode: (bolt11: string) => InvoiceFacts;
+    /** `sha256(P)`, hex — the trader's OWN. */
+    paymentHash: string;
+    quote: RfqQuote;
+}) => {
+    payDeadline: number;
+};
+/**
+ * The receive leg's gate, checked before the invoice is published. Separate
+ * from {@link assertFundable} because the semantics invert: `refund_locktime`
+ * belongs to the SOLVER here, so BIP-113's median-time-past lag extends the
+ * trader's claim window instead of shrinking it. What can actually run out is
+ * the hold invoice's own window — minutes, not the quote's hour — which is why
+ * the claim window is measured from `payDeadline`, the last moment a payer can
+ * arm the swap, and not from `now`.
+ *
+ * `maxPayAmount` is an opt-in absolute ceiling on what the payer is asked for:
+ * `assertQuotedAmount` pins the side the request named, so with
+ * `amountSide: "to"` the price is the free variable. Optional because a bad
+ * price is visible to the caller before anything is published — unlike an
+ * opaque invoice or an underfunded lockup.
+ *
+ * Reasons: `quote_expired` | `missing_refund_locktime` | `claim_window_too_short` |
+ * `price_too_high` | `quote_malformed` | `invalid_gate_input`.
+ */
+declare const assertReceivable: (input: {
+    quote: RfqQuote;
+    /** From {@link verifyReceiveInvoice}: `min(invoice expiry, valid_until)`. */
+    payDeadline: number;
+    now: number;
+    minClaimWindowSeconds?: number;
+    /** Absolute sats ceiling on `from_amount`. */
+    maxPayAmount?: number;
+}) => void;
+/** Compile the RECEIVE-direction VHTLC: the same eight-leaf tree as {@link
+ * lightningSendVtxoScript} with the roles inverted — the trader is the
+ * `receiver` (it generated `P` and claims the lockup with it), the solver is
+ * the `sender` (it funds the lockup and holds the refund recourse). One
+ * function shared by both receive corridors, mirroring the send legs' sharing
+ * of `lightningSendVtxoScript`. */
+declare function receiveVtxoScript(params: {
+    /** Binding field #1: the solver's x-only key, from the quote — VHTLC's
+     * `sender` role on the receive corridors. */
+    solverPubkey: Uint8Array;
+    /** Binding field #2: the SOLVER's own refund deadline on these legs, from
+     * the quote — after it the solver may reclaim an unclaimed lockup. */
+    refundLocktime: number;
+    /** The Ark server's x-only key — the trader's OWN connection. */
+    serverPubkey: Uint8Array;
+    /** `sha256(P)`, hex — the trader's OWN preimage hash. */
+    paymentHash: string;
+    /** From {@link unilateralClaimDelay} over the trader's OWN server info. */
+    claimDelay: number;
+    /** Emulator x-only key — see {@link requestLightningSend}'s parameter. */
+    emulatorPubkey: Uint8Array;
+    /** The solver's covenant refund destination, from the quote
+     * (`profile.solver_refund_pk_script`) — the one tree parameter nothing
+     * else on the wire determines. */
+    solverRefundPkScript: Uint8Array;
+    /** The trader's own x-only Arkade key — VHTLC's `receiver` role on these
+     * legs, so the trader can claim without covclaimd. */
+    payoutPubkey: Uint8Array;
+    /** The trader's own Arkade payout pkScript (decoded from its payout
+     * address) — `nonInteractiveClaim`'s pinned destination. */
+    payoutPkScript: Uint8Array;
+}): InstanceType<typeof VHTLC.ScriptV2>;
+/**
+ * The pure core of {@link requestLightningReceive}: derive the solver-funded
+ * covenant locally from the quote's binding fields plus the trader's own data
+ * and refuse on any address mismatch. The trader funds nothing on Arkade on
+ * this leg — verification is still what makes paying the hold invoice safe:
+ * the lockup the solver will fund must be the tree whose claim paths pay the
+ * trader.
+ */
+declare function deriveLightningReceive(input: {
+    quote: RfqQuote;
+    paymentHash: string;
+    payoutPubkey: Uint8Array;
+    payoutAddress: string;
+    serverPubkey: Uint8Array;
+    emulatorPubkey: Uint8Array;
+    claimDelay: number;
+    hrp: string;
+}): {
+    address: string;
+    swapPkScript: Uint8Array;
+    script: InstanceType<typeof VHTLC.ScriptV2>;
+    /** The solver's hold invoice on `H` — what the trader pays to arm the swap. */
+    invoice: string;
+    refundLocktime: number;
+};
+/**
+ * The `lightning:BTC->arkade:BTC` user flow: quote → derive the covenant
+ * locally → verify → gate. Returns the solver's hold invoice to PAY — the
+ * payment itself is the trader's own Lightning wallet's job, exactly as
+ * funding is the caller's job on the send corridors. Once the paid HTLC is
+ * held, the solver funds the lockup; the trader claims it with `P` (its own,
+ * generated here) — itself via the collaborative claim leaf
+ * ({@link claimReceiveLockup} in `claim.ts`), or via covclaimd if it is
+ * offline.
+ *
+ * Three obligations, all of them before the invoice is handed to a payer:
+ *
+ * 1. Persist `secrets` and `expectedAmount`. The preimage and the payout key
+ *    re-derive from `secrets` (or, on a non-HD wallet, are carried by it), and
+ *    without `expectedAmount` the claim has nothing to compare the funded
+ *    value against.
+ * 2. Stay online. covclaimd cannot claim this covenant today, so the offline
+ *    path the claim packet exists for does not run yet: an unclaimed lockup is
+ *    reclaimed by the solver at `refund_locktime` and the payer refunded.
+ * 3. On {@link LockupRegistrationFailed}, call this function again once the
+ *    store is working. The failed attempt is inert — it returned no invoice,
+ *    so nothing can be paid into the lockup nobody is watching — and the new
+ *    call derives its own preimage and `rfq_id`. Re-registering `error.script`
+ *    does NOT resume it: the invoice and `secrets` were never handed back.
+ *
+ * The invoice is the solver's, so it is verified here against the trader's own
+ * `H` and the quote ({@link verifyReceiveInvoice}) before it is returned —
+ * nothing publishable comes back from a failed check, registration included.
+ * Pay before `invoiceExpiresAt`: the hold-invoice window is minutes, not the
+ * quote's `valid_until`.
+ */
+declare function requestLightningReceive(wallet: IWallet, arkServerUrl: string, 
+/** Covenant co-signer (emulator) x-only key — same parameter, same
+ * caller obligation, as {@link requestLightningSend}'s. */
+emulatorPubkey: Uint8Array, transport: RfqTransport, params: {
+    amount: number;
+    amountSide: "from" | "to";
+    /** covclaimd's 33-byte compressed pubkey (from its own info endpoint)
+     * — the claim packet seals to it and only it can ever read `P` early. */
+    covclaimdPubkey: Uint8Array;
+    /** The caller's own BOLT11 decoder, applied to the SOLVER's invoice.
+     * Required: an optional verifier is one integrators skip, and this is
+     * the check whose absence loses the whole payment. */
+    decodeInvoice: (bolt11: string) => InvoiceFacts;
+    /** Opt-in ceiling, in sats, on what the payer will be asked for. */
+    maxPayAmount?: number;
+    rfqId?: string;
+}): Promise<{
+    rfqId: string;
+    quote: RfqQuote;
+    /** The solver's hold invoice — what the trader pays, for `payAmount`.
+     * Verified against this swap's `H` and the quote's `from_amount`. */
+    invoice: string;
+    /** What the trader pays: the quote's `from_amount`. */
+    payAmount: number;
+    /** What the solver's lockup must carry: the quote's `to_amount`. Persist
+     * it with the record — `pushClaim` refuses to publish `P` for less, and
+     * captured at claim time instead it would be whatever the solver funded. */
+    expectedAmount: number;
+    /** Last moment the invoice can be paid, unix seconds: `min(invoice
+     * expiry, valid_until)`. Absolute on purpose — a countdown returned from
+     * here is stale before the caller reads it; derive one at display time. */
+    invoiceExpiresAt: number;
+    /** The trader's OWN derivation of the lockup the solver must fund. */
+    address: string;
+    swapPkScript: Uint8Array;
+    script: InstanceType<typeof VHTLC.ScriptV2>;
+    payoutAddress: string;
+    /** The trader's covenant `receiver` key, bound into the tree. Public. */
+    payoutPubkey: Uint8Array;
+    /** How the preimage and the payout key are recovered later. Persist it
+     * with the record BEFORE paying the invoice. */
+    secrets: SwapSecrets;
+}>;
+/**
+ * The pure core of {@link requestOnchainReceive}: derive BOTH contracts
+ * locally — the solver-funded Arkade covenant and the L1 HTLC the trader
+ * funds — and refuse on any mismatch. Binding: `solver_pubkey`,
+ * `refund_locktime`, `claim_pubkey`, `htlc_locktime`, `min_confirmations`;
+ * `lockup_address` and `htlc_address` are compare-only.
+ */
+declare function deriveOnchainReceive(input: {
+    quote: RfqQuote;
+    paymentHash: string;
+    payoutPubkey: Uint8Array;
+    payoutAddress: string;
+    /** The trader's own x-only L1 key — the HTLC's refund role. */
+    refundPubkey: Uint8Array;
+    serverPubkey: Uint8Array;
+    emulatorPubkey: Uint8Array;
+    claimDelay: number;
+    hrp: string;
+    l1Network: OnchainNetwork;
+}): {
+    address: string;
+    swapPkScript: Uint8Array;
+    script: InstanceType<typeof VHTLC.ScriptV2>;
+    /** The L1 HTLC the trader funds, derived locally — fund only this. */
+    htlc: OnchainHtlc;
+    refundLocktime: number;
+    htlcLocktime: number;
+    minConfirmations: number;
+};
+/**
+ * The `onchain:BTC->arkade:BTC` user flow: quote → derive BOTH contracts
+ * locally → verify → gate. Returns the L1 HTLC to fund (`htlc.address`, for
+ * `fundAmount`) — the funding transaction itself is the trader's own L1
+ * wallet's job, exactly as on the send corridors. After `min_confirmations`
+ * the solver funds the Arkade lockup; the trader claims it with `P` (its
+ * own), itself or via covclaimd.
+ *
+ * Persist `secrets` BEFORE funding, and note the direction's own deadline:
+ * if the swap never settles, the L1 HTLC's refund leaf (the trader's
+ * `refundPubkey`) opens at `htlc.refundLocktime` — `buildHtlcRefund` takes it
+ * back from there.
+ */
+declare function requestOnchainReceive(wallet: IWallet, arkServerUrl: string, 
+/** Covenant co-signer (emulator) x-only key — same parameter, same
+ * caller obligation, as {@link requestLightningSend}'s. */
+emulatorPubkey: Uint8Array, transport: RfqTransport, params: {
+    amount: number;
+    amountSide: "from" | "to";
+    /** Trader's x-only L1 key for the HTLC's refund leaf. */
+    refundPubkey: Uint8Array;
+    /** covclaimd's 33-byte compressed pubkey — see {@link requestLightningReceive}. */
+    covclaimdPubkey: Uint8Array;
+    rfqId?: string;
+}): Promise<{
+    rfqId: string;
+    quote: RfqQuote;
+    /** The trader's OWN derivation of the lockup the solver must fund. */
+    address: string;
+    /** What the trader's L1 funding must carry: the quote's `from_amount`. */
+    fundAmount: number;
+    /** What the solver's lockup must carry: the quote's `to_amount`. Persist
+     * it with the record — see {@link requestLightningReceive}. */
+    expectedAmount: number;
+    swapPkScript: Uint8Array;
+    script: InstanceType<typeof VHTLC.ScriptV2>;
+    /** The EXPECTED L1 contract, derived locally — fund only this address. */
+    htlc: OnchainHtlc;
+    payoutAddress: string;
+    payoutPubkey: Uint8Array;
+    secrets: SwapSecrets;
+}>;
+
+export { buildPreimageMessage as $, type AssetSwapRepository as A, BTC_ASSET_ID as B, type ChainSource as C, type DerivedSwapSecrets as D, RFQ_TERMINAL_STATES as E, type RefundBlockedReason as F, RefundNotLocallyPossibleError as G, type HtlcUtxo as H, InMemoryAssetSwapRepository as I, type RelaySocket as J, type RfqQuote as K, LIGHTNING_BTC as L, type MarketsCacheEntry as M, type RfqRefusalReason as N, type OnchainHtlc as O, SwapRefusal as P, type SwapSecrets as Q, type RfqStatus as R, type StoredSwapSecrets as S, addAssetSwap as T, adoptSwapDescriptor as U, arkadeSwapRequest as V, assertFundable as W, assertReceivable as X, awaitOnchainFill as Y, buildHtlcClaim as Z, buildHtlcRefund as _, type AssetSwap as a, claimOnchainFill as a0, classifyOnchainHtlc as a1, deriveLightningReceive as a2, deriveOnchainReceive as a3, deriveOnchainSend as a4, derivePreimage as a5, deriveSwapSecrets as a6, extractPreimage as a7, getAssetSwaps as a8, getAssetSwapsOrThrow as a9, unilateralClaimDelay as aA, unilateralRefundDelay as aB, unilateralRefundWithoutReceiverDelay as aC, updateAssetSwap as aD, updateAssetSwapBestEffort as aE, verifyLockupAddress as aF, verifyReceiveInvoice as aG, httpTransport as aa, isDeterministicSigner as ab, lightningReceiveRequest as ac, lightningSendRequest as ad, lightningSendVtxoScript as ae, newPreimage as af, newRfqId as ag, offerTermsFromQuote as ah, onchainHtlcScript as ai, onchainReceiveRequest as aj, onchainSendRequest as ak, paymentHashOf as al, preimageForRfqSecrets as am, randomSwapSecrets as an, receiveVtxoScript as ao, relayTransport as ap, requestLightningReceive as aq, requestLightningSend as ar, requestOnchainReceive as as, requestOnchainSend as at, rfqPair as au, rfqSecretsOfRecord as av, rfqSecretsToRecord as aw, senderIdentityForRfqSecrets as ax, senderIdentityForSwapRecord as ay, senderPubkeyForRfqSecrets as az, type RfqTransport as b, type ChainUtxo as c, type OnchainHtlcPhase as d, ARKADE_ASSET as e, ARKADE_BTC as f, AddressMismatch as g, type AssetSwapFallbackSecrets as h, type AssetSwapStatus as i, type DeterministicSigner as j, type InvoiceFacts as k, LIGHTNING_RECEIVE_PAIR as l, LIGHTNING_SEND_PAIR as m, MAX_MIN_CONFIRMATIONS as n, MIN_CLAIM_WINDOW_SECONDS as o, MIN_HEADROOM_SECONDS as p, ONCHAIN_BTC as q, ONCHAIN_CLAIM_MARGIN_SECONDS as r, ONCHAIN_DUST_SATS as s, ONCHAIN_ORDER_MARGIN_SECONDS as t, ONCHAIN_RECEIVE_PAIR as u, ONCHAIN_SECONDS_PER_BLOCK as v, ONCHAIN_SEND_PAIR as w, type OnchainHtlcParams as x, type OnchainNetwork as y, RFQ_PREIMAGE_TAG as z };