@arkade-os/swap 0.0.14 → 0.0.16

package/dist/index.d.cts

@@ -1,9 +1,9 @@
-import { ProvisionedKey, ProvisionedClaimSecret, asset, RelativeTimelock, IWallet, arkade, RestIndexerProvider, Transaction, IContractManager, OnchainProvider, PaymentRail, Asset, VHTLC, Identity, ActivityResolver } from '@arkade-os/sdk';
-import { S as SwapSecretsProjection, R as RfqSwapRecord, A as AssetSwapRepository, a as AssetSwap, M as MarketsCacheEntry, b as RefundArkProvider, c as RefundIndexer, L as LockupVtxo, d as RfqSwap, e as ArkadeRefundResult, f as LockupSpendIndexer, g as RfqSwapState } from './repository-Vfx65uF1.cjs';
-export { h as AssetSwapStatus, i as AvailableRfqSwapManagerCallbacks, B as BTC_ASSET_ID, I as InMemoryAssetSwapRepository, j as LightningReceiveSwap, k as LightningSendSwap, l as LockupFate, m as LockupNeedsRecoveryError, n as LockupParams, o as LockupSpend, O as OnchainSendAction, p as OnchainSendSwap, P as PersistableRfqSwap, q as PreimageBlockedReason, r as PreimageNotRecoverableError, s as REFUND_MTP_LAG_SECONDS, t as RFQ_RESOLVED_STATES, u as RFQ_SWAP_RETENTION_SECONDS, v as RFQ_SWAP_TERMINAL_STATES, w as RefundOutcome, x as RfqRestoreFailure, y as RfqRestoreOptions, z as RfqRestoreResult, C as RfqSwapActionName, D as RfqSwapLockup, E as RfqSwapManager, F as RfqSwapManagerCallbacks, G as RfqSwapManagerConfig, H as RfqSwapManagerDeps, J as RfqSwapManagerEvents, K as RfqSwapOrigin, N as RfqSwapOriginRequired, Q as RfqSwapOutcome, T as RfqSwapRecordStore, U as SwapContractRegistry, V as addAssetSwap, W as awaitRfqResolution, X as createRfqSwapRecord, Y as findLockupVtxos, Z as getAssetSwaps, _ as getAssetSwapsOrThrow, $ as isRfqSwapTerminal, a0 as isRfqTerminal, a1 as nextOnchainAction, a2 as preimageForSwapRecord, a3 as pushRefundWithoutReceiver, a4 as readLockupFate, a5 as rebuildRfqSwap, a6 as refundIfUnresolved, a7 as rfqSwapOriginOf, a8 as shouldRetainRfqSwap, a9 as swapSecretsToRecord, aa as updateAssetSwap, ab as updateAssetSwapBestEffort, ac as updateRfqSwapRecord } from './repository-Vfx65uF1.cjs';
+import { ProvisionedKey, ProvisionedClaimSecret, ArkTxInput, asset, RelativeTimelock, IWallet, EmulatorProvider, arkade, RestIndexerProvider, Transaction, IContractManager, OnchainProvider, PaymentRail, Asset, VHTLC, Identity, ActivityResolver } from '@arkade-os/sdk';
+import { S as SwapSecretsProjection, R as RfqSwapRecord, A as AssetSwapRepository, a as AssetSwap, M as MarketsCacheEntry, b as RefundArkProvider, c as RefundIndexer, L as LockupVtxo, d as RfqSwap, e as ArkadeRefundResult, f as LockupSpendIndexer, g as RfqSwapState } from './repository-rwU1Sv2-.cjs';
+export { h as AssetSwapStatus, i as AvailableRfqSwapManagerCallbacks, B as BTC_ASSET_ID, I as InMemoryAssetSwapRepository, j as LightningReceiveSwap, k as LightningSendSwap, l as LockupFate, m as LockupNeedsRecoveryError, n as LockupParams, o as LockupSpend, O as OnchainSendAction, p as OnchainSendSwap, P as PersistableRfqSwap, q as PreimageBlockedReason, r as PreimageNotRecoverableError, s as REFUND_MTP_LAG_SECONDS, t as RFQ_RESOLVED_STATES, u as RFQ_SWAP_RETENTION_SECONDS, v as RFQ_SWAP_TERMINAL_STATES, w as RefundOutcome, x as RfqRestoreFailure, y as RfqRestoreOptions, z as RfqRestoreResult, C as RfqSwapActionName, D as RfqSwapLockup, E as RfqSwapManager, F as RfqSwapManagerCallbacks, G as RfqSwapManagerConfig, H as RfqSwapManagerDeps, J as RfqSwapManagerEvents, K as RfqSwapOrigin, N as RfqSwapOriginRequired, Q as RfqSwapOutcome, T as RfqSwapRecordStore, U as SwapContractRegistry, V as addAssetSwap, W as awaitRfqResolution, X as createRfqSwapRecord, Y as findLockupVtxos, Z as getAssetSwaps, _ as getAssetSwapsOrThrow, $ as isRfqSwapTerminal, a0 as isRfqTerminal, a1 as nextOnchainAction, a2 as preimageForSwapRecord, a3 as pushRefundWithoutReceiver, a4 as readLockupFate, a5 as rebuildRfqSwap, a6 as refundIfUnresolved, a7 as rfqSwapOriginOf, a8 as shouldRetainRfqSwap, a9 as swapSecretsToRecord, aa as updateAssetSwap, ab as updateAssetSwapBestEffort, ac as updateRfqSwapRecord } from './repository-rwU1Sv2-.cjs';
 import { Network, LocalCardInput, DiscoveredMarket, Side, OfferPlan } from '@arkade-os/solver-discovery';
-import { O as OnchainNetwork, a as OnchainHtlc, b as OnchainHtlcParams, C as ChainSource, R as RfqTransport, r as requestOnchainSend, I as InvoiceFacts, c as requestLightningSend } from './rfq-CYfKvAPp.cjs';
-export { A as ARKADE_ASSET, d as ARKADE_BTC, e as AddressMismatch, f as ChainUtxo, H as HtlcUtxo, L as LIGHTNING_BTC, g as LIGHTNING_RECEIVE_PAIR, h as LIGHTNING_SEND_PAIR, i as LOCKTIME_THRESHOLD, j as LightningReceiveTreeParams, k as LightningSendTreeParams, M as MAX_MIN_CONFIRMATIONS, l as MIN_CLAIM_WINDOW_SECONDS, m as MIN_HEADROOM_SECONDS, n as ONCHAIN_BTC, o as ONCHAIN_CLAIM_MARGIN_SECONDS, p as ONCHAIN_DUST_SATS, q as ONCHAIN_ORDER_MARGIN_SECONDS, s as ONCHAIN_RECEIVE_PAIR, t as ONCHAIN_SECONDS_PER_BLOCK, u as ONCHAIN_SEND_PAIR, v as OnchainHtlcPhase, w as RFQ_TERMINAL_STATES, x as RelaySocket, y as RfqQuote, z as RfqRefusalReason, B as RfqStatus, S as SOLO_REFUND_HEADROOM_SECONDS, D as SwapRefusal, E as arkadeAssetLeg, F as arkadeSwapRequest, G as assertFundable, J as assertReceivable, K as awaitOnchainFill, N as buildHtlcClaim, P as buildHtlcRefund, Q as claimOnchainFill, T as classifyOnchainHtlc, U as deriveLightningReceive, V as deriveOnchainReceive, W as deriveOnchainSend, X as extractPreimage, Y as httpTransport, Z as l1ScriptForAddress, _ as lightningReceiveRequest, $ as lightningSendRequest, a0 as lightningSendVtxoScript, a1 as newPreimage, a2 as newRfqId, a3 as offerTermsFromQuote, a4 as onchainHtlcScript, a5 as onchainReceiveRequest, a6 as onchainSendRequest, a7 as paymentHashOf, a8 as receiveVtxoScript, a9 as relayTransport, aa as requestLightningReceive, ab as requestOnchainReceive, ac as rfqPair, ad as unilateralClaimDelay, ae as unilateralRefundDelay, af as unilateralRefundWithoutReceiverDelay, ag as verifyLockupAddress, ah as verifyReceiveInvoice } from './rfq-CYfKvAPp.cjs';
+import { O as OnchainNetwork, a as OnchainHtlc, b as OnchainHtlcParams, C as ChainSource, R as RfqTransport, r as requestOnchainSend, I as InvoiceFacts, c as requestLightningSend } from './rfq-DirJn_4k.cjs';
+export { A as ARKADE_ASSET, d as ARKADE_BTC, e as AddressMismatch, f as ChainUtxo, H as HtlcUtxo, L as LIGHTNING_BTC, g as LIGHTNING_RECEIVE_PAIR, h as LIGHTNING_SEND_PAIR, i as LOCKTIME_THRESHOLD, j as LightningReceiveTreeParams, k as LightningSendTreeParams, M as MAX_MIN_CONFIRMATIONS, l as MIN_CLAIM_WINDOW_SECONDS, m as MIN_HEADROOM_SECONDS, n as ONCHAIN_BTC, o as ONCHAIN_CLAIM_MARGIN_SECONDS, p as ONCHAIN_DUST_SATS, q as ONCHAIN_ORDER_MARGIN_SECONDS, s as ONCHAIN_RECEIVE_PAIR, t as ONCHAIN_SECONDS_PER_BLOCK, u as ONCHAIN_SEND_PAIR, v as OnchainHtlcPhase, w as RFQ_REFUSAL_ERROR_CODES, x as RFQ_TERMINAL_STATES, y as RelaySocket, z as RfqQuote, B as RfqRefusalDetail, D as RfqRefusalErrorCode, E as RfqRefusalReason, F as RfqRefusalUnit, G as RfqStatus, S as SOLO_REFUND_HEADROOM_SECONDS, J as SwapRefusal, K as arkadeAssetLeg, N as arkadeSwapRequest, P as assertFundable, Q as assertReceivable, T as awaitOnchainFill, U as buildHtlcClaim, V as buildHtlcRefund, W as claimOnchainFill, X as classifyOnchainHtlc, Y as deriveLightningReceive, Z as deriveOnchainReceive, _ as deriveOnchainSend, $ as extractPreimage, a0 as httpTransport, a1 as isRfqRefusalErrorCode, a2 as l1ScriptForAddress, a3 as lightningReceiveRequest, a4 as lightningSendRequest, a5 as lightningSendVtxoScript, a6 as newPreimage, a7 as newRfqId, a8 as offerTermsFromQuote, a9 as onchainHtlcScript, aa as onchainReceiveRequest, ab as onchainSendRequest, ac as paymentHashOf, ad as receiveVtxoScript, ae as relayTransport, af as requestLightningReceive, ag as requestOnchainReceive, ah as rfqPair, ai as unilateralClaimDelay, aj as unilateralRefundDelay, ak as unilateralRefundWithoutReceiverDelay, al as verifyLockupAddress, am as verifyReceiveInvoice } from './rfq-DirJn_4k.cjs';
 
 /**
  * Which wallet key signs this leg. Stored at `profile.signer`.
@@ -235,6 +235,22 @@ declare const OFFER_PACKET_TYPE = 3;
 declare function encodeOffer(offer: Offer): Uint8Array;
 /** Parse TLV bytes into an offer. Throws on malformed or unknown records. */
 declare function decodeOffer(data: Uint8Array): Offer;
+/**
+ * Put the covenants of restored swap records back in the watched set.
+ *
+ * {@link restoreAssetSwaps} rebuilds the *record* and nothing else, so a
+ * restored wallet holds swaps with no contract row behind them — never
+ * subscribed, never emitting `vtxo_spent`, unresolvable by the watcher. The
+ * restore-scan backstop three modules lean on restores records, not coverage.
+ * Separate from that scan, which is indexer-only and whose records must survive
+ * a coverage failure. A script whose every record is {@link RETIRABLE} is
+ * skipped, or this undoes {@link retireSettledOfferContracts}. One client, one
+ * manager and one `createContracts` for the batch, so N covenants cost one
+ * indexer round trip. A covenant that no longer derives is skipped; a dead
+ * server or store is not — it covered nothing, and saying otherwise stops the
+ * caller retrying.
+ */
+declare function restoreOfferCoverage(wallet: IWallet, arkServerUrl: string, swaps: AssetSwap[]): Promise<void>;
 /**
  * Build a new offer for `wallet` (the user). Fund `address` with the side
  * you deposit, embedding the returned extension, and the solver does the rest:
@@ -360,6 +376,95 @@ declare function cancelOffer(wallet: IWallet, arkServerUrl: string, offerHex: st
     fundingTxid?: string;
     swapAddress?: string;
 }): Promise<string>;
+/** Sats output 0 carries when the maker is paid in an ASSET rather than sats:
+ * the covenant checks the asset there, and the output still needs a carrier of
+ * its own. Overridable per fill via `assetCarrierSats`.
+ *
+ * Derived from the SDK's constant rather than restated, so the two spellings of
+ * one dust threshold cannot drift apart; `bigint` only because this package's
+ * amounts are. */
+declare const ASSET_CARRIER_SATS: bigint;
+/**
+ * A coin the taker supplies, plus whatever assets it carries.
+ *
+ * `ArkTxInput` describes sats only, so the assets have to be declared — this is
+ * the one thing a fill cannot discover for itself, and omitting it is not
+ * cosmetic. **arkd refuses a spend whose asset packet omits an asset one of its
+ * inputs owns** (`ASSET_NOT_FOUND`), so a coin picked for its sats that happens
+ * to carry an asset takes the whole fill down unless it is named here. A
+ * wallet's own coins already carry `assets` in this shape.
+ */
+type FillFunding = ArkTxInput & {
+    assets?: readonly {
+        assetId: string;
+        amount: bigint | number;
+    }[];
+};
+/**
+ * Fill an offer — the TAKER's side, and the counterpart to {@link createOffer}.
+ *
+ * The covenant's `fulfill` leaf is signed by the server alone and constrains the
+ * spend to pay output 0 at least `wantAmount` to the maker's witness program, so
+ * a taker cannot take the deposit without delivering. This composes that spend;
+ * it does not weaken or reinterpret the covenant.
+ *
+ * **Both want sides.** For a BTC want output 0 pays `wantAmount` sats. For an
+ * ASSET want the covenant reads output 0 through `OP_INSPECTOUTASSETLOOKUP` with
+ * `lookup_index = 0`, so the wanted asset must be the FIRST group in the packet
+ * and output 0 carries only a dust sat carrier ({@link ASSET_CARRIER_SATS}).
+ * Group order follows the order the groups are added, which is why the wanted
+ * asset is added first — reordering it silently breaks the covenant.
+ *
+ * Every other asset in the spend — the deposit's own, and any the taker's
+ * funding coins carry — is routed to the taker's payout. Declaring those is not
+ * optional; see {@link FillFunding}.
+ *
+ * Unlike {@link cancelOffer} this writes NO local swap record. A taker filling
+ * someone else's offer has no row to update — the repository dance there belongs
+ * to the funder, whose swap it is. The maker learns the outcome from the chain
+ * (`classifySpend`), which is the design § 7.2 of the RFQ protocol describes.
+ *
+ * `fund` is required and explicit rather than selected here. Coin selection is
+ * the caller's: only they know which coins are reserved for other flows, and a
+ * helper that picked for them would spend a corridor's float out from under it.
+ * The coins become inputs 1..n and are signed with the wallet's identity.
+ *
+ * `payoutScript` is where the taker's proceeds land — the deposit it just took,
+ * plus any surplus over `wantAmount`. Defaults to the wallet's own address.
+ *
+ * Racing a cancel is a NORMAL outcome, not a failure: cancel is a 2-of-2 of the
+ * funder and the server and does not involve the taker, so a funder may cancel
+ * between this reading the deposit and broadcasting. That surfaces the same way
+ * cancel's own race does — "no spendable VTXO at the swap address" — and a
+ * caller should treat it as "the offer is gone", not as an error to retry.
+ */
+declare function fillOffer(wallet: IWallet, arkServerUrl: string, offerHex: string, opts: {
+    /** Coins the taker supplies to pay `wantAmount`, with any assets they
+     * carry. Become inputs 1..n. @see FillFunding */
+    fund: FillFunding[];
+    /** Where the taker's proceeds land. Defaults to the wallet's own address. */
+    payoutScript?: Uint8Array;
+    /** Selects the deposit when the swap address holds more than one. */
+    fundingTxid?: string;
+    /** The funded address, to pin the server key the covenant was built with. */
+    swapAddress?: string;
+    /** Sats at output 0 on an asset want. Defaults to {@link ASSET_CARRIER_SATS};
+     * raise it for a server whose dust threshold is higher. */
+    assetCarrierSats?: bigint;
+    /**
+     * The co-signing service — a base URL, or a provider of your own.
+     *
+     * Required, with no default: `fulfill` is a covenant path, so the
+     * emulator is what executes the arkade script and finalizes the spend
+     * with arkd. A client without one builds the transaction and then
+     * refuses to submit it.
+     */
+    emulator: EmulatorProvider | string;
+    /** Co-signer key override (33-byte compressed hex), as `createOffer`
+     * takes. Needed on a network the SDK pins no emulator key for, where
+     * connecting with an emulator otherwise throws. */
+    emulatorPubkey?: string;
+}): Promise<string>;
 
 /**
  * Quoting: solver discovery and the pricing guardrails around a plan.
@@ -434,6 +539,19 @@ type PlanError = "insufficient-balance" | "side-disabled" | "below-min" | "above
 /** Validate a plan against the user's balance and the server dust limit. */
 declare const validatePlan: (plan: OfferPlan, giveBalance: bigint, dust: bigint) => PlanError | undefined;
 
+declare const MARKET_CORRIDORS: readonly ["arkade", "bolt11", "bitcoin", "eip155"];
+type MarketCorridor = (typeof MARKET_CORRIDORS)[number];
+type MarketLike = {
+    base_asset?: unknown;
+    quote_asset?: unknown;
+    base_corridor?: unknown;
+    quote_corridor?: unknown;
+};
+declare const marketAssetId: (market: MarketLike, side: Side) => string | undefined;
+declare const marketCorridor: (market: MarketLike, side: Side) => MarketCorridor;
+declare const isRfqMarket: (market: MarketLike) => boolean;
+declare const marketPairLabel: (market: MarketLike) => string;
+
 /** Browser backend over the SDK's shared IndexedDB manager — the same
  * infrastructure the wallet already uses for its Boltz swap repository. */
 declare class IndexedDbAssetSwapRepository implements AssetSwapRepository {
@@ -578,15 +696,80 @@ declare function classifyDepositSpend(offer: Offer, serverPubkey: Uint8Array, sp
  * `serverPubkey` must be the server key the covenants were funded against; a
  * key that has rotated since makes every affected swap unclassifiable rather
  * than misclassified.
+ *
+ * ## `reopen`: re-asking a record this left pending
+ *
+ * A run finding the deposit unspent returns `pending` *and* marks the funding
+ * txid scanned, so the natural call asks once and never again — `pending` is the
+ * absence of an answer. Pass those records as `reopen`: re-answered from stored
+ * `offerHex`, no funding fetch, skip lists unchanged, definite outcomes only.
  */
 declare function restoreAssetSwaps(indexer: RestoreIndexer, txs: Tx[], existingIds: ReadonlySet<string>, opts: {
     serverPubkey: Uint8Array;
     scanned?: ReadonlySet<string>;
+    reopen?: AssetSwap[];
 }): Promise<{
     restored: AssetSwap[];
     scannedTxids: string[];
 }>;
 
+interface AssetSwapRestoreChange {
+    /** The stored record before this restore; absent for a rebuilt record. */
+    previous?: AssetSwap;
+    /** The record persisted by this restore. */
+    current: AssetSwap;
+}
+interface RestoreAssetSwapRepositoryOptions {
+    wallet: IWallet;
+    arkServerUrl: string;
+    indexer: RestoreIndexer;
+    repository: AssetSwapRepository;
+    txs: Tx[];
+    /** The server key the restored covenants were funded against, x-only. */
+    serverPubkey: Uint8Array;
+    /** Add consumer-owned metadata to a newly rebuilt record before it is saved. */
+    prepareNew?: (swap: AssetSwap) => AssetSwap | Promise<AssetSwap>;
+    /** Stops repository writes and coverage work after an in-flight scan returns. */
+    signal?: AbortSignal;
+}
+interface RestoreAssetSwapRepositoryResult {
+    /** The repository's newest-first state after this operation. */
+    swaps: AssetSwap[];
+    /** Every record this operation inserted or updated. */
+    changes: AssetSwapRestoreChange[];
+    /** Funding txids newly added to the durable scan cursor. */
+    scannedTxids: string[];
+    /** Set when the caller cancelled before the operation could commit. */
+    aborted: boolean;
+    /** Coverage setup failed after records were safely persisted. Retry is safe. */
+    coverageError?: unknown;
+}
+/**
+ * Restore the durable asset-swap state for one wallet.
+ *
+ * This is the consumer entry point above the two lower-level recovery
+ * primitives: it reads the repository, reopens every live record, persists
+ * rebuilt records and outcomes before advancing the scan cursor, then restores
+ * the wallet-contract coverage needed by the live watcher. Consumers keep only
+ * presentation work (for example decorating a new record or announcing a
+ * returned change).
+ *
+ * Scan and persistence failures reject. Coverage setup is different: records
+ * are already safe by then, so its error is returned as `coverageError` and a
+ * later call can retry without losing or duplicating anything.
+ */
+declare function restoreAssetSwapRepository(opts: RestoreAssetSwapRepositoryOptions): Promise<RestoreAssetSwapRepositoryResult>;
+
+interface RegisterAssetSwapRestoreOptions {
+    arkServerUrl: string;
+    repository: AssetSwapRepository;
+    indexer?: RestoreIndexer;
+    serverPubkey?: Uint8Array;
+    prepareNew?: RestoreAssetSwapRepositoryOptions["prepareNew"];
+    onResult?: (result: RestoreAssetSwapRepositoryResult) => void | Promise<void>;
+}
+declare function registerAssetSwapRestore(wallet: IWallet, options: RegisterAssetSwapRestoreOptions): () => void;
+
 /**
  * The record change a classified spend implies, or `undefined` when it implies
  * none — an already-resolved swap, or a spend nobody could classify.
@@ -622,9 +805,9 @@ interface WatchOfferSwapsParams {
  * registered covenant is watched, so only registered offers produce events.
  * Offers funded before registration existed stay on the restore scan.
  *
- * This depends on the wallet's contract event transport. In Node, callers must
- * provide an `EventSource` implementation or use a runtime where it is enabled;
- * otherwise live updates do not arrive and restore remains the fallback.
+ * *Live* updates depend on the wallet's contract event transport. In Node,
+ * callers must provide an `EventSource` implementation or use a runtime where
+ * it is enabled. The start-up pass needs none of it.
  */
 declare function watchOfferSwaps({ wallet, arkServerUrl, repository, onUpdate, }: WatchOfferSwapsParams): Promise<OfferSwapWatcher>;
 
@@ -1258,4 +1441,4 @@ interface RfqSwapActivityDeps {
  */
 declare function rfqSwapActivityInputs(deps: RfqSwapActivityDeps): Promise<SwapActivityInput[]>;
 
-export { ArkadeRefundResult, type ArkadeRefunderDeps, AssetSwap, AssetSwapRepository, CROSS_ASSET_RAIL, ChainSource, type ClaimArkProvider, type ClaimPacketInput, type CovclaimdClient, type CovclaimdInfo, CovclaimdRevealError, type CrossAssetPhase, type CrossAssetRailDeps, type CrossAssetSwap, type DiscoverMarketsOptions, IndexedDbAssetSwapRepository, InvoiceFacts, type LightningReceiveProfile, type LightningSendProfile, LockupAmountMismatchError, LockupContractMissing, type LockupContractReader, type LockupContractWriter, LockupRegistrationFailed, LockupSpendIndexer, LockupVtxo, MarketsCacheEntry, OFFER_PACKET_TYPE, type Offer, type OfferContractRetirer, type OfferSwapWatcher, OnchainHtlc, OnchainHtlcParams, OnchainNetwork, type OnchainSendProfile, type PlanError, QUOTE_OPTIONS, RefundArkProvider, type RefundBlockedReason, RefundIndexer, RefundNotLocallyPossibleError, type RestoreIndexer, type RevealParams, type RfqClaimSecretProjection, type RfqHashlockProjection, type RfqSignerProjection, RfqSwap, type RfqSwapActivityDeps, RfqSwapRecord, RfqSwapState, RfqTransport, SOLVER_LIGHTNING_RAIL, SOLVER_ONCHAIN_RAIL, SWAP_LOCKUP_CONTRACT_KIND, SWAP_LOCKUP_CONTRACT_LABEL, SWAP_LOCKUP_CONTRACT_TYPE, type SealedClaimPacket, type SolverLightningRailDeps, type SolverLightningSend, type SolverOnchainRailDeps, type SolverOnchainSend, type SolverRendezvous, type SpendKind, type SwapActivityInput, SwapSecretsProjection, type Tx, type WatchOfferSwapsParams, arkadeRefunder, awaitLockupFunding, cancelOffer, chainSourceFrom, claimReceiveLockup, classifyDepositSpend, classifySpend, covclaimdClient, createOffer, crossAssetRail, decodeOffer, discoverMarkets, encodeOffer, findMarket, lockupContractParams, makeCachedFeedFetch, offerVtxoScript, onchainSendProfile, pushClaim, registerLockupContract, requestLightningSend, requestOnchainSend, restoreAssetSwaps, retireSettledOfferContracts, revealClaimPacket, revealFieldsFromScript, rfqClaimSecretOf, rfqSecretsProfile, rfqSignerOf, rfqSwapActivityInputs, sealClaimPacket, senderIdentityForSwapRecord, solverLightningRail, solverLightningRendezvous, solverOnchainRail, solverOnchainRendezvous, solverRendezvous, spendTxidsOf, spendUpdate, swapActivityResolver, swapPrograms, validatePlan, watchOfferSwaps };
+export { ASSET_CARRIER_SATS, ArkadeRefundResult, type ArkadeRefunderDeps, AssetSwap, AssetSwapRepository, type AssetSwapRestoreChange, CROSS_ASSET_RAIL, ChainSource, type ClaimArkProvider, type ClaimPacketInput, type CovclaimdClient, type CovclaimdInfo, CovclaimdRevealError, type CrossAssetPhase, type CrossAssetRailDeps, type CrossAssetSwap, type DiscoverMarketsOptions, type FillFunding, IndexedDbAssetSwapRepository, InvoiceFacts, type LightningReceiveProfile, type LightningSendProfile, LockupAmountMismatchError, LockupContractMissing, type LockupContractReader, type LockupContractWriter, LockupRegistrationFailed, LockupSpendIndexer, LockupVtxo, MARKET_CORRIDORS, type MarketCorridor, type MarketLike, MarketsCacheEntry, OFFER_PACKET_TYPE, type Offer, type OfferContractRetirer, type OfferSwapWatcher, OnchainHtlc, OnchainHtlcParams, OnchainNetwork, type OnchainSendProfile, type PlanError, QUOTE_OPTIONS, RefundArkProvider, type RefundBlockedReason, RefundIndexer, RefundNotLocallyPossibleError, type RegisterAssetSwapRestoreOptions, type RestoreAssetSwapRepositoryOptions, type RestoreAssetSwapRepositoryResult, type RestoreIndexer, type RevealParams, type RfqClaimSecretProjection, type RfqHashlockProjection, type RfqSignerProjection, RfqSwap, type RfqSwapActivityDeps, RfqSwapRecord, RfqSwapState, RfqTransport, SOLVER_LIGHTNING_RAIL, SOLVER_ONCHAIN_RAIL, SWAP_LOCKUP_CONTRACT_KIND, SWAP_LOCKUP_CONTRACT_LABEL, SWAP_LOCKUP_CONTRACT_TYPE, type SealedClaimPacket, type SolverLightningRailDeps, type SolverLightningSend, type SolverOnchainRailDeps, type SolverOnchainSend, type SolverRendezvous, type SpendKind, type SwapActivityInput, SwapSecretsProjection, type Tx, type WatchOfferSwapsParams, arkadeRefunder, awaitLockupFunding, cancelOffer, chainSourceFrom, claimReceiveLockup, classifyDepositSpend, classifySpend, covclaimdClient, createOffer, crossAssetRail, decodeOffer, discoverMarkets, encodeOffer, fillOffer, findMarket, isRfqMarket, lockupContractParams, makeCachedFeedFetch, marketAssetId, marketCorridor, marketPairLabel, offerVtxoScript, onchainSendProfile, pushClaim, registerAssetSwapRestore, registerLockupContract, requestLightningSend, requestOnchainSend, restoreAssetSwapRepository, restoreAssetSwaps, restoreOfferCoverage, retireSettledOfferContracts, revealClaimPacket, revealFieldsFromScript, rfqClaimSecretOf, rfqSecretsProfile, rfqSignerOf, rfqSwapActivityInputs, sealClaimPacket, senderIdentityForSwapRecord, solverLightningRail, solverLightningRendezvous, solverOnchainRail, solverOnchainRendezvous, solverRendezvous, spendTxidsOf, spendUpdate, swapActivityResolver, swapPrograms, validatePlan, watchOfferSwaps };

package/dist/index.d.ts

@@ -1,9 +1,9 @@
-import { ProvisionedKey, ProvisionedClaimSecret, asset, RelativeTimelock, IWallet, arkade, RestIndexerProvider, Transaction, IContractManager, OnchainProvider, PaymentRail, Asset, VHTLC, Identity, ActivityResolver } from '@arkade-os/sdk';
-import { S as SwapSecretsProjection, R as RfqSwapRecord, A as AssetSwapRepository, a as AssetSwap, M as MarketsCacheEntry, b as RefundArkProvider, c as RefundIndexer, L as LockupVtxo, d as RfqSwap, e as ArkadeRefundResult, f as LockupSpendIndexer, g as RfqSwapState } from './repository-D5JoeqwB.js';
-export { h as AssetSwapStatus, i as AvailableRfqSwapManagerCallbacks, B as BTC_ASSET_ID, I as InMemoryAssetSwapRepository, j as LightningReceiveSwap, k as LightningSendSwap, l as LockupFate, m as LockupNeedsRecoveryError, n as LockupParams, o as LockupSpend, O as OnchainSendAction, p as OnchainSendSwap, P as PersistableRfqSwap, q as PreimageBlockedReason, r as PreimageNotRecoverableError, s as REFUND_MTP_LAG_SECONDS, t as RFQ_RESOLVED_STATES, u as RFQ_SWAP_RETENTION_SECONDS, v as RFQ_SWAP_TERMINAL_STATES, w as RefundOutcome, x as RfqRestoreFailure, y as RfqRestoreOptions, z as RfqRestoreResult, C as RfqSwapActionName, D as RfqSwapLockup, E as RfqSwapManager, F as RfqSwapManagerCallbacks, G as RfqSwapManagerConfig, H as RfqSwapManagerDeps, J as RfqSwapManagerEvents, K as RfqSwapOrigin, N as RfqSwapOriginRequired, Q as RfqSwapOutcome, T as RfqSwapRecordStore, U as SwapContractRegistry, V as addAssetSwap, W as awaitRfqResolution, X as createRfqSwapRecord, Y as findLockupVtxos, Z as getAssetSwaps, _ as getAssetSwapsOrThrow, $ as isRfqSwapTerminal, a0 as isRfqTerminal, a1 as nextOnchainAction, a2 as preimageForSwapRecord, a3 as pushRefundWithoutReceiver, a4 as readLockupFate, a5 as rebuildRfqSwap, a6 as refundIfUnresolved, a7 as rfqSwapOriginOf, a8 as shouldRetainRfqSwap, a9 as swapSecretsToRecord, aa as updateAssetSwap, ab as updateAssetSwapBestEffort, ac as updateRfqSwapRecord } from './repository-D5JoeqwB.js';
+import { ProvisionedKey, ProvisionedClaimSecret, ArkTxInput, asset, RelativeTimelock, IWallet, EmulatorProvider, arkade, RestIndexerProvider, Transaction, IContractManager, OnchainProvider, PaymentRail, Asset, VHTLC, Identity, ActivityResolver } from '@arkade-os/sdk';
+import { S as SwapSecretsProjection, R as RfqSwapRecord, A as AssetSwapRepository, a as AssetSwap, M as MarketsCacheEntry, b as RefundArkProvider, c as RefundIndexer, L as LockupVtxo, d as RfqSwap, e as ArkadeRefundResult, f as LockupSpendIndexer, g as RfqSwapState } from './repository-DH5zjdw4.js';
+export { h as AssetSwapStatus, i as AvailableRfqSwapManagerCallbacks, B as BTC_ASSET_ID, I as InMemoryAssetSwapRepository, j as LightningReceiveSwap, k as LightningSendSwap, l as LockupFate, m as LockupNeedsRecoveryError, n as LockupParams, o as LockupSpend, O as OnchainSendAction, p as OnchainSendSwap, P as PersistableRfqSwap, q as PreimageBlockedReason, r as PreimageNotRecoverableError, s as REFUND_MTP_LAG_SECONDS, t as RFQ_RESOLVED_STATES, u as RFQ_SWAP_RETENTION_SECONDS, v as RFQ_SWAP_TERMINAL_STATES, w as RefundOutcome, x as RfqRestoreFailure, y as RfqRestoreOptions, z as RfqRestoreResult, C as RfqSwapActionName, D as RfqSwapLockup, E as RfqSwapManager, F as RfqSwapManagerCallbacks, G as RfqSwapManagerConfig, H as RfqSwapManagerDeps, J as RfqSwapManagerEvents, K as RfqSwapOrigin, N as RfqSwapOriginRequired, Q as RfqSwapOutcome, T as RfqSwapRecordStore, U as SwapContractRegistry, V as addAssetSwap, W as awaitRfqResolution, X as createRfqSwapRecord, Y as findLockupVtxos, Z as getAssetSwaps, _ as getAssetSwapsOrThrow, $ as isRfqSwapTerminal, a0 as isRfqTerminal, a1 as nextOnchainAction, a2 as preimageForSwapRecord, a3 as pushRefundWithoutReceiver, a4 as readLockupFate, a5 as rebuildRfqSwap, a6 as refundIfUnresolved, a7 as rfqSwapOriginOf, a8 as shouldRetainRfqSwap, a9 as swapSecretsToRecord, aa as updateAssetSwap, ab as updateAssetSwapBestEffort, ac as updateRfqSwapRecord } from './repository-DH5zjdw4.js';
 import { Network, LocalCardInput, DiscoveredMarket, Side, OfferPlan } from '@arkade-os/solver-discovery';
-import { O as OnchainNetwork, a as OnchainHtlc, b as OnchainHtlcParams, C as ChainSource, R as RfqTransport, r as requestOnchainSend, I as InvoiceFacts, c as requestLightningSend } from './rfq-CYfKvAPp.js';
-export { A as ARKADE_ASSET, d as ARKADE_BTC, e as AddressMismatch, f as ChainUtxo, H as HtlcUtxo, L as LIGHTNING_BTC, g as LIGHTNING_RECEIVE_PAIR, h as LIGHTNING_SEND_PAIR, i as LOCKTIME_THRESHOLD, j as LightningReceiveTreeParams, k as LightningSendTreeParams, M as MAX_MIN_CONFIRMATIONS, l as MIN_CLAIM_WINDOW_SECONDS, m as MIN_HEADROOM_SECONDS, n as ONCHAIN_BTC, o as ONCHAIN_CLAIM_MARGIN_SECONDS, p as ONCHAIN_DUST_SATS, q as ONCHAIN_ORDER_MARGIN_SECONDS, s as ONCHAIN_RECEIVE_PAIR, t as ONCHAIN_SECONDS_PER_BLOCK, u as ONCHAIN_SEND_PAIR, v as OnchainHtlcPhase, w as RFQ_TERMINAL_STATES, x as RelaySocket, y as RfqQuote, z as RfqRefusalReason, B as RfqStatus, S as SOLO_REFUND_HEADROOM_SECONDS, D as SwapRefusal, E as arkadeAssetLeg, F as arkadeSwapRequest, G as assertFundable, J as assertReceivable, K as awaitOnchainFill, N as buildHtlcClaim, P as buildHtlcRefund, Q as claimOnchainFill, T as classifyOnchainHtlc, U as deriveLightningReceive, V as deriveOnchainReceive, W as deriveOnchainSend, X as extractPreimage, Y as httpTransport, Z as l1ScriptForAddress, _ as lightningReceiveRequest, $ as lightningSendRequest, a0 as lightningSendVtxoScript, a1 as newPreimage, a2 as newRfqId, a3 as offerTermsFromQuote, a4 as onchainHtlcScript, a5 as onchainReceiveRequest, a6 as onchainSendRequest, a7 as paymentHashOf, a8 as receiveVtxoScript, a9 as relayTransport, aa as requestLightningReceive, ab as requestOnchainReceive, ac as rfqPair, ad as unilateralClaimDelay, ae as unilateralRefundDelay, af as unilateralRefundWithoutReceiverDelay, ag as verifyLockupAddress, ah as verifyReceiveInvoice } from './rfq-CYfKvAPp.js';
+import { O as OnchainNetwork, a as OnchainHtlc, b as OnchainHtlcParams, C as ChainSource, R as RfqTransport, r as requestOnchainSend, I as InvoiceFacts, c as requestLightningSend } from './rfq-DirJn_4k.js';
+export { A as ARKADE_ASSET, d as ARKADE_BTC, e as AddressMismatch, f as ChainUtxo, H as HtlcUtxo, L as LIGHTNING_BTC, g as LIGHTNING_RECEIVE_PAIR, h as LIGHTNING_SEND_PAIR, i as LOCKTIME_THRESHOLD, j as LightningReceiveTreeParams, k as LightningSendTreeParams, M as MAX_MIN_CONFIRMATIONS, l as MIN_CLAIM_WINDOW_SECONDS, m as MIN_HEADROOM_SECONDS, n as ONCHAIN_BTC, o as ONCHAIN_CLAIM_MARGIN_SECONDS, p as ONCHAIN_DUST_SATS, q as ONCHAIN_ORDER_MARGIN_SECONDS, s as ONCHAIN_RECEIVE_PAIR, t as ONCHAIN_SECONDS_PER_BLOCK, u as ONCHAIN_SEND_PAIR, v as OnchainHtlcPhase, w as RFQ_REFUSAL_ERROR_CODES, x as RFQ_TERMINAL_STATES, y as RelaySocket, z as RfqQuote, B as RfqRefusalDetail, D as RfqRefusalErrorCode, E as RfqRefusalReason, F as RfqRefusalUnit, G as RfqStatus, S as SOLO_REFUND_HEADROOM_SECONDS, J as SwapRefusal, K as arkadeAssetLeg, N as arkadeSwapRequest, P as assertFundable, Q as assertReceivable, T as awaitOnchainFill, U as buildHtlcClaim, V as buildHtlcRefund, W as claimOnchainFill, X as classifyOnchainHtlc, Y as deriveLightningReceive, Z as deriveOnchainReceive, _ as deriveOnchainSend, $ as extractPreimage, a0 as httpTransport, a1 as isRfqRefusalErrorCode, a2 as l1ScriptForAddress, a3 as lightningReceiveRequest, a4 as lightningSendRequest, a5 as lightningSendVtxoScript, a6 as newPreimage, a7 as newRfqId, a8 as offerTermsFromQuote, a9 as onchainHtlcScript, aa as onchainReceiveRequest, ab as onchainSendRequest, ac as paymentHashOf, ad as receiveVtxoScript, ae as relayTransport, af as requestLightningReceive, ag as requestOnchainReceive, ah as rfqPair, ai as unilateralClaimDelay, aj as unilateralRefundDelay, ak as unilateralRefundWithoutReceiverDelay, al as verifyLockupAddress, am as verifyReceiveInvoice } from './rfq-DirJn_4k.js';
 
 /**
  * Which wallet key signs this leg. Stored at `profile.signer`.
@@ -235,6 +235,22 @@ declare const OFFER_PACKET_TYPE = 3;
 declare function encodeOffer(offer: Offer): Uint8Array;
 /** Parse TLV bytes into an offer. Throws on malformed or unknown records. */
 declare function decodeOffer(data: Uint8Array): Offer;
+/**
+ * Put the covenants of restored swap records back in the watched set.
+ *
+ * {@link restoreAssetSwaps} rebuilds the *record* and nothing else, so a
+ * restored wallet holds swaps with no contract row behind them — never
+ * subscribed, never emitting `vtxo_spent`, unresolvable by the watcher. The
+ * restore-scan backstop three modules lean on restores records, not coverage.
+ * Separate from that scan, which is indexer-only and whose records must survive
+ * a coverage failure. A script whose every record is {@link RETIRABLE} is
+ * skipped, or this undoes {@link retireSettledOfferContracts}. One client, one
+ * manager and one `createContracts` for the batch, so N covenants cost one
+ * indexer round trip. A covenant that no longer derives is skipped; a dead
+ * server or store is not — it covered nothing, and saying otherwise stops the
+ * caller retrying.
+ */
+declare function restoreOfferCoverage(wallet: IWallet, arkServerUrl: string, swaps: AssetSwap[]): Promise<void>;
 /**
  * Build a new offer for `wallet` (the user). Fund `address` with the side
  * you deposit, embedding the returned extension, and the solver does the rest:
@@ -360,6 +376,95 @@ declare function cancelOffer(wallet: IWallet, arkServerUrl: string, offerHex: st
     fundingTxid?: string;
     swapAddress?: string;
 }): Promise<string>;
+/** Sats output 0 carries when the maker is paid in an ASSET rather than sats:
+ * the covenant checks the asset there, and the output still needs a carrier of
+ * its own. Overridable per fill via `assetCarrierSats`.
+ *
+ * Derived from the SDK's constant rather than restated, so the two spellings of
+ * one dust threshold cannot drift apart; `bigint` only because this package's
+ * amounts are. */
+declare const ASSET_CARRIER_SATS: bigint;
+/**
+ * A coin the taker supplies, plus whatever assets it carries.
+ *
+ * `ArkTxInput` describes sats only, so the assets have to be declared — this is
+ * the one thing a fill cannot discover for itself, and omitting it is not
+ * cosmetic. **arkd refuses a spend whose asset packet omits an asset one of its
+ * inputs owns** (`ASSET_NOT_FOUND`), so a coin picked for its sats that happens
+ * to carry an asset takes the whole fill down unless it is named here. A
+ * wallet's own coins already carry `assets` in this shape.
+ */
+type FillFunding = ArkTxInput & {
+    assets?: readonly {
+        assetId: string;
+        amount: bigint | number;
+    }[];
+};
+/**
+ * Fill an offer — the TAKER's side, and the counterpart to {@link createOffer}.
+ *
+ * The covenant's `fulfill` leaf is signed by the server alone and constrains the
+ * spend to pay output 0 at least `wantAmount` to the maker's witness program, so
+ * a taker cannot take the deposit without delivering. This composes that spend;
+ * it does not weaken or reinterpret the covenant.
+ *
+ * **Both want sides.** For a BTC want output 0 pays `wantAmount` sats. For an
+ * ASSET want the covenant reads output 0 through `OP_INSPECTOUTASSETLOOKUP` with
+ * `lookup_index = 0`, so the wanted asset must be the FIRST group in the packet
+ * and output 0 carries only a dust sat carrier ({@link ASSET_CARRIER_SATS}).
+ * Group order follows the order the groups are added, which is why the wanted
+ * asset is added first — reordering it silently breaks the covenant.
+ *
+ * Every other asset in the spend — the deposit's own, and any the taker's
+ * funding coins carry — is routed to the taker's payout. Declaring those is not
+ * optional; see {@link FillFunding}.
+ *
+ * Unlike {@link cancelOffer} this writes NO local swap record. A taker filling
+ * someone else's offer has no row to update — the repository dance there belongs
+ * to the funder, whose swap it is. The maker learns the outcome from the chain
+ * (`classifySpend`), which is the design § 7.2 of the RFQ protocol describes.
+ *
+ * `fund` is required and explicit rather than selected here. Coin selection is
+ * the caller's: only they know which coins are reserved for other flows, and a
+ * helper that picked for them would spend a corridor's float out from under it.
+ * The coins become inputs 1..n and are signed with the wallet's identity.
+ *
+ * `payoutScript` is where the taker's proceeds land — the deposit it just took,
+ * plus any surplus over `wantAmount`. Defaults to the wallet's own address.
+ *
+ * Racing a cancel is a NORMAL outcome, not a failure: cancel is a 2-of-2 of the
+ * funder and the server and does not involve the taker, so a funder may cancel
+ * between this reading the deposit and broadcasting. That surfaces the same way
+ * cancel's own race does — "no spendable VTXO at the swap address" — and a
+ * caller should treat it as "the offer is gone", not as an error to retry.
+ */
+declare function fillOffer(wallet: IWallet, arkServerUrl: string, offerHex: string, opts: {
+    /** Coins the taker supplies to pay `wantAmount`, with any assets they
+     * carry. Become inputs 1..n. @see FillFunding */
+    fund: FillFunding[];
+    /** Where the taker's proceeds land. Defaults to the wallet's own address. */
+    payoutScript?: Uint8Array;
+    /** Selects the deposit when the swap address holds more than one. */
+    fundingTxid?: string;
+    /** The funded address, to pin the server key the covenant was built with. */
+    swapAddress?: string;
+    /** Sats at output 0 on an asset want. Defaults to {@link ASSET_CARRIER_SATS};
+     * raise it for a server whose dust threshold is higher. */
+    assetCarrierSats?: bigint;
+    /**
+     * The co-signing service — a base URL, or a provider of your own.
+     *
+     * Required, with no default: `fulfill` is a covenant path, so the
+     * emulator is what executes the arkade script and finalizes the spend
+     * with arkd. A client without one builds the transaction and then
+     * refuses to submit it.
+     */
+    emulator: EmulatorProvider | string;
+    /** Co-signer key override (33-byte compressed hex), as `createOffer`
+     * takes. Needed on a network the SDK pins no emulator key for, where
+     * connecting with an emulator otherwise throws. */
+    emulatorPubkey?: string;
+}): Promise<string>;
 
 /**
  * Quoting: solver discovery and the pricing guardrails around a plan.
@@ -434,6 +539,19 @@ type PlanError = "insufficient-balance" | "side-disabled" | "below-min" | "above
 /** Validate a plan against the user's balance and the server dust limit. */
 declare const validatePlan: (plan: OfferPlan, giveBalance: bigint, dust: bigint) => PlanError | undefined;
 
+declare const MARKET_CORRIDORS: readonly ["arkade", "bolt11", "bitcoin", "eip155"];
+type MarketCorridor = (typeof MARKET_CORRIDORS)[number];
+type MarketLike = {
+    base_asset?: unknown;
+    quote_asset?: unknown;
+    base_corridor?: unknown;
+    quote_corridor?: unknown;
+};
+declare const marketAssetId: (market: MarketLike, side: Side) => string | undefined;
+declare const marketCorridor: (market: MarketLike, side: Side) => MarketCorridor;
+declare const isRfqMarket: (market: MarketLike) => boolean;
+declare const marketPairLabel: (market: MarketLike) => string;
+
 /** Browser backend over the SDK's shared IndexedDB manager — the same
  * infrastructure the wallet already uses for its Boltz swap repository. */
 declare class IndexedDbAssetSwapRepository implements AssetSwapRepository {
@@ -578,15 +696,80 @@ declare function classifyDepositSpend(offer: Offer, serverPubkey: Uint8Array, sp
  * `serverPubkey` must be the server key the covenants were funded against; a
  * key that has rotated since makes every affected swap unclassifiable rather
  * than misclassified.
+ *
+ * ## `reopen`: re-asking a record this left pending
+ *
+ * A run finding the deposit unspent returns `pending` *and* marks the funding
+ * txid scanned, so the natural call asks once and never again — `pending` is the
+ * absence of an answer. Pass those records as `reopen`: re-answered from stored
+ * `offerHex`, no funding fetch, skip lists unchanged, definite outcomes only.
  */
 declare function restoreAssetSwaps(indexer: RestoreIndexer, txs: Tx[], existingIds: ReadonlySet<string>, opts: {
     serverPubkey: Uint8Array;
     scanned?: ReadonlySet<string>;
+    reopen?: AssetSwap[];
 }): Promise<{
     restored: AssetSwap[];
     scannedTxids: string[];
 }>;
 
+interface AssetSwapRestoreChange {
+    /** The stored record before this restore; absent for a rebuilt record. */
+    previous?: AssetSwap;
+    /** The record persisted by this restore. */
+    current: AssetSwap;
+}
+interface RestoreAssetSwapRepositoryOptions {
+    wallet: IWallet;
+    arkServerUrl: string;
+    indexer: RestoreIndexer;
+    repository: AssetSwapRepository;
+    txs: Tx[];
+    /** The server key the restored covenants were funded against, x-only. */
+    serverPubkey: Uint8Array;
+    /** Add consumer-owned metadata to a newly rebuilt record before it is saved. */
+    prepareNew?: (swap: AssetSwap) => AssetSwap | Promise<AssetSwap>;
+    /** Stops repository writes and coverage work after an in-flight scan returns. */
+    signal?: AbortSignal;
+}
+interface RestoreAssetSwapRepositoryResult {
+    /** The repository's newest-first state after this operation. */
+    swaps: AssetSwap[];
+    /** Every record this operation inserted or updated. */
+    changes: AssetSwapRestoreChange[];
+    /** Funding txids newly added to the durable scan cursor. */
+    scannedTxids: string[];
+    /** Set when the caller cancelled before the operation could commit. */
+    aborted: boolean;
+    /** Coverage setup failed after records were safely persisted. Retry is safe. */
+    coverageError?: unknown;
+}
+/**
+ * Restore the durable asset-swap state for one wallet.
+ *
+ * This is the consumer entry point above the two lower-level recovery
+ * primitives: it reads the repository, reopens every live record, persists
+ * rebuilt records and outcomes before advancing the scan cursor, then restores
+ * the wallet-contract coverage needed by the live watcher. Consumers keep only
+ * presentation work (for example decorating a new record or announcing a
+ * returned change).
+ *
+ * Scan and persistence failures reject. Coverage setup is different: records
+ * are already safe by then, so its error is returned as `coverageError` and a
+ * later call can retry without losing or duplicating anything.
+ */
+declare function restoreAssetSwapRepository(opts: RestoreAssetSwapRepositoryOptions): Promise<RestoreAssetSwapRepositoryResult>;
+
+interface RegisterAssetSwapRestoreOptions {
+    arkServerUrl: string;
+    repository: AssetSwapRepository;
+    indexer?: RestoreIndexer;
+    serverPubkey?: Uint8Array;
+    prepareNew?: RestoreAssetSwapRepositoryOptions["prepareNew"];
+    onResult?: (result: RestoreAssetSwapRepositoryResult) => void | Promise<void>;
+}
+declare function registerAssetSwapRestore(wallet: IWallet, options: RegisterAssetSwapRestoreOptions): () => void;
+
 /**
  * The record change a classified spend implies, or `undefined` when it implies
  * none — an already-resolved swap, or a spend nobody could classify.
@@ -622,9 +805,9 @@ interface WatchOfferSwapsParams {
  * registered covenant is watched, so only registered offers produce events.
  * Offers funded before registration existed stay on the restore scan.
  *
- * This depends on the wallet's contract event transport. In Node, callers must
- * provide an `EventSource` implementation or use a runtime where it is enabled;
- * otherwise live updates do not arrive and restore remains the fallback.
+ * *Live* updates depend on the wallet's contract event transport. In Node,
+ * callers must provide an `EventSource` implementation or use a runtime where
+ * it is enabled. The start-up pass needs none of it.
  */
 declare function watchOfferSwaps({ wallet, arkServerUrl, repository, onUpdate, }: WatchOfferSwapsParams): Promise<OfferSwapWatcher>;
 
@@ -1258,4 +1441,4 @@ interface RfqSwapActivityDeps {
  */
 declare function rfqSwapActivityInputs(deps: RfqSwapActivityDeps): Promise<SwapActivityInput[]>;
 
-export { ArkadeRefundResult, type ArkadeRefunderDeps, AssetSwap, AssetSwapRepository, CROSS_ASSET_RAIL, ChainSource, type ClaimArkProvider, type ClaimPacketInput, type CovclaimdClient, type CovclaimdInfo, CovclaimdRevealError, type CrossAssetPhase, type CrossAssetRailDeps, type CrossAssetSwap, type DiscoverMarketsOptions, IndexedDbAssetSwapRepository, InvoiceFacts, type LightningReceiveProfile, type LightningSendProfile, LockupAmountMismatchError, LockupContractMissing, type LockupContractReader, type LockupContractWriter, LockupRegistrationFailed, LockupSpendIndexer, LockupVtxo, MarketsCacheEntry, OFFER_PACKET_TYPE, type Offer, type OfferContractRetirer, type OfferSwapWatcher, OnchainHtlc, OnchainHtlcParams, OnchainNetwork, type OnchainSendProfile, type PlanError, QUOTE_OPTIONS, RefundArkProvider, type RefundBlockedReason, RefundIndexer, RefundNotLocallyPossibleError, type RestoreIndexer, type RevealParams, type RfqClaimSecretProjection, type RfqHashlockProjection, type RfqSignerProjection, RfqSwap, type RfqSwapActivityDeps, RfqSwapRecord, RfqSwapState, RfqTransport, SOLVER_LIGHTNING_RAIL, SOLVER_ONCHAIN_RAIL, SWAP_LOCKUP_CONTRACT_KIND, SWAP_LOCKUP_CONTRACT_LABEL, SWAP_LOCKUP_CONTRACT_TYPE, type SealedClaimPacket, type SolverLightningRailDeps, type SolverLightningSend, type SolverOnchainRailDeps, type SolverOnchainSend, type SolverRendezvous, type SpendKind, type SwapActivityInput, SwapSecretsProjection, type Tx, type WatchOfferSwapsParams, arkadeRefunder, awaitLockupFunding, cancelOffer, chainSourceFrom, claimReceiveLockup, classifyDepositSpend, classifySpend, covclaimdClient, createOffer, crossAssetRail, decodeOffer, discoverMarkets, encodeOffer, findMarket, lockupContractParams, makeCachedFeedFetch, offerVtxoScript, onchainSendProfile, pushClaim, registerLockupContract, requestLightningSend, requestOnchainSend, restoreAssetSwaps, retireSettledOfferContracts, revealClaimPacket, revealFieldsFromScript, rfqClaimSecretOf, rfqSecretsProfile, rfqSignerOf, rfqSwapActivityInputs, sealClaimPacket, senderIdentityForSwapRecord, solverLightningRail, solverLightningRendezvous, solverOnchainRail, solverOnchainRendezvous, solverRendezvous, spendTxidsOf, spendUpdate, swapActivityResolver, swapPrograms, validatePlan, watchOfferSwaps };
+export { ASSET_CARRIER_SATS, ArkadeRefundResult, type ArkadeRefunderDeps, AssetSwap, AssetSwapRepository, type AssetSwapRestoreChange, CROSS_ASSET_RAIL, ChainSource, type ClaimArkProvider, type ClaimPacketInput, type CovclaimdClient, type CovclaimdInfo, CovclaimdRevealError, type CrossAssetPhase, type CrossAssetRailDeps, type CrossAssetSwap, type DiscoverMarketsOptions, type FillFunding, IndexedDbAssetSwapRepository, InvoiceFacts, type LightningReceiveProfile, type LightningSendProfile, LockupAmountMismatchError, LockupContractMissing, type LockupContractReader, type LockupContractWriter, LockupRegistrationFailed, LockupSpendIndexer, LockupVtxo, MARKET_CORRIDORS, type MarketCorridor, type MarketLike, MarketsCacheEntry, OFFER_PACKET_TYPE, type Offer, type OfferContractRetirer, type OfferSwapWatcher, OnchainHtlc, OnchainHtlcParams, OnchainNetwork, type OnchainSendProfile, type PlanError, QUOTE_OPTIONS, RefundArkProvider, type RefundBlockedReason, RefundIndexer, RefundNotLocallyPossibleError, type RegisterAssetSwapRestoreOptions, type RestoreAssetSwapRepositoryOptions, type RestoreAssetSwapRepositoryResult, type RestoreIndexer, type RevealParams, type RfqClaimSecretProjection, type RfqHashlockProjection, type RfqSignerProjection, RfqSwap, type RfqSwapActivityDeps, RfqSwapRecord, RfqSwapState, RfqTransport, SOLVER_LIGHTNING_RAIL, SOLVER_ONCHAIN_RAIL, SWAP_LOCKUP_CONTRACT_KIND, SWAP_LOCKUP_CONTRACT_LABEL, SWAP_LOCKUP_CONTRACT_TYPE, type SealedClaimPacket, type SolverLightningRailDeps, type SolverLightningSend, type SolverOnchainRailDeps, type SolverOnchainSend, type SolverRendezvous, type SpendKind, type SwapActivityInput, SwapSecretsProjection, type Tx, type WatchOfferSwapsParams, arkadeRefunder, awaitLockupFunding, cancelOffer, chainSourceFrom, claimReceiveLockup, classifyDepositSpend, classifySpend, covclaimdClient, createOffer, crossAssetRail, decodeOffer, discoverMarkets, encodeOffer, fillOffer, findMarket, isRfqMarket, lockupContractParams, makeCachedFeedFetch, marketAssetId, marketCorridor, marketPairLabel, offerVtxoScript, onchainSendProfile, pushClaim, registerAssetSwapRestore, registerLockupContract, requestLightningSend, requestOnchainSend, restoreAssetSwapRepository, restoreAssetSwaps, restoreOfferCoverage, retireSettledOfferContracts, revealClaimPacket, revealFieldsFromScript, rfqClaimSecretOf, rfqSecretsProfile, rfqSignerOf, rfqSwapActivityInputs, sealClaimPacket, senderIdentityForSwapRecord, solverLightningRail, solverLightningRendezvous, solverOnchainRail, solverOnchainRendezvous, solverRendezvous, spendTxidsOf, spendUpdate, swapActivityResolver, swapPrograms, validatePlan, watchOfferSwaps };