@arkade-os/swap 0.0.3 → 0.0.4

package/dist/index.d.cts

@@ -1,7 +1,152 @@
-import { asset, IWallet, arkade, RestIndexerProvider, Transaction, IContractManager, RestArkProvider, VHTLC, Identity } from '@arkade-os/sdk';
-import { A as AssetSwapRepository, a as AssetSwap, M as MarketsCacheEntry, R as RfqStatus, b as RfqTransport, O as OnchainHtlc, C as ChainSource, c as ChainUtxo, d as OnchainHtlcPhase } from './rfq-CCAFoFtR.cjs';
-export { e as ARKADE_ASSET, f as ARKADE_BTC, g as AddressMismatch, h as AssetSwapFallbackSecrets, i as AssetSwapStatus, B as BTC_ASSET_ID, D as DerivedSwapSecrets, j as DeterministicSigner, H as HtlcUtxo, I as InMemoryAssetSwapRepository, k as InvoiceFacts, L as LIGHTNING_BTC, l as LIGHTNING_RECEIVE_PAIR, m as LIGHTNING_SEND_PAIR, n as MAX_MIN_CONFIRMATIONS, o as MIN_CLAIM_WINDOW_SECONDS, p as MIN_HEADROOM_SECONDS, q as ONCHAIN_BTC, r as ONCHAIN_CLAIM_MARGIN_SECONDS, s as ONCHAIN_DUST_SATS, t as ONCHAIN_ORDER_MARGIN_SECONDS, u as ONCHAIN_RECEIVE_PAIR, v as ONCHAIN_SECONDS_PER_BLOCK, w as ONCHAIN_SEND_PAIR, x as OnchainHtlcParams, y as OnchainNetwork, z as RFQ_PREIMAGE_TAG, E as RFQ_TERMINAL_STATES, F as RefundBlockedReason, G as RefundNotLocallyPossibleError, J as RelaySocket, K as RfqQuote, N as RfqRefusalReason, S as StoredSwapSecrets, P as SwapRefusal, Q as SwapSecrets, T as addAssetSwap, U as adoptSwapDescriptor, V as arkadeSwapRequest, W as assertFundable, X as assertReceivable, Y as awaitOnchainFill, Z as buildHtlcClaim, _ as buildHtlcRefund, $ as buildPreimageMessage, a0 as claimOnchainFill, a1 as classifyOnchainHtlc, a2 as deriveLightningReceive, a3 as deriveOnchainReceive, a4 as deriveOnchainSend, a5 as derivePreimage, a6 as deriveSwapSecrets, a7 as extractPreimage, a8 as getAssetSwaps, a9 as getAssetSwapsOrThrow, aa as httpTransport, ab as isDeterministicSigner, ac as lightningReceiveRequest, ad as lightningSendRequest, ae as lightningSendVtxoScript, af as newPreimage, ag as newRfqId, ah as offerTermsFromQuote, ai as onchainHtlcScript, aj as onchainReceiveRequest, ak as onchainSendRequest, al as paymentHashOf, am as preimageForRfqSecrets, an as randomSwapSecrets, ao as receiveVtxoScript, ap as relayTransport, aq as requestLightningReceive, ar as requestLightningSend, as as requestOnchainReceive, at as requestOnchainSend, au as rfqPair, av as rfqSecretsOfRecord, aw as rfqSecretsToRecord, ax as senderIdentityForRfqSecrets, ay as senderIdentityForSwapRecord, az as senderPubkeyForRfqSecrets, aA as unilateralClaimDelay, aB as unilateralRefundDelay, aC as unilateralRefundWithoutReceiverDelay, aD as updateAssetSwap, aE as updateAssetSwapBestEffort, aF as verifyLockupAddress, aG as verifyReceiveInvoice } from './rfq-CCAFoFtR.cjs';
-import { Network, LocalCardInput, DiscoveredMarket, Side, OfferPlan } from '@arkade-os/solver-discovery';
+import { ProvisionedKey, ProvisionedClaimSecret, asset, IWallet, arkade, RestIndexerProvider, Transaction, IContractManager, RestArkProvider, VHTLC, Identity } from '@arkade-os/sdk';
+import { DiscoveredMarket, Network, LocalCardInput, Side, OfferPlan } from '@arkade-os/solver-discovery';
+import { R as RfqStatus, a as RfqTransport, O as OnchainHtlc, C as ChainSource, b as ChainUtxo, c as OnchainHtlcPhase } from './rfq-DjZlesr4.cjs';
+export { A as ARKADE_ASSET, d as ARKADE_BTC, e as AddressMismatch, H as HtlcUtxo, I as InvoiceFacts, L as LIGHTNING_BTC, f as LIGHTNING_RECEIVE_PAIR, g as LIGHTNING_SEND_PAIR, M as MAX_MIN_CONFIRMATIONS, h as MIN_CLAIM_WINDOW_SECONDS, i as MIN_HEADROOM_SECONDS, j as ONCHAIN_BTC, k as ONCHAIN_CLAIM_MARGIN_SECONDS, l as ONCHAIN_DUST_SATS, m as ONCHAIN_ORDER_MARGIN_SECONDS, n as ONCHAIN_RECEIVE_PAIR, o as ONCHAIN_SECONDS_PER_BLOCK, p as ONCHAIN_SEND_PAIR, q as OnchainHtlcParams, r as OnchainNetwork, s as RFQ_TERMINAL_STATES, t as RelaySocket, u as RfqQuote, v as RfqRefusalReason, S as SwapRefusal, w as arkadeSwapRequest, x as assertFundable, y as assertReceivable, z as awaitOnchainFill, B as buildHtlcClaim, D as buildHtlcRefund, E as claimOnchainFill, F as classifyOnchainHtlc, G as deriveLightningReceive, J as deriveOnchainReceive, K as deriveOnchainSend, N as extractPreimage, P as httpTransport, Q as lightningReceiveRequest, T as lightningSendRequest, U as lightningSendVtxoScript, V as newPreimage, W as newRfqId, X as offerTermsFromQuote, Y as onchainHtlcScript, Z as onchainReceiveRequest, _ as onchainSendRequest, $ as paymentHashOf, a0 as receiveVtxoScript, a1 as relayTransport, a2 as requestLightningReceive, a3 as requestLightningSend, a4 as requestOnchainReceive, a5 as requestOnchainSend, a6 as rfqPair, a7 as unilateralClaimDelay, a8 as unilateralRefundDelay, a9 as unilateralRefundWithoutReceiverDelay, aa as verifyLockupAddress, ab as verifyReceiveInvoice } from './rfq-DjZlesr4.cjs';
+
+type AssetSwapStatus = "pending" | "cancelling" | "fulfilled" | "cancelled" | "recoverable" | "awaiting_fill" | "claimable" | "claimed" | "refunded_l1";
+/** The sentinel asset id for BTC itself, as opposed to a 68-hex asset id.
+ * Lives here with the {@link AssetSwap} fields it describes so the market and
+ * restore layers share one spelling instead of re-typing the literal. */
+declare const BTC_ASSET_ID = "btc";
+interface AssetSwap {
+    /** Funding txid — the swap's identity. */
+    id: string;
+    /** 'btc' or a 68-hex asset id. */
+    fromAsset: string;
+    toAsset: string;
+    /** Atomic amounts as strings (bigint is not JSON-safe). */
+    fromAmount: string;
+    /** The covenant wantAmount — a floor, the fill pays >= this. */
+    toAmount: string;
+    swapAddress: string;
+    /** Hex pkScript of the swap contract — the indexer monitoring key. */
+    swapPkScript: string;
+    /** TLV offer — needed to rebuild the contract for cancel. */
+    offerHex: string;
+    fundingTxid: string;
+    spentTxid?: string;
+    status: AssetSwapStatus;
+    createdAt: number;
+    completedAt?: number;
+    /** RFQ pair string, e.g. `arkade:BTC->onchain:BTC`. */
+    pair?: string;
+    /** `sha256(P)`, hex. Public, and how a restore confirms a candidate
+     * derivation is the right one. */
+    paymentHash?: string;
+    /**
+     * The wallet descriptor this swap's sender key comes from — a fresh HD
+     * child, or a static wallet's `tr(pubkey)`. Public — the signer
+     * re-derives from the wallet, so the record carries no key material.
+     */
+    signingDescriptor?: string;
+    /** P, hex, when it cannot be re-derived from the seed: the user supplied
+     * it, or the descriptor is static (shared across swaps, so a derived
+     * preimage would collide). The swap's only claim secret when present. */
+    preimageHex?: string;
+    /** The L1 HTLC's pkScript, hex — the chain-watch key. */
+    htlcPkScriptHex?: string;
+    htlcLocktime?: number;
+    /** The L1 funding txid, once observed. */
+    l1Txid?: string;
+}
+/** All swaps, newest-first. Insertion order is not chronological — the restore
+ * scan rebuilds records in tx-scan order — so sort at read to keep
+ * newest-first canonical for every consumer. */
+declare const getAssetSwapsOrThrow: (repository: AssetSwapRepository) => Promise<AssetSwap[]>;
+/** The consumer read: a broken backend reads as no swaps rather than crashing
+ * a history view. Mutations must use {@link getAssetSwapsOrThrow} instead —
+ * swallowing the read there would let "the backend is gone" masquerade as "no
+ * such swap" and skip the write silently. */
+declare const getAssetSwaps: (repository: AssetSwapRepository) => Promise<AssetSwap[]>;
+/** Add a swap; no-op if the id is already stored. Returns the updated list.
+ * THROWS on a failed write — nothing irreversible may happen until this record
+ * is durable, so the caller must not fund on a failure. */
+declare const addAssetSwap: (repository: AssetSwapRepository, swap: AssetSwap) => Promise<AssetSwap[]>;
+/** Merge changes into a swap by id. Returns the updated list.
+ * THROWS on a failed read or write, like {@link addAssetSwap} — use this for a
+ * write that gates something irreversible. Transitions written *after* the
+ * irreversible act belong on {@link updateAssetSwapBestEffort}. */
+declare const updateAssetSwap: (repository: AssetSwapRepository, id: string, changes: Partial<Omit<AssetSwap, "id">>) => Promise<AssetSwap[]>;
+/**
+ * {@link updateAssetSwap} for transitions that follow an irreversible action (a
+ * broadcast claim, a spent lockup): failing the caller there would report as
+ * failed a swap whose funds already moved, and a stale status is recoverable —
+ * crash recovery re-derives the true state from the chain
+ * (`classifyOnchainHtlc`).
+ *
+ * `persisted` is the part that must not be hidden: a caller that notifies on a
+ * change, or treats one as terminal, has to know the store did not agree.
+ */
+declare const updateAssetSwapBestEffort: (repository: AssetSwapRepository, id: string, changes: Partial<Omit<AssetSwap, "id">>) => Promise<{
+    swaps: AssetSwap[];
+    persisted: boolean;
+}>;
+/**
+ * The record fields a wallet-provisioned secret becomes.
+ *
+ * `signingDescriptor` is public and always stored — it is what recovers the
+ * signer. `preimageHex` is stored only when the wallet says it cannot
+ * re-derive P, and is then the swap's only claim secret.
+ */
+declare const swapSecretsToRecord: (secrets: ProvisionedKey | ProvisionedClaimSecret) => {
+    signingDescriptor: string;
+    preimageHex?: string;
+};
+
+/** A registry discovery result held for reuse. Refetchable — unlike a swap
+ * record, losing it costs one network round trip — but it must survive a cold
+ * boot: serving it stale is what keeps quoting alive while a registry is down. */
+interface MarketsCacheEntry {
+    markets: DiscoveredMarket[];
+    fetchedAt: number;
+}
+/**
+ * Everything the package persists, following the monorepo repository
+ * convention (versioned interface, AsyncDisposable, one backend per
+ * platform — see the Boltz plugin's SwapRepository). Consumers construct
+ * exactly one of these; there is no second storage seam.
+ *
+ * Durable records (swaps) and rebuildable state (the restore scan's txid
+ * cursor, the markets cache) live side by side because they share a
+ * lifetime: all three belong to one wallet on one device, and a consumer
+ * that wipes one wants all three gone.
+ *
+ * ponytail: no query filters — every consumer reads all swaps and filters
+ * in memory; mirror the Boltz plugin's GetSwapsFilter when a consumer needs
+ * subset queries.
+ */
+interface AssetSwapRepository extends AsyncDisposable {
+    readonly version: 1;
+    /** Insert or replace a swap by id. Store the record whole: `preimageHex`
+     * is secret-bearing — the only claim secret of a swap whose descriptor is
+     * not per-swap — and a field-mapped backend that drops it leaves the swap
+     * unclaimable. */
+    saveSwap(swap: AssetSwap): Promise<void>;
+    /** All stored swaps, in no particular order — `getAssetSwaps` is the
+     * canonical newest-first read. */
+    getAllSwaps(): Promise<AssetSwap[]>;
+    /** Sent txids already checked for offer packets (see restore.ts). */
+    getScannedTxids(): Promise<Set<string>>;
+    markTxidsScanned(txids: Iterable<string>): Promise<void>;
+    /** Cached registry markets, or undefined on a miss. */
+    getCachedMarkets(network: string, registry: string): Promise<MarketsCacheEntry | undefined>;
+    saveCachedMarkets(network: string, registry: string, entry: MarketsCacheEntry): Promise<void>;
+    clear(): Promise<void>;
+}
+declare class InMemoryAssetSwapRepository implements AssetSwapRepository {
+    readonly version: 1;
+    private readonly swaps;
+    private readonly scanned;
+    private readonly markets;
+    saveSwap(swap: AssetSwap): Promise<void>;
+    getAllSwaps(): Promise<AssetSwap[]>;
+    getScannedTxids(): Promise<Set<string>>;
+    markTxidsScanned(txids: Iterable<string>): Promise<void>;
+    getCachedMarkets(network: string, registry: string): Promise<MarketsCacheEntry | undefined>;
+    saveCachedMarkets(network: string, registry: string, entry: MarketsCacheEntry): Promise<void>;
+    clear(): Promise<void>;
+    [Symbol.asyncDispose](): Promise<void>;
+}
 
 /** The contracts — pure data, shared verbatim with any other implementation. */
 declare const swapPrograms: Record<"wantAsset" | "wantBtc", ReturnType<typeof arkade.parseArtifact>>;
@@ -738,9 +883,12 @@ declare function readLockupFate(indexer: LockupSpendIndexer, input: {
  */
 declare function pushRefundWithoutReceiver(ark: RefundArkProvider, input: {
     script: InstanceType<typeof VHTLC.ScriptV2>;
-    /** The `sender` signer. Build it from the swap's `secrets` with
-     * `senderIdentityForRfqSecrets` — on an HD wallet that resolves from
-     * the seed, with no stored key bytes anywhere. */
+    /** The `sender` signer. Build it from the swap record with
+     * {@link senderIdentityForSwapRecord} — on an HD wallet that resolves
+     * from the seed, with no stored key bytes anywhere, and every way the
+     * wallet can fail to produce it arrives as one typed
+     * {@link RefundNotLocallyPossibleError} the manager reads as permanent
+     * rather than retrying for the rest of the refund window. */
     sender: Identity;
     vtxos: readonly LockupVtxo[];
     /** Defaults to the contract's own committed refund destination. */
@@ -887,7 +1035,7 @@ declare function pushClaim(ark: ClaimArkProvider, input: {
     /** The receive-direction covenant (see `receiveVtxoScript`). */
     script: InstanceType<typeof VHTLC.ScriptV2>;
     /** The trader's `receiver` signer. Build it from the swap's `secrets`
-     * with `senderIdentityForRfqSecrets` — on an HD wallet that resolves
+     * with `contractSigner` — on an HD wallet that resolves
      * from the seed, with no stored key bytes anywhere. */
     receiver: Identity;
     /** `P`, 32 bytes — the trader generated it at request time. */
@@ -942,6 +1090,50 @@ declare function claimReceiveLockup(indexer: RefundIndexer, ark: ClaimArkProvide
     amount: number;
 }>;
 
+/**
+ * Why a wallet cannot produce a swap's spending key.
+ *
+ * A swap-lifecycle concern, not a key-provisioning one — which is why it
+ * lives here and not in the SDK: `RfqSwapManager` reads it to decide a refund
+ * is impossible rather than merely failing, and stops grinding against a push
+ * that can never work for the whole refund window.
+ */
+
+type RefundBlockedReason = 
+/** The record carries no `signingDescriptor`. */
+"no-secrets"
+/** The descriptor belongs to another wallet's key. */
+ | "foreign-descriptor"
+/**
+ * This wallet holds the key but cannot sign with it — a watch-only
+ * identity, or a remote signer that is not attached. Unlike the other two
+ * this can stop being true without changing wallets, so it is worth
+ * telling apart: "attach your signer", not "restore the other wallet".
+ */
+ | "unsignable-wallet";
+/**
+ * The wallet cannot produce this swap's spending key, so no local refund is
+ * possible: not a failure to retry, a capability this wallet does not have.
+ */
+declare class RefundNotLocallyPossibleError extends Error {
+    readonly reason: RefundBlockedReason;
+    readonly name = "RefundNotLocallyPossibleError";
+    constructor(reason: RefundBlockedReason, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * The signer for a swap record's `signingDescriptor`, or a typed refusal.
+ *
+ * **Wire `refundArkade` here, not to `contractSigner` directly.** The SDK
+ * answers about a descriptor; only this knows that a record without one is a
+ * permanent refusal rather than a `TypeError` at the push site — which the
+ * manager would treat as retryable.
+ */
+declare function senderIdentityForSwapRecord(wallet: IWallet, record: {
+    signingDescriptor?: string;
+}): Promise<Identity>;
+
 /** The contract type a swap lockup registers under. `@arkade-os/sdk`'s handler
  * for `VHTLC.ScriptV2` — the covenant script this corridor builds. */
 declare const SWAP_LOCKUP_CONTRACT_TYPE = "vhtlc-v2";
@@ -1737,4 +1929,4 @@ interface RfqSwapOutcome {
     txid?: string;
 }
 
-export { type ArkadeRefundResult, AssetSwap, AssetSwapRepository, ChainSource, ChainUtxo, type ClaimArkProvider, type ClaimPacketInput, type DiscoverMarketsOptions, IndexedDbAssetSwapRepository, type LightningReceiveSwap, type LightningSendSwap, LockupAmountMismatchError, type LockupContractWriter, type LockupFate, LockupNeedsRecoveryError, LockupRegistrationFailed, type LockupSpendIndexer, type LockupVtxo, MarketsCacheEntry, OFFER_PACKET_TYPE, type Offer, type OfferContractRetirer, type OfferSwapWatcher, OnchainHtlc, OnchainHtlcPhase, type OnchainSendAction, type OnchainSendSwap, type PlanError, QUOTE_OPTIONS, REFUND_MTP_LAG_SECONDS, RFQ_RESOLVED_STATES, RFQ_SWAP_TERMINAL_STATES, type RefundArkProvider, type RefundIndexer, type RefundOutcome, type RestoreIndexer, RfqStatus, type RfqSwap, type RfqSwapActionName, type RfqSwapLockup, RfqSwapManager, type RfqSwapManagerCallbacks, type RfqSwapManagerConfig, type RfqSwapManagerDeps, type RfqSwapManagerEvents, type RfqSwapOutcome, type RfqSwapState, RfqTransport, SWAP_LOCKUP_CONTRACT_KIND, SWAP_LOCKUP_CONTRACT_LABEL, SWAP_LOCKUP_CONTRACT_TYPE, type SealedClaimPacket, type SpendKind, type SwapContractRegistry, type Tx, type WatchOfferSwapsParams, awaitLockupFunding, awaitRfqResolution, cancelOffer, claimReceiveLockup, classifyDepositSpend, classifySpend, createOffer, decodeOffer, discoverMarkets, encodeOffer, findLockupVtxos, findMarket, isRfqSwapTerminal, isRfqTerminal, makeCachedFeedFetch, nextOnchainAction, offerVtxoScript, pushClaim, pushRefundWithoutReceiver, readLockupFate, refundIfUnresolved, registerLockupContract, restoreAssetSwaps, retireSettledOfferContracts, sealClaimPacket, spendTxidsOf, spendUpdate, swapPrograms, validatePlan, watchOfferSwaps };
+export { type ArkadeRefundResult, type AssetSwap, type AssetSwapRepository, type AssetSwapStatus, BTC_ASSET_ID, ChainSource, ChainUtxo, type ClaimArkProvider, type ClaimPacketInput, type DiscoverMarketsOptions, InMemoryAssetSwapRepository, IndexedDbAssetSwapRepository, type LightningReceiveSwap, type LightningSendSwap, LockupAmountMismatchError, type LockupContractWriter, type LockupFate, LockupNeedsRecoveryError, LockupRegistrationFailed, type LockupSpendIndexer, type LockupVtxo, type MarketsCacheEntry, OFFER_PACKET_TYPE, type Offer, type OfferContractRetirer, type OfferSwapWatcher, OnchainHtlc, OnchainHtlcPhase, type OnchainSendAction, type OnchainSendSwap, type PlanError, QUOTE_OPTIONS, REFUND_MTP_LAG_SECONDS, RFQ_RESOLVED_STATES, RFQ_SWAP_TERMINAL_STATES, type RefundArkProvider, type RefundBlockedReason, type RefundIndexer, RefundNotLocallyPossibleError, type RefundOutcome, type RestoreIndexer, RfqStatus, type RfqSwap, type RfqSwapActionName, type RfqSwapLockup, RfqSwapManager, type RfqSwapManagerCallbacks, type RfqSwapManagerConfig, type RfqSwapManagerDeps, type RfqSwapManagerEvents, type RfqSwapOutcome, type RfqSwapState, RfqTransport, SWAP_LOCKUP_CONTRACT_KIND, SWAP_LOCKUP_CONTRACT_LABEL, SWAP_LOCKUP_CONTRACT_TYPE, type SealedClaimPacket, type SpendKind, type SwapContractRegistry, type Tx, type WatchOfferSwapsParams, addAssetSwap, awaitLockupFunding, awaitRfqResolution, cancelOffer, claimReceiveLockup, classifyDepositSpend, classifySpend, createOffer, decodeOffer, discoverMarkets, encodeOffer, findLockupVtxos, findMarket, getAssetSwaps, getAssetSwapsOrThrow, isRfqSwapTerminal, isRfqTerminal, makeCachedFeedFetch, nextOnchainAction, offerVtxoScript, pushClaim, pushRefundWithoutReceiver, readLockupFate, refundIfUnresolved, registerLockupContract, restoreAssetSwaps, retireSettledOfferContracts, sealClaimPacket, senderIdentityForSwapRecord, spendTxidsOf, spendUpdate, swapPrograms, swapSecretsToRecord, updateAssetSwap, updateAssetSwapBestEffort, validatePlan, watchOfferSwaps };

package/dist/index.d.ts

@@ -1,7 +1,152 @@
-import { asset, IWallet, arkade, RestIndexerProvider, Transaction, IContractManager, RestArkProvider, VHTLC, Identity } from '@arkade-os/sdk';
-import { A as AssetSwapRepository, a as AssetSwap, M as MarketsCacheEntry, R as RfqStatus, b as RfqTransport, O as OnchainHtlc, C as ChainSource, c as ChainUtxo, d as OnchainHtlcPhase } from './rfq-CCAFoFtR.js';
-export { e as ARKADE_ASSET, f as ARKADE_BTC, g as AddressMismatch, h as AssetSwapFallbackSecrets, i as AssetSwapStatus, B as BTC_ASSET_ID, D as DerivedSwapSecrets, j as DeterministicSigner, H as HtlcUtxo, I as InMemoryAssetSwapRepository, k as InvoiceFacts, L as LIGHTNING_BTC, l as LIGHTNING_RECEIVE_PAIR, m as LIGHTNING_SEND_PAIR, n as MAX_MIN_CONFIRMATIONS, o as MIN_CLAIM_WINDOW_SECONDS, p as MIN_HEADROOM_SECONDS, q as ONCHAIN_BTC, r as ONCHAIN_CLAIM_MARGIN_SECONDS, s as ONCHAIN_DUST_SATS, t as ONCHAIN_ORDER_MARGIN_SECONDS, u as ONCHAIN_RECEIVE_PAIR, v as ONCHAIN_SECONDS_PER_BLOCK, w as ONCHAIN_SEND_PAIR, x as OnchainHtlcParams, y as OnchainNetwork, z as RFQ_PREIMAGE_TAG, E as RFQ_TERMINAL_STATES, F as RefundBlockedReason, G as RefundNotLocallyPossibleError, J as RelaySocket, K as RfqQuote, N as RfqRefusalReason, S as StoredSwapSecrets, P as SwapRefusal, Q as SwapSecrets, T as addAssetSwap, U as adoptSwapDescriptor, V as arkadeSwapRequest, W as assertFundable, X as assertReceivable, Y as awaitOnchainFill, Z as buildHtlcClaim, _ as buildHtlcRefund, $ as buildPreimageMessage, a0 as claimOnchainFill, a1 as classifyOnchainHtlc, a2 as deriveLightningReceive, a3 as deriveOnchainReceive, a4 as deriveOnchainSend, a5 as derivePreimage, a6 as deriveSwapSecrets, a7 as extractPreimage, a8 as getAssetSwaps, a9 as getAssetSwapsOrThrow, aa as httpTransport, ab as isDeterministicSigner, ac as lightningReceiveRequest, ad as lightningSendRequest, ae as lightningSendVtxoScript, af as newPreimage, ag as newRfqId, ah as offerTermsFromQuote, ai as onchainHtlcScript, aj as onchainReceiveRequest, ak as onchainSendRequest, al as paymentHashOf, am as preimageForRfqSecrets, an as randomSwapSecrets, ao as receiveVtxoScript, ap as relayTransport, aq as requestLightningReceive, ar as requestLightningSend, as as requestOnchainReceive, at as requestOnchainSend, au as rfqPair, av as rfqSecretsOfRecord, aw as rfqSecretsToRecord, ax as senderIdentityForRfqSecrets, ay as senderIdentityForSwapRecord, az as senderPubkeyForRfqSecrets, aA as unilateralClaimDelay, aB as unilateralRefundDelay, aC as unilateralRefundWithoutReceiverDelay, aD as updateAssetSwap, aE as updateAssetSwapBestEffort, aF as verifyLockupAddress, aG as verifyReceiveInvoice } from './rfq-CCAFoFtR.js';
-import { Network, LocalCardInput, DiscoveredMarket, Side, OfferPlan } from '@arkade-os/solver-discovery';
+import { ProvisionedKey, ProvisionedClaimSecret, asset, IWallet, arkade, RestIndexerProvider, Transaction, IContractManager, RestArkProvider, VHTLC, Identity } from '@arkade-os/sdk';
+import { DiscoveredMarket, Network, LocalCardInput, Side, OfferPlan } from '@arkade-os/solver-discovery';
+import { R as RfqStatus, a as RfqTransport, O as OnchainHtlc, C as ChainSource, b as ChainUtxo, c as OnchainHtlcPhase } from './rfq-DjZlesr4.js';
+export { A as ARKADE_ASSET, d as ARKADE_BTC, e as AddressMismatch, H as HtlcUtxo, I as InvoiceFacts, L as LIGHTNING_BTC, f as LIGHTNING_RECEIVE_PAIR, g as LIGHTNING_SEND_PAIR, M as MAX_MIN_CONFIRMATIONS, h as MIN_CLAIM_WINDOW_SECONDS, i as MIN_HEADROOM_SECONDS, j as ONCHAIN_BTC, k as ONCHAIN_CLAIM_MARGIN_SECONDS, l as ONCHAIN_DUST_SATS, m as ONCHAIN_ORDER_MARGIN_SECONDS, n as ONCHAIN_RECEIVE_PAIR, o as ONCHAIN_SECONDS_PER_BLOCK, p as ONCHAIN_SEND_PAIR, q as OnchainHtlcParams, r as OnchainNetwork, s as RFQ_TERMINAL_STATES, t as RelaySocket, u as RfqQuote, v as RfqRefusalReason, S as SwapRefusal, w as arkadeSwapRequest, x as assertFundable, y as assertReceivable, z as awaitOnchainFill, B as buildHtlcClaim, D as buildHtlcRefund, E as claimOnchainFill, F as classifyOnchainHtlc, G as deriveLightningReceive, J as deriveOnchainReceive, K as deriveOnchainSend, N as extractPreimage, P as httpTransport, Q as lightningReceiveRequest, T as lightningSendRequest, U as lightningSendVtxoScript, V as newPreimage, W as newRfqId, X as offerTermsFromQuote, Y as onchainHtlcScript, Z as onchainReceiveRequest, _ as onchainSendRequest, $ as paymentHashOf, a0 as receiveVtxoScript, a1 as relayTransport, a2 as requestLightningReceive, a3 as requestLightningSend, a4 as requestOnchainReceive, a5 as requestOnchainSend, a6 as rfqPair, a7 as unilateralClaimDelay, a8 as unilateralRefundDelay, a9 as unilateralRefundWithoutReceiverDelay, aa as verifyLockupAddress, ab as verifyReceiveInvoice } from './rfq-DjZlesr4.js';
+
+type AssetSwapStatus = "pending" | "cancelling" | "fulfilled" | "cancelled" | "recoverable" | "awaiting_fill" | "claimable" | "claimed" | "refunded_l1";
+/** The sentinel asset id for BTC itself, as opposed to a 68-hex asset id.
+ * Lives here with the {@link AssetSwap} fields it describes so the market and
+ * restore layers share one spelling instead of re-typing the literal. */
+declare const BTC_ASSET_ID = "btc";
+interface AssetSwap {
+    /** Funding txid — the swap's identity. */
+    id: string;
+    /** 'btc' or a 68-hex asset id. */
+    fromAsset: string;
+    toAsset: string;
+    /** Atomic amounts as strings (bigint is not JSON-safe). */
+    fromAmount: string;
+    /** The covenant wantAmount — a floor, the fill pays >= this. */
+    toAmount: string;
+    swapAddress: string;
+    /** Hex pkScript of the swap contract — the indexer monitoring key. */
+    swapPkScript: string;
+    /** TLV offer — needed to rebuild the contract for cancel. */
+    offerHex: string;
+    fundingTxid: string;
+    spentTxid?: string;
+    status: AssetSwapStatus;
+    createdAt: number;
+    completedAt?: number;
+    /** RFQ pair string, e.g. `arkade:BTC->onchain:BTC`. */
+    pair?: string;
+    /** `sha256(P)`, hex. Public, and how a restore confirms a candidate
+     * derivation is the right one. */
+    paymentHash?: string;
+    /**
+     * The wallet descriptor this swap's sender key comes from — a fresh HD
+     * child, or a static wallet's `tr(pubkey)`. Public — the signer
+     * re-derives from the wallet, so the record carries no key material.
+     */
+    signingDescriptor?: string;
+    /** P, hex, when it cannot be re-derived from the seed: the user supplied
+     * it, or the descriptor is static (shared across swaps, so a derived
+     * preimage would collide). The swap's only claim secret when present. */
+    preimageHex?: string;
+    /** The L1 HTLC's pkScript, hex — the chain-watch key. */
+    htlcPkScriptHex?: string;
+    htlcLocktime?: number;
+    /** The L1 funding txid, once observed. */
+    l1Txid?: string;
+}
+/** All swaps, newest-first. Insertion order is not chronological — the restore
+ * scan rebuilds records in tx-scan order — so sort at read to keep
+ * newest-first canonical for every consumer. */
+declare const getAssetSwapsOrThrow: (repository: AssetSwapRepository) => Promise<AssetSwap[]>;
+/** The consumer read: a broken backend reads as no swaps rather than crashing
+ * a history view. Mutations must use {@link getAssetSwapsOrThrow} instead —
+ * swallowing the read there would let "the backend is gone" masquerade as "no
+ * such swap" and skip the write silently. */
+declare const getAssetSwaps: (repository: AssetSwapRepository) => Promise<AssetSwap[]>;
+/** Add a swap; no-op if the id is already stored. Returns the updated list.
+ * THROWS on a failed write — nothing irreversible may happen until this record
+ * is durable, so the caller must not fund on a failure. */
+declare const addAssetSwap: (repository: AssetSwapRepository, swap: AssetSwap) => Promise<AssetSwap[]>;
+/** Merge changes into a swap by id. Returns the updated list.
+ * THROWS on a failed read or write, like {@link addAssetSwap} — use this for a
+ * write that gates something irreversible. Transitions written *after* the
+ * irreversible act belong on {@link updateAssetSwapBestEffort}. */
+declare const updateAssetSwap: (repository: AssetSwapRepository, id: string, changes: Partial<Omit<AssetSwap, "id">>) => Promise<AssetSwap[]>;
+/**
+ * {@link updateAssetSwap} for transitions that follow an irreversible action (a
+ * broadcast claim, a spent lockup): failing the caller there would report as
+ * failed a swap whose funds already moved, and a stale status is recoverable —
+ * crash recovery re-derives the true state from the chain
+ * (`classifyOnchainHtlc`).
+ *
+ * `persisted` is the part that must not be hidden: a caller that notifies on a
+ * change, or treats one as terminal, has to know the store did not agree.
+ */
+declare const updateAssetSwapBestEffort: (repository: AssetSwapRepository, id: string, changes: Partial<Omit<AssetSwap, "id">>) => Promise<{
+    swaps: AssetSwap[];
+    persisted: boolean;
+}>;
+/**
+ * The record fields a wallet-provisioned secret becomes.
+ *
+ * `signingDescriptor` is public and always stored — it is what recovers the
+ * signer. `preimageHex` is stored only when the wallet says it cannot
+ * re-derive P, and is then the swap's only claim secret.
+ */
+declare const swapSecretsToRecord: (secrets: ProvisionedKey | ProvisionedClaimSecret) => {
+    signingDescriptor: string;
+    preimageHex?: string;
+};
+
+/** A registry discovery result held for reuse. Refetchable — unlike a swap
+ * record, losing it costs one network round trip — but it must survive a cold
+ * boot: serving it stale is what keeps quoting alive while a registry is down. */
+interface MarketsCacheEntry {
+    markets: DiscoveredMarket[];
+    fetchedAt: number;
+}
+/**
+ * Everything the package persists, following the monorepo repository
+ * convention (versioned interface, AsyncDisposable, one backend per
+ * platform — see the Boltz plugin's SwapRepository). Consumers construct
+ * exactly one of these; there is no second storage seam.
+ *
+ * Durable records (swaps) and rebuildable state (the restore scan's txid
+ * cursor, the markets cache) live side by side because they share a
+ * lifetime: all three belong to one wallet on one device, and a consumer
+ * that wipes one wants all three gone.
+ *
+ * ponytail: no query filters — every consumer reads all swaps and filters
+ * in memory; mirror the Boltz plugin's GetSwapsFilter when a consumer needs
+ * subset queries.
+ */
+interface AssetSwapRepository extends AsyncDisposable {
+    readonly version: 1;
+    /** Insert or replace a swap by id. Store the record whole: `preimageHex`
+     * is secret-bearing — the only claim secret of a swap whose descriptor is
+     * not per-swap — and a field-mapped backend that drops it leaves the swap
+     * unclaimable. */
+    saveSwap(swap: AssetSwap): Promise<void>;
+    /** All stored swaps, in no particular order — `getAssetSwaps` is the
+     * canonical newest-first read. */
+    getAllSwaps(): Promise<AssetSwap[]>;
+    /** Sent txids already checked for offer packets (see restore.ts). */
+    getScannedTxids(): Promise<Set<string>>;
+    markTxidsScanned(txids: Iterable<string>): Promise<void>;
+    /** Cached registry markets, or undefined on a miss. */
+    getCachedMarkets(network: string, registry: string): Promise<MarketsCacheEntry | undefined>;
+    saveCachedMarkets(network: string, registry: string, entry: MarketsCacheEntry): Promise<void>;
+    clear(): Promise<void>;
+}
+declare class InMemoryAssetSwapRepository implements AssetSwapRepository {
+    readonly version: 1;
+    private readonly swaps;
+    private readonly scanned;
+    private readonly markets;
+    saveSwap(swap: AssetSwap): Promise<void>;
+    getAllSwaps(): Promise<AssetSwap[]>;
+    getScannedTxids(): Promise<Set<string>>;
+    markTxidsScanned(txids: Iterable<string>): Promise<void>;
+    getCachedMarkets(network: string, registry: string): Promise<MarketsCacheEntry | undefined>;
+    saveCachedMarkets(network: string, registry: string, entry: MarketsCacheEntry): Promise<void>;
+    clear(): Promise<void>;
+    [Symbol.asyncDispose](): Promise<void>;
+}
 
 /** The contracts — pure data, shared verbatim with any other implementation. */
 declare const swapPrograms: Record<"wantAsset" | "wantBtc", ReturnType<typeof arkade.parseArtifact>>;
@@ -738,9 +883,12 @@ declare function readLockupFate(indexer: LockupSpendIndexer, input: {
  */
 declare function pushRefundWithoutReceiver(ark: RefundArkProvider, input: {
     script: InstanceType<typeof VHTLC.ScriptV2>;
-    /** The `sender` signer. Build it from the swap's `secrets` with
-     * `senderIdentityForRfqSecrets` — on an HD wallet that resolves from
-     * the seed, with no stored key bytes anywhere. */
+    /** The `sender` signer. Build it from the swap record with
+     * {@link senderIdentityForSwapRecord} — on an HD wallet that resolves
+     * from the seed, with no stored key bytes anywhere, and every way the
+     * wallet can fail to produce it arrives as one typed
+     * {@link RefundNotLocallyPossibleError} the manager reads as permanent
+     * rather than retrying for the rest of the refund window. */
     sender: Identity;
     vtxos: readonly LockupVtxo[];
     /** Defaults to the contract's own committed refund destination. */
@@ -887,7 +1035,7 @@ declare function pushClaim(ark: ClaimArkProvider, input: {
     /** The receive-direction covenant (see `receiveVtxoScript`). */
     script: InstanceType<typeof VHTLC.ScriptV2>;
     /** The trader's `receiver` signer. Build it from the swap's `secrets`
-     * with `senderIdentityForRfqSecrets` — on an HD wallet that resolves
+     * with `contractSigner` — on an HD wallet that resolves
      * from the seed, with no stored key bytes anywhere. */
     receiver: Identity;
     /** `P`, 32 bytes — the trader generated it at request time. */
@@ -942,6 +1090,50 @@ declare function claimReceiveLockup(indexer: RefundIndexer, ark: ClaimArkProvide
     amount: number;
 }>;
 
+/**
+ * Why a wallet cannot produce a swap's spending key.
+ *
+ * A swap-lifecycle concern, not a key-provisioning one — which is why it
+ * lives here and not in the SDK: `RfqSwapManager` reads it to decide a refund
+ * is impossible rather than merely failing, and stops grinding against a push
+ * that can never work for the whole refund window.
+ */
+
+type RefundBlockedReason = 
+/** The record carries no `signingDescriptor`. */
+"no-secrets"
+/** The descriptor belongs to another wallet's key. */
+ | "foreign-descriptor"
+/**
+ * This wallet holds the key but cannot sign with it — a watch-only
+ * identity, or a remote signer that is not attached. Unlike the other two
+ * this can stop being true without changing wallets, so it is worth
+ * telling apart: "attach your signer", not "restore the other wallet".
+ */
+ | "unsignable-wallet";
+/**
+ * The wallet cannot produce this swap's spending key, so no local refund is
+ * possible: not a failure to retry, a capability this wallet does not have.
+ */
+declare class RefundNotLocallyPossibleError extends Error {
+    readonly reason: RefundBlockedReason;
+    readonly name = "RefundNotLocallyPossibleError";
+    constructor(reason: RefundBlockedReason, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * The signer for a swap record's `signingDescriptor`, or a typed refusal.
+ *
+ * **Wire `refundArkade` here, not to `contractSigner` directly.** The SDK
+ * answers about a descriptor; only this knows that a record without one is a
+ * permanent refusal rather than a `TypeError` at the push site — which the
+ * manager would treat as retryable.
+ */
+declare function senderIdentityForSwapRecord(wallet: IWallet, record: {
+    signingDescriptor?: string;
+}): Promise<Identity>;
+
 /** The contract type a swap lockup registers under. `@arkade-os/sdk`'s handler
  * for `VHTLC.ScriptV2` — the covenant script this corridor builds. */
 declare const SWAP_LOCKUP_CONTRACT_TYPE = "vhtlc-v2";
@@ -1737,4 +1929,4 @@ interface RfqSwapOutcome {
     txid?: string;
 }
 
-export { type ArkadeRefundResult, AssetSwap, AssetSwapRepository, ChainSource, ChainUtxo, type ClaimArkProvider, type ClaimPacketInput, type DiscoverMarketsOptions, IndexedDbAssetSwapRepository, type LightningReceiveSwap, type LightningSendSwap, LockupAmountMismatchError, type LockupContractWriter, type LockupFate, LockupNeedsRecoveryError, LockupRegistrationFailed, type LockupSpendIndexer, type LockupVtxo, MarketsCacheEntry, OFFER_PACKET_TYPE, type Offer, type OfferContractRetirer, type OfferSwapWatcher, OnchainHtlc, OnchainHtlcPhase, type OnchainSendAction, type OnchainSendSwap, type PlanError, QUOTE_OPTIONS, REFUND_MTP_LAG_SECONDS, RFQ_RESOLVED_STATES, RFQ_SWAP_TERMINAL_STATES, type RefundArkProvider, type RefundIndexer, type RefundOutcome, type RestoreIndexer, RfqStatus, type RfqSwap, type RfqSwapActionName, type RfqSwapLockup, RfqSwapManager, type RfqSwapManagerCallbacks, type RfqSwapManagerConfig, type RfqSwapManagerDeps, type RfqSwapManagerEvents, type RfqSwapOutcome, type RfqSwapState, RfqTransport, SWAP_LOCKUP_CONTRACT_KIND, SWAP_LOCKUP_CONTRACT_LABEL, SWAP_LOCKUP_CONTRACT_TYPE, type SealedClaimPacket, type SpendKind, type SwapContractRegistry, type Tx, type WatchOfferSwapsParams, awaitLockupFunding, awaitRfqResolution, cancelOffer, claimReceiveLockup, classifyDepositSpend, classifySpend, createOffer, decodeOffer, discoverMarkets, encodeOffer, findLockupVtxos, findMarket, isRfqSwapTerminal, isRfqTerminal, makeCachedFeedFetch, nextOnchainAction, offerVtxoScript, pushClaim, pushRefundWithoutReceiver, readLockupFate, refundIfUnresolved, registerLockupContract, restoreAssetSwaps, retireSettledOfferContracts, sealClaimPacket, spendTxidsOf, spendUpdate, swapPrograms, validatePlan, watchOfferSwaps };
+export { type ArkadeRefundResult, type AssetSwap, type AssetSwapRepository, type AssetSwapStatus, BTC_ASSET_ID, ChainSource, ChainUtxo, type ClaimArkProvider, type ClaimPacketInput, type DiscoverMarketsOptions, InMemoryAssetSwapRepository, IndexedDbAssetSwapRepository, type LightningReceiveSwap, type LightningSendSwap, LockupAmountMismatchError, type LockupContractWriter, type LockupFate, LockupNeedsRecoveryError, LockupRegistrationFailed, type LockupSpendIndexer, type LockupVtxo, type MarketsCacheEntry, OFFER_PACKET_TYPE, type Offer, type OfferContractRetirer, type OfferSwapWatcher, OnchainHtlc, OnchainHtlcPhase, type OnchainSendAction, type OnchainSendSwap, type PlanError, QUOTE_OPTIONS, REFUND_MTP_LAG_SECONDS, RFQ_RESOLVED_STATES, RFQ_SWAP_TERMINAL_STATES, type RefundArkProvider, type RefundBlockedReason, type RefundIndexer, RefundNotLocallyPossibleError, type RefundOutcome, type RestoreIndexer, RfqStatus, type RfqSwap, type RfqSwapActionName, type RfqSwapLockup, RfqSwapManager, type RfqSwapManagerCallbacks, type RfqSwapManagerConfig, type RfqSwapManagerDeps, type RfqSwapManagerEvents, type RfqSwapOutcome, type RfqSwapState, RfqTransport, SWAP_LOCKUP_CONTRACT_KIND, SWAP_LOCKUP_CONTRACT_LABEL, SWAP_LOCKUP_CONTRACT_TYPE, type SealedClaimPacket, type SpendKind, type SwapContractRegistry, type Tx, type WatchOfferSwapsParams, addAssetSwap, awaitLockupFunding, awaitRfqResolution, cancelOffer, claimReceiveLockup, classifyDepositSpend, classifySpend, createOffer, decodeOffer, discoverMarkets, encodeOffer, findLockupVtxos, findMarket, getAssetSwaps, getAssetSwapsOrThrow, isRfqSwapTerminal, isRfqTerminal, makeCachedFeedFetch, nextOnchainAction, offerVtxoScript, pushClaim, pushRefundWithoutReceiver, readLockupFate, refundIfUnresolved, registerLockupContract, restoreAssetSwaps, retireSettledOfferContracts, sealClaimPacket, senderIdentityForSwapRecord, spendTxidsOf, spendUpdate, swapPrograms, swapSecretsToRecord, updateAssetSwap, updateAssetSwapBestEffort, validatePlan, watchOfferSwaps };