@arkade-os/swap 0.0.5 → 0.0.7

package/dist/repositories/sqlite/index.cjs

@@ -0,0 +1,163 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/repositories/sqlite/index.ts
+var sqlite_exports = {};
+__export(sqlite_exports, {
+  SQLiteAssetSwapRepository: () => SQLiteAssetSwapRepository
+});
+module.exports = __toCommonJS(sqlite_exports);
+
+// src/repositories/sqlite/repository.ts
+var import_sqlite = require("@arkade-os/sdk/repositories/sqlite");
+
+// src/repository.ts
+var marketsCacheKey = (network, registry) => `arkade-intents-markets-${network}-${registry}`;
+
+// src/repositories/sqlite/repository.ts
+var DEFAULT_PREFIX = "arkade_";
+var INSERT_CHUNK = 500;
+var SQLiteAssetSwapRepository = class {
+  constructor(db, options) {
+    this.db = db;
+    this.prefix = (0, import_sqlite.sanitizeTablePrefix)(options?.prefix ?? DEFAULT_PREFIX);
+    this.swaps = `${this.prefix}asset_swaps`;
+    this.scanned = `${this.prefix}asset_swap_scanned_txids`;
+    this.markets = `${this.prefix}asset_swap_markets`;
+  }
+  db;
+  version = 2;
+  initPromise = null;
+  prefix;
+  swaps;
+  scanned;
+  markets;
+  /** A rejected init is not cached. The DDL runs in a transaction on a shared
+   * connection, so it can fail for reasons that pass — a `SQLITE_BUSY` on
+   * `BEGIN IMMEDIATE`, a neighbour's rollback — and caching that rejection
+   * would strand the instance unusable for the life of the process. Same rule
+   * as the IndexedDB backend's `ensureDb`. */
+  ensureInit() {
+    return this.initPromise ??= this.init().catch((err) => {
+      this.initPromise = null;
+      throw err;
+    });
+  }
+  /** The DDL is transactional in SQLite too: run raw on a shared connection it
+   * would join a neighbour's open transaction and vanish with its rollback,
+   * while `initPromise` stayed resolved and every later statement failed with
+   * `no such table`. */
+  async init() {
+    await this.withTx(async () => {
+      await this.db.run(`CREATE TABLE IF NOT EXISTS ${this.swaps} (
+                id TEXT PRIMARY KEY,
+                status TEXT NOT NULL,
+                created_at INTEGER NOT NULL,
+                data TEXT NOT NULL
+            )`);
+      await this.db.run(
+        `CREATE INDEX IF NOT EXISTS idx_${this.prefix}asset_swaps_status ON ${this.swaps} (status)`
+      );
+      await this.db.run(
+        `CREATE INDEX IF NOT EXISTS idx_${this.prefix}asset_swaps_created_at ON ${this.swaps} (created_at)`
+      );
+      await this.db.run(`CREATE TABLE IF NOT EXISTS ${this.scanned} (txid TEXT PRIMARY KEY)`);
+      await this.db.run(
+        `CREATE TABLE IF NOT EXISTS ${this.markets} (cache_key TEXT PRIMARY KEY, data TEXT NOT NULL)`
+      );
+    });
+  }
+  /** Every write, including the single-statement ones. The chain serializes
+   * transaction *blocks*, not bare statements: one issued between a
+   * neighbour's BEGIN IMMEDIATE and its COMMIT becomes part of that
+   * transaction and dies with it. `fn` must issue only raw db calls — no
+   * repository method, no `ensureInit` — since `runInTransaction` cannot
+   * nest. */
+  withTx(fn) {
+    return (0, import_sqlite.runInTransaction)(this.db, fn);
+  }
+  async saveSwap(swap) {
+    await this.ensureInit();
+    await this.withTx(async () => {
+      await this.db.run(
+        `INSERT OR REPLACE INTO ${this.swaps} (id, status, created_at, data)
+                 VALUES (?, ?, ?, ?)`,
+        [swap.id, swap.status, swap.createdAt, JSON.stringify(swap)]
+      );
+    });
+  }
+  async getAllSwaps() {
+    await this.ensureInit();
+    const rows = await this.db.all(`SELECT data FROM ${this.swaps}`);
+    return rows.map((r) => JSON.parse(r.data));
+  }
+  async getScannedTxids() {
+    await this.ensureInit();
+    const rows = await this.db.all(`SELECT txid FROM ${this.scanned}`);
+    return new Set(rows.map((r) => r.txid));
+  }
+  async markTxidsScanned(txids) {
+    await this.ensureInit();
+    const all = [...txids];
+    if (all.length === 0) return;
+    await this.withTx(async () => {
+      for (let i = 0; i < all.length; i += INSERT_CHUNK) {
+        const chunk = all.slice(i, i + INSERT_CHUNK);
+        await this.db.run(
+          `INSERT OR IGNORE INTO ${this.scanned} (txid) VALUES ${chunk.map(() => "(?)").join(", ")}`,
+          chunk
+        );
+      }
+    });
+  }
+  async getCachedMarkets(network, registry) {
+    await this.ensureInit();
+    const row = await this.db.get(
+      `SELECT data FROM ${this.markets} WHERE cache_key = ?`,
+      [marketsCacheKey(network, registry)]
+    );
+    return row ? JSON.parse(row.data) : void 0;
+  }
+  async saveCachedMarkets(network, registry, entry) {
+    await this.ensureInit();
+    await this.withTx(async () => {
+      await this.db.run(
+        `INSERT OR REPLACE INTO ${this.markets} (cache_key, data) VALUES (?, ?)`,
+        [marketsCacheKey(network, registry), JSON.stringify(entry)]
+      );
+    });
+  }
+  /** All three tables in one transaction: clearing swaps but keeping scanned
+   * txids would leave the restore scan permanently skipping those funding
+   * txs, so a partial clear must not be observable. */
+  async clear() {
+    await this.ensureInit();
+    await this.withTx(async () => {
+      await this.db.run(`DELETE FROM ${this.swaps}`);
+      await this.db.run(`DELETE FROM ${this.scanned}`);
+      await this.db.run(`DELETE FROM ${this.markets}`);
+    });
+  }
+  async [Symbol.asyncDispose]() {
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SQLiteAssetSwapRepository
+});

package/dist/repositories/sqlite/index.d.cts

@@ -0,0 +1,63 @@
+import { SQLExecutor } from '@arkade-os/sdk/repositories/sqlite';
+import { A as AssetSwapRepository, a as AssetSwap, M as MarketsCacheEntry } from '../../repository-BwnZ8N62.cjs';
+import '@arkade-os/solver-discovery';
+import '@arkade-os/sdk';
+
+/**
+ * SQLite backend over the SDK's `SQLExecutor`, so any driver plugs in
+ * (expo-sqlite on React Native, better-sqlite3, node:sqlite).
+ *
+ * **Records are serialized as JSON**, whole, into a `data` column — `status`
+ * and `created_at` are mapped out for querying only, so no field of a record
+ * can be dropped. That holds for JSON-safe values: a consumer-added `Date`
+ * comes back a string and a `bigint` throws on save, unlike the IndexedDB
+ * backend's structured clone. `AssetSwap` itself is JSON-safe by design.
+ *
+ * Tables are created lazily on first operation. The consumer owns the
+ * `SQLExecutor` lifecycle — `[Symbol.asyncDispose]` is a no-op — and must pass
+ * the **same executor instance** to every repository on the database: the
+ * write chain is keyed by that object, and a per-repository literal splits it.
+ */
+declare class SQLiteAssetSwapRepository implements AssetSwapRepository {
+    private readonly db;
+    readonly version: 2;
+    private initPromise;
+    private readonly prefix;
+    private readonly swaps;
+    private readonly scanned;
+    private readonly markets;
+    constructor(db: SQLExecutor, options?: {
+        prefix?: string;
+    });
+    /** A rejected init is not cached. The DDL runs in a transaction on a shared
+     * connection, so it can fail for reasons that pass — a `SQLITE_BUSY` on
+     * `BEGIN IMMEDIATE`, a neighbour's rollback — and caching that rejection
+     * would strand the instance unusable for the life of the process. Same rule
+     * as the IndexedDB backend's `ensureDb`. */
+    private ensureInit;
+    /** The DDL is transactional in SQLite too: run raw on a shared connection it
+     * would join a neighbour's open transaction and vanish with its rollback,
+     * while `initPromise` stayed resolved and every later statement failed with
+     * `no such table`. */
+    private init;
+    /** Every write, including the single-statement ones. The chain serializes
+     * transaction *blocks*, not bare statements: one issued between a
+     * neighbour's BEGIN IMMEDIATE and its COMMIT becomes part of that
+     * transaction and dies with it. `fn` must issue only raw db calls — no
+     * repository method, no `ensureInit` — since `runInTransaction` cannot
+     * nest. */
+    private withTx;
+    saveSwap(swap: AssetSwap): Promise<void>;
+    getAllSwaps(): Promise<AssetSwap[]>;
+    getScannedTxids(): Promise<Set<string>>;
+    markTxidsScanned(txids: Iterable<string>): Promise<void>;
+    getCachedMarkets(network: string, registry: string): Promise<MarketsCacheEntry | undefined>;
+    saveCachedMarkets(network: string, registry: string, entry: MarketsCacheEntry): Promise<void>;
+    /** All three tables in one transaction: clearing swaps but keeping scanned
+     * txids would leave the restore scan permanently skipping those funding
+     * txs, so a partial clear must not be observable. */
+    clear(): Promise<void>;
+    [Symbol.asyncDispose](): Promise<void>;
+}
+
+export { SQLiteAssetSwapRepository };

package/dist/repositories/sqlite/index.d.ts

@@ -0,0 +1,63 @@
+import { SQLExecutor } from '@arkade-os/sdk/repositories/sqlite';
+import { A as AssetSwapRepository, a as AssetSwap, M as MarketsCacheEntry } from '../../repository-BwnZ8N62.js';
+import '@arkade-os/solver-discovery';
+import '@arkade-os/sdk';
+
+/**
+ * SQLite backend over the SDK's `SQLExecutor`, so any driver plugs in
+ * (expo-sqlite on React Native, better-sqlite3, node:sqlite).
+ *
+ * **Records are serialized as JSON**, whole, into a `data` column — `status`
+ * and `created_at` are mapped out for querying only, so no field of a record
+ * can be dropped. That holds for JSON-safe values: a consumer-added `Date`
+ * comes back a string and a `bigint` throws on save, unlike the IndexedDB
+ * backend's structured clone. `AssetSwap` itself is JSON-safe by design.
+ *
+ * Tables are created lazily on first operation. The consumer owns the
+ * `SQLExecutor` lifecycle — `[Symbol.asyncDispose]` is a no-op — and must pass
+ * the **same executor instance** to every repository on the database: the
+ * write chain is keyed by that object, and a per-repository literal splits it.
+ */
+declare class SQLiteAssetSwapRepository implements AssetSwapRepository {
+    private readonly db;
+    readonly version: 2;
+    private initPromise;
+    private readonly prefix;
+    private readonly swaps;
+    private readonly scanned;
+    private readonly markets;
+    constructor(db: SQLExecutor, options?: {
+        prefix?: string;
+    });
+    /** A rejected init is not cached. The DDL runs in a transaction on a shared
+     * connection, so it can fail for reasons that pass — a `SQLITE_BUSY` on
+     * `BEGIN IMMEDIATE`, a neighbour's rollback — and caching that rejection
+     * would strand the instance unusable for the life of the process. Same rule
+     * as the IndexedDB backend's `ensureDb`. */
+    private ensureInit;
+    /** The DDL is transactional in SQLite too: run raw on a shared connection it
+     * would join a neighbour's open transaction and vanish with its rollback,
+     * while `initPromise` stayed resolved and every later statement failed with
+     * `no such table`. */
+    private init;
+    /** Every write, including the single-statement ones. The chain serializes
+     * transaction *blocks*, not bare statements: one issued between a
+     * neighbour's BEGIN IMMEDIATE and its COMMIT becomes part of that
+     * transaction and dies with it. `fn` must issue only raw db calls — no
+     * repository method, no `ensureInit` — since `runInTransaction` cannot
+     * nest. */
+    private withTx;
+    saveSwap(swap: AssetSwap): Promise<void>;
+    getAllSwaps(): Promise<AssetSwap[]>;
+    getScannedTxids(): Promise<Set<string>>;
+    markTxidsScanned(txids: Iterable<string>): Promise<void>;
+    getCachedMarkets(network: string, registry: string): Promise<MarketsCacheEntry | undefined>;
+    saveCachedMarkets(network: string, registry: string, entry: MarketsCacheEntry): Promise<void>;
+    /** All three tables in one transaction: clearing swaps but keeping scanned
+     * txids would leave the restore scan permanently skipping those funding
+     * txs, so a partial clear must not be observable. */
+    clear(): Promise<void>;
+    [Symbol.asyncDispose](): Promise<void>;
+}
+
+export { SQLiteAssetSwapRepository };

package/dist/repositories/sqlite/index.js

@@ -0,0 +1,138 @@
+import {
+  marketsCacheKey
+} from "../../chunk-WGRU2DBF.js";
+
+// src/repositories/sqlite/repository.ts
+import {
+  runInTransaction,
+  sanitizeTablePrefix
+} from "@arkade-os/sdk/repositories/sqlite";
+var DEFAULT_PREFIX = "arkade_";
+var INSERT_CHUNK = 500;
+var SQLiteAssetSwapRepository = class {
+  constructor(db, options) {
+    this.db = db;
+    this.prefix = sanitizeTablePrefix(options?.prefix ?? DEFAULT_PREFIX);
+    this.swaps = `${this.prefix}asset_swaps`;
+    this.scanned = `${this.prefix}asset_swap_scanned_txids`;
+    this.markets = `${this.prefix}asset_swap_markets`;
+  }
+  db;
+  version = 2;
+  initPromise = null;
+  prefix;
+  swaps;
+  scanned;
+  markets;
+  /** A rejected init is not cached. The DDL runs in a transaction on a shared
+   * connection, so it can fail for reasons that pass — a `SQLITE_BUSY` on
+   * `BEGIN IMMEDIATE`, a neighbour's rollback — and caching that rejection
+   * would strand the instance unusable for the life of the process. Same rule
+   * as the IndexedDB backend's `ensureDb`. */
+  ensureInit() {
+    return this.initPromise ??= this.init().catch((err) => {
+      this.initPromise = null;
+      throw err;
+    });
+  }
+  /** The DDL is transactional in SQLite too: run raw on a shared connection it
+   * would join a neighbour's open transaction and vanish with its rollback,
+   * while `initPromise` stayed resolved and every later statement failed with
+   * `no such table`. */
+  async init() {
+    await this.withTx(async () => {
+      await this.db.run(`CREATE TABLE IF NOT EXISTS ${this.swaps} (
+                id TEXT PRIMARY KEY,
+                status TEXT NOT NULL,
+                created_at INTEGER NOT NULL,
+                data TEXT NOT NULL
+            )`);
+      await this.db.run(
+        `CREATE INDEX IF NOT EXISTS idx_${this.prefix}asset_swaps_status ON ${this.swaps} (status)`
+      );
+      await this.db.run(
+        `CREATE INDEX IF NOT EXISTS idx_${this.prefix}asset_swaps_created_at ON ${this.swaps} (created_at)`
+      );
+      await this.db.run(`CREATE TABLE IF NOT EXISTS ${this.scanned} (txid TEXT PRIMARY KEY)`);
+      await this.db.run(
+        `CREATE TABLE IF NOT EXISTS ${this.markets} (cache_key TEXT PRIMARY KEY, data TEXT NOT NULL)`
+      );
+    });
+  }
+  /** Every write, including the single-statement ones. The chain serializes
+   * transaction *blocks*, not bare statements: one issued between a
+   * neighbour's BEGIN IMMEDIATE and its COMMIT becomes part of that
+   * transaction and dies with it. `fn` must issue only raw db calls — no
+   * repository method, no `ensureInit` — since `runInTransaction` cannot
+   * nest. */
+  withTx(fn) {
+    return runInTransaction(this.db, fn);
+  }
+  async saveSwap(swap) {
+    await this.ensureInit();
+    await this.withTx(async () => {
+      await this.db.run(
+        `INSERT OR REPLACE INTO ${this.swaps} (id, status, created_at, data)
+                 VALUES (?, ?, ?, ?)`,
+        [swap.id, swap.status, swap.createdAt, JSON.stringify(swap)]
+      );
+    });
+  }
+  async getAllSwaps() {
+    await this.ensureInit();
+    const rows = await this.db.all(`SELECT data FROM ${this.swaps}`);
+    return rows.map((r) => JSON.parse(r.data));
+  }
+  async getScannedTxids() {
+    await this.ensureInit();
+    const rows = await this.db.all(`SELECT txid FROM ${this.scanned}`);
+    return new Set(rows.map((r) => r.txid));
+  }
+  async markTxidsScanned(txids) {
+    await this.ensureInit();
+    const all = [...txids];
+    if (all.length === 0) return;
+    await this.withTx(async () => {
+      for (let i = 0; i < all.length; i += INSERT_CHUNK) {
+        const chunk = all.slice(i, i + INSERT_CHUNK);
+        await this.db.run(
+          `INSERT OR IGNORE INTO ${this.scanned} (txid) VALUES ${chunk.map(() => "(?)").join(", ")}`,
+          chunk
+        );
+      }
+    });
+  }
+  async getCachedMarkets(network, registry) {
+    await this.ensureInit();
+    const row = await this.db.get(
+      `SELECT data FROM ${this.markets} WHERE cache_key = ?`,
+      [marketsCacheKey(network, registry)]
+    );
+    return row ? JSON.parse(row.data) : void 0;
+  }
+  async saveCachedMarkets(network, registry, entry) {
+    await this.ensureInit();
+    await this.withTx(async () => {
+      await this.db.run(
+        `INSERT OR REPLACE INTO ${this.markets} (cache_key, data) VALUES (?, ?)`,
+        [marketsCacheKey(network, registry), JSON.stringify(entry)]
+      );
+    });
+  }
+  /** All three tables in one transaction: clearing swaps but keeping scanned
+   * txids would leave the restore scan permanently skipping those funding
+   * txs, so a partial clear must not be observable. */
+  async clear() {
+    await this.ensureInit();
+    await this.withTx(async () => {
+      await this.db.run(`DELETE FROM ${this.swaps}`);
+      await this.db.run(`DELETE FROM ${this.scanned}`);
+      await this.db.run(`DELETE FROM ${this.markets}`);
+    });
+  }
+  async [Symbol.asyncDispose]() {
+  }
+};
+export {
+  SQLiteAssetSwapRepository
+};

package/dist/repository-BwnZ8N62.d.cts

@@ -0,0 +1,236 @@
+import { DiscoveredMarket } from '@arkade-os/solver-discovery';
+import { IWallet, ProvisionedKey, ProvisionedClaimSecret } from '@arkade-os/sdk';
+
+type AssetSwapStatus = "pending" | "cancelling" | "fulfilled" | "cancelled" | "recoverable" | "awaiting_fill" | "claimable" | "claimed" | "refunded_l1";
+/** The sentinel asset id for BTC itself, as opposed to a 68-hex asset id.
+ * Lives here with the {@link AssetSwap} fields it describes so the market and
+ * restore layers share one spelling instead of re-typing the literal. */
+declare const BTC_ASSET_ID = "btc";
+/**
+ * The record fields a wallet-provisioned secret becomes — what
+ * {@link swapSecretsToRecord} emits, and what every record type carrying swap
+ * secrets embeds.
+ *
+ * A named type rather than four fields restated per record: the mapper and the
+ * records it feeds must agree exactly, and a record that silently omits one of
+ * these round-trips a swap whose preimage cannot be re-derived. Embedding makes
+ * the omission a compile error instead.
+ *
+ * **Only `preimageHex` is secret.** `signingDescriptor` and `preimageSaltHex`
+ * are public derivation inputs — they must survive a field-mapped backend, but
+ * they leak nothing without the seed.
+ */
+interface SwapSecretsProjection {
+    /**
+     * The wallet descriptor this swap's sender key comes from — a fresh HD
+     * child, or a static wallet's `tr(pubkey)`. Public — the signer
+     * re-derives from the wallet, so the record carries no key material.
+     */
+    signingDescriptor?: string;
+    /** P, hex, when it cannot be re-derived from the seed at all: the user
+     * supplied it, or the signer cannot sign deterministically. The swap's only
+     * claim secret when present. */
+    preimageHex?: string;
+    /**
+     * The salt P derives from, hex, on the salted arm — what a static wallet
+     * gets instead of storing P. **Public**, and unlike every other field here
+     * it is minted per swap: it is what stops one repeating key from handing
+     * every swap the same preimage.
+     */
+    preimageSaltHex?: string;
+}
+interface AssetSwap extends SwapSecretsProjection {
+    /** Funding txid — the swap's identity. */
+    id: string;
+    /** 'btc' or a 68-hex asset id. */
+    fromAsset: string;
+    toAsset: string;
+    /** Atomic amounts as strings (bigint is not JSON-safe). */
+    fromAmount: string;
+    /** The covenant wantAmount — a floor, the fill pays >= this. */
+    toAmount: string;
+    swapAddress: string;
+    /** Hex pkScript of the swap contract — the indexer monitoring key. */
+    swapPkScript: string;
+    /** TLV offer — needed to rebuild the contract for cancel. */
+    offerHex: string;
+    fundingTxid: string;
+    spentTxid?: string;
+    status: AssetSwapStatus;
+    createdAt: number;
+    completedAt?: number;
+    /** RFQ pair string, e.g. `arkade:BTC->onchain:BTC`. */
+    pair?: string;
+    /** `sha256(P)`, hex. Public, and how a restore confirms a candidate
+     * derivation is the right one. */
+    paymentHash?: string;
+    /** The L1 HTLC's pkScript, hex — the chain-watch key. */
+    htlcPkScriptHex?: string;
+    htlcLocktime?: number;
+    /** The L1 funding txid, once observed. */
+    l1Txid?: string;
+}
+/** All swaps, newest-first. Insertion order is not chronological — the restore
+ * scan rebuilds records in tx-scan order — so sort at read to keep
+ * newest-first canonical for every consumer. */
+declare const getAssetSwapsOrThrow: (repository: AssetSwapRepository) => Promise<AssetSwap[]>;
+/** The consumer read: a broken backend reads as no swaps rather than crashing
+ * a history view. Mutations must use {@link getAssetSwapsOrThrow} instead —
+ * swallowing the read there would let "the backend is gone" masquerade as "no
+ * such swap" and skip the write silently. */
+declare const getAssetSwaps: (repository: AssetSwapRepository) => Promise<AssetSwap[]>;
+/** Add a swap; no-op if the id is already stored. Returns the updated list.
+ * THROWS on a failed write — nothing irreversible may happen until this record
+ * is durable, so the caller must not fund on a failure. */
+declare const addAssetSwap: (repository: AssetSwapRepository, swap: AssetSwap) => Promise<AssetSwap[]>;
+/** Merge changes into a swap by id. Returns the updated list.
+ * THROWS on a failed read or write, like {@link addAssetSwap} — use this for a
+ * write that gates something irreversible. Transitions written *after* the
+ * irreversible act belong on {@link updateAssetSwapBestEffort}. */
+declare const updateAssetSwap: (repository: AssetSwapRepository, id: string, changes: Partial<Omit<AssetSwap, "id">>) => Promise<AssetSwap[]>;
+/**
+ * {@link updateAssetSwap} for transitions that follow an irreversible action (a
+ * broadcast claim, a spent lockup): failing the caller there would report as
+ * failed a swap whose funds already moved, and a stale status is recoverable —
+ * crash recovery re-derives the true state from the chain
+ * (`classifyOnchainHtlc`).
+ *
+ * `persisted` is the part that must not be hidden: a caller that notifies on a
+ * change, or treats one as terminal, has to know the store did not agree.
+ */
+declare const updateAssetSwapBestEffort: (repository: AssetSwapRepository, id: string, changes: Partial<Omit<AssetSwap, "id">>) => Promise<{
+    swaps: AssetSwap[];
+    persisted: boolean;
+}>;
+/**
+ * The record fields a wallet-provisioned secret becomes.
+ *
+ * `signingDescriptor` is public and always stored — it is what recovers the
+ * signer. Then at most one of: `preimageHex`, when the wallet says it cannot
+ * re-derive P and it becomes the swap's only claim secret; or
+ * `preimageSaltHex`, the public input a derivable-but-repeating key needs.
+ */
+declare const swapSecretsToRecord: (secrets: ProvisionedKey | ProvisionedClaimSecret) => SwapSecretsProjection & {
+    signingDescriptor: string;
+};
+/** Why a wallet cannot produce a swap's preimage. */
+type PreimageBlockedReason = 
+/** The record carries no `signingDescriptor`. */
+"no-secrets"
+/** `preimageHex` or `preimageSaltHex` is present but not 32 bytes of hex. */
+ | "malformed-record"
+/**
+ * Nothing to derive from: a descriptor that repeats across swaps, with
+ * neither a stored preimage nor a salt — or one this wallet holds no key
+ * for. Merged deliberately: `contractSigner` reports a key it does not
+ * hold as a plain `Error` for static wallets and a `ForeignDescriptorError`
+ * for HD ones, so splitting the two here would mean matching on message
+ * text, which is the thing this type exists to avoid. The `cause` carries
+ * whichever it was.
+ */
+ | "not-derivable"
+/** Derived, but it does not hash to the record's `paymentHash`. */
+ | "hash-mismatch";
+/**
+ * The wallet cannot produce this swap's preimage, and which of the four ways
+ * is `reason`.
+ *
+ * Deliberately **not** {@link RefundNotLocallyPossibleError}: that one means
+ * "no local refund is possible", and `RfqSwapManager` acts on it by reporting
+ * `needs_counterparty`. A claim-path read failure is a different verdict, and
+ * borrowing the refund error would have the manager announce one for the
+ * other.
+ */
+declare class PreimageNotRecoverableError extends Error {
+    readonly reason: PreimageBlockedReason;
+    readonly name = "PreimageNotRecoverableError";
+    constructor(reason: PreimageBlockedReason, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * The preimage a swap record claims with — stored, or re-derived from the
+ * wallet.
+ *
+ * The record-shaped inverse of {@link swapSecretsToRecord}, and the one place
+ * that knows which of a record's fields `contractPreimage` needs. Wire claim
+ * paths here rather than composing it by hand: a caller that forgets to pass
+ * `preimageSaltHex` gets a *wrong* preimage from a wallet that can derive,
+ * not an error.
+ *
+ * Verifies the result against `paymentHash` when the record carries one. The
+ * salted arm has two inputs that can be wrong — the key and the salt — where
+ * the HD arm had one, and a wrong P otherwise surfaces as an opaque script
+ * failure at claim time, long after the mistake.
+ *
+ * Every refusal is a {@link PreimageNotRecoverableError} carrying a `reason`,
+ * so a caller can tell "this record predates the descriptor" from "the salt is
+ * corrupt" without reading message text.
+ */
+declare const preimageForSwapRecord: (wallet: IWallet, record: SwapSecretsProjection & {
+    paymentHash?: string;
+}) => Promise<Uint8Array>;
+
+/** A registry discovery result held for reuse. Refetchable — unlike a swap
+ * record, losing it costs one network round trip — but it must survive a cold
+ * boot: serving it stale is what keeps quoting alive while a registry is down. */
+interface MarketsCacheEntry {
+    markets: DiscoveredMarket[];
+    fetchedAt: number;
+}
+/**
+ * Everything the package persists, following the monorepo repository
+ * convention (versioned interface, AsyncDisposable, one backend per
+ * platform — see the Boltz plugin's SwapRepository). Consumers construct
+ * exactly one of these; there is no second storage seam.
+ *
+ * Durable records (swaps) and rebuildable state (the restore scan's txid
+ * cursor, the markets cache) live side by side because they share a
+ * lifetime: all three belong to one wallet on one device, and a consumer
+ * that wipes one wants all three gone.
+ *
+ * ponytail: no query filters — every consumer reads all swaps and filters
+ * in memory; mirror the Boltz plugin's GetSwapsFilter when a consumer needs
+ * subset queries.
+ */
+interface AssetSwapRepository extends AsyncDisposable {
+    readonly version: 2;
+    /** Insert or replace a swap by id. Store the record whole: `preimageHex`
+     * and `preimageSaltHex` both leave the swap unclaimable if a field-mapped
+     * backend drops them — the first is the only claim secret of a swap whose
+     * signer cannot derive, the second the public input every other static
+     * wallet's preimage derives from.
+     *
+     * Records must be **JSON-safe**: the SQLite and Realm backends serialize
+     * the record to JSON, so a `Date` in a consumer-added field comes back a
+     * string, a `Set`/`Map` comes back empty, and a `bigint` throws here —
+     * none of which happens on IndexedDB's structured clone. `AssetSwap` as
+     * declared is JSON-safe; keep added fields that way. */
+    saveSwap(swap: AssetSwap): Promise<void>;
+    /** All stored swaps, in no particular order — `getAssetSwaps` is the
+     * canonical newest-first read. */
+    getAllSwaps(): Promise<AssetSwap[]>;
+    /** Sent txids already checked for offer packets (see restore.ts). */
+    getScannedTxids(): Promise<Set<string>>;
+    markTxidsScanned(txids: Iterable<string>): Promise<void>;
+    /** Cached registry markets, or undefined on a miss. */
+    getCachedMarkets(network: string, registry: string): Promise<MarketsCacheEntry | undefined>;
+    saveCachedMarkets(network: string, registry: string, entry: MarketsCacheEntry): Promise<void>;
+    clear(): Promise<void>;
+}
+declare class InMemoryAssetSwapRepository implements AssetSwapRepository {
+    readonly version: 2;
+    private readonly swaps;
+    private readonly scanned;
+    private readonly markets;
+    saveSwap(swap: AssetSwap): Promise<void>;
+    getAllSwaps(): Promise<AssetSwap[]>;
+    getScannedTxids(): Promise<Set<string>>;
+    markTxidsScanned(txids: Iterable<string>): Promise<void>;
+    getCachedMarkets(network: string, registry: string): Promise<MarketsCacheEntry | undefined>;
+    saveCachedMarkets(network: string, registry: string, entry: MarketsCacheEntry): Promise<void>;
+    clear(): Promise<void>;
+    [Symbol.asyncDispose](): Promise<void>;
+}
+
+export { type AssetSwapRepository as A, BTC_ASSET_ID as B, InMemoryAssetSwapRepository as I, type MarketsCacheEntry as M, type PreimageBlockedReason as P, type SwapSecretsProjection as S, type AssetSwap as a, type AssetSwapStatus as b, PreimageNotRecoverableError as c, addAssetSwap as d, getAssetSwapsOrThrow as e, updateAssetSwapBestEffort as f, getAssetSwaps as g, preimageForSwapRecord as p, swapSecretsToRecord as s, updateAssetSwap as u };