@arkade-os/swap 0.0.7 → 0.0.8

package/dist/repository-BcZ9LXRP.d.ts

@@ -0,0 +1,1862 @@
+import { DiscoveredMarket } from '@arkade-os/solver-discovery';
+import { IWallet, ProvisionedKey, ProvisionedClaimSecret, RestArkProvider, RestIndexerProvider, VHTLC, Identity, IContractManager } from '@arkade-os/sdk';
+import { w as RfqStatus, x as RfqTransport, a as OnchainHtlc, e as ChainUtxo, C as ChainSource, s as OnchainHtlcPhase } from './rfq-C-aq5LDJ.js';
+
+type AssetSwapStatus = "pending" | "cancelling" | "fulfilled" | "cancelled" | "recoverable" | "awaiting_fill" | "claimable" | "claimed" | "refunded_l1";
+/** The sentinel asset id for BTC itself, as opposed to a 68-hex asset id.
+ * Lives here with the {@link AssetSwap} fields it describes so the market and
+ * restore layers share one spelling instead of re-typing the literal. */
+declare const BTC_ASSET_ID = "btc";
+/**
+ * The record fields a wallet-provisioned secret becomes — what
+ * {@link swapSecretsToRecord} emits, and what every record type carrying swap
+ * secrets embeds.
+ *
+ * A named type rather than four fields restated per record: the mapper and the
+ * records it feeds must agree exactly, and a record that silently omits one of
+ * these round-trips a swap whose preimage cannot be re-derived. Embedding makes
+ * the omission a compile error instead.
+ *
+ * **Only `preimageHex` is secret.** `signingDescriptor` and `preimageSaltHex`
+ * are public derivation inputs — they must survive a field-mapped backend, but
+ * they leak nothing without the seed.
+ */
+interface SwapSecretsProjection {
+    /**
+     * The wallet descriptor this swap's sender key comes from — a fresh HD
+     * child, or a static wallet's `tr(pubkey)`. Public — the signer
+     * re-derives from the wallet, so the record carries no key material.
+     */
+    signingDescriptor?: string;
+    /** P, hex, when it cannot be re-derived from the seed at all: the user
+     * supplied it, or the signer cannot sign deterministically. The swap's only
+     * claim secret when present. */
+    preimageHex?: string;
+    /**
+     * The salt P derives from, hex, on the salted arm — what a static wallet
+     * gets instead of storing P. **Public**, and unlike every other field here
+     * it is minted per swap: it is what stops one repeating key from handing
+     * every swap the same preimage.
+     */
+    preimageSaltHex?: string;
+}
+interface AssetSwap extends SwapSecretsProjection {
+    /** Funding txid — the swap's identity. */
+    id: string;
+    /** 'btc' or a 68-hex asset id. */
+    fromAsset: string;
+    toAsset: string;
+    /** Atomic amounts as strings (bigint is not JSON-safe). */
+    fromAmount: string;
+    /** The covenant wantAmount — a floor, the fill pays >= this. */
+    toAmount: string;
+    swapAddress: string;
+    /** Hex pkScript of the swap contract — the indexer monitoring key. */
+    swapPkScript: string;
+    /** TLV offer — needed to rebuild the contract for cancel. */
+    offerHex: string;
+    fundingTxid: string;
+    spentTxid?: string;
+    status: AssetSwapStatus;
+    createdAt: number;
+    completedAt?: number;
+    /** RFQ pair string, e.g. `arkade:BTC->onchain:BTC`. */
+    pair?: string;
+    /** `sha256(P)`, hex. Public, and how a restore confirms a candidate
+     * derivation is the right one. */
+    paymentHash?: string;
+    /** The L1 HTLC's pkScript, hex — the chain-watch key. */
+    htlcPkScriptHex?: string;
+    htlcLocktime?: number;
+    /** The L1 funding txid, once observed. */
+    l1Txid?: string;
+}
+/** All swaps, newest-first. Insertion order is not chronological — the restore
+ * scan rebuilds records in tx-scan order — so sort at read to keep
+ * newest-first canonical for every consumer. */
+declare const getAssetSwapsOrThrow: (repository: AssetSwapRepository) => Promise<AssetSwap[]>;
+/** The consumer read: a broken backend reads as no swaps rather than crashing
+ * a history view. Mutations must use {@link getAssetSwapsOrThrow} instead —
+ * swallowing the read there would let "the backend is gone" masquerade as "no
+ * such swap" and skip the write silently. */
+declare const getAssetSwaps: (repository: AssetSwapRepository) => Promise<AssetSwap[]>;
+/** Add a swap; no-op if the id is already stored. Returns the updated list.
+ * THROWS on a failed write — nothing irreversible may happen until this record
+ * is durable, so the caller must not fund on a failure. */
+declare const addAssetSwap: (repository: AssetSwapRepository, swap: AssetSwap) => Promise<AssetSwap[]>;
+/** Merge changes into a swap by id. Returns the updated list.
+ * THROWS on a failed read or write, like {@link addAssetSwap} — use this for a
+ * write that gates something irreversible. Transitions written *after* the
+ * irreversible act belong on {@link updateAssetSwapBestEffort}. */
+declare const updateAssetSwap: (repository: AssetSwapRepository, id: string, changes: Partial<Omit<AssetSwap, "id">>) => Promise<AssetSwap[]>;
+/**
+ * {@link updateAssetSwap} for transitions that follow an irreversible action (a
+ * broadcast claim, a spent lockup): failing the caller there would report as
+ * failed a swap whose funds already moved, and a stale status is recoverable —
+ * crash recovery re-derives the true state from the chain
+ * (`classifyOnchainHtlc`).
+ *
+ * `persisted` is the part that must not be hidden: a caller that notifies on a
+ * change, or treats one as terminal, has to know the store did not agree.
+ */
+declare const updateAssetSwapBestEffort: (repository: AssetSwapRepository, id: string, changes: Partial<Omit<AssetSwap, "id">>) => Promise<{
+    swaps: AssetSwap[];
+    persisted: boolean;
+}>;
+/**
+ * The record fields a wallet-provisioned secret becomes.
+ *
+ * `signingDescriptor` is public and always stored — it is what recovers the
+ * signer. Then at most one of: `preimageHex`, when the wallet says it cannot
+ * re-derive P and it becomes the swap's only claim secret; or
+ * `preimageSaltHex`, the public input a derivable-but-repeating key needs.
+ */
+declare const swapSecretsToRecord: (secrets: ProvisionedKey | ProvisionedClaimSecret) => SwapSecretsProjection & {
+    signingDescriptor: string;
+};
+/** Why a wallet cannot produce a swap's preimage. */
+type PreimageBlockedReason = 
+/** The record carries no `signingDescriptor`. */
+"no-secrets"
+/** `preimageHex` or `preimageSaltHex` is present but not 32 bytes of hex. */
+ | "malformed-record"
+/**
+ * Nothing to derive from: a descriptor that repeats across swaps, with
+ * neither a stored preimage nor a salt — or one this wallet holds no key
+ * for. Merged deliberately: `contractSigner` reports a key it does not
+ * hold as a plain `Error` for static wallets and a `ForeignDescriptorError`
+ * for HD ones, so splitting the two here would mean matching on message
+ * text, which is the thing this type exists to avoid. The `cause` carries
+ * whichever it was.
+ */
+ | "not-derivable"
+/** Derived, but it does not hash to the record's `paymentHash`. */
+ | "hash-mismatch";
+/**
+ * The wallet cannot produce this swap's preimage, and which of the four ways
+ * is `reason`.
+ *
+ * Deliberately **not** {@link RefundNotLocallyPossibleError}: that one means
+ * "no local refund is possible", and `RfqSwapManager` acts on it by reporting
+ * `needs_counterparty`. A claim-path read failure is a different verdict, and
+ * borrowing the refund error would have the manager announce one for the
+ * other.
+ */
+declare class PreimageNotRecoverableError extends Error {
+    readonly reason: PreimageBlockedReason;
+    readonly name = "PreimageNotRecoverableError";
+    constructor(reason: PreimageBlockedReason, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * The preimage a swap record claims with — stored, or re-derived from the
+ * wallet.
+ *
+ * The record-shaped inverse of {@link swapSecretsToRecord}, and the one place
+ * that knows which of a record's fields `contractPreimage` needs. Wire claim
+ * paths here rather than composing it by hand: a caller that forgets to pass
+ * `preimageSaltHex` gets a *wrong* preimage from a wallet that can derive,
+ * not an error.
+ *
+ * Verifies the result against `paymentHash` when the record carries one. The
+ * salted arm has two inputs that can be wrong — the key and the salt — where
+ * the HD arm had one, and a wrong P otherwise surfaces as an opaque script
+ * failure at claim time, long after the mistake.
+ *
+ * Every refusal is a {@link PreimageNotRecoverableError} carrying a `reason`,
+ * so a caller can tell "this record predates the descriptor" from "the salt is
+ * corrupt" without reading message text.
+ */
+declare const preimageForSwapRecord: (wallet: IWallet, record: SwapSecretsProjection & {
+    paymentHash?: string;
+}) => Promise<Uint8Array>;
+
+/** True for the states after which the solver will report nothing further. */
+declare const isRfqTerminal: (state: string) => boolean;
+/**
+ * The terminal states that mean the swap is OVER and the lockup is already
+ * gone — the solver either claimed it (`settled`, revealing the preimage) or
+ * returned it (`refunded`). A trader seeing one of these has nothing left to
+ * do.
+ *
+ * Deliberately narrower than {@link RFQ_TERMINAL_STATES}: `refused`, `expired`
+ * and `stuck` are terminal for the NEGOTIATION but say nothing about whether
+ * the trader's sats are still sitting at the lockup. A trader that funded just
+ * as the quote expired, or whose solver wedged mid-payment, is exactly the
+ * trader who needs the refund most — so those states must not short-circuit
+ * it. {@link refundIfUnresolved} treats them as "keep going", and lets the
+ * on-chain VTXO lookup be the authority on whether anything is actually there.
+ */
+declare const RFQ_RESOLVED_STATES: readonly ["settled", "refunded"];
+/**
+ * Poll a swap's status until it reaches a terminal state.
+ *
+ * Same shape and conventions as {@link awaitOnchainFill}: a `pollMs` interval,
+ * an optional unix-seconds `deadline`, and a thrown error carrying a stable
+ * `reason` when that deadline passes.
+ *
+ * A `null` status (the solver has no record of this `rfq_id`) is treated as
+ * "not yet", not as an answer — a status route can legitimately 404 for a
+ * moment after a quote is issued. The deadline is what bounds that wait.
+ *
+ * Transport errors are NOT swallowed; a failing `status()` call rejects this
+ * function. Callers polling across a long refund window should expect to
+ * restart it after a network blip — nothing is lost by doing so, since the
+ * refund path this feeds is gated on an absolute timelock that does not
+ * expire.
+ */
+declare function awaitRfqResolution(transport: RfqTransport, rfqId: string, options?: {
+    pollMs?: number;
+    deadline?: number;
+}): Promise<RfqStatus>;
+/** The Ark surface the refund push needs — narrower than a full provider, and
+ * satisfied by {@link RestArkProvider}. Same seam style as `RestoreIndexer`. */
+type RefundArkProvider = Pick<RestArkProvider, "getInfo" | "submitTx" | "finalizeTx">;
+/** The indexer surface the lockup lookup needs. */
+type RefundIndexer = Pick<RestIndexerProvider, "getVtxos">;
+/** A still-refundable virtual output sitting at the swap lockup. */
+interface LockupVtxo {
+    txid: string;
+    vout: number;
+    value: number;
+    /**
+     * The batch this output lived in expired and the operator swept it, so it
+     * is no longer a live leaf — it can be RECOVERED, but not spent offchain.
+     *
+     * It is still the trader's money and it is still visible, which is why
+     * {@link findLockupVtxos} returns it. What it is not is refundable by
+     * {@link pushRefundWithoutReceiver}: that builds an offchain Ark
+     * transaction, and the SDK's own predicates make the two states mutually
+     * exclusive — `canSpendOffchain` is false exactly when `canRecoverOnchain`
+     * is true (`wallet/vtxo.ts`), and the latter is documented as "must be
+     * recovered into a fresh batch rather than spent offchain". Holding the
+     * trader's `sender` key does not change that; a sweep removes the leaf from
+     * the live tree, not the signature from the trader.
+     *
+     * `packages/boltz-swap` splits on exactly this fact rather than working
+     * around it: `settleRefundWithoutReceiver` sends a live VTXO through an
+     * offchain tx and a recoverable one through `joinBatch` — "a swept
+     * (recoverable) VTXO is no longer a live leaf, so it can only be reclaimed
+     * by re-registering it into a batch".
+     *
+     * So the remedy is recovery (renewing the output into a fresh batch),
+     * after which the ordinary CLTV refund works again. This package does not
+     * build that round — see {@link pushRefundWithoutReceiver}, which refuses
+     * rather than submitting a spend that cannot succeed.
+     */
+    recoverable: boolean;
+}
+/**
+ * Thrown when a refund was asked for over outputs that have been swept.
+ *
+ * Carries the outpoints so a caller can act — recover exactly those, then
+ * retry — instead of reading a server rejection and guessing. `reason` follows
+ * the same convention as `awaitOnchainFill`'s `fill_timeout` and
+ * `claimOnchainFill`'s `claim_window_closed`.
+ *
+ * **The remedy already exists; this package does not reimplement it.** The SDK
+ * recovers swept outputs by re-registering them into a fresh batch, through
+ * `IVtxoManager.recoverVtxos()` — the same batch round `packages/boltz-swap`
+ * reaches via its own `joinBatch`. It reads the wallet's registered-contract
+ * snapshot (`recoverVtxos` → `wallet.getVtxos({ withRecoverable: true })` →
+ * `contractSnapshot()` → `contractManager.getContractsWithVtxos()`), so it
+ * covers a swap lockup as soon as that lockup is registered as a contract —
+ * which is what {@link RfqSwapManagerDeps.contracts} does. Registration is
+ * therefore not only a latency optimization; it is what turns a swept lockup
+ * from a dead end into something the ordinary wallet path can recover.
+ *
+ * Two caveats a caller must hold, neither enforceable from here:
+ *
+ * - **The wallet must hold the lockup's `sender` key**, because recovery
+ *   settles through `refundWithoutReceiver` — the leaf `vhtlc-v2` annotates
+ *   these VTXOs with.
+ * - **`refundLocktime` must have matured.** That leaf carries a CLTV, so a
+ *   recovery round including this VTXO earlier is rejected. `recoverVtxos`
+ *   sweeps every recoverable output in ONE settlement and has no CLTV
+ *   awareness, so recovering early can fail the whole batch rather than just
+ *   this output. `packages/boltz-swap` encodes the same rule as "pre-CLTV
+ *   recoverable → skipped".
+ */
+declare class LockupNeedsRecoveryError extends Error {
+    readonly name = "LockupNeedsRecoveryError";
+    readonly reason = "needs_recovery";
+    /** `txid:vout` for each output that must be recovered first. */
+    readonly outpoints: string[];
+    /**
+     * The contract's `refundLocktime`. Recovering before this matures is the
+     * hazard described above: `recoverVtxos()` sweeps EVERY recoverable output
+     * into one settlement with no CLTV awareness, so an early attempt can fail
+     * the whole batch — including unrelated outputs that were otherwise fine.
+     *
+     * Exposed as a value, not only inside the message, so a caller can encode
+     * `packages/boltz-swap`'s "pre-CLTV recoverable → skipped" rule without
+     * parsing prose. Seconds-based locktimes mature against the chain tip's
+     * timestamp rather than wall clock, so treat this as a floor to wait past,
+     * not an exact alarm.
+     */
+    readonly recoverableAfter: bigint;
+    constructor(outpoints: string[], recoverableAfter: bigint);
+}
+/**
+ * Every output still sitting at the lockup script — spendable AND
+ * swept-but-recoverable, each tagged with which it is.
+ *
+ * All of them, not the first: a trader may fund a lockup in more than one
+ * send, and refunding only `vtxos[0]` returns part of the money and strands
+ * the rest at a script whose other refund paths are all longer.
+ *
+ * BOTH queries, because they are disjoint sets and `spendableOnly` alone goes
+ * blind at exactly the wrong moment. A lockup whose batch expiry passed is
+ * swept into the recoverable set, and this function exists to serve swaps that
+ * sat unresolved — which are precisely the ones most likely to have got there.
+ * Reading only the spendable set would report `nothing_to_refund` over money
+ * that is still sitting at the script, which is worse than an error: it looks
+ * like a resolved swap. `packages/boltz-swap` merges the same two queries for
+ * the same reason (`arkade-swaps.ts`'s `refundableVtxos`).
+ *
+ * **Visible is not the same as refundable.** A `recoverable` output cannot be
+ * spent offchain at all — see {@link LockupVtxo.recoverable} — so this set is
+ * "what is there", not "what {@link pushRefundWithoutReceiver} can take back".
+ * That function refuses the recoverable ones by name rather than submitting a
+ * spend the server must reject.
+ *
+ * This read — not the RFQ's reported state — is the authority on whether
+ * there is anything left at the lockup.
+ *
+ * **Not replaced by the contract manager's VTXO state, deliberately.** Once a
+ * lockup is registered (see `RfqSwapManagerDeps.contracts`) the wallet tracks
+ * these same outputs, and `getContractsWithVtxos` plus `canSpendOffchain` /
+ * `canRecoverOnchain` would classify them. That is a WEAKER answer here on two
+ * counts: it serves the wallet REPOSITORY, which a degraded sync will happily
+ * hand back stale (`getSyncState()` reports `degraded` and returns cached rows
+ * rather than failing), and its height-based expiry test needs a chain tip this
+ * module does not have. The two queries below ask the indexer itself and need
+ * neither. Ask-the-indexer, don't-trust-local-state — the same posture
+ * {@link readLockupFate} takes, and for the same reason: this decides money.
+ */
+declare function findLockupVtxos(indexer: RefundIndexer, swapPkScript: Uint8Array): Promise<LockupVtxo[]>;
+/**
+ * The indexer surface the lockup-spend read needs: the vtxo lookup, plus the
+ * raw transactions those vtxos were spent by. Same narrow-seam style as
+ * {@link RefundIndexer} and `restore.ts`'s `RestoreIndexer`, and satisfied by
+ * {@link RestIndexerProvider}.
+ */
+type LockupSpendIndexer = Pick<RestIndexerProvider, "getVtxos" | "getVirtualTxs">;
+/**
+ * What chain data says became of a swap lockup — the whole answer, with no
+ * solver involvement and nothing taken on the solver's word.
+ */
+interface LockupSpend {
+    /** What the vtxo's `spentBy` names — the checkpoint, never the ark
+     * transaction. */
+    checkpointTxid: string;
+    /** The ark transaction that spent the above checkpoint output. What
+     * history correlation matches on; absent when the indexer omitted it. */
+    arkTxid?: string;
+}
+type LockupFate = 
+/** At least one output at the lockup is still unspent. Not over. */
+{
+    fate: "open";
+}
+/** Spent by a witness carrying a preimage that HASHES to the quote's
+ * `payment_hash`. Only the claim leaf can reveal one, and the only
+ * legitimate way the solver obtains it is by completing its side. */
+ | {
+    fate: "claimed";
+    preimage: Uint8Array;
+    spends: readonly LockupSpend[];
+}
+/** Fully spent, and nothing that spent it revealed a matching preimage —
+ * so the money went back to the trader. See {@link readLockupFate}. */
+ | {
+    fate: "returned";
+    spends: readonly LockupSpend[];
+}
+/** Nothing was learned: no outputs visible, an output spent by nothing the
+ * indexer names, a spend it could not produce, or a blob that would not
+ * decode. Never an answer. */
+ | {
+    fate: "unknown";
+};
+/**
+ * Decide from chain data alone whether a swap lockup settled, came back, or is
+ * still live.
+ *
+ * **Why this is decidable without asking anyone.** The lockup's claim leaf can
+ * only be spent by revealing `P`, so a spend witness carrying a value that
+ * hashes to the quote's `payment_hash` is proof the claim leaf was used — and
+ * the only legitimate way the counterparty obtains `P` is by completing its
+ * side of the swap. Every OTHER leaf is a refund: `nonInteractiveRefund` is
+ * covenant-pinned to the trader's own address (`enforcePayTo(senderPkScript)`),
+ * and `refund`, `refundWithoutReceiver`, `unilateralRefund` and
+ * `unilateralRefundWithoutReceiver` all require the trader's own signature. So
+ * "spent, but not by a hash-verified claim" means the money went back to the
+ * trader, and nothing here has to trust a counterparty to say so.
+ *
+ * **A matching witness SHAPE is not proof.** Only a candidate that hashes to
+ * `paymentHash` may be read as a claim; a 32-byte item that hashes to anything
+ * else is just bytes, and is treated as a refund. Getting this wrong in the
+ * permissive direction would report "settled" for a swap that actually
+ * refunded, which is precisely the fact a trader is relying on.
+ *
+ * **`unknown` is not `returned`.** An empty vtxo set (indexer lag, or a lockup
+ * not visible yet), a `spentBy` the indexer cannot produce a transaction for,
+ * or a blob that will not decode all come back as `unknown`. `getVirtualTxs`
+ * may legitimately return fewer transactions than were asked for, so the
+ * observed set is counted rather than assumed complete. The caller's correct
+ * response to `unknown` is the same as to `open`: keep watching, and let the
+ * refund timelock — which no outage can move — be what ends the wait.
+ *
+ * Ask-the-indexer, don't-trust-local-state: read fresh on every poll, never
+ * cached, the same posture {@link findLockupVtxos} already establishes.
+ */
+declare function readLockupFate(indexer: LockupSpendIndexer, input: {
+    swapPkScript: Uint8Array;
+    /** `sha256(P)`, hex — the quote's `payment_hash`. */
+    paymentHash: string;
+}): Promise<LockupFate>;
+/**
+ * Build, sign, and push the `refundWithoutReceiver` spend: return every funded
+ * output at the lockup to the trader's refund address.
+ *
+ * The leaf is `CLTV(refundLocktime) + <sender> + <server>` — the trader's own
+ * VHTLC `sender` key and the Arkade server, and NOBODY else. In particular the
+ * emulator is not involved: it co-signs only the two covenant leaves
+ * (`nonInteractiveClaim` / `nonInteractiveRefund`), which is why the solver's
+ * own escape hatch has to go through it and this one does not. So unlike that
+ * push, this transaction is submitted SIGNED, and the only counterparty is the
+ * Arkade server doing what it does for any collaborative spend.
+ *
+ * One aggregate output, not one per input — again unlike the solver's covenant
+ * refund, which needs index-aligned outputs because its ArkadeScript inspects
+ * the output at the current input's index. This leaf carries no covenant, so a
+ * single output paying the whole balance is both valid and cheaper.
+ *
+ * `refundPkScript` defaults to the destination the contract itself commits to
+ * (`nonInteractiveRefund`'s `senderPkScript`, i.e. the address the trader gave
+ * at quote time), so the ordinary call cannot send the refund somewhere the
+ * trader did not intend. It is overridable because this leaf, having no
+ * covenant, genuinely does permit any destination.
+ *
+ * **Consensus, not wall clock, decides when this is spendable.** A seconds
+ * locktime matures against median-time-past, which trails real time by roughly
+ * an hour, so a push issued the moment `refundLocktime` passes can be rejected
+ * until enough blocks land. That is expected, not a failure — see
+ * {@link refundIfUnresolved}, which retries.
+ *
+ * **Swept outputs are refused, not attempted.** This is an OFFCHAIN spend, and
+ * a swept output is no longer a live leaf: `canSpendOffchain` and
+ * `canRecoverOnchain` are mutually exclusive by construction, so a recoverable
+ * input cannot be spent this way whatever key signs it (see
+ * {@link LockupVtxo.recoverable}). Because every input lands in ONE aggregate
+ * transaction, a single swept output would take the live ones down with it —
+ * so the whole push is refused with {@link LockupNeedsRecoveryError} naming the
+ * outpoints, rather than submitted and rejected. Filtering them out silently
+ * would be worse still: it would report success over money that never moved.
+ */
+declare function pushRefundWithoutReceiver(ark: RefundArkProvider, input: {
+    script: InstanceType<typeof VHTLC.ScriptV2>;
+    /** The `sender` signer. Build it from the swap record with
+     * {@link senderIdentityForSwapRecord} — on an HD wallet that resolves
+     * from the seed, with no stored key bytes anywhere, and every way the
+     * wallet can fail to produce it arrives as one typed
+     * {@link RefundNotLocallyPossibleError} the manager reads as permanent
+     * rather than retrying for the rest of the refund window. */
+    sender: Identity;
+    vtxos: readonly LockupVtxo[];
+    /** Defaults to the contract's own committed refund destination. */
+    refundPkScript?: Uint8Array;
+}): Promise<{
+    arkTxid: string;
+    amount: number;
+}>;
+/**
+ * How long past `refundLocktime` to keep retrying the push before giving up
+ * and surfacing the server's refusal.
+ *
+ * Two hours because the CLTV matures against median-time-past (BIP-113), which
+ * lags wall clock by about an hour, plus room for a slow block. This is the
+ * mirror of `MIN_HEADROOM_SECONDS`, which refuses to FUND without 90 minutes
+ * of the same margin.
+ */
+declare const REFUND_MTP_LAG_SECONDS: number;
+type RefundOutcome = 
+/** The solver resolved it — claimed (`settled`) or returned it (`refunded`). */
+{
+    outcome: "resolved";
+    status: RfqStatus;
+}
+/** The trader took it back via `refundWithoutReceiver`. */
+ | {
+    outcome: "refunded";
+    arkTxid: string;
+    amount: number;
+    status: RfqStatus | null;
+}
+/** The refund window opened but the lockup holds nothing to return. */
+ | {
+    outcome: "nothing_to_refund";
+    status: RfqStatus | null;
+}
+/**
+ * The money is still at the lockup, but its batch was swept, so no offchain
+ * spend can take it back until it is recovered into a fresh batch. Returned
+ * rather than retried: unlike a median-time-past refusal, no amount of
+ * waiting fixes this — see {@link LockupNeedsRecoveryError}. Recover the
+ * named outpoints, then call this again.
+ */
+ | {
+    outcome: "needs_recovery";
+    outpoints: string[];
+    vtxos: LockupVtxo[];
+    status: RfqStatus | null;
+};
+/**
+ * Ask first, then fall back: watch the swap for the solver to resolve it, and
+ * if `refundLocktime` matures without that happening, take the lockup back
+ * with `refundWithoutReceiver`.
+ *
+ * This is the whole trader-side failure story in one call. It polls `status()`
+ * — the only "asking" this protocol has (see the module doc) — and returns as
+ * soon as the solver reports `settled` or `refunded`. Otherwise, once the
+ * quote's `refund_locktime` passes, it looks up what is actually at the lockup
+ * and pushes the refund.
+ *
+ * Two behaviours worth knowing:
+ *
+ * - **A dead negotiation is not a reason to stop.** `refused`, `expired` and
+ *   `stuck` are terminal states, but a trader can be holding a funded lockup in
+ *   every one of them, so they do not end the wait — only `settled`/`refunded`
+ *   do (see {@link RFQ_RESOLVED_STATES}). What ends it otherwise is the
+ *   timelock.
+ * - **The first push after the deadline may legitimately fail.** Median-time-
+ *   past trails wall clock, so the server can still consider the leaf locked
+ *   for a while after `refundLocktime` passes in real time. Failures are
+ *   retried at the poll interval until `attemptDeadline`, after which the last
+ *   error is rethrown rather than swallowed.
+ * - **A swept lockup ends the wait instead of consuming it.** Once the batch
+ *   is gone the CLTV refund is not "not yet" but "not this way", so it returns
+ *   `needs_recovery` naming the outpoints rather than retrying until the
+ *   deadline. Recover them and call again.
+ *
+ * Safe to call late, and safe to call again: a caller recovering from a crash
+ * well past the deadline skips straight to the push, and a lockup that is
+ * already empty comes back as `nothing_to_refund` instead of an error.
+ */
+declare function refundIfUnresolved(transport: RfqTransport, ark: RefundArkProvider, indexer: RefundIndexer, input: {
+    rfqId: string;
+    script: InstanceType<typeof VHTLC.ScriptV2>;
+    /** @see pushRefundWithoutReceiver */
+    sender: Identity;
+    /** `refund_locktime` from the quote, unix seconds. */
+    refundLocktime: number;
+    /** Defaults to the contract's own committed refund destination. */
+    refundPkScript?: Uint8Array;
+    pollMs?: number;
+    /** Stop retrying the push at this unix time, rethrowing the last
+     * error. Defaults to `refundLocktime + REFUND_MTP_LAG_SECONDS`. */
+    attemptDeadline?: number;
+    /** Injected for tests; defaults to wall clock, in unix seconds. */
+    now?: () => number;
+}): Promise<RefundOutcome>;
+
+/**
+ * Where a monitored RFQ swap stands, and which of those states end it.
+ *
+ * Its own module rather than a corner of `swapManager.ts` because the
+ * dependency runs the other way: the record layer decides retention from
+ * {@link isRfqSwapTerminal}, and the manager persists through the record
+ * layer. With the vocabulary here, neither has to import the other at runtime.
+ * `swapManager.ts` re-exports all three names, so nothing about the public
+ * surface moved.
+ */
+/**
+ * Where a monitored swap stands.
+ *
+ * `claimable` and `claimed` are the states of a swap the TRADER has something
+ * to claim on: the L1 fill on an onchain send, and the solver-funded lockup on
+ * a receive. Only `lightning_send` has neither — there the solver claims the
+ * lockup, and the trader's only move is the refund.
+ */
+type RfqSwapState = 
+/** Live; nothing actionable yet. On a receive leg this covers the whole
+ * stretch before the solver funds anything. */
+"pending"
+/** There is something for the trader to take, and the window to take it is
+ * open: the confirmed L1 fill on an onchain send, or a lockup funded for at
+ * least `expectedAmount` on a receive. */
+ | "claimable"
+/**
+ * The trader's claim has been made — its L1 broadcast on an onchain send,
+ * its Arkade submission on a receive.
+ *
+ * **On a receive this is a local belief and not a chain fact**, which is
+ * why it is not terminal: `settled` is the chain's answer, and `refunded`
+ * is still reachable from here if the claim never lands and the solver
+ * takes the lockup back.
+ */
+ | "claimed"
+/**
+ * This wallet will not act, and only the counterparty can change that.
+ *
+ * On a send leg: the Arkade refund cannot be pushed from here — no secrets
+ * on the record, a descriptor from another seed, or nothing wired to act —
+ * so the lockup comes back only if the counterparty claims it or the wallet
+ * that can sign it is restored. On a receive leg: the trader holds no
+ * refund at all, so this is a lockup that cannot be claimed — funded for
+ * less than the swap agreed (publishing `P` for it is the whole attack
+ * `LockupAmountMismatchError` exists to refuse), or one whose claim window
+ * shut unclaimed. `RfqSwapCommon.blockedReason` says which.
+ *
+ * **Not terminal, and not a dead end.** The money is still at the lockup,
+ * so the counterparty's move is still observable and still ends the swap;
+ * and the refusal is re-checked every pass, so restoring the right wallet,
+ * wiring the callbacks, or the solver topping the lockup up returns the
+ * swap to `pending` and resumes the normal drive. For an onchain-send swap
+ * it says nothing about the L1 half, which keeps being driven and claimed.
+ */
+ | "needs_counterparty"
+/**
+ * Terminal: the lockup was spent by a hash-verified claim. Read off chain,
+ * never reported.
+ *
+ * On a send leg that claim is the counterparty's, and it is proof the
+ * counterparty completed its side. On a receive leg it is the TRADER's own
+ * — matched by the hash and not by our txid, so a claim that lands without
+ * us still counts (see `RfqSwapManager`).
+ */
+ | "settled"
+/**
+ * Terminal: the lockup was spent by something other than a claim.
+ *
+ * On a send leg that is the money coming back, by the solver's hand or the
+ * trader's. **On a receive leg it is a LOSS**: the lockup was the solver's
+ * money, every non-claim leaf is the solver's, and a swap that ends here
+ * ended with the trader's incoming payment never arriving. It is also where
+ * a receive swap ends when its window closes with nothing left to observe —
+ * see `RfqSwapManager`.
+ */
+ | "refunded"
+/** Terminal: an action failed and its window closed. */
+ | "failed";
+/** The states after which the manager stops monitoring a swap. Deliberately
+ * without `needs_counterparty`: retiring on it would unwatch a funded lockup
+ * whose claim is still the thing that ends the swap. */
+declare const RFQ_SWAP_TERMINAL_STATES: readonly ["settled", "refunded", "failed"];
+declare const isRfqSwapTerminal: (state: RfqSwapState) => boolean;
+
+/**
+ * What the manager needs to register a swap's lockup with the wallet, so the
+ * indexer pushes its funding and its spend instead of being asked every few
+ * seconds.
+ *
+ * Both fields are things the caller already holds. `script` is the very object
+ * `pushRefundWithoutReceiver` and `pushClaim` take, so a caller wired to act has
+ * it in hand; `address` is the request entrypoint's own return value. The
+ * address is taken rather than re-derived on purpose — the row's address must be
+ * the one that was actually funded, and a local re-derivation would silently use
+ * the SDK's default network, which is the exact bug `registerOfferContract`
+ * guards against.
+ */
+interface RfqSwapLockup {
+    /** The covenant. Its `pkScript` MUST equal the record's `lockupPkScript`. */
+    script: InstanceType<typeof VHTLC.ScriptV2>;
+    /** The Arkade address that was funded. */
+    address: string;
+}
+interface RfqSwapCommon {
+    /** The negotiation id — this record's identity. */
+    rfqId: string;
+    state: RfqSwapState;
+    /** The Arkade lockup's scriptPubKey — `swapPkScript` from any of the four
+     * request entrypoints. This is what the manager watches to decide the swap:
+     * it is the only handle on the covenant whose spend witness says whether
+     * the swap settled or came back. */
+    lockupPkScript: Uint8Array;
+    /** The covenant behind {@link lockupPkScript}, when the caller wants the
+     * lockup registered with a contract manager. Optional: without it the
+     * manager still watches the swap on its timer, it just cannot subscribe.
+     * See {@link RfqSwapManagerDeps.contracts}. */
+    lockup?: RfqSwapLockup;
+    /**
+     * `sha256(P)`, hex — the quote's `payment_hash`. The claim leaf can only
+     * be spent by revealing a value that hashes to this, which is what makes a
+     * settlement provable rather than reported. For an onchain send this is
+     * the SAME hash the L1 `htlc` carries: one `P` unlocks both legs.
+     *
+     * True of the three corridors that exist today and only of them: a hashlock
+     * belongs to a CORRIDOR, and a banco-style one settles without any. The
+     * stored record already says so — the hash lives in `profile.hashlock`, not
+     * on `RfqSwapRecord` — and this field follows onto the per-corridor swap
+     * types when the first such corridor lands. Do not read the current shape as
+     * settled.
+     */
+    paymentHash: string;
+    /**
+     * `refund_locktime` from the quote, unix seconds.
+     *
+     * Whose deadline it is inverts with the direction, and so does what to do
+     * about it. On a send leg it is the TRADER's: the lockup is the trader's
+     * money and this gates the refund that takes it back, so it is a moment to
+     * act AFTER. On a receive leg it is the SOLVER's: the trader has no refund
+     * leaf at all, and this is the moment to have claimed BEFORE.
+     */
+    refundLocktime: number;
+    createdAt: number;
+    updatedAt: number;
+    /** Set once the trader's own `refundWithoutReceiver` push landed. */
+    refundArkTxid?: string;
+    /**
+     * The ark transactions that SPENT the lockup, stamped from the chain read
+     * that ended the swap — `LockupFate.spends`, whichever verdict it reached.
+     *
+     * The counterparty's move, on every leg but one: a solver claim on a send,
+     * a solver reclaim on a receive, and — the exception — the trader's own
+     * claim when a receive settles. What they have in common is that no local
+     * action produced them, so nothing else on this record can name them:
+     * {@link refundArkTxid} names only a push this wallet made, and
+     * `claimArkTxid` only a submission it made.
+     *
+     * Stamped so a terminal record answers "which transaction ended this" from
+     * storage. Without it the only source is another read of the lockup — a
+     * network round trip per terminal swap, which is what activity correlation
+     * has to pay on the offline-first path where it is least affordable.
+     *
+     * Absent when the swap ended without a chain verdict, or when the indexer
+     * named the checkpoint but not the ark transaction — the same `arkTxid`
+     * `LockupSpend` declares optional, for the same reason.
+     */
+    lockupSpendArkTxids?: string[];
+    /** Why `state` is `failed`. */
+    failure?: string;
+    /** Why `state` is `needs_counterparty`. Distinct from {@link failure},
+     * which means an action was attempted and did not work. */
+    blockedReason?: string;
+}
+/** `arkade:BTC->lightning:BTC`. Nothing for the trader to claim: the solver
+ * claims the lockup with the preimage it learns by paying the invoice — which
+ * is exactly why that spend's witness is proof the payment landed. */
+interface LightningSendSwap extends RfqSwapCommon {
+    kind: "lightning_send";
+}
+/** `arkade:BTC->onchain:BTC`. Carries the L1 half the trader must claim. */
+interface OnchainSendSwap extends RfqSwapCommon {
+    kind: "onchain_send";
+    /** The locally derived HTLC from `requestOnchainSend` — the manager reads
+     * `pkScript`, `paymentHash` and `refundLocktime` off it to classify. */
+    htlc: OnchainHtlc;
+    /** `profile.min_confirmations` from the quote. */
+    minConfirmations: number;
+    /** The fill's outpoint, learned on first sighting. Without it a SPENT
+     * HTLC reads as never funded — see {@link classifyOnchainHtlc}. */
+    funding?: {
+        txid: string;
+        vout: number;
+    };
+    /** Our L1 claim's txid. */
+    claimTxid?: string;
+}
+/**
+ * `lightning:BTC->arkade:BTC`. The inverted leg: the SOLVER funds the lockup
+ * and the TRADER claims it, and that claim is what publishes `P` and lets the
+ * solver settle the payer's held Lightning HTLC.
+ *
+ * Two consequences shape how this record is driven, both of them absent from
+ * the send legs:
+ *
+ * - **There is no trader-side refund.** Every non-claim leaf of this covenant
+ *   is the solver's, so the manager never calls
+ *   {@link RfqSwapManagerCallbacks.refundArkade} for one of these. A swap that
+ *   is not claimed is simply lost — the solver reclaims at
+ *   {@link RfqSwapCommon.refundLocktime} and the payer is refunded when the
+ *   held HTLC lapses.
+ * - **The claim is the whole swap, and it is on a deadline.** The trader must
+ *   be online for it: covclaimd cannot claim this covenant today, so the claim
+ *   packet's offline path does not run.
+ */
+interface LightningReceiveSwap extends RfqSwapCommon {
+    kind: "lightning_receive";
+    /**
+     * What the lockup must carry — the quote's `to_amount`, captured at REQUEST
+     * time and persisted with the record.
+     *
+     * **Not re-derivable, and not optional.** Captured at claim time it would
+     * be whatever the solver funded, which is the dust-funding attack rather
+     * than a check on it. A record that reaches the manager without a finite
+     * value here is reported `needs_counterparty` and never claimed: a
+     * comparison against `undefined` or `NaN` is false, so an unusable
+     * comparand does not fail the value gate, it deletes it.
+     */
+    expectedAmount: number;
+    /** Our Arkade claim's txid, once submitted. Set from the callback's return
+     * and never from a chain read — the chain's answer is `settled`. */
+    claimArkTxid?: string;
+}
+/**
+ * A monitored swap.
+ *
+ * This is a live record, not a serialization format: `lockupPkScript` and
+ * `htlc` hold derived `Uint8Array`s, and `RfqSwapRecord` is its storable
+ * projection. Give the manager a {@link RfqSwapManagerDeps.repository} and it
+ * writes and rebuilds these itself, through
+ * {@link RfqSwapManager.restoreFromRepository}. A caller keeping its own store
+ * projects it in {@link RfqSwapManagerCallbacks.saveSwap} instead, rebuilds it
+ * on restart the way it was made — `lightningSendVtxoScript` /
+ * `receiveVtxoScript` / `onchainHtlcScript` over the quote's binding fields —
+ * and hands the result to {@link RfqSwapManager.start}.
+ *
+ * **`onchain:BTC->arkade:BTC` is deliberately not a member yet.** Its Arkade
+ * half is the same solver-funded lockup as {@link LightningReceiveSwap}'s, but
+ * it also has an L1 half the trader funds and must take back itself
+ * (`buildHtlcRefund` at the HTLC's own `htlc_locktime`), which is a second
+ * deadline, a second observation seam and a second action callback. Adding the
+ * lockup half alone would produce a manager that silently lets that L1 refund
+ * window pass — the one failure mode {@link RfqSwapManager} refuses elsewhere
+ * by name (see `driveOnchain`'s missing-`ChainSource` check). Until the L1
+ * refund is driven too, that corridor is better served by the request and claim
+ * functions directly than by a monitor that covers half of it.
+ */
+type RfqSwap = LightningSendSwap | OnchainSendSwap | LightningReceiveSwap;
+/** What the manager should do next about an onchain-send swap's L1 half. */
+type OnchainSendAction = 
+/** Not funded yet, or not confirmed deep enough. */
+"wait"
+/** Funded, confirmed, and far enough from the refund leaf to claim safely. */
+ | "claim"
+/** The claim is off the table for good; the money comes back through the
+ * Arkade lockup instead. */
+ | "claim_window_closed"
+/** Our claim already landed (only the trader holds P). */
+ | "claimed"
+/** The solver took its L1 refund — the fill is gone. */
+ | "swept";
+/**
+ * The decision a "poll status, refund on timeout" loop gets wrong.
+ *
+ * {@link OnchainHtlcPhase} runs `unfunded -> awaiting_confirmations ->
+ * claimable -> (refundable | claimed | swept)`, and `refundable` does NOT mean
+ * "time to refund the L1 HTLC" — the trader has no key on that leaf; it is the
+ * SOLVER's refund, and reaching it means the trader's claim was missed. So the
+ * L1 claim has to be driven before it, and from it the only remaining move is
+ * the Arkade-side refund.
+ *
+ * There is a second, quieter trap between those two functions:
+ * `classifyOnchainHtlc` reports `claimable` right up until median-time-past
+ * reaches `refundLocktime`, while `claimOnchainFill` refuses from
+ * {@link ONCHAIN_CLAIM_MARGIN_SECONDS} before it — because broadcasting
+ * publishes P, and doing that into the counterparty's live refund window risks
+ * losing the race AND giving away the preimage. Driving straight off the phase
+ * would therefore spend that whole margin throwing `claim_window_closed` at
+ * every poll and never fall back. This function applies the margin, so
+ * "claimable" here means claimable by `claimOnchainFill` too.
+ */
+declare function nextOnchainAction(input: {
+    phase: OnchainHtlcPhase;
+    /** `htlc.refundLocktime` — when the solver's L1 refund leaf opens. */
+    htlcLocktime: number;
+    /** Unix seconds. */
+    now: number;
+}): OnchainSendAction;
+/** What the trader's own `refundWithoutReceiver` push returned, or `null` when
+ * the lockup held nothing to return. */
+type ArkadeRefundResult = {
+    arkTxid: string;
+    amount: number;
+} | null;
+/**
+ * The money-moving half, injected. The manager decides when; these do it.
+ *
+ * Neither action gets a retry loop of its own here — see the module doc. Take
+ * `arkadeRefunder` for `refundArkade` rather than assembling it: it composes
+ * the atomic push (`findLockupVtxos` + `senderIdentityForSwapRecord` +
+ * `pushRefundWithoutReceiver`) and keeps the three rules below structural.
+ *
+ * Do NOT wire `refundArkade` to `refundIfUnresolved`: that function is the
+ * single-swap version of this whole class and brings its own status polling
+ * and its own MTP retry loop, which would nest inside the manager's.
+ *
+ * Resolve the sender key through `senderIdentityForSwapRecord`: it is
+ * what turns "this wallet cannot sign this swap" into
+ * {@link RefundNotLocallyPossibleError}, which the manager reports as
+ * `needs_counterparty` instead of retrying for the whole refund window.
+ */
+interface RfqSwapManagerCallbacks {
+    /** Build and broadcast the L1 claim. See `claimOnchainFill`. */
+    claimOnchain: (swap: OnchainSendSwap, utxo: ChainUtxo) => Promise<{
+        txid: string;
+    }>;
+    /**
+     * Claim the solver-funded lockup on a receive leg, revealing `P`. Wire it
+     * to `pushClaim` — the outputs are supplied, so `findLockupVtxos` has
+     * already been called and `claimReceiveLockup`'s wait would only sit on a
+     * lockup the manager has just seen.
+     *
+     * **Pass `expectedAmount` and `partiallyClaimed` straight through.** The
+     * manager checks the funded value before calling this, but that check
+     * decides WHEN to act; `pushClaim`'s decides whether `P` is published, and
+     * it is the one that runs with nothing between it and the signature. Two
+     * checks, one of which is load-bearing — do not drop the inner one because
+     * the outer one exists.
+     *
+     * Required here, like {@link claimOnchain}: a receive swap monitored with
+     * nothing wired to claim it is a swap that quietly expires, and a compile
+     * error is the right way to learn that. A consumer that drives only the
+     * kinds needing neither installs
+     * {@link AvailableRfqSwapManagerCallbacks} instead and takes the runtime
+     * refusal in its place.
+     */
+    claimLockup: (swap: LightningReceiveSwap, vtxos: readonly LockupVtxo[], options: {
+        /** A claim of ours is already out, so `P` is public and the value
+         * gate has nothing left to protect — pass this to `pushClaim` so a
+         * funding that arrived piecemeal can still be swept. */
+        partiallyClaimed: boolean;
+    }) => Promise<{
+        arkTxid: string;
+        amount: number;
+    }>;
+    /**
+     * Push `refundWithoutReceiver` for every output at the lockup. See
+     * `pushRefundWithoutReceiver`; return `null` for an empty lockup. Never
+     * called for a {@link LightningReceiveSwap} — that leg's refund leaf is the
+     * solver's.
+     *
+     * Only {@link RefundNotLocallyPossibleError} is read as permanent. Every
+     * other throw is treated as transient and RETRIED once a poll: each attempt
+     * reports through `onSwapFailed` unwrapped, and the swap ends `failed` only
+     * past `refundLocktime + REFUND_MTP_LAG_SECONDS`. That is deliberate for a
+     * genuinely transient failure — `LockupNeedsRecoveryError` is the
+     * case it is built for, since recovery is something the caller can perform
+     * while the window is still open — but it means a wiring mistake that
+     * throws unconditionally does not read as `needs_counterparty`. It reports
+     * once a poll for the rest of the refund window and then ends `failed`.
+     * Throw {@link RefundNotLocallyPossibleError} for anything this wallet will
+     * never be able to do.
+     */
+    refundArkade: (swap: RfqSwap) => Promise<ArkadeRefundResult>;
+    /**
+     * Whether a local refund is possible at all — the record's secrets, against
+     * this wallet. Called every pass, including *before* the refund window
+     * opens, so a swap nobody can refund says so while the solver can still
+     * act, instead of at the deadline; and so restoring the right wallet lifts
+     * the state again. Never called for a receive swap: there is no local
+     * refund there to probe for.
+     *
+     * Optional: omit to answer "yes" and learn at push time, from
+     * {@link RefundNotLocallyPossibleError}. Local by contract — no network
+     * call belongs here.
+     */
+    canRefundArkade?: (swap: RfqSwap) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /**
+     * Persist the record. Called after any pass that changed it.
+     *
+     * With {@link RfqSwapManagerDeps.repository} wired this is the SECOND
+     * write of the pass, not the only one: the manager writes the canonical
+     * `RfqSwapRecord` itself and then calls this. Both must succeed for the
+     * pass to count as persisted, so a rejection here still holds waiters and
+     * finalization back exactly as it does without a repository. A consumer
+     * whose `saveSwap` writes that same repository by hand should
+     * drop the duplicate when it wires the dep, and keep this for genuinely
+     * secondary sinks: metrics, a cache, a second store.
+     */
+    saveSwap: (swap: RfqSwap) => Promise<void>;
+}
+/**
+ * What {@link RfqSwapManager.setCallbacks} accepts: the full contract, minus
+ * the two claims that are already kind-gated at dispatch, and minus
+ * `saveSwap`. A consumer driving only lightning sends reaches neither claim,
+ * and stubbing them to throw is not a contract — it is a lie the compiler
+ * waves through.
+ *
+ * `saveSwap` is optional for the same reason one step removed: with
+ * {@link RfqSwapManagerDeps.repository} wired the manager writes the record
+ * itself, so a consumer with no second sink has nothing to put here, and a
+ * no-op stub would be that same lie. Omitting BOTH is the documented
+ * process-local mode: state is kept in memory and dies with the process,
+ * which is what a manager with no callbacks at all already does today.
+ *
+ * The strict {@link RfqSwapManagerCallbacks} is untouched and still means
+ * "fully wired", so a helper that takes one and calls `claimOnchain` keeps its
+ * guarantee. Only the parameter widens, which every existing caller satisfies.
+ *
+ * The compile-time guarantee this trades away is bought back at runtime: a
+ * kind whose claim is missing blocks — non-terminal, re-evaluated every pass,
+ * and lifted the moment `setCallbacks` supplies it.
+ */
+type AvailableRfqSwapManagerCallbacks = Omit<RfqSwapManagerCallbacks, "claimOnchain" | "claimLockup" | "saveSwap"> & Partial<Pick<RfqSwapManagerCallbacks, "claimOnchain" | "claimLockup" | "saveSwap">>;
+/** The actions the manager executes on a caller's behalf. */
+type RfqSwapActionName = "claimOnchain" | "claimLockup" | "refundArkade";
+interface RfqSwapManagerEvents {
+    /** Every state change, including ones that read as going backwards.
+     * `claimed -> claimable` is legal and expected on a receive swap the solver
+     * funds piecemeal: a lockup topped up after a claim is a new claimable
+     * event, and the label says so before the sweep goes out. Treat these
+     * states as a description of what to do next, not as a progress bar. */
+    onSwapUpdate?: (swap: RfqSwap, previous: RfqSwapState) => void;
+    /** Fired once, when a swap leaves monitoring `settled` or `refunded`.
+     * A swap that ends `failed` reports through `onSwapFailed` instead — the
+     * two are mutually exclusive. */
+    onSwapCompleted?: (swap: RfqSwap) => void;
+    /** Fired for any action that threw — including ones the manager will retry
+     * on the next pass — and once more when the swap finally ends `failed`. */
+    onSwapFailed?: (swap: RfqSwap, error: Error) => void;
+    onActionExecuted?: (swap: RfqSwap, action: RfqSwapActionName) => void;
+}
+type SwapUpdateListener = NonNullable<RfqSwapManagerEvents["onSwapUpdate"]>;
+type SwapCompletedListener = NonNullable<RfqSwapManagerEvents["onSwapCompleted"]>;
+type SwapFailedListener = NonNullable<RfqSwapManagerEvents["onSwapFailed"]>;
+type ActionExecutedListener = NonNullable<RfqSwapManagerEvents["onActionExecuted"]>;
+interface RfqSwapManagerConfig {
+    /** Drive claims and refunds automatically (default: true). With this off
+     * the manager still watches and reports, so a caller can act by hand off
+     * `claimable`. */
+    enableAutoActions?: boolean;
+    /** How often to run a pass, ms. Default 5000 — the same interval
+     * `awaitOnchainFill` and `refundIfUnresolved` poll at. */
+    pollIntervalMs?: number;
+    /** Injected for tests; defaults to wall clock, in unix seconds — the same
+     * convention `refundIfUnresolved` uses. */
+    now?: () => number;
+    events?: RfqSwapManagerEvents;
+}
+/** The contract-manager surface this needs, narrowed for injection — the same
+ * seam style as {@link LockupSpendIndexer} and `refund.ts`'s
+ * {@link RefundArkProvider}, and satisfied structurally by a real
+ * `ContractManager` (`await wallet.getContractManager()`). */
+type SwapContractRegistry = Pick<IContractManager, "createContract" | "getContracts" | "onContractEvent" | "setContractWatchState">;
+/**
+ * The record store the manager writes to, narrowed to the four RFQ methods —
+ * the same seam style as {@link LockupSpendIndexer} and
+ * {@link SwapContractRegistry}, and satisfied structurally by a real
+ * `AssetSwapRepository`.
+ *
+ * Narrowed rather than imported whole so this module keeps no runtime edge to
+ * `repository.ts`, and so a caller with a different backing store — a server
+ * process holding many wallets' records in one table — can satisfy it without
+ * implementing the offer-swap and markets halves it has no use for.
+ *
+ * Expect TWO calls per dirty swap per poll: `getRfqSwap` then `saveRfqSwap`.
+ * The read is deliberate — the store is the system of record, so a consumer's
+ * own edit to a record's origin half must not be overwritten by a copy the
+ * manager took at boot — but a backend where a keyed read is expensive should
+ * know it is on the write path, not just the restore path.
+ */
+interface RfqSwapRecordStore {
+    saveRfqSwap(record: RfqSwapRecord): Promise<void>;
+    getRfqSwap(rfqId: string): Promise<RfqSwapRecord | undefined>;
+    getAllRfqSwaps(): Promise<RfqSwapRecord[]>;
+    removeRfqSwap(rfqId: string): Promise<void>;
+}
+/**
+ * A swap was handed to the manager with a repository wired, no origin, and no
+ * record already in the store.
+ *
+ * Thrown at the door rather than at the first write, because the write happens
+ * a pass later and by then the funding is broadcast: a swap admitted here and
+ * refused at `save` would be monitored, acted on, and unwritable — the record
+ * would exist only in memory while its lockup held money, and a restart would
+ * lose it. The remedy is to pass the origin, which the caller has: it is what
+ * the request entrypoint returned.
+ */
+declare class RfqSwapOriginRequired extends Error {
+    /** The swap that could not be admitted. */
+    readonly rfqId: string;
+    constructor(rfqId: string);
+}
+/** One stored record that could not be turned back into a live swap. */
+interface RfqRestoreFailure {
+    rfqId: string;
+    /** Why — a covenant that does not derive the funded address, a lockup with
+     * no contract row, a corridor with no handler registered. */
+    error: Error;
+}
+interface RfqRestoreOptions {
+    /**
+     * Where each record's covenant parameters come from. Defaults to the
+     * lockup's own contract row, read through
+     * {@link RfqSwapManagerDeps.contracts}.
+     *
+     * Override it when the covenant lives somewhere else — a consumer keeping
+     * its own copy of `VHTLCV2ContractHandler.serializeParams(...)`, or a
+     * process with no contract manager at all. Whatever it returns is still
+     * checked against the record's funded address by `rebuildRfqSwap`, so an
+     * override cannot produce a swap watching the wrong covenant.
+     */
+    params?: (record: RfqSwapRecord) => Promise<LockupParams>;
+}
+/** What {@link RfqSwapManager.restoreFromRepository} did. Every stored record
+ * is in exactly one of the three lists. */
+interface RfqRestoreResult {
+    /** Rebuilt: monitored, or kept as finished when already terminal. */
+    restored: RfqSwap[];
+    /** Kept in the store, but not rebuildable right now. */
+    failed: RfqRestoreFailure[];
+    /** Removed: terminal and past `RFQ_SWAP_RETENTION_SECONDS`. */
+    pruned: string[];
+}
+/** The observation seams. None is owned by the manager, and none holds keys —
+ * same philosophy as `onchainHtlc.ts`'s `ChainSource`. There is no
+ * `RfqTransport` here on purpose: nothing this manager decides depends on the
+ * solver answering (see the module doc). */
+interface RfqSwapManagerDeps {
+    /** Arkade access. Required: this is how a swap's resolution is determined,
+     * for both legs. */
+    indexer: LockupSpendIndexer;
+    /** L1 access. Required to monitor onchain-send swaps; a lightning-only
+     * caller can leave it out. */
+    chain?: ChainSource;
+    /**
+     * Where the manager persists RFQ swap records, when a caller wants it to.
+     *
+     * Wiring it makes the repository the CANONICAL sink: every pass that
+     * changed a swap is written here as an {@link RfqSwapRecord}, and
+     * {@link RfqSwapManager.restoreFromRepository} reads it back. That removes
+     * the origin trap a caller otherwise hits assembling the write by hand —
+     * `updateRfqSwapRecord` needs the existing record and
+     * `createRfqSwapRecord` needs request-time facts the live swap does not
+     * carry, so the first write of a swap cannot be composed from the swap
+     * alone. The manager resolves that itself, which is what
+     * {@link RfqSwapManager.addSwap}'s `origin` parameter is for.
+     *
+     * Optional, like every other dep here: without it the manager persists
+     * through {@link RfqSwapManagerCallbacks.saveSwap} exactly as before, and
+     * without either it keeps its state in memory.
+     */
+    repository?: RfqSwapRecordStore;
+    /**
+     * The wallet's contract manager, when there is one. Optional in the same
+     * way {@link chain} is: a caller with no wallet, or one that only wants the
+     * timer, still gets a fully working manager — the subscription is a
+     * LATENCY optimization and nothing depends on it.
+     *
+     * Supplying it buys two things. The lockup gets REGISTERED, which is what
+     * puts it in the wallet's own contract set at all — a prerequisite for
+     * anything that has to act on the lockup before its batch expires, since an
+     * expired lockup is swept and loses every cooperative path. And the indexer
+     * PUSHES its funding and its spend, so a settlement is noticed when it
+     * happens rather than up to `pollIntervalMs` later.
+     *
+     * Prefer `await wallet.getContractManager()` over constructing one, the way
+     * `createOffer` does.
+     */
+    contracts?: SwapContractRegistry;
+}
+/**
+ * Watches a set of live RFQ swaps and drives each to its end.
+ *
+ * One pass per swap, in this order, every
+ * {@link RfqSwapManagerConfig.pollIntervalMs} — and additionally the moment a
+ * contract event names that swap's lockup, which changes only WHEN a pass runs,
+ * never what it concludes (see {@link subscribe}):
+ *
+ * 0. **Register the lockup**, if a contract manager was supplied and it is not
+ *    registered yet. Best-effort; never blocks the steps below.
+ * 1. **Ask the chain what became of the lockup** — {@link readLockupFate}. A
+ *    spend whose witness HASHES to the quote's `payment_hash` ends the swap
+ *    `settled`; a lockup fully spent by anything else ends it `refunded`.
+ *    Anything the indexer could not answer is `unknown`, which is NOT an
+ *    answer: the pass carries on to the steps below, whose deadlines an indexer
+ *    outage has no bearing on.
+ * 2. **Drive the trader's claim.** On an onchain send that is the L1 fill — see
+ *    {@link nextOnchainAction}. On a receive it is the lockup itself, and it
+ *    ends the pass: that leg has no step 3.
+ * 3. **Take the lockup back**, send legs only, once `refundLocktime` has passed
+ *    and step 1 has not ended the swap. This runs for onchain-send too,
+ *    including after a successful claim: the trader's lockup is still funded and
+ *    still theirs to recover if the solver never comes for it. When no local
+ *    refund is possible at all — no secrets, another wallet's descriptor,
+ *    nothing wired — the swap reports `needs_counterparty` instead of retrying
+ *    a push that cannot work.
+ *
+ * **What step 1 proves depends on the direction.** On a send leg every non-claim
+ * leaf pays the trader's own committed address or needs the trader's own
+ * signature, so "spent, but not by a hash-verified claim" means the money came
+ * back. On a receive leg those leaves are the SOLVER's and the claim leaf is the
+ * trader's, so the same two readings mean the opposite things — `settled` is the
+ * trader's own claim landing, `refunded` is the solver taking back a lockup the
+ * trader failed to claim. The read is identical; only the state docs differ.
+ *
+ * Two things about the receive arm that are easy to get wrong, and are asserted
+ * in the tests rather than left to be inferred:
+ *
+ * - **A claim is matched by its preimage, never by our txid.** The covenant's
+ *   `nonInteractiveClaim` leaf is pinned to the trader's own payout script, so a
+ *   claim that lands without us — covclaimd, the day it works — still pays the
+ *   trader and is still `settled`. Matching on the txid we submitted would turn
+ *   that success into an anomaly.
+ * - **`LockupFate.fate === "claimed"` maps to the state `settled`, never to the
+ *   state `claimed`.** The two words live one layer apart: the fate is the
+ *   chain's, the state is ours, and the state `claimed` means only that we
+ *   submitted something.
+ */
+declare class RfqSwapManager {
+    private readonly deps;
+    private readonly config;
+    private callbacks;
+    private readonly swapUpdateListeners;
+    private readonly swapCompletedListeners;
+    private readonly swapFailedListeners;
+    private readonly actionExecutedListeners;
+    private readonly monitored;
+    /** Monitored swaps by lockup script hex, so a contract event — which names
+     * a script and nothing else — can find the swap it belongs to. */
+    private readonly byLockupScript;
+    /**
+     * Swaps whose lockup registration has been SETTLED one way or another,
+     * mapped to whether a contract row actually resulted. Membership is what
+     * stops a per-pass retry from becoming a per-pass round trip; the value is
+     * what keeps a swap that could never be registered from later trying to
+     * retire a row that does not exist, which would report a spurious failure
+     * on a swap that in fact succeeded.
+     */
+    private readonly registered;
+    /**
+     * Swaps whose `refundArkade` answered {@link RefundNotLocallyPossibleError}
+     * in this process. Membership stops the push from being re-issued every
+     * pass — it cannot start working on its own, and re-issuing it is the
+     * grind `needs_counterparty` exists to remove. Only
+     * {@link RfqSwapManagerCallbacks.canRefundArkade} clears it, so a caller
+     * with no probe learns again on the next start, when the wallet that can
+     * sign may well have been restored.
+     */
+    private readonly refundRefused;
+    /**
+     * The last error a receive swap's claim callback threw, by rfqId.
+     *
+     * Kept only to tell two terminal outcomes apart once the claim window
+     * shuts: a swap whose claim was attempted and kept failing ends `failed`
+     * with that reason, while one that simply never became claimable ends
+     * `refunded`. Without it a broken claim callback would resolve a caller's
+     * {@link waitForSwapCompletion} as an ordinary unwind.
+     *
+     * Process-local, like {@link refundRefused}: after a restart the same swap
+     * ends `refunded` instead, which costs the caller a reason and nothing else
+     * — every throw was already reported through `onSwapFailed` as it happened.
+     */
+    private readonly lastClaimError;
+    /**
+     * The lockup outpoints a receive swap's claim callback has already been
+     * handed, by rfqId.
+     *
+     * What this exists to prevent: a claim SUCCEEDS, and for the next few
+     * passes the indexer still lists those outputs as unspent. Without a
+     * record of what was already claimed, every one of those passes would
+     * re-submit the same spend, fail against the server, and report a swap
+     * that in fact worked as failing. With one, a re-claim happens only when
+     * an outpoint appears that was never claimed — a lockup funded piecemeal,
+     * which is legitimate and which `partiallyClaimed` exists for.
+     *
+     * Process-local: after a restart a swap with a live claim tries once more.
+     * That is the recovery case rather than the spam one — a claim that never
+     * landed leaves its outputs unspent, and one that did leaves a single
+     * rejection.
+     */
+    private readonly claimedOutpoints;
+    /** Live `onContractEvent` subscription, held so `stop()` can drop it. */
+    private unsubscribeContracts;
+    /** Terminal records, kept so a late {@link waitForSwapCompletion} still
+     * answers instead of throwing "not found". Cleared by {@link removeSwap}. */
+    private readonly finished;
+    private readonly waiters;
+    /**
+     * The request-time origin of each swap the manager may have to CREATE a
+     * record for, by rfqId.
+     *
+     * Needed only for a swap the store has never seen: once a record exists,
+     * `updateRfqSwapRecord` carries the origin half through and the map is
+     * redundant. It is kept anyway for the swap's whole life, so a record the
+     * store loses between passes is rewritten rather than lost — and dropped
+     * by {@link removeSwap} and by retention, which are the two places a swap
+     * stops being this manager's business.
+     */
+    private readonly origins;
+    /** Records changed during the current pass, flushed to the repository and
+     * through `saveSwap`. */
+    private readonly dirty;
+    /** Race guard: one action at a time per swap. */
+    private readonly inProgress;
+    private timer;
+    private running;
+    constructor(deps: RfqSwapManagerDeps, config?: RfqSwapManagerConfig);
+    /** Wire the money-moving half. Without it the manager only watches. The
+     * two claims may be omitted for a consumer that drives no kind reaching
+     * them — see {@link AvailableRfqSwapManagerCallbacks}. */
+    setCallbacks(callbacks: AvailableRfqSwapManagerCallbacks): void;
+    onSwapUpdate(listener: SwapUpdateListener): () => void;
+    onSwapCompleted(listener: SwapCompletedListener): () => void;
+    onSwapFailed(listener: SwapFailedListener): () => void;
+    onActionExecuted(listener: ActionExecutedListener): () => void;
+    /**
+     * Rebuild every stored swap and take over monitoring them.
+     *
+     * The composition a consumer otherwise writes by hand, and the one place
+     * all four pieces meet: retention decides what to keep
+     * (`shouldRetainRfqSwap`), the lockup's contract row supplies the covenant
+     * (`lockupContractParams`), `rebuildRfqSwap` turns a record back into a
+     * live swap, and each rebuilt swap arrives with its own origin, so nothing
+     * is asked of the caller.
+     *
+     * **Deliberately not part of {@link start}.** A consumer that wants to
+     * look at its records — count them, show them, prune and stop — is not
+     * forced to start driving money to do it. Call this first and `start()`
+     * after; a manager already running polls the restored swaps at once.
+     *
+     * Retention runs BEFORE the rebuild, so a record past
+     * `RFQ_SWAP_RETENTION_SECONDS` costs no contract lookup on its way to being
+     * dropped.
+     *
+     * **A record that cannot be rebuilt is reported, never swallowed and never
+     * fatal.** `rebuildRfqSwap` throws by design when the covenant params do
+     * not derive the funded address, and `lockupContractParams` throws
+     * `LockupContractMissing` when the wallet has no row for the lockup — both
+     * say something true about that one record, and neither is a reason to
+     * strand the others. They come back in {@link RfqRestoreResult.failed}.
+     */
+    restoreFromRepository(options?: RfqRestoreOptions): Promise<RfqRestoreResult>;
+    /**
+     * Drop stored records that are terminal and past
+     * `RFQ_SWAP_RETENTION_SECONDS`, and return their ids.
+     *
+     * `needs_counterparty` is never dropped, however old: the money is still at
+     * the lockup and the counterparty's move still ends the swap. That rule
+     * lives in `shouldRetainRfqSwap`, which this defers to rather than
+     * restating.
+     *
+     * Public because retention is a caller's cadence, not the manager's: a
+     * long-lived process wants it on a timer of its own, a mobile app wants it
+     * at boot. {@link restoreFromRepository} runs it first, so the boot path
+     * needs no separate call.
+     */
+    pruneRetiredSwaps(): Promise<string[]>;
+    private dropRetired;
+    private requireRepository;
+    /** The default covenant source: the wallet's own contract row for each
+     * lockup, which is where registration put it before the address could be
+     * funded. */
+    private paramsFromContracts;
+    /**
+     * Load records and begin monitoring. Runs one pass immediately — a caller
+     * resuming after a restart may be well past a deadline already — then
+     * every `pollIntervalMs`. Records that are already terminal are kept only
+     * so {@link waitForSwapCompletion} can answer for them.
+     *
+     * Calling it again while running loads the records and returns rather than
+     * re-arming — dropping them silently would strand a funded swap on a
+     * caller's harmless double-start.
+     *
+     * The signature is unchanged with a {@link RfqSwapManagerDeps.repository}
+     * wired; the origins are resolved from the store instead, by the same rule
+     * {@link addSwap} applies. A swap the store has never seen throws
+     * {@link RfqSwapOriginRequired} — hand that one to `addSwap` with its
+     * origin, or restore the whole set with {@link restoreFromRepository},
+     * which needs no caller input at all. Every swap is checked before any is
+     * tracked, so a bad one in the list does not leave a half-loaded manager.
+     */
+    start(swaps?: readonly RfqSwap[]): Promise<void>;
+    /**
+     * Stop monitoring and clear the timer. In-flight actions are not
+     * cancellable and run to completion; outstanding
+     * {@link waitForSwapCompletion} promises are left pending, since
+     * stop/start is a pause rather than a cancellation.
+     *
+     * The contract subscription is dropped too — an open stream with nothing
+     * reacting to it is a leak, and {@link start} puts it back. What is NOT
+     * undone is the contract registration: those rows are the wallet's, they
+     * outlive this manager's lifecycle, and dropping them would unwatch a
+     * lockup that is still funded.
+     */
+    stop(): Promise<void>;
+    /**
+     * Begin monitoring a swap. Polled immediately when the manager is running,
+     * so a just-funded swap does not wait out a whole interval.
+     *
+     * `origin` is the request-time half a live swap cannot carry — the corridor,
+     * the funded address, the corridor's profile, the funding txid — and it is
+     * what lets the manager write this swap's FIRST record. Supply it whenever
+     * a {@link RfqSwapManagerDeps.repository} is wired and the swap is new. It
+     * may be omitted for a swap the store already holds a record for, which is
+     * then read to confirm it; omitting it for one the store has never seen
+     * throws {@link RfqSwapOriginRequired} rather than admitting a swap whose
+     * record could never be written. With no repository wired the parameter is
+     * inert.
+     */
+    addSwap(swap: RfqSwap, origin?: RfqSwapOrigin): Promise<void>;
+    /**
+     * Settle where this swap's record will come from, before it is monitored.
+     *
+     * Three ways it can be answered, in order: the caller passed an origin, one
+     * is already remembered from an earlier `addSwap`, or the store holds a
+     * record — which is the origin, already written. Only the last costs a read,
+     * and only when the first two are absent.
+     */
+    private admit;
+    /** Forget a swap entirely, monitored or finished.
+     *
+     * Its contract row is left alone: registration is a wallet-level fact about
+     * a script that may still hold money, and this call says only that THIS
+     * manager stops driving the swap. Retiring the row is reserved for a swap
+     * that reached a terminal state, where the lockup is provably done. */
+    removeSwap(rfqId: string): Promise<void>;
+    /** Every swap still being monitored. */
+    getPendingSwaps(): Promise<RfqSwap[]>;
+    hasSwap(rfqId: string): Promise<boolean>;
+    /** True while an action for this swap holds the per-swap lock. */
+    isProcessing(rfqId: string): Promise<boolean>;
+    getStats(): Promise<{
+        isRunning: boolean;
+        monitoredSwaps: number;
+        finishedSwaps: number;
+        inProgress: number;
+        pollIntervalMs: number;
+    }>;
+    /**
+     * Run one monitoring pass over every swap now.
+     *
+     * {@link start} calls this on an interval, but it is public on purpose: a
+     * caller that sleeps its process (a mobile app resuming, a service worker
+     * waking) wants a pass on that event rather than at the next tick. Passes
+     * do not overlap per swap — the in-progress lock makes a concurrent call a
+     * no-op for any swap already being worked on.
+     */
+    poll(): Promise<void>;
+    /**
+     * Resolve once this swap's PAYOUT is decided — which for onchain-send is
+     * the L1 claim, not the end of the record's life: once `claimTxid` is set
+     * the trader has the coins it swapped for, and what remains is the manager
+     * watching the Arkade lockup close. That holds however the record is
+     * labelled afterwards, `needs_counterparty` included. Lightning-send has no
+     * such split and resolves at `settled`/`refunded`, and so does lightning
+     * receive — see {@link isPayoutDecided} for why its own claim txid does not
+     * decide it.
+     *
+     * Rejects only on `failed`. `refunded` resolves: on a send leg a refund is
+     * an outcome the caller asked this manager to drive, not an exception. On a
+     * receive leg it is the swap being lost, which is still an answer and not
+     * an error — read `state`, do not infer success from resolution.
+     */
+    waitForSwapCompletion(rfqId: string): Promise<RfqSwapOutcome>;
+    private track;
+    /** Drops the swap from BOTH indexes. The event index is the one that stops
+     * a late event finding a swap that is gone; `pollSwap`'s own
+     * `monitored` check would also catch it, and deliberately still does —
+     * either alone is sufficient, which is what keeps a future change to one of
+     * them from silently re-driving a cancelled swap. */
+    private untrack;
+    /**
+     * Turn the indexer's push into an extra reason to run a pass — and nothing
+     * more.
+     *
+     * **This is deliberately not a source of truth.** An event names a script;
+     * the reaction is to run the ordinary pass for the swap at that script, and
+     * that pass re-reads the lockup through {@link readLockupFate} exactly as
+     * the timer's pass does. So an event that is missed, duplicated, reordered
+     * or outright FORGED can only cost or save latency — it can never change
+     * what this manager believes about a swap, and it can never on its own
+     * cause a claim or a refund. That property is what makes it safe to bolt a
+     * best-effort stream onto a money path, and it must survive any future
+     * change here: the moment an event is BELIEVED rather than merely acted on,
+     * a relay outage becomes a correctness problem instead of a latency one.
+     *
+     * The timer stays armed regardless, and is the failsafe. Every deadline
+     * that moves money — `refundLocktime`, the L1 claim window — is an absolute
+     * timelock that passes whether or not a single event ever arrives.
+     */
+    private subscribe;
+    /**
+     * Register this swap's lockup with the wallet's contract manager, once.
+     *
+     * The backstop, not the primary site: `requestLightningSend` /
+     * `requestOnchainSend` register before the caller can fund, so this covers
+     * swaps whose records predate that — and costs nothing when it does not,
+     * since `createContract` is first-writer-wins.
+     *
+     * Best-effort by design: a failure here is reported and retried on the next
+     * pass, and never aborts the pass it is part of. Registration buys latency
+     * and puts the lockup in the wallet's contract set; it decides nothing. The
+     * money path below it reads the indexer directly and is gated on timelocks
+     * that a missing contract row has no bearing on, so failing the pass over
+     * this would trade a real deadline for a bookkeeping one.
+     */
+    private ensureRegistered;
+    /** Stop watching a finished swap's lockup. Retained, not deleted: the row
+     * is what keeps the lockup's own VTXOs annotatable and its history
+     * readable, while `retained` is what drops it from the subscription and
+     * the poll — a settled swap that stayed watched would cost the wallet a
+     * script for its whole life. Best-effort — the swap is over either way. */
+    private retireContract;
+    private arm;
+    private pollSwap;
+    private runPass;
+    /**
+     * The receive leg's whole state machine: claim the solver-funded lockup
+     * while the window is open, and recognise the shapes in which it can be
+     * lost.
+     *
+     * **The window closes at `refundLocktime`, on wall clock, with no margin.**
+     * Both halves of that are deliberate. It closes there because publishing
+     * `P` into the solver's live refund window risks losing the race and
+     * handing over the preimage anyway — the hazard `ONCHAIN_CLAIM_MARGIN_SECONDS`
+     * guards on the L1 side. It takes no margin because the two situations are
+     * not alike: that one budgets for confirmation depth, while this claim is an
+     * offchain spend that lands in seconds. Wall clock is already the
+     * conservative reading — the solver's leaf is a CLTV, which matures against
+     * median-time-past, and MTP trails wall clock — so the real window extends
+     * PAST this deadline rather than ending before it. Every second of margin
+     * subtracted here is a second of live claim window given away for nothing.
+     *
+     * **The trader has no move after it.** Nothing here can take the lockup
+     * back, so once the window shuts the swap is the solver's to resolve and
+     * this manager's job is to watch it happen and then stop.
+     */
+    private driveReceiveClaim;
+    /**
+     * Claim what the solver funded, once it is enough.
+     *
+     * The value gate here decides WHEN to act. `pushClaim`'s decides whether
+     * `P` is published, and runs with nothing between it and the signature —
+     * the check that matters is the inner one, and this is not a reason to
+     * relax it.
+     */
+    private claimIfFunded;
+    /** `handled` ends the pass; `continue` falls through to the refund gate. */
+    private driveOnchain;
+    private driveArkadeRefund;
+    /** Whether any of these outputs has never been handed to the claim
+     * callback — the only reason to claim a lockup a second time. */
+    private hasUnclaimedOutpoint;
+    private rememberClaimed;
+    /**
+     * L1 progress, which past the refund window must not overwrite a refusal.
+     * The two halves are independent — a claimed fill says nothing about
+     * whether this wallet can take the Arkade lockup back — and `claimed` is
+     * re-asserted from chain on every pass, so without this a blocked swap
+     * would flip between the two states forever. The claim itself always runs;
+     * only the label defers, and only once the refund is the live half.
+     */
+    private setOnchainState;
+    /** The probe's refusal reason, or `undefined` when a local refund is
+     * possible as far as anyone here can tell. A probe that throws is treated
+     * as a refusal: a capability check that cannot answer is not a yes. */
+    private probeRefusal;
+    /** Report that no local refund will happen, without ending the swap. */
+    private block;
+    /** The way back out, taken as soon as the swap becomes actionable again.
+     * Back to what the record can prove, not to `pending` unconditionally: a
+     * swap that already made its claim has a txid for it, and reporting that
+     * swap as `pending` would un-say something true. */
+    private unblock;
+    /**
+     * Record which ark transactions ended the lockup.
+     *
+     * Only the ones the indexer actually named: `LockupSpend.arkTxid` is
+     * optional, and a checkpoint txid is not what history correlates on — a
+     * record carrying one would name a transaction the wallet's own activity
+     * never shows. Fewer txids is the right failure here.
+     *
+     * Assigned rather than merged: the fate is one read of the whole lockup,
+     * so it is the complete answer for this swap, and a swap only reaches a
+     * verdict once.
+     */
+    private stampLockupSpends;
+    private touch;
+    private setState;
+    /** Terminal failure. The `onSwapFailed` emission is left to
+     * {@link finalize}, so this does not double-report. */
+    private fail;
+    private emitFailed;
+    private emitAction;
+    /**
+     * Flush a changed record to every sink that is wired, and say whether all
+     * of them took it.
+     *
+     * Up to two writes, in this order: the canonical `RfqSwapRecord` to
+     * {@link RfqSwapManagerDeps.repository}, then
+     * {@link RfqSwapManagerCallbacks.saveSwap}. Both gate — a rejection from
+     * either leaves the record dirty and monitored, so waiters stay unsettled
+     * and a terminal swap is not finalized until the write it claims lands.
+     * That is exactly today's rule for `saveSwap`, applied to whichever sinks
+     * exist; wiring the repository does not weaken it.
+     *
+     * The canonical write goes FIRST and a failure there skips the second.
+     * `saveSwap` is a projection of the record, and projecting a state the
+     * record of record has just refused would leave the secondary sink ahead
+     * of the primary — the one ordering that survives no restart.
+     *
+     * With neither wired the state is process-local, which is what a manager
+     * with no callbacks has always done.
+     */
+    private save;
+    /** The canonical write. True when there is no repository to write to. */
+    private saveRecord;
+    private originOrThrow;
+    /**
+     * Drop a terminal swap from monitoring and report it exactly once.
+     *
+     * `onSwapCompleted` and `onSwapFailed` are mutually exclusive here, unlike
+     * Boltz's manager, which fires completion for every swap that leaves
+     * monitoring including the failed ones — a listener named "completed" that
+     * also fires on failure is a trap worth not inheriting.
+     */
+    private finalize;
+    private settleWaiters;
+}
+/** What {@link RfqSwapManager.waitForSwapCompletion} reports. `txid` is the
+ * trader's own claim — L1 for a claimed onchain send, Arkade for a claimed
+ * receive — or the ark txid for a refund the trader pushed; a solver-side
+ * settlement or refund carries none, and a receive swap that ended `refunded`
+ * carries none either, however far its claim got (see {@link outcomeOf}). So
+ * a `txid` here always names something that happened, and `state` remains the
+ * only thing to read for whether the swap paid out. */
+interface RfqSwapOutcome {
+    state: RfqSwapState;
+    txid?: string;
+}
+
+/**
+ * The swap kinds this projection covers — all three the manager monitors.
+ *
+ * `onchain_send` carries an L1 half nothing else can rebuild. Its Arkade lockup
+ * has a contract row like the others, but the HTLC is Bitcoin L1, not an Arkade
+ * contract, so no row exists for it; and `OnchainHtlc` exposes only derived
+ * values — `address`, `pkScript`, `leaves`, `controlBlocks` — never the
+ * `claimKey`/`refundKey` `onchainHtlcScript` takes as inputs. So they ride in
+ * that corridor's {@link RfqSwapOrigin.profile}, and without them a restored
+ * swap would let its L1 refund window pass unwatched.
+ */
+type PersistableRfqSwap = LightningSendSwap | LightningReceiveSwap | OnchainSendSwap;
+/**
+ * The serialized covenant parameters a rebuild is given.
+ *
+ * `VHTLCV2ContractHandler`'s own wire shape — what `serializeParams` writes and
+ * `createScript` reads — which is exactly what a lockup's contract row stores
+ * under `params`.
+ */
+type LockupParams = Record<string, string>;
+/**
+ * How long a retired swap's record is kept, in SECONDS.
+ *
+ * Terminal records are history, not garbage: the covenant's spender is a
+ * transaction the wallet never signed, so its own history cannot reconstruct
+ * them. Kept for a month, then dropped so a hot wallet's store stays bounded.
+ *
+ * Seconds, not milliseconds, because that is the unit `RfqSwap.updatedAt`
+ * carries; the manager stamps it from `RfqSwapManagerConfig.now`, which is
+ * "wall clock, in unix seconds". Comparing it against `Date.now()` would drop
+ * every terminal record after ~43 minutes.
+ */
+declare const RFQ_SWAP_RETENTION_SECONDS: number;
+/** The immutable request-time half, and only what EVERY corridor has. Hex for
+ * everything binary, so the record is plain JSON and survives any
+ * structured-clone backend unchanged. */
+interface RfqSwapOrigin {
+    /**
+     * Which corridor this is. Resolves the handler that owns {@link profile};
+     * see `rfqCorridor.ts`.
+     *
+     * The manager's own union, not an open string: `RfqSwapManager` branches on
+     * `kind` to decide what to drive, so a corridor it does not know could be
+     * persisted and rebuilt here and then never driven — which is the failure
+     * this whole file is arranged to make impossible.
+     */
+    kind: PersistableRfqSwap["kind"];
+    /**
+     * The Arkade address that was funded.
+     *
+     * Both the swap's handle on its covenant — {@link lockupContractParams}
+     * looks the contract row up by the script it decodes to — and, being taken
+     * from the entry point rather than re-derived, the check that the
+     * parameters a caller supplies belong to THIS swap.
+     */
+    lockupAddress: string;
+    /**
+     * The corridor's own half, as plain JSON — written by the caller from the
+     * request result, kept current by the handler's `project`.
+     *
+     * Opaque here on purpose. Nothing in this file, the repository or the
+     * IndexedDB store interprets it, which is what lets a new corridor ship
+     * without touching any of them. It carries the corridor's keys as well as
+     * its state: `signer` (which wallet key signs this leg) and, on a corridor
+     * locked to a preimage, `hashlock` — see `rfqProfileParts.ts`, and write
+     * both with `rfqSecretsProfile` rather than by hand.
+     *
+     * Not a consumer scratchpad: every write merges it as `{ ...profile,
+     * ...handler.project(swap) }`, so a consumer key colliding with one the
+     * handler projects is silently overwritten on every pass.
+     */
+    profile: Record<string, unknown>;
+    /** Consumer display metadata. The rebuild ignores it — `RfqSwapCommon`
+     * carries no amount of its own. */
+    amount?: number;
+    /**
+     * The ark transaction that funded {@link lockupAddress}.
+     *
+     * Origin, not manager state: the caller broadcasts the funding and knows
+     * its txid, while the manager watches the lockup by script and never
+     * learns it. So it is written once at record creation, like {@link amount},
+     * and no corridor `project` emits it.
+     */
+    fundingArkTxid?: string;
+}
+/** The stored record: the origin plus the manager's mutable state. */
+interface RfqSwapRecord extends RfqSwapOrigin {
+    rfqId: string;
+    state: RfqSwapState;
+    createdAt: number;
+    updatedAt: number;
+    refundArkTxid?: string;
+    /** The ark transactions that spent the lockup, stamped by the manager from
+     * the chain read that ended the swap. See
+     * `RfqSwapCommon.lockupSpendArkTxids`. */
+    lockupSpendArkTxids?: string[];
+    failure?: string;
+    blockedReason?: string;
+}
+/** First write, at the moment the caller hands the swap to the manager. */
+declare function createRfqSwapRecord(origin: RfqSwapOrigin, swap: PersistableRfqSwap): RfqSwapRecord;
+/**
+ * Every later write. The origin half is carried through untouched.
+ *
+ * The mutable half is REPLACED, not merged. `managerState` omits a key the live
+ * swap no longer carries, so spreading it over the old record could only ever
+ * set these fields, never clear them. The manager clears them on purpose: it
+ * deletes `blockedReason` when a swap leaves `needs_counterparty`, precisely
+ * because a stale `blockedReason` reads as a live refusal.
+ */
+declare function updateRfqSwapRecord(record: RfqSwapRecord, swap: PersistableRfqSwap): RfqSwapRecord;
+/**
+ * The immutable half of a stored record, on its own.
+ *
+ * A record IS an origin plus manager state, so `record` where an
+ * {@link RfqSwapOrigin} is wanted type-checks — and is a bug. Spread into
+ * {@link createRfqSwapRecord} it carries the OLD state's `failure`,
+ * `blockedReason` and `refundArkTxid` past `managerState`, which omits a field
+ * the live swap no longer has and therefore cannot clear one. That is the same
+ * trap {@link updateRfqSwapRecord} strips those three fields to avoid; this is
+ * how a caller holding only a record gets an origin that is safe to keep.
+ *
+ * What `RfqSwapManager.restoreFromRepository` remembers for each record it
+ * rebuilds, so a later write can create the record again if the store lost it.
+ */
+declare function rfqSwapOriginOf(record: RfqSwapRecord): RfqSwapOrigin;
+/**
+ * Rebuild the live record. Pure, and synchronous, given the covenant's
+ * parameters.
+ *
+ * Hand the result to {@link RfqSwapManager.start}. Take `params` from the
+ * lockup's contract row — {@link lockupContractParams} is the one-liner — or
+ * from a copy of `VHTLCV2ContractHandler.serializeParams(script.options)` a
+ * consumer keeps itself; either way they are checked against the address that
+ * was actually funded, so the `lockupPkScript` this produces is the one the
+ * funded lockup is keyed by.
+ */
+declare function rebuildRfqSwap(record: RfqSwapRecord, params: LockupParams): PersistableRfqSwap;
+/**
+ * Whether a retired swap's record should be kept.
+ *
+ * `needs_counterparty` is deliberately not terminal and is never dropped: the
+ * money is still at the lockup, the counterparty's move is still what ends the
+ * swap, and the refusal is re-checked every pass; restoring the right wallet
+ * returns it to `pending`.
+ *
+ * @param now Current time in **unix seconds**; the same unit as
+ * `RfqSwap.updatedAt`, which the manager stamps from
+ * `RfqSwapManagerConfig.now`. Pass `Math.floor(Date.now() / 1000)`, never
+ * `Date.now()`: milliseconds against a seconds window would retire every
+ * terminal record after ~43 minutes.
+ */
+declare function shouldRetainRfqSwap(record: RfqSwapRecord, now: number): boolean;
+
+/** A registry discovery result held for reuse. Refetchable — unlike a swap
+ * record, losing it costs one network round trip — but it must survive a cold
+ * boot: serving it stale is what keeps quoting alive while a registry is down. */
+interface MarketsCacheEntry {
+    markets: DiscoveredMarket[];
+    fetchedAt: number;
+}
+/**
+ * Everything the package persists, following the monorepo repository
+ * convention (versioned interface, AsyncDisposable, one backend per
+ * platform — see the Boltz plugin's SwapRepository). Consumers construct
+ * exactly one of these; there is no second storage seam.
+ *
+ * Durable records (swaps) and rebuildable state (the restore scan's txid
+ * cursor, the markets cache) live side by side because they share a
+ * lifetime: all three belong to one wallet on one device, and a consumer
+ * that wipes one wants all three gone.
+ *
+ * ponytail: no query filters — every consumer reads all swaps and filters
+ * in memory; mirror the Boltz plugin's GetSwapsFilter when a consumer needs
+ * subset queries.
+ */
+interface AssetSwapRepository extends AsyncDisposable {
+    /** 4 adds `getRfqSwap`. 3 added the other RFQ methods below; 2 was the
+     * released shape — swaps, scan cursor, markets, with `preimageSaltHex` on
+     * the swap record — so an implementor built against either cannot satisfy
+     * this one silently. */
+    readonly version: 4;
+    /** Insert or replace a swap by id. Store the record whole: `preimageHex`
+     * and `preimageSaltHex` both leave the swap unclaimable if a field-mapped
+     * backend drops them — the first is the only claim secret of a swap whose
+     * signer cannot derive, the second the public input every other static
+     * wallet's preimage derives from.
+     *
+     * Records must be **JSON-safe**: the SQLite and Realm backends serialize
+     * the record to JSON, so a `Date` in a consumer-added field comes back a
+     * string, a `Set`/`Map` comes back empty, and a `bigint` throws here —
+     * none of which happens on IndexedDB's structured clone. `AssetSwap` as
+     * declared is JSON-safe; keep added fields that way. */
+    saveSwap(swap: AssetSwap): Promise<void>;
+    /** All stored swaps, in no particular order — `getAssetSwaps` is the
+     * canonical newest-first read. */
+    getAllSwaps(): Promise<AssetSwap[]>;
+    /**
+     * Insert or replace a monitored RFQ swap by `rfqId`.
+     *
+     * Store the record WHOLE. Every field is a covenant tree parameter or the
+     * manager's own state, and a field-mapped backend that drops one round-trips
+     * a record whose covenant `rebuildRfqSwap` cannot reproduce — which surfaces
+     * as a refund that cannot be signed, long after the write.
+     */
+    saveRfqSwap(record: RfqSwapRecord): Promise<void>;
+    /** One record by key. `undefined` on a miss — retention prunes terminal
+     * records, so absence is ordinary and not an error. */
+    getRfqSwap(rfqId: string): Promise<RfqSwapRecord | undefined>;
+    /** Every stored RFQ swap record, in no particular order. */
+    getAllRfqSwaps(): Promise<RfqSwapRecord[]>;
+    /** Drop one, once it is past retention — see `shouldRetainRfqSwap`. */
+    removeRfqSwap(rfqId: string): Promise<void>;
+    /** Sent txids already checked for offer packets (see restore.ts). */
+    getScannedTxids(): Promise<Set<string>>;
+    markTxidsScanned(txids: Iterable<string>): Promise<void>;
+    /** Cached registry markets, or undefined on a miss. */
+    getCachedMarkets(network: string, registry: string): Promise<MarketsCacheEntry | undefined>;
+    saveCachedMarkets(network: string, registry: string, entry: MarketsCacheEntry): Promise<void>;
+    clear(): Promise<void>;
+}
+declare class InMemoryAssetSwapRepository implements AssetSwapRepository {
+    readonly version: 4;
+    private readonly swaps;
+    private readonly rfqSwaps;
+    private readonly scanned;
+    private readonly markets;
+    saveSwap(swap: AssetSwap): Promise<void>;
+    getAllSwaps(): Promise<AssetSwap[]>;
+    saveRfqSwap(record: RfqSwapRecord): Promise<void>;
+    getRfqSwap(rfqId: string): Promise<RfqSwapRecord | undefined>;
+    getAllRfqSwaps(): Promise<RfqSwapRecord[]>;
+    removeRfqSwap(rfqId: string): Promise<void>;
+    getScannedTxids(): Promise<Set<string>>;
+    markTxidsScanned(txids: Iterable<string>): Promise<void>;
+    getCachedMarkets(network: string, registry: string): Promise<MarketsCacheEntry | undefined>;
+    saveCachedMarkets(network: string, registry: string, entry: MarketsCacheEntry): Promise<void>;
+    clear(): Promise<void>;
+    [Symbol.asyncDispose](): Promise<void>;
+}
+
+export { isRfqSwapTerminal as $, type AssetSwapRepository as A, BTC_ASSET_ID as B, type RfqSwapActionName as C, type RfqSwapLockup as D, RfqSwapManager as E, type RfqSwapManagerCallbacks as F, type RfqSwapManagerConfig as G, type RfqSwapManagerDeps as H, InMemoryAssetSwapRepository as I, type RfqSwapManagerEvents as J, type RfqSwapOrigin as K, type LockupVtxo as L, type MarketsCacheEntry as M, RfqSwapOriginRequired as N, type OnchainSendAction as O, type PersistableRfqSwap as P, type RfqSwapOutcome as Q, type RfqSwapRecord as R, type SwapSecretsProjection as S, type RfqSwapRecordStore as T, type SwapContractRegistry as U, addAssetSwap as V, awaitRfqResolution as W, createRfqSwapRecord as X, findLockupVtxos as Y, getAssetSwaps as Z, getAssetSwapsOrThrow as _, type AssetSwap as a, isRfqTerminal as a0, nextOnchainAction as a1, preimageForSwapRecord as a2, pushRefundWithoutReceiver as a3, readLockupFate as a4, rebuildRfqSwap as a5, refundIfUnresolved as a6, rfqSwapOriginOf as a7, shouldRetainRfqSwap as a8, swapSecretsToRecord as a9, updateAssetSwap as aa, updateAssetSwapBestEffort as ab, updateRfqSwapRecord as ac, type RefundArkProvider as b, type RefundIndexer as c, type RfqSwap as d, type ArkadeRefundResult as e, type LockupSpendIndexer as f, type RfqSwapState as g, type AssetSwapStatus as h, type AvailableRfqSwapManagerCallbacks as i, type LightningReceiveSwap as j, type LightningSendSwap as k, type LockupFate as l, LockupNeedsRecoveryError as m, type LockupParams as n, type LockupSpend as o, type OnchainSendSwap as p, type PreimageBlockedReason as q, PreimageNotRecoverableError as r, REFUND_MTP_LAG_SECONDS as s, RFQ_RESOLVED_STATES as t, RFQ_SWAP_RETENTION_SECONDS as u, RFQ_SWAP_TERMINAL_STATES as v, type RefundOutcome as w, type RfqRestoreFailure as x, type RfqRestoreOptions as y, type RfqRestoreResult as z };