@hyperbridge/simplex 0.16.5 → 0.16.7

package/dist/index.d.cts

@@ -353,46 +353,50 @@ declare class FillerConfigService {
  * What one quorum call is allowed to spend.
  *
  * `deadlineMs` is the ceiling on the call itself: past it, the endpoints still
- * outstanding are treated as failures and the call fails with a QuorumError
- * naming them, rather than waiting out the slowest provider. It cannot rescue a
- * call — early exit already resolves the moment the bar is reachable, over the
- * same responses `finalize` would see — so in practice the deadline is where a
- * doomed call dies quickly instead of slowly.
+ * outstanding are treated as failures, so they stop voting and the call is
+ * decided over the endpoints that answered, or fails with a QuorumError naming
+ * them. Early exit decides as soon as the endpoints still out could not change
+ * the outcome; the deadline decides when one of them never answers.
+ *
+ * `timeoutMs` bounds one endpoint's attempt, and there is only ever one: the
+ * transports are built with `retryCount: 0`, so an endpoint's whole
+ * contribution to a call is a single request. That is what keeps the two
+ * numbers independent — a task cannot approach `deadlineMs` by retrying inside
+ * itself, so a deadline that fires means something outside the budget went
+ * wrong rather than an endpoint using the budget as designed.
  */
 interface QuorumBudget {
     timeoutMs: number;
-    retryCount: number;
-    retryDelayMs: number;
     deadlineMs: number;
 }
 /**
  * Wraps multiple viem `PublicClient`s — one per configured RPC URL — and runs
  * selected read paths (`getLogs`, `getBlockNumber`, `getTransactionConfirmations`)
- * as a **BFT quorum**: a result is accepted only when `quorumThreshold(n)` of the
- * operator's endpoints agree on it.
+ * as a **BFT quorum**: a result is accepted only when `quorumThreshold(m)` of the
+ * `m` endpoints that answered agree on it.
  *
  * A provider that *answers with divergent data* is never special-cased away — it
  * simply fails to join the agreeing group, which is what makes a lying or reorged
  * endpoint detectable rather than authoritative.
  *
- * The pausing state is the bench, and {@link benchFor} decides who goes on it:
- * a request-rate limit ({@link isSuspendableRateLimit}), a response that is not
- * JSON ({@link isMalformedResponse}), or a head behind the quorum's
- * ({@link isStaleHead}). A benched endpoint is DROPPED for its window: not
- * queried and not counted, so each call's bar is computed over the endpoints
- * actually asked. All three share the property that earns the bench — the
- * endpoint will keep failing the same way for a while, so keeping it in the
- * denominator would only turn its problem into the solver missing events, and a
- * scanner that misses orders loses fills.
+ * A provider that *fails* does not vote. A failed request says nothing about the
+ * chain, so it must not outvote the endpoints that agree: the threshold guards
+ * against endpoints that answer wrongly, and every answer still counts. Six
+ * endpoints with two failing decide over the other four, three of which must
+ * agree. The price, worth stating plainly, is that a call can be decided by fewer
+ * endpoints than the operator configured; at the limit, one endpoint answering
+ * while the rest fail decides alone. The voters are still exclusively the
+ * operator's own.
  *
- * That is a deliberate widening of what shrinks the voter set, and worth stating
- * plainly: 5 endpoints with 2 lagging used to fail the call, and now decide it
- * over the remaining 3. The bar still comes from a BFT threshold over the
- * endpoints asked, and the voters are still exclusively the operator's own, but
- * a call CAN now be decided by fewer of them than the operator configured. When
- * every endpoint is benched, all are queried again; there is nobody left to
- * prefer. Every other failure mode stays stateless: a chronically slow endpoint
- * costs one failed sub-request per call, never a shrunk quorum.
+ * The bench is the one state this class keeps, and {@link benchFor} decides who
+ * goes on it: a request-rate limit ({@link isSuspendableRateLimit}), a response
+ * that is not JSON ({@link isMalformedResponse}), or a head behind the quorum's
+ * ({@link isStaleHead}). All three share the property that earns it — the
+ * endpoint will keep failing the same way for a while — so a benched endpoint is
+ * not asked for its window: asking would spend its quota, or hold the call open
+ * for an answer already known to fail. When every endpoint is benched, all are
+ * queried again; there is nobody left to prefer. Every other failure is per
+ * call, and the endpoint is asked again next time.
  *
  * The constructor validates that URLs resolve to distinct hostnames so a "quorum"
  * isn't secretly the same upstream in disguise.
@@ -402,8 +406,8 @@ declare class QuorumPublicClient {
     readonly rpcUrls: string[];
     /**
      * The quorum bar when every endpoint answers: `quorumThreshold(n)` over the
-     * full set. Calls made while endpoints are benched use
-     * `quorumThreshold(queried)` — the bar always matches who was asked.
+     * full set. Each call's bar is `quorumThreshold` over the endpoints that answer
+     * it, so this is the most it can be.
      */
     readonly threshold: number;
     private readonly logger?;
@@ -424,11 +428,10 @@ declare class QuorumPublicClient {
     /** Endpoints currently benched, by URL. See {@link benchFor} for the reasons. */
     suspended(): string[];
     /**
-     * The endpoints this call queries — everyone not benched — and the quorum
-     * bar for exactly that set. A benched endpoint is dropped outright: it
-     * answers nothing while throttled, so counting it could only fail calls the
-     * remaining endpoints agree on. With every endpoint benched, everyone is
-     * queried again; there is nobody left to prefer.
+     * The endpoints this call queries: everyone not benched. A benched endpoint is
+     * dropped outright: it answers nothing while throttled, so asking it could only
+     * cost a request. With every endpoint benched, everyone is queried again; there
+     * is nobody left to prefer.
      */
     private participants;
     /**
@@ -453,22 +456,26 @@ declare class QuorumPublicClient {
      * retries would otherwise stall every confirmation poll). Stragglers settle
      * out of band and are ignored. `tryDecide` returns undefined to keep
      * waiting; once every task has settled, `finalize` must decide (it throws
-     * the QuorumError when the full response set still has no quorum). Early
-     * exit never weakens the trust model — a decision still requires the same
-     * quorum, it just doesn't wait for votes it no longer needs.
+     * the QuorumError when the full response set still has no quorum).
+     *
+     * Both are handed the bar: the BFT threshold over the endpoints that have not
+     * failed, answered or still out. A failure lowers it rather than counting
+     * against it. Counting the pending endpoints keeps an early decision to a bar
+     * no lower than the full response set would get, so a vote it did not wait for
+     * could never have reversed it.
      *
      * `deadlineMs` bounds the other direction: when the bar is NOT reachable
      * from the fast responders, the call used to wait out every straggler, and
      * the caller's own retry loop multiplied that into minutes of a chain not
      * being scanned at all, silently. At the deadline the outstanding endpoints
      * are treated as failures — named in the QuorumError, so the operator sees
-     * which ones held the call up — and `finalize` decides on the rest. The
-     * trust model is untouched: a decision still needs the same quorum.
+     * which ones held the call up — and `finalize` decides over the endpoints
+     * that answered.
      */
     private settleUntilQuorum;
     /**
-     * Highest block head backed by a full quorum. Throws {@link QuorumError}
-     * when fewer than `threshold` endpoints respond.
+     * Highest block head backed by a quorum of the endpoints that answer. Throws
+     * {@link QuorumError} when none do.
      */
     getBlockNumber(): Promise<bigint>;
     /**
@@ -2652,13 +2659,11 @@ interface PostedOrder {
  * Every code the orderbook's `RejectionCode` enum can send, listed rather than
  * written as a union so a test can hold it against the published schema.
  *
- * Why the orderbook refuses an order. `MIN_ORDER_SIZE` and `TTL_TOO_SHORT` are
- * prevented by validation before posting; `REPLAYED` and `ORDER_EXISTS` are
- * answered by bumping the nonce; the rest are encoding bugs on our side.
- *
- * `UNSUPPORTED_SOURCE_CHAIN` is the exception: a declared source chain has to
- * register the order's input symbol on the server, which is the server's own
- * config and nothing here can check ahead of asking.
+ * Why the orderbook refuses an order. `MIN_ORDER_SIZE`, `TTL_TOO_SHORT` and
+ * `UNSUPPORTED_SOURCE_CHAIN` are prevented by validation before posting, the last
+ * against the chains the server serves and the tokens its registry lists on each;
+ * `REPLAYED` and `ORDER_EXISTS` are answered by bumping the nonce; the rest are
+ * encoding bugs on our side.
  */
 declare const REJECTION_CODES: readonly ["MALFORMED_USER_OP", "NO_FILL_ORDER", "UNSUPPORTED_CHAIN", "UNSUPPORTED_SHAPE", "NOT_PHANTOM", "TTL_TOO_SHORT", "UNSUPPORTED_PAIR", "BAD_SIGNATURE", "BAD_NONCE_BINDING", "REPLAYED", "ORDER_EXISTS", "TOO_MANY_ORDERS", "MIN_ORDER_SIZE", "MISSING_DECLARATION", "EMPTY_DECLARATION", "UNSUPPORTED_SOURCE_CHAIN"];
 type RejectionCode = (typeof REJECTION_CODES)[number];
@@ -2733,9 +2738,10 @@ type CancelOrderResult = {
  * {@link OrderbookRequestError} because it could not get one.
  */
 declare class OrderbookClient {
-    private readonly url;
     private readonly requestTimeoutMs;
     private logger;
+    /** The configured endpoint, with `/graphql` if it was left off. */
+    private readonly url;
     constructor(url: string, requestTimeoutMs: number, loggers?: LoggerContext);
     /** The limits to validate against before posting, plus the books on offer. */
     limits(): Promise<OrderbookLimits>;
@@ -2844,6 +2850,13 @@ interface ReconcileReport {
  * orderbook's answer is then written back onto that row: an accepted order
  * carries its commitment, a rejected one carries the reason.
  */
+/**
+ * The configured ERC-4626 vaults' holdings, as `VaultFundingPlanner` reports them. A fill sources
+ * a payout shortfall from these, so they back a limit order as much as the wallet does.
+ */
+interface VaultHoldings {
+    getBalanceSnapshot(chain?: string): Promise<VaultBalancePosition[]>;
+}
 declare class LimitOrderService {
     private readonly store;
     private readonly client;
@@ -2855,12 +2868,16 @@ declare class LimitOrderService {
     private readonly delegationService?;
     /** Where a new order's nonce starts; tests pin it, production draws it at random. */
     private readonly startingNonce;
+    /** The configured ERC-4626 vaults, when the operator runs any. */
+    private readonly vaultBalances?;
     private logger;
     private cachedLimits?;
     private onEvent?;
     constructor(store: LimitOrderStore, client: OrderbookClient, contractService: ContractInteractionService, configService: FillerConfigService, assetRegistry: AssetRegistry, signer: Signer, defaultTtlSecs: number, delegationService?: DelegationService | undefined, loggers?: LoggerContext, 
     /** Where a new order's nonce starts; tests pin it, production draws it at random. */
-    startingNonce?: () => bigint);
+    startingNonce?: () => bigint, 
+    /** The configured ERC-4626 vaults, when the operator runs any. */
+    vaultBalances?: VaultHoldings | undefined);
     /**
      * Attaches the listener fill-driven changes are reported to. `Simplex` does
      * this after boot, the same way the filler is handed the service itself.
@@ -2896,6 +2913,19 @@ declare class LimitOrderService {
      */
     private withdraw;
     private signAndCancel;
+    /**
+     * The pairs an order can be written against, the smallest payout each token may carry, and
+     * the tokens the orderbook registers on each chain.
+     *
+     * The orderbook lists the books; `resolveBook` refuses a request naming anything else, so the
+     * operator is offered exactly these and no combination of symbols they could not post. The
+     * chains do the same for the source chains an order can accept.
+     */
+    books(): Promise<{
+        books: Book[];
+        minOrderSizes: TokenMinSize[];
+        chains: ChainInfo[];
+    }>;
     /**
      * Reads `serverInfo` and `books`, reusing the last read for {@link LIMITS_TTL_MS}.
      *
@@ -2915,15 +2945,30 @@ declare class LimitOrderService {
      * balance on the fill chain, so the operator hears it while they are creating
      * the order.
      *
+     * A fill pays out of the wallet and then withdraws any shortfall from the
+     * configured ERC-4626 vaults in the same batch, so what those vaults hold of
+     * the payout token backs the order too and is counted here. Without it an
+     * operator who sweeps inventory into a vault is refused orders their filler
+     * would have filled.
+     *
      * Each order is checked against the whole balance, not against what is left of
      * it after the others. One balance backs every order resting on it — that is
      * what quoting both sides of a book is — and the orderbook says as much: it
      * advertises each entry at `min(quoted, balance)` rather than dividing the
      * balance between them. Whichever order fills first draws the inventory down,
      * and the rest are cut to what is left. Netting them here would refuse the
-     * second side of every book.
+     * second side of every book. Vault positions are counted the same way: the
+     * whole position, not what is left after reservations for fills in flight.
      */
     private assertWalletCanPay;
+    /**
+     * What the configured vaults hold of `token` on `chain`, in scaled units.
+     *
+     * Zero when no vault is configured. A snapshot that cannot be read is also
+     * zero: the wallet alone then has to cover the order, which refuses one the
+     * filler might have managed rather than accepting one it could not.
+     */
+    private vaultHoldings;
     /**
      * Works a limit order down by what a fill delivered, and puts the rest back on
      * the orderbook.
@@ -3457,6 +3502,15 @@ declare class FXFiller implements FillerStrategy {
      * the output token's own decimals.
      */
     private matchLeg;
+    /** Why no limit order serves the order, leg by leg, for the line that says it was passed over. */
+    private explainUnmatched;
+    /**
+     * One leg as the matcher sees it, or null when its input token is not one the asset
+     * registry knows on the source chain.
+     *
+     * Amounts cross into the matcher at 1e18, the unit limit orders are kept in.
+     */
+    private incomingFor;
     /**
      * The order's input in **USD**, or null when no limit order connects its input
      * token to a dollar.
@@ -3794,6 +3848,12 @@ declare class LimitOrderController {
         fills: LimitOrderFill[];
         bids: StoredBid[];
     } | null>;
+    /** The pairs the orderbook lists, the smallest payout each token may carry, and its tokens per chain. */
+    books(): Promise<{
+        books: Book[];
+        minOrderSizes: TokenMinSize[];
+        chains: ChainInfo[];
+    }>;
     /** Creates the order, posts it, and reports what the orderbook made of it. */
     create(request: CreateLimitOrderRequest): Promise<PostedLimitOrder>;
     cancel(id: string): Promise<CancelledLimitOrder>;

package/dist/index.d.ts

@@ -353,46 +353,50 @@ declare class FillerConfigService {
  * What one quorum call is allowed to spend.
  *
  * `deadlineMs` is the ceiling on the call itself: past it, the endpoints still
- * outstanding are treated as failures and the call fails with a QuorumError
- * naming them, rather than waiting out the slowest provider. It cannot rescue a
- * call — early exit already resolves the moment the bar is reachable, over the
- * same responses `finalize` would see — so in practice the deadline is where a
- * doomed call dies quickly instead of slowly.
+ * outstanding are treated as failures, so they stop voting and the call is
+ * decided over the endpoints that answered, or fails with a QuorumError naming
+ * them. Early exit decides as soon as the endpoints still out could not change
+ * the outcome; the deadline decides when one of them never answers.
+ *
+ * `timeoutMs` bounds one endpoint's attempt, and there is only ever one: the
+ * transports are built with `retryCount: 0`, so an endpoint's whole
+ * contribution to a call is a single request. That is what keeps the two
+ * numbers independent — a task cannot approach `deadlineMs` by retrying inside
+ * itself, so a deadline that fires means something outside the budget went
+ * wrong rather than an endpoint using the budget as designed.
  */
 interface QuorumBudget {
     timeoutMs: number;
-    retryCount: number;
-    retryDelayMs: number;
     deadlineMs: number;
 }
 /**
  * Wraps multiple viem `PublicClient`s — one per configured RPC URL — and runs
  * selected read paths (`getLogs`, `getBlockNumber`, `getTransactionConfirmations`)
- * as a **BFT quorum**: a result is accepted only when `quorumThreshold(n)` of the
- * operator's endpoints agree on it.
+ * as a **BFT quorum**: a result is accepted only when `quorumThreshold(m)` of the
+ * `m` endpoints that answered agree on it.
  *
  * A provider that *answers with divergent data* is never special-cased away — it
  * simply fails to join the agreeing group, which is what makes a lying or reorged
  * endpoint detectable rather than authoritative.
  *
- * The pausing state is the bench, and {@link benchFor} decides who goes on it:
- * a request-rate limit ({@link isSuspendableRateLimit}), a response that is not
- * JSON ({@link isMalformedResponse}), or a head behind the quorum's
- * ({@link isStaleHead}). A benched endpoint is DROPPED for its window: not
- * queried and not counted, so each call's bar is computed over the endpoints
- * actually asked. All three share the property that earns the bench — the
- * endpoint will keep failing the same way for a while, so keeping it in the
- * denominator would only turn its problem into the solver missing events, and a
- * scanner that misses orders loses fills.
+ * A provider that *fails* does not vote. A failed request says nothing about the
+ * chain, so it must not outvote the endpoints that agree: the threshold guards
+ * against endpoints that answer wrongly, and every answer still counts. Six
+ * endpoints with two failing decide over the other four, three of which must
+ * agree. The price, worth stating plainly, is that a call can be decided by fewer
+ * endpoints than the operator configured; at the limit, one endpoint answering
+ * while the rest fail decides alone. The voters are still exclusively the
+ * operator's own.
  *
- * That is a deliberate widening of what shrinks the voter set, and worth stating
- * plainly: 5 endpoints with 2 lagging used to fail the call, and now decide it
- * over the remaining 3. The bar still comes from a BFT threshold over the
- * endpoints asked, and the voters are still exclusively the operator's own, but
- * a call CAN now be decided by fewer of them than the operator configured. When
- * every endpoint is benched, all are queried again; there is nobody left to
- * prefer. Every other failure mode stays stateless: a chronically slow endpoint
- * costs one failed sub-request per call, never a shrunk quorum.
+ * The bench is the one state this class keeps, and {@link benchFor} decides who
+ * goes on it: a request-rate limit ({@link isSuspendableRateLimit}), a response
+ * that is not JSON ({@link isMalformedResponse}), or a head behind the quorum's
+ * ({@link isStaleHead}). All three share the property that earns it — the
+ * endpoint will keep failing the same way for a while — so a benched endpoint is
+ * not asked for its window: asking would spend its quota, or hold the call open
+ * for an answer already known to fail. When every endpoint is benched, all are
+ * queried again; there is nobody left to prefer. Every other failure is per
+ * call, and the endpoint is asked again next time.
  *
  * The constructor validates that URLs resolve to distinct hostnames so a "quorum"
  * isn't secretly the same upstream in disguise.
@@ -402,8 +406,8 @@ declare class QuorumPublicClient {
     readonly rpcUrls: string[];
     /**
      * The quorum bar when every endpoint answers: `quorumThreshold(n)` over the
-     * full set. Calls made while endpoints are benched use
-     * `quorumThreshold(queried)` — the bar always matches who was asked.
+     * full set. Each call's bar is `quorumThreshold` over the endpoints that answer
+     * it, so this is the most it can be.
      */
     readonly threshold: number;
     private readonly logger?;
@@ -424,11 +428,10 @@ declare class QuorumPublicClient {
     /** Endpoints currently benched, by URL. See {@link benchFor} for the reasons. */
     suspended(): string[];
     /**
-     * The endpoints this call queries — everyone not benched — and the quorum
-     * bar for exactly that set. A benched endpoint is dropped outright: it
-     * answers nothing while throttled, so counting it could only fail calls the
-     * remaining endpoints agree on. With every endpoint benched, everyone is
-     * queried again; there is nobody left to prefer.
+     * The endpoints this call queries: everyone not benched. A benched endpoint is
+     * dropped outright: it answers nothing while throttled, so asking it could only
+     * cost a request. With every endpoint benched, everyone is queried again; there
+     * is nobody left to prefer.
      */
     private participants;
     /**
@@ -453,22 +456,26 @@ declare class QuorumPublicClient {
      * retries would otherwise stall every confirmation poll). Stragglers settle
      * out of band and are ignored. `tryDecide` returns undefined to keep
      * waiting; once every task has settled, `finalize` must decide (it throws
-     * the QuorumError when the full response set still has no quorum). Early
-     * exit never weakens the trust model — a decision still requires the same
-     * quorum, it just doesn't wait for votes it no longer needs.
+     * the QuorumError when the full response set still has no quorum).
+     *
+     * Both are handed the bar: the BFT threshold over the endpoints that have not
+     * failed, answered or still out. A failure lowers it rather than counting
+     * against it. Counting the pending endpoints keeps an early decision to a bar
+     * no lower than the full response set would get, so a vote it did not wait for
+     * could never have reversed it.
      *
      * `deadlineMs` bounds the other direction: when the bar is NOT reachable
      * from the fast responders, the call used to wait out every straggler, and
      * the caller's own retry loop multiplied that into minutes of a chain not
      * being scanned at all, silently. At the deadline the outstanding endpoints
      * are treated as failures — named in the QuorumError, so the operator sees
-     * which ones held the call up — and `finalize` decides on the rest. The
-     * trust model is untouched: a decision still needs the same quorum.
+     * which ones held the call up — and `finalize` decides over the endpoints
+     * that answered.
      */
     private settleUntilQuorum;
     /**
-     * Highest block head backed by a full quorum. Throws {@link QuorumError}
-     * when fewer than `threshold` endpoints respond.
+     * Highest block head backed by a quorum of the endpoints that answer. Throws
+     * {@link QuorumError} when none do.
      */
     getBlockNumber(): Promise<bigint>;
     /**
@@ -2652,13 +2659,11 @@ interface PostedOrder {
  * Every code the orderbook's `RejectionCode` enum can send, listed rather than
  * written as a union so a test can hold it against the published schema.
  *
- * Why the orderbook refuses an order. `MIN_ORDER_SIZE` and `TTL_TOO_SHORT` are
- * prevented by validation before posting; `REPLAYED` and `ORDER_EXISTS` are
- * answered by bumping the nonce; the rest are encoding bugs on our side.
- *
- * `UNSUPPORTED_SOURCE_CHAIN` is the exception: a declared source chain has to
- * register the order's input symbol on the server, which is the server's own
- * config and nothing here can check ahead of asking.
+ * Why the orderbook refuses an order. `MIN_ORDER_SIZE`, `TTL_TOO_SHORT` and
+ * `UNSUPPORTED_SOURCE_CHAIN` are prevented by validation before posting, the last
+ * against the chains the server serves and the tokens its registry lists on each;
+ * `REPLAYED` and `ORDER_EXISTS` are answered by bumping the nonce; the rest are
+ * encoding bugs on our side.
  */
 declare const REJECTION_CODES: readonly ["MALFORMED_USER_OP", "NO_FILL_ORDER", "UNSUPPORTED_CHAIN", "UNSUPPORTED_SHAPE", "NOT_PHANTOM", "TTL_TOO_SHORT", "UNSUPPORTED_PAIR", "BAD_SIGNATURE", "BAD_NONCE_BINDING", "REPLAYED", "ORDER_EXISTS", "TOO_MANY_ORDERS", "MIN_ORDER_SIZE", "MISSING_DECLARATION", "EMPTY_DECLARATION", "UNSUPPORTED_SOURCE_CHAIN"];
 type RejectionCode = (typeof REJECTION_CODES)[number];
@@ -2733,9 +2738,10 @@ type CancelOrderResult = {
  * {@link OrderbookRequestError} because it could not get one.
  */
 declare class OrderbookClient {
-    private readonly url;
     private readonly requestTimeoutMs;
     private logger;
+    /** The configured endpoint, with `/graphql` if it was left off. */
+    private readonly url;
     constructor(url: string, requestTimeoutMs: number, loggers?: LoggerContext);
     /** The limits to validate against before posting, plus the books on offer. */
     limits(): Promise<OrderbookLimits>;
@@ -2844,6 +2850,13 @@ interface ReconcileReport {
  * orderbook's answer is then written back onto that row: an accepted order
  * carries its commitment, a rejected one carries the reason.
  */
+/**
+ * The configured ERC-4626 vaults' holdings, as `VaultFundingPlanner` reports them. A fill sources
+ * a payout shortfall from these, so they back a limit order as much as the wallet does.
+ */
+interface VaultHoldings {
+    getBalanceSnapshot(chain?: string): Promise<VaultBalancePosition[]>;
+}
 declare class LimitOrderService {
     private readonly store;
     private readonly client;
@@ -2855,12 +2868,16 @@ declare class LimitOrderService {
     private readonly delegationService?;
     /** Where a new order's nonce starts; tests pin it, production draws it at random. */
     private readonly startingNonce;
+    /** The configured ERC-4626 vaults, when the operator runs any. */
+    private readonly vaultBalances?;
     private logger;
     private cachedLimits?;
     private onEvent?;
     constructor(store: LimitOrderStore, client: OrderbookClient, contractService: ContractInteractionService, configService: FillerConfigService, assetRegistry: AssetRegistry, signer: Signer, defaultTtlSecs: number, delegationService?: DelegationService | undefined, loggers?: LoggerContext, 
     /** Where a new order's nonce starts; tests pin it, production draws it at random. */
-    startingNonce?: () => bigint);
+    startingNonce?: () => bigint, 
+    /** The configured ERC-4626 vaults, when the operator runs any. */
+    vaultBalances?: VaultHoldings | undefined);
     /**
      * Attaches the listener fill-driven changes are reported to. `Simplex` does
      * this after boot, the same way the filler is handed the service itself.
@@ -2896,6 +2913,19 @@ declare class LimitOrderService {
      */
     private withdraw;
     private signAndCancel;
+    /**
+     * The pairs an order can be written against, the smallest payout each token may carry, and
+     * the tokens the orderbook registers on each chain.
+     *
+     * The orderbook lists the books; `resolveBook` refuses a request naming anything else, so the
+     * operator is offered exactly these and no combination of symbols they could not post. The
+     * chains do the same for the source chains an order can accept.
+     */
+    books(): Promise<{
+        books: Book[];
+        minOrderSizes: TokenMinSize[];
+        chains: ChainInfo[];
+    }>;
     /**
      * Reads `serverInfo` and `books`, reusing the last read for {@link LIMITS_TTL_MS}.
      *
@@ -2915,15 +2945,30 @@ declare class LimitOrderService {
      * balance on the fill chain, so the operator hears it while they are creating
      * the order.
      *
+     * A fill pays out of the wallet and then withdraws any shortfall from the
+     * configured ERC-4626 vaults in the same batch, so what those vaults hold of
+     * the payout token backs the order too and is counted here. Without it an
+     * operator who sweeps inventory into a vault is refused orders their filler
+     * would have filled.
+     *
      * Each order is checked against the whole balance, not against what is left of
      * it after the others. One balance backs every order resting on it — that is
      * what quoting both sides of a book is — and the orderbook says as much: it
      * advertises each entry at `min(quoted, balance)` rather than dividing the
      * balance between them. Whichever order fills first draws the inventory down,
      * and the rest are cut to what is left. Netting them here would refuse the
-     * second side of every book.
+     * second side of every book. Vault positions are counted the same way: the
+     * whole position, not what is left after reservations for fills in flight.
      */
     private assertWalletCanPay;
+    /**
+     * What the configured vaults hold of `token` on `chain`, in scaled units.
+     *
+     * Zero when no vault is configured. A snapshot that cannot be read is also
+     * zero: the wallet alone then has to cover the order, which refuses one the
+     * filler might have managed rather than accepting one it could not.
+     */
+    private vaultHoldings;
     /**
      * Works a limit order down by what a fill delivered, and puts the rest back on
      * the orderbook.
@@ -3457,6 +3502,15 @@ declare class FXFiller implements FillerStrategy {
      * the output token's own decimals.
      */
     private matchLeg;
+    /** Why no limit order serves the order, leg by leg, for the line that says it was passed over. */
+    private explainUnmatched;
+    /**
+     * One leg as the matcher sees it, or null when its input token is not one the asset
+     * registry knows on the source chain.
+     *
+     * Amounts cross into the matcher at 1e18, the unit limit orders are kept in.
+     */
+    private incomingFor;
     /**
      * The order's input in **USD**, or null when no limit order connects its input
      * token to a dollar.
@@ -3794,6 +3848,12 @@ declare class LimitOrderController {
         fills: LimitOrderFill[];
         bids: StoredBid[];
     } | null>;
+    /** The pairs the orderbook lists, the smallest payout each token may carry, and its tokens per chain. */
+    books(): Promise<{
+        books: Book[];
+        minOrderSizes: TokenMinSize[];
+        chains: ChainInfo[];
+    }>;
     /** Creates the order, posts it, and reports what the orderbook made of it. */
     create(request: CreateLimitOrderRequest): Promise<PostedLimitOrder>;
     cancel(id: string): Promise<CancelledLimitOrder>;