@hyperbridge/simplex 0.16.8 → 0.16.12

package/dist/index.d.ts

@@ -2,8 +2,8 @@ import { EventEmitter as EventEmitter$1 } from 'node:events';
 import { HexString, ERC7821Call, ChainConfig, Order, TokenInfo, IntentsCoprocessor, ExecutionResult, IntentGateway, FillOptions, FillerConfig as FillerConfig$1 } from '@hyperbridge/sdk';
 import { PublicClient, Hash, AbiEvent, BlockNumber, BlockTag, GetLogsParameters, GetLogsReturnType, WalletClient, Transport, Chain } from 'viem';
 import { LocalAccount, Account } from 'viem/accounts';
-import { L as LoggerContext, a as LogLevel, b as Logger, A as ActivityStore, c as ActivityInsert, d as ActivityEvent, O as OrderHistoryPage, W as WalletTx, e as LimitOrderStore, f as LimitOrder, g as LimitOrderFilter, B as BidStore, S as SimplexDataStore, h as LimitOrderFill, i as StoredBid, j as LogSink, k as BidStats, l as StateStore } from './types-C7rnnKWn.js';
-export { m as ActivityType, n as BidInsert, o as OperatorNotification, R as RuntimeState, p as WalletTxKind, q as addLogSink, r as configureLogger, s as getLogger } from './types-C7rnnKWn.js';
+import { L as LoggerContext, a as LogLevel, b as Logger, A as ActivityStore, c as ActivityInsert, d as ActivityEvent, O as OrderHistoryPage, W as WalletTx, e as LimitOrderStore, f as LimitOrder, g as LimitOrderFilter, B as BidStore, S as SimplexDataStore, h as LimitOrderFill, i as StoredBid, j as LogSink, k as BidStats, l as StateStore } from './types-B5zkFhxR.js';
+export { m as ActivityType, n as BidInsert, o as LimitOrderFillInsert, p as LimitOrderHold, q as LimitOrderInsert, r as LimitOrderPosting, s as LimitOrderSide, t as LimitOrderStatus, u as OperatorNotification, R as RuntimeState, v as WalletTxKind, w as addLogSink, x as configureLogger, y as getLogger } from './types-B5zkFhxR.js';
 import { ChannelCredentials } from '@grpc/grpc-js';
 import { EventEmitter } from 'events';
 import Decimal$1, { Decimal } from 'decimal.js';
@@ -158,6 +158,11 @@ interface FillerConfig {
      * See `bidValiditySeconds` in filler-toml for why this bound matters.
      */
     bidValiditySeconds?: number;
+    /**
+     * Order size in USD below which `order.fees` must cover the execution cost.
+     * Defaults to 20. See `minOrderSizeUsd` in filler-toml.
+     */
+    minOrderSizeUsd?: number;
     /**
      * Overfill protection knobs. If omitted, defaults are used
      * (maxOverfillBps=500, maxConsecutiveClamps=3).
@@ -343,6 +348,11 @@ declare class FillerConfigService {
      * Hyperbridge-side retraction does not reach the destination chain.
      */
     getBidValiditySeconds(): number;
+    /**
+     * The order size, in USD, below which `order.fees` must cover the execution cost.
+     * Defaults to 20. An order at or above it is filled whatever fees it carries.
+     */
+    getMinOrderSizeUsd(): number;
     /** Ceiling bps above user-requested output. Default 500 (5%). */
     getMaxOverfillBps(): bigint;
     /** Consecutive clamped evaluations before the strategy halts. Default 3. */
@@ -546,7 +556,8 @@ interface MpcVaultSignerConfig {
 declare enum SignerType {
     PrivateKey = "privateKey",
     MpcVault = "mpcVault",
-    Turnkey = "turnkey"
+    Turnkey = "turnkey",
+    SecretPhrase = "secretPhrase"
 }
 interface TurnkeySignerConfig {
     organizationId: string;
@@ -557,6 +568,15 @@ interface TurnkeySignerConfig {
 interface PrivateKeySignerConfig {
     key: HexString;
 }
+interface SecretPhraseSignerConfig {
+    /** BIP-39 mnemonic from the English wordlist. */
+    phrase: string;
+    /**
+     * Which wallet under the phrase is the hot wallet: the last component of
+     * `m/44'/60'/0'/0/i`. Defaults to 0.
+     */
+    accountIndex?: number;
+}
 /**
  * The `[simplex.signer]` block of the TOML file the binary reads — a tagged
  * union over the bundled backends. `createSigner` turns one into a {@link Signer};
@@ -568,7 +588,9 @@ type SignerConfig = ({
     type: SignerType.MpcVault;
 } & MpcVaultSignerConfig) | ({
     type: SignerType.Turnkey;
-} & TurnkeySignerConfig);
+} & TurnkeySignerConfig) | ({
+    type: SignerType.SecretPhrase;
+} & SecretPhraseSignerConfig);
 /**
  * A secp256k1 signature in split form, which is how EIP-7702 and raw digests
  * consume it: `r` and `s` as 32-byte 0x-hex, and `yParity` strictly 0 or 1.
@@ -682,6 +704,16 @@ interface Signer {
      */
     signTransaction(tx: SignerTransaction): Promise<HexString>;
 }
+/**
+ * A {@link Signer} backed by a key tree rather than a single key, so it can hand
+ * out signers for sibling wallets.
+ */
+interface DerivingSigner extends Signer {
+    /** Index of the wallet this signer itself signs with. */
+    readonly accountIndex: number;
+    /** The signer for the wallet at `index`, which may be this signer's own. */
+    derive(index: number): Signer;
+}
 /** The tuple an EIP-7702 authorization signature covers. */
 interface AuthorizationRequest {
     chainId: number;
@@ -745,6 +777,19 @@ declare function viemSigner(account: LocalAccount): Signer;
  */
 declare function privateKeySigner(privateKey: HexString): Signer;
 
+/**
+ * Throws unless the phrase is a BIP-39 mnemonic from the English wordlist with a
+ * matching checksum. The errors name what is wrong and never quote the phrase.
+ */
+declare function validateSecretPhrase(phrase: string): void;
+/**
+ * Signs with wallets derived from a BIP-39 phrase held in this process. The
+ * hot wallet is `m/44'/60'/0'/0/accountIndex`, and `derive` returns the signer
+ * for any sibling under the same parent.
+ */
+declare function secretPhraseSigner(config: SecretPhraseSignerConfig): DerivingSigner;
+declare function canDerive(signer: Signer): signer is DerivingSigner;
+
 /**
  * Signs through MPCVault's signing ceremony.
  *
@@ -1350,10 +1395,9 @@ interface BuiltinAssetResolver {
     getAssetBySymbol(chain: string, symbol: string): HexString | undefined;
 }
 /**
- * Symbols pegged to 1 USD. They seed the USD anchor graph at $1 — the roots
- * from which every pair's token0 must be reachable so confirmation depth can be
- * sized in USD (see `unanchoredToken0Symbols` and `FXFiller.usdFactors`). Trade
- * pricing never uses this as a price.
+ * Symbols pegged to 1 USD. They are pinned at $1 when an order's USD value is
+ * derived from the limit orders' rates (see `usdFactorsFrom`), which is what
+ * sizes confirmation depth. Trade pricing never uses this as a price.
  */
 declare const USD_STABLE_SYMBOLS: ReadonlySet<string>;
 /** Normalises a symbol for lookups: trimmed, uppercased. "cNGN" ≡ "CNGN". */
@@ -1419,22 +1463,24 @@ declare class AssetRegistry {
  *
  * ```toml
  * [[pairs]]
- * token0 = "USDC"   # quote side — any symbol in the asset registry
- * token1 = "CNGN"   # base side — any symbol in the asset registry
+ * token0 = "USDC"   # the book's base — any symbol in the asset registry
+ * token1 = "CNGN"   # the book's quote — any symbol in the asset registry
  * ```
  *
  * A pair declares that a market exists and nothing more. What the filler will
  * pay on it comes from the operator's limit orders, which carry the rate and the
  * size they are good for.
  *
- * One orientation only: declaring both `A/B` and `B/A` would make matching
- * depend on declaration order. `token0 == token1` is the same-asset cross-chain
- * market.
+ * The orientation follows the orderbook's books, which the setup wizard copies:
+ * `token0` is the book's base and `token1` its quote, so the `USDC-cNGN` book
+ * (priced in cNGN per USDC) becomes `token0 = "USDC"`, `token1 = "CNGN"`. One
+ * orientation only: `A/B` and `B/A` are the same market and declaring both is
+ * refused. `token0 == token1` is the same-asset cross-chain market.
  */
 interface PairConfig {
-    /** Quote-side symbol (e.g. "USDC", "USDT", "ZARP"). */
+    /** The book's base symbol (e.g. "USDC", "USDT"). Any symbol in the registry. */
     token0: string;
-    /** Base-side symbol (e.g. "CNGN"). Any symbol in the registry. */
+    /** The book's quote symbol, which the book prices the base in (e.g. "CNGN"). Any symbol in the registry. */
     token1: string;
 }
 /**
@@ -1709,18 +1755,21 @@ interface FillerTomlConfig {
      */
     assets?: Record<string, AssetDefinition>;
     /**
-     * Trading pairs — the entire trading configuration. Each pair prices
-     * `token1` in units of `token0` via its own bid/ask curves and carries a
-     * per-order `maxOrderSize` cap; a same-token pair (token0 == token1) is the
-     * same-asset cross-chain market. Required unless running watch-only.
+     * Markets the operator dashboard lists, as `token0`/`token1` symbol pairs.
+     * They carry no prices and do not gate matching: the filler prices every
+     * fill from the operator's limit orders. Optional; the browser setup wizard
+     * writes one per book the orderbook lists. Keys left over from the curve
+     * era (`bidPriceCurve`, `askPriceCurve`, `maxOrderSize`, `referenceOnly`)
+     * are ignored.
      */
     pairs?: PairConfig[];
     /**
      * Per-chain confirmation policies for cross-chain orders, keyed by chain id.
      * Merged over built-in defaults (ETH, BSC, Polygon, Base, Arbitrum,
      * Unichain); every configured chain must be covered or startup fails. The
-     * curve amount axis is the order's USD value, derived from the pair curves
-     * via the USD anchors.
+     * policy's amount axis is the order's USD value: USD stables count at $1 and
+     * other tokens are valued through the open limit orders' rates. An order no
+     * limit order connects to a dollar waits for the policy's maximum depth.
      */
     confirmationPolicies?: Record<string, ChainConfirmationPolicy>;
     simplex: {
@@ -1762,8 +1811,10 @@ interface FillerTomlConfig {
         };
         /**
          * Overfill protection knobs. Defaults: maxOverfillBps=500, maxConsecutiveClamps=3.
-         * `maxOverfillBps` clamps the per-leg output ceiling on every strategy.
-         * `maxConsecutiveClamps` only halts FXFiller. Curve clamps warn but never halt.
+         * `maxOverfillBps` is warn-only: FXFiller logs a limit order whose offer exceeds
+         * the swapper's ask by more than this, and clamps nothing. `maxConsecutiveClamps`
+         * is accepted but dormant: the clamp that fed it was for Uniswap V4 venue pricing,
+         * which is gone, so FXFiller never halts.
          */
         overfillProtection?: {
             maxOverfillBps?: number;
@@ -1781,6 +1832,16 @@ interface FillerTomlConfig {
          * Configured in seconds but written on-chain in blocks, converted per destination chain.
          */
         bidValiditySeconds?: number;
+        /**
+         * The order size, in USD, below which `order.fees` must cover the execution cost
+         * (fill gas plus, cross-chain, the relayer fee). Defaults to 20.
+         *
+         * An order worth at least this much is filled whatever fees it carries: the margin
+         * in the limit order that prices it pays for the gas. On a smaller order that
+         * margin is too thin to, so the fees have to. Set to 0 to never check fees. An
+         * order nothing can put a dollar figure on is treated as below it.
+         */
+        minOrderSizeUsd?: number;
         /**
          * Remote access: an outbound SSH tunnel to a rendezvous relay so a phone's
          * SSH client can reach the local web UI. Off unless `enabled = true`; the
@@ -1926,12 +1987,6 @@ declare class ActivityRecorder extends EventEmitter$1 {
     walletTxs(limit?: number): Promise<WalletTx[]>;
 }
 
-/**
- * One curve-priced trading pair's editable price curves. The policies are the
- * same instances the running engine prices with, so `replacePoints` takes
- * effect on the next order evaluation. A side is absent when it cannot be
- * edited: disabled (one-sided LP) or venue-priced (both sides absent).
- */
 /** One market the engine serves, as the operator's market list shows it. */
 interface AdminStrategy {
     /** Stable identifier for the API. */
@@ -1952,6 +2007,15 @@ interface HaltControl {
     resetHalt(): void;
 }
 
+/** What a limit order may pay out over its whole life, as the fill chain enforces it. */
+interface LimitOrderBudget {
+    budgetId: HexString;
+    /** The order's whole size in the output token's own units. */
+    cap: bigint;
+    /** The token the order pays on its fill chain. */
+    token: HexString;
+}
+
 interface SwapCall {
     to: string;
     data: string;
@@ -1983,6 +2047,8 @@ interface BidPlan {
     fundingCalls: ERC7821Call[];
     partialFill: boolean;
     profit: number;
+    /** That limit order's budget, which the bid settles against on the fill chain. */
+    budget?: LimitOrderBudget;
 }
 declare class CacheService {
     private cacheData;
@@ -2017,13 +2083,21 @@ declare class CacheService {
         token: HexString;
         amount: bigint;
     }[] | null;
+    /**
+     * The budget of the limit order that priced the outputs cached for this order, or
+     * null when no limit order did.
+     *
+     * Kept on the same entry as the outputs, so the two are replaced and expire
+     * together: a bid can never sign one limit order's payout beside another's budget.
+     */
+    getBidBudget(orderId: string): LimitOrderBudget | null;
     setFillerOutputs(orderId: string, outputs: {
         token: HexString;
         amount: bigint;
     }[], inputs?: {
         token: HexString;
         amount: bigint;
-    }[]): void;
+    }[], budget?: LimitOrderBudget): void;
     /**
      * The limit order this order was priced against, and the payout it allowed.
      *
@@ -2059,6 +2133,17 @@ declare class CacheService {
     isPartialFill(orderId: string): boolean;
     setPartialFill(orderId: string, partial: boolean): void;
     clearPartialFill(orderId: string): void;
+    /**
+     * Whether the strategy's completed evaluation let a bid through without holding
+     * `order.fees` to the execution cost, because the order is at or above the
+     * operator's minimum size.
+     *
+     * Written and cleared the way {@link isPartialFill} is, for the same reason: the
+     * caller exempts such an order from its profit floor.
+     */
+    isFeeCheckWaived(orderId: string): boolean;
+    setFeeCheckWaived(orderId: string, waived: boolean): void;
+    clearFeeCheckWaived(orderId: string): void;
     getFeeTokenWithDecimals(chain: string): {
         address: HexString;
         decimals: number;
@@ -2070,6 +2155,12 @@ declare class CacheService {
     setSolverSelection(chain: string, active: boolean): void;
 }
 
+/** What a bid's batch needs to settle its limit order's budget. */
+interface BudgetSettlement {
+    budget: LimitOrderBudget;
+    /** The solver's account, which is the only caller `debitOrder` accepts. */
+    solverAccount: HexString;
+}
 declare class ContractInteractionService {
     private clientManager;
     private configService;
@@ -2113,13 +2204,14 @@ declare class ContractInteractionService {
     }>;
     /**
      * The call gas a bid needs: the shared estimate plus room for the funding calls
-     * this bid prepends.
+     * this bid prepends and for settling its limit order's budget.
      *
      * Funding calls are not simulated (the V4 PositionManager's flash accounting does
      * not resolve in the bundler's estimation context), so each one adds a fixed
      * allowance for its modifyLiquidities + take. They differ between the bids on one
      * order, since each draws on its own limit order and so on its own funding, which
      * is why this is worked out per bid rather than baked into the cached estimate.
+     * The estimate is of a lone fillOrder, so the budget call is not in it either.
      */
     private callGasLimitFor;
     /**
@@ -2163,6 +2255,15 @@ declare class ContractInteractionService {
      */
     /** What `holder` holds of an ERC-20 on `chain`, in the token's own units. */
     getTokenBalance(chain: string, token: HexString, holder: HexString): Promise<bigint>;
+    /**
+     * What the solver's account has tallied against a limit order's budget on `chain`, in
+     * the paid token's own units, or null when it cannot be read.
+     *
+     * Null rather than a throw: an account whose implementation keeps no tally answers
+     * with a revert or with no data, and the caller carries on without the figure either
+     * way. Not retried, since that answer does not change on a second ask.
+     */
+    limitOrderSpent(chain: string, budgetId: HexString): Promise<bigint | null>;
     getSolverEntryPointBalance(chain: string): Promise<bigint>;
     /**
      * Deposits native tokens to the ERC-4337 EntryPoint on behalf of the solver account.
@@ -2275,8 +2376,13 @@ declare class ContractInteractionService {
      * Same-chain fills release escrow locally with no Hyperbridge dispatch, so the
      * gateway never pulls the fee token — its approval is skipped. Only cross-chain
      * fills, which dispatch a RedeemEscrow message paid in the fee token, need it.
+     *
+     * A bid priced by a limit order ends with `debitOrder`, which takes the budget's id
+     * as its `orderId`, works out what the fill paid from what is left of the allowance
+     * and reverts the whole batch if the order's payouts would pass its size. It has to
+     * come last, after the gateway has drawn on the allowance.
      */
-    buildApprovalAndFillCalldata(order: Order, fillerOutputs: TokenInfo[], fillOptions: FillOptions, requiredFeeTokenAmount: bigint): Promise<HexString>;
+    buildApprovalAndFillCalldata(order: Order, fillerOutputs: TokenInfo[], fillOptions: FillOptions, requiredFeeTokenAmount: bigint, settlement?: BudgetSettlement): Promise<HexString>;
 }
 
 /**
@@ -2775,12 +2881,18 @@ declare class OrderbookClient {
     private request;
 }
 
+/**
+ * An operator error: the request itself is wrong, and retrying it unchanged will
+ * fail the same way. The HTTP layer turns these into a 400.
+ */
+declare class LimitOrderValidationError extends Error {
+}
 /**
  * One limit order as the operator states it: what simplex takes in, and what it
  * pays out for that.
  *
- * "10000 USDC for 139000000 CNGN" is `tokenIn: "USDC", amountIn: 10000e18,
- * tokenOut: "CNGN", amountOut: 139000000e18`. The rate and the side of the book
+ * "10000 USDC for 15500000 CNGN" is `tokenIn: "USDC", amountIn: "10000",
+ * tokenOut: "CNGN", amountOut: "15500000"`, in whole tokens. The rate and the side of the book
  * follow from those, so the order is directional by construction: it prices
  * USDC to CNGN swaps and never the reverse.
  */
@@ -3021,6 +3133,21 @@ declare class LimitOrderService {
      * down because the solver cannot cover what it quoted.
      */
     reconcile(now?: Date): Promise<ReconcileReport>;
+    /**
+     * Lowers every open order's `remaining` to what the solver's account will still
+     * pay for it, and puts the order back on the book at that size.
+     *
+     * The account tallies each order's payouts on the fill chain and refuses a fill
+     * that would take the tally past the order's size. A fill that never settled
+     * here, or a store restored from an older copy, leaves `remaining` above that
+     * room and the order posted at a size the account will refuse. A tally behind
+     * the store changes nothing: `remaining` is never raised.
+     *
+     * Answers how many orders were lowered.
+     */
+    reconcileTallies(): Promise<number>;
+    /** The order as the store now holds it when its tally lowered it, null when it was left alone. */
+    private clampToTally;
     /**
      * Withdraws every order that has outlived the operator's own `expiresAt`.
      *
@@ -3131,6 +3258,13 @@ declare class IntentFiller {
      */
     /** Hands the filler the service that keeps the orderbook in step with a fill. */
     setLimitOrderService(service: LimitOrderService): void;
+    /**
+     * Brings the limit orders' `remaining` in line with their on-chain tallies.
+     *
+     * On the settlement queue, so the pass and a fill never resize the same order at
+     * once. Resolves when the pass has run.
+     */
+    reconcileLimitOrderTallies(): Promise<void>;
     /** Whether the given chain id is configured for watch-only (monitor, never fill). */
     private isChainWatchOnly;
     /**
@@ -3217,6 +3351,13 @@ declare class IntentFiller {
     private verifyOrderOnSource;
     private handleNewOrder;
     private evaluateOrder;
+    /**
+     * The destination chain's latest block number, the clock `order.deadline` is read on.
+     *
+     * Null when the read fails. That is not an answer about the order, so evaluation goes
+     * on: the gas estimate simulates the same deadline check and refuses an expired order.
+     */
+    private destinationHead;
     /**
      * Whether the strategy's evaluation concluded in a deliberate partial fill.
      *
@@ -3227,6 +3368,12 @@ declare class IntentFiller {
      * and filled them.
      */
     private fillsPartially;
+    /**
+     * Whether the strategy's evaluation let a bid through without the fee check, because
+     * the order is at or above the operator's minimum size. Read from a flag the strategy
+     * sets only once it has an answer, as {@link fillsPartially} is.
+     */
+    private feeCheckWaived;
     private executeOrder;
     private handleOrderFilledOnChain;
     /**
@@ -3275,8 +3422,8 @@ declare class IntentFiller {
      */
     private claimExecutedBid;
     /**
-     * What this fill delivered of the token the limit order pays, at 1e18, or null
-     * when the fill names none of it.
+     * What this fill delivered of the token the limit order pays, or null when the
+     * fill names none of it.
      */
     private deliveredAgainst;
     /**
@@ -3321,48 +3468,47 @@ interface TradingPair {
     token1: string;
 }
 /**
- * Strategy for swaps across a configurable set of trading pairs, each priced
- * and sized by its own bid/ask curves. Supports both same-chain and cross-chain
- * orders.
+ * Strategy for swaps priced by the operator's limit orders. Supports both
+ * same-chain and cross-chain orders.
  *
- * Pairs are declared as `token0`/`token1` registry symbols — e.g. USDC/CNGN,
- * USDT/CNGN, ZARP/CNGN — and any number of pairs can run in one engine. Curves
- * are quoted in **token1 per token0**; nothing assumes the quote side is a USD
- * stablecoin and no external price feed is consulted. Trade sizing is
- * pair-local in token0 units (the per-order `maxOrderSize` cap and the curve
- * amount axis); only confirmation sizing converts to USD, using the curves
- * themselves as the price feed (see `usdFactors`).
+ * Every leg is matched against the open limit orders (`matchLimitOrders`): an
+ * order serves a leg when it fills on the destination chain, takes the leg's
+ * input, pays out its output, accepts its source chain and, at its own rate,
+ * pays at least what the swapper asked for. Each matching order gets its own
+ * bid, best offer first, sized `min(offer, remaining)`; there is no fallback
+ * price, so a leg nothing matches is not bid on. No external price feed is
+ * consulted. Confirmation sizing is the only place a dollar value is needed,
+ * and it is derived from the limit orders' own rates (see `usdFactorsFrom`).
  *
- * For each (input, output) leg the engine finds the configured pair matching
- * the leg's direction:
- *  - input = token0, output = token1 → the filler *sells* token1 at the ask.
- *  - input = token1, output = token0 → the filler *buys* token1 at the bid.
+ * Payouts are bounded by the filler's real balances plus funding-venue
+ * withdrawals. Because the IntentGateway releases inputs proportionally to the
+ * fraction of outputs provided, partial fills need no extra on-chain logic.
  *
- * The filler holds inventory on both sides of its pairs. Profitability
- * evaluation caps each pair's legs at the pair's `maxOrderSize`, prices each
- * leg with its pair's curve (or venue), and bounds outputs by the filler's
- * real balances plus funding-venue withdrawals. Because the IntentGateway
- * releases inputs proportionally to the fraction of outputs provided, partial
- * fills (and overfills) need no extra on-chain logic.
+ * `[[pairs]]` markets do not gate matching; they name the markets the operator
+ * dashboard lists.
  */
 declare class FXFiller implements FillerStrategy {
     name: string;
     private clientManager;
     private contractService;
     private configService;
-    /** Trading pairs served by this engine; each with its own bid/ask policies and cap. */
+    /** Markets the dashboard lists. Informational only: matching reads the limit orders. */
     private pairs;
     /** Symbol → per-chain address resolution (built-ins + curated + user `[assets]`). */
     private registry;
     private signer;
     private logger;
-    /** Consecutive orders where overfill clamp activated. */
+    /**
+     * Consecutive orders where the overfill clamp activated. Dormant: the clamp
+     * existed for venue-priced legs, which went with Uniswap V4 pricing, so every
+     * outcome is now recorded unclamped and this never climbs. See `recordOrderOutcome`.
+     */
     private consecutiveClamps;
-    /** Once set, the filler refuses all orders until restart — systemic pricing error suspected. */
+    /** Once set, the filler refuses all orders until reset. Unreachable while the clamp is dormant. */
     private halted;
-    /** Ceiling bps above user-requested output. Sourced from filler config. */
+    /** Bps above the swapper's ask past which a limit order's offer is logged as suspicious. Warn only. */
     private readonly maxOverfillBps;
-    /** Consecutive clamped evaluations before halting. Sourced from filler config. */
+    /** Consecutive clamped evaluations before halting. Dormant, as `consecutiveClamps` is. */
     private readonly maxConsecutiveClamps;
     confirmationPolicy?: {
         getConfirmationBlocks: (chainId: number, amountUsd: number) => number;
@@ -3395,10 +3541,9 @@ declare class FXFiller implements FillerStrategy {
      */
     addPair(pair: TradingPair): void;
     /**
-     * Removes a market from the running engine. All-or-nothing: at least one
-     * market must remain and no other pair may lose its USD anchor (removing a
-     * reference feed that anchors a dependent market is rejected). In-flight
-     * rechecks of orders on the removed pair simply stop matching.
+     * Removes a market from the running engine. At least one market must remain.
+     * Matching reads the limit orders rather than the pairs, so removing a market
+     * changes what the dashboard lists, not what the filler fills.
      */
     removePair(pair: TradingPair): void;
     /**
@@ -3408,22 +3553,21 @@ declare class FXFiller implements FillerStrategy {
     initialise(): Promise<void>;
     canFill(order: Order): Promise<boolean>;
     /**
-     * Evaluates whether an order is profitable to fill under the per-pair
-     * `maxOrderSize` caps (where set) and the filler's current token balances.
+     * Evaluates whether an order is profitable to fill against the operator's
+     * limit orders and the filler's current token balances.
      *
      * High-level flow:
-     * - Resolve each (input, output) leg to a configured pair and direction.
-     * - Estimate each pair's total token0 notional in the order and cap it at
-     *   the pair's `maxOrderSize` when one is set; pair curves are evaluated at
-     *   that (possibly uncapped) notional.
-     * - Walk the legs, allocating from each pair's capped token0 budget and
-     *   pricing outputs at the pair's rate.
-     * - Further cap each leg by the filler's current token balance plus
-     *   funding-venue withdrawals.
-     * - Cache the resulting outputs for later use in `executeOrder`.
-     *
-     * Note: we may intentionally overfill relative to the user's requested
-     * outputs if the pair pricing makes that attractive. This is how we stay competitive.
+     * - Match each (input, output) leg against the open limit orders.
+     * - Build one bid per matching order, best offer first, each paying the
+     *   order's whole offer for the input at its own rate, capped by what the
+     *   order has left. The gateway credits the swapper the ask and splits
+     *   anything above it between the swapper and the protocol.
+     * - Treat a payout below the ask as a partial fill, which only orders
+     *   without output calldata and without an earlier partial fill allow.
+     * - Cap each payout by the filler's balance plus funding-venue withdrawals,
+     *   then gate it on fees (full fills of orders below `minOrderSizeUsd`) and the
+     *   same-asset spread.
+     * - Cache the resulting bids for later use in `executeOrder`.
      */
     calculateProfitability(order: Order): Promise<number>;
     /**
@@ -3445,27 +3589,19 @@ declare class FXFiller implements FillerStrategy {
     private submitBid;
     /**
      * Update consecutive-clamp counter after a successful order evaluation.
-     * Only venue-priced legs feed this counter (see clamp site) — a streak of those
-     * is the signal that a live market source has gone off (stale pool, manipulated
-     * venue) and the filler should stop until an operator investigates. Offline
-     * price-curve clamps warn but never reach here.
+     *
+     * Dormant. Only venue-priced legs ever fed a clamped outcome here: a streak
+     * of those meant a live market source had gone off (stale pool, manipulated
+     * venue). Venue pricing went with Uniswap V4, and limit orders are prices the
+     * operator set, so the only caller records `false` and the filler never
+     * halts. `isHalted`, `resetHalt` and `[simplex.overfillProtection]
+     * maxConsecutiveClamps` are kept so existing configs and the halt API still
+     * load; they can go once nothing reads them.
      */
     private recordOrderOutcome;
     isHalted(): boolean;
     /** Operator acknowledgement after investigating a self-halt; resumes filling. */
     resetHalt(): void;
-    /**
-     * Given a single (input, output) leg and the remaining token0 budget of its
-     * pair, computes how much token0 notional to allocate to this leg and the
-     * corresponding maximum output amount at the pair's rate.
-     *
-     * `rate` is **token1 per 1 token0**:
-     * - token0 input → token1 output: token0 × rate → token1 amount.
-     * - token1 input → token0 output: token1 ÷ rate → token0 amount.
-     *
-     * Returns `null` when this leg cannot consume any of the pair's remaining
-     * budget (e.g. the cap has already been exhausted).
-     */
     /**
      * Whether any solver has already delivered output against this order.
      *
@@ -3659,7 +3795,8 @@ interface SimplexOptions {
      * transaction it sends. Required unless every chain is watch-only.
      *
      * {@link Signer} is an interface, not a menu: `privateKeySigner`,
-     * `turnkeySigner` and `mpcVaultSigner` are the implementations that ship here,
+     * `secretPhraseSigner`, `turnkeySigner` and `mpcVaultSigner` are the
+     * implementations that ship here,
      * `viemSigner` adapts any viem account (a `toAccount` wrapper around an HSM or
      * a remote signing service included), and anything else that satisfies the
      * interface works the same way.
@@ -3775,12 +3912,20 @@ interface SimplexEvents {
     "limit-order:cancelled": {
         order: LimitOrder;
     };
-    /** A fill worked the order down and it went back on the book at its new size. */
+    /**
+     * The order was worked down and went back on the book at its new size. A fill does
+     * this, and so does a correction to the solver account's on-chain tally, for which
+     * no fill is recorded. `delivered` is what the order went down by either way.
+     */
     "limit-order:resized": {
         order: LimitOrder;
         delivered: string;
     };
-    /** A fill took the order under the orderbook's dust floor, so it is done. */
+    /**
+     * The order went under the orderbook's dust floor, so it is done. A fill takes it
+     * there, and so does a correction to the solver account's on-chain tally, for which
+     * no fill is recorded.
+     */
     "limit-order:filled": {
         order: LimitOrder;
     };
@@ -4146,7 +4291,8 @@ declare class OrderScanner implements OrderScanner$1 {
      * back from its own endpoints, which also proves they answer for one chain
      * before a filler ever depends on them.
      *
-     * @throws if an endpoint set is invalid or unreachable, if two entries resolve
+     * @throws if an endpoint set is invalid, if none of a chain's endpoints answer,
+     *   if its endpoints disagree on the chain, if two entries resolve
      *   to the same chain, or if `scanIntervalSecs` is below the minimum.
      */
     static create(options: OrderScannerOptions): Promise<OrderScanner>;
@@ -4174,4 +4320,4 @@ declare class OrderScanner implements OrderScanner$1 {
     private closeNow;
 }
 
-export { ActivityEvent, ActivityInsert, ActivityStore, type AllowlistConfig, type AssetBalanceRow, AssetController, type AssetDefinition, type AuthorizationRequest, type BalanceIssue, type BalanceSnapshot, BidStats, BidStore, type BinanceConfig, type ChainBalanceRow, type ChainConfirmationPolicy, ChainController, type ChainInput, type ChainView, type CurveConfig, type CurvePoint, type Eip7702Authorization$1 as Eip7702Authorization, type FillerConfigFile, type FillerTomlConfig, type HyperbridgeBalance, LogLevel, LogSink, Logger, LoggerContext, MemoryDataStore, type MpcVaultSignerConfig, OrderScanner, type OrderScanner$1 as OrderScannerContract, type OrderScannerHandlers, type OrderScannerOptions, type PairConfig, PairController, type PairView, type PrivateKeySignerConfig, type QueueConfig, RebalanceController, type RebalancingConfig, type ResolvedChainConfig, type ScannedFill, type ScannedOrder, type ScannerChainConfig, type Signature, type Signer, type SignerConfig, type SignerTransaction, SignerType, Simplex, type SimplexConfig, SimplexDataStore, type SimplexEvents, type SimplexOptions, type SimplexStatus, type SolverWork, StateStore, StoredBid, type Subscription, type TurnkeySignerConfig, type TypedDataPayload, USD_STABLE_SYMBOLS, type UserProvidedChainConfig, type VaultBalanceRow, VaultController, type VaultSweepDeposit, type VaultSweepResult, type VaultSweepSkip, type VaultSweepSkipReason, type VaultSweepSubmission, type VaultToml, type VaultTomlConfig, WalletController, WalletTx, assertConfirmationCoverage, createSigner, digestSigner, formatChainKey, isRegistrySymbol, mpcVaultSigner, normalizeSymbol, parseChainKey, pickAnchorStable, privateKeySigner, registrySymbols, turnkeySigner, validateAssetDefinitions, validateConfig, validatePairConfigs, validateSignerConfig, validateVaultToml, viemSigner };
+export { ActivityEvent, ActivityInsert, ActivityStore, type AllowlistConfig, type AssetBalanceRow, AssetController, type AssetDefinition, type AuthorizationRequest, type BalanceIssue, type BalanceSnapshot, BidStats, BidStore, type BinanceConfig, type CancelledLimitOrder, type ChainBalanceRow, type ChainConfirmationPolicy, ChainController, type ChainInput, type ChainView, type CreateLimitOrderRequest, type CurveConfig, type CurvePoint, type DerivingSigner, type Eip7702Authorization$1 as Eip7702Authorization, type FillerConfigFile, type FillerTomlConfig, type HyperbridgeBalance, LimitOrder, LimitOrderController, LimitOrderFill, LimitOrderFilter, LimitOrderStore, LimitOrderValidationError, LogLevel, LogSink, Logger, LoggerContext, MemoryDataStore, type MpcVaultSignerConfig, OrderScanner, type OrderScanner$1 as OrderScannerContract, type OrderScannerHandlers, type OrderScannerOptions, type PairConfig, PairController, type PairView, type PostedLimitOrder, type PostingOutcome, type PrivateKeySignerConfig, type QueueConfig, RebalanceController, type RebalancingConfig, type ResolvedChainConfig, type ScannedFill, type ScannedOrder, type ScannerChainConfig, type SecretPhraseSignerConfig, type Signature, type Signer, type SignerConfig, type SignerTransaction, SignerType, Simplex, type SimplexConfig, SimplexDataStore, type SimplexEvents, type SimplexOptions, type SimplexStatus, type SolverWork, StateStore, StoredBid, type Subscription, type TurnkeySignerConfig, type TypedDataPayload, USD_STABLE_SYMBOLS, type UserProvidedChainConfig, type VaultBalanceRow, VaultController, type VaultSweepDeposit, type VaultSweepResult, type VaultSweepSkip, type VaultSweepSkipReason, type VaultSweepSubmission, type VaultToml, type VaultTomlConfig, WalletController, WalletTx, assertConfirmationCoverage, canDerive, createSigner, digestSigner, formatChainKey, isRegistrySymbol, mpcVaultSigner, normalizeSymbol, parseChainKey, pickAnchorStable, privateKeySigner, registrySymbols, secretPhraseSigner, turnkeySigner, validateAssetDefinitions, validateConfig, validatePairConfigs, validateSecretPhrase, validateSignerConfig, validateVaultToml, viemSigner };