@hyperbridge/simplex 0.17.0 → 0.18.0

package/dist/types-6MEltdkX.d.cts

@@ -0,0 +1,2297 @@
+import { ChainConfig, HexString, Order, ERC7821Call, IntentsCoprocessor } from '@hyperbridge/sdk';
+import { PublicClient, Hash, AbiEvent, BlockNumber, BlockTag, GetLogsParameters, GetLogsReturnType, WalletClient, Transport, Chain } from 'viem';
+import { Account } from 'viem/accounts';
+import pino from 'pino';
+import { ChannelCredentials } from '@grpc/grpc-js';
+import Decimal from 'decimal.js';
+
+declare const LOG_LEVELS: readonly ["trace", "debug", "info", "warn", "error"];
+type LogLevel = (typeof LOG_LEVELS)[number];
+/**
+ * Anything that accepts a line of text: `process.stdout`, a `fs` write stream, a
+ * socket, a `pino-pretty` transform, or an object literal that forwards into
+ * your own logger. Node's `Writable` satisfies it as-is.
+ */
+interface LogSink {
+    write(line: string): void;
+}
+type LogFn = {
+    (obj: unknown, msg?: string, ...args: unknown[]): void;
+    (msg: string, ...args: unknown[]): void;
+};
+interface Logger {
+    trace: LogFn;
+    debug: LogFn;
+    info: LogFn;
+    warn: LogFn;
+    error: LogFn;
+    fatal: LogFn;
+}
+type LoggerOptions = {
+    module?: string;
+};
+/**
+ * An isolated logging destination: its own sinks, its own level, its own pino
+ * instance.
+ *
+ * Each `Simplex` owns one, so two fillers in a process log to their own sinks at
+ * their own verbosity and never cross-contaminate. Services receive the context
+ * their filler was started with and resolve module loggers from it.
+ */
+declare class LoggerContext {
+    private level;
+    private readonly sinks;
+    private base;
+    private readonly children;
+    constructor(options?: {
+        level?: LogLevel;
+        sink?: LogSink;
+    });
+    /**
+     * Drops the memoized loggers so the next call rebuilds at the current level
+     * and sink set. Module loggers are wrappers rather than pino instances
+     * precisely so this reaches loggers that already exist — replacing the base
+     * logger would leave every service that had captured a child logging at the
+     * old level forever.
+     */
+    private invalidate;
+    private baseLogger;
+    private childFor;
+    /** Registers a destination and returns a function that removes it. */
+    addSink(sink: LogSink): () => void;
+    /** Sets verbosity, including for loggers already handed out. */
+    setLevel(level: LogLevel): void;
+    /** A logger tagged with `module`. Safe to hold; it resolves the current state per call. */
+    get(module?: string): Logger;
+    /** @internal — used by {@link ModuleLogger} to resolve per call. */
+    resolve(module?: string): pino.Logger;
+}
+/**
+ * Registers a destination on the process-wide context and returns a function
+ * that removes it.
+ *
+ * This is for the application layer. To capture a specific filler's output, pass
+ * `SimplexOptions.logger` instead — a filler's records go to its own context,
+ * not here.
+ */
+declare function addLogSink(sink: LogSink): () => void;
+/** Sets the level of the process-wide context. Does not affect running fillers. */
+declare function configureLogger(level: LogLevel): void;
+/** A logger on the process-wide context. Instance-scoped code resolves from its own {@link LoggerContext}. */
+declare function getLogger(moduleOrOptions?: string | LoggerOptions): Logger;
+/**
+ * Resolves a module logger from a context that may be absent.
+ *
+ * Services read their context off the `FillerConfigService` or
+ * `ChainClientManager` they were constructed with, and `bootFiller` always
+ * supplies real ones. Hand-built test doubles generally do not, so this falls
+ * back to the process context rather than forcing every mock to carry a logger.
+ */
+declare function moduleLogger(context: LoggerContext | undefined, module: string): Logger;
+
+interface UserProvidedChainConfig {
+    /** One or more RPC URLs. When multiple are provided, event scans use quorum consensus. */
+    rpcUrls: string[];
+    /** Accepted and ignored. Simplex fills through Hyperbridge's bundler for the chain. */
+    bundlerUrl?: string;
+}
+interface ResolvedChainConfig {
+    chainId: number;
+    /** One or more RPC URLs for this chain. When multiple are provided, event scans use quorum consensus. */
+    rpcUrls: string[];
+    /** Hyperbridge's bundler for the chain, or undefined where it runs none. */
+    bundlerUrl?: string;
+}
+interface GasFeeBumpConfig {
+    maxPriorityFeePerGasBumpPercent?: number;
+    maxFeePerGasBumpPercent?: number;
+}
+interface RebalancingConfig$1 {
+    triggerPercentage: number;
+    baseBalances: {
+        USDC?: Record<string, string>;
+        USDT?: Record<string, string>;
+    };
+}
+interface OverfillProtectionConfig {
+    /** Ceiling bps above user-requested output; filler clamps its computed output to this. Default 500 (5%). */
+    maxOverfillBps?: number;
+    /** Consecutive clamped evaluations before the strategy halts itself. Default 3. */
+    maxConsecutiveClamps?: number;
+}
+interface AllowlistConfig {
+    /** Hex addresses eligible across all chains. */
+    users?: string[];
+    /** Per-source-chain overrides, keyed by state machine id (e.g. "EVM-1"). Merged with the global list. */
+    bySource?: Record<string, string[]>;
+}
+interface FillerConfig {
+    maxConcurrentOrders: number;
+    logging?: LogLevel;
+    hyperbridgeWsUrl?: string;
+    substratePrivateKey?: string;
+    entryPointAddress?: string;
+    /**
+     * Optional gas fee bump configuration for UserOperation gas estimation.
+     * If not provided, defaults will be used (8% for priority fee, 10% for max fee).
+     */
+    gasFeeBump?: GasFeeBumpConfig;
+    rebalancing?: RebalancingConfig$1;
+    /**
+     * Target gas units the EntryPoint deposit should cover per chain.
+     * Defaults to 3,000,000 if not set.
+     */
+    targetGasUnits?: number;
+    /**
+     * Seconds a signed bid stays executable. Defaults to 300 (5 minutes).
+     * See `bidValiditySeconds` in filler-toml for why this bound matters.
+     */
+    bidValiditySeconds?: number;
+    /**
+     * Order size in USD below which `order.fees` must cover the execution cost.
+     * Defaults to 20. See `minOrderSizeUsd` in filler-toml.
+     */
+    minOrderSizeUsd?: number;
+    /**
+     * Overfill protection knobs. If omitted, defaults are used
+     * (maxOverfillBps=500, maxConsecutiveClamps=3).
+     */
+    overfillProtection?: OverfillProtectionConfig;
+    /**
+     * Restricts which order `user` addresses the filler processes. When omitted, all
+     * users are accepted. When present, only listed users (global ∪ per-source) are
+     * accepted; a chain whose merged set is empty rejects every order.
+     */
+    allowlist?: AllowlistConfig;
+    /**
+     * How often the block scanner polls each chain, in seconds. Defaults to 3.
+     * Each tick costs one `eth_blockNumber` plus one `eth_getLogs` per chain per
+     * endpoint, so raising it is the main lever for staying inside a
+     * rate-limited RPC's budget — at the cost of seeing orders that much later.
+     */
+    blockScanIntervalSeconds?: number;
+}
+/**
+ * Simplified configuration service for the filler that wraps ChainConfigService
+ * and only requires minimal user configuration (RPC URLs, private keys, etc.)
+ */
+declare class FillerConfigService {
+    /**
+     * This filler's logging destination. Services resolve their module loggers
+     * from here rather than from the process-wide context, which is what keeps
+     * two fillers in one process from writing into each other's sinks.
+     */
+    readonly loggers: LoggerContext;
+    private chainConfigService;
+    private rpcOverrides;
+    private bundlerUrls;
+    private fillerConfig?;
+    /** Lowercased global allowlist users, or undefined when no global list is configured. */
+    private allowlistGlobal?;
+    /** Lowercased per-source allowlist users keyed by state machine id, or undefined when no per-source list is configured. */
+    private allowlistBySource?;
+    constructor(chainConfigs: ResolvedChainConfig[], fillerConfig?: FillerConfig, loggers?: LoggerContext);
+    getAllowlist(): AllowlistConfig | undefined;
+    /**
+     * Registers a chain at runtime. `getConfiguredChainIds` derives from the RPC
+     * override map, so this is what makes a chain "configured" — every address
+     * lookup already resolves through the SDK's chain registry, which knows the
+     * chain whether or not this filler was started with it.
+     *
+     * Rejects a chain that is already registered: silently replacing its
+     * endpoints would leave the event monitor scanning the old ones. Use
+     * {@link setRpcUrls} for that.
+     */
+    addChain(chain: ResolvedChainConfig): void;
+    /** Drops a chain from the configured set. */
+    removeChain(chainId: number): void;
+    /**
+     * Replaces a chain's RPC endpoints. Callers must invalidate the cached viem
+     * clients (`ChainClientManager.invalidate`) and rebuild the chain's scanner
+     * afterwards — a client bakes its transport in at construction, so this
+     * change is invisible to anything already holding one.
+     */
+    setRpcUrls(chainId: number, rpcUrls: string[]): void;
+    /** Replaces the rebalancing config at runtime; trigger checks read it live. */
+    setRebalancing(rebalancing: RebalancingConfig$1 | undefined): void;
+    /** Replaces the allowlist at runtime; takes effect on the next order. */
+    setAllowlist(allowlist: AllowlistConfig | undefined): void;
+    /**
+     * Whether an order from `user` on `chain` (a source state machine id, e.g. "EVM-1")
+     * may be processed. Returns true when no allowlist is configured. Otherwise the user
+     * must appear in the global list or the per-source override for that chain; an empty
+     * merged set rejects every order on that chain.
+     */
+    isUserAllowed(user: string, chain: string): boolean;
+    getChainConfig(chain: string): ChainConfig;
+    getIntentGatewayAddress(chain: string): `0x${string}`;
+    getHostAddress(chain: string): `0x${string}`;
+    getWrappedNativeAssetWithDecimals(chain: string): {
+        asset: HexString;
+        decimals: number;
+    };
+    getDaiAsset(chain: string): HexString;
+    getUsdtAsset(chain: string): HexString;
+    getUsdcAsset(chain: string): HexString;
+    getUsdcDecimals(chain: string): number;
+    getSimplexPaymasterAddress(chain: string): HexString | undefined;
+    getUsdtDecimals(chain: string): number;
+    /**
+     * Curated decimals for a token, looked up by address in the SDK's per-chain
+     * asset table. Returns `undefined` for any token not in that table.
+     *
+     * This is the safety net for `ContractInteractionService.getTokenDecimals`
+     * when the on-chain `decimals()` read fails: the registry already carries the
+     * correct value for every supported asset (verified on-chain at curation
+     * time), so a failed read has no business guessing.
+     */
+    getAssetDecimalsByAddress(chain: string, address: HexString): number | undefined;
+    getChainId(chain: string): number;
+    getConsensusStateId(chain: string): string;
+    getHyperbridgeChainId(): number;
+    getHyperbridgeRpcUrl(): string;
+    getRpcUrl(chain: string): string;
+    /**
+     * Returns every user-configured RPC URL for a chain. When multiple URLs are present,
+     * consumers (e.g. the event monitor) run queries as a quorum — every provider must
+     * return the same result for the batch to succeed.
+     */
+    getRpcUrls(chain: string): string[];
+    private getChainIdFromStateMachineId;
+    getUniswapRouterV2Address(chain: string): HexString;
+    getUniswapV2FactoryAddress(chain: string): HexString;
+    getUniversalRouterAddress(chain: string): HexString;
+    getUniswapV3QuoterAddress(chain: string): HexString;
+    getUniswapV4QuoterAddress(chain: string): HexString;
+    getUniswapV4PositionManagerAddress(chain: string): HexString;
+    getUniswapV4PoolManagerAddress(chain: string): HexString;
+    getUniswapV4StateViewAddress(chain: string): HexString;
+    getPermit2Address(chain: string): HexString;
+    getCoingeckoId(chain: string): string | undefined;
+    getCNgnAsset(chain: string): HexString | undefined;
+    getAssetBySymbol(chain: string, symbol: string): HexString | undefined;
+    getCNgnDecimals(chain: string): number | undefined;
+    getExtAsset(chain: string): HexString | undefined;
+    getExtDecimals(chain: string): number | undefined;
+    getConfiguredChainIds(): number[];
+    getLoggingConfig(): LogLevel | undefined;
+    getHyperbridgeAddress(): string;
+    getHyperbridgeWsUrl(): string | undefined;
+    getSubstratePrivateKey(): string | undefined;
+    getEntryPointAddress(chain: string): HexString | undefined;
+    getSolverAccountContractAddress(chain: string): HexString | undefined;
+    getBundlerUrl(chain: string): string | undefined;
+    /**
+     * Get the maxPriorityFeePerGas bump percentage.
+     * @returns The configured percentage or undefined if not set (default 8% will be used)
+     */
+    getMaxPriorityFeePerGasBumpPercent(): number | undefined;
+    /**
+     * Get the maxFeePerGas bump percentage.
+     * @returns The configured percentage or undefined if not set (default 10% will be used)
+     */
+    getMaxFeePerGasBumpPercent(): number | undefined;
+    /**
+     * Get the full gas fee bump configuration.
+     * @returns The gas fee bump config or undefined if not set
+     */
+    getGasFeeBumpConfig(): GasFeeBumpConfig | undefined;
+    /**
+     * Get the LayerZero Endpoint ID for the chain
+     * Used for USDT0 cross-chain transfers via LayerZero OFT
+     */
+    getLayerZeroEid(chain: string): number | undefined;
+    /**
+     * Get the USDT0 OFT contract address for the chain
+     * On Ethereum: OFT Adapter (locks/unlocks USDT)
+     * On other chains: OFT contract (mints/burns USDT0)
+     */
+    getUsdt0OftAddress(chain: string): HexString | undefined;
+    /**
+     * Get rebalancing configuration
+     */
+    getRebalancingConfig(): RebalancingConfig$1 | undefined;
+    /**
+     * Get base balance for a specific chain and asset
+     * @param chainId Chain ID as number
+     * @param asset "USDC" or "USDT"
+     * @returns Base balance as Decimal, or undefined if not configured
+     */
+    getBaseBalance(chainId: number, asset: "USDC" | "USDT"): number | undefined;
+    /**
+     * Get trigger percentage for rebalancing
+     * @returns Trigger percentage (0-1), or undefined if not configured
+     */
+    getTriggerPercentage(): number | undefined;
+    /**
+     * Get target gas units for EntryPoint deposits.
+     * Defaults to 3,000,000 if not configured.
+     */
+    getTargetGasUnits(): bigint;
+    /**
+     * How long a signed bid remains executable, in seconds. Defaults to 300 (5 minutes).
+     *
+     * A bid is a firm price the placer may take up at a moment of their choosing; this is the
+     * only thing bounding that window, since the order deadline is placer-controlled and
+     * Hyperbridge-side retraction does not reach the destination chain.
+     */
+    getBidValiditySeconds(): number;
+    /**
+     * The order size, in USD, below which `order.fees` must cover the execution cost.
+     * Defaults to 20. An order at or above it is filled whatever fees it carries.
+     */
+    getMinOrderSizeUsd(): number;
+    /** Ceiling bps above user-requested output. Default 500 (5%). */
+    getMaxOverfillBps(): bigint;
+    /** Consecutive clamped evaluations before the strategy halts. Default 3. */
+    getMaxConsecutiveClamps(): number;
+}
+
+/**
+ * What one quorum call is allowed to spend.
+ *
+ * `deadlineMs` is the ceiling on the call itself: past it, the endpoints still
+ * outstanding are treated as failures, so they stop voting and the call is
+ * decided over the endpoints that answered, or fails with a QuorumError naming
+ * them. Early exit decides as soon as the endpoints still out could not change
+ * the outcome; the deadline decides when one of them never answers.
+ *
+ * `timeoutMs` bounds one endpoint's attempt, and there is only ever one: the
+ * transports are built with `retryCount: 0`, so an endpoint's whole
+ * contribution to a call is a single request. That is what keeps the two
+ * numbers independent — a task cannot approach `deadlineMs` by retrying inside
+ * itself, so a deadline that fires means something outside the budget went
+ * wrong rather than an endpoint using the budget as designed.
+ */
+interface QuorumBudget {
+    timeoutMs: number;
+    deadlineMs: number;
+}
+/**
+ * Wraps multiple viem `PublicClient`s — one per configured RPC URL — and runs
+ * selected read paths (`getLogs`, `getBlockNumber`, `getTransactionConfirmations`)
+ * as a **BFT quorum**: a result is accepted only when `quorumThreshold(m)` of the
+ * `m` endpoints that answered agree on it.
+ *
+ * A provider that *answers with divergent data* is never special-cased away — it
+ * simply fails to join the agreeing group, which is what makes a lying or reorged
+ * endpoint detectable rather than authoritative.
+ *
+ * A provider that *fails* does not vote. A failed request says nothing about the
+ * chain, so it must not outvote the endpoints that agree: the threshold guards
+ * against endpoints that answer wrongly, and every answer still counts. Six
+ * endpoints with two failing decide over the other four, three of which must
+ * agree. The price, worth stating plainly, is that a call can be decided by fewer
+ * endpoints than the operator configured; at the limit, one endpoint answering
+ * while the rest fail decides alone. The voters are still exclusively the
+ * operator's own.
+ *
+ * The bench is the one state this class keeps, and {@link benchFor} decides who
+ * goes on it: a request-rate limit ({@link isSuspendableRateLimit}), a response
+ * that is not JSON ({@link isMalformedResponse}), or a head behind the quorum's
+ * ({@link isStaleHead}). All three share the property that earns it — the
+ * endpoint will keep failing the same way for a while — so a benched endpoint is
+ * not asked for its window: asking would spend its quota, or hold the call open
+ * for an answer already known to fail. When every endpoint is benched, all are
+ * queried again; there is nobody left to prefer. Every other failure is per
+ * call, and the endpoint is asked again next time.
+ *
+ * The constructor validates that URLs resolve to distinct hostnames so a "quorum"
+ * isn't secretly the same upstream in disguise.
+ */
+declare class QuorumPublicClient {
+    readonly clients: PublicClient[];
+    readonly rpcUrls: string[];
+    /**
+     * The quorum bar when every endpoint answers: `quorumThreshold(n)` over the
+     * full set. Each call's bar is `quorumThreshold` over the endpoints that answer
+     * it, so this is the most it can be.
+     */
+    readonly threshold: number;
+    private readonly logger?;
+    /**
+     * Rate-limit bench state, shared across every instance and keyed by endpoint
+     * URL. The bench describes the ENDPOINT, not the wrapper: the scanner and the
+     * confirmation poller construct separate clients over the same URLs, and a
+     * throttle one of them observed is a throttle for both. Instance state would
+     * halve the relief — and evaporate whenever `setRpcUrls` rebuilds a client.
+     */
+    private static benchedUntil;
+    /** Test hook: forgets every bench. Production never calls it. */
+    static clearAllSuspensions(): void;
+    /** What this client's calls may spend; see {@link QuorumBudget}. */
+    private readonly deadlineMs;
+    constructor(chainId: number, rpcUrls: string[], loggers?: LoggerContext, budget?: QuorumBudget);
+    get size(): number;
+    /** Endpoints currently benched, by URL. See {@link benchFor} for the reasons. */
+    suspended(): string[];
+    /**
+     * The endpoints this call queries: everyone not benched. A benched endpoint is
+     * dropped outright: it answers nothing while throttled, so asking it could only
+     * cost a request. With every endpoint benched, everyone is queried again; there
+     * is nobody left to prefer.
+     */
+    private participants;
+    /**
+     * Records a task failure against its endpoint. Only the failures
+     * {@link benchFor} names carry state: everything else stays per-call, as the
+     * class doc promises.
+     * The bench is the one silent state transition this class has, so it warns —
+     * an operator whose bar just dropped from 2-of-2 to 1-of-1 should not need a
+     * QuorumError to find out.
+     */
+    private noteFailure;
+    /**
+     * Highest block a quorum of endpoints have all indexed: the highest B such
+     * that `threshold` endpoints report head ≥ B. Returns null when fewer than
+     * `threshold` endpoints have responded.
+     */
+    private quorumHead;
+    /**
+     * Settles per-client tasks incrementally and resolves the moment the
+     * evaluator can decide from the responses seen so far — the hot path never
+     * blocks on the slowest provider (a hung endpoint with a 30s timeout × 3
+     * retries would otherwise stall every confirmation poll). Stragglers settle
+     * out of band and are ignored. `tryDecide` returns undefined to keep
+     * waiting; once every task has settled, `finalize` must decide (it throws
+     * the QuorumError when the full response set still has no quorum).
+     *
+     * Both are handed the bar: the BFT threshold over the endpoints that have not
+     * failed, answered or still out. A failure lowers it rather than counting
+     * against it. Counting the pending endpoints keeps an early decision to a bar
+     * no lower than the full response set would get, so a vote it did not wait for
+     * could never have reversed it.
+     *
+     * `deadlineMs` bounds the other direction: when the bar is NOT reachable
+     * from the fast responders, the call used to wait out every straggler, and
+     * the caller's own retry loop multiplied that into minutes of a chain not
+     * being scanned at all, silently. At the deadline the outstanding endpoints
+     * are treated as failures — named in the QuorumError, so the operator sees
+     * which ones held the call up — and `finalize` decides over the endpoints
+     * that answered.
+     */
+    private settleUntilQuorum;
+    /**
+     * Highest block head backed by a quorum of the endpoints that answer. Throws
+     * {@link QuorumError} when none do.
+     */
+    getBlockNumber(): Promise<bigint>;
+    /**
+     * Confirmation count for a transaction under the quorum.
+     *
+     * Every endpoint is asked for the receipt and its head. A "receipt not found"
+     * answer is a valid **no** vote — the endpoint is responsive but does not see
+     * the transaction (not yet propagated, or reorged out) — so it counts toward
+     * responsiveness but joins no inclusion group. The transaction is confirmed
+     * only when a quorum agrees on the same `(blockHash, blockNumber)`; the depth
+     * is then the quorum head of that agreeing group. A minority still serving a
+     * reorged/fabricated receipt can never reach the quorum.
+     *
+     * Throws {@link QuorumError} when no inclusion reaches the quorum — including
+     * the ordinary window where the tx is not yet mined on enough endpoints.
+     */
+    getTransactionConfirmations({ hash }: {
+        hash: Hash;
+    }): Promise<bigint>;
+    /**
+     * Fetches logs from every endpoint in parallel and returns the result once a
+     * quorum agrees. Fails with {@link QuorumError} otherwise.
+     *
+     * Generics mirror `PublicClient.getLogs` so caller-side inference (event decoding,
+     * strict mode, pending vs mined) is preserved end-to-end.
+     */
+    getLogs<const TAbiEvent extends AbiEvent | undefined = undefined, const TAbiEvents extends readonly AbiEvent[] | readonly unknown[] | undefined = TAbiEvent extends AbiEvent ? [TAbiEvent] : undefined, TStrict extends boolean | undefined = undefined, TFromBlock extends BlockNumber | BlockTag | undefined = undefined, TToBlock extends BlockNumber | BlockTag | undefined = undefined>(params: GetLogsParameters<TAbiEvent, TAbiEvents, TStrict, TFromBlock, TToBlock>): Promise<GetLogsReturnType<TAbiEvent, TAbiEvents, TStrict, TFromBlock, TToBlock>>;
+    /**
+     * `skipped` is the participants() snapshot for THIS call, not the suspension
+     * state at throw time — a call that rides out its deadline can outlive a
+     * bench window, and the message must explain
+     * who was excluded when the call started, not who would be excluded now.
+     */
+    private describeResponders;
+    private formatFailures;
+}
+
+/**
+ * The signing contract a solver runs on, and the config shapes the bundled
+ * implementations take.
+ *
+ * `Signer` is the whole surface: implement it and Simplex signs with your
+ * backend. Nothing here is viem-shaped, so a consumer never has to match this
+ * package's viem version to satisfy it — `viemSigner` adapts a viem account into
+ * one, and simplex builds the account its wallet clients need from whatever it
+ * is given.
+ */
+
+interface MpcVaultSignerConfig {
+    apiToken: string;
+    vaultUuid: string;
+    accountAddress: HexString;
+    callbackClientSignerPublicKey: string;
+    /**
+     * gRPC target address. Defaults to "api.mpcvault.com:443".
+     * Replaces the previous REST `baseUrl` field.
+     */
+    grpcTarget?: string;
+    /**
+     * Destination for signing lifecycle logs. Defaults to the process-wide
+     * context, which an embedded filler's `SimplexOptions.logger` never sees —
+     * pass your own to capture retries and failures in that setup.
+     */
+    logger?: Logger;
+    /** Channel credentials override for tests against a plaintext server. Defaults to TLS. */
+    credentials?: ChannelCredentials;
+}
+declare enum SignerType {
+    PrivateKey = "privateKey",
+    MpcVault = "mpcVault",
+    Turnkey = "turnkey",
+    SecretPhrase = "secretPhrase"
+}
+interface TurnkeySignerConfig {
+    organizationId: string;
+    apiPublicKey: string;
+    apiPrivateKey: string;
+    signWith: string;
+}
+interface PrivateKeySignerConfig {
+    key: HexString;
+}
+interface SecretPhraseSignerConfig {
+    /** BIP-39 mnemonic from the English wordlist. */
+    phrase: string;
+    /**
+     * Which wallet under the phrase is the hot wallet: the last component of
+     * `m/44'/60'/0'/0/i`. Defaults to 0.
+     */
+    accountIndex?: number;
+}
+/**
+ * The `[simplex.signer]` block of the TOML file the binary reads — a tagged
+ * union over the bundled backends. `createSigner` turns one into a {@link Signer};
+ * `Simplex.start` takes the `Signer`, not this.
+ */
+type SignerConfig = ({
+    type: SignerType.PrivateKey;
+} & PrivateKeySignerConfig) | ({
+    type: SignerType.MpcVault;
+} & MpcVaultSignerConfig) | ({
+    type: SignerType.Turnkey;
+} & TurnkeySignerConfig) | ({
+    type: SignerType.SecretPhrase;
+} & SecretPhraseSignerConfig);
+/**
+ * A secp256k1 signature in split form, which is how EIP-7702 and raw digests
+ * consume it: `r` and `s` as 32-byte 0x-hex, and `yParity` strictly 0 or 1.
+ * A backend that hands back the legacy `v` (27/28) should subtract 27 — the
+ * delegation path rejects anything else rather than letting viem mis-encode it.
+ */
+interface Signature {
+    r: HexString;
+    s: HexString;
+    yParity: number;
+}
+/**
+ * An EIP-712 payload, as `eth_signTypedData_v4` defines it.
+ *
+ * `domain.chainId` is the only field a signing backend is likely to read for
+ * itself: the digest covers it, and backends that scope a signing request to a
+ * chain (MPCVault) take it from here rather than from a separate argument.
+ *
+ * **List `EIP712Domain` in `types` on any payload you build.** viem ignores it
+ * when hashing locally, so a payload without it looks correct against a private
+ * key. Backends that hash server-side from the JSON derive the domain type from
+ * that entry — MPCVault and Turnkey both do — and without it they sign a
+ * different digest than the one your verifier checks. The failure is quiet: the
+ * signature is well-formed and recovers to an address that is not yours.
+ * `CryptoUtils.packedUserOpTypedData` in the sdk sets it for this reason.
+ */
+interface TypedDataPayload {
+    domain?: {
+        name?: string;
+        version?: string;
+        chainId?: number | bigint;
+        verifyingContract?: HexString;
+        salt?: HexString;
+    };
+    types: Record<string, readonly {
+        name: string;
+        type: string;
+    }[]>;
+    primaryType: string;
+    message: Record<string, unknown>;
+}
+/** EIP-7702 authorization tuple, signed, as a set-code transaction carries it. */
+interface Eip7702Authorization$1 extends Signature {
+    chainId: number;
+    address: HexString;
+    nonce: number;
+}
+/**
+ * A transaction to sign, handed to backends that implement
+ * {@link Signer.signTransaction}. Field names follow the JSON-RPC transaction
+ * object; simplex only ever sends EIP-1559 transfers and EIP-7702 set-code
+ * transactions, so those are the fields modelled here.
+ */
+interface SignerTransaction {
+    chainId: number;
+    type?: string;
+    to?: HexString;
+    value?: bigint;
+    data?: HexString;
+    nonce?: number;
+    gas?: bigint;
+    maxFeePerGas?: bigint;
+    maxPriorityFeePerGas?: bigint;
+    /** Present on EIP-7702 set-code transactions, and on nothing else. */
+    authorizationList?: Eip7702Authorization$1[];
+}
+/**
+ * Everything a solver asks of the key that owns its funds. Pass an
+ * implementation to `Simplex.start({ signer })`.
+ *
+ * Three operations, one identity. Each operation names what is being authorised
+ * — a typed-data payload, an EIP-7702 authorization, a transaction — rather than
+ * a digest, so a custody backend's policy engine can read what it is signing.
+ *
+ * A backend that only signs digests does not implement this by hand: pass its
+ * `sign(hash)` to {@link digestSigner}, which does the hashing and serialising
+ * and returns a `Signer`.
+ */
+interface Signer {
+    /** The address every fill, bid and delegation is attributed to. */
+    readonly address: HexString;
+    /** Names the backend in logs — `"privateKey"`, `"turnkey"`, or whatever names yours. */
+    readonly mode: string;
+    /**
+     * EIP-712. Signs every bid UserOperation and every paymaster permit.
+     *
+     * Returns the 65-byte `r ‖ s ‖ v` signature as 0x-hex (132 characters), with
+     * `v` 27 or 28 — exactly what `eth_signTypedData_v4` and viem's
+     * `signTypedData` produce. On-chain validation recovers against this form.
+     */
+    signTypedData(typedData: TypedDataPayload): Promise<HexString>;
+    /**
+     * Signs an EIP-7702 authorization tuple — the delegation that makes this
+     * account a solver. Backends with a structured encoding for it (Turnkey) use
+     * that; others sign `keccak256(0x05 ‖ rlp([chainId, contractAddress, nonce]))`.
+     *
+     * Returns the SPLIT signature — see {@link Signature}: `yParity` must be 0 or
+     * 1, not the legacy `v`. This is the one method that does not return hex,
+     * because the authorization is embedded field-by-field in the transaction.
+     */
+    signAuthorization(auth: AuthorizationRequest): Promise<Signature>;
+    /**
+     * Signs and serialises a transaction. Backends that take transactions
+     * (MPCVault's vault API, Turnkey's transaction payloads) keep the transaction
+     * legible to their policy engine; others serialise it and sign the digest.
+     *
+     * Returns the WHOLE SIGNED TRANSACTION — typed-envelope RLP as
+     * `eth_sendRawTransaction` takes it (`0x02…` for EIP-1559, `0x04…` for
+     * set-code), not a bare signature. viem's `serializeTransaction(tx, signature)`
+     * produces it from a signed digest.
+     */
+    signTransaction(tx: SignerTransaction): Promise<HexString>;
+}
+/**
+ * A {@link Signer} backed by a key tree rather than a single key, so it can hand
+ * out signers for sibling wallets.
+ */
+interface DerivingSigner extends Signer {
+    /** Index of the wallet this signer itself signs with. */
+    readonly accountIndex: number;
+    /** The signer for the wallet at `index`, which may be this signer's own. */
+    derive(index: number): Signer;
+}
+/** The tuple an EIP-7702 authorization signature covers. */
+interface AuthorizationRequest {
+    chainId: number;
+    /** The contract the account delegates to. */
+    contractAddress: HexString;
+    nonce: number;
+}
+
+/**
+ * Manages chain clients for different operations
+ */
+declare class ChainClientManager {
+    private signer;
+    /**
+     * The viem account every wallet client is built on, derived from the signer
+     * once. `Signer` is viem-free by design, so this is where the two meet.
+     */
+    private account;
+    private configService;
+    private clientFactory;
+    private quorumClients;
+    /** This filler's logging destination, relayed from the config service. */
+    get loggers(): LoggerContext;
+    constructor(configService: FillerConfigService, signer?: Signer);
+    /**
+     * Drops every cached client for a chain. Call after the chain's RPC URLs
+     * change (or when the chain is removed) so the next lookup rebuilds against
+     * the current endpoints — transports are baked into a client at construction.
+     *
+     * Callers that hold a client reference across the invalidation keep talking to
+     * the old endpoints; `EventMonitor` re-reads its quorum client per chain
+     * rebuild for exactly this reason.
+     */
+    invalidate(chain: string): void;
+    getPublicClient(chain: string): PublicClient;
+    /**
+     * Quorum client for consensus-critical reads (cross-chain confirmation
+     * counting; the scanner builds its own instance over its own chain list).
+     * Built from the operator's configured endpoints and cached per chain. The
+     * instances are separate but their rate-limit bench is shared state keyed by
+     * endpoint URL, so a throttle either observes benches the endpoint for both.
+     */
+    getQuorumClient(chain: string): QuorumPublicClient;
+    getWalletClient(chain: string): WalletClient<Transport, Chain, Account>;
+    getAccount(): Account;
+    getSigner(): Signer;
+    getClientsForOrder(order: Order): {
+        destClient: PublicClient;
+        sourceClient: PublicClient;
+        walletClient: WalletClient<Transport, Chain, Account>;
+    };
+}
+
+/**
+ * Raw EIP-7702 authorization, as produced by the delegation flow. Attached to the
+ * bundler UserOp so a not-yet-delegated EOA can be delegated in the same op.
+ */
+interface Eip7702Authorization {
+    chainId: number;
+    address: HexString;
+    nonce: number;
+    r: HexString;
+    s: HexString;
+    yParity: number;
+}
+interface UserOpGasLimits {
+    verificationGasLimit: bigint;
+    callGasLimit: bigint;
+    preVerificationGas: bigint;
+}
+interface SponsoredUserOpRequest {
+    chain: string;
+    /** ERC-7821 batch (or "0x" for a no-op, e.g. delegation). */
+    callData: HexString;
+    /**
+     * Attach when the EOA still needs delegating in this op. Pass a factory rather
+     * than a pre-signed tuple: building paymaster data can send an approve tx from
+     * the authority EOA (the Simplex bootstrap approve to Permit2), and an authorization signed before
+     * that tx embeds a stale nonce the bundler will reject. The factory runs only
+     * after paymaster data is built.
+     */
+    eip7702Auth?: Eip7702Authorization | (() => Promise<Eip7702Authorization>);
+    /** EntryPoint nonce key. Defaults to 0. */
+    nonceKey?: bigint;
+    /**
+     * Explicit gas limits. Provide them to skip bundler estimation — required for
+     * the not-yet-delegated EIP-7702 case, where the account has no code to
+     * simulate so estimation is unreliable. When omitted, limits are estimated.
+     */
+    gas?: UserOpGasLimits;
+    /**
+     * Lets the paymaster fall back to an EIP-2612 permit when the fee token has no
+     * Permit2 allowance yet. Only a first-time delegation sets this — it carries the
+     * `approve(Permit2, max)` in its own callData, so the permit buys the one op that
+     * makes every later Permit2 op possible without native.
+     */
+    permitBootstrap?: boolean;
+}
+/**
+ * Submits self-initiated, paymaster-sponsored UserOperations through the bundler,
+ * so the solver pays gas in stablecoins rather than native token. Shared by the
+ * delegation setup and the vault sweep/redeem paths.
+ *
+ * Submission contract (so callers can safely fall back to a native tx without
+ * risking a double-execution):
+ * - Returns `null` when the op was **never submitted** — paymaster/bundler not
+ *   configured, insufficient USDC, preparation failed (approve tx or signing), or
+ *   the bundler rejected `eth_sendUserOperation` outright (it never entered the
+ *   mempool). The caller may fall back to native.
+ * - Returns `{ txHash }` once a receipt is observed.
+ * - **Throws** only when the op **was submitted** but no receipt arrived. The
+ *   caller must NOT fall back (the op may still land) — retry on the next cycle.
+ */
+declare class UserOpSender {
+    private readonly clientManager;
+    private readonly configService;
+    private readonly signer;
+    private logger;
+    constructor(clientManager: ChainClientManager, configService: FillerConfigService, signer: Signer);
+    /** True when a sponsored UserOp is even possible on this chain (paymaster + bundler configured). */
+    canSponsor(chain: string): boolean;
+    trySendSponsored(req: SponsoredUserOpRequest): Promise<{
+        txHash: HexString;
+    } | null>;
+    /**
+     * Estimates account gas limits via the bundler. The op is signed first so the
+     * estimation simulation passes the account's ECDSA validation. Falls back to
+     * generous constants when the bundler estimate is unavailable.
+     */
+    private estimateGas;
+    private buildSignedUserOp;
+    /**
+     * Prices the op for the rundler bundler, as the fill path does: its suggested fees, or the
+     * chain's gas price raised to the priority fee it requires where it suggests none.
+     */
+    private getGasPrice;
+    private sendBundlerRpc;
+    private waitForUserOpReceipt;
+}
+
+/**
+ * Service for managing EIP-7702 delegation of the filler's EOA to the SolverAccount contract.
+ * This enables the filler to participate in solver selection mode.
+ *
+ * When the Simplex paymaster is configured and the filler holds stablecoins already
+ * approved to Permit2, delegation is performed via a no-op UserOp sent through the
+ * bundler — the paymaster pays gas in stablecoins. Falls back to a direct type-0x04 tx
+ * if the bundler path is unavailable.
+ *
+ * The paymaster prefunds through Permit2, which needs a standing token approval to the
+ * Permit2 contract. On a chain the solver has never used, the delegation op installs
+ * that approval itself and pays for the privilege with an EIP-2612 permit, so a
+ * permit-capable fee token bootstraps with no native at all. A token without a permit
+ * (BNB Chain) still needs native dust once, for the type-0x04 tx that batches the
+ * approve in. Every op after that is native-free either way.
+ */
+declare class DelegationService {
+    private clientManager;
+    private configService;
+    private signer;
+    private logger;
+    private readonly userOpSender;
+    constructor(clientManager: ChainClientManager, configService: FillerConfigService, signer: Signer);
+    /**
+     * @param viaBundler When true, uses the current nonce (bundler submits the tx).
+     *                   When false, uses nonce+1 (EOA submits the type-0x04 tx itself).
+     */
+    private buildAuthorization;
+    private sendDelegationTransaction;
+    /**
+     * Best-effort resolution of a Permit2 approval to fold into a native delegation. Never
+     * throws: a resolution failure (RPC error, misconfig) yields null and the delegation
+     * proceeds as a plain self-call.
+     */
+    private resolvePendingPermit2Approval;
+    /**
+     * Checks if the filler's EOA is already delegated to the SolverAccount contract on a specific chain.
+     */
+    isDelegated(chain: string): Promise<boolean>;
+    /**
+     * Sets up EIP-7702 delegation via the bundler. Uses the Simplex paymaster when
+     * configured and the filler holds a sufficient stablecoin balance.
+     *
+     * The op is a no-op once the account has a Permit2 allowance. On a chain it has
+     * never used, and only when the fee token implements EIP-2612 (`permitCapable`),
+     * the op instead carries `approve(Permit2, max)` as its callData and asks the
+     * paymaster for PERMIT mode: the permit covers this op's gas, and the op installs
+     * the allowance every later op authorizes against. That is the whole zero-native
+     * bootstrap — one sponsored op, after which the account never needs a permit again.
+     */
+    private setupDelegationViaBundler;
+    /**
+     * Installs `approve(Permit2, max)` on an account that is ALREADY delegated, using the same
+     * permit-funded op the first-time delegation carries — minus the authorization, which it
+     * does not need.
+     *
+     * This exists because delegation and bootstrap are separate facts. An account delegated by
+     * an earlier release has no Permit2 allowance (that release charged EIP-2612 permits and
+     * never touched Permit2), and `setupDelegation` returns before the bootstrap once
+     * `isDelegated` holds. Leaving it there strands every upgraded solver on the native-funded
+     * approve path.
+     *
+     * Best-effort and never throws: on failure the first sponsored op still falls back to
+     * `sendFundedApprove`, which works for a solver holding native.
+     */
+    private ensurePermit2Allowance;
+    /**
+     * Sets up EIP-7702 delegation from the filler's EOA to the SolverAccount contract.
+     *
+     * A fee token with no Permit2 allowance yet cannot be charged through Permit2, so the
+     * approve has to be installed by the very first operation. Which carrier does that
+     * depends on the token:
+     *
+     * - EIP-2612 token: the bundler goes first and the op pays for itself with a permit
+     *   while carrying the approve in its callData. No native is spent, so this is
+     *   preferred even on an EOA that holds some.
+     * - No permit (BSC pegged stables): only a native type-0x04 tx can carry the approve,
+     *   so that goes first when the EOA covers it.
+     *
+     * With nothing pending — the allowance is already in place — the bundler path goes
+     * first as usual. A plain direct tx is the last fallback in every case.
+     */
+    setupDelegation(chain: string): Promise<boolean>;
+    /** Whether the EOA can pay for one direct set-code tx at the current gas price. */
+    private nativeCoversDirectTx;
+    /**
+     * Sends one native EIP-7702 delegation tx (optionally batching a Permit2 approve) and
+     * waits for its receipt. Never throws: a revert or send error is logged and returns
+     * false, so the caller can fall back. Rebuilds the authorization each call, so a fresh
+     * nonce is used after a prior attempt consumed one.
+     */
+    private trySendDelegation;
+    /**
+     * Sets up delegation on the specified chains where solver selection is active.
+     */
+    setupDelegationOnChains(chains: string[]): Promise<{
+        success: boolean;
+        results: Record<string, boolean>;
+    }>;
+    /**
+     * Revokes delegation by delegating to the zero address.
+     */
+    revokeDelegation(chain: string): Promise<boolean>;
+}
+
+/** `[simplex.tunnel]` in the config file. */
+interface TunnelConfig {
+    /** Off by default: enabling it makes the embedded SSH server reachable from the internet. */
+    enabled?: boolean;
+    /** `host[:port]`; port defaults to 443. */
+    relay?: string;
+    /** `SHA256:…` fingerprint of the relay host key. Without it the key seen on first contact is pinned. */
+    relayHostKey?: string;
+}
+
+/**
+ * A coordinate point on a curve
+ * @property amount - The input threshold (e.g., USD amount)
+ * @property value - The output value at this threshold (e.g., confirmations, bps)
+ */
+interface CurvePoint {
+    amount: string;
+    value: number;
+}
+/**
+ * Configuration for a curve
+ */
+interface CurveConfig {
+    points: CurvePoint[];
+}
+/**
+ * Manages confirmation block requirements per chain.
+ * Each chain has its own curve mapping order value to required confirmations.
+ */
+/**
+ * Parses a per-chain config key. Every other table in the config writes chains
+ * as state machine ids ("EVM-1"), so both "EVM-1" and bare "1" are accepted;
+ * anything else returns null and callers MUST fail loudly — a silently
+ * discarded chain key has meant committing capital on a chain configured as
+ * watch-only, or hardening a confirmation curve that never applied.
+ */
+declare function parseChainKey(key: string): number | null;
+/** The canonical "EVM-<id>" state machine id `parseChainKey` accepts. */
+declare function formatChainKey(chainId: number | string): string;
+declare class ConfirmationPolicy {
+    private policies;
+    constructor(policyConfig: Record<string, CurveConfig>);
+    getConfirmationBlocks(chainId: number, amountUsd: Decimal): number;
+    /**
+     * Installs a curve for a chain added at runtime. Validates before it mutates,
+     * so a rejected curve leaves the policy set untouched — a chain that started
+     * scanning without a curve would drop every cross-chain order sourced on it
+     * with a per-order throw.
+     */
+    add(chainId: number, config: CurveConfig): void;
+    /** Whether a chain has a confirmation curve. */
+    has(chainId: number): boolean;
+    remove(chainId: number): void;
+    /**
+     * Copies one chain's curve across from another policy set.
+     *
+     * Used when a chain is added at runtime and covered by a built-in default: the
+     * defaults are only materialised inside a freshly constructed policy, so the
+     * live one adopts the entry rather than re-deriving it.
+     */
+    adopt(chainId: number, from: ConfirmationPolicy): void;
+    /**
+     * Startup guard: every configured chain must have a confirmation curve.
+     * Without this, a missing policy only surfaces as a per-order throw at
+     * fill time — cross-chain orders sourced on that chain silently dropped.
+     */
+    assertCovers(chainIds: number[]): void;
+}
+
+/**
+ * A user-supplied asset entry in the `[assets]` TOML table: symbol → chain
+ * state machine id → contract address.
+ *
+ * ```toml
+ * [assets.BRZ]
+ * "EVM-1"   = "0x..."
+ * "EVM-137" = "0x..."
+ * ```
+ */
+type AssetDefinition = Record<string, HexString>;
+/**
+ * The subset of `FillerConfigService` used to resolve built-in symbols to
+ * per-chain addresses from the SDK chain registry.
+ */
+interface BuiltinAssetResolver {
+    getUsdcAsset(chain: string): HexString;
+    getUsdtAsset(chain: string): HexString;
+    getDaiAsset(chain: string): HexString;
+    getCNgnAsset(chain: string): HexString | undefined;
+    /** Generic per-chain lookup into the SDK chain registry's asset table. */
+    getAssetBySymbol(chain: string, symbol: string): HexString | undefined;
+}
+/**
+ * Symbols pegged to 1 USD. They are pinned at $1 when an order's USD value is
+ * derived from the limit orders' rates (see `usdFactorsFrom`), which is what
+ * sizes confirmation depth. Trade pricing never uses this as a price.
+ */
+declare const USD_STABLE_SYMBOLS: ReadonlySet<string>;
+/** Normalises a symbol for lookups: trimmed, uppercased. "cNGN" ≡ "CNGN". */
+declare function normalizeSymbol(symbol: string): string;
+/** Every symbol the registry ships without user configuration. */
+declare function registrySymbols(): string[];
+/** Whether `symbol` ships with the registry (built-in or curated). Pure — no chain resolution. */
+declare function isRegistrySymbol(symbol: string): boolean;
+/**
+ * Validates the `[assets]` table; throws a descriptive error on the first
+ * invalid entry. Side-effect free — safe to call at config-parse time and again
+ * at registry construction.
+ */
+declare function validateAssetDefinitions(assets: Record<string, AssetDefinition>): void;
+/**
+ * Symbol → contract address registry: how a token symbol in a limit order or an
+ * orderbook book becomes a contract on a chain.
+ *
+ * Resolution merges two layers, most specific winning:
+ *  1. the user's `[assets]` table — an *escape hatch* for assets the registry
+ *     doesn't ship (or per-deployment overrides), never required for shipped
+ *     symbols;
+ *  2. shipped symbols (USDC, USDT, DAI, CNGN, USDR, ZARP, EURC, XSGD, TRYB,
+ *     BRIDGE) resolved per chain from the SDK chain registry (`chain.ts`) —
+ *     the single source of truth shared with the rest of the SDK, so an
+ *     address correction there is never shadowed by a parallel table here.
+ *
+ * Address lookups are per `(symbol, chain)` — a chain where no layer knows the
+ * asset simply doesn't trade it. The registry holds addresses only; prices come
+ * from the operator's limit orders.
+ */
+declare class AssetRegistry {
+    private readonly resolver;
+    private readonly userAssets;
+    private readonly addressCache;
+    constructor(resolver: BuiltinAssetResolver, userAssets?: Record<string, AssetDefinition>);
+    /** Whether `symbol` is known (user-defined, curated, or built-in). */
+    hasSymbol(symbol: string): boolean;
+    /**
+     * Registers new user-defined assets on the live registry (runtime market
+     * adds). Existing symbols may not be redefined — an address swap under a
+     * running market would silently repoint its fills.
+     */
+    addAssets(defs: Record<string, AssetDefinition>): void;
+    /**
+     * Contract address of `symbol` on `chain`, or `null` when the asset is not
+     * deployed/known there. User `[assets]` addresses win over the SDK chain
+     * registry, per chain.
+     */
+    getAddress(symbol: string, chain: string): HexString | null;
+    /**
+     * The symbol `address` is known by on `chain`, or null when nothing in the
+     * registry resolves to it.
+     *
+     * Every symbol this registry can name is tried, user `[assets]` first so an
+     * overridden address reports the name the operator gave it. Two symbols
+     * resolving to one address would be a registry mistake; the first wins.
+     */
+    symbolFor(address: string, chain: string): string | null;
+}
+
+interface PaymasterKeeperConfig {
+    /** Chains to monitor. Defaults to every configured chain with a SimplexPaymaster. */
+    chains?: string[];
+    intervalMinutes?: number;
+    /** Minimum accrued balance (in whole stablecoin units) worth recycling. */
+    minSwapUsd?: number;
+}
+
+interface ChainConfirmationPolicy {
+    /**
+     * Array of (amount, value) coordinates defining the confirmation curve.
+     * value = number of confirmations at that order amount
+     */
+    points: Array<{
+        amount: string;
+        value: number;
+    }>;
+}
+/**
+ * TOML row for an ERC-4626 vault entry. `threshold` (absolute human units) is the
+ * high-water mark that triggers a sweep down to `minBalance`; omit both for
+ * withdraw-only sourcing.
+ */
+interface VaultToml {
+    chain: string;
+    vault: HexString;
+    threshold?: string;
+    minBalance?: string;
+    redeemOnShutdown?: boolean;
+}
+/** Top-level `[vault]` config: ERC-4626 treasury vaults, for withdraw sourcing and threshold sweeping. */
+interface VaultTomlConfig {
+    vaults?: VaultToml[];
+    sweepIntervalMs?: number;
+}
+interface QueueConfig {
+    maxRechecks: number;
+    recheckDelayMs: number;
+}
+interface RebalancingConfig {
+    triggerPercentage: number;
+    baseBalances: {
+        USDC?: Record<string, string>;
+        USDT?: Record<string, string>;
+    };
+}
+interface BinanceConfig {
+    apiKey: string;
+    apiSecret: string;
+    basePath?: string;
+    timeout?: number;
+    depositTimeoutMs?: number;
+    pollIntervalMs?: number;
+    withdrawTimeoutMs?: number;
+}
+interface FillerTomlConfig {
+    /**
+     * Optional asset-registry escape hatch: symbol → { chain → address }. Only
+     * needed for assets the built-in registry does not ship, or to override a
+     * shipped address for a deployment. Shipped symbols: USDC, USDT, DAI, CNGN
+     * (SDK chain registry) + curated USDR, ZARP, EURC, XSGD, TRYB and BRIDGE.
+     */
+    assets?: Record<string, AssetDefinition>;
+    /**
+     * Per-chain confirmation policies for cross-chain orders, keyed by chain id.
+     * Merged over built-in defaults (ETH, BSC, Polygon, Base, Arbitrum,
+     * Unichain); every configured chain must be covered or startup fails. The
+     * policy's amount axis is the order's USD value: USD stables count at $1 and
+     * other tokens are valued through the open limit orders' rates. An order no
+     * limit order connects to a dollar waits for the policy's maximum depth.
+     */
+    confirmationPolicies?: Record<string, ChainConfirmationPolicy>;
+    simplex: {
+        /** Orders evaluated at once. Defaults to 5. */
+        maxConcurrentOrders?: number;
+        /**
+         * Accepted and ignored. Older configs and the wizard used to write it; the
+         * engine never read it. Kept in the type so those configs still load.
+         */
+        queue?: QueueConfig;
+        logging?: string;
+        watchOnly?: boolean | Record<string, boolean>;
+        substratePrivateKey: string;
+        hyperbridgeWsUrl: string;
+        /**
+         * Hyperbridge indexer GraphQL endpoint, used to backfill order details on
+         * activity rows recorded before they were captured. Defaults per network
+         * (nexus for mainnet, gargantua for testnet).
+         */
+        indexerUrl?: string;
+        /** Accepted and ignored. Contract addresses come from the SDK chain registry. */
+        entryPointAddress?: string;
+        /** Accepted and ignored. Contract addresses come from the SDK chain registry. */
+        solverAccountContractAddress?: string;
+        /** Target gas units for EntryPoint deposits per chain. Defaults to 3,000,000. */
+        targetGasUnits?: number;
+        /**
+         * Block-scanner poll period per chain in seconds. Defaults to 3, and
+         * fractional values are allowed (0.5 = twice a second). Each tick costs
+         * one `eth_blockNumber` + one `eth_getLogs` per chain per endpoint, so
+         * raising this is the lever for fitting inside a rate-limited RPC's
+         * budget; the cost is seeing new orders that much later.
+         */
+        blockScanIntervalSeconds?: number;
+        /** Gas fee bump (percentages added to base gasPrice). Defaults: priority=8%, max=10%. */
+        gasFeeBump?: {
+            maxPriorityFeePerGasBumpPercent?: number;
+            maxFeePerGasBumpPercent?: number;
+        };
+        /**
+         * Overfill protection knobs. Defaults: maxOverfillBps=500, maxConsecutiveClamps=3.
+         * `maxOverfillBps` is warn-only: FXFiller logs a limit order whose offer exceeds
+         * the swapper's ask by more than this, and clamps nothing. `maxConsecutiveClamps`
+         * is accepted but dormant: the clamp that fed it was for Uniswap V4 venue pricing,
+         * which is gone, so FXFiller never halts.
+         */
+        overfillProtection?: {
+            maxOverfillBps?: number;
+            maxConsecutiveClamps?: number;
+        };
+        /**
+         * How long a signed bid stays executable, in seconds. Defaults to 300 (5 minutes).
+         *
+         * Written into `FillOptions.validUntil` and enforced by `fillOrder`, which reverts
+         * `FillExpired` past it. This is how long the quoted price stands as a firm commitment:
+         * the order's `deadline` is chosen by the placer with no ceiling, and retracting the bid
+         * on Hyperbridge does not reach the destination chain, so without it a signed bid stays
+         * executable indefinitely and is taken up only once the rate has moved against us.
+         *
+         * Configured in seconds but written on-chain in blocks, converted per destination chain.
+         */
+        bidValiditySeconds?: number;
+        /**
+         * The order size, in USD, below which `order.fees` must cover the execution cost
+         * (fill gas plus, cross-chain, the relayer fee). Defaults to 20.
+         *
+         * An order worth at least this much is filled whatever fees it carries: the margin
+         * in the limit order that prices it pays for the gas. On a smaller order that
+         * margin is too thin to, so the fees have to. Set to 0 to never check fees. An
+         * order nothing can put a dollar figure on is treated as below it.
+         */
+        minOrderSizeUsd?: number;
+        /**
+         * Remote access: an outbound SSH tunnel to a rendezvous relay so a phone's
+         * SSH client can reach the local web UI. Off unless `enabled = true`; the
+         * relay defaults to the hosted one. Devices are paired from the UI.
+         */
+        tunnel?: TunnelConfig;
+    };
+    chains: UserProvidedChainConfig[];
+    rebalancing?: RebalancingConfig;
+    binance?: BinanceConfig;
+    /** Filler-wide vault config: stablecoin sourcing for fills + threshold sweeping. */
+    vault?: VaultTomlConfig;
+    /** Restricts order processing to listed user addresses. Omit to accept all users. */
+    allowlist?: AllowlistConfig;
+    /** SimplexPaymaster fee-recycling keeper (`paymaster-keeper` subcommand). */
+    keeper?: PaymasterKeeperConfig;
+    /** The HyperFX orderbook simplex posts its limit orders to. */
+    orderbook?: OrderbookConfig;
+}
+/**
+ * Where the operator's limit orders are advertised.
+ *
+ * The limit orders themselves are not configured here: they live in `bids.db`
+ * and are created over the API, because they are inventory the operator opens
+ * and closes while the filler runs rather than startup settings.
+ */
+interface OrderbookConfig {
+    /** GraphQL endpoint. */
+    url: string;
+    /**
+     * How long a limit order lives, in seconds, and the TTL written into its posting,
+     * when the create request names none. Defaults to 365 days; at least 900, the
+     * orderbook's floor. The order and its posting expire together: there is one
+     * clock, and nothing renews it.
+     */
+    defaultTtlSecs?: number;
+    /** How often to reconcile local limit orders against the orderbook, in seconds. */
+    reconcileIntervalSecs?: number;
+    requestTimeoutMs?: number;
+}
+/**
+ * The TOML file the binary reads: a {@link FillerTomlConfig} plus the
+ * `[simplex.signer]` block, which is the CLI's way of naming a signing backend.
+ *
+ * The block is not part of the library's config — `Simplex.start` takes a
+ * `Signer` instance — so it lives on this type and nowhere else. The binary
+ * resolves it with `signerFromToml` and passes the parsed file straight through;
+ * the extra key rides along untouched so the dashboard's config writer can put
+ * it back in the file it came from.
+ */
+interface FillerConfigFile extends FillerTomlConfig {
+    simplex: FillerTomlConfig["simplex"] & {
+        /** Omitted by watch-only configs, which sign nothing. */
+        signer?: SignerConfig;
+    };
+}
+/**
+ * Boot-parity confirmation coverage: every configured chain id needs a
+ * confirmation curve (built-in defaults or [confirmationPolicies]), or orders
+ * sourced on it would be silently dropped. Boot and both wizard write gates
+ * run the same construction; the gates know the chain ids the wizard selected,
+ * boot the ids resolved from the RPCs.
+ */
+declare function assertConfirmationCoverage(confirmationPolicies: FillerTomlConfig["confirmationPolicies"], chainIds: number[]): ConfirmationPolicy;
+/**
+ * Validates raw TOML `[vault].vaults` entries. Pure and browser-safe — shared
+ * by `validateConfig`, the vault-update endpoint and the funding planner.
+ * Throws on missing/invalid required fields.
+ */
+declare function validateVaultToml(vaults: {
+    chain?: string;
+    vault?: string;
+    threshold?: string;
+    minBalance?: string;
+    redeemOnShutdown?: boolean;
+}[]): void;
+declare function validateConfig(config: FillerTomlConfig, cliWatchOnly?: boolean): void;
+
+interface SendTokenParams {
+    /** State machine id, e.g. "EVM-8453". */
+    chain: string;
+    /** "native" or an ERC-20 address. Configured vault shares are redeemed to the recipient instead of transferred. */
+    token: string;
+    /** Human-readable amount, parsed against the token's decimals. */
+    amount: string;
+    to: HexString;
+}
+interface SendTokenResult {
+    txHash: HexString;
+    sponsored: boolean;
+    /** Set when vault holdings were redeemed as part of the send. */
+    redeemed: boolean;
+}
+/**
+ * Operator-initiated outbound transfers from the filler wallet. Uses the same
+ * sponsored UserOp path as fills (gas paid by the paymaster) with a native-tx
+ * fallback. When the wallet balance of an ERC-20 falls short and a configured
+ * ERC-4626 vault holds it as underlying, the shortfall is withdrawn from the
+ * vault in the same batch as the transfer. Sending a vault's share token
+ * directly issues `redeem(shares, recipient, solver)` — shares only ever
+ * leave as the underlying asset.
+ */
+declare class TokenSender {
+    private readonly clientManager;
+    private readonly solver;
+    /** Live view of the configured vaults so runtime vault edits are honored. */
+    private readonly getVaults;
+    private readonly userOpSender?;
+    /** Only needed to size the paymaster's gas reserve; without it a send reserves nothing. */
+    private readonly configService?;
+    private readonly logger;
+    constructor(clientManager: ChainClientManager, solver: HexString, 
+    /** Live view of the configured vaults so runtime vault edits are honored. */
+    getVaults: () => VaultToml[], userOpSender?: UserOpSender | undefined, 
+    /** Only needed to size the paymaster's gas reserve; without it a send reserves nothing. */
+    configService?: FillerConfigService | undefined);
+    send(params: SendTokenParams): Promise<SendTokenResult>;
+    /**
+     * A `withdraw(shortfall, solver, solver)` call against a configured vault on
+     * this chain whose underlying is the token being sent and that can cover the
+     * shortfall, or null when no vault can.
+     */
+    /**
+     * A withdrawal that funds the transfer and, where the vault can afford it,
+     * leaves headroom in the wallet rather than nothing.
+     *
+     * `shortfall` is what the transfer cannot do without, and is zero or negative
+     * when the wallet already covers it. The headroom is the larger of the
+     * paymaster's gas `reserve` and the vault's `minBalance` — the first is what
+     * validation will pull out of this wallet, the second is the operator's own
+     * statement of the working balance this token keeps. A vault that can only
+     * cover the shortfall still funds the send: headroom is a preference, not a
+     * reason to refuse a transfer the operator asked for.
+     */
+    private vaultWithdrawalCall;
+    /**
+     * Executes a batch from the filler wallet: sponsored UserOp first, native tx
+     * when no sponsor is available. Shared by every operator-initiated outbound flow.
+     */
+    submitCalls(chain: string, calls: ERC7821Call[]): Promise<{
+        txHash: HexString;
+        sponsored: boolean;
+    }>;
+    /**
+     * The `approve(Permit2, max)` to run first when the wallet has never approved Permit2 for its fee
+     * token on this chain, and that token has an EIP-2612 permit. The op then pays its gas with a permit
+     * and installs the approval, so a wallet with no native can still send; later ops use Permit2.
+     * Undefined otherwise, or when the check fails, and the send goes ahead as before.
+     */
+    private permit2Bootstrap;
+}
+
+type TopUpPayToken = "USDC" | "USDT";
+/**
+ * - `placing`: the placement batch is being sent.
+ * - `awaiting_bids` / `filling`: the order is open on the gateway.
+ * - `delivering`: filled on BSC; the BRIDGE is being relayed to Hyperbridge.
+ * - `delivered`: the BRIDGE reached the filler's Hyperbridge account.
+ * - `unfilled`: the order is past its auction without a fill; its input is still escrowed.
+ * - `reclaiming` / `reclaimed`: the order is being, or has been, cancelled and refunded.
+ * - `filled`: a record from before delivery was tracked; the BRIDGE was sent to Hyperbridge.
+ * - `failed`: nothing was escrowed, or the outcome needs the operator's attention.
+ */
+type BridgeTopUpStage = "placing" | "awaiting_bids" | "filling" | "delivering" | "delivered" | "unfilled" | "reclaiming" | "reclaimed" | "filled" | "failed";
+interface BridgeTopUpQuoteParams {
+    /** Source state machine id the filler pays from, e.g. "EVM-8453". */
+    chain: string;
+    token: TopUpPayToken;
+    /** Human-readable stablecoin amount. */
+    amount: string;
+}
+interface BridgeTopUpQuote {
+    chain: string;
+    token: TopUpPayToken;
+    tokenAddress: HexString;
+    amountIn: string;
+    /** BRIDGE the order requires, after slippage and nexus rounding. */
+    bridgeOut: string;
+    /** BRIDGE per one stablecoin unit, from the quote. */
+    rate: string;
+    fillable: boolean;
+    /** Largest stablecoin input the route can fill, human-readable. */
+    maxFillableIn: string;
+    route: string;
+}
+/** What the dashboard sees of a top-up: the stored record without its order or session key. */
+type BridgeTopUpState = Omit<StoredBridgeTopUp, "order" | "sessionPrivateKey"> & {
+    /** True while the top-up blocks a new one. */
+    pending: boolean;
+};
+/** A stablecoin the filler wallet can pay a top-up with, on one network it fills on. */
+interface BridgeTopUpSource {
+    chain: string;
+    chainId: number;
+    token: TopUpPayToken;
+    address: HexString;
+    /** Human-readable wallet balance, or null when the network could not be read. */
+    balance: string | null;
+    /** What a top-up can spend: the balance less {@link reserve}. Null when unread. */
+    spendable: string | null;
+    /** Held back for the paymaster, which pulls gas in this token. */
+    reserve: string;
+}
+interface BridgeTopUpDeps {
+    clientManager: ChainClientManager;
+    /**
+     * A top-up pays from a network the filler fills on: one whose account is delegated, so
+     * the placement batch runs through it with gas paid in stablecoins.
+     */
+    delegation: Pick<DelegationService, "isDelegated">;
+    configService: FillerConfigService;
+    tokenSender: TokenSender;
+    /** Where the top-up record is kept, so an open order is tracked across restarts. */
+    state: StateStore;
+    /** Directory for the SDK's order session keys and cancellation progress. */
+    storagePath: string;
+    /** Indexer the cross-chain reclaim streams its GET request status from. */
+    indexerUrl: string;
+    /** Filler EVM account that pays for the order. */
+    solver: HexString;
+    /** sr25519 public key of the filler's Hyperbridge account, the BRIDGE recipient. */
+    substratePublicKey: HexString;
+    /** Coprocessor the order's bids are read from. */
+    hyperbridge?: Promise<IntentsCoprocessor>;
+    loggers?: Parameters<typeof moduleLogger>[0];
+}
+/**
+ * Operator top-up of the filler's Hyperbridge BRIDGE balance. Places an IntentGateway order
+ * from any running chain that sells USDC/USDT for BRIDGE filled on BSC, with an output call
+ * that sends the BRIDGE to the filler's Hyperbridge account through the HyperFungibleToken.
+ *
+ * One top-up is open at a time. Its record, order and session key are persisted, so a
+ * restart resumes tracking it, and an order that goes unfilled can be reclaimed.
+ */
+declare class BridgeTopUp {
+    private readonly deps;
+    private readonly logger;
+    private readonly gateways;
+    private dispatcher;
+    private hyperbridgeChain;
+    private record;
+    private loaded;
+    /** Serializes state writes so a later stage never lands before an earlier one. */
+    private writes;
+    private deliverySync;
+    private bscClient;
+    private syncing;
+    /**
+     * The top-up this process is driving, if any. Keyed by id: a finished top-up can still be
+     * reading its last statuses when the operator starts the next one, which must not wait.
+     */
+    private driving;
+    constructor(deps: BridgeTopUpDeps);
+    get bridgeToken(): HexString;
+    /** Loads the stored top-up and resumes driving it when it was left open. Never rejects. */
+    restore(): Promise<void>;
+    current(): Promise<BridgeTopUpState | undefined>;
+    /** Networks the filler runs and has delegated its account on. */
+    private sourceChains;
+    /** USDC and USDT wallet balances on every network a top-up can be paid from. */
+    sources(): Promise<BridgeTopUpSource[]>;
+    quote(params: BridgeTopUpQuoteParams): Promise<BridgeTopUpQuote>;
+    /** Re-quotes, then places and drives the order in the background. Returns its state. */
+    start(params: BridgeTopUpQuoteParams): Promise<BridgeTopUpState>;
+    /** Cancels an unfilled order and refunds its escrowed input to the filler wallet. */
+    reclaim(): Promise<BridgeTopUpState>;
+    /**
+     * Places the order, then tracks it. The SDK builds the `placeOrder` calldata and the
+     * session key; the receipt is read back here, through the filler's own multi-endpoint
+     * client, rather than by the SDK from one endpoint, where a node that has not caught up
+     * with the new block fails the read and loses track of an order that did land.
+     */
+    private place;
+    /**
+     * Reads the placement receipt and stores the order as the gateway committed it. Throws
+     * when the transaction placed no order, so the top-up is marked failed.
+     */
+    private recordPlacement;
+    /** Continues an order whose placement landed but was not recorded. */
+    private recoverPlacement;
+    private resumeDelivery;
+    private resumeOrder;
+    /** Follows a placed order through bids to a fill, or to its deadline. */
+    private trackOrder;
+    /**
+     * Carries the bought BRIDGE to Hyperbridge. The order's output call dispatched it from
+     * BSC with no relayer fee. Relayers may still deliver it; when none has shortly after BSC
+     * is final on Hyperbridge, the filler relays it itself: a request into Hyperbridge goes
+     * in as an unsigned extrinsic and costs nothing. Runs until the request is delivered.
+     */
+    private deliver;
+    /** Delivered, but the indexer has yet to record the delivery, and not for too long. */
+    private needsStatusBackfill;
+    /**
+     * Reads where the order and its BRIDGE are, from the indexer and the chains, and records
+     * it. Shared by the driver and {@link sync}, and never runs twice at once. True once the
+     * BRIDGE has reached Hyperbridge.
+     */
+    private syncDelivery;
+    private readDelivery;
+    /**
+     * The HyperFungibleToken request the fill dispatched to Hyperbridge. The indexer finds it by
+     * the fill's transaction, as the explorer's search does; the fill's own `Sent` log is the
+     * fallback while the indexer catches up.
+     */
+    private deliveryRequest;
+    /**
+     * BSC, read through every endpoint there is: the filler need not run it, and a single public
+     * endpoint refuses receipts it considers old.
+     */
+    private bsc;
+    /**
+     * The transaction that filled the order. The executor reports it only for a fill this
+     * process selected, so it comes from the indexer, or, while the indexer has yet to reach
+     * BSC's latest blocks, from the gateway's `OrderFilled` log around when the fill was seen.
+     */
+    private findFill;
+    /** The order's statuses as the indexer has them: placed, filled, redeemed or refunded. */
+    private indexedOrder;
+    /**
+     * Brings a pending top-up up to date from the chains and the indexer, for a dashboard that
+     * is showing it: someone may have filled, delivered or refunded it while this process was
+     * not looking. One sync at a time; a call made while one runs waits for that one.
+     */
+    sync(): Promise<void>;
+    private reconcile;
+    /**
+     * Submits the request to Hyperbridge with a proof from BSC state. Public BSC endpoints
+     * differ in whether they serve `eth_getProof` for recent blocks, so each is tried in turn.
+     */
+    private selfRelay;
+    /** The operator's BSC endpoints first, then the free public ones. */
+    private bscProofRpcUrls;
+    /** Records an executor update. True when the order reached a final state. */
+    private applyExecutionUpdate;
+    /**
+     * Recovers an unfilled order's escrow, following the Hyperbridge app's recovery: the SDK
+     * cancel flow from the paying chain (BSC's expiry height finalized, the cancel sent, the
+     * cancellation finalized on the source, verified and finalized on Hyperbridge), then the
+     * refund. A relayer normally delivers that refund; if none has within a few minutes of
+     * Hyperbridge finalizing, the filler submits Hyperbridge's response itself. Each step is
+     * recorded as it lands, and a restart resumes from the SDK's persisted progress.
+     */
+    private driveReclaim;
+    /**
+     * Submits Hyperbridge's finalized response to the source chain's ISMP handler, which
+     * refunds the escrow, as the Hyperbridge app's "Claim funds" does.
+     */
+    private claimRefund;
+    /**
+     * Whether the escrow is back with the filler, from the source gateway or the indexer's
+     * REFUNDED status; records the refund as the recovery's last step when it is.
+     */
+    private refunded;
+    private hasRecoveryStep;
+    /** Records a recovery step once, at the time it landed (or now). */
+    private recordRecoveryStep;
+    /** Runs one background flow for the record; a failure is recorded rather than thrown. */
+    private drive;
+    /** Keeps what the executor reported, for the timeline's offers and its links. */
+    private recordEvent;
+    private update;
+    private persist;
+    private buildOrder;
+    /**
+     * Approvals for the gateway to pull the input and the order fee, then `placeOrder`.
+     * The fee token is often the input token itself; one approval then covers both.
+     */
+    private placementCalls;
+    private payToken;
+    private walletBalance;
+    /** What the paymaster pulls for gas on the sponsored path, which a top-up must leave. */
+    private reserve;
+    /** Spendable wallet balance: the paymaster's gas reserve is held back. */
+    private balanceOf;
+    private feeToken;
+    /** The CallDispatcher the BSC gateway runs output calls through, read from the gateway itself. */
+    private callDispatcher;
+    private blockTimeSeconds;
+    private evmChain;
+    private gateway;
+    private hyperbridge;
+    /** Tracks requests from BSC into Hyperbridge, the route the bought BRIDGE takes. */
+    private ismpClient;
+    /** Tracks the reclaim's cancellation, which runs between the paying chain and BSC. */
+    private cancelClient;
+}
+
+/**
+ * The persistence contract for a running filler.
+ *
+ * Everything simplex must remember across a restart lives behind these four
+ * stores: submitted bids (so deposits can be reclaimed), the order-activity
+ * feed, the operator's limit orders, and a scrap of operator state. Nothing
+ * else in the filler touches a database, a file, or a data directory.
+ *
+ * Every method is async. The bundled SQLite adapter is synchronous underneath
+ * and simply returns resolved promises — the async signature exists so a
+ * consumer can back these with Postgres, Redis, or a hosted API. Making the
+ * interface synchronous would have limited "bring your own backend" to backends
+ * that are local and synchronous, which is nearly the same as not having the
+ * interface at all.
+ */
+interface SimplexDataStore {
+    bids: BidStore;
+    activity: ActivityStore;
+    state: StateStore;
+    limitOrders: LimitOrderStore;
+    inventory: InventoryStore;
+    /** Directory the store keeps its files in; absent for an in-memory store. */
+    readonly dataDir?: string;
+    /** Releases any underlying handles. Called by `Simplex.stop()`. */
+    close?(): Promise<void>;
+}
+/** A bid submitted to Hyperbridge's solver-selection pallet. */
+interface StoredBid {
+    id: number;
+    commitment: string;
+    /** The identifier Hyperbridge files the bid under; see {@link BidInsert.bid}. */
+    bid: string | null;
+    extrinsicHash: string | null;
+    blockHash: string | null;
+    success: boolean;
+    /**
+     * The submission timed out with the extrinsic still in Hyperbridge's pool. It
+     * may yet land and reserve a deposit, so the sweep treats it as reclaimable
+     * even though `success` is false.
+     */
+    pending: boolean;
+    error: string | null;
+    /** SQLite-style "YYYY-MM-DD HH:MM:SS" in UTC. Sorts lexicographically. */
+    createdAt: string;
+    retracted: boolean;
+    retractedAt: string | null;
+    retractExtrinsicHash: string | null;
+    /** The order was seen filled on-chain, so this bid can never win — reclaim its deposit now. */
+    dead: boolean;
+    /**
+     * What this bid holds against the operator's limit orders, at 1e18, in the
+     * order the payout draws on them. Empty for a bid placed before limit orders
+     * priced anything, and empty again once the hold has been settled, whether it
+     * was released because the bid lost or converted because the bid filled.
+     *
+     * More than one when a swap drew on several levels: the orderbook quotes a
+     * same-chain swapper across every level that can fill the trade together, so a
+     * bid may be meeting several of the operator's own orders at once.
+     */
+    reservations: LimitOrderHold[];
+}
+/** One limit order and what a bid holds against it, at 1e18. */
+interface LimitOrderHold {
+    limitOrderId: string;
+    amount: string;
+    /**
+     * The take the bid signed beside `amount`, in the input token's raw units. With it, settlement
+     * works out what the gateway charged: the escrow it released at `amount / take`. Holds recorded
+     * before bids carried their own rate have none.
+     */
+    take?: string;
+    /**
+     * The input token's decimals on the order's source chain, which is where `take` and the escrow
+     * a fill releases are counted. With it, settlement records what a fill took in at 1e18. Holds
+     * recorded before fills kept their input have none.
+     */
+    takeDecimals?: number;
+}
+interface BidInsert {
+    commitment: string;
+    /**
+     * The identifier Hyperbridge files the bid under, `keccak256` of its calldata. Bids on one
+     * incoming order share a commitment, and this is what tells them apart. It is also what
+     * retracting the bid names, so it is recorded here at placement rather than looked up later:
+     * a bid still in Hyperbridge's pool is not in its storage yet, but its retraction, sent after it
+     * from the same account, lands after it and reclaims its deposit all the same.
+     */
+    bid?: string;
+    /** What this bid holds against the limit orders that priced it, best first. */
+    reservations?: LimitOrderHold[];
+    extrinsicHash?: string;
+    blockHash?: string;
+    success: boolean;
+    /** Submission is still in the pool; see {@link StoredBid.pending}. */
+    pending?: boolean;
+    error?: string;
+}
+interface BidStats {
+    total: number;
+    successful: number;
+    failed: number;
+    retracted: number;
+    /** Deposits still locked: successful or pending, and not yet retracted. */
+    pendingRetraction: number;
+}
+/**
+ * Persistent record of every bid submitted to Hyperbridge.
+ *
+ * This is the money-critical store: a successful bid locks a deposit that is
+ * only reclaimable by retracting it, and the retraction sweep finds what to
+ * reclaim by querying here. An implementation that loses writes leaks deposits,
+ * so `store` must be durable before it resolves — do not buffer it in memory
+ * and flush later.
+ */
+interface BidStore {
+    store(bid: BidInsert): Promise<void>;
+    /** The most recent bid for a commitment, or null. */
+    byCommitment(commitment: string): Promise<StoredBid | null>;
+    /** Every bid for any of `commitments`, newest first. Empty input resolves empty. */
+    byCommitments(commitments: string[]): Promise<StoredBid[]>;
+    /** Unretracted bids whose deposit may still be locked: confirmed or pooled. */
+    unretractedReclaimable(): Promise<StoredBid[]>;
+    /**
+     * Bids due for retraction: successful *or still pending*, unretracted, and
+     * either older than `maxAgeMs` or flagged dead. Pending counts because a
+     * pooled extrinsic that later lands reserves a deposit exactly like a
+     * confirmed one. Dead bids ignore the age cut — their deposit is
+     * reclaimable immediately, so a failed attempt retries on the next sweep
+     * rather than waiting out the TTL.
+     */
+    expiredUnretracted(maxAgeMs: number): Promise<StoredBid[]>;
+    /**
+     * Marks a bid retracted. Also called when the chain reports `BidNotFound`:
+     * bids only leave the pallet by retraction, so "no bid" means there is
+     * nothing left to reclaim and no hash is available.
+     *
+     * Resolves false when no unretracted bid matched (already retracted, or never
+     * stored) — the caller treats that as success, not an error.
+     */
+    markRetracted(commitment: string, retractExtrinsicHash: string | null): Promise<boolean>;
+    /** Flags a bid dead (its order was filled on-chain). False when nothing matched. */
+    markDead(commitment: string): Promise<boolean>;
+    /**
+     * Takes what this bid holds, exactly once, and returns it.
+     *
+     * A losing bid gives its holds back and a winning one converts them into
+     * draw-downs, and both routes end at the same bid row — a bid that won is still
+     * retracted eventually, by the stale sweep, so an unguarded release would undo
+     * a conversion that already happened. Whichever settles first claims them here;
+     * the other gets an empty list and does nothing.
+     */
+    /**
+     * Takes the holds off a bid, exactly once, and hands them to the caller.
+     *
+     * With a `bid` it claims that one bid; without, every outstanding hold on the
+     * commitment, which is what a filled or dead order needs so no bid's hold is
+     * left behind.
+     */
+    claimReservation(commitment: string, bid?: string): Promise<LimitOrderHold[]>;
+    /**
+     * Every bid that drew on a limit order, newest first. What makes a `remaining`
+     * explicable to the operator: which bids took the difference.
+     */
+    byLimitOrder(limitOrderId: string, limit?: number): Promise<StoredBid[]>;
+    /** Newest first. Implementations should cap `limit` at a few hundred. */
+    recent(limit?: number): Promise<StoredBid[]>;
+    /** Failed bids, newest first — for debugging. */
+    failed(limit?: number): Promise<StoredBid[]>;
+    byDateRange(from: Date, to: Date): Promise<StoredBid[]>;
+    stats(): Promise<BidStats>;
+}
+/**
+ * `bid`: this filler's bid for the order was accepted by Hyperbridge (txHash is
+ * the extrinsic hash). `filled`: this filler filled the order on chain. `lost`:
+ * another filler did (reason carries its address). `executed`: a direct fill
+ * attempt or a failed bid.
+ */
+type ActivityType = "detected" | "bid" | "filled" | "lost" | "executed" | "skipped" | "rebalance";
+/** One leg of an order as the activity feed records it. */
+interface OrderLeg {
+    /** 20-byte token address; the zero address is the chain's native asset. */
+    token: string;
+    /** Raw on-chain amount as a decimal string (bigint-safe). */
+    amount: string;
+    /** Registry symbol when the token is known to this filler, else null. */
+    symbol: string | null;
+    /** ERC-20 decimals when they could be read, else null (the UI then shows the raw amount). */
+    decimals: number | null;
+}
+/**
+ * What the activity feed knows about an order, captured when it was detected
+ * and attached to every later event for that order so each row stands alone.
+ */
+interface OrderSummary {
+    user: string;
+    /** Source chain state machine id, e.g. "EVM-8453". */
+    source: string;
+    destination: string;
+    /** Hash of the transaction that placed the order on the source chain. */
+    placedTxHash: string | null;
+    /** 20-byte referrer from the order's graffiti tag; null when unattributed. */
+    referrer: string | null;
+    inputs: OrderLeg[];
+    outputs: OrderLeg[];
+    /** Order deadline (block number) as a decimal string. */
+    deadline: string;
+}
+interface ActivityEvent {
+    id: number;
+    ts: number;
+    type: ActivityType;
+    orderId: string | null;
+    chainId: number | null;
+    strategy: string | null;
+    success: boolean | null;
+    /** Skip reason or execution error. */
+    reason: string | null;
+    volumeUsd: number | null;
+    profitUsd: number | null;
+    txHash: string | null;
+    /** The order this event concerns, when known; null for rebalances and legacy rows. */
+    order: OrderSummary | null;
+}
+type ActivityInsert = Partial<Omit<ActivityEvent, "id" | "ts" | "type">> & {
+    type: ActivityType;
+};
+type WalletTxKind = "send" | "sweep" | "redeem";
+/** One outbound transaction from the filler wallet (operator send, vault sweep/redeem). */
+interface WalletTx {
+    id: number;
+    ts: number;
+    kind: WalletTxKind;
+    chainId: number | null;
+    /** What left the wallet: symbol and decimal amount (sends, sweeps, redeems). */
+    token: string | null;
+    amount: string | null;
+    to: string | null;
+    txHash: string;
+    sponsored: boolean | null;
+    /** What came back: vault shares for a sweep, the underlying for a redeem. */
+    tokenIn?: string | null;
+    amountIn?: string | null;
+}
+/**
+ * Append-only feed of what the filler did, backing the operator dashboard.
+ *
+ * Unlike {@link BidStore} this is observability, not correctness: dropping a
+ * row costs a line in the activity view and nothing else, so an implementation
+ * may prune, sample, or cap history freely.
+ */
+interface ActivityStore {
+    /** Appends an event and resolves the stored row (its `id` and `ts` assigned). */
+    record(event: ActivityInsert): Promise<ActivityEvent>;
+    /** Newest first; pass `beforeId` to page backwards. */
+    recent(limit?: number, beforeId?: number): Promise<ActivityEvent[]>;
+    /** Fill events carrying both a tx hash and a chain, newest first. */
+    fills(limit?: number): Promise<ActivityEvent[]>;
+    recordWalletTx(tx: Omit<WalletTx, "id" | "ts">): Promise<void>;
+    walletTxs(limit?: number): Promise<WalletTx[]>;
+    /** Sweep and redeem rows recorded without amounts (before the ledger carried them). Newest first. */
+    walletTxsWithoutAmounts(limit?: number): Promise<WalletTx[]>;
+    /** Fills in the amount fields of one ledger row. */
+    updateWalletTx(id: number, patch: Pick<WalletTx, "token" | "amount" | "to" | "tokenIn" | "amountIn">): Promise<void>;
+    /**
+     * Distinct order ids among the newest rows that carry no order summary —
+     * rows written before summaries existed. Newest first, at most `limit`.
+     */
+    orderIdsMissingSummary(limit?: number): Promise<string[]>;
+    /** Sets the summary on every row for `orderId` that lacks one; resolves the rows it changed. */
+    attachOrder(orderId: string, order: OrderSummary): Promise<ActivityEvent[]>;
+    /**
+     * Orders (rows sharing an order id) newest-activity first, one page at a
+     * time. `page` is 1-based; `total` counts every distinct order.
+     */
+    orderHistory(page: number, pageSize: number): Promise<OrderHistoryPage>;
+    /** Whether any row exists for `orderId` — i.e. this filler has seen the order. */
+    knowsOrder(orderId: string): Promise<boolean>;
+    /**
+     * Orders this filler bid on that have no on-chain outcome recorded yet: a
+     * `bid` row, or a legacy bid-time `filled` row (those carry `volumeUsd`), and
+     * neither a `lost` row nor an observed `filled` row (no `volumeUsd`). Newest first.
+     */
+    unsettledOrders(limit?: number): Promise<string[]>;
+    /** Retypes an order's legacy bid-time `filled` rows to `bid`; resolves the rows it changed. */
+    retypeLegacyBid(orderId: string): Promise<ActivityEvent[]>;
+}
+/** One order's rows, newest first. */
+interface OrderHistoryEntry {
+    orderId: string;
+    events: ActivityEvent[];
+}
+interface OrderHistoryPage {
+    page: number;
+    pageSize: number;
+    total: number;
+    orders: OrderHistoryEntry[];
+}
+/** Which way round a limit order trades its book's pair. */
+type LimitOrderSide = "BID" | "ASK";
+/**
+ * `open`: live, and bids may draw on it. `resizing`: a repost is in flight after
+ * a fill, so the orderbook entry may be missing until it lands. `filled`: worked
+ * down past the dust floor. `cancelled`: withdrawn by the operator. `expired`:
+ * past the operator's own `expiresAt` and swept off the book. `rejected`: the
+ * orderbook refused it and `lastError` says why.
+ */
+type LimitOrderStatus = "open" | "resizing" | "filled" | "cancelled" | "expired" | "rejected";
+/**
+ * One of the operator's limit orders.
+ *
+ * This record is what simplex prices against and draws down; the orderbook entry
+ * is a derived copy that expires and is reposted. Amounts and prices are decimal
+ * strings at 1e18, the unit the orderbook takes and returns, whatever decimals
+ * the tokens use on their own chains.
+ */
+interface LimitOrder {
+    /** Stable across every repost, unlike `commitment`. */
+    id: string;
+    /** Orderbook book id, with the symbols it resolved to. */
+    book: string;
+    base: string;
+    quote: string;
+    side: LimitOrderSide;
+    /** Where simplex fills, as a state machine id. */
+    fillChain: string;
+    /** Quote per 1 base: the rate simplex signs, before the orderbook's fee haircut. */
+    price: string;
+    /** The output simplex offered to pay when the order was created. */
+    size: string;
+    /** Output not yet delivered. */
+    remaining: string;
+    /** Output promised to bids that have neither filled nor been retracted. */
+    reserved: string;
+    /** Source chains this order accepts swaps from. Never empty. */
+    acceptedSources: string[];
+    /** TTL written into each posting. */
+    ttlSecs: number;
+    /** Operator expiry for the limit order itself, independent of the posting's. */
+    expiresAt: string | null;
+    status: LimitOrderStatus;
+    /** The current posting's commitment, absent while nothing is live. */
+    commitment: string | null;
+    /** Bumped on every repost, so each posting hashes differently. */
+    orderNonce: string;
+    /**
+     * The EntryPoint the current posting's op was signed for. Null while nothing is
+     * posted, and on a posting stored before this was recorded, which was signed
+     * for v0.8.
+     */
+    entryPoint: string | null;
+    /** When the current posting expires, as the orderbook reported it. */
+    bookExpiresAt: string | null;
+    /** `Order.price` from the orderbook, which shades `price` by the protocol fee. */
+    bookPrice: string | null;
+    /** The last rejection, as "CODE: message". */
+    lastError: string | null;
+    /** SQLite-style "YYYY-MM-DD HH:MM:SS" in UTC. Sorts lexicographically. */
+    createdAt: string;
+    updatedAt: string;
+}
+/** What the operator supplies; everything else is derived or defaulted. */
+interface LimitOrderInsert {
+    id: string;
+    book: string;
+    base: string;
+    quote: string;
+    side: LimitOrderSide;
+    fillChain: string;
+    price: string;
+    size: string;
+    acceptedSources: string[];
+    ttlSecs: number;
+    expiresAt?: string | null;
+    /** Where the order's posted-op nonce starts. Defaults to "0". */
+    orderNonce?: string;
+}
+interface LimitOrderFilter {
+    status?: LimitOrderStatus;
+    fillChain?: string;
+    book?: string;
+}
+/** The fields a posting writes back, applied together so a half-posted row is never visible. */
+interface LimitOrderPosting {
+    commitment: string | null;
+    bookExpiresAt: string | null;
+    bookPrice: string | null;
+    orderNonce: string;
+    entryPoint: string | null;
+    status: LimitOrderStatus;
+    lastError: string | null;
+}
+/**
+ * Persistent record of the operator's limit orders.
+ *
+ * This is inventory, not a cache: `remaining` and `reserved` are what stop two
+ * chains from paying out the same liability twice, so a store that loses writes
+ * overcommits real money.
+ */
+/**
+ * One fill that drew a limit order down: kept apart from the bid that priced it, whose
+ * holds are cleared on settlement, so an order keeps its history across every resize.
+ */
+interface LimitOrderFill {
+    id: number;
+    limitOrderId: string;
+    /** The swap order the fill settled. */
+    commitment: string;
+    /** The identifier Hyperbridge filed the executed bid under, when known. */
+    bid: string | null;
+    /** What the fill drew the limit order down by, at 1e18 in the token it pays. */
+    amount: string;
+    /**
+     * The escrow the fill released to the solver, at 1e18 in the token the order takes in. Null
+     * for a fill recorded before this was kept, and for one whose event carried no inputs.
+     */
+    amountIn: string | null;
+    /** The fill's transaction on the order's fill chain, when the event carried it. */
+    transactionHash: string | null;
+    /** SQLite-style "YYYY-MM-DD HH:MM:SS" in UTC. */
+    filledAt: string;
+}
+interface LimitOrderFillInsert {
+    limitOrderId: string;
+    commitment: string;
+    bid?: string | null;
+    amount: string;
+    amountIn?: string | null;
+    transactionHash?: string | null;
+}
+/**
+ * A fill with the terms of the order it drew on: what profitability is worked out from. The
+ * order's `price` stands in for the rate of a fill that kept no `amountIn`.
+ */
+interface LimitOrderFillRecord {
+    id: number;
+    limitOrderId: string;
+    book: string;
+    base: string;
+    quote: string;
+    side: LimitOrderSide;
+    price: string;
+    amount: string;
+    amountIn: string | null;
+    filledAt: string;
+}
+interface LimitOrderStore {
+    create(order: LimitOrderInsert): Promise<LimitOrder>;
+    get(id: string): Promise<LimitOrder | null>;
+    list(filter?: LimitOrderFilter): Promise<LimitOrder[]>;
+    /** Every `open` order, which is what the matcher prices against. */
+    open(): Promise<LimitOrder[]>;
+    /**
+     * Records what the orderbook did with the current posting.
+     *
+     * `only` guards the write on the status the row still holds, and answers null
+     * when it has moved on. A posting is a slow round trip, and an operator's
+     * cancel or an expiry sweep that lands first must not be undone by an answer
+     * that was already in flight.
+     */
+    setPosting(id: string, posting: LimitOrderPosting, only?: readonly LimitOrderStatus[]): Promise<LimitOrder | null>;
+    setStatus(id: string, status: LimitOrderStatus, lastError?: string | null, only?: readonly LimitOrderStatus[]): Promise<LimitOrder | null>;
+    /**
+     * Adds `amount` to `reserved`, but only while the order is `open` and
+     * `remaining` covers this one hold. Resolves false when it does not.
+     *
+     * Other bids' holds do not count against it: a pending bid must not stop the
+     * next one going out, so the limit order bounds each bid and what fills draw
+     * down, not the sum of bids still waiting. The hold is bookkeeping, turned into
+     * a draw-down if the bid wins and given back if it loses. The write is still
+     * guarded on the `reserved` it read, so two holds landing together both count.
+     */
+    reserve(id: string, amount: string): Promise<boolean>;
+    /** Gives a reservation back, after a bid was retracted, lost or found dead. */
+    release(id: string, amount: string): Promise<void>;
+    /**
+     * Works the order down by output that has actually been delivered, floored at
+     * zero. Returns the order as it now stands, or null when there is none.
+     */
+    drawDown(id: string, amount: string): Promise<LimitOrder | null>;
+    /**
+     * Lowers an `open` order's `remaining` to `room + reserved`, where `room` is
+     * what the solver's account on chain will still pay for this order, at 1e18.
+     * Never raises it. Returns the order when it was lowered, null otherwise.
+     *
+     * `reserved` is added back because a fill the chain has already counted, but
+     * that has not been drawn down here yet, still holds its amount there until it
+     * settles. Clamping to `room` alone would take that fill off twice.
+     */
+    clampRemaining(id: string, room: string): Promise<LimitOrder | null>;
+    /** Records a fill against its limit order. Called alongside the draw-down it explains. */
+    recordFill(fill: LimitOrderFillInsert): Promise<void>;
+    /** Every fill of every limit order, oldest first, each with its order's terms. */
+    fillHistory(): Promise<LimitOrderFillRecord[]>;
+    /** A limit order's fills, newest first. */
+    fills(limitOrderId: string, limit?: number): Promise<LimitOrderFill[]>;
+    /**
+     * Runs `settle` as one unit where the backend can.
+     *
+     * A fill claims what its bid held, works the orders down by what went out and
+     * gives the rest back, and a crash between those leaves the hold released
+     * against an order that was never drawn down. The bid rows live in the same
+     * database as the limit orders, which is what lets one transaction cover both.
+     *
+     * Only store calls belong inside: they are synchronous underneath, so nothing
+     * else interleaves on the connection, which would not hold for a network call.
+     */
+    transaction<T>(settle: () => Promise<T>): Promise<T>;
+}
+/** Operator state that must survive a restart. */
+interface RuntimeState {
+    /** A pause set by the operator stays set across restarts. */
+    paused?: boolean;
+    /** Notification rules, browser subscriptions, and the per-installation VAPID identity. */
+    notifications?: NotificationRuntimeState;
+    /** The latest BRIDGE top-up, kept so an open order is resumed or reclaimed after a restart. */
+    bridgeTopUp?: StoredBridgeTopUp;
+}
+interface StoredBridgeTopUp {
+    id: string;
+    /** Source state machine id the order was placed on. */
+    chain: string;
+    token: TopUpPayToken;
+    amountIn: string;
+    bridgeOut: string;
+    stage: BridgeTopUpStage;
+    createdAt: number;
+    updatedAt: number;
+    /** The order as placed, bigints encoded by `serializeOrder`. */
+    order: string;
+    /** Signs the order's bid selection; it authorizes nothing beyond this order. */
+    sessionPrivateKey?: HexString;
+    commitment?: HexString;
+    placeTxHash?: HexString;
+    fillTxHash?: HexString;
+    reclaimTxHash?: HexString;
+    /** The HyperFungibleToken request that carries the BRIDGE to Hyperbridge. */
+    deliveryCommitment?: HexString;
+    /** The Hyperbridge extrinsic that delivered it, when this filler relayed it. */
+    deliveryTxHash?: HexString;
+    /** Bids seen for the order. */
+    bidCount?: number;
+    /** When each stage was entered, in ms. */
+    stageTimes?: Partial<Record<BridgeTopUpStage, number>>;
+    /** What the order's executor reported, oldest first: bids, the selection and the fill. */
+    events?: TopUpExecutionEvent[];
+    /** The solver that filled the order, from the executor or the indexer. */
+    filler?: HexString;
+    /** The BRIDGE request's progress from BSC into Hyperbridge, from the indexer. */
+    deliveryStatuses?: DeliveryStatus[];
+    /** The unfilled order's recovery, step by step, as the SDK's cancel flow reported it. */
+    recoverySteps?: RecoveryStepRecord[];
+    /** Hyperbridge's finalized response, which refunds the escrow when submitted on the source. */
+    claimCalldata?: HexString;
+    /** The filler's own refund claim, when no relayer delivered it in time. */
+    claimTxHash?: HexString;
+    error?: string;
+}
+interface RecoveryStepRecord {
+    step: "DESTINATION_FINALIZED" | "ORDER_CANCELED" | "SOURCE_FINALIZED" | "HYPERBRIDGE_DELIVERED" | "HYPERBRIDGE_FINALIZED" | "FUNDS_CLAIMED";
+    /** When the step completed, in ms. */
+    timestamp: number;
+    txHash?: HexString;
+}
+interface DeliveryStatus {
+    /** Dispatched on BSC, BSC final on Hyperbridge, delivered to Hyperbridge. */
+    status: "SOURCE" | "SOURCE_FINALIZED" | "DESTINATION";
+    /** In ms. */
+    timestamp: number;
+    txHash: HexString;
+}
+interface TopUpBidPreview {
+    solverAddress: HexString;
+    /** Output budgets as raw token units, the token as bytes32. */
+    outputs: {
+        token: HexString;
+        amount: string;
+    }[];
+}
+interface TopUpExecutionEvent {
+    status: "NEW_BID" | "BIDS_RECEIVED" | "BID_SELECTED" | "FILLED";
+    /** When the filler saw it, in ms. */
+    timestamp: number;
+    bidCount?: number;
+    bids?: TopUpBidPreview[];
+    selectedSolver?: HexString;
+    userOpHash?: HexString;
+    txHash?: HexString;
+}
+interface NotificationSettings {
+    /** Alert once when aggregate spendable USD-stable liquidity crosses below this value. */
+    lowLiquidityThresholdUsd: number | null;
+    /** Alert after this filler completes a swap. */
+    swaps: boolean;
+}
+/** Transport-safe alert payload shared by Web Push and the native desktop shell. */
+interface OperatorNotification {
+    title: string;
+    body: string;
+    tag: string;
+    /** Relative dashboard destination to open when the operator clicks the alert. */
+    url: string;
+    /** Opaque, short-lived receipt used only to confirm native desktop test delivery. */
+    receiptId?: string;
+}
+interface StoredPushSubscription {
+    endpoint: string;
+    expirationTime?: number | null;
+    keys: {
+        p256dh: string;
+        auth: string;
+    };
+}
+interface NotificationRuntimeState {
+    settings: NotificationSettings;
+    vapid: {
+        publicKey: string;
+        privateKey: string;
+    };
+    subscriptions: StoredPushSubscription[];
+    /** Prevents restart/poll spam while liquidity remains below the configured threshold. */
+    lowLiquidityActive?: boolean;
+}
+interface StateStore {
+    get(): Promise<RuntimeState>;
+    /** Replaces the whole record. Keys absent from `state` are dropped. */
+    set(state: RuntimeState): Promise<void>;
+    /**
+     * Merges `patch` into the stored record atomically, leaving keys it does not
+     * name untouched. Optional: `patchRuntimeState` falls back to a read and a
+     * `set` for stores that cannot do better, which loses a key written
+     * concurrently. The bundled SQLite store implements it.
+     */
+    patch?(patch: Partial<RuntimeState>): Promise<RuntimeState>;
+}
+/**
+ * What the solver held at one moment: whole tokens per symbol, counting the wallet and the
+ * vaults on every chain.
+ */
+interface InventorySnapshot {
+    id: number;
+    /** SQLite-style "YYYY-MM-DD HH:MM:SS" in UTC. */
+    takenAt: string;
+    balances: Record<string, number>;
+}
+/**
+ * A record of what the solver held, taken about once a day.
+ *
+ * It is what profit is measured against: the inventory a period began with. The chain can say
+ * what an account holds now but not what it held last week, so a snapshot that was never taken
+ * cannot be recovered. Like {@link ActivityStore} it is observability rather than correctness:
+ * a lost row costs a figure on the analytics page and nothing else.
+ */
+interface InventoryStore {
+    record(balances: Record<string, number>): Promise<void>;
+    /** The most recent snapshot, or null when none has been taken. */
+    latest(): Promise<InventorySnapshot | null>;
+    /** Every snapshot taken at or after `from`, oldest first. */
+    since(from: Date): Promise<InventorySnapshot[]>;
+}
+
+export { type LimitOrderPosting as $, type ActivityStore as A, type BidStore as B, ChainClientManager as C, type DerivingSigner as D, type AuthorizationRequest as E, FillerConfigService as F, type BidInsert as G, type BinanceConfig as H, type InventoryStore as I, type CurveConfig as J, type CurvePoint as K, LoggerContext as L, type MpcVaultSignerConfig as M, type Eip7702Authorization$1 as N, type OrderHistoryPage as O, type FillerConfigFile as P, type InventorySnapshot as Q, type ResolvedChainConfig as R, type SignerConfig as S, type TurnkeySignerConfig as T, UserOpSender as U, type VaultToml as V, type WalletTx as W, type LimitOrderFillInsert as X, type LimitOrderFillRecord as Y, type LimitOrderHold as Z, type LimitOrderInsert as _, type Signer as a, type LimitOrderSide as a0, type LimitOrderStatus as a1, type Logger as a2, type OperatorNotification as a3, type PrivateKeySignerConfig as a4, type QueueConfig as a5, type RuntimeState as a6, type SignerTransaction as a7, SignerType as a8, type TypedDataPayload as a9, USD_STABLE_SYMBOLS as aa, type UserProvidedChainConfig as ab, type VaultTomlConfig as ac, type WalletTxKind as ad, addLogSink as ae, assertConfirmationCoverage as af, configureLogger as ag, formatChainKey as ah, getLogger as ai, isRegistrySymbol as aj, normalizeSymbol as ak, parseChainKey as al, registrySymbols as am, validateAssetDefinitions as an, validateConfig as ao, validateVaultToml as ap, type OrderSummary as aq, type Signature as b, type SecretPhraseSignerConfig as c, type ActivityInsert as d, type ActivityEvent as e, type LimitOrderStore as f, AssetRegistry as g, DelegationService as h, type LimitOrder as i, type LimitOrderFilter as j, type SimplexDataStore as k, ConfirmationPolicy as l, type FillerTomlConfig as m, TokenSender as n, BridgeTopUp as o, type AssetDefinition as p, type ChainConfirmationPolicy as q, type LimitOrderFill as r, type StoredBid as s, type RebalancingConfig as t, type LogSink as u, type BidStats as v, type AllowlistConfig as w, type LogLevel as x, type StateStore as y, type ActivityType as z };