@hyperbridge/simplex 0.17.0 → 0.18.0

package/dist/index.d.cts

@@ -1,15 +1,15 @@
-import { EventEmitter as EventEmitter$1 } from 'node:events';
-import { HexString, ERC7821Call, ChainConfig, Order, TokenInfo, IntentsCoprocessor, ExecutionResult, IntentGateway, FillOptions, FillerConfig as FillerConfig$1 } from '@hyperbridge/sdk';
-import { PublicClient, Hash, AbiEvent, BlockNumber, BlockTag, GetLogsParameters, GetLogsReturnType, WalletClient, Transport, Chain } from 'viem';
-import { LocalAccount, Account } from 'viem/accounts';
-import { L as LoggerContext, a as LogLevel, b as Logger, A as ActivityStore, c as ActivityInsert, d as ActivityEvent, O as OrderHistoryPage, W as WalletTx, e as LimitOrderStore, f as LimitOrder, g as LimitOrderFilter, B as BidStore, S as SimplexDataStore, h as LimitOrderFill, i as StoredBid, j as LogSink, k as BidStats, l as StateStore, I as InventoryStore } from './types-BPyUX8qu.cjs';
-export { m as ActivityType, n as BidInsert, o as InventorySnapshot, p as LimitOrderFillInsert, q as LimitOrderFillRecord, r as LimitOrderHold, s as LimitOrderInsert, t as LimitOrderPosting, u as LimitOrderSide, v as LimitOrderStatus, w as OperatorNotification, R as RuntimeState, x as WalletTxKind, y as addLogSink, z as configureLogger, C as getLogger } from './types-BPyUX8qu.cjs';
-import { ChannelCredentials } from '@grpc/grpc-js';
-import { EventEmitter } from 'events';
-import Decimal$1, { Decimal } from 'decimal.js';
+import { EventEmitter } from 'node:events';
+import { HexString, ERC7821Call, IntentsCoprocessor, Order, TokenInfo, ChainConfig, ExecutionResult, IntentGateway, FillOptions, FillerConfig } from '@hyperbridge/sdk';
+import { S as SignerConfig, a as Signer, b as Signature, D as DerivingSigner, c as SecretPhraseSignerConfig, M as MpcVaultSignerConfig, T as TurnkeySignerConfig, C as ChainClientManager, F as FillerConfigService, U as UserOpSender, L as LoggerContext, A as ActivityStore, d as ActivityInsert, e as ActivityEvent, O as OrderHistoryPage, W as WalletTx, f as LimitOrderStore, g as AssetRegistry, h as DelegationService, i as LimitOrder, j as LimitOrderFilter, B as BidStore, k as SimplexDataStore, l as ConfirmationPolicy, R as ResolvedChainConfig, m as FillerTomlConfig, V as VaultToml, n as TokenSender, o as BridgeTopUp, p as AssetDefinition, q as ChainConfirmationPolicy, r as LimitOrderFill, s as StoredBid, t as RebalancingConfig, u as LogSink, v as BidStats, w as AllowlistConfig, x as LogLevel, y as StateStore, I as InventoryStore } from './types-6MEltdkX.cjs';
+export { z as ActivityType, E as AuthorizationRequest, G as BidInsert, H as BinanceConfig, J as CurveConfig, K as CurvePoint, N as Eip7702Authorization, P as FillerConfigFile, Q as InventorySnapshot, X as LimitOrderFillInsert, Y as LimitOrderFillRecord, Z as LimitOrderHold, _ as LimitOrderInsert, $ as LimitOrderPosting, a0 as LimitOrderSide, a1 as LimitOrderStatus, a2 as Logger, a3 as OperatorNotification, a4 as PrivateKeySignerConfig, a5 as QueueConfig, a6 as RuntimeState, a7 as SignerTransaction, a8 as SignerType, a9 as TypedDataPayload, aa as USD_STABLE_SYMBOLS, ab as UserProvidedChainConfig, ac as VaultTomlConfig, ad as WalletTxKind, ae as addLogSink, af as assertConfirmationCoverage, ag as configureLogger, ah as formatChainKey, ai as getLogger, aj as isRegistrySymbol, ak as normalizeSymbol, al as parseChainKey, am as registrySymbols, an as validateAssetDefinitions, ao as validateConfig, ap as validateVaultToml } from './types-6MEltdkX.cjs';
+import { EventEmitter as EventEmitter$1 } from 'events';
+import { Decimal } from 'decimal.js';
 import * as _circle_fin_bridge_kit from '@circle-fin/bridge-kit';
 import { BridgeResult, EstimateResult } from '@circle-fin/bridge-kit';
+import { LocalAccount } from 'viem/accounts';
+import 'viem';
 import 'pino';
+import '@grpc/grpc-js';
 
 /**
  * A liquidity source that can atomically withdraw tokens and make them
@@ -102,626 +102,6 @@ interface VaultOutputFundingConfig {
     sweepIntervalMs?: number;
 }
 
-interface UserProvidedChainConfig {
-    /** One or more RPC URLs. When multiple are provided, event scans use quorum consensus. */
-    rpcUrls: string[];
-    bundlerUrl: string;
-}
-interface ResolvedChainConfig {
-    chainId: number;
-    /** One or more RPC URLs for this chain. When multiple are provided, event scans use quorum consensus. */
-    rpcUrls: string[];
-    bundlerUrl?: string;
-}
-interface GasFeeBumpConfig {
-    maxPriorityFeePerGasBumpPercent?: number;
-    maxFeePerGasBumpPercent?: number;
-}
-interface RebalancingConfig$1 {
-    triggerPercentage: number;
-    baseBalances: {
-        USDC?: Record<string, string>;
-        USDT?: Record<string, string>;
-    };
-}
-interface OverfillProtectionConfig {
-    /** Ceiling bps above user-requested output; filler clamps its computed output to this. Default 500 (5%). */
-    maxOverfillBps?: number;
-    /** Consecutive clamped evaluations before the strategy halts itself. Default 3. */
-    maxConsecutiveClamps?: number;
-}
-interface AllowlistConfig {
-    /** Hex addresses eligible across all chains. */
-    users?: string[];
-    /** Per-source-chain overrides, keyed by state machine id (e.g. "EVM-1"). Merged with the global list. */
-    bySource?: Record<string, string[]>;
-}
-interface FillerConfig {
-    maxConcurrentOrders: number;
-    logging?: LogLevel;
-    hyperbridgeWsUrl?: string;
-    substratePrivateKey?: string;
-    entryPointAddress?: string;
-    /**
-     * Optional gas fee bump configuration for UserOperation gas estimation.
-     * If not provided, defaults will be used (8% for priority fee, 10% for max fee).
-     */
-    gasFeeBump?: GasFeeBumpConfig;
-    rebalancing?: RebalancingConfig$1;
-    /**
-     * Target gas units the EntryPoint deposit should cover per chain.
-     * Defaults to 3,000,000 if not set.
-     */
-    targetGasUnits?: number;
-    /**
-     * Seconds a signed bid stays executable. Defaults to 300 (5 minutes).
-     * See `bidValiditySeconds` in filler-toml for why this bound matters.
-     */
-    bidValiditySeconds?: number;
-    /**
-     * Order size in USD below which `order.fees` must cover the execution cost.
-     * Defaults to 20. See `minOrderSizeUsd` in filler-toml.
-     */
-    minOrderSizeUsd?: number;
-    /**
-     * Overfill protection knobs. If omitted, defaults are used
-     * (maxOverfillBps=500, maxConsecutiveClamps=3).
-     */
-    overfillProtection?: OverfillProtectionConfig;
-    /**
-     * Restricts which order `user` addresses the filler processes. When omitted, all
-     * users are accepted. When present, only listed users (global ∪ per-source) are
-     * accepted; a chain whose merged set is empty rejects every order.
-     */
-    allowlist?: AllowlistConfig;
-    /**
-     * How often the block scanner polls each chain, in seconds. Defaults to 3.
-     * Each tick costs one `eth_blockNumber` plus one `eth_getLogs` per chain per
-     * endpoint, so raising it is the main lever for staying inside a
-     * rate-limited RPC's budget — at the cost of seeing orders that much later.
-     */
-    blockScanIntervalSeconds?: number;
-}
-/**
- * Simplified configuration service for the filler that wraps ChainConfigService
- * and only requires minimal user configuration (RPC URLs, private keys, etc.)
- */
-declare class FillerConfigService {
-    /**
-     * This filler's logging destination. Services resolve their module loggers
-     * from here rather than from the process-wide context, which is what keeps
-     * two fillers in one process from writing into each other's sinks.
-     */
-    readonly loggers: LoggerContext;
-    private chainConfigService;
-    private rpcOverrides;
-    private bundlerUrls;
-    private fillerConfig?;
-    /** Lowercased global allowlist users, or undefined when no global list is configured. */
-    private allowlistGlobal?;
-    /** Lowercased per-source allowlist users keyed by state machine id, or undefined when no per-source list is configured. */
-    private allowlistBySource?;
-    constructor(chainConfigs: ResolvedChainConfig[], fillerConfig?: FillerConfig, loggers?: LoggerContext);
-    getAllowlist(): AllowlistConfig | undefined;
-    /**
-     * Registers a chain at runtime. `getConfiguredChainIds` derives from the RPC
-     * override map, so this is what makes a chain "configured" — every address
-     * lookup already resolves through the SDK's chain registry, which knows the
-     * chain whether or not this filler was started with it.
-     *
-     * Rejects a chain that is already registered: silently replacing its
-     * endpoints would leave the event monitor scanning the old ones. Use
-     * {@link setRpcUrls} for that.
-     */
-    addChain(chain: ResolvedChainConfig): void;
-    /** Drops a chain from the configured set. */
-    removeChain(chainId: number): void;
-    /**
-     * Replaces a chain's RPC endpoints. Callers must invalidate the cached viem
-     * clients (`ChainClientManager.invalidate`) and rebuild the chain's scanner
-     * afterwards — a client bakes its transport in at construction, so this
-     * change is invisible to anything already holding one.
-     */
-    setRpcUrls(chainId: number, rpcUrls: string[]): void;
-    setBundlerUrl(chainId: number, bundlerUrl: string): void;
-    /** Replaces the rebalancing config at runtime; trigger checks read it live. */
-    setRebalancing(rebalancing: RebalancingConfig$1 | undefined): void;
-    /** Replaces the allowlist at runtime; takes effect on the next order. */
-    setAllowlist(allowlist: AllowlistConfig | undefined): void;
-    /**
-     * Whether an order from `user` on `chain` (a source state machine id, e.g. "EVM-1")
-     * may be processed. Returns true when no allowlist is configured. Otherwise the user
-     * must appear in the global list or the per-source override for that chain; an empty
-     * merged set rejects every order on that chain.
-     */
-    isUserAllowed(user: string, chain: string): boolean;
-    getChainConfig(chain: string): ChainConfig;
-    getIntentGatewayAddress(chain: string): `0x${string}`;
-    getHostAddress(chain: string): `0x${string}`;
-    getWrappedNativeAssetWithDecimals(chain: string): {
-        asset: HexString;
-        decimals: number;
-    };
-    getDaiAsset(chain: string): HexString;
-    getUsdtAsset(chain: string): HexString;
-    getUsdcAsset(chain: string): HexString;
-    getUsdcDecimals(chain: string): number;
-    getSimplexPaymasterAddress(chain: string): HexString | undefined;
-    getUsdtDecimals(chain: string): number;
-    /**
-     * Curated decimals for a token, looked up by address in the SDK's per-chain
-     * asset table. Returns `undefined` for any token not in that table.
-     *
-     * This is the safety net for `ContractInteractionService.getTokenDecimals`
-     * when the on-chain `decimals()` read fails: the registry already carries the
-     * correct value for every supported asset (verified on-chain at curation
-     * time), so a failed read has no business guessing.
-     */
-    getAssetDecimalsByAddress(chain: string, address: HexString): number | undefined;
-    getChainId(chain: string): number;
-    getConsensusStateId(chain: string): string;
-    getHyperbridgeChainId(): number;
-    getHyperbridgeRpcUrl(): string;
-    getRpcUrl(chain: string): string;
-    /**
-     * Returns every user-configured RPC URL for a chain. When multiple URLs are present,
-     * consumers (e.g. the event monitor) run queries as a quorum — every provider must
-     * return the same result for the batch to succeed.
-     */
-    getRpcUrls(chain: string): string[];
-    private getChainIdFromStateMachineId;
-    getUniswapRouterV2Address(chain: string): HexString;
-    getUniswapV2FactoryAddress(chain: string): HexString;
-    getUniversalRouterAddress(chain: string): HexString;
-    getUniswapV3QuoterAddress(chain: string): HexString;
-    getUniswapV4QuoterAddress(chain: string): HexString;
-    getUniswapV4PositionManagerAddress(chain: string): HexString;
-    getUniswapV4PoolManagerAddress(chain: string): HexString;
-    getUniswapV4StateViewAddress(chain: string): HexString;
-    getPermit2Address(chain: string): HexString;
-    getCoingeckoId(chain: string): string | undefined;
-    getCNgnAsset(chain: string): HexString | undefined;
-    getAssetBySymbol(chain: string, symbol: string): HexString | undefined;
-    getCNgnDecimals(chain: string): number | undefined;
-    getExtAsset(chain: string): HexString | undefined;
-    getExtDecimals(chain: string): number | undefined;
-    getConfiguredChainIds(): number[];
-    getLoggingConfig(): LogLevel | undefined;
-    getHyperbridgeAddress(): string;
-    getHyperbridgeWsUrl(): string | undefined;
-    getSubstratePrivateKey(): string | undefined;
-    getEntryPointAddress(chain: string): HexString | undefined;
-    getSolverAccountContractAddress(chain: string): HexString | undefined;
-    getBundlerUrl(chain: string): string | undefined;
-    /**
-     * Get the maxPriorityFeePerGas bump percentage.
-     * @returns The configured percentage or undefined if not set (default 8% will be used)
-     */
-    getMaxPriorityFeePerGasBumpPercent(): number | undefined;
-    /**
-     * Get the maxFeePerGas bump percentage.
-     * @returns The configured percentage or undefined if not set (default 10% will be used)
-     */
-    getMaxFeePerGasBumpPercent(): number | undefined;
-    /**
-     * Get the full gas fee bump configuration.
-     * @returns The gas fee bump config or undefined if not set
-     */
-    getGasFeeBumpConfig(): GasFeeBumpConfig | undefined;
-    /**
-     * Get the LayerZero Endpoint ID for the chain
-     * Used for USDT0 cross-chain transfers via LayerZero OFT
-     */
-    getLayerZeroEid(chain: string): number | undefined;
-    /**
-     * Get the USDT0 OFT contract address for the chain
-     * On Ethereum: OFT Adapter (locks/unlocks USDT)
-     * On other chains: OFT contract (mints/burns USDT0)
-     */
-    getUsdt0OftAddress(chain: string): HexString | undefined;
-    /**
-     * Get rebalancing configuration
-     */
-    getRebalancingConfig(): RebalancingConfig$1 | undefined;
-    /**
-     * Get base balance for a specific chain and asset
-     * @param chainId Chain ID as number
-     * @param asset "USDC" or "USDT"
-     * @returns Base balance as Decimal, or undefined if not configured
-     */
-    getBaseBalance(chainId: number, asset: "USDC" | "USDT"): number | undefined;
-    /**
-     * Get trigger percentage for rebalancing
-     * @returns Trigger percentage (0-1), or undefined if not configured
-     */
-    getTriggerPercentage(): number | undefined;
-    /**
-     * Get target gas units for EntryPoint deposits.
-     * Defaults to 3,000,000 if not configured.
-     */
-    getTargetGasUnits(): bigint;
-    /**
-     * How long a signed bid remains executable, in seconds. Defaults to 300 (5 minutes).
-     *
-     * A bid is a firm price the placer may take up at a moment of their choosing; this is the
-     * only thing bounding that window, since the order deadline is placer-controlled and
-     * Hyperbridge-side retraction does not reach the destination chain.
-     */
-    getBidValiditySeconds(): number;
-    /**
-     * The order size, in USD, below which `order.fees` must cover the execution cost.
-     * Defaults to 20. An order at or above it is filled whatever fees it carries.
-     */
-    getMinOrderSizeUsd(): number;
-    /** Ceiling bps above user-requested output. Default 500 (5%). */
-    getMaxOverfillBps(): bigint;
-    /** Consecutive clamped evaluations before the strategy halts. Default 3. */
-    getMaxConsecutiveClamps(): number;
-}
-
-/**
- * What one quorum call is allowed to spend.
- *
- * `deadlineMs` is the ceiling on the call itself: past it, the endpoints still
- * outstanding are treated as failures, so they stop voting and the call is
- * decided over the endpoints that answered, or fails with a QuorumError naming
- * them. Early exit decides as soon as the endpoints still out could not change
- * the outcome; the deadline decides when one of them never answers.
- *
- * `timeoutMs` bounds one endpoint's attempt, and there is only ever one: the
- * transports are built with `retryCount: 0`, so an endpoint's whole
- * contribution to a call is a single request. That is what keeps the two
- * numbers independent — a task cannot approach `deadlineMs` by retrying inside
- * itself, so a deadline that fires means something outside the budget went
- * wrong rather than an endpoint using the budget as designed.
- */
-interface QuorumBudget {
-    timeoutMs: number;
-    deadlineMs: number;
-}
-/**
- * Wraps multiple viem `PublicClient`s — one per configured RPC URL — and runs
- * selected read paths (`getLogs`, `getBlockNumber`, `getTransactionConfirmations`)
- * as a **BFT quorum**: a result is accepted only when `quorumThreshold(m)` of the
- * `m` endpoints that answered agree on it.
- *
- * A provider that *answers with divergent data* is never special-cased away — it
- * simply fails to join the agreeing group, which is what makes a lying or reorged
- * endpoint detectable rather than authoritative.
- *
- * A provider that *fails* does not vote. A failed request says nothing about the
- * chain, so it must not outvote the endpoints that agree: the threshold guards
- * against endpoints that answer wrongly, and every answer still counts. Six
- * endpoints with two failing decide over the other four, three of which must
- * agree. The price, worth stating plainly, is that a call can be decided by fewer
- * endpoints than the operator configured; at the limit, one endpoint answering
- * while the rest fail decides alone. The voters are still exclusively the
- * operator's own.
- *
- * The bench is the one state this class keeps, and {@link benchFor} decides who
- * goes on it: a request-rate limit ({@link isSuspendableRateLimit}), a response
- * that is not JSON ({@link isMalformedResponse}), or a head behind the quorum's
- * ({@link isStaleHead}). All three share the property that earns it — the
- * endpoint will keep failing the same way for a while — so a benched endpoint is
- * not asked for its window: asking would spend its quota, or hold the call open
- * for an answer already known to fail. When every endpoint is benched, all are
- * queried again; there is nobody left to prefer. Every other failure is per
- * call, and the endpoint is asked again next time.
- *
- * The constructor validates that URLs resolve to distinct hostnames so a "quorum"
- * isn't secretly the same upstream in disguise.
- */
-declare class QuorumPublicClient {
-    readonly clients: PublicClient[];
-    readonly rpcUrls: string[];
-    /**
-     * The quorum bar when every endpoint answers: `quorumThreshold(n)` over the
-     * full set. Each call's bar is `quorumThreshold` over the endpoints that answer
-     * it, so this is the most it can be.
-     */
-    readonly threshold: number;
-    private readonly logger?;
-    /**
-     * Rate-limit bench state, shared across every instance and keyed by endpoint
-     * URL. The bench describes the ENDPOINT, not the wrapper: the scanner and the
-     * confirmation poller construct separate clients over the same URLs, and a
-     * throttle one of them observed is a throttle for both. Instance state would
-     * halve the relief — and evaporate whenever `setRpcUrls` rebuilds a client.
-     */
-    private static benchedUntil;
-    /** Test hook: forgets every bench. Production never calls it. */
-    static clearAllSuspensions(): void;
-    /** What this client's calls may spend; see {@link QuorumBudget}. */
-    private readonly deadlineMs;
-    constructor(chainId: number, rpcUrls: string[], loggers?: LoggerContext, budget?: QuorumBudget);
-    get size(): number;
-    /** Endpoints currently benched, by URL. See {@link benchFor} for the reasons. */
-    suspended(): string[];
-    /**
-     * The endpoints this call queries: everyone not benched. A benched endpoint is
-     * dropped outright: it answers nothing while throttled, so asking it could only
-     * cost a request. With every endpoint benched, everyone is queried again; there
-     * is nobody left to prefer.
-     */
-    private participants;
-    /**
-     * Records a task failure against its endpoint. Only the failures
-     * {@link benchFor} names carry state: everything else stays per-call, as the
-     * class doc promises.
-     * The bench is the one silent state transition this class has, so it warns —
-     * an operator whose bar just dropped from 2-of-2 to 1-of-1 should not need a
-     * QuorumError to find out.
-     */
-    private noteFailure;
-    /**
-     * Highest block a quorum of endpoints have all indexed: the highest B such
-     * that `threshold` endpoints report head ≥ B. Returns null when fewer than
-     * `threshold` endpoints have responded.
-     */
-    private quorumHead;
-    /**
-     * Settles per-client tasks incrementally and resolves the moment the
-     * evaluator can decide from the responses seen so far — the hot path never
-     * blocks on the slowest provider (a hung endpoint with a 30s timeout × 3
-     * retries would otherwise stall every confirmation poll). Stragglers settle
-     * out of band and are ignored. `tryDecide` returns undefined to keep
-     * waiting; once every task has settled, `finalize` must decide (it throws
-     * the QuorumError when the full response set still has no quorum).
-     *
-     * Both are handed the bar: the BFT threshold over the endpoints that have not
-     * failed, answered or still out. A failure lowers it rather than counting
-     * against it. Counting the pending endpoints keeps an early decision to a bar
-     * no lower than the full response set would get, so a vote it did not wait for
-     * could never have reversed it.
-     *
-     * `deadlineMs` bounds the other direction: when the bar is NOT reachable
-     * from the fast responders, the call used to wait out every straggler, and
-     * the caller's own retry loop multiplied that into minutes of a chain not
-     * being scanned at all, silently. At the deadline the outstanding endpoints
-     * are treated as failures — named in the QuorumError, so the operator sees
-     * which ones held the call up — and `finalize` decides over the endpoints
-     * that answered.
-     */
-    private settleUntilQuorum;
-    /**
-     * Highest block head backed by a quorum of the endpoints that answer. Throws
-     * {@link QuorumError} when none do.
-     */
-    getBlockNumber(): Promise<bigint>;
-    /**
-     * Confirmation count for a transaction under the quorum.
-     *
-     * Every endpoint is asked for the receipt and its head. A "receipt not found"
-     * answer is a valid **no** vote — the endpoint is responsive but does not see
-     * the transaction (not yet propagated, or reorged out) — so it counts toward
-     * responsiveness but joins no inclusion group. The transaction is confirmed
-     * only when a quorum agrees on the same `(blockHash, blockNumber)`; the depth
-     * is then the quorum head of that agreeing group. A minority still serving a
-     * reorged/fabricated receipt can never reach the quorum.
-     *
-     * Throws {@link QuorumError} when no inclusion reaches the quorum — including
-     * the ordinary window where the tx is not yet mined on enough endpoints.
-     */
-    getTransactionConfirmations({ hash }: {
-        hash: Hash;
-    }): Promise<bigint>;
-    /**
-     * Fetches logs from every endpoint in parallel and returns the result once a
-     * quorum agrees. Fails with {@link QuorumError} otherwise.
-     *
-     * Generics mirror `PublicClient.getLogs` so caller-side inference (event decoding,
-     * strict mode, pending vs mined) is preserved end-to-end.
-     */
-    getLogs<const TAbiEvent extends AbiEvent | undefined = undefined, const TAbiEvents extends readonly AbiEvent[] | readonly unknown[] | undefined = TAbiEvent extends AbiEvent ? [TAbiEvent] : undefined, TStrict extends boolean | undefined = undefined, TFromBlock extends BlockNumber | BlockTag | undefined = undefined, TToBlock extends BlockNumber | BlockTag | undefined = undefined>(params: GetLogsParameters<TAbiEvent, TAbiEvents, TStrict, TFromBlock, TToBlock>): Promise<GetLogsReturnType<TAbiEvent, TAbiEvents, TStrict, TFromBlock, TToBlock>>;
-    /**
-     * `skipped` is the participants() snapshot for THIS call, not the suspension
-     * state at throw time — a call that rides out its deadline can outlive a
-     * bench window, and the message must explain
-     * who was excluded when the call started, not who would be excluded now.
-     */
-    private describeResponders;
-    private formatFailures;
-}
-
-/**
- * The signing contract a solver runs on, and the config shapes the bundled
- * implementations take.
- *
- * `Signer` is the whole surface: implement it and Simplex signs with your
- * backend. Nothing here is viem-shaped, so a consumer never has to match this
- * package's viem version to satisfy it — `viemSigner` adapts a viem account into
- * one, and simplex builds the account its wallet clients need from whatever it
- * is given.
- */
-
-interface MpcVaultSignerConfig {
-    apiToken: string;
-    vaultUuid: string;
-    accountAddress: HexString;
-    callbackClientSignerPublicKey: string;
-    /**
-     * gRPC target address. Defaults to "api.mpcvault.com:443".
-     * Replaces the previous REST `baseUrl` field.
-     */
-    grpcTarget?: string;
-    /**
-     * Destination for signing lifecycle logs. Defaults to the process-wide
-     * context, which an embedded filler's `SimplexOptions.logger` never sees —
-     * pass your own to capture retries and failures in that setup.
-     */
-    logger?: Logger;
-    /** Channel credentials override for tests against a plaintext server. Defaults to TLS. */
-    credentials?: ChannelCredentials;
-}
-declare enum SignerType {
-    PrivateKey = "privateKey",
-    MpcVault = "mpcVault",
-    Turnkey = "turnkey",
-    SecretPhrase = "secretPhrase"
-}
-interface TurnkeySignerConfig {
-    organizationId: string;
-    apiPublicKey: string;
-    apiPrivateKey: string;
-    signWith: string;
-}
-interface PrivateKeySignerConfig {
-    key: HexString;
-}
-interface SecretPhraseSignerConfig {
-    /** BIP-39 mnemonic from the English wordlist. */
-    phrase: string;
-    /**
-     * Which wallet under the phrase is the hot wallet: the last component of
-     * `m/44'/60'/0'/0/i`. Defaults to 0.
-     */
-    accountIndex?: number;
-}
-/**
- * The `[simplex.signer]` block of the TOML file the binary reads — a tagged
- * union over the bundled backends. `createSigner` turns one into a {@link Signer};
- * `Simplex.start` takes the `Signer`, not this.
- */
-type SignerConfig = ({
-    type: SignerType.PrivateKey;
-} & PrivateKeySignerConfig) | ({
-    type: SignerType.MpcVault;
-} & MpcVaultSignerConfig) | ({
-    type: SignerType.Turnkey;
-} & TurnkeySignerConfig) | ({
-    type: SignerType.SecretPhrase;
-} & SecretPhraseSignerConfig);
-/**
- * A secp256k1 signature in split form, which is how EIP-7702 and raw digests
- * consume it: `r` and `s` as 32-byte 0x-hex, and `yParity` strictly 0 or 1.
- * A backend that hands back the legacy `v` (27/28) should subtract 27 — the
- * delegation path rejects anything else rather than letting viem mis-encode it.
- */
-interface Signature {
-    r: HexString;
-    s: HexString;
-    yParity: number;
-}
-/**
- * An EIP-712 payload, as `eth_signTypedData_v4` defines it.
- *
- * `domain.chainId` is the only field a signing backend is likely to read for
- * itself: the digest covers it, and backends that scope a signing request to a
- * chain (MPCVault) take it from here rather than from a separate argument.
- *
- * **List `EIP712Domain` in `types` on any payload you build.** viem ignores it
- * when hashing locally, so a payload without it looks correct against a private
- * key. Backends that hash server-side from the JSON derive the domain type from
- * that entry — MPCVault and Turnkey both do — and without it they sign a
- * different digest than the one your verifier checks. The failure is quiet: the
- * signature is well-formed and recovers to an address that is not yours.
- * `CryptoUtils.packedUserOpTypedData` in the sdk sets it for this reason.
- */
-interface TypedDataPayload {
-    domain?: {
-        name?: string;
-        version?: string;
-        chainId?: number | bigint;
-        verifyingContract?: HexString;
-        salt?: HexString;
-    };
-    types: Record<string, readonly {
-        name: string;
-        type: string;
-    }[]>;
-    primaryType: string;
-    message: Record<string, unknown>;
-}
-/** EIP-7702 authorization tuple, signed, as a set-code transaction carries it. */
-interface Eip7702Authorization$1 extends Signature {
-    chainId: number;
-    address: HexString;
-    nonce: number;
-}
-/**
- * A transaction to sign, handed to backends that implement
- * {@link Signer.signTransaction}. Field names follow the JSON-RPC transaction
- * object; simplex only ever sends EIP-1559 transfers and EIP-7702 set-code
- * transactions, so those are the fields modelled here.
- */
-interface SignerTransaction {
-    chainId: number;
-    type?: string;
-    to?: HexString;
-    value?: bigint;
-    data?: HexString;
-    nonce?: number;
-    gas?: bigint;
-    maxFeePerGas?: bigint;
-    maxPriorityFeePerGas?: bigint;
-    /** Present on EIP-7702 set-code transactions, and on nothing else. */
-    authorizationList?: Eip7702Authorization$1[];
-}
-/**
- * Everything a solver asks of the key that owns its funds. Pass an
- * implementation to `Simplex.start({ signer })`.
- *
- * Three operations, one identity. Each operation names what is being authorised
- * — a typed-data payload, an EIP-7702 authorization, a transaction — rather than
- * a digest, so a custody backend's policy engine can read what it is signing.
- *
- * A backend that only signs digests does not implement this by hand: pass its
- * `sign(hash)` to {@link digestSigner}, which does the hashing and serialising
- * and returns a `Signer`.
- */
-interface Signer {
-    /** The address every fill, bid and delegation is attributed to. */
-    readonly address: HexString;
-    /** Names the backend in logs — `"privateKey"`, `"turnkey"`, or whatever names yours. */
-    readonly mode: string;
-    /**
-     * EIP-712. Signs every bid UserOperation and every paymaster permit.
-     *
-     * Returns the 65-byte `r ‖ s ‖ v` signature as 0x-hex (132 characters), with
-     * `v` 27 or 28 — exactly what `eth_signTypedData_v4` and viem's
-     * `signTypedData` produce. On-chain validation recovers against this form.
-     */
-    signTypedData(typedData: TypedDataPayload): Promise<HexString>;
-    /**
-     * Signs an EIP-7702 authorization tuple — the delegation that makes this
-     * account a solver. Backends with a structured encoding for it (Turnkey) use
-     * that; others sign `keccak256(0x05 ‖ rlp([chainId, contractAddress, nonce]))`.
-     *
-     * Returns the SPLIT signature — see {@link Signature}: `yParity` must be 0 or
-     * 1, not the legacy `v`. This is the one method that does not return hex,
-     * because the authorization is embedded field-by-field in the transaction.
-     */
-    signAuthorization(auth: AuthorizationRequest): Promise<Signature>;
-    /**
-     * Signs and serialises a transaction. Backends that take transactions
-     * (MPCVault's vault API, Turnkey's transaction payloads) keep the transaction
-     * legible to their policy engine; others serialise it and sign the digest.
-     *
-     * Returns the WHOLE SIGNED TRANSACTION — typed-envelope RLP as
-     * `eth_sendRawTransaction` takes it (`0x02…` for EIP-1559, `0x04…` for
-     * set-code), not a bare signature. viem's `serializeTransaction(tx, signature)`
-     * produces it from a signed digest.
-     */
-    signTransaction(tx: SignerTransaction): Promise<HexString>;
-}
-/**
- * A {@link Signer} backed by a key tree rather than a single key, so it can hand
- * out signers for sibling wallets.
- */
-interface DerivingSigner extends Signer {
-    /** Index of the wallet this signer itself signs with. */
-    readonly accountIndex: number;
-    /** The signer for the wallet at `index`, which may be this signer's own. */
-    derive(index: number): Signer;
-}
-/** The tuple an EIP-7702 authorization signature covers. */
-interface AuthorizationRequest {
-    chainId: number;
-    /** The contract the account delegates to. */
-    contractAddress: HexString;
-    nonce: number;
-}
-
 /**
  * Builds the signer a `[simplex.signer]` TOML block describes.
  *
@@ -813,140 +193,223 @@ declare function mpcVaultSigner(config: MpcVaultSignerConfig): Signer;
  */
 declare function turnkeySigner(config: TurnkeySignerConfig): Promise<Signer>;
 
-/**
- * Manages chain clients for different operations
- */
-declare class ChainClientManager {
-    private signer;
-    /**
-     * The viem account every wallet client is built on, derived from the signer
-     * once. `Signer` is viem-free by design, so this is where the two meet.
-     */
-    private account;
-    private configService;
-    private clientFactory;
-    private quorumClients;
-    /** This filler's logging destination, relayed from the config service. */
-    get loggers(): LoggerContext;
-    constructor(configService: FillerConfigService, signer?: Signer);
-    /**
-     * Drops every cached client for a chain. Call after the chain's RPC URLs
-     * change (or when the chain is removed) so the next lookup rebuilds against
-     * the current endpoints — transports are baked into a client at construction.
-     *
-     * Callers that hold a client reference across the invalidation keep talking to
-     * the old endpoints; `EventMonitor` re-reads its quorum client per chain
-     * rebuild for exactly this reason.
-     */
-    invalidate(chain: string): void;
-    getPublicClient(chain: string): PublicClient;
-    /**
-     * Quorum client for consensus-critical reads (cross-chain confirmation
-     * counting; the scanner builds its own instance over its own chain list).
-     * Built from the operator's configured endpoints and cached per chain. The
-     * instances are separate but their rate-limit bench is shared state keyed by
-     * endpoint URL, so a throttle either observes benches the endpoint for both.
-     */
-    getQuorumClient(chain: string): QuorumPublicClient;
-    getWalletClient(chain: string): WalletClient<Transport, Chain, Account>;
-    getAccount(): Account;
-    getSigner(): Signer;
-    getClientsForOrder(order: Order): {
-        destClient: PublicClient;
-        sourceClient: PublicClient;
-        walletClient: WalletClient<Transport, Chain, Account>;
-    };
+/** Native gas a chain needs before its paymaster can sponsor the wallet's transactions. */
+interface NativeSetupNeed {
+    /** Native to send, in whole units: twice the current cost, so a gas-price rise does not leave it short. */
+    required: number;
+    /** The fee token whose one-time Permit2 approval has to be paid in native. */
+    feeToken: "USDC" | "USDT";
 }
 
-/**
- * Raw EIP-7702 authorization, as produced by the delegation flow. Attached to the
- * bundler UserOp so a not-yet-delegated EOA can be delegated in the same op.
- */
-interface Eip7702Authorization {
+interface ChainBalanceRow {
     chainId: number;
-    address: HexString;
-    nonce: number;
-    r: HexString;
-    s: HexString;
-    yParity: number;
+    native?: {
+        symbol: string;
+        amount: number;
+    };
+    usdc?: number;
+    usdt?: number;
+    exotics?: Array<{
+        symbol: string;
+        amount: number;
+    }>;
+    /** Canonical token balances, including funds held in configured ERC-4626 vaults. */
+    assets: AssetBalanceRow[];
+    /** Set when the paymaster cannot sponsor this chain until the wallet holds some native gas. */
+    nativeSetup?: NativeSetupNeed;
 }
-interface UserOpGasLimits {
-    verificationGasLimit: bigint;
-    callGasLimit: bigint;
-    preVerificationGas: bigint;
+type AssetBalanceStatus = "fresh" | "partial" | "unavailable";
+interface VaultBalanceRow {
+    address: string;
+    position: number;
+    available: number;
+    /** False while the vault reports `maxDeposit(solver) == 0`; sweeps into it are idle until it reopens. */
+    acceptsDeposits: boolean;
 }
-interface SponsoredUserOpRequest {
-    chain: string;
-    /** ERC-7821 batch (or "0x" for a no-op, e.g. delegation). */
-    callData: HexString;
-    /**
-     * Attach when the EOA still needs delegating in this op. Pass a factory rather
-     * than a pre-signed tuple: building paymaster data can send an approve tx from
-     * the authority EOA (the Simplex bootstrap approve to Permit2), and an authorization signed before
-     * that tx embeds a stale nonce the bundler will reject. The factory runs only
-     * after paymaster data is built.
-     */
-    eip7702Auth?: Eip7702Authorization | (() => Promise<Eip7702Authorization>);
-    /** EntryPoint nonce key. Defaults to 0. */
-    nonceKey?: bigint;
+interface AssetBalanceRow {
+    address: string;
+    symbol: string;
+    /** Direct underlying balance held by the solver account. Null when its RPC read failed. */
+    wallet: number | null;
+    /** Configured wallet floor that must remain liquid. */
+    walletReserve: number;
+    /** Total solver-owned underlying represented by vault shares. */
+    vaultPosition: number;
+    /** Vault assets that can be withdrawn now, after pending-fill reservations. */
+    vaultAvailable: number;
+    /** Wallet plus vault position. Null when any required source was unavailable. */
+    total: number | null;
+    /** Spendable wallet above reserve plus currently withdrawable vault assets. */
+    available: number | null;
+    vaults: VaultBalanceRow[];
+    status: AssetBalanceStatus;
+}
+type BalanceIssueSource = "chain" | "native" | "token" | "vault";
+interface BalanceIssue {
+    chainId?: number;
+    source: BalanceIssueSource;
+    asset?: string;
+    message: string;
+}
+type BalanceSnapshotStatus = "loading" | "fresh" | "partial" | "unavailable";
+interface HyperbridgeBalance {
+    address: string;
+    free: number;
+    reserved: number;
+}
+interface BalanceSnapshot {
+    /** null until the first refresh attempt completes. */
+    updatedAt: number | null;
+    status: BalanceSnapshotStatus;
+    chains: ChainBalanceRow[];
+    issues: BalanceIssue[];
+    hyperbridge?: HyperbridgeBalance;
+}
+/** Narrow read-only seam implemented by the vault funding planner. */
+interface VaultBalanceSource {
+    getBalanceSnapshot(chain?: string): Promise<VaultBalancePosition[]>;
+}
+interface BalanceProviderOptions {
+    chainClientManager: ChainClientManager;
+    configService: FillerConfigService;
+    fillerAddress: string;
     /**
-     * Explicit gas limits. Provide them to skip bundler estimation — required for
-     * the not-yet-delegated EIP-7702 case, where the account has no code to
-     * simulate so estimation is unreliable. When omitted, limits are estimated.
+     * Token addresses to read beyond USDC and USDT, by state machine id: every token of the
+     * orderbook's books. Asked on each refresh, so a book the orderbook adds is picked up
+     * without a restart.
      */
-    gas?: UserOpGasLimits;
+    tokens: () => Promise<Record<string, string[]>>;
     /**
-     * Lets the paymaster fall back to an EIP-2612 permit when the fee token has no
-     * Permit2 allowance yet. Only a first-time delegation sets this — it carries the
-     * `approve(Permit2, max)` in its own callData, so the permit buys the one op that
-     * makes every later Permit2 op possible without native.
+     * The filler's Hyperbridge connection, reused rather than dialled again. A second socket to the
+     * same node doubles the reconnect traffic during an outage for a balance read that is only
+     * needed once a minute.
      */
-    permitBootstrap?: boolean;
+    hyperbridge?: Promise<IntentsCoprocessor>;
+    substratePrivateKey?: string;
+    refreshIntervalMs?: number;
+    vaultBalances?: VaultBalanceSource;
 }
 /**
- * Submits self-initiated, paymaster-sponsored UserOperations through the bundler,
- * so the solver pays gas in stablecoins rather than native token. Shared by the
- * delegation setup and the vault sweep/redeem paths.
- *
- * Submission contract (so callers can safely fall back to a native tx without
- * risking a double-execution):
- * - Returns `null` when the op was **never submitted** — paymaster/bundler not
- *   configured, insufficient USDC, preparation failed (approve tx or signing), or
- *   the bundler rejected `eth_sendUserOperation` outright (it never entered the
- *   mempool). The caller may fall back to native.
- * - Returns `{ txHash }` once a receipt is observed.
- * - **Throws** only when the op **was submitted** but no receipt arrived. The
- *   caller must NOT fall back (the op may still land) — retry on the next cycle.
+ * Periodically collects wallet balances (native, USDC, USDT and the other tokens
+ * of the orderbook's books per chain, plus the BRIDGE balance of the substrate
+ * account) into a plain snapshot,
+ * consumed by the UI JSON API and `wallet.balances()`.
  */
-declare class UserOpSender {
-    private readonly clientManager;
-    private readonly configService;
-    private readonly signer;
+declare class BalanceProvider extends EventEmitter {
+    private snapshot;
+    private stopped;
+    private refreshInterval?;
+    private hyperbridgeInterval?;
     private logger;
-    constructor(clientManager: ChainClientManager, configService: FillerConfigService, signer: Signer);
-    /** True when a sponsored UserOp is even possible on this chain (paymaster + bundler configured). */
-    canSponsor(chain: string): boolean;
-    trySendSponsored(req: SponsoredUserOpRequest): Promise<{
-        txHash: HexString;
-    } | null>;
-    /**
-     * Estimates account gas limits via the bundler. The op is signed first so the
-     * estimation simulation passes the account's ECDSA validation. Falls back to
-     * generous constants when the bundler estimate is unavailable.
-     */
-    private estimateGas;
-    private buildSignedUserOp;
-    /**
-     * Mirrors the gas-price selection used by the delegation and fill paths: Pimlico's and
-     * Alchemy's own pricing, otherwise the chain's gas price raised to the priority fee a
-     * rundler bundler requires, when the bundler gives one.
-     */
-    private getGasPrice;
-    private sendBundlerRpc;
-    private waitForUserOpReceipt;
+    private options;
+    private intervalMs;
+    constructor(options: BalanceProviderOptions);
+    start(): Promise<void>;
+    stop(): void;
+    getSnapshot(): BalanceSnapshot;
+    refresh(): Promise<BalanceSnapshot>;
+    private collectChain;
+    private addConfiguredStable;
+    private trackHyperbridgeBalance;
 }
 
-/** One vault's share of a transaction, with the metadata the ledger row needs. */
+/** The stretch of time a summary covers. Each is cut into buckets of one size. */
+type ProfitPeriod = "7d" | "30d" | "12w" | "12m" | "all";
+type ProfitBucket = "day" | "week" | "month" | "year";
+/** What a stretch of fills came to, in dollars at the latest rate. Unpriced tokens are left out. */
+interface ProfitFigures {
+    /** What the stretch's fills added to inventory, less what they took out of it. */
+    profitUsd: number;
+    /** The inventory held when the stretch began. Null when nothing within reach of then records it. */
+    startInventoryUsd: number | null;
+    /** `profitUsd` over `startInventoryUsd`, as a percentage. Null without a starting inventory. */
+    returnPct: number | null;
+    /**
+     * What moved in and out over the stretch other than through fills, net: deposits, withdrawals,
+     * fees and vault yield. Null when the indexer has no reading for both ends of the stretch.
+     */
+    transfersUsd: number | null;
+    boughtUsd: number;
+    soldUsd: number;
+    buys: number;
+    sells: number;
+}
+interface ProfitBucketFigures extends ProfitFigures {
+    /** When the bucket starts, in milliseconds since the epoch. */
+    start: number;
+}
+/** One book's buys against its sells over the period, in the book's own tokens. */
+interface BookProfit {
+    book: string;
+    base: string;
+    quote: string;
+    /** Base bought and sold in the period. */
+    bought: number;
+    sold: number;
+    /** Quote per base, averaged over the period's buys and its sells. Null for a side with none. */
+    averageBuy: number | null;
+    averageSell: number | null;
+    /** How far the average sell sits above the average buy, as a percentage. Null without both. */
+    spreadPct: number | null;
+    /** What the period's fills did to the base and the quote held: positive is more than before. */
+    baseChange: number;
+    quoteChange: number;
+    /** The rate the book's tokens are valued at: midway between its latest buy and latest sell. */
+    rate: number | null;
+    /** Both changes in dollars. Null when the book's tokens have no dollar price. */
+    profitUsd: number | null;
+}
+/** The inventory a period began with, token by token. */
+interface StartingInventory {
+    /** The instant it describes, in milliseconds since the epoch. */
+    at: number;
+    /** A stored snapshot, or the balances as they stand now. Either is adjusted by what happened between. */
+    source: "snapshot" | "balances";
+    /** When that record was taken. */
+    recordedAt: number;
+    usd: number;
+    tokens: Array<{
+        symbol: string;
+        amount: number;
+        usd: number | null;
+    }>;
+}
+interface Profitability {
+    period: ProfitPeriod;
+    bucket: ProfitBucket;
+    /** The start of the first bucket and the moment the summary was taken, in milliseconds. */
+    from: number;
+    to: number;
+    totals: ProfitFigures;
+    /** One entry per bucket, oldest first, including buckets nothing happened in. */
+    series: ProfitBucketFigures[];
+    books: BookProfit[];
+    /** Null when there is no snapshot, and the period began more than {@link BALANCES_REACH_MS} ago. */
+    startInventory: StartingInventory | null;
+    /** Fills in the period priced at their order's rate, because they kept no record of what they took in. */
+    estimatedFills: number;
+    /** Tokens the period touched that have no dollar price, and so are in none of the dollar figures. */
+    unpricedTokens: string[];
+}
+
+/**
+ * Wire contracts between the UI server and the browser bundle. The server
+ * types its response literals with these and `ui/src` imports them type-only,
+ * so drift on either side is a compile error. Browser-safe: no runtime
+ * dependencies beyond constants.
+ */
+
+/** Signer work that must finish before the desktop may replace the bundled solver. */
+interface SolverWork {
+    queuedEvaluations: number;
+    evaluating: number;
+    queuedFills: number;
+    activeFills: number;
+    retractions: number;
+    rebalancing: number;
+}
+
+/** One vault's share of a transaction, with the metadata the ledger row needs. */
 interface DescribedMovement {
     kind: "sweep" | "redeem";
     vault: string;
@@ -1270,738 +733,110 @@ interface OrderScanner$1 {
 
 /**
  * Per-instance event bus for one filler.
- *
- * This used to own a block-scan loop per chain. It no longer does: scanning is
- * identical work for every filler on a chain, so it moved to a shared
- * {@link OrderSource} and this class subscribes to it. Everything else stays —
- * the monitor is the filler's event bus, not merely a source. `IntentFiller`
- * emits `orderTiming`, `orderSkipped`, `orderFilled`, `orderExecuted` and
- * `rebalanceExecuted` on it, `ActivityRecorder` attaches to it, and `Simplex`
- * re-exposes it as the public event surface.
- *
- * Three things must stay on this side of the boundary:
- *  - the `OrderFilled` filler-address filter. `filler` is `indexed: false` on
- *    both `OrderFilled` and `PartialFill`, so it can never be a topic filter;
- *    every consumer receives every fill and narrows it locally.
- *  - the leg filter. An order reaches the filler only when its inputs and
- *    outputs pair up leg by leg; the strategy then bids on each leg one of its
- *    limit orders serves.
- *  - de-duplication. Exactly-once used to be emergent — a private monotonic
- *    cursor made a repeat impossible. A shared feed can replay from a cursor
- *    after a reconnect, so the seen-set below is what preserves the property
- *    the filler has always assumed.
- */
-declare class EventMonitor extends EventEmitter {
-    private listening;
-    private configService;
-    private fillerAddress;
-    private logger;
-    private orderScanner;
-    private subscription?;
-    /** Chain ids this filler is configured for; the scanner may carry more. */
-    private chains;
-    /** Order ids already delivered, newest last. Bounds the memory a replay can cost. */
-    private seen;
-    private seenOrder;
-    constructor(chainConfigs: ChainConfig[], configService: FillerConfigService, fillerAddress: HexString, orderScanner: OrderScanner$1);
-    /** Marks a chain as one this filler cares about. */
-    private registerChain;
-    /**
-     * Attaches to the scanner. One subscription covers every chain it carries — a
-     * scanner shared with other fillers may cover more chains than this one is
-     * configured for, so events are matched on `chainId` here.
-     */
-    startListening(): Promise<void>;
-    private handleOrder;
-    private handleFill;
-    /**
-     * Starts matching events for a chain added after boot.
-     *
-     * The scanner must already carry the chain. `Simplex` adds it to a scanner it
-     * owns; when the scanner was supplied by the caller it stays the caller's to
-     * manage, so that another filler reading from it is never surprised by a
-     * chain appearing or vanishing underneath it.
-     */
-    addChain(chainId: number): Promise<void>;
-    /** Stops matching events for a chain. The scanner keeps scanning it for others. */
-    removeChain(chainId: number): Promise<void>;
-    /**
-     * No-op against a scanner: endpoints belong to the scanner, not to a filler
-     * reading from it. `Simplex.chains.setRpcUrls` swaps the endpoints on a scanner
-     * it owns and rejects the call on one it does not.
-     */
-    rebuildChain(chainId: number): Promise<void>;
-    /** Events dropped because this filler could not keep up with the scanner. */
-    droppedEvents(): number;
-    stopListening(): Promise<void>;
-}
-
-/**
- * An execution outcome that can also report a still-pooled bid.
- *
- * `submitBid` can time out with the extrinsic still in Hyperbridge's pool. That
- * is neither success nor failure: the extrinsic may yet land and reserve a
- * deposit, so the bid record has to be reclaimable even though `success` is
- * false. Widened here rather than on the SDK's `ExecutionResult` so simplex does
- * not need an unreleased SDK.
- */
-interface FillResult extends ExecutionResult {
-    pending?: boolean;
-    /**
-     * The identifier Hyperbridge files the bid under, once its op was built:
-     * `keccak256` of its calldata. It tells the bids on one order apart, and retracting the bid names it.
-     */
-    bid?: HexString;
-}
-
-interface FillerStrategy {
-    name: string;
-    canFill(order: Order): Promise<boolean>;
-    calculateProfitability(order: Order): Promise<number>;
-    executeOrder(order: Order, hyperbridge?: IntentsCoprocessor): Promise<FillResult>;
-    /**
-     * Optional hook for strategies to provide a USD value for the full input basket.
-     * Returns null when the strategy cannot or does not want to price the order.
-     */
-    getOrderUsdValue?(order: Order): Promise<{
-        inputUsd: Decimal;
-    } | null>;
-    /**
-     * Optional confirmation policy for this strategy.
-     * If absent, no confirmation waiting is required (e.g. same-chain strategies).
-     */
-    confirmationPolicy?: {
-        getConfirmationBlocks: (chainId: number, amountUsd: number) => number;
-    };
-}
-
-/**
- * A user-supplied asset entry in the `[assets]` TOML table: symbol → chain
- * state machine id → contract address.
- *
- * ```toml
- * [assets.BRZ]
- * "EVM-1"   = "0x..."
- * "EVM-137" = "0x..."
- * ```
- */
-type AssetDefinition = Record<string, HexString>;
-/**
- * The subset of `FillerConfigService` used to resolve built-in symbols to
- * per-chain addresses from the SDK chain registry.
- */
-interface BuiltinAssetResolver {
-    getUsdcAsset(chain: string): HexString;
-    getUsdtAsset(chain: string): HexString;
-    getDaiAsset(chain: string): HexString;
-    getCNgnAsset(chain: string): HexString | undefined;
-    /** Generic per-chain lookup into the SDK chain registry's asset table. */
-    getAssetBySymbol(chain: string, symbol: string): HexString | undefined;
-}
-/**
- * Symbols pegged to 1 USD. They are pinned at $1 when an order's USD value is
- * derived from the limit orders' rates (see `usdFactorsFrom`), which is what
- * sizes confirmation depth. Trade pricing never uses this as a price.
- */
-declare const USD_STABLE_SYMBOLS: ReadonlySet<string>;
-/** Normalises a symbol for lookups: trimmed, uppercased. "cNGN" ≡ "CNGN". */
-declare function normalizeSymbol(symbol: string): string;
-/** Every symbol the registry ships without user configuration. */
-declare function registrySymbols(): string[];
-/** Whether `symbol` ships with the registry (built-in or curated). Pure — no chain resolution. */
-declare function isRegistrySymbol(symbol: string): boolean;
-/**
- * Validates the `[assets]` table; throws a descriptive error on the first
- * invalid entry. Side-effect free — safe to call at config-parse time and again
- * at registry construction.
- */
-declare function validateAssetDefinitions(assets: Record<string, AssetDefinition>): void;
-/**
- * Symbol → contract address registry backing the `[[pairs]]` configuration.
- *
- * Resolution merges two layers, most specific winning:
- *  1. the user's `[assets]` table — an *escape hatch* for assets the registry
- *     doesn't ship (or per-deployment overrides), never required for shipped
- *     symbols;
- *  2. shipped symbols (USDC, USDT, DAI, CNGN, USDR, ZARP, EURC, XSGD, TRYB,
- *     BRIDGE) resolved per chain from the SDK chain registry (`chain.ts`) —
- *     the single source of truth shared with the rest of the SDK, so an
- *     address correction there is never shadowed by a parallel table here.
- *
- * Address lookups are per `(symbol, chain)` — a chain where no layer knows the
- * asset simply doesn't trade pairs involving it. The registry holds addresses
- * only; all pricing (including risk sizing) is derived from the pair curves.
- */
-declare class AssetRegistry {
-    private readonly resolver;
-    private readonly userAssets;
-    private readonly addressCache;
-    constructor(resolver: BuiltinAssetResolver, userAssets?: Record<string, AssetDefinition>);
-    /** Whether `symbol` is known (user-defined, curated, or built-in). */
-    hasSymbol(symbol: string): boolean;
-    /**
-     * Registers new user-defined assets on the live registry (runtime market
-     * adds). Existing symbols may not be redefined — an address swap under a
-     * running market would silently repoint its fills.
-     */
-    addAssets(defs: Record<string, AssetDefinition>): void;
-    /**
-     * Contract address of `symbol` on `chain`, or `null` when the asset is not
-     * deployed/known there. User `[assets]` addresses win over the SDK chain
-     * registry, per chain.
-     */
-    getAddress(symbol: string, chain: string): HexString | null;
-    /**
-     * The symbol `address` is known by on `chain`, or null when nothing in the
-     * registry resolves to it.
-     *
-     * Every symbol this registry can name is tried, user `[assets]` first so an
-     * overridden address reports the name the operator gave it. Two symbols
-     * resolving to one address would be a registry mistake; the first wins.
-     */
-    symbolFor(address: string, chain: string): string | null;
-}
-
-/**
- * One market from the top-level `[[pairs]]` TOML array:
- *
- * ```toml
- * [[pairs]]
- * token0 = "USDC"   # the book's base — any symbol in the asset registry
- * token1 = "CNGN"   # the book's quote — any symbol in the asset registry
- * ```
- *
- * A pair declares that a market exists and nothing more. What the filler will
- * pay on it comes from the operator's limit orders, which carry the rate and the
- * size they are good for.
- *
- * The orientation follows the orderbook's books, which the setup wizard copies:
- * `token0` is the book's base and `token1` its quote, so the `USDC-cNGN` book
- * (priced in cNGN per USDC) becomes `token0 = "USDC"`, `token1 = "CNGN"`. One
- * orientation only: `A/B` and `B/A` are the same market and declaring both is
- * refused. `token0 == token1` is the same-asset cross-chain market.
- */
-interface PairConfig {
-    /** The book's base symbol (e.g. "USDC", "USDT"). Any symbol in the registry. */
-    token0: string;
-    /** The book's quote symbol, which the book prices the base in (e.g. "CNGN"). Any symbol in the registry. */
-    token1: string;
-}
-/**
- * The USD stable to quote a reference feed against for an unanchored symbol:
- * the first stable (registry preference order) with no existing orientation
- * against it — a pair and its reverse are the same market, so a stable that
- * already has any market against the symbol cannot also carry the feed.
- * Returns null when every stable is taken. Shared by both wizards.
- */
-declare function pickAnchorStable(pairs: Array<{
-    token0: string;
-    token1: string;
-}>, symbol: string): string | null;
-/**
- * Validates the `[[pairs]]` array against the `[assets]` table and built-in
- * symbols. Pure — throws a descriptive error on the first invalid pair.
- */
-declare function validatePairConfigs(pairs: PairConfig[], userAssets?: Record<string, AssetDefinition>): void;
-
-interface ChainBalanceRow {
-    chainId: number;
-    native?: {
-        symbol: string;
-        amount: number;
-    };
-    usdc?: number;
-    usdt?: number;
-    exotics?: Array<{
-        symbol: string;
-        amount: number;
-    }>;
-    /** Canonical token balances, including funds held in configured ERC-4626 vaults. */
-    assets: AssetBalanceRow[];
-}
-type AssetBalanceStatus = "fresh" | "partial" | "unavailable";
-interface VaultBalanceRow {
-    address: string;
-    position: number;
-    available: number;
-    /** False while the vault reports `maxDeposit(solver) == 0`; sweeps into it are idle until it reopens. */
-    acceptsDeposits: boolean;
-}
-interface AssetBalanceRow {
-    address: string;
-    symbol: string;
-    /** Direct underlying balance held by the solver account. Null when its RPC read failed. */
-    wallet: number | null;
-    /** Configured wallet floor that must remain liquid. */
-    walletReserve: number;
-    /** Total solver-owned underlying represented by vault shares. */
-    vaultPosition: number;
-    /** Vault assets that can be withdrawn now, after pending-fill reservations. */
-    vaultAvailable: number;
-    /** Wallet plus vault position. Null when any required source was unavailable. */
-    total: number | null;
-    /** Spendable wallet above reserve plus currently withdrawable vault assets. */
-    available: number | null;
-    vaults: VaultBalanceRow[];
-    status: AssetBalanceStatus;
-}
-type BalanceIssueSource = "chain" | "native" | "token" | "vault";
-interface BalanceIssue {
-    chainId?: number;
-    source: BalanceIssueSource;
-    asset?: string;
-    message: string;
-}
-type BalanceSnapshotStatus = "loading" | "fresh" | "partial" | "unavailable";
-interface HyperbridgeBalance {
-    address: string;
-    free: number;
-    reserved: number;
-}
-interface BalanceSnapshot {
-    /** null until the first refresh attempt completes. */
-    updatedAt: number | null;
-    status: BalanceSnapshotStatus;
-    chains: ChainBalanceRow[];
-    issues: BalanceIssue[];
-    hyperbridge?: HyperbridgeBalance;
-}
-/** Narrow read-only seam implemented by the vault funding planner. */
-interface VaultBalanceSource {
-    getBalanceSnapshot(chain?: string): Promise<VaultBalancePosition[]>;
-}
-interface BalanceProviderOptions {
-    chainClientManager: ChainClientManager;
-    configService: FillerConfigService;
-    fillerAddress: string;
-    /** Exotic token addresses per state machine id — every cross-asset pair's token1 on that chain. */
-    token1: Record<string, string[]>;
-    /**
-     * The filler's Hyperbridge connection, reused rather than dialled again. A second socket to the
-     * same node doubles the reconnect traffic during an outage for a balance read that is only
-     * needed once a minute.
-     */
-    hyperbridge?: Promise<IntentsCoprocessor>;
-    substratePrivateKey?: string;
-    refreshIntervalMs?: number;
-    vaultBalances?: VaultBalanceSource;
-}
-/**
- * Periodically collects wallet balances (native, USDC, USDT, exotic per chain,
- * plus the BRIDGE balance of the substrate account) into a plain snapshot,
- * consumed by the UI JSON API and `wallet.balances()`.
- */
-declare class BalanceProvider extends EventEmitter$1 {
-    private snapshot;
-    private stopped;
-    private refreshInterval?;
-    private hyperbridgeInterval?;
-    private logger;
-    private options;
-    private intervalMs;
-    constructor(options: BalanceProviderOptions);
-    start(): Promise<void>;
-    stop(): void;
-    getSnapshot(): BalanceSnapshot;
-    refresh(): Promise<BalanceSnapshot>;
-    private collectChain;
-    private addConfiguredStable;
-    private trackHyperbridgeBalance;
-}
-
-/** The stretch of time a summary covers. Each is cut into buckets of one size. */
-type ProfitPeriod = "7d" | "30d" | "12w" | "12m" | "all";
-type ProfitBucket = "day" | "week" | "month" | "year";
-/** What a stretch of fills came to, in dollars at the latest rate. Unpriced tokens are left out. */
-interface ProfitFigures {
-    /** What the stretch's fills added to inventory, less what they took out of it. */
-    profitUsd: number;
-    /** The inventory held when the stretch began. Null when nothing within reach of then records it. */
-    startInventoryUsd: number | null;
-    /** `profitUsd` over `startInventoryUsd`, as a percentage. Null without a starting inventory. */
-    returnPct: number | null;
-    /**
-     * What moved in and out over the stretch other than through fills, net: deposits, withdrawals,
-     * fees and vault yield. Null when the indexer has no reading for both ends of the stretch.
-     */
-    transfersUsd: number | null;
-    boughtUsd: number;
-    soldUsd: number;
-    buys: number;
-    sells: number;
-}
-interface ProfitBucketFigures extends ProfitFigures {
-    /** When the bucket starts, in milliseconds since the epoch. */
-    start: number;
-}
-/** One book's buys against its sells over the period, in the book's own tokens. */
-interface BookProfit {
-    book: string;
-    base: string;
-    quote: string;
-    /** Base bought and sold in the period. */
-    bought: number;
-    sold: number;
-    /** Quote per base, averaged over the period's buys and its sells. Null for a side with none. */
-    averageBuy: number | null;
-    averageSell: number | null;
-    /** How far the average sell sits above the average buy, as a percentage. Null without both. */
-    spreadPct: number | null;
-    /** What the period's fills did to the base and the quote held: positive is more than before. */
-    baseChange: number;
-    quoteChange: number;
-    /** The rate the book's tokens are valued at: midway between its latest buy and latest sell. */
-    rate: number | null;
-    /** Both changes in dollars. Null when the book's tokens have no dollar price. */
-    profitUsd: number | null;
-}
-/** The inventory a period began with, token by token. */
-interface StartingInventory {
-    /** The instant it describes, in milliseconds since the epoch. */
-    at: number;
-    /** A stored snapshot, or the balances as they stand now. Either is adjusted by what happened between. */
-    source: "snapshot" | "balances";
-    /** When that record was taken. */
-    recordedAt: number;
-    usd: number;
-    tokens: Array<{
-        symbol: string;
-        amount: number;
-        usd: number | null;
-    }>;
-}
-interface Profitability {
-    period: ProfitPeriod;
-    bucket: ProfitBucket;
-    /** The start of the first bucket and the moment the summary was taken, in milliseconds. */
-    from: number;
-    to: number;
-    totals: ProfitFigures;
-    /** One entry per bucket, oldest first, including buckets nothing happened in. */
-    series: ProfitBucketFigures[];
-    books: BookProfit[];
-    /** Null when there is no snapshot, and the period began more than {@link BALANCES_REACH_MS} ago. */
-    startInventory: StartingInventory | null;
-    /** Fills in the period priced at their order's rate, because they kept no record of what they took in. */
-    estimatedFills: number;
-    /** Tokens the period touched that have no dollar price, and so are in none of the dollar figures. */
-    unpricedTokens: string[];
-}
-
-/**
- * Wire contracts between the UI server and the browser bundle. The server
- * types its response literals with these and `ui/src` imports them type-only,
- * so drift on either side is a compile error. Browser-safe: no runtime
- * dependencies beyond constants.
- */
-
-/** Signer work that must finish before the desktop may replace the bundled solver. */
-interface SolverWork {
-    queuedEvaluations: number;
-    evaluating: number;
-    queuedFills: number;
-    activeFills: number;
-    retractions: number;
-    rebalancing: number;
-}
-
-/** `[simplex.tunnel]` in the config file. */
-interface TunnelConfig {
-    /** Off by default: enabling it makes the embedded SSH server reachable from the internet. */
-    enabled?: boolean;
-    /** `host[:port]`; port defaults to 443. */
-    relay?: string;
-    /** `SHA256:…` fingerprint of the relay host key. Without it the key seen on first contact is pinned. */
-    relayHostKey?: string;
-}
-
-/**
- * A coordinate point on a curve
- * @property amount - The input threshold (e.g., USD amount)
- * @property value - The output value at this threshold (e.g., confirmations, bps)
- */
-interface CurvePoint {
-    amount: string;
-    value: number;
-}
-/**
- * Configuration for a curve
- */
-interface CurveConfig {
-    points: CurvePoint[];
-}
-/**
- * Manages confirmation block requirements per chain.
- * Each chain has its own curve mapping order value to required confirmations.
- */
-/**
- * Parses a per-chain config key. Every other table in the config writes chains
- * as state machine ids ("EVM-1"), so both "EVM-1" and bare "1" are accepted;
- * anything else returns null and callers MUST fail loudly — a silently
- * discarded chain key has meant committing capital on a chain configured as
- * watch-only, or hardening a confirmation curve that never applied.
+ *
+ * This used to own a block-scan loop per chain. It no longer does: scanning is
+ * identical work for every filler on a chain, so it moved to a shared
+ * {@link OrderSource} and this class subscribes to it. Everything else stays —
+ * the monitor is the filler's event bus, not merely a source. `IntentFiller`
+ * emits `orderTiming`, `orderSkipped`, `orderFilled`, `orderExecuted` and
+ * `rebalanceExecuted` on it, `ActivityRecorder` attaches to it, and `Simplex`
+ * re-exposes it as the public event surface.
+ *
+ * Three things must stay on this side of the boundary:
+ *  - the `OrderFilled` filler-address filter. `filler` is `indexed: false` on
+ *    both `OrderFilled` and `PartialFill`, so it can never be a topic filter;
+ *    every consumer receives every fill and narrows it locally.
+ *  - the leg filter. An order reaches the filler only when its inputs and
+ *    outputs pair up leg by leg; the strategy then bids on each leg one of its
+ *    limit orders serves.
+ *  - de-duplication. Exactly-once used to be emergent — a private monotonic
+ *    cursor made a repeat impossible. A shared feed can replay from a cursor
+ *    after a reconnect, so the seen-set below is what preserves the property
+ *    the filler has always assumed.
  */
-declare function parseChainKey(key: string): number | null;
-/** The canonical "EVM-<id>" state machine id `parseChainKey` accepts. */
-declare function formatChainKey(chainId: number | string): string;
-declare class ConfirmationPolicy {
-    private policies;
-    constructor(policyConfig: Record<string, CurveConfig>);
-    getConfirmationBlocks(chainId: number, amountUsd: Decimal$1): number;
-    /**
-     * Installs a curve for a chain added at runtime. Validates before it mutates,
-     * so a rejected curve leaves the policy set untouched — a chain that started
-     * scanning without a curve would drop every cross-chain order sourced on it
-     * with a per-order throw.
-     */
-    add(chainId: number, config: CurveConfig): void;
-    /** Whether a chain has a confirmation curve. */
-    has(chainId: number): boolean;
-    remove(chainId: number): void;
-    /**
-     * Copies one chain's curve across from another policy set.
-     *
-     * Used when a chain is added at runtime and covered by a built-in default: the
-     * defaults are only materialised inside a freshly constructed policy, so the
-     * live one adopts the entry rather than re-deriving it.
+declare class EventMonitor extends EventEmitter$1 {
+    private listening;
+    private configService;
+    private fillerAddress;
+    private logger;
+    private orderScanner;
+    private subscription?;
+    /** Chain ids this filler is configured for; the scanner may carry more. */
+    private chains;
+    /** Order ids already delivered, newest last. Bounds the memory a replay can cost. */
+    private seen;
+    private seenOrder;
+    constructor(chainConfigs: ChainConfig[], configService: FillerConfigService, fillerAddress: HexString, orderScanner: OrderScanner$1);
+    /** Marks a chain as one this filler cares about. */
+    private registerChain;
+    /**
+     * Attaches to the scanner. One subscription covers every chain it carries — a
+     * scanner shared with other fillers may cover more chains than this one is
+     * configured for, so events are matched on `chainId` here.
      */
-    adopt(chainId: number, from: ConfirmationPolicy): void;
+    startListening(): Promise<void>;
+    private handleOrder;
+    private handleFill;
     /**
-     * Startup guard: every configured chain must have a confirmation curve.
-     * Without this, a missing policy only surfaces as a per-order throw at
-     * fill time — cross-chain orders sourced on that chain silently dropped.
+     * Starts matching events for a chain added after boot.
+     *
+     * The scanner must already carry the chain. `Simplex` adds it to a scanner it
+     * owns; when the scanner was supplied by the caller it stays the caller's to
+     * manage, so that another filler reading from it is never surprised by a
+     * chain appearing or vanishing underneath it.
      */
-    assertCovers(chainIds: number[]): void;
-}
-
-interface PaymasterKeeperConfig {
-    /** Chains to monitor. Defaults to every configured chain with a SimplexPaymaster. */
-    chains?: string[];
-    intervalMinutes?: number;
-    /** Minimum accrued balance (in whole stablecoin units) worth recycling. */
-    minSwapUsd?: number;
-}
-
-interface ChainConfirmationPolicy {
+    addChain(chainId: number): Promise<void>;
+    /** Stops matching events for a chain. The scanner keeps scanning it for others. */
+    removeChain(chainId: number): Promise<void>;
     /**
-     * Array of (amount, value) coordinates defining the confirmation curve.
-     * value = number of confirmations at that order amount
+     * No-op against a scanner: endpoints belong to the scanner, not to a filler
+     * reading from it. `Simplex.chains.setRpcUrls` swaps the endpoints on a scanner
+     * it owns and rejects the call on one it does not.
      */
-    points: Array<{
-        amount: string;
-        value: number;
-    }>;
-}
-/**
- * TOML row for an ERC-4626 vault entry. `threshold` (absolute human units) is the
- * high-water mark that triggers a sweep down to `minBalance`; omit both for
- * withdraw-only sourcing.
- */
-interface VaultToml {
-    chain: string;
-    vault: HexString;
-    threshold?: string;
-    minBalance?: string;
-    redeemOnShutdown?: boolean;
-}
-/** Top-level `[vault]` config: ERC-4626 treasury vaults, for withdraw sourcing and threshold sweeping. */
-interface VaultTomlConfig {
-    vaults?: VaultToml[];
-    sweepIntervalMs?: number;
-}
-interface QueueConfig {
-    maxRechecks: number;
-    recheckDelayMs: number;
-}
-interface RebalancingConfig {
-    triggerPercentage: number;
-    baseBalances: {
-        USDC?: Record<string, string>;
-        USDT?: Record<string, string>;
-    };
-}
-interface BinanceConfig {
-    apiKey: string;
-    apiSecret: string;
-    basePath?: string;
-    timeout?: number;
-    depositTimeoutMs?: number;
-    pollIntervalMs?: number;
-    withdrawTimeoutMs?: number;
-}
-interface FillerTomlConfig {
-    /**
-     * Optional asset-registry escape hatch: symbol → { chain → address }. Only
-     * needed for assets the built-in registry does not ship, or to override a
-     * shipped address for a deployment. Shipped symbols: USDC, USDT, DAI, CNGN
-     * (SDK chain registry) + curated USDR, ZARP, EURC, XSGD, TRYB and BRIDGE.
-     */
-    assets?: Record<string, AssetDefinition>;
-    /**
-     * Markets the operator dashboard lists, as `token0`/`token1` symbol pairs.
-     * They carry no prices and do not gate matching: the filler prices every
-     * fill from the operator's limit orders. Optional; the browser setup wizard
-     * writes one per book the orderbook lists. Keys left over from the curve
-     * era (`bidPriceCurve`, `askPriceCurve`, `maxOrderSize`, `referenceOnly`)
-     * are ignored.
-     */
-    pairs?: PairConfig[];
-    /**
-     * Per-chain confirmation policies for cross-chain orders, keyed by chain id.
-     * Merged over built-in defaults (ETH, BSC, Polygon, Base, Arbitrum,
-     * Unichain); every configured chain must be covered or startup fails. The
-     * policy's amount axis is the order's USD value: USD stables count at $1 and
-     * other tokens are valued through the open limit orders' rates. An order no
-     * limit order connects to a dollar waits for the policy's maximum depth.
-     */
-    confirmationPolicies?: Record<string, ChainConfirmationPolicy>;
-    simplex: {
-        /** Orders evaluated at once. Defaults to 5. */
-        maxConcurrentOrders?: number;
-        /**
-         * Accepted and ignored. Older configs and the wizard used to write it; the
-         * engine never read it. Kept in the type so those configs still load.
-         */
-        queue?: QueueConfig;
-        logging?: string;
-        watchOnly?: boolean | Record<string, boolean>;
-        substratePrivateKey: string;
-        hyperbridgeWsUrl: string;
-        /**
-         * Hyperbridge indexer GraphQL endpoint, used to backfill order details on
-         * activity rows recorded before they were captured. Defaults per network
-         * (nexus for mainnet, gargantua for testnet).
-         */
-        indexerUrl?: string;
-        /** Accepted and ignored. Contract addresses come from the SDK chain registry. */
-        entryPointAddress?: string;
-        /** Accepted and ignored. Contract addresses come from the SDK chain registry. */
-        solverAccountContractAddress?: string;
-        /** Target gas units for EntryPoint deposits per chain. Defaults to 3,000,000. */
-        targetGasUnits?: number;
-        /**
-         * Block-scanner poll period per chain in seconds. Defaults to 3, and
-         * fractional values are allowed (0.5 = twice a second). Each tick costs
-         * one `eth_blockNumber` + one `eth_getLogs` per chain per endpoint, so
-         * raising this is the lever for fitting inside a rate-limited RPC's
-         * budget; the cost is seeing new orders that much later.
-         */
-        blockScanIntervalSeconds?: number;
-        /** Gas fee bump (percentages added to base gasPrice). Defaults: priority=8%, max=10%. */
-        gasFeeBump?: {
-            maxPriorityFeePerGasBumpPercent?: number;
-            maxFeePerGasBumpPercent?: number;
-        };
-        /**
-         * Overfill protection knobs. Defaults: maxOverfillBps=500, maxConsecutiveClamps=3.
-         * `maxOverfillBps` is warn-only: FXFiller logs a limit order whose offer exceeds
-         * the swapper's ask by more than this, and clamps nothing. `maxConsecutiveClamps`
-         * is accepted but dormant: the clamp that fed it was for Uniswap V4 venue pricing,
-         * which is gone, so FXFiller never halts.
-         */
-        overfillProtection?: {
-            maxOverfillBps?: number;
-            maxConsecutiveClamps?: number;
-        };
-        /**
-         * How long a signed bid stays executable, in seconds. Defaults to 300 (5 minutes).
-         *
-         * Written into `FillOptions.validUntil` and enforced by `fillOrder`, which reverts
-         * `FillExpired` past it. This is how long the quoted price stands as a firm commitment:
-         * the order's `deadline` is chosen by the placer with no ceiling, and retracting the bid
-         * on Hyperbridge does not reach the destination chain, so without it a signed bid stays
-         * executable indefinitely and is taken up only once the rate has moved against us.
-         *
-         * Configured in seconds but written on-chain in blocks, converted per destination chain.
-         */
-        bidValiditySeconds?: number;
-        /**
-         * The order size, in USD, below which `order.fees` must cover the execution cost
-         * (fill gas plus, cross-chain, the relayer fee). Defaults to 20.
-         *
-         * An order worth at least this much is filled whatever fees it carries: the margin
-         * in the limit order that prices it pays for the gas. On a smaller order that
-         * margin is too thin to, so the fees have to. Set to 0 to never check fees. An
-         * order nothing can put a dollar figure on is treated as below it.
-         */
-        minOrderSizeUsd?: number;
-        /**
-         * Remote access: an outbound SSH tunnel to a rendezvous relay so a phone's
-         * SSH client can reach the local web UI. Off unless `enabled = true`; the
-         * relay defaults to the hosted one. Devices are paired from the UI.
-         */
-        tunnel?: TunnelConfig;
-    };
-    chains: UserProvidedChainConfig[];
-    rebalancing?: RebalancingConfig;
-    binance?: BinanceConfig;
-    /** Filler-wide vault config: stablecoin sourcing for fills + threshold sweeping. */
-    vault?: VaultTomlConfig;
-    /** Restricts order processing to listed user addresses. Omit to accept all users. */
-    allowlist?: AllowlistConfig;
-    /** SimplexPaymaster fee-recycling keeper (`paymaster-keeper` subcommand). */
-    keeper?: PaymasterKeeperConfig;
-    /** The HyperFX orderbook simplex posts its limit orders to. */
-    orderbook?: OrderbookConfig;
+    rebuildChain(chainId: number): Promise<void>;
+    /** Events dropped because this filler could not keep up with the scanner. */
+    droppedEvents(): number;
+    stopListening(): Promise<void>;
 }
+
 /**
- * Where the operator's limit orders are advertised.
+ * An execution outcome that can also report a still-pooled bid.
  *
- * The limit orders themselves are not configured here: they live in `bids.db`
- * and are created over the API, because they are inventory the operator opens
- * and closes while the filler runs rather than startup settings.
+ * `submitBid` can time out with the extrinsic still in Hyperbridge's pool. That
+ * is neither success nor failure: the extrinsic may yet land and reserve a
+ * deposit, so the bid record has to be reclaimable even though `success` is
+ * false. Widened here rather than on the SDK's `ExecutionResult` so simplex does
+ * not need an unreleased SDK.
  */
-interface OrderbookConfig {
-    /** GraphQL endpoint. */
-    url: string;
-    /**
-     * How long a limit order lives, in seconds, and the TTL written into its posting,
-     * when the create request names none. Defaults to 365 days; at least 900, the
-     * orderbook's floor. The order and its posting expire together: there is one
-     * clock, and nothing renews it.
-     */
-    defaultTtlSecs?: number;
-    /** How often to reconcile local limit orders against the orderbook, in seconds. */
-    reconcileIntervalSecs?: number;
-    requestTimeoutMs?: number;
+interface FillResult extends ExecutionResult {
+    pending?: boolean;
+    /**
+     * The identifier Hyperbridge files the bid under, once its op was built:
+     * `keccak256` of its calldata. It tells the bids on one order apart, and retracting the bid names it.
+     */
+    bid?: HexString;
 }
-/**
- * The TOML file the binary reads: a {@link FillerTomlConfig} plus the
- * `[simplex.signer]` block, which is the CLI's way of naming a signing backend.
- *
- * The block is not part of the library's config — `Simplex.start` takes a
- * `Signer` instance — so it lives on this type and nowhere else. The binary
- * resolves it with `signerFromToml` and passes the parsed file straight through;
- * the extra key rides along untouched so the dashboard's config writer can put
- * it back in the file it came from.
- */
-interface FillerConfigFile extends FillerTomlConfig {
-    simplex: FillerTomlConfig["simplex"] & {
-        /** Omitted by watch-only configs, which sign nothing. */
-        signer?: SignerConfig;
+
+interface FillerStrategy {
+    name: string;
+    canFill(order: Order): Promise<boolean>;
+    calculateProfitability(order: Order): Promise<number>;
+    executeOrder(order: Order, hyperbridge?: IntentsCoprocessor): Promise<FillResult>;
+    /**
+     * Optional hook for strategies to provide a USD value for the full input basket.
+     * Returns null when the strategy cannot or does not want to price the order.
+     */
+    getOrderUsdValue?(order: Order): Promise<{
+        inputUsd: Decimal;
+    } | null>;
+    /**
+     * Optional confirmation policy for this strategy.
+     * If absent, no confirmation waiting is required (e.g. same-chain strategies).
+     */
+    confirmationPolicy?: {
+        getConfirmationBlocks: (chainId: number, amountUsd: number) => number;
     };
 }
-/**
- * Boot-parity confirmation coverage: every configured chain id needs a
- * confirmation curve (built-in defaults or [confirmationPolicies]), or orders
- * sourced on it would be silently dropped. Boot and both wizard write gates
- * run the same construction; the gates know the chain ids the wizard selected,
- * boot the ids resolved from the RPCs.
- */
-declare function assertConfirmationCoverage(confirmationPolicies: FillerTomlConfig["confirmationPolicies"], chainIds: number[]): ConfirmationPolicy;
-/**
- * Validates raw TOML `[vault].vaults` entries. Pure and browser-safe — shared
- * by `validateConfig`, the vault-update endpoint and the funding planner.
- * Throws on missing/invalid required fields.
- */
-declare function validateVaultToml(vaults: {
-    chain?: string;
-    vault?: string;
-    threshold?: string;
-    minBalance?: string;
-    redeemOnShutdown?: boolean;
-}[]): void;
-declare function validateConfig(config: FillerTomlConfig, cliWatchOnly?: boolean): void;
 
 /** Symbol and decimals for a token on a chain, as far as the filler knows them. */
 interface TokenDescription {
@@ -2030,7 +865,7 @@ interface ActivityRecorderOptions {
  * stored row is re-emitted as `event` for live consumers (the UI's SSE stream,
  * and `Simplex`'s `activity` event).
  */
-declare class ActivityRecorder extends EventEmitter$1 {
+declare class ActivityRecorder extends EventEmitter {
     private store;
     private logger;
     private monitor?;
@@ -2070,19 +905,6 @@ declare class ActivityRecorder extends EventEmitter$1 {
     walletTxs(limit?: number): Promise<WalletTx[]>;
 }
 
-/** One market the engine serves, as the operator's market list shows it. */
-interface AdminStrategy {
-    /** Stable identifier for the API. */
-    index: number;
-    /** Position in the TOML `[[pairs]]` array. */
-    pairIndex: number;
-    /** Pair label, e.g. "USDC/CNGN" (display-only). */
-    exotic?: string;
-    token0: string;
-    token1: string;
-    /** Same-asset cross-chain market, where the spread is realized in kind. */
-    sameToken?: boolean;
-}
 /** Self-halt visibility/reset for one FX strategy (overfill protection). */
 interface HaltControl {
     index: number;
@@ -2488,111 +1310,6 @@ declare class ContractInteractionService {
     buildApprovalAndFillCalldata(order: Order, fillerOutputs: TokenInfo[], fillOptions: FillOptions, requiredFeeTokenAmount: bigint, settlement?: BudgetSettlement): Promise<HexString>;
 }
 
-/**
- * Service for managing EIP-7702 delegation of the filler's EOA to the SolverAccount contract.
- * This enables the filler to participate in solver selection mode.
- *
- * When the Simplex paymaster is configured and the filler holds stablecoins already
- * approved to Permit2, delegation is performed via a no-op UserOp sent through the
- * bundler — the paymaster pays gas in stablecoins. Falls back to a direct type-0x04 tx
- * if the bundler path is unavailable.
- *
- * The paymaster prefunds through Permit2, which needs a standing token approval to the
- * Permit2 contract. On a chain the solver has never used, the delegation op installs
- * that approval itself and pays for the privilege with an EIP-2612 permit, so a
- * permit-capable fee token bootstraps with no native at all. A token without a permit
- * (BNB Chain) still needs native dust once, for the type-0x04 tx that batches the
- * approve in. Every op after that is native-free either way.
- */
-declare class DelegationService {
-    private clientManager;
-    private configService;
-    private signer;
-    private logger;
-    private readonly userOpSender;
-    constructor(clientManager: ChainClientManager, configService: FillerConfigService, signer: Signer);
-    /**
-     * @param viaBundler When true, uses the current nonce (bundler submits the tx).
-     *                   When false, uses nonce+1 (EOA submits the type-0x04 tx itself).
-     */
-    private buildAuthorization;
-    private sendDelegationTransaction;
-    /**
-     * Best-effort resolution of a Permit2 approval to fold into a native delegation. Never
-     * throws: a resolution failure (RPC error, misconfig) yields null and the delegation
-     * proceeds as a plain self-call.
-     */
-    private resolvePendingPermit2Approval;
-    /**
-     * Checks if the filler's EOA is already delegated to the SolverAccount contract on a specific chain.
-     */
-    isDelegated(chain: string): Promise<boolean>;
-    /**
-     * Sets up EIP-7702 delegation via the bundler. Uses the Simplex paymaster when
-     * configured and the filler holds a sufficient stablecoin balance.
-     *
-     * The op is a no-op once the account has a Permit2 allowance. On a chain it has
-     * never used, and only when the fee token implements EIP-2612 (`permitCapable`),
-     * the op instead carries `approve(Permit2, max)` as its callData and asks the
-     * paymaster for PERMIT mode: the permit covers this op's gas, and the op installs
-     * the allowance every later op authorizes against. That is the whole zero-native
-     * bootstrap — one sponsored op, after which the account never needs a permit again.
-     */
-    private setupDelegationViaBundler;
-    /**
-     * Installs `approve(Permit2, max)` on an account that is ALREADY delegated, using the same
-     * permit-funded op the first-time delegation carries — minus the authorization, which it
-     * does not need.
-     *
-     * This exists because delegation and bootstrap are separate facts. An account delegated by
-     * an earlier release has no Permit2 allowance (that release charged EIP-2612 permits and
-     * never touched Permit2), and `setupDelegation` returns before the bootstrap once
-     * `isDelegated` holds. Leaving it there strands every upgraded solver on the native-funded
-     * approve path.
-     *
-     * Best-effort and never throws: on failure the first sponsored op still falls back to
-     * `sendFundedApprove`, which works for a solver holding native.
-     */
-    private ensurePermit2Allowance;
-    /**
-     * Sets up EIP-7702 delegation from the filler's EOA to the SolverAccount contract.
-     *
-     * A fee token with no Permit2 allowance yet cannot be charged through Permit2, so the
-     * approve has to be installed by the very first operation. Which carrier does that
-     * depends on the token:
-     *
-     * - EIP-2612 token: the bundler goes first and the op pays for itself with a permit
-     *   while carrying the approve in its callData. No native is spent, so this is
-     *   preferred even on an EOA that holds some.
-     * - No permit (BSC pegged stables): only a native type-0x04 tx can carry the approve,
-     *   so that goes first when the EOA covers it.
-     *
-     * With nothing pending — the allowance is already in place — the bundler path goes
-     * first as usual. A plain direct tx is the last fallback in every case.
-     */
-    setupDelegation(chain: string): Promise<boolean>;
-    /** Whether the EOA can pay for one direct set-code tx at the current gas price. */
-    private nativeCoversDirectTx;
-    /**
-     * Sends one native EIP-7702 delegation tx (optionally batching a Permit2 approve) and
-     * waits for its receipt. Never throws: a revert or send error is logged and returns
-     * false, so the caller can fall back. Rebuilds the authorization each call, so a fresh
-     * nonce is used after a prior attempt consumed one.
-     */
-    private trySendDelegation;
-    /**
-     * Sets up delegation on the specified chains where solver selection is active.
-     */
-    setupDelegationOnChains(chains: string[]): Promise<{
-        success: boolean;
-        results: Record<string, boolean>;
-    }>;
-    /**
-     * Revokes delegation by delegating to the zero address.
-     */
-    revokeDelegation(chain: string): Promise<boolean>;
-}
-
 interface BinanceCexConfig {
     apiKey: string;
     apiSecret: string;
@@ -3432,7 +2149,7 @@ declare class IntentFiller {
     private signer;
     private fillerAddress;
     private logger;
-    constructor(chainConfigs: ChainConfig[], strategies: FillerStrategy[], config: FillerConfig$1, configService: FillerConfigService, chainClientManager: ChainClientManager, contractService: ContractInteractionService, signer: Signer, scanners: {
+    constructor(chainConfigs: ChainConfig[], strategies: FillerStrategy[], config: FillerConfig, configService: FillerConfigService, chainClientManager: ChainClientManager, contractService: ContractInteractionService, signer: Signer, scanners: {
         orders: OrderScanner$1;
     }, rebalancingService?: RebalancingService, bidStorage?: BidStore, limitOrders?: LimitOrderStore, assetRegistry?: AssetRegistry);
     /**
@@ -3640,278 +2357,11 @@ declare class IntentFiller {
     private retractStoredBids;
 }
 
-/**
- * One market the engine will quote, as a pair of registry symbols.
- *
- * A pair declares that the market exists and nothing more: what the filler pays
- * on it comes from the operator's limit orders. `token0 == token1` is the
- * same-asset cross-chain market, where the spread is realized in kind.
- */
-interface TradingPair {
-    token0: string;
-    token1: string;
-}
-/**
- * Strategy for swaps priced by the operator's limit orders. Supports both
- * same-chain and cross-chain orders.
- *
- * Every leg is matched against the open limit orders (`matchLimitOrders`): an
- * order serves a leg when it fills on the destination chain, takes the leg's
- * input, pays out its output, accepts its source chain and, at its own rate,
- * pays at least what the swapper asked for. Each matching order gets its own
- * bid, best offer first, sized `min(offer, remaining)`; there is no fallback
- * price, so a leg nothing matches is not bid on. No external price feed is
- * consulted. Confirmation sizing is the only place a dollar value is needed,
- * and it is derived from the limit orders' own rates (see `usdFactorsFrom`).
- *
- * Payouts are bounded by the filler's real balances plus funding-venue
- * withdrawals. Because the IntentGateway releases inputs proportionally to the
- * fraction of outputs provided, partial fills need no extra on-chain logic.
- *
- * `[[pairs]]` markets do not gate matching; they name the markets the operator
- * dashboard lists.
- */
-declare class FXFiller implements FillerStrategy {
-    name: string;
-    private clientManager;
-    private contractService;
-    private configService;
-    /** Markets the dashboard lists. Informational only: matching reads the limit orders. */
-    private pairs;
-    /** Symbol → per-chain address resolution (built-ins + curated + user `[assets]`). */
-    private registry;
-    private signer;
-    private logger;
-    /**
-     * Consecutive orders where the overfill clamp activated. Dormant: the clamp
-     * existed for venue-priced legs, which went with Uniswap V4 pricing, so every
-     * outcome is now recorded unclamped and this never climbs. See `recordOrderOutcome`.
-     */
-    private consecutiveClamps;
-    /** Once set, the filler refuses all orders until reset. Unreachable while the clamp is dormant. */
-    private halted;
-    /** Bps above the swapper's ask past which a limit order's offer is logged as suspicious. Warn only. */
-    private readonly maxOverfillBps;
-    /** Consecutive clamped evaluations before halting. Dormant, as `consecutiveClamps` is. */
-    private readonly maxConsecutiveClamps;
-    confirmationPolicy?: {
-        getConfirmationBlocks: (chainId: number, amountUsd: number) => number;
-    };
-    private fundingVenues;
-    /** The operator's resting orders: the only thing that prices a fill. */
-    private limitOrders?;
-    /**
-     * @param signer          Filler's signing account for UserOp signatures.
-     * @param configService   Network/config provider for addresses and decimals.
-     * @param clientManager   Used to get viem PublicClients for chains.
-     * @param contractService Shared contract interaction service.
-     * @param pairs           Trading pairs with their bid/ask price policies and per-order caps.
-     * @param registry        Asset symbol registry resolving pair symbols per chain.
-     * @param options.confirmationPolicy Optional per-chain confirmation policy for cross-chain orders.
-     * @param options.fundingVenues  Optional funding venues for on-chain liquidity sourcing.
-     */
-    constructor(signer: Signer, configService: FillerConfigService, clientManager: ChainClientManager, contractService: ContractInteractionService, pairs: TradingPair[], registry: AssetRegistry, options?: {
-        confirmationPolicy?: ConfirmationPolicy;
-        fundingVenues?: FundingVenue[];
-        /** Where prices come from. Without it the engine matches nothing and fills nothing. */
-        limitOrders?: LimitOrderStore;
-    });
-    /** Per-pair invariants, shared by the constructor and addPair. Adds the accepted pair's label to `seenPairs`. */
-    private static assertPairValid;
-    /**
-     * Adds a market to the running engine. All-or-nothing: the pair passes the
-     * same duplicate and reverse-orientation checks the constructor enforces
-     * before it is pushed.
-     */
-    addPair(pair: TradingPair): void;
-    /**
-     * Removes a market from the running engine. At least one market must remain.
-     * Matching reads the limit orders rather than the pairs, so removing a market
-     * changes what the dashboard lists, not what the filler fills.
-     */
-    removePair(pair: TradingPair): void;
-    /**
-     * Call once at startup after construction.
-     * Hydrates all funding venue state before any fill sources from it.
-     */
-    initialise(): Promise<void>;
-    canFill(order: Order): Promise<boolean>;
-    /**
-     * Evaluates whether an order is profitable to fill against the operator's
-     * limit orders and the filler's current token balances.
-     *
-     * High-level flow:
-     * - Match each (input, output) leg against the open limit orders.
-     * - Build one bid per matching order, best offer first, each paying the
-     *   order's whole offer for the input at its own rate, capped by what the
-     *   order has left. The gateway credits the swapper the ask and splits
-     *   anything above it between the swapper and the protocol.
-     * - Treat a payout below the ask as a partial fill, which only orders
-     *   without output calldata and without an earlier partial fill allow.
-     * - Cap each payout by the filler's balance plus funding-venue withdrawals,
-     *   then gate it on fees (full fills of orders below `minOrderSizeUsd`) and the
-     *   same-asset spread.
-     * - Cache the resulting bids for later use in `executeOrder`.
-     */
-    calculateProfitability(order: Order): Promise<number>;
-    /**
-     * Executes an order by submitting a bid via the IntentsCoprocessor.
-     *
-     * Assumes that `calculateProfitability` has already been called for the
-     * given order so that filler outputs are cached in `contractService`.
-     * This method only orchestrates the bid construction and submission; the
-     * actual token movements are handled on-chain by the IntentGateway.
-     */
-    executeOrder(order: Order, intentsCoprocessor?: IntentsCoprocessor): Promise<ExecutionResult>;
-    /**
-     * Prepares and submits a bid UserOp to Hyperbridge for the given order.
-     *
-     * Uses the filler outputs previously cached by `calculateProfitability`.
-     * Approval bundling and UserOp construction are handled by
-     * `ContractInteractionService.prepareBidUserOp`.
-     */
-    private submitBid;
-    /**
-     * Update consecutive-clamp counter after a successful order evaluation.
-     *
-     * Dormant. Only venue-priced legs ever fed a clamped outcome here: a streak
-     * of those meant a live market source had gone off (stale pool, manipulated
-     * venue). Venue pricing went with Uniswap V4, and limit orders are prices the
-     * operator set, so the only caller records `false` and the filler never
-     * halts. `isHalted`, `resetHalt` and `[simplex.overfillProtection]
-     * maxConsecutiveClamps` are kept so existing configs and the halt API still
-     * load; they can go once nothing reads them.
-     */
-    private recordOrderOutcome;
-    isHalted(): boolean;
-    /** Operator acknowledgement after investigating a self-halt; resumes filling. */
-    resetHalt(): void;
-    /**
-     * Whether any solver has already delivered output against this order.
-     *
-     * Fails closed: a read that errors returns true, so an order we cannot price
-     * confidently is left alone rather than bid on with stale escrow assumptions.
-     */
-    private hasExistingPartialFill;
-    /**
-     * Reads and caches the filler's balance for a token on the destination chain.
-     *
-     * Normalizes the token address, checks an in-memory cache, and only hits
-     * the chain (native `getBalance` or ERC20 `balanceOf`) on a cache miss.
-     * This allows multiple legs within a single profitability evaluation to
-     * share the same balance pool.
-     */
-    private getAndCacheBalance;
-    /**
-     * Resolves every (input, output) leg of an order to a configured pair in one
-     * pass. Returns null if any leg matches no pair (or a disabled direction).
-     *
-     * The address-level classification is cached per order id in the shared
-     * cache (as `CachedPairClassification`, one entry per leg) so repeated
-     * evaluations skip re-derivation; pair resolution itself is re-run per
-     * strategy since pair sets differ between engine instances.
-     */
-    /** Whether any leg of the order matches a limit order: what `canFill` asks. */
-    private matchOrder;
-    /**
-     * The limit orders one leg of an order is priced against, best offer first, or
-     * none when nothing serves it.
-     *
-     * Amounts cross into the matcher at 1e18, the unit limit orders are kept in,
-     * and the payout comes back in the same unit for the caller to bring down to
-     * the output token's own decimals.
-     */
-    private matchLeg;
-    /** Why no limit order serves the order, leg by leg, for the line that says it was passed over. */
-    private explainUnmatched;
-    /**
-     * One leg as the matcher sees it, or null when its input token is not one the asset
-     * registry knows on the source chain.
-     *
-     * Amounts cross into the matcher at 1e18, the unit limit orders are kept in.
-     */
-    private incomingFor;
-    /**
-     * The order's input in **USD**, or null when no limit order connects its input
-     * token to a dollar.
-     *
-     * The core filler feeds this to the per-chain confirmation curves, whose
-     * amount axis is dollars. Null is the honest answer when the route is missing:
-     * the caller waits on this figure, and inventing one would under-wait a large
-     * order against a source chain that has not finalised.
-     */
-    getOrderUsdValue(order: Order): Promise<{
-        inputUsd: Decimal;
-    } | null>;
-}
-
-interface SendTokenParams {
-    /** State machine id, e.g. "EVM-8453". */
-    chain: string;
-    /** "native" or an ERC-20 address. Configured vault shares are redeemed to the recipient instead of transferred. */
-    token: string;
-    /** Human-readable amount, parsed against the token's decimals. */
-    amount: string;
-    to: HexString;
-}
-interface SendTokenResult {
-    txHash: HexString;
-    sponsored: boolean;
-    /** Set when vault holdings were redeemed as part of the send. */
-    redeemed: boolean;
-}
-/**
- * Operator-initiated outbound transfers from the filler wallet. Uses the same
- * sponsored UserOp path as fills (gas paid by the paymaster) with a native-tx
- * fallback. When the wallet balance of an ERC-20 falls short and a configured
- * ERC-4626 vault holds it as underlying, the shortfall is withdrawn from the
- * vault in the same batch as the transfer. Sending a vault's share token
- * directly issues `redeem(shares, recipient, solver)` — shares only ever
- * leave as the underlying asset.
- */
-declare class TokenSender {
-    private readonly clientManager;
-    private readonly solver;
-    /** Live view of the configured vaults so runtime vault edits are honored. */
-    private readonly getVaults;
-    private readonly userOpSender?;
-    /** Only needed to size the paymaster's gas reserve; without it a send reserves nothing. */
-    private readonly configService?;
-    private readonly logger;
-    constructor(clientManager: ChainClientManager, solver: HexString, 
-    /** Live view of the configured vaults so runtime vault edits are honored. */
-    getVaults: () => VaultToml[], userOpSender?: UserOpSender | undefined, 
-    /** Only needed to size the paymaster's gas reserve; without it a send reserves nothing. */
-    configService?: FillerConfigService | undefined);
-    send(params: SendTokenParams): Promise<SendTokenResult>;
-    /**
-     * A `withdraw(shortfall, solver, solver)` call against a configured vault on
-     * this chain whose underlying is the token being sent and that can cover the
-     * shortfall, or null when no vault can.
-     */
-    /**
-     * A withdrawal that funds the transfer and, where the vault can afford it,
-     * leaves headroom in the wallet rather than nothing.
-     *
-     * `shortfall` is what the transfer cannot do without, and is zero or negative
-     * when the wallet already covers it. The headroom is the larger of the
-     * paymaster's gas `reserve` and the vault's `minBalance` — the first is what
-     * validation will pull out of this wallet, the second is the operator's own
-     * statement of the working balance this token keeps. A vault that can only
-     * cover the shortfall still funds the send: headroom is a preference, not a
-     * reason to refuse a transfer the operator asked for.
-     */
-    private vaultWithdrawalCall;
-    private submit;
-}
-
 /** Everything a running filler exposes to the UI server and the CLI. */
 interface FillerRuntime {
     intentFiller: IntentFiller;
     balanceProvider: BalanceProvider;
     vaultVenue?: VaultFundingPlanner;
-    /** The markets this filler serves, for the operator UI. */
-    adminStrategies: AdminStrategy[];
     /** Self-halt visibility/reset for the trading engine (overfill protection). */
     haltControls: HaltControl[];
     /** Live order-activity bridge; emits `event` per stored row. */
@@ -3944,12 +2394,6 @@ interface FillerRuntime {
     assetRegistry: AssetRegistry;
     /** Creates and posts the operator's limit orders. */
     limitOrders?: LimitOrderService;
-    /** The live trading engine. It runs whether or not the config names any pairs. */
-    engine: FXFiller;
-    /** The engine's live pair array (same instance), indexed 1:1 with config.pairs. */
-    tradingPairs: TradingPair[];
-    /** BalanceProvider's live token1 map (chain name to exotic addresses); mutations apply on its next refresh. */
-    balanceTokens: Record<string, string[]>;
     rebalancingService?: RebalancingService;
     resolvedChains: ResolvedChainConfig[];
     fillerAddress: HexString;
@@ -3969,6 +2413,8 @@ interface FillerRuntime {
     vaultPreflight(vaults: VaultToml[]): Promise<void>;
     /** Operator-initiated outbound transfers (dashboard Send). */
     tokenSender: TokenSender;
+    /** Buys BRIDGE on BSC for the filler's Hyperbridge account. Absent without a substrate key. */
+    bridgeTopUp?: BridgeTopUp;
     startedAt: number;
     /** Stops everything bootFiller started. Idempotent; does NOT process.exit. */
     shutdown(signal: string): Promise<void>;
@@ -4118,23 +2564,16 @@ interface SimplexEvents {
         order: LimitOrder;
     };
 }
-interface PairView {
-    index: number;
-    token0: string;
-    token1: string;
-    /** token0 === token1: the same-asset cross-chain market. */
-    sameToken: boolean;
-}
 interface ChainView {
     chainId: number;
     stateMachineId: string;
     rpcUrls: string[];
+    /** Hyperbridge's bundler the chain fills through, empty where it runs none. */
     bundlerUrl: string;
     watchOnly: boolean;
 }
 interface ChainInput {
     rpcUrls: string[];
-    bundlerUrl: string;
     watchOnly?: boolean;
     /**
      * Required for chains with no built-in confirmation curve (testnets and
@@ -4152,9 +2591,7 @@ interface SimplexStatus {
     uptimeSec: number;
     chains: number[];
     watchOnly: Record<number, boolean>;
-    pairs: number;
 }
-/** Trading pairs of the running engine. Every mutation binds on the next order. */
 /**
  * The operator's limit orders: what simplex offers to pay, and what the
  * orderbook advertises on its behalf.
@@ -4198,7 +2635,7 @@ declare class LimitOrderController {
     profitability(period: ProfitPeriod, tzOffsetMinutes?: number): Promise<Profitability>;
     /** One reader for the life of the filler, so the readings it has already fetched are kept. */
     private indexerInventory;
-    /** The pairs the orderbook lists, the smallest payout each token may carry, and its tokens per chain. */
+    /** The books the orderbook lists, the smallest payout each token may carry, and its tokens per chain. */
     books(): Promise<{
         books: Book[];
         minOrderSizes: TokenMinSize[];
@@ -4214,26 +2651,6 @@ declare class LimitOrderController {
 }
 /** How the controller publishes an outcome on the `Simplex` it belongs to. */
 type LimitOrderEmitter = <E extends "limit-order:posted" | "limit-order:rejected" | "limit-order:cancelled" | "limit-order:resized" | "limit-order:filled">(event: E, payload: SimplexEvents[E]) => void;
-declare class PairController {
-    private runtime;
-    private persist;
-    constructor(runtime: FillerRuntime, persist: () => void | Promise<void>);
-    private get pairs();
-    list(): PairView[];
-    /**
-     * Opens a new market on the running engine.
-     *
-     * Validated against the same rules boot applies, so a pair accepted here is
-     * one a restart would also accept. New `assets` are registered first, because
-     * the pair's symbols have to resolve before the market can be hydrated.
-     */
-    add(pair: PairConfig, options?: {
-        assets?: Record<string, AssetDefinition>;
-    }): Promise<PairView>;
-    /** Closes a market. Orders already in flight against it still complete. */
-    remove(index: number): Promise<void>;
-    private livePair;
-}
 /** The chain set of the running filler. */
 declare class ChainController {
     private runtime;
@@ -4282,7 +2699,6 @@ declare class ChainController {
      * leaves no gap in the scanned block range.
      */
     setRpcUrls(chainId: number, rpcUrls: string[]): Promise<void>;
-    setBundlerUrl(chainId: number, bundlerUrl: string): Promise<void>;
     /** Monitor without filling. Takes effect on the next order. */
     setWatchOnly(chainId: number, watchOnly: boolean): Promise<void>;
     /** A global boolean is left alone — expanding it per chain changes how the config validates. */
@@ -4358,7 +2774,7 @@ declare class RebalanceController {
  *
  * Start one with {@link Simplex.start}, which boots every service, delegates the
  * filler account where solver selection is active, and begins scanning the
- * configured chains. The instance is the whole control surface: trading pairs,
+ * configured chains. The instance is the whole control surface: limit orders,
  * chains, vaults, assets, wallet and rebalancing are reachable as controllers,
  * and everything the filler does is observable through {@link SimplexEvents}.
  *
@@ -4369,12 +2785,11 @@ declare class RebalanceController {
  *
  * More than one instance can run in one process. They share no state.
  */
-declare class Simplex extends EventEmitter$1 {
+declare class Simplex extends EventEmitter {
     private runtime;
     private options;
     /** The scanner this filler built for itself, and must therefore close. */
     private ownedScanners;
-    readonly pairs: PairController;
     readonly chains: ChainController;
     readonly vaults: VaultController;
     readonly assets: AssetController;
@@ -4521,4 +2936,4 @@ declare class OrderScanner implements OrderScanner$1 {
     private closeNow;
 }
 
-export { ActivityEvent, ActivityInsert, ActivityStore, type AllowlistConfig, type AssetBalanceRow, AssetController, type AssetDefinition, type AuthorizationRequest, type BalanceIssue, type BalanceSnapshot, BidStats, BidStore, type BinanceConfig, type BookProfit, type CancelledLimitOrder, type ChainBalanceRow, type ChainConfirmationPolicy, ChainController, type ChainInput, type ChainView, type CreateLimitOrderRequest, type CurveConfig, type CurvePoint, type DerivingSigner, type Eip7702Authorization$1 as Eip7702Authorization, type FillerConfigFile, type FillerTomlConfig, type HyperbridgeBalance, InventoryStore, LimitOrder, LimitOrderController, LimitOrderFill, LimitOrderFilter, LimitOrderStore, LimitOrderValidationError, LogLevel, LogSink, Logger, LoggerContext, MemoryDataStore, type MpcVaultSignerConfig, OrderScanner, type OrderScanner$1 as OrderScannerContract, type OrderScannerHandlers, type OrderScannerOptions, type PairConfig, PairController, type PairView, type PostedLimitOrder, type PostingOutcome, type PrivateKeySignerConfig, type ProfitBucket, type ProfitBucketFigures, type ProfitFigures, type ProfitPeriod, type Profitability, type QueueConfig, RebalanceController, type RebalancingConfig, type ResolvedChainConfig, type ScannedFill, type ScannedOrder, type ScannerChainConfig, type SecretPhraseSignerConfig, type Signature, type Signer, type SignerConfig, type SignerTransaction, SignerType, Simplex, type SimplexConfig, SimplexDataStore, type SimplexEvents, type SimplexOptions, type SimplexStatus, type SolverWork, type StartingInventory, StateStore, StoredBid, type Subscription, type TurnkeySignerConfig, type TypedDataPayload, USD_STABLE_SYMBOLS, type UserProvidedChainConfig, type VaultBalanceRow, VaultController, type VaultSweepDeposit, type VaultSweepResult, type VaultSweepSkip, type VaultSweepSkipReason, type VaultSweepSubmission, type VaultToml, type VaultTomlConfig, WalletController, WalletTx, assertConfirmationCoverage, canDerive, createSigner, digestSigner, formatChainKey, isRegistrySymbol, mpcVaultSigner, normalizeSymbol, parseChainKey, pickAnchorStable, privateKeySigner, registrySymbols, secretPhraseSigner, turnkeySigner, validateAssetDefinitions, validateConfig, validatePairConfigs, validateSecretPhrase, validateSignerConfig, validateVaultToml, viemSigner };
+export { ActivityEvent, ActivityInsert, ActivityStore, AllowlistConfig, type AssetBalanceRow, AssetController, AssetDefinition, type BalanceIssue, type BalanceSnapshot, BidStats, BidStore, type BookProfit, type CancelledLimitOrder, type ChainBalanceRow, ChainConfirmationPolicy, ChainController, type ChainInput, type ChainView, type CreateLimitOrderRequest, DerivingSigner, FillerTomlConfig, type HyperbridgeBalance, InventoryStore, LimitOrder, LimitOrderController, LimitOrderFill, LimitOrderFilter, LimitOrderStore, LimitOrderValidationError, LogLevel, LogSink, LoggerContext, MemoryDataStore, MpcVaultSignerConfig, OrderScanner, type OrderScanner$1 as OrderScannerContract, type OrderScannerHandlers, type OrderScannerOptions, type PostedLimitOrder, type PostingOutcome, type ProfitBucket, type ProfitBucketFigures, type ProfitFigures, type ProfitPeriod, type Profitability, RebalanceController, RebalancingConfig, ResolvedChainConfig, type ScannedFill, type ScannedOrder, type ScannerChainConfig, SecretPhraseSignerConfig, Signature, Signer, SignerConfig, Simplex, type SimplexConfig, SimplexDataStore, type SimplexEvents, type SimplexOptions, type SimplexStatus, type SolverWork, type StartingInventory, StateStore, StoredBid, type Subscription, TurnkeySignerConfig, type VaultBalanceRow, VaultController, type VaultSweepDeposit, type VaultSweepResult, type VaultSweepSkip, type VaultSweepSkipReason, type VaultSweepSubmission, VaultToml, WalletController, WalletTx, canDerive, createSigner, digestSigner, mpcVaultSigner, privateKeySigner, secretPhraseSigner, turnkeySigner, validateSecretPhrase, validateSignerConfig, viemSigner };