@hyperbridge/simplex 0.18.1 → 0.18.3

package/dist/{types-6MEltdkX.d.ts → types-CW6STIE7.d.ts}

@@ -113,12 +113,6 @@ interface RebalancingConfig$1 {
         USDT?: Record<string, string>;
     };
 }
-interface OverfillProtectionConfig {
-    /** Ceiling bps above user-requested output; filler clamps its computed output to this. Default 500 (5%). */
-    maxOverfillBps?: number;
-    /** Consecutive clamped evaluations before the strategy halts itself. Default 3. */
-    maxConsecutiveClamps?: number;
-}
 interface AllowlistConfig {
     /** Hex addresses eligible across all chains. */
     users?: string[];
@@ -153,10 +147,10 @@ interface FillerConfig {
      */
     minOrderSizeUsd?: number;
     /**
-     * Overfill protection knobs. If omitted, defaults are used
-     * (maxOverfillBps=500, maxConsecutiveClamps=3).
+     * Smallest payout, in USD, a partial fill may bid. Defaults to 20. Set to 0 to
+     * bid whatever can be filled. See `minPartialFillUsd` in filler-toml.
      */
-    overfillProtection?: OverfillProtectionConfig;
+    minPartialFillUsd?: number;
     /**
      * Restricts which order `user` addresses the filler processes. When omitted, all
      * users are accepted. When present, only listed users (global ∪ per-source) are
@@ -341,10 +335,11 @@ declare class FillerConfigService {
      * Defaults to 20. An order at or above it is filled whatever fees it carries.
      */
     getMinOrderSizeUsd(): number;
-    /** Ceiling bps above user-requested output. Default 500 (5%). */
-    getMaxOverfillBps(): bigint;
-    /** Consecutive clamped evaluations before the strategy halts. Default 3. */
-    getMaxConsecutiveClamps(): number;
+    /**
+     * The smallest payout, in USD, a partial fill may bid. Defaults to 20. `0` bids
+     * whatever can be filled. Full fills are not checked.
+     */
+    getMinPartialFillUsd(): number;
 }
 
 /**
@@ -369,9 +364,10 @@ interface QuorumBudget {
 }
 /**
  * Wraps multiple viem `PublicClient`s — one per configured RPC URL — and runs
- * selected read paths (`getLogs`, `getBlockNumber`, `getTransactionConfirmations`)
- * as a **BFT quorum**: a result is accepted only when `quorumThreshold(m)` of the
- * `m` endpoints that answered agree on it.
+ * selected read paths (`getLogs`, `getBlockNumber`, `getTransactionInclusion` /
+ * `getTransactionConfirmations`, `readWithQuorum`) as a **BFT quorum**: a result is
+ * accepted only when `quorumThreshold(m)` of the `m` endpoints that answered agree
+ * on it.
  *
  * A provider that *answers with divergent data* is never special-cased away — it
  * simply fails to join the agreeing group, which is what makes a lying or reorged
@@ -477,22 +473,46 @@ declare class QuorumPublicClient {
      */
     getBlockNumber(): Promise<bigint>;
     /**
-     * Confirmation count for a transaction under the quorum.
+     * The inclusion a quorum of endpoints agreed on for a transaction, and its depth.
      *
      * Every endpoint is asked for the receipt and its head. A "receipt not found"
      * answer is a valid **no** vote — the endpoint is responsive but does not see
      * the transaction (not yet propagated, or reorged out) — so it counts toward
-     * responsiveness but joins no inclusion group. The transaction is confirmed
-     * only when a quorum agrees on the same `(blockHash, blockNumber)`; the depth
-     * is then the quorum head of that agreeing group. A minority still serving a
-     * reorged/fabricated receipt can never reach the quorum.
+     * responsiveness but joins no inclusion group. The block is reported only when a
+     * quorum agrees on the same `(blockHash, blockNumber)`; the depth is then the
+     * quorum head of that agreeing group. A minority still serving a
+     * reorged/fabricated receipt can never reach the quorum. Returning the block as
+     * well as the depth lets a caller bind the count to the block it read the event
+     * from: a placement re-mined elsewhere keeps its transaction hash but not its
+     * block, and not the commitment built from it.
      *
      * Throws {@link QuorumError} when no inclusion reaches the quorum — including
      * the ordinary window where the tx is not yet mined on enough endpoints.
      */
+    getTransactionInclusion({ hash }: {
+        hash: Hash;
+    }): Promise<TransactionInclusion>;
+    /**
+     * Confirmation count for a transaction under the quorum. See
+     * {@link getTransactionInclusion}, whose depth this is.
+     */
     getTransactionConfirmations({ hash }: {
         hash: Hash;
     }): Promise<bigint>;
+    /**
+     * Runs an arbitrary read on every endpoint and returns the value a quorum
+     * agrees on. The `read` callback is the whole vote: one endpoint's answer is
+     * whatever its callback resolves to, so a caller that reads a vector of slots
+     * (e.g. every leg's escrow) votes on the vector, not on each slot separately.
+     * Values are compared under `JSON.stringify(..., bigIntReplacer)`, so bigints
+     * and arrays compare by value rather than by identity.
+     *
+     * An endpoint whose `read` throws does not vote — the class's rule for every
+     * quorum path. A quorum-meeting group is unique, so the first satisfiable
+     * agreement is final. Fails with {@link QuorumError} when no value reaches the
+     * bar, naming `label`.
+     */
+    readWithQuorum<T>(label: string, read: (client: PublicClient) => Promise<T>): Promise<T>;
     /**
      * Fetches logs from every endpoint in parallel and returns the result once a
      * quorum agrees. Fails with {@link QuorumError} otherwise.
@@ -510,6 +530,12 @@ declare class QuorumPublicClient {
     private describeResponders;
     private formatFailures;
 }
+/** The inclusion a quorum of endpoints agreed on for a transaction, and its depth. */
+interface TransactionInclusion {
+    blockHash: string;
+    blockNumber: bigint;
+    confirmations: bigint;
+}
 
 /**
  * The signing contract a solver runs on, and the config shapes the bundled
@@ -755,93 +781,6 @@ declare class ChainClientManager {
     };
 }
 
-/**
- * Raw EIP-7702 authorization, as produced by the delegation flow. Attached to the
- * bundler UserOp so a not-yet-delegated EOA can be delegated in the same op.
- */
-interface Eip7702Authorization {
-    chainId: number;
-    address: HexString;
-    nonce: number;
-    r: HexString;
-    s: HexString;
-    yParity: number;
-}
-interface UserOpGasLimits {
-    verificationGasLimit: bigint;
-    callGasLimit: bigint;
-    preVerificationGas: bigint;
-}
-interface SponsoredUserOpRequest {
-    chain: string;
-    /** ERC-7821 batch (or "0x" for a no-op, e.g. delegation). */
-    callData: HexString;
-    /**
-     * Attach when the EOA still needs delegating in this op. Pass a factory rather
-     * than a pre-signed tuple: building paymaster data can send an approve tx from
-     * the authority EOA (the Simplex bootstrap approve to Permit2), and an authorization signed before
-     * that tx embeds a stale nonce the bundler will reject. The factory runs only
-     * after paymaster data is built.
-     */
-    eip7702Auth?: Eip7702Authorization | (() => Promise<Eip7702Authorization>);
-    /** EntryPoint nonce key. Defaults to 0. */
-    nonceKey?: bigint;
-    /**
-     * Explicit gas limits. Provide them to skip bundler estimation — required for
-     * the not-yet-delegated EIP-7702 case, where the account has no code to
-     * simulate so estimation is unreliable. When omitted, limits are estimated.
-     */
-    gas?: UserOpGasLimits;
-    /**
-     * Lets the paymaster fall back to an EIP-2612 permit when the fee token has no
-     * Permit2 allowance yet. Only a first-time delegation sets this — it carries the
-     * `approve(Permit2, max)` in its own callData, so the permit buys the one op that
-     * makes every later Permit2 op possible without native.
-     */
-    permitBootstrap?: boolean;
-}
-/**
- * Submits self-initiated, paymaster-sponsored UserOperations through the bundler,
- * so the solver pays gas in stablecoins rather than native token. Shared by the
- * delegation setup and the vault sweep/redeem paths.
- *
- * Submission contract (so callers can safely fall back to a native tx without
- * risking a double-execution):
- * - Returns `null` when the op was **never submitted** — paymaster/bundler not
- *   configured, insufficient USDC, preparation failed (approve tx or signing), or
- *   the bundler rejected `eth_sendUserOperation` outright (it never entered the
- *   mempool). The caller may fall back to native.
- * - Returns `{ txHash }` once a receipt is observed.
- * - **Throws** only when the op **was submitted** but no receipt arrived. The
- *   caller must NOT fall back (the op may still land) — retry on the next cycle.
- */
-declare class UserOpSender {
-    private readonly clientManager;
-    private readonly configService;
-    private readonly signer;
-    private logger;
-    constructor(clientManager: ChainClientManager, configService: FillerConfigService, signer: Signer);
-    /** True when a sponsored UserOp is even possible on this chain (paymaster + bundler configured). */
-    canSponsor(chain: string): boolean;
-    trySendSponsored(req: SponsoredUserOpRequest): Promise<{
-        txHash: HexString;
-    } | null>;
-    /**
-     * Estimates account gas limits via the bundler. The op is signed first so the
-     * estimation simulation passes the account's ECDSA validation. Falls back to
-     * generous constants when the bundler estimate is unavailable.
-     */
-    private estimateGas;
-    private buildSignedUserOp;
-    /**
-     * Prices the op for the rundler bundler, as the fill path does: its suggested fees, or the
-     * chain's gas price raised to the priority fee it requires where it suggests none.
-     */
-    private getGasPrice;
-    private sendBundlerRpc;
-    private waitForUserOpReceipt;
-}
-
 /**
  * Service for managing EIP-7702 delegation of the filler's EOA to the SolverAccount contract.
  * This enables the filler to participate in solver selection mode.
@@ -866,8 +805,18 @@ declare class DelegationService {
     private readonly userOpSender;
     constructor(clientManager: ChainClientManager, configService: FillerConfigService, signer: Signer);
     /**
-     * @param viaBundler When true, uses the current nonce (bundler submits the tx).
-     *                   When false, uses nonce+1 (EOA submits the type-0x04 tx itself).
+     * Signs the authorization tuple and reports the nonce a direct set-code tx must carry.
+     *
+     * The tx nonce and the tuple nonce are two different counters, and the tuple's is the
+     * one *after* the tx's: EIP-7702 compares the tuple's nonce against the authority's
+     * nonce once the tx has bumped it. A direct tx therefore reads `pending` — what viem
+     * would fill anyway — and signs the tuple at `nonce + 1`. Reading `latest` instead
+     * signs one too low whenever an EOA tx is in flight, and a mismatched tuple is skipped
+     * without reverting: the receipt reads success while the account stays undelegated.
+     *
+     * @param viaBundler When true, the bundler submits the tx, so the tuple uses the
+     *                   authority's current nonce. When false, the EOA sends the type-0x04
+     *                   tx itself and the tuple is signed at that tx's nonce + 1.
      */
     private buildAuthorization;
     private sendDelegationTransaction;
@@ -879,8 +828,27 @@ declare class DelegationService {
     private resolvePendingPermit2Approval;
     /**
      * Checks if the filler's EOA is already delegated to the SolverAccount contract on a specific chain.
+     *
+     * Best-effort: callers retry, so a read failure answers "not delegated".
      */
     isDelegated(chain: string): Promise<boolean>;
+    /**
+     * Whether the EOA's code is the EIP-7702 delegation to the configured SolverAccount.
+     *
+     * A `blockNumber` makes this a claim about one mined block, so a read failure throws
+     * rather than answering "not delegated"; `confirmDelegationAt` turns that into "not
+     * confirmed". Without one it is a best-effort check, and `isDelegated` swallows a
+     * read failure to false.
+     */
+    private readDelegation;
+    /**
+     * Confirms the delegation at the block a tx mined in. A failed read of that one block is
+     * not a verdict, so the wallet's delegation at `latest` decides instead: a delegation that
+     * landed is not reported as failed because a node could not serve a historical `getCode`.
+     * `isDelegated` answers false when `latest` cannot be read either, which is "not confirmed",
+     * never a pass.
+     */
+    private confirmDelegationAt;
     /**
      * Sets up EIP-7702 delegation via the bundler. Uses the Simplex paymaster when
      * configured and the filler holds a sufficient stablecoin balance.
@@ -891,8 +859,46 @@ declare class DelegationService {
      * paymaster for PERMIT mode: the permit covers this op's gas, and the op installs
      * the allowance every later op authorizes against. That is the whole zero-native
      * bootstrap — one sponsored op, after which the account never needs a permit again.
+     *
+     * Returns an outcome rather than a boolean because only "unavailable" may fall back to
+     * a native tx: once the op reached the bundler it may still land, and a native retry
+     * alongside it would delegate twice.
      */
     private setupDelegationViaBundler;
+    /**
+     * Resolves the sponsored delegation op an earlier attempt left unconfirmed, before anything
+     * new is built on its nonce.
+     *
+     * - Its receipt is found: the delegation is confirmed on chain.
+     * - The EntryPoint nonce at `latest` has moved past the op's and the wallet is not delegated:
+     *   the nonce was consumed without delegating, so the op is gone.
+     * - The nonce has not moved, but the bundler definitely no longer holds the op and it is past
+     *   the grace period (see {@link DelegationService.bundlerDroppedOp}): it was dropped, so "gone".
+     * - Anything else, including a lookup or read that failed: still unresolved, so "pending".
+     *   The op may land, and a replacement or a native delegation alongside it would double up.
+     */
+    private resolveUnconfirmedOp;
+    /**
+     * Whether the bundler has definitely dropped an unconfirmed delegation op. Rundler's
+     * `eth_getUserOperationByHash` checks its mempool and then the chain, so a definite `null`
+     * means the op is neither pooled nor landed. That only counts once the op is older than
+     * {@link UNCONFIRMED_OP_GRACE_MS}, so a lookup racing the bundler's own indexing is not read
+     * as a drop, and a failed or ambiguous lookup is not an answer at all.
+     *
+     * A wrong "gone" costs at most one set-code transaction's gas: once a native set-code tx
+     * lands it consumes the EOA nonce the old op's 7702 authorization was signed for, so the
+     * old op can no longer delegate. And "gone" only falls through to the normal setup, which
+     * tries a sponsored op first.
+     */
+    private bundlerDroppedOp;
+    /**
+     * Confirms the delegation at the block a sponsored op's transaction mined in. The public
+     * RPC can lag the bundler's, so the receipt is waited for, bounded by
+     * {@link BUNDLER_RECEIPT_WAIT_TIMEOUT_MS}. A receipt that cannot be read is not evidence
+     * either way, so the wallet's delegation at `latest` decides instead: a delegation that
+     * landed is not reported as failed because the receipt wait timed out.
+     */
+    private confirmBundlerDelegation;
     /**
      * Installs `approve(Permit2, max)` on an account that is ALREADY delegated, using the same
      * permit-funded op the first-time delegation carries — minus the authorization, which it
@@ -923,8 +929,25 @@ declare class DelegationService {
      *
      * With nothing pending — the allowance is already in place — the bundler path goes
      * first as usual. A plain direct tx is the last fallback in every case.
+     *
+     * One operation runs per wallet and chain at a time. Two services delegate the same
+     * wallet (the filler's and the limit-order service's, see
+     * `inFlightDelegationByWallet`), so a second call joins the attempt already in flight
+     * instead of sending a competing op.
      */
     setupDelegation(chain: string): Promise<boolean>;
+    /** The key every per-wallet, per-chain delegation map shares. */
+    private walletKey;
+    /**
+     * Runs one delegation operation under the per-wallet/chain lock.
+     *
+     * A second call of the same operation joins the one in flight (they would do the same
+     * thing). A different operation — a revoke during a setup — queues behind it so the
+     * two never overlap, but still runs: returning the other operation's result would
+     * report a revoke that never happened.
+     */
+    private withDelegationLock;
+    private setupDelegationOnce;
     /** Whether the EOA can pay for one direct set-code tx at the current gas price. */
     private nativeCoversDirectTx;
     /**
@@ -942,9 +965,180 @@ declare class DelegationService {
         results: Record<string, boolean>;
     }>;
     /**
-     * Revokes delegation by delegating to the zero address.
+     * Revokes delegation by delegating to the zero address, under the same per-wallet/chain
+     * lock setupDelegation uses so a revoke and a setup cannot overlap.
      */
     revokeDelegation(chain: string): Promise<boolean>;
+    private revokeDelegationOnce;
+    /** Confirms the EOA's code is empty at the block a revoke tx mined in. */
+    private confirmRevokedAt;
+}
+
+/** A sponsored UserOp the bundler accepted but had no receipt for. */
+interface SubmittedUserOp {
+    kind: "userOp";
+    userOpHash: HexString;
+    /** The EntryPoint nonce and nonce key the op was signed with, for a later `getNonce` check. */
+    nonce: bigint;
+    nonceKey: bigint;
+    /**
+     * Whether the paymaster attached a validity deadline. A Permit2-mode op does, so once its
+     * permit deadline has passed it can no longer land; a PERMIT bootstrap op does not, so it can
+     * land any time until its EntryPoint nonce is consumed.
+     */
+    expires: boolean;
+    /** When the bundler accepted the op, in ms. */
+    submittedAt: number;
+}
+/** A native transaction the node accepted but that got no receipt within the wait. */
+interface SubmittedTx {
+    kind: "tx";
+    txHash: HexString;
+    /**
+     * The wallet nonce the tx was sent with. A node or mempool that no longer lists the tx proves
+     * nothing; the wallet's nonce moving past this one does.
+     */
+    nonce: number;
+    /** When the transaction was sent, in ms. */
+    submittedAt: number;
+}
+
+/**
+ * Raw EIP-7702 authorization, as produced by the delegation flow. Attached to the
+ * bundler UserOp so a not-yet-delegated EOA can be delegated in the same op.
+ */
+interface Eip7702Authorization {
+    chainId: number;
+    address: HexString;
+    nonce: number;
+    r: HexString;
+    s: HexString;
+    yParity: number;
+}
+interface UserOpGasLimits {
+    verificationGasLimit: bigint;
+    callGasLimit: bigint;
+    preVerificationGas: bigint;
+}
+interface SponsoredUserOpRequest {
+    chain: string;
+    /** ERC-7821 batch (or "0x" for a no-op, e.g. delegation). */
+    callData: HexString;
+    /**
+     * Attach when the EOA still needs delegating in this op. Pass a factory rather
+     * than a pre-signed tuple: building paymaster data can send an approve tx from
+     * the authority EOA (the Simplex bootstrap approve to Permit2), and an authorization signed before
+     * that tx embeds a stale nonce the bundler will reject. The factory runs only
+     * after paymaster data is built.
+     */
+    eip7702Auth?: Eip7702Authorization | (() => Promise<Eip7702Authorization>);
+    /** EntryPoint nonce key. Defaults to 0. */
+    nonceKey?: bigint;
+    /**
+     * Explicit gas limits. Provide them to skip bundler estimation — required for
+     * the not-yet-delegated EIP-7702 case, where the account has no code to
+     * simulate so estimation is unreliable. When omitted, limits are estimated.
+     */
+    gas?: UserOpGasLimits;
+    /**
+     * Lets the paymaster fall back to an EIP-2612 permit when the fee token has no
+     * Permit2 allowance yet. Only a first-time delegation sets this — it carries the
+     * `approve(Permit2, max)` in its own callData, so the permit buys the one op that
+     * makes every later Permit2 op possible without native.
+     */
+    permitBootstrap?: boolean;
+}
+/**
+ * Submits self-initiated, paymaster-sponsored UserOperations through the bundler,
+ * so the solver pays gas in stablecoins rather than native token. Shared by the
+ * delegation setup and the vault sweep/redeem paths.
+ *
+ * Submission contract (so callers can safely fall back to a native tx without
+ * risking a double-execution):
+ * - Returns `null` when the op was **never submitted** — paymaster/bundler not
+ *   configured, insufficient USDC, preparation failed (approve tx or signing), the
+ *   bundler rejected `eth_sendUserOperation` outright, the connection could not be
+ *   established, or a post-failure lookup proved the op never entered the pool. The
+ *   caller may fall back to native.
+ * - Returns `{ txHash, userOp }` once a receipt is observed.
+ * - **Throws** {@link SubmittedUnconfirmedError} when the op **was submitted** but no
+ *   receipt arrived, or when its submission could not be determined at all (the send
+ *   response was lost and the lookup could not ask). The caller must NOT fall back (the
+ *   op may still land) — retry on the next cycle, and resolve the op's fate later with
+ *   {@link lookupUserOpReceipt}.
+ * - **Throws** {@link PendingOpOnNonceError} when the bundler refuses the op because an
+ *   earlier op from this sender already holds its EntryPoint nonce ("replacement
+ *   underpriced", "already known"). Not a rejection: that earlier op may still land, so
+ *   the caller must NOT fall back — retry later.
+ */
+declare class UserOpSender {
+    private readonly clientManager;
+    private readonly configService;
+    private readonly signer;
+    private logger;
+    constructor(clientManager: ChainClientManager, configService: FillerConfigService, signer: Signer);
+    /** True when a sponsored UserOp is even possible on this chain (paymaster + bundler configured). */
+    canSponsor(chain: string): boolean;
+    trySendSponsored(req: SponsoredUserOpRequest): Promise<{
+        txHash: HexString;
+        userOp: SubmittedUserOp;
+    } | null>;
+    /**
+     * One `eth_getUserOperationReceipt` for an op this filler submitted. Null when the bundler
+     * does not know it — the op has not been indexed, which is not proof it never landed. Throws
+     * when the bundler could not be asked, so a caller can tell "not found" apart from "couldn't ask".
+     */
+    lookupUserOpReceipt(chain: string, userOpHash: HexString): Promise<{
+        txHash: HexString;
+        success: boolean;
+    } | null>;
+    /**
+     * Whether the bundler still knows an op this filler submitted. Rundler's
+     * `eth_getUserOperationByHash` checks its mempool and then the chain, so `false` is a definite
+     * `null` answer: the op is neither pooled nor landed. Throws when the bundler could not be
+     * asked or answered ambiguously, so a caller can tell "dropped" apart from "couldn't ask".
+     */
+    isUserOpKnown(chain: string, userOpHash: HexString): Promise<boolean>;
+    /**
+     * Estimates account gas limits via the bundler. The op is signed first so the
+     * estimation simulation passes the account's ECDSA validation. Falls back to
+     * generous constants when the bundler estimate is unavailable.
+     */
+    private estimateGas;
+    private buildSignedUserOp;
+    /**
+     * Prices the op for the rundler bundler, as the fill path does: its suggested fees, or the
+     * chain's gas price raised to the priority fee it requires where it suggests none.
+     */
+    private getGasPrice;
+    /**
+     * One bundler JSON-RPC call, used by every request in this class. `timeoutMs` bounds the
+     * request; a failure is thrown as a {@link BundlerCallError} whose `outcome` says whether it
+     * is safe to treat the call as never having reached the bundler — the distinction the send
+     * path relies on to avoid a native resend of an op that may already be submitted.
+     */
+    private sendBundlerRpc;
+    /**
+     * After an ambiguous `eth_sendUserOperation`, asks the bundler whether it actually holds the
+     * op. Rundler's `eth_getUserOperationByHash` checks its mempool and then the chain, so a
+     * non-null result means the op was accepted; a definite `null` on every attempt means it
+     * never entered the pool.
+     *
+     * `lookupDelaysMs` are inter-attempt waits, so the default `[2_000, 5_000, 10_000]` looks up
+     * at about 2 s, 7 s and 17 s after the failed send.
+     *
+     * Returns `"unknown"` when any attempt failed, because that is not proof of absence: a
+     * bundler still validating the op after our request timed out could add it after the last
+     * attempt, and the widening delays exist to shrink that window. Only `"absent"` — a `null`
+     * from every attempt — lets the caller fall back.
+     */
+    private findSubmittedOp;
+    /**
+     * Polls for the op's receipt until `deadlineMs` has elapsed, 2 s apart. Time-based so the
+     * wait cannot stretch with the per-poll timeout; `deadlineMs` and `intervalMs` stay
+     * overridable for tests.
+     */
+    private waitForUserOpReceipt;
 }
 
 /** `[simplex.tunnel]` in the config file. */
@@ -1186,8 +1380,13 @@ interface FillerTomlConfig {
         queue?: QueueConfig;
         logging?: string;
         watchOnly?: boolean | Record<string, boolean>;
-        substratePrivateKey: string;
-        hyperbridgeWsUrl: string;
+        /**
+         * The Hyperbridge account that signs bid extrinsics and holds BRIDGE for their deposits.
+         * Optional: without it the solver bids on the HyperFX orderbook alone.
+         */
+        substratePrivateKey?: string;
+        /** The Hyperbridge WebSocket endpoint bids go to. Required when a key is set. */
+        hyperbridgeWsUrl?: string;
         /**
          * Hyperbridge indexer GraphQL endpoint, used to backfill order details on
          * activity rows recorded before they were captured. Defaults per network
@@ -1214,16 +1413,14 @@ interface FillerTomlConfig {
             maxFeePerGasBumpPercent?: number;
         };
         /**
-         * Overfill protection knobs. Defaults: maxOverfillBps=500, maxConsecutiveClamps=3.
-         * `maxOverfillBps` is warn-only: FXFiller logs a limit order whose offer exceeds
-         * the swapper's ask by more than this, and clamps nothing. `maxConsecutiveClamps`
-         * is accepted but dormant: the clamp that fed it was for Uniswap V4 venue pricing,
-         * which is gone, so FXFiller never halts.
+         * Removed. `[simplex.overfillProtection]` was dropped when the overfill clamp
+         * and the self-halt were taken out. It is no longer read: boot warns when a
+         * config still carries it, and `simplex init` drops it. Not rejected, because
+         * `simplex init` wrote the section uncommented for existing operators, and
+         * refusing it would crash-loop their Docker deployments. Typed `unknown` so
+         * whatever an old file holds still parses.
          */
-        overfillProtection?: {
-            maxOverfillBps?: number;
-            maxConsecutiveClamps?: number;
-        };
+        overfillProtection?: unknown;
         /**
          * How long a signed bid stays executable, in seconds. Defaults to 300 (5 minutes).
          *
@@ -1246,6 +1443,18 @@ interface FillerTomlConfig {
          * order nothing can put a dollar figure on is treated as below it.
          */
         minOrderSizeUsd?: number;
+        /**
+         * The smallest payout, in USD, a partial fill may bid. Defaults to 20.
+         *
+         * A partial fill collects none of the order's fees, and is deliberately exempt from
+         * the fee check and the profit floor: its gas is paid by the margin in the limit
+         * order that prices it. That leaves it with no size floor of its own, so a
+         * near-exhausted limit order, or a wallet just above its gas reserve, used to bid
+         * dust on every matching order — each bid paying fill gas and the relayer fee.
+         * Bids worth less than this are skipped. Set to 0 to bid whatever can be filled.
+         * Full fills are unaffected.
+         */
+        minPartialFillUsd?: number;
         /**
          * Remote access: an outbound SSH tunnel to a rendezvous relay so a phone's
          * SSH client can reach the local web UI. Off unless `enabled = true`; the
@@ -1356,13 +1565,34 @@ declare class TokenSender {
     private readonly userOpSender?;
     /** Only needed to size the paymaster's gas reserve; without it a send reserves nothing. */
     private readonly configService?;
+    /**
+     * Whether the filler's account is EIP-7702-delegated on a chain. A native multi-call
+     * batch is addressed to the account itself, so an undelegated EOA would accept the
+     * transaction and do nothing; without this check the send is reported as done.
+     */
+    private readonly isDelegated?;
     private readonly logger;
     constructor(clientManager: ChainClientManager, solver: HexString, 
     /** Live view of the configured vaults so runtime vault edits are honored. */
     getVaults: () => VaultToml[], userOpSender?: UserOpSender | undefined, 
     /** Only needed to size the paymaster's gas reserve; without it a send reserves nothing. */
-    configService?: FillerConfigService | undefined);
+    configService?: FillerConfigService | undefined, 
+    /**
+     * Whether the filler's account is EIP-7702-delegated on a chain. A native multi-call
+     * batch is addressed to the account itself, so an undelegated EOA would accept the
+     * transaction and do nothing; without this check the send is reported as done.
+     */
+    isDelegated?: ((chain: string) => Promise<boolean>) | undefined);
     send(params: SendTokenParams): Promise<SendTokenResult>;
+    /**
+     * Refuses recipients a transfer can never usefully reach. Each is a well-formed address, so
+     * a mistyped or pasted value would otherwise go out: the zero address and a token's own
+     * contract burn or strand the funds, a vault would take the tokens as a donation to its
+     * share holders, and a native or ERC-20 send to the solver itself only spends gas to move
+     * nothing. Vault shares are the exception to the last: they leave as `redeem(shares, to,
+     * solver)`, so sending them to the solver is how an exact amount is withdrawn into the wallet.
+     */
+    private assertRecipient;
     /**
      * A `withdraw(shortfall, solver, solver)` call against a configured vault on
      * this chain whose underlying is the token being sent and that can cover the
@@ -1381,13 +1611,33 @@ declare class TokenSender {
      * reason to refuse a transfer the operator asked for.
      */
     private vaultWithdrawalCall;
+    /**
+     * One bundler lookup for an op this sender submitted, for a caller that has to settle whether
+     * a placement landed. Null when the bundler does not know the op; throws when it could not be
+     * asked. See {@link UserOpSender.lookupUserOpReceipt}.
+     */
+    userOpReceipt(chain: string, userOpHash: HexString): Promise<{
+        txHash: HexString;
+        success: boolean;
+    } | null>;
     /**
      * Executes a batch from the filler wallet: sponsored UserOp first, native tx
      * when no sponsor is available. Shared by every operator-initiated outbound flow.
+     *
+     * `nonceKey` puts the sponsored op on its own EntryPoint nonce lane (default 0). Two ops on one
+     * key read the same `getNonce`, so a caller that can run alongside another key-0 sender passes
+     * its own. It has no effect on the native fallback.
+     *
+     * A `PendingOpOnNonceError` from the sponsored path is not caught: an earlier op from
+     * this wallet is still pending on the nonce and may land, so a native send of the same calls
+     * could pay twice. It reaches the caller, which waits and retries.
      */
-    submitCalls(chain: string, calls: ERC7821Call[]): Promise<{
+    submitCalls(chain: string, calls: ERC7821Call[], opts?: {
+        nonceKey?: bigint;
+    }): Promise<{
         txHash: HexString;
         sponsored: boolean;
+        submission: SubmittedUserOp | SubmittedTx;
     }>;
     /**
      * The `approve(Permit2, max)` to run first when the wallet has never approved Permit2 for its fee
@@ -1470,6 +1720,8 @@ interface BridgeTopUpDeps {
     substratePublicKey: HexString;
     /** Coprocessor the order's bids are read from. */
     hyperbridge?: Promise<IntentsCoprocessor>;
+    /** Re-reads the filler's BRIDGE balance the moment a delivery lands, for the dashboard. */
+    refreshBridgeBalance?: () => Promise<void>;
     loggers?: Parameters<typeof moduleLogger>[0];
 }
 /**
@@ -1498,6 +1750,8 @@ declare class BridgeTopUp {
      * reading its last statuses when the operator starts the next one, which must not wait.
      */
     private driving;
+    /** Consecutive failed recovery attempts; reset by recorded progress, an operator restart, a long attempt, and a fresh process. */
+    private reclaimFailures;
     constructor(deps: BridgeTopUpDeps);
     get bridgeToken(): HexString;
     /** Loads the stored top-up and resumes driving it when it was left open. Never rejects. */
@@ -1510,6 +1764,14 @@ declare class BridgeTopUp {
     quote(params: BridgeTopUpQuoteParams): Promise<BridgeTopUpQuote>;
     /** Re-quotes, then places and drives the order in the background. Returns its state. */
     start(params: BridgeTopUpQuoteParams): Promise<BridgeTopUpState>;
+    /**
+     * Throws unless the wallet covers the input and the solver fee, net of the paymaster reserve.
+     * The order goes out with `fees: 0n` and the SDK prices the fee only as it places, in the
+     * host's fee token, which the placement batch then approves alongside the input. A wallet that
+     * covers the input alone would revert inside a sponsored op the paymaster still charges for.
+     * The quote here is for this check only; the SDK still prices the fee it places.
+     */
+    private assertCanPay;
     /** Cancels an unfilled order and refunds its escrowed input to the filler wallet. */
     reclaim(): Promise<BridgeTopUpState>;
     /**
@@ -1520,12 +1782,94 @@ declare class BridgeTopUp {
      */
     private place;
     /**
-     * Reads the placement receipt and stores the order as the gateway committed it. Throws
-     * when the transaction placed no order, so the top-up is marked failed.
+     * Reads the placement receipt and stores the order as the gateway committed it, from the
+     * `OrderPlaced` log that names this top-up's session key. A UserOp placement's receipt is a
+     * bundle that can carry other users' placements, so the first log is not necessarily ours.
+     *
+     * A mined receipt with no such log, or one that reverted, is settled: the placement is final
+     * and nothing was escrowed, so it is written `failed` and false is returned. A receipt that
+     * cannot be read throws, so the caller retries or falls back to the chain scan.
      */
     private recordPlacement;
-    /** Continues an order whose placement landed but was not recorded. */
+    /**
+     * Continues a placement whose outcome was never recorded, using every piece of evidence the
+     * chain offers: the tx receipt if there is one, the bundler's receipt for a UserOp, and the
+     * paying chain's own `OrderPlaced` log for this session. It settles the record as failed only
+     * once the batch can no longer land; otherwise it throws so the caller retries.
+     */
     private recoverPlacement;
+    /**
+     * The transaction that placed this order, found on the paying chain rather than from a
+     * receipt: the `OrderPlaced` log whose `session` is this top-up's session key, from the scan
+     * cursor (or the block stored before submission), each an evidence margin lower, up to the latest.
+     * Returns `undefined` when the record predates the scan; a read failure, or a node behind the
+     * range that must be read, throws, so an unread range is never counted as "not found".
+     * `scannedTo` is the height the scan reached, the reference for every later read of the chain.
+     * See {@link scanGatewayEvent} for the margin and the cursor.
+     */
+    private findPlacementLog;
+    /**
+     * The transaction whose `OrderCancelled` log on the paying chain's gateway names this order,
+     * from the cancel's saved cursor (or a margin below `fromBlock`, the height read before the
+     * cancel was sent) up to the latest block. `cancelOrder` emits it on every cancel that succeeds
+     * and the gateway itself is the emitter, however the cancel was submitted; a cancel that
+     * reverted leaves none. Throws on a read failure, so an unread range is never "not found".
+     */
+    private findCancelLog;
+    /**
+     * Scans the paying chain's IntentGateway for an event this top-up emitted, in chunks, and
+     * returns the transaction of the first log `isOurs` accepts. A scan starts an evidence margin
+     * below its saved cursor, not at it, so a page a lagging backend served empty is read again;
+     * the first scan starts that margin below the height read before the send, since that height
+     * came from one backend of a load-balanced endpoint that can be ahead of the one that took
+     * the broadcast. The cursor is saved per chunk, so a scan that fails late resumes where it
+     * got to. It trails the tip by the margin and never decides anything on its own: the evidence
+     * was read up to `scannedTo`, the latest block, the reference for every later read of the chain.
+     * A read failure, or a node behind the range that must be read, throws.
+     */
+    private scanGatewayEvent;
+    /**
+     * Scans a block range in the small chunks public endpoints accept, handing each page to `read`
+     * and stopping at the first page that resolves a value. A failure propagates, so a caller
+     * retries rather than treating an unread range as empty.
+     */
+    private scanLogs;
+    /**
+     * The paying-chain scan (placement and cancel), in chunks wider than BSC's fill search. A chunk a public endpoint
+     * refuses is halved and retried, down to a floor, before the attempt gives up and the caller
+     * retries. `onChunk` runs after each chunk read without a match. Kept separate from
+     * {@link scanLogs} so the BSC fill search is unchanged.
+     */
+    private scanPlacementLogs;
+    /**
+     * Settles a placement with no order on chain. "Nothing was escrowed" is written only on
+     * positive evidence that the batch can no longer land, read an evidence margin (see
+     * {@link evidenceMarginBlocks}) below the height the scan covered, so it is asserted against state every backend agrees on:
+     *
+     * - a native tx whose nonce the wallet has moved past: some other tx took that nonce, and had
+     *   it been ours the scan would have found its `OrderPlaced`. A node that no longer lists the
+     *   tx proves nothing, since one backend or mempool can lack a tx another still holds, so a
+     *   tx this record has a nonce for keeps waiting. A legacy record has none: it takes the
+     *   nonce of a tx the node still lists, and is settled `failed`, unverified, when the node
+     *   does not know the tx, because waiting would block every new top-up for good;
+     * - a UserOp whose EntryPoint nonce was consumed, or whose Permit2 permit expired by the
+     *   timestamp of the block that nonce is read at, not by this host's clock.
+     *
+     * A tx hash that came from the bundler's receipt is never settled as a native tx: a bundle
+     * reorged out can be re-bundled under a different hash, so it falls to the UserOp rules (the
+     * scan would find a re-bundled placement). A tx the node reports with a block number has been
+     * mined, so its receipt will be readable. A bootstrap UserOp has no expiry and stays pending
+     * until its nonce moves or its log appears: it could still land. Inconclusive cases throw, so
+     * the caller retries.
+     */
+    private settleUnplaceable;
+    /**
+     * Whether the order's deadline has passed. The deadline is a block height on the order's
+     * destination (BSC), so it is read there; the gateway rejects a fill only once the height is
+     * strictly past it. An unreadable height is treated as not passed: an order must not be
+     * settled from a read that failed.
+     */
+    private deadlinePassed;
     private resumeDelivery;
     private resumeOrder;
     /** Follows a placed order through bids to a fill, or to its deadline. */
@@ -1547,9 +1891,14 @@ declare class BridgeTopUp {
     private syncDelivery;
     private readDelivery;
     /**
-     * The HyperFungibleToken request the fill dispatched to Hyperbridge. The indexer finds it by
-     * the fill's transaction, as the explorer's search does; the fill's own `Sent` log is the
-     * fallback while the indexer catches up.
+     * The HyperFungibleToken request the fill dispatched to this filler's Hyperbridge account.
+     *
+     * The fill's own receipt is read first and the `Sent` log it carries is taken, because it is
+     * the transaction this order's output call ran in. A bundled fill can carry several HFT sends,
+     * so only logs from the BRIDGE token addressed to this filler's substrate key count; when more
+     * than one matches, the amount the order's output call sends picks the right one. The indexer
+     * finds the request by the fill's transaction too, as the explorer's search does, and is the
+     * fallback only while the receipt cannot be read — and only when it is unambiguous.
      */
     private deliveryRequest;
     /**
@@ -1560,7 +1909,14 @@ declare class BridgeTopUp {
     /**
      * The transaction that filled the order. The executor reports it only for a fill this
      * process selected, so it comes from the indexer, or, while the indexer has yet to reach
-     * BSC's latest blocks, from the gateway's `OrderFilled` log around when the fill was seen.
+     * BSC's latest blocks, from the gateway's `OrderFilled` log.
+     *
+     * The log is searched over the whole range a fill can be in, not around when it was seen: a
+     * fill found late (another filler's, after a restart) landed any time before the deadline. The
+     * range starts where the order became fillable, which placement fixed as the deadline less
+     * {@link ORDER_WINDOW_SECONDS} of BSC blocks (less an evidence margin, since the block time
+     * is measured now and the order was built at an earlier one), and ends at the deadline or the
+     * head. A failed read throws, so the caller retries; it never reads as "no fill".
      */
     private findFill;
     /** The order's statuses as the indexer has them: placed, filled, redeemed or refunded. */
@@ -1572,6 +1928,7 @@ declare class BridgeTopUp {
      */
     sync(): Promise<void>;
     private reconcile;
+    private reconcileRecord;
     /**
      * Submits the request to Hyperbridge with a proof from BSC state. Public BSC endpoints
      * differ in whether they serve `eth_getProof` for recent blocks, so each is tried in turn.
@@ -1586,27 +1943,108 @@ declare class BridgeTopUp {
      * cancel flow from the paying chain (BSC's expiry height finalized, the cancel sent, the
      * cancellation finalized on the source, verified and finalized on Hyperbridge), then the
      * refund. A relayer normally delivers that refund; if none has within a few minutes of
-     * Hyperbridge finalizing, the filler submits Hyperbridge's response itself. Each step is
-     * recorded as it lands, and a restart resumes from the SDK's persisted progress.
+     * Hyperbridge finalizing, the filler submits Hyperbridge's response itself. The cancel pays
+     * the relayer fee in the source host's fee token, and repeated failures, retried on a
+     * backoff, stop the recovery and return the top-up to `unfilled`, where the operator restarts
+     * it from the SDK's saved progress. The refund claim is rebuilt when its calldata is missing or
+     * a claim reverted, since the SDK reports it only once.
      */
     private driveReclaim;
+    /**
+     * The calls that cancel an unfilled order's escrow from its source chain. The cancel carries
+     * no value: the source host pulls the relayer fee from the filler in its fee token, and the
+     * filler wallet holds stablecoins, not the native token the SDK's quote would spend. The fee
+     * is decoded from the SDK's own calldata so the approval matches what the gateway pulls.
+     */
+    private cancelCalls;
+    /**
+     * Whether a submitted cancel landed. Returns its transaction hash when it did, and undefined
+     * when it can no longer land (it reverted, or its nonce was taken by another transaction), so a
+     * new cancel is safe to send. Throws while it could still land, or while the evidence cannot be
+     * read, which keeps the recovery waiting and retrying.
+     *
+     * A duplicate cross-chain cancel does not revert: `_cancelFromSource` checks only the creator
+     * and the height, so a second one dispatches another GET request and pulls the relayer fee
+     * again. A cancel is therefore resent only on positive evidence that it cannot land. The
+     * evidence, strongest first:
+     *
+     * 1. The receipt: a tx's by hash, a UserOp's from the bundler if it answers. A bundler that
+     *    cannot be asked (it lost the op, is down, or its URL was removed) is not fatal.
+     * 2. The paying chain's own `OrderCancelled` log for this order, scanned from the height read
+     *    before the send, which backs the cancel whatever the bundler says. Its transaction is the
+     *    cancel.
+     * 3. With no log up to `scannedTo`, the nonce rules, read an evidence margin below it: the
+     *    wallet's nonce is past a tx's, or the EntryPoint's is past the op's, so some other
+     *    transaction took it; or a Permit2 op's deadline has passed by the chain's own clock.
+     * 4. Anything else waits.
+     */
+    private settleCancel;
+    /** How the fee token reads in an error: USDC/USDT when configured, else its raw address in raw units. */
+    private feeTokenLabel;
     /**
      * Submits Hyperbridge's finalized response to the source chain's ISMP handler, which
      * refunds the escrow, as the Hyperbridge app's "Claim funds" does.
      */
     private claimRefund;
     /**
-     * Whether the escrow is back with the filler, from the source gateway or the indexer's
-     * REFUNDED status; records the refund as the recovery's last step when it is.
+     * Builds Hyperbridge's finalized response for the cancel's GET request again, from the SDK's
+     * own snapshot of it. The SDK reports the calldata once, proven at the height known then;
+     * this is what replaces calldata that reverted or was never saved.
+     */
+    private rebuildClaim;
+    /** The cancel's GET request: as recorded, else read back from the cancel's receipt. */
+    private cancelCommitment;
+    /** The GET request the IntentGateway on `chain` dispatched through its host, among a cancel receipt's logs. */
+    private cancelRequestCommitment;
+    /**
+     * Whether there is nothing left to reclaim: the escrow is back with the filler, as the source
+     * gateway reports it, which is recorded as the recovery's last step. The indexer's REFUNDED
+     * status only supplies that step's tx hash and time: it is not evidence on its own.
+     * `isOrderRefunded` reads the escrow and is true for an empty one, including an order that was
+     * never placed, so it only counts for a record whose placement was seen (`commitment`).
+     *
+     * An empty escrow is also what a fill leaves: `IntentsBase._withdraw` releases it for a redeem
+     * too. So before calling it a refund the order's fill is checked on BSC ({@link filledByOther}),
+     * and an order that filled moves to `delivering` instead (also true, since the reclaim has
+     * nothing to do).
+     *
+     * An escrow read that fails reads as "not refunded" so the reclaim goes on to the cancel; a
+     * caller that records an outcome from the answer passes `strict` to have it throw instead.
      */
     private refunded;
+    /**
+     * Whether someone other than the order's creator took the order on BSC. The gateway's
+     * `_filled[commitment]` cannot tell a fill from a refund by itself: a fill sets it to the
+     * filler, but `IntentsBase._withdraw` sets it to the beneficiary on every finalising
+     * withdrawal, and a destination-side cancel sets it to `order.user`. A same-chain top-up's own
+     * cancel, or a third party's, therefore leaves it non-zero, so only an address that is not the
+     * creator counts as a fill (`isOrderFilled` in the SDK would count both). A read that fails
+     * throws: neither `reclaimed` nor `delivering` is recorded from a value that was not read.
+     */
+    private filledByOther;
     private hasRecoveryStep;
-    /** Records a recovery step once, at the time it landed (or now). */
+    /**
+     * Records a recovery step once, at the time it landed (or now). `also` is written in the same
+     * update, for what a restart must never see without the step.
+     */
     private recordRecoveryStep;
-    /** Runs one background flow for the record; a failure is recorded rather than thrown. */
+    /**
+     * Schedules a retry in `delayMs` ({@link DELIVERY_RETRY_MS} unless given), but only while the
+     * record it was scheduled for is still the current one. A timer from a finished top-up must
+     * never drive the next one: a top-up the operator started after this record was replaced has
+     * its own state to protect.
+     */
+    private scheduleRetry;
+    /**
+     * Runs one background flow for the record; a failure is recorded rather than thrown. Every
+     * write the flow makes, its failure handling included, is bound to this record.
+     */
     private drive;
+    private driveRecord;
     /** Keeps what the executor reported, for the timeline's offers and its links. */
     private recordEvent;
+    /** Whether the calling flow was started for a record that has since been replaced. */
+    private superseded;
     private update;
     private persist;
     private buildOrder;
@@ -1684,30 +2122,36 @@ interface StoredBid {
     /** The order was seen filled on-chain, so this bid can never win — reclaim its deposit now. */
     dead: boolean;
     /**
-     * What this bid holds against the operator's limit orders, at 1e18, in the
-     * order the payout draws on them. Empty for a bid placed before limit orders
-     * priced anything, and empty again once the hold has been settled, whether it
-     * was released because the bid lost or converted because the bid filled.
+     * The HyperFX orderbook took this bid, so a swapper can execute it whatever Hyperbridge said.
+     * The orderbook serves a bid for its TTL and nothing withdraws it, so this never changes; the
+     * bid is live there until its op's `validUntil`. False for a bid the orderbook refused or was
+     * not offered, and for rows from before bids went to the orderbook.
+     */
+    onOrderbook: boolean;
+    /**
+     * The limit order that priced this bid and the terms it signed, written when the bid is stored
+     * and never changed. Null for a bid no limit order priced.
      *
-     * More than one when a swap drew on several levels: the orderbook quotes a
-     * same-chain swapper across every level that can fill the trade together, so a
-     * bid may be meeting several of the operator's own orders at once.
+     * Provenance only: nothing is held against the order. The order's on-chain budget refuses a
+     * fill past its cap, and settlement re-reads that budget rather than doing arithmetic on this.
      */
-    reservations: LimitOrderHold[];
+    pricedBy: BidPricing | null;
 }
-/** One limit order and what a bid holds against it, at 1e18. */
-interface LimitOrderHold {
+/** The limit order a bid drew on and what the bid signed against it. */
+interface BidPricing {
     limitOrderId: string;
-    amount: string;
+    /** The output the bid offered to pay, at 1e18. */
+    payout: string;
     /**
-     * The take the bid signed beside `amount`, in the input token's raw units. With it, settlement
-     * works out what the gateway charged: the escrow it released at `amount / take`. Holds recorded
-     * before bids carried their own rate have none.
+     * The take the bid signed beside `payout`, in the input token's raw units. With it, settlement
+     * works out what the gateway charged: the escrow it released at `payout / take`, and which of
+     * several bids on one order a fill executed. Bids recorded before bids carried their own rate
+     * have none.
      */
     take?: string;
     /**
      * The input token's decimals on the order's source chain, which is where `take` and the escrow
-     * a fill releases are counted. With it, settlement records what a fill took in at 1e18. Holds
+     * a fill releases are counted. With it, settlement records what a fill took in at 1e18. Bids
      * recorded before fills kept their input have none.
      */
     takeDecimals?: number;
@@ -1722,18 +2166,22 @@ interface BidInsert {
      * from the same account, lands after it and reclaims its deposit all the same.
      */
     bid?: string;
-    /** What this bid holds against the limit orders that priced it, best first. */
-    reservations?: LimitOrderHold[];
+    /** The limit order that priced this bid; see {@link StoredBid.pricedBy}. */
+    pricedBy?: BidPricing;
     extrinsicHash?: string;
     blockHash?: string;
     success: boolean;
     /** Submission is still in the pool; see {@link StoredBid.pending}. */
     pending?: boolean;
     error?: string;
+    /** The orderbook holds this bid; see {@link StoredBid.onOrderbook}. */
+    onOrderbook?: boolean;
 }
 interface BidStats {
     total: number;
+    /** Bids a venue took: Hyperbridge, or the orderbook alone. */
     successful: number;
+    /** Bids no venue took. */
     failed: number;
     retracted: number;
     /** Deposits still locked: successful or pending, and not yet retracted. */
@@ -1772,35 +2220,29 @@ interface BidStore {
      *
      * Resolves false when no unretracted bid matched (already retracted, or never
      * stored) — the caller treats that as success, not an error.
-     */
-    markRetracted(commitment: string, retractExtrinsicHash: string | null): Promise<boolean>;
-    /** Flags a bid dead (its order was filled on-chain). False when nothing matched. */
-    markDead(commitment: string): Promise<boolean>;
-    /**
-     * Takes what this bid holds, exactly once, and returns it.
      *
-     * A losing bid gives its holds back and a winning one converts them into
-     * draw-downs, and both routes end at the same bid row — a bid that won is still
-     * retracted eventually, by the stale sweep, so an unguarded release would undo
-     * a conversion that already happened. Whichever settles first claims them here;
-     * the other gets an empty list and does nothing.
+     * With `rows` (the {@link StoredBid.id}s) only those bids are marked: a retraction
+     * closes the bids it sent retractions for, not one stored on the commitment while it
+     * was in flight. Without, every unretracted bid on the commitment is marked. An empty
+     * `rows` marks nothing.
      */
+    markRetracted(commitment: string, retractExtrinsicHash: string | null, rows?: readonly number[]): Promise<boolean>;
     /**
-     * Takes the holds off a bid, exactly once, and hands them to the caller.
-     *
-     * With a `bid` it claims that one bid; without, every outstanding hold on the
-     * commitment, which is what a filled or dead order needs so no bid's hold is
-     * left behind.
+     * Flags a bid dead, so the sweep retries its retraction next cycle rather than after
+     * the TTL: its order was filled on-chain, or a retraction selected it and could not
+     * close it. With `rows` (the {@link StoredBid.id}s) only those bids are flagged;
+     * without, every unretracted bid on the commitment. An empty `rows` flags nothing.
+     * False when nothing matched.
      */
-    claimReservation(commitment: string, bid?: string): Promise<LimitOrderHold[]>;
+    markDead(commitment: string, rows?: readonly number[]): Promise<boolean>;
     /**
-     * Every bid that drew on a limit order, newest first. What makes a `remaining`
-     * explicable to the operator: which bids took the difference.
+     * Every bid a limit order priced, newest first, from each bid's `pricedBy`. What
+     * makes a `remaining` explicable to the operator: which bids drew on the order.
      */
     byLimitOrder(limitOrderId: string, limit?: number): Promise<StoredBid[]>;
     /** Newest first. Implementations should cap `limit` at a few hundred. */
     recent(limit?: number): Promise<StoredBid[]>;
-    /** Failed bids, newest first — for debugging. */
+    /** Bids no venue took (neither Hyperbridge nor the orderbook), newest first — for debugging. */
     failed(limit?: number): Promise<StoredBid[]>;
     byDateRange(from: Date, to: Date): Promise<StoredBid[]>;
     stats(): Promise<BidStats>;
@@ -1965,8 +2407,6 @@ interface LimitOrder {
     size: string;
     /** Output not yet delivered. */
     remaining: string;
-    /** Output promised to bids that have neither filled nor been retracted. */
-    reserved: string;
     /** Source chains this order accepts swaps from. Never empty. */
     acceptedSources: string[];
     /** TTL written into each posting. */
@@ -2026,15 +2466,8 @@ interface LimitOrderPosting {
     lastError: string | null;
 }
 /**
- * Persistent record of the operator's limit orders.
- *
- * This is inventory, not a cache: `remaining` and `reserved` are what stop two
- * chains from paying out the same liability twice, so a store that loses writes
- * overcommits real money.
- */
-/**
- * One fill that drew a limit order down: kept apart from the bid that priced it, whose
- * holds are cleared on settlement, so an order keeps its history across every resize.
+ * One fill of a limit order, kept apart from the bid row so an order keeps its history
+ * across every resize and repost.
  */
 interface LimitOrderFill {
     id: number;
@@ -2052,6 +2485,12 @@ interface LimitOrderFill {
     amountIn: string | null;
     /** The fill's transaction on the order's fill chain, when the event carried it. */
     transactionHash: string | null;
+    /**
+     * Which log of that transaction the fill is. One transaction can carry several of our
+     * fills, so the hash alone does not name one. Null for a fill recorded before this was
+     * kept, and for one whose event carried none.
+     */
+    logIndex: number | null;
     /** SQLite-style "YYYY-MM-DD HH:MM:SS" in UTC. */
     filledAt: string;
 }
@@ -2062,6 +2501,7 @@ interface LimitOrderFillInsert {
     amount: string;
     amountIn?: string | null;
     transactionHash?: string | null;
+    logIndex?: number | null;
 }
 /**
  * A fill with the terms of the order it drew on: what profitability is worked out from. The
@@ -2079,6 +2519,13 @@ interface LimitOrderFillRecord {
     amountIn: string | null;
     filledAt: string;
 }
+/**
+ * Persistent record of the operator's limit orders.
+ *
+ * `remaining` follows the order's on-chain budget, which is what actually refuses a fill
+ * past the order's size: it is lowered to that budget after each fill and by the periodic
+ * tally reconciliation, and never raised.
+ */
 interface LimitOrderStore {
     create(order: LimitOrderInsert): Promise<LimitOrder>;
     get(id: string): Promise<LimitOrder | null>;
@@ -2096,51 +2543,30 @@ interface LimitOrderStore {
     setPosting(id: string, posting: LimitOrderPosting, only?: readonly LimitOrderStatus[]): Promise<LimitOrder | null>;
     setStatus(id: string, status: LimitOrderStatus, lastError?: string | null, only?: readonly LimitOrderStatus[]): Promise<LimitOrder | null>;
     /**
-     * Adds `amount` to `reserved`, but only while the order is `open` and
-     * `remaining` covers this one hold. Resolves false when it does not.
+     * Lowers an `open` or `resizing` order's `remaining` to `room`, what the solver's
+     * account on chain will still pay for this order, at 1e18. Never raises it.
+     * Returns the order when it was lowered, null otherwise, including for an order in
+     * any other status.
      *
-     * Other bids' holds do not count against it: a pending bid must not stop the
-     * next one going out, so the limit order bounds each bid and what fills draw
-     * down, not the sum of bids still waiting. The hold is bookkeeping, turned into
-     * a draw-down if the bid wins and given back if it loses. The write is still
-     * guarded on the `reserved` it read, so two holds landing together both count.
-     */
-    reserve(id: string, amount: string): Promise<boolean>;
-    /** Gives a reservation back, after a bid was retracted, lost or found dead. */
-    release(id: string, amount: string): Promise<void>;
-    /**
-     * Works the order down by output that has actually been delivered, floored at
-     * zero. Returns the order as it now stands, or null when there is none.
-     */
-    drawDown(id: string, amount: string): Promise<LimitOrder | null>;
-    /**
-     * Lowers an `open` order's `remaining` to `room + reserved`, where `room` is
-     * what the solver's account on chain will still pay for this order, at 1e18.
-     * Never raises it. Returns the order when it was lowered, null otherwise.
+     * `only` narrows the statuses it may act on, like `setStatus` and `setPosting` take;
+     * it never widens them, so a status other than `open` or `resizing` is never clamped.
+     * Both callers pass it, because the two statuses mean different things. A repost
+     * holds a row in `resizing` and lowers it to the tally before it posts, so that call
+     * passes `["resizing"]`: a store that refused `resizing` would have the repost
+     * advertise the pre-fill size. A fill's sync starts a repost of its own after it
+     * lowers the row, so it passes `["open"]`: a row a repost already holds is left to
+     * it, and two reposts of one row would orphan a book entry.
      *
-     * `reserved` is added back because a fill the chain has already counted, but
-     * that has not been drawn down here yet, still holds its amount there until it
-     * settles. Clamping to `room` alone would take that fill off twice.
+     * A custom store must apply the status check and the write atomically: a row that
+     * moved to another status after the caller read it is left as it is.
      */
-    clampRemaining(id: string, room: string): Promise<LimitOrder | null>;
-    /** Records a fill against its limit order. Called alongside the draw-down it explains. */
+    clampRemaining(id: string, room: string, only?: readonly LimitOrderStatus[]): Promise<LimitOrder | null>;
+    /** Records a fill against its limit order, for its history and profit. */
     recordFill(fill: LimitOrderFillInsert): Promise<void>;
     /** Every fill of every limit order, oldest first, each with its order's terms. */
     fillHistory(): Promise<LimitOrderFillRecord[]>;
     /** A limit order's fills, newest first. */
     fills(limitOrderId: string, limit?: number): Promise<LimitOrderFill[]>;
-    /**
-     * Runs `settle` as one unit where the backend can.
-     *
-     * A fill claims what its bid held, works the orders down by what went out and
-     * gives the rest back, and a crash between those leaves the hold released
-     * against an order that was never drawn down. The bid rows live in the same
-     * database as the limit orders, which is what lets one transaction cover both.
-     *
-     * Only store calls belong inside: they are synchronous underneath, so nothing
-     * else interleaves on the connection, which would not hold for a network call.
-     */
-    transaction<T>(settle: () => Promise<T>): Promise<T>;
 }
 /** Operator state that must survive a restart. */
 interface RuntimeState {
@@ -2167,8 +2593,59 @@ interface StoredBridgeTopUp {
     sessionPrivateKey?: HexString;
     commitment?: HexString;
     placeTxHash?: HexString;
+    /**
+     * The wallet nonce a native placement tx was sent with. Only the wallet's nonce moving past it
+     * shows the tx can no longer be mined; a node that forgot the tx shows nothing.
+     */
+    placeTxNonce?: number;
+    /**
+     * The placement UserOp the bundler accepted when its receipt never arrived. The batch may have
+     * been mined, so the record stays pending and the op is looked up again; without it a restart
+     * would declare that nothing was escrowed while the order could still be live.
+     */
+    placeUserOpHash?: HexString;
+    /** The EntryPoint `nonce` the op was signed with, as a decimal string (the record is JSON-persisted). */
+    placeUserOpNonce?: string;
+    /** The EntryPoint `nonceKey` the op was signed with, as a decimal string. */
+    placeUserOpNonceKey?: string;
+    /**
+     * Whether a UserOp placement's paymaster attached a validity deadline (Permit2 mode). A
+     * bootstrap op has none, so it can still land; without this a restart cannot tell them apart.
+     */
+    placeUserOpExpires?: boolean;
+    /**
+     * When the placement batch was submitted, in ms. Dates a UserOp's permit window. Records from
+     * before this was recorded are dated by `stageTimes.placing`, then `createdAt`; `updatedAt` is
+     * rewritten by every save, so it never ages.
+     */
+    placeSubmittedAt?: number;
+    /**
+     * The order's session-key address, matched against `OrderPlaced.session`. A placement receipt
+     * can carry other users' placements (a UserOp is a bundle), so only the log naming this address
+     * is this top-up's.
+     */
+    placeSession?: HexString;
+    /** Block the paying chain was at before the placement was submitted, as a decimal string; the scan starts here. */
+    placeFromBlock?: string;
+    /**
+     * The next block a recovery scan reads, as a decimal string. Saved after each chunk and trailing
+     * the tip by the evidence margin; the next scan starts a margin below it, so a page a lagging
+     * backend served empty is read again.
+     */
+    placeScannedTo?: string;
     fillTxHash?: HexString;
+    /**
+     * The cancel's transaction. With no `reclaimSubmission` it is a cancel whose send was confirmed
+     * (the only way it was ever written before submissions were kept), and is handed to the SDK as is.
+     */
     reclaimTxHash?: HexString;
+    /**
+     * The cancel as submitted, kept until the `ORDER_CANCELED` step is recorded. It is settled from
+     * on-chain evidence before the SDK is handed a hash or a new cancel is sent: a duplicate
+     * cross-chain cancel does not revert, it dispatches another GET request and pays the relayer fee
+     * again. See {@link StoredSubmission}.
+     */
+    reclaimSubmission?: StoredSubmission;
     /** The HyperFungibleToken request that carries the BRIDGE to Hyperbridge. */
     deliveryCommitment?: HexString;
     /** The Hyperbridge extrinsic that delivered it, when this filler relayed it. */
@@ -2185,12 +2662,37 @@ interface StoredBridgeTopUp {
     deliveryStatuses?: DeliveryStatus[];
     /** The unfilled order's recovery, step by step, as the SDK's cancel flow reported it. */
     recoverySteps?: RecoveryStepRecord[];
+    /** The GET request a cross-chain cancel dispatched; Hyperbridge answers it with the refund response. */
+    getCommitment?: HexString;
     /** Hyperbridge's finalized response, which refunds the escrow when submitted on the source. */
     claimCalldata?: HexString;
     /** The filler's own refund claim, when no relayer delivered it in time. */
     claimTxHash?: HexString;
     error?: string;
 }
+/**
+ * A submission as kept in the JSON state: bigints as decimal strings, plus the evidence window of
+ * the chain scan that settles it.
+ */
+type StoredSubmission = ({
+    kind: "tx";
+    txHash: HexString;
+    nonce: number;
+    submittedAt: number;
+} | {
+    kind: "userOp";
+    userOpHash: HexString;
+    nonce: string;
+    nonceKey: string;
+    /** Whether the paymaster attached a validity deadline; see {@link StoredBridgeTopUp.placeUserOpExpires}. */
+    expires: boolean;
+    submittedAt: number;
+}) & {
+    /** The paying chain's height, read before the send, as a decimal string; the evidence scan starts a margin below it. */
+    fromBlock: string;
+    /** The next block the scan reads, as a decimal string; see {@link StoredBridgeTopUp.placeScannedTo}. */
+    scannedTo?: string;
+};
 interface RecoveryStepRecord {
     step: "DESTINATION_FINALIZED" | "ORDER_CANCELED" | "SOURCE_FINALIZED" | "HYPERBRIDGE_DELIVERED" | "HYPERBRIDGE_FINALIZED" | "FUNDS_CLAIMED";
     /** When the step completed, in ms. */
@@ -2294,4 +2796,4 @@ interface InventoryStore {
     since(from: Date): Promise<InventorySnapshot[]>;
 }
 
-export { type LimitOrderPosting as $, type ActivityStore as A, type BidStore as B, ChainClientManager as C, type DerivingSigner as D, type AuthorizationRequest as E, FillerConfigService as F, type BidInsert as G, type BinanceConfig as H, type InventoryStore as I, type CurveConfig as J, type CurvePoint as K, LoggerContext as L, type MpcVaultSignerConfig as M, type Eip7702Authorization$1 as N, type OrderHistoryPage as O, type FillerConfigFile as P, type InventorySnapshot as Q, type ResolvedChainConfig as R, type SignerConfig as S, type TurnkeySignerConfig as T, UserOpSender as U, type VaultToml as V, type WalletTx as W, type LimitOrderFillInsert as X, type LimitOrderFillRecord as Y, type LimitOrderHold as Z, type LimitOrderInsert as _, type Signer as a, type LimitOrderSide as a0, type LimitOrderStatus as a1, type Logger as a2, type OperatorNotification as a3, type PrivateKeySignerConfig as a4, type QueueConfig as a5, type RuntimeState as a6, type SignerTransaction as a7, SignerType as a8, type TypedDataPayload as a9, USD_STABLE_SYMBOLS as aa, type UserProvidedChainConfig as ab, type VaultTomlConfig as ac, type WalletTxKind as ad, addLogSink as ae, assertConfirmationCoverage as af, configureLogger as ag, formatChainKey as ah, getLogger as ai, isRegistrySymbol as aj, normalizeSymbol as ak, parseChainKey as al, registrySymbols as am, validateAssetDefinitions as an, validateConfig as ao, validateVaultToml as ap, type OrderSummary as aq, type Signature as b, type SecretPhraseSignerConfig as c, type ActivityInsert as d, type ActivityEvent as e, type LimitOrderStore as f, AssetRegistry as g, DelegationService as h, type LimitOrder as i, type LimitOrderFilter as j, type SimplexDataStore as k, ConfirmationPolicy as l, type FillerTomlConfig as m, TokenSender as n, BridgeTopUp as o, type AssetDefinition as p, type ChainConfirmationPolicy as q, type LimitOrderFill as r, type StoredBid as s, type RebalancingConfig as t, type LogSink as u, type BidStats as v, type AllowlistConfig as w, type LogLevel as x, type StateStore as y, type ActivityType as z };
+export { type LimitOrderPosting as $, type ActivityStore as A, type BidStore as B, ChainClientManager as C, type DerivingSigner as D, type AuthorizationRequest as E, FillerConfigService as F, type BidInsert as G, type BidPricing as H, type InventoryStore as I, type BinanceConfig as J, type CurveConfig as K, LoggerContext as L, type MpcVaultSignerConfig as M, type CurvePoint as N, type OrderHistoryPage as O, type Eip7702Authorization$1 as P, type FillerConfigFile as Q, type ResolvedChainConfig as R, type SignerConfig as S, type TurnkeySignerConfig as T, UserOpSender as U, type VaultToml as V, type WalletTx as W, type InventorySnapshot as X, type LimitOrderFillInsert as Y, type LimitOrderFillRecord as Z, type LimitOrderInsert as _, type Signer as a, type LimitOrderSide as a0, type LimitOrderStatus as a1, type Logger as a2, type OperatorNotification as a3, type PrivateKeySignerConfig as a4, type QueueConfig as a5, type RuntimeState as a6, type SignerTransaction as a7, SignerType as a8, type TypedDataPayload as a9, USD_STABLE_SYMBOLS as aa, type UserProvidedChainConfig as ab, type VaultTomlConfig as ac, type WalletTxKind as ad, addLogSink as ae, assertConfirmationCoverage as af, configureLogger as ag, formatChainKey as ah, getLogger as ai, isRegistrySymbol as aj, normalizeSymbol as ak, parseChainKey as al, registrySymbols as am, validateAssetDefinitions as an, validateConfig as ao, validateVaultToml as ap, type OrderSummary as aq, type Signature as b, type SecretPhraseSignerConfig as c, DelegationService as d, type ActivityInsert as e, type ActivityEvent as f, type LimitOrderStore as g, AssetRegistry as h, type LimitOrder as i, type LimitOrderFilter as j, type SimplexDataStore as k, ConfirmationPolicy as l, type FillerTomlConfig as m, TokenSender as n, BridgeTopUp as o, type AssetDefinition as p, type ChainConfirmationPolicy as q, type LimitOrderFill as r, type StoredBid as s, type RebalancingConfig as t, type LogSink as u, type BidStats as v, type AllowlistConfig as w, type LogLevel as x, type StateStore as y, type ActivityType as z };