@hyperbridge/simplex 0.18.1 → 0.18.3

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { EventEmitter } from 'node:events';
-import { HexString, ERC7821Call, IntentsCoprocessor, Order, TokenInfo, ChainConfig, ExecutionResult, IntentGateway, FillOptions, FillerConfig } from '@hyperbridge/sdk';
-import { S as SignerConfig, a as Signer, b as Signature, D as DerivingSigner, c as SecretPhraseSignerConfig, M as MpcVaultSignerConfig, T as TurnkeySignerConfig, C as ChainClientManager, F as FillerConfigService, U as UserOpSender, L as LoggerContext, A as ActivityStore, d as ActivityInsert, e as ActivityEvent, O as OrderHistoryPage, W as WalletTx, f as LimitOrderStore, g as AssetRegistry, h as DelegationService, i as LimitOrder, j as LimitOrderFilter, B as BidStore, k as SimplexDataStore, l as ConfirmationPolicy, R as ResolvedChainConfig, m as FillerTomlConfig, V as VaultToml, n as TokenSender, o as BridgeTopUp, p as AssetDefinition, q as ChainConfirmationPolicy, r as LimitOrderFill, s as StoredBid, t as RebalancingConfig, u as LogSink, v as BidStats, w as AllowlistConfig, x as LogLevel, y as StateStore, I as InventoryStore } from './types-6MEltdkX.js';
-export { z as ActivityType, E as AuthorizationRequest, G as BidInsert, H as BinanceConfig, J as CurveConfig, K as CurvePoint, N as Eip7702Authorization, P as FillerConfigFile, Q as InventorySnapshot, X as LimitOrderFillInsert, Y as LimitOrderFillRecord, Z as LimitOrderHold, _ as LimitOrderInsert, $ as LimitOrderPosting, a0 as LimitOrderSide, a1 as LimitOrderStatus, a2 as Logger, a3 as OperatorNotification, a4 as PrivateKeySignerConfig, a5 as QueueConfig, a6 as RuntimeState, a7 as SignerTransaction, a8 as SignerType, a9 as TypedDataPayload, aa as USD_STABLE_SYMBOLS, ab as UserProvidedChainConfig, ac as VaultTomlConfig, ad as WalletTxKind, ae as addLogSink, af as assertConfirmationCoverage, ag as configureLogger, ah as formatChainKey, ai as getLogger, aj as isRegistrySymbol, ak as normalizeSymbol, al as parseChainKey, am as registrySymbols, an as validateAssetDefinitions, ao as validateConfig, ap as validateVaultToml } from './types-6MEltdkX.js';
+import { HexString, ERC7821Call, IntentsCoprocessor, Order, TokenInfo, ChainConfig, BidSubmissionResult, ExecutionResult, IntentGateway, FillOptions, FillerConfig } from '@hyperbridge/sdk';
+import { S as SignerConfig, a as Signer, b as Signature, D as DerivingSigner, c as SecretPhraseSignerConfig, M as MpcVaultSignerConfig, T as TurnkeySignerConfig, C as ChainClientManager, F as FillerConfigService, U as UserOpSender, d as DelegationService, L as LoggerContext, A as ActivityStore, e as ActivityInsert, f as ActivityEvent, O as OrderHistoryPage, W as WalletTx, g as LimitOrderStore, h as AssetRegistry, i as LimitOrder, j as LimitOrderFilter, B as BidStore, k as SimplexDataStore, l as ConfirmationPolicy, R as ResolvedChainConfig, m as FillerTomlConfig, V as VaultToml, n as TokenSender, o as BridgeTopUp, p as AssetDefinition, q as ChainConfirmationPolicy, r as LimitOrderFill, s as StoredBid, t as RebalancingConfig, u as LogSink, v as BidStats, w as AllowlistConfig, x as LogLevel, y as StateStore, I as InventoryStore } from './types-CW6STIE7.js';
+export { z as ActivityType, E as AuthorizationRequest, G as BidInsert, H as BidPricing, J as BinanceConfig, K as CurveConfig, N as CurvePoint, P as Eip7702Authorization, Q as FillerConfigFile, X as InventorySnapshot, Y as LimitOrderFillInsert, Z as LimitOrderFillRecord, _ as LimitOrderInsert, $ as LimitOrderPosting, a0 as LimitOrderSide, a1 as LimitOrderStatus, a2 as Logger, a3 as OperatorNotification, a4 as PrivateKeySignerConfig, a5 as QueueConfig, a6 as RuntimeState, a7 as SignerTransaction, a8 as SignerType, a9 as TypedDataPayload, aa as USD_STABLE_SYMBOLS, ab as UserProvidedChainConfig, ac as VaultTomlConfig, ad as WalletTxKind, ae as addLogSink, af as assertConfirmationCoverage, ag as configureLogger, ah as formatChainKey, ai as getLogger, aj as isRegistrySymbol, ak as normalizeSymbol, al as parseChainKey, am as registrySymbols, an as validateAssetDefinitions, ao as validateConfig, ap as validateVaultToml } from './types-CW6STIE7.js';
 import { EventEmitter as EventEmitter$1 } from 'events';
 import { Decimal } from 'decimal.js';
 import * as _circle_fin_bridge_kit from '@circle-fin/bridge-kit';
@@ -28,10 +28,15 @@ interface FundingVenue {
      * from LP positions on `destChain`. Returns the calls and the credited
      * amount that will become available after execution.
      *
+     * `alreadyPlanned` is what the caller's current evaluation has already
+     * planned from this venue for this token on this chain, and is taken off
+     * what the venue can release. It is the caller's to keep; the venue holds
+     * nothing between calls.
+     *
      * Access is serialised per chain via a mutex so concurrent evaluations
      * do not race on shared liquidity state.
      */
-    planWithdrawalForToken(destChain: string, solver: HexString, tokenOutLower: string, amountNeeded: bigint, deadlineTimestamp?: bigint): Promise<FundingPlanResult>;
+    planWithdrawalForToken(destChain: string, solver: HexString, tokenOutLower: string, amountNeeded: bigint, deadlineTimestamp?: bigint, alreadyPlanned?: bigint): Promise<FundingPlanResult>;
     /**
      * Wallet balance of `tokenLower` the fill must keep liquid and never source
      * from — the vault's `minBalance` floor, reserved for gas/paymaster paid in
@@ -85,7 +90,7 @@ interface VaultBalancePosition {
     decimals: number;
     /** Solver-owned vault position in underlying-asset terms. */
     positionAssets: bigint;
-    /** Immediately withdrawable amount after pending-fill reservations. */
+    /** Immediately withdrawable amount: the vault's `maxWithdraw(solver)`. */
     availableAssets: bigint;
     /** Underlying amount deliberately kept liquid in the solver wallet. */
     walletReserve: bigint;
@@ -252,7 +257,7 @@ interface AssetBalanceRow {
     walletReserve: number;
     /** Total solver-owned underlying represented by vault shares. */
     vaultPosition: number;
-    /** Vault assets that can be withdrawn now, after pending-fill reservations. */
+    /** Vault assets that can be withdrawn now: the vault's `maxWithdraw(solver)`. */
     vaultAvailable: number;
     /** Wallet plus vault position. Null when any required source was unavailable. */
     total: number | null;
@@ -327,6 +332,14 @@ declare class BalanceProvider extends EventEmitter {
     refresh(): Promise<BalanceSnapshot>;
     private collectChain;
     private addConfiguredStable;
+    private hyperbridgeAccount?;
+    /**
+     * Re-reads the filler's BRIDGE balance on Hyperbridge, outside the once-a-minute interval:
+     * a BRIDGE top-up calls it the moment its delivery lands, so the dashboard's reload shows
+     * the new balance. A failed read leaves the last snapshot in place. No-op while tracking
+     * is not initialized (no Hyperbridge key).
+     */
+    refreshHyperbridgeBalance(): Promise<void>;
     private trackHyperbridgeBalance;
 }
 
@@ -503,6 +516,13 @@ declare class VaultFundingPlanner implements FundingVenue {
     private readonly clientManager;
     private config;
     private readonly userOpSender?;
+    /**
+     * Read-only EIP-7702 check for the native-tx fallback. A vault batch is an
+     * `executeBatch` on the solver account, so it only does anything once the EOA is
+     * delegated to that account; sent to a codeless EOA it succeeds and moves nothing.
+     * Left out, the fallback is sent unchecked (library callers without a signer).
+     */
+    private readonly delegation?;
     private readonly logger;
     name: string;
     private stateByChain;
@@ -525,7 +545,14 @@ declare class VaultFundingPlanner implements FundingVenue {
      * sponsored UserOps (gas paid in USDC) where the chain supports it, falling back
      * to a native EOA tx. Omit to always use native txs.
      */
-    constructor(clientManager: ChainClientManager, config: VaultOutputFundingConfig, userOpSender?: UserOpSender | undefined);
+    constructor(clientManager: ChainClientManager, config: VaultOutputFundingConfig, userOpSender?: UserOpSender | undefined, 
+    /**
+     * Read-only EIP-7702 check for the native-tx fallback. A vault batch is an
+     * `executeBatch` on the solver account, so it only does anything once the EOA is
+     * delegated to that account; sent to a codeless EOA it succeeds and moves nothing.
+     * Left out, the fallback is sent unchecked (library callers without a signer).
+     */
+    delegation?: Pick<DelegationService, "isDelegated"> | undefined);
     /** Invoked after each submitted sweep/redeem batch so wallet history can record it. */
     onTx?: (tx: {
         chain: string;
@@ -555,9 +582,9 @@ declare class VaultFundingPlanner implements FundingVenue {
     initialise(solver: HexString): Promise<void>;
     refresh(chain?: string): Promise<void>;
     /**
-     * Returns a coherent read-only view of every configured vault. Refreshing
-     * under the same per-chain mutex used by withdrawal planning ensures the
-     * displayed availability includes all live pending-fill reservations.
+     * Returns a coherent read-only view of every configured vault, refreshed
+     * under the same per-chain mutex withdrawal planning uses. Availability is
+     * the vault's own `maxWithdraw(solver)`.
      */
     getBalanceSnapshot(requestedChain?: string): Promise<VaultBalancePosition[]>;
     /**
@@ -570,8 +597,13 @@ declare class VaultFundingPlanner implements FundingVenue {
      * Produces a single `vault.withdraw` ERC-7821 call that sends up to
      * `amountNeeded` of `tokenOutLower` to the solver, capped by the vault's
      * `maxWithdraw`. Returns a no-op when no configured vault holds the token.
+     *
+     * `maxWithdraw` is read afresh for every plan, less `alreadyPlanned`: what
+     * the caller's own evaluation has planned from this vault so far. Nothing is
+     * held back across evaluations: a plan whose withdrawal another evaluation's
+     * fill has already spent reverts its batch on chain, which is the accepted cost.
      */
-    planWithdrawalForToken(destChain: string, solver: HexString, tokenOutLower: string, amountNeeded: bigint, _deadlineTimestamp?: bigint): Promise<FundingPlanResult>;
+    planWithdrawalForToken(destChain: string, solver: HexString, tokenOutLower: string, amountNeeded: bigint, _deadlineTimestamp?: bigint, alreadyPlanned?: bigint): Promise<FundingPlanResult>;
     /**
      * Starts the periodic sweep timer. Runs one sweep shortly after start, then
      * every `sweepIntervalMs`. Idempotent — a second call is a no-op.
@@ -601,7 +633,9 @@ declare class VaultFundingPlanner implements FundingVenue {
      *
      * The sponsored path only falls back to native when the op was **never
      * submitted**; a submitted-but-unconfirmed op throws so a native resend can't
-     * double-execute the batch (the caller's timer logs and retries next cycle).
+     * double-execute the batch (the caller's timer logs and retries next cycle). So does a
+     * `PendingOpOnNonceError`: an earlier op from this wallet still holds the nonce, which is
+     * "not now", never a reason to send natively.
      */
     private submitBatch;
     /**
@@ -816,413 +850,774 @@ declare class EventMonitor extends EventEmitter$1 {
     stopListening(): Promise<void>;
 }
 
-/**
- * An execution outcome that can also report a still-pooled bid.
- *
- * `submitBid` can time out with the extrinsic still in Hyperbridge's pool. That
- * is neither success nor failure: the extrinsic may yet land and reserve a
- * deposit, so the bid record has to be reclaimable even though `success` is
- * false. Widened here rather than on the SDK's `ExecutionResult` so simplex does
- * not need an unreleased SDK.
- */
-interface FillResult extends ExecutionResult {
-    pending?: boolean;
-    /**
-     * The identifier Hyperbridge files the bid under, once its op was built:
-     * `keccak256` of its calldata. It tells the bids on one order apart, and retracting the bid names it.
-     */
-    bid?: HexString;
+interface Book {
+    id: string;
+    base: string;
+    quote: string;
 }
-
-interface FillerStrategy {
-    name: string;
-    canFill(order: Order): Promise<boolean>;
-    calculateProfitability(order: Order): Promise<number>;
-    executeOrder(order: Order, hyperbridge?: IntentsCoprocessor): Promise<FillResult>;
-    /**
-     * Optional hook for strategies to provide a USD value for the full input basket.
-     * Returns null when the strategy cannot or does not want to price the order.
-     */
-    getOrderUsdValue?(order: Order): Promise<{
-        inputUsd: Decimal;
-    } | null>;
-    /**
-     * Optional confirmation policy for this strategy.
-     * If absent, no confirmation waiting is required (e.g. same-chain strategies).
-     */
-    confirmationPolicy?: {
-        getConfirmationBlocks: (chainId: number, amountUsd: number) => number;
-    };
+/** Live price levels. All prices and sizes are decimal integer strings at 1e18. */
+interface OrderbookLevel {
+    fillChain: string;
+    priceBucket: string;
+    price: string;
+    worstPrice: string;
+    baseSize: string;
+    quoteSize: string;
+    orderCount: number;
+    solverCount: number;
 }
-
-/** Symbol and decimals for a token on a chain, as far as the filler knows them. */
-interface TokenDescription {
-    symbol: string | null;
-    decimals: number | null;
+interface OrderbookSnapshot extends Book {
+    /** Best first: bids descending, asks ascending. */
+    bids: OrderbookLevel[];
+    asks: OrderbookLevel[];
+    /** True backing liquidity, in quote for bids and base for asks. */
+    bidLiquidity: string;
+    askLiquidity: string;
+    /** Price bucket width, quote per 1 base at 1e18; null when the orderbook does not report one. */
+    granularity: string | null;
 }
-/** Resolves display metadata for `token` (20-byte address) on `chain` (state machine id). */
-type TokenDescriber = (chain: string, token: string) => Promise<TokenDescription>;
-interface ActivityRecorderOptions {
-    /**
-     * Enriches order legs with symbol/decimals so the feed can show "19,585 USDC"
-     * rather than a raw integer. Omit to record addresses and raw amounts only.
-     */
-    describeToken?: TokenDescriber;
+/** One solver's order inside a price level. Prices and sizes are decimal integer strings at 1e18. */
+interface OrderbookLevelOrder {
+    solver: string;
+    commitment: string;
+    fillChain: string;
+    price: string;
+    /** What the order publishes as depth, in the token its side pays out: quote for bids, base for asks. */
+    advertisedSize: string;
+    /** The signed output before any balance cap, in the same token as `advertisedSize`. */
+    quotedAmount: string;
+    /** True when the solver's balance, not the quote, binds `advertisedSize`. */
+    resized: boolean;
+    expiresAt: string;
+    acceptedSources: string[];
 }
-/**
- * Bridges the filler's order lifecycle onto an {@link ActivityStore}.
- *
- * The store used to subscribe to the `EventMonitor` itself, which meant a
- * consumer implementing the data interface also had to know about the filler's
- * internal event names. Ownership is inverted here: the recorder listens, the
- * store just receives rows.
- *
- * Writes are fire-and-forget — the activity feed is observability, and a failed
- * insert must never propagate back into the fill path that emitted it. Each
- * stored row is re-emitted as `event` for live consumers (the UI's SSE stream,
- * and `Simplex`'s `activity` event).
- */
-declare class ActivityRecorder extends EventEmitter {
-    private store;
-    private logger;
-    private monitor?;
-    private handlers;
-    private describeToken?;
-    /** Order summaries by order id, so filled/skipped rows carry the order too. Insertion-ordered for eviction. */
-    private summaries;
-    constructor(store: ActivityStore, loggers?: LoggerContext, options?: ActivityRecorderOptions);
-    /** Subscribes to the filler's order lifecycle events. Idempotent per monitor. */
-    attach(monitor: EventMonitor): void;
-    private subscribe;
-    /** Unsubscribes from the attached monitor. Safe to call when never attached. */
-    detach(): void;
-    private remember;
-    private summaryFor;
-    /**
-     * Settles an order from its on-chain fill: `filled` when this filler won it,
-     * `lost` (reason = the winner) when a rival did. A rival's fill is recorded
-     * only for orders this filler has rows for — every fill on the chain passes
-     * through here, and the feed is about this filler's orders.
-     */
-    private settle;
-    /**
-     * Captures the order for the feed. Token metadata lookups may hit the chain;
-     * a failure degrades that leg to address + raw amount rather than dropping the row.
-     */
-    private summarize;
+interface OrderbookLevelQuery {
+    side: "BID" | "ASK";
+    fillChain: string;
+    priceBucket: string;
+    sourceChain?: string;
+}
+interface OrderbookFilters {
+    sourceChain?: string;
+    fillChain?: string;
+}
+interface TokenMinSize {
+    symbol: string;
+    size: string;
+}
+interface ServerInfo {
+    minOrderTtlSecs: number;
+    heartbeatIntervalSecs: number;
+    signatureSkewSecs: number;
+    maxBatchSize: number;
+    minOrderSizes: TokenMinSize[];
     /**
-     * Writes an event and emits the stored row. Never rejects — a failed write is
-     * logged and dropped, because the caller is usually a fill in progress.
+     * Every chain the orderbook serves, by state machine id: the chains orders
+     * fill on, and the source chains they may declare.
      */
-    record(event: ActivityInsert): void;
-    recent(limit?: number, beforeId?: number): Promise<ActivityEvent[]>;
-    fills(limit?: number): Promise<ActivityEvent[]>;
-    orderHistory(page: number, pageSize: number): Promise<OrderHistoryPage>;
-    recordWalletTx(tx: Omit<WalletTx, "id" | "ts">): Promise<void>;
-    walletTxs(limit?: number): Promise<WalletTx[]>;
+    chains: string[];
+    eip712DomainName: string;
+    eip712DomainVersion: string;
 }
-
-/** Self-halt visibility/reset for one FX strategy (overfill protection). */
-interface HaltControl {
-    index: number;
-    isHalted(): boolean;
-    resetHalt(): void;
+/** One token on one chain, as the orderbook's own registry has it. */
+interface ChainToken {
+    symbol: string;
+    /** Its decimals there: USDC and USDT carry 18 on BNB Chain and 6 on the rest. */
+    decimals: number;
 }
-
-/** What a limit order may pay out over its whole life, as the fill chain enforces it. */
-interface LimitOrderBudget {
-    budgetId: HexString;
-    /** The order's whole size in the output token's own units. */
-    cap: bigint;
-    /** The token the order pays on its fill chain. */
-    token: HexString;
+/** One chain the orderbook serves, with the tokens it registers on it. */
+interface ChainInfo {
+    /** State machine id, such as `EVM-8453`. */
+    id: string;
+    name: string;
+    tokens: ChainToken[];
 }
-
-interface SwapCall {
-    to: string;
-    data: string;
-    value: string;
+/** `serverInfo`, `books` and `chains` together, which is how simplex reads them. */
+interface OrderbookLimits {
+    serverInfo: ServerInfo;
+    books: Book[];
+    chains: ChainInfo[];
 }
-interface CachedPairClassification {
-    inputIsStable: boolean;
-    stableToken: string;
-    exoticToken: string;
+interface PostedOrder {
+    commitment: HexString;
+    side: "BID" | "ASK";
+    status: "ACTIVE" | "SUSPENDED";
+    price: string;
+    quotedAmount: string;
+    advertisedSize: string;
+    expiresAt: string;
+    acceptedSources: string[];
+    /** The balance, not the quote, is what binds `advertisedSize`. */
+    resized?: boolean;
+    /**
+     * Whether the solver's balance covers the whole quote. Also false before any
+     * balance has been read, which is why {@link PostedOrder.validatedAt} decides
+     * whether a false here means anything.
+     */
+    backed?: boolean;
+    /**
+     * The last cycle that read this order's balance, absent until one has. An
+     * order surfaces at its quoted size meanwhile.
+     */
+    validatedAt?: string | null;
 }
 /**
- * One bid: what a single limit order pays for an incoming order, and what funds it.
+ * Every code the orderbook's `RejectionCode` enum can send, listed rather than
+ * written as a union so a test can hold it against the published schema.
  *
- * An order that several limit orders can serve produces several of these, one per
- * order, each priced against the whole input at its own rate. They are never
- * summed: each bid is its own fill, and the gateway clamps whichever one lands
- * against what is still outstanding.
+ * Why the orderbook refuses an order. `MIN_ORDER_SIZE`, `TTL_TOO_SHORT` and
+ * `UNSUPPORTED_SOURCE_CHAIN` are prevented by validation before posting, the last
+ * against the chains the server serves and the tokens its registry lists on each;
+ * `REPLAYED` and `ORDER_EXISTS` are answered by bumping the nonce; the rest are
+ * encoding bugs on our side.
  */
-interface BidPlan {
-    limitOrderId: string;
-    /** The order leg this bid fills; every other leg is quoted at zero. */
-    leg: number;
-    /** What this bid draws from that limit order, at 1e18. */
-    payout: bigint;
-    /** The outputs the bid signs, in the output token's own units. */
-    fillerOutputs: TokenInfo[];
-    /** The take signed beside each output: the escrow this bid's fill earns. */
-    fillerInputs: TokenInfo[];
-    /** The decimals `fillerInputs[leg]` is counted in: the input token's, on the order's source chain. */
-    inputDecimals?: number;
-    fundingCalls: ERC7821Call[];
-    partialFill: boolean;
-    profit: number;
-    /** That limit order's budget, which the bid settles against on the fill chain. */
-    budget?: LimitOrderBudget;
-}
-declare class CacheService {
-    private cacheData;
-    private readonly CACHE_EXPIRY_MS;
-    private logger;
-    constructor(loggers?: LoggerContext);
-    private isCacheValid;
-    private cleanupStaleData;
-    getGasEstimate(orderId: string): {
-        totalCostInSourceFeeToken: bigint;
-        relayerFeeInSourceFeeToken: bigint;
-        dispatchFee: bigint;
-        callGasLimit: bigint;
-        verificationGasLimit: bigint;
-        preVerificationGas: bigint;
-        maxFeePerGas: bigint;
-        maxPriorityFeePerGas: bigint;
-        totalGasCostWei: bigint;
-    } | null;
-    setGasEstimate(orderId: string, totalCostInSourceFeeToken: bigint, relayerFeeInSourceFeeToken: bigint, dispatchFee: bigint, callGasLimit: bigint, verificationGasLimit: bigint, preVerificationGas: bigint, maxFeePerGas: bigint, maxPriorityFeePerGas: bigint, totalGasCostWei: bigint): void;
-    getSwapOperations(orderId: string): {
-        calls: SwapCall[];
-        totalGasEstimate: bigint;
-    } | null;
-    setSwapOperations(orderId: string, calls: SwapCall[], totalGasEstimate: bigint): void;
-    getFillerOutputs(orderId: string): {
-        token: HexString;
-        amount: bigint;
-    }[] | null;
-    /** The takes cached with the order's filler outputs, or null when absent or stale. */
-    getFillerInputs(orderId: string): {
-        token: HexString;
-        amount: bigint;
-    }[] | null;
+declare const REJECTION_CODES: readonly ["MALFORMED_USER_OP", "NO_FILL_ORDER", "UNSUPPORTED_CHAIN", "UNSUPPORTED_SHAPE", "NOT_PHANTOM", "TTL_TOO_SHORT", "UNSUPPORTED_PAIR", "BAD_SIGNATURE", "BAD_NONCE_BINDING", "REPLAYED", "ORDER_EXISTS", "TOO_MANY_ORDERS", "MIN_ORDER_SIZE", "MISSING_DECLARATION", "EMPTY_DECLARATION", "UNSUPPORTED_SOURCE_CHAIN", "NO_LIMIT_ORDER", "TOO_MANY_BIDS"];
+type RejectionCode = (typeof REJECTION_CODES)[number];
+/**
+ * Why the orderbook could not decide an op at all. Ingest reads no chain, so it
+ * is the database or the submission running out of time, and both are worth
+ * another attempt.
+ */
+declare const FAILURE_CODES: readonly ["DATABASE_UNAVAILABLE", "TIMEOUT"];
+type FailureCode = (typeof FAILURE_CODES)[number];
+type SubmitOrderResult = {
+    kind: "accepted";
+    order: PostedOrder;
+    surfaced: boolean;
+} | {
+    kind: "unchanged";
+    order: PostedOrder;
+} | {
+    kind: "rejected";
+    code: RejectionCode;
+    message: string;
+} | {
+    kind: "failed";
+    code: FailureCode | "REQUEST_FAILED";
+    message: string;
+    retryable: boolean;
+};
+/**
+ * A bid on a swapper's order as the orderbook holds it, under the order's commitment. Amounts
+ * and the price are decimal strings at 1e18.
+ */
+interface PostedBid {
+    commitment: HexString;
+    /** Which of the order's legs the bid quotes, from 0. */
+    leg: number;
+    side: "BID" | "ASK";
+    fillChain: string;
+    sourceChain: string;
+    /** The rate the bid signed, quote per 1 base, before the protocol fee. */
+    price: string;
+    amountIn: string;
+    amountOut: string;
+    /** ISO-8601: when the orderbook stops serving the bid (`receivedAt` plus `serverInfo.bidTtlSecs`). */
+    expiresAt: string;
+}
+/**
+ * The orderbook's answer to a bid. `unchanged` is the same op posted again while its bid is
+ * still live, which changed nothing; a bid is served until its TTL and cannot be withdrawn.
+ */
+type SubmitBidResult = {
+    kind: "accepted";
+    bid: PostedBid;
+} | {
+    kind: "unchanged";
+    bid: PostedBid;
+} | {
+    kind: "rejected";
+    code: RejectionCode;
+    message: string;
+} | {
+    kind: "failed";
+    code: FailureCode | "REQUEST_FAILED";
+    message: string;
+    retryable: boolean;
+};
+/** Why a signed message was refused, shared by `cancelOrder` and `heartbeat`. */
+declare const MESSAGE_REJECTION_CODES: readonly ["BAD_SIGNATURE", "SOLVER_MISMATCH", "SIGNATURE_EXPIRED", "SIGNATURE_REUSED", "UNKNOWN_ORDER", "UNKNOWN_SOLVER"];
+type MessageRejectionCode = (typeof MESSAGE_REJECTION_CODES)[number];
+type SolverStatus = "ACTIVE" | "SUSPENDED";
+type HeartbeatResult = {
+    kind: "accepted";
+    status: SolverStatus;
+    reactivatedOrders: number;
+    heartbeatDueBy: string;
+} | {
+    kind: "rejected";
+    code: MessageRejectionCode;
+    message: string;
+};
+/** One page of the solver's own orders, as reconciliation walks them. */
+interface PostedOrderPage {
+    orders: PostedOrder[];
+    /** Cursor for the next page, absent on the last one. */
+    cursor?: string;
+    status: SolverStatus;
+}
+type CancelOrderResult = {
+    kind: "cancelled";
+    commitment: HexString;
+} | {
+    kind: "rejected";
+    code: MessageRejectionCode;
+    message: string;
+}
+/**
+ * The request never got an answer. Distinct from `UNKNOWN_ORDER`, which is the
+ * orderbook saying the entry is already gone: here the entry may well still be
+ * live, and a caller that treats the two alike orphans it.
+ */
+ | {
+    kind: "failed";
+    message: string;
+};
+
+/**
+ * Talks to one HyperFX orderbook over GraphQL.
+ *
+ * Stateless apart from the endpoint and timeout. Every method either returns the
+ * orderbook's own answer, including its refusals, or throws
+ * {@link OrderbookRequestError} because it could not get one.
+ */
+declare class OrderbookClient {
+    private readonly requestTimeoutMs;
+    private logger;
+    /** The configured endpoint, with `/graphql` if it was left off. */
+    private readonly url;
+    constructor(url: string, requestTimeoutMs: number, loggers?: LoggerContext);
+    /** The limits to validate against before posting, plus the books on offer. */
+    limits(): Promise<OrderbookLimits>;
+    /** The public book across all solvers, restricted to the selected route. */
+    snapshot(id: string, filters?: OrderbookFilters): Promise<OrderbookSnapshot | null>;
     /**
-     * The budget of the limit order that priced the outputs cached for this order, or
-     * null when no limit order did.
-     *
-     * Kept on the same entry as the outputs, so the two are replaced and expire
-     * together: a bid can never sign one limit order's payout beside another's budget.
+     * The orders behind one price level. The orderbook filters orders by side and route but not by
+     * price bucket, so this walks the side's orders on the level's fill chain and keeps the bucket.
+     * Null when the book does not exist.
      */
-    getBidBudget(orderId: string): LimitOrderBudget | null;
-    setFillerOutputs(orderId: string, outputs: {
-        token: HexString;
-        amount: bigint;
-    }[], inputs?: {
-        token: HexString;
-        amount: bigint;
-    }[], budget?: LimitOrderBudget): void;
+    levelOrders(id: string, level: OrderbookLevelQuery): Promise<OrderbookLevelOrder[] | null>;
+    submitOrder(userOp: HexString): Promise<SubmitOrderResult>;
     /**
-     * The limit order this order was priced against, and the payout it allowed.
-     *
-     * Carried from `calculateProfitability` to the bid so the reservation lands on
-     * the same limit order the price came from. A fill later finds it through the
-     * bid row, not through here.
+     * Posts a bid on a swapper's order: the signed fill UserOp, SCALE-encoded, exactly as it goes
+     * to Hyperbridge. The orderbook verifies it as it does a limit order, except that it need not
+     * be phantom and carries no TTL, and accepts it only from a solver holding an active limit
+     * order on the leg's book filling on the order's destination (`NO_LIMIT_ORDER`). It serves
+     * the bid under the order's commitment for `serverInfo.bidTtlSecs`; there is no withdrawing
+     * it before then.
      */
-    getMatchedLimitOrder(orderId: string): {
-        limitOrderId: string;
-        payout: bigint;
-    }[];
-    getBidPlans(orderId: string): BidPlan[];
-    setBidPlans(orderId: string, plans: BidPlan[]): void;
-    clearBidPlans(orderId: string): void;
-    setMatchedLimitOrder(orderId: string, holds: {
-        limitOrderId: string;
-        payout: bigint;
-    }[]): void;
-    getPairClassifications(orderId: string): CachedPairClassification[] | null;
-    setPairClassifications(orderId: string, pairs: CachedPairClassification[]): void;
-    getFundingPrepends(orderId: string): {
-        calls: ERC7821Call[];
-    } | null;
-    setFundingPrepends(orderId: string, calls: ERC7821Call[]): void;
-    clearFundingPrepends(orderId: string): void;
+    submitBid(userOp: HexString): Promise<SubmitBidResult>;
     /**
-     * Whether the strategy's completed evaluation of this order chose a partial fill.
+     * The entry this solver holds at `commitment`, or null when it holds none.
      *
-     * Only ever written by an evaluation that went on to return a fillable answer,
-     * and cleared at the start of every evaluation — so a refusal can never leave a
-     * `true` behind for the caller to act on.
+     * What tells `ORDER_EXISTS` from `REPLAYED`: the first means a live entry is
+     * already sitting there, and posting again on a new nonce would put a second
+     * one behind the same liability.
      */
-    isPartialFill(orderId: string): boolean;
-    setPartialFill(orderId: string, partial: boolean): void;
-    clearPartialFill(orderId: string): void;
+    orderAt(solver: HexString, commitment: HexString): Promise<PostedOrder | null>;
+    cancelOrder(params: {
+        solver: HexString;
+        commitment: HexString;
+        timestamp: number;
+        signature: HexString;
+    }): Promise<CancelOrderResult>;
+    heartbeat(params: {
+        solver: HexString;
+        timestamp: number;
+        signature: HexString;
+    }): Promise<HeartbeatResult>;
     /**
-     * Whether the strategy's completed evaluation let a bid through without holding
-     * `order.fees` to the execution cost, because the order is at or above the
-     * operator's minimum size.
+     * One page of the solver's own orders as the orderbook holds them.
      *
-     * Written and cleared the way {@link isPartialFill} is, for the same reason: the
-     * caller exempts such an order from its profit floor.
+     * A solver the orderbook has never accepted an order from is not an error:
+     * it answers with no solver at all, which reads here as an empty page.
      */
-    isFeeCheckWaived(orderId: string): boolean;
-    setFeeCheckWaived(orderId: string, waived: boolean): void;
-    clearFeeCheckWaived(orderId: string): void;
-    getFeeTokenWithDecimals(chain: string): {
-        address: HexString;
-        decimals: number;
-    } | null;
-    setFeeTokenWithDecimals(chain: string, address: HexString, decimals: number): void;
-    getTokenDecimals(chain: string, tokenAddress: HexString): number | null;
-    setTokenDecimals(chain: string, tokenAddress: HexString, decimals: number): void;
-    getSolverSelection(chain: string): boolean | null;
-    setSolverSelection(chain: string, active: boolean): void;
+    myOrders(solver: HexString, after?: string): Promise<PostedOrderPage>;
+    private request;
 }
 
-/** What a bid's batch needs to settle its limit order's budget. */
-interface BudgetSettlement {
-    budget: LimitOrderBudget;
-    /** The solver's account, which is the only caller `debitOrder` accepts. */
-    solverAccount: HexString;
-}
-declare class ContractInteractionService {
-    private clientManager;
-    private configService;
-    cacheService: CacheService;
-    private logger;
-    private sdkHelperCache;
-    private blockTimes;
-    private solverAccountAddress;
-    private signer;
-    constructor(clientManager: ChainClientManager, configService: FillerConfigService, signer: Signer, sharedCacheService?: CacheService);
+/**
+ * Where a bid goes. A strategy builds the signed fill op and hands it here; the venues decide
+ * who receives it. The filler passes one of these to `FillerStrategy.executeOrder`.
+ */
+interface BidPlacer {
     /**
-     * The endpoint SDK helpers should use for `chain`: the first configured RPC,
-     * matching the one viem's `fallback` transport tries first.
+     * @param commitment - The swap order the bid is on.
+     * @param userOp - The signed fill UserOp, SCALE-encoded: the same bytes every venue takes.
+     * @param bid - The identifier Hyperbridge files the bid under, `keccak256` of its calldata.
      */
-    private primaryRpcUrl;
+    place(commitment: HexString, userOp: HexString, bid: HexString): Promise<BidPlacement>;
+}
+/** What each venue said. A venue the bid was not sent to is absent. */
+interface BidPlacement {
+    /** Hyperbridge's answer: the extrinsic landed, is pooled, or failed. */
+    hyperbridge?: BidSubmissionResult;
+    /** The HyperFX orderbook's answer. */
+    orderbook?: SubmitBidResult;
+}
+
+/**
+ * An execution outcome that can also report a still-pooled bid, and what the orderbook said.
+ *
+ * `success`, `txHash`, `pending` and `error` are Hyperbridge's answer. `submitBid` can time out
+ * with the extrinsic still in Hyperbridge's pool. That is neither success nor failure: the
+ * extrinsic may yet land and reserve a deposit, so the bid record has to be reclaimable even
+ * though `success` is false. Widened here rather than on the SDK's `ExecutionResult` so simplex
+ * does not need an unreleased SDK.
+ *
+ * A bid goes to the HyperFX orderbook as well, and to it alone when the filler holds no BRIDGE
+ * for the Hyperbridge deposit; `orderbook` is that venue's answer. A bid the orderbook holds is
+ * live whatever Hyperbridge said.
+ */
+interface FillResult extends ExecutionResult {
+    pending?: boolean;
     /**
-     * Gets the SDK helper for a given source and destination chain.
-     * Instances are cached and reused to avoid redundant RPC calls.
+     * The identifier Hyperbridge files the bid under, once its op was built:
+     * `keccak256` of its calldata. It tells the bids on one order apart, and retracting the bid names it.
      */
-    getIntentGateway(source: string, destination: string): Promise<IntentGateway>;
-    /**
-     * Best-effort cache warm-up. Deliberately never rejects: this runs unawaited from the
-     * constructor, so a rejection would surface as an unhandled rejection and take the
-     * process down. A failed prewarm only means the value is fetched on first use, where
-     * `getTokenDecimals` is strict — which is the right place for strictness, because
-     * there it can skip a single order instead of killing the filler at boot.
-     */
-    initCache(): Promise<void>;
-    getCache(): CacheService;
-    /**
-     * Gets the decimals for a token
-     */
-    getTokenDecimals(tokenAddress: string, chain: string): Promise<number>;
+    bid?: HexString;
+    /** The orderbook's answer; absent when the bid was not offered to it. */
+    orderbook?: SubmitBidResult;
+}
+interface FillerStrategy {
+    name: string;
+    canFill(order: Order): Promise<boolean>;
+    calculateProfitability(order: Order): Promise<number>;
     /**
-     * Estimates gas for filling an order and caches the full estimate for bid preparation
+     * Places the strategy's bid on `order` through `bids`, the venues the filler bids on
+     * (Hyperbridge and the HyperFX orderbook). Without `bids` the destination selects no
+     * solver, so there is nothing to bid on.
      */
-    estimateGasFillPost(order: Order): Promise<{
-        totalCostInSourceFeeToken: bigint;
-        relayerFeeInSourceFeeToken: bigint;
-        dispatchFee: bigint;
-        callGasLimit: bigint;
-    }>;
+    executeOrder(order: Order, bids?: BidPlacer): Promise<FillResult>;
     /**
-     * The call gas a bid needs: the shared estimate plus room for the funding calls
-     * this bid prepends and for settling its limit order's budget.
-     *
-     * Funding calls are not simulated (the V4 PositionManager's flash accounting does
-     * not resolve in the bundler's estimation context), so each one adds a fixed
-     * allowance for its modifyLiquidities + take. They differ between the bids on one
-     * order, since each draws on its own limit order and so on its own funding, which
-     * is why this is worked out per bid rather than baked into the cached estimate.
-     * The estimate is of a lone fillOrder, so the budget call is not in it either.
+     * Optional hook for strategies to provide a USD value for the full input basket.
+     * Returns null when the strategy cannot or does not want to price the order.
      */
-    private callGasLimitFor;
+    getOrderUsdValue?(order: Order): Promise<{
+        inputUsd: Decimal;
+    } | null>;
     /**
-     * Gets the fee token address and decimals for a given chain.
-     *
-     * @param chain - The chain identifier to get fee token info for
-     * @returns An object containing the fee token address and its decimal places
+     * Optional confirmation policy for this strategy.
+     * If absent, no confirmation waiting is required (e.g. same-chain strategies).
      */
-    getFeeTokenWithDecimals(chain: string): Promise<{
-        address: HexString;
-        decimals: number;
-    }>;
+    confirmationPolicy?: {
+        getConfirmationBlocks: (chainId: number, amountUsd: number) => number;
+    };
+}
+
+/** Symbol and decimals for a token on a chain, as far as the filler knows them. */
+interface TokenDescription {
+    symbol: string | null;
+    decimals: number | null;
+}
+/** Resolves display metadata for `token` (20-byte address) on `chain` (state machine id). */
+type TokenDescriber = (chain: string, token: string) => Promise<TokenDescription>;
+interface ActivityRecorderOptions {
     /**
-     * Tops up the solver's EntryPoint deposit so it covers at least
-     * `targetGasUnits` at the current gas price. Skips if the wallet
-     * balance cannot afford at least 1M gas units (not enough to send txs).
-     *
-     * @param chain - The chain identifier
-     * @param targetGasUnits - Gas units the deposit should cover (default 3M)
-     * @param thresholdGasUnits - Only top up if deposit is below this many gas units (defaults to targetGasUnits)
+     * Enriches order legs with symbol/decimals so the feed can show "19,585 USDC"
+     * rather than a raw integer. Omit to record addresses and raw amounts only.
      */
-    topUpEntryPointDeposit(chain: string, targetGasUnits?: bigint, thresholdGasUnits?: bigint): Promise<void>;
+    describeToken?: TokenDescriber;
+}
+/**
+ * Bridges the filler's order lifecycle onto an {@link ActivityStore}.
+ *
+ * The store used to subscribe to the `EventMonitor` itself, which meant a
+ * consumer implementing the data interface also had to know about the filler's
+ * internal event names. Ownership is inverted here: the recorder listens, the
+ * store just receives rows.
+ *
+ * Writes are fire-and-forget — the activity feed is observability, and a failed
+ * insert must never propagate back into the fill path that emitted it. Each
+ * stored row is re-emitted as `event` for live consumers (the UI's SSE stream,
+ * and `Simplex`'s `activity` event).
+ */
+declare class ActivityRecorder extends EventEmitter {
+    private store;
+    private logger;
+    private monitor?;
+    private handlers;
+    private describeToken?;
+    /** Order summaries by order id, so filled/skipped rows carry the order too. Insertion-ordered for eviction. */
+    private summaries;
+    constructor(store: ActivityStore, loggers?: LoggerContext, options?: ActivityRecorderOptions);
+    /** Subscribes to the filler's order lifecycle events. Idempotent per monitor. */
+    attach(monitor: EventMonitor): void;
+    private subscribe;
+    /** Unsubscribes from the attached monitor. Safe to call when never attached. */
+    detach(): void;
+    private remember;
+    private summaryFor;
     /**
-     * Calculates the total USD value of an order's inputs.
-     * Only stable (USDC/USDT) inputs contribute; non-stables contribute 0.
-     *
-     * @param order - The order to calculate input value for
-     * @returns The total USD value of inputs (sum of normalized stable amounts, or 0 if none)
+     * Settles an order from its on-chain fill: `filled` when this filler won it,
+     * `lost` (reason = the winner) when a rival did. A rival's fill is recorded
+     * only for orders this filler has rows for — every fill on the chain passes
+     * through here, and the feed is about this filler's orders.
      */
-    getInputUsdValue(order: Order): Promise<Decimal>;
+    private settle;
     /**
-     * Checks if solver selection mode is active on the destination chain
-     * When active, fillers must submit bids to Hyperbridge instead of filling directly
-     *
-     * @param chain - The chain identifier to check
-     * @returns True if solver selection is active
+     * Captures the order for the feed. Token metadata lookups may hit the chain;
+     * a failure degrades that leg to address + raw amount rather than dropping the row.
      */
-    isSolverSelectionActive(chain: string): Promise<boolean>;
+    private summarize;
     /**
-     * Reads the solver account's deposit balance on the ERC-4337 EntryPoint.
+     * Writes an event and emits the stored row. Never rejects — a failed write is
+     * logged and dropped, because the caller is usually a fill in progress.
      */
-    /** What `holder` holds of an ERC-20 on `chain`, in the token's own units. */
-    getTokenBalance(chain: string, token: HexString, holder: HexString): Promise<bigint>;
+    record(event: ActivityInsert): void;
+    recent(limit?: number, beforeId?: number): Promise<ActivityEvent[]>;
+    fills(limit?: number): Promise<ActivityEvent[]>;
+    orderHistory(page: number, pageSize: number): Promise<OrderHistoryPage>;
+    recordWalletTx(tx: Omit<WalletTx, "id" | "ts">): Promise<void>;
+    walletTxs(limit?: number): Promise<WalletTx[]>;
+}
+
+/** What a limit order may pay out over its whole life, as the fill chain enforces it. */
+interface LimitOrderBudget {
+    budgetId: HexString;
+    /** The order's whole size in the output token's own units. */
+    cap: bigint;
+    /** The token the order pays on its fill chain. */
+    token: HexString;
+}
+
+interface SwapCall {
+    to: string;
+    data: string;
+    value: string;
+}
+interface CachedPairClassification {
+    inputIsStable: boolean;
+    stableToken: string;
+    exoticToken: string;
+}
+/**
+ * One bid: what a single limit order pays for an incoming order, and what funds it.
+ *
+ * An order that several limit orders can serve produces several of these, one per
+ * order, each priced against the whole input at its own rate. They are never
+ * summed: each bid is its own fill, and the gateway clamps whichever one lands
+ * against what is still outstanding.
+ */
+interface BidPlan {
+    limitOrderId: string;
+    /** The order leg this bid fills; every other leg is quoted at zero. */
+    leg: number;
+    /** What this bid draws from that limit order, at 1e18. */
+    payout: bigint;
+    /** The outputs the bid signs, in the output token's own units. */
+    fillerOutputs: TokenInfo[];
+    /** The take signed beside each output: the escrow this bid's fill earns. */
+    fillerInputs: TokenInfo[];
+    /** The decimals `fillerInputs[leg]` is counted in: the input token's, on the order's source chain. */
+    inputDecimals?: number;
+    fundingCalls: ERC7821Call[];
+    partialFill: boolean;
+    profit: number;
+    /** That limit order's budget, which the bid settles against on the fill chain. */
+    budget?: LimitOrderBudget;
+}
+declare class CacheService {
+    private cacheData;
+    private readonly CACHE_EXPIRY_MS;
+    /** How long each order's source confirmations take, for the orders still waiting for them. */
+    private readonly confirmationWaits;
+    /** When each order's bid loop began, for the orders whose loop is still running. */
+    private readonly pins;
+    private logger;
+    constructor(loggers?: LoggerContext);
     /**
-     * What the solver's account has tallied against a limit order's budget on `chain`, in
-     * the paid token's own units, or null when it cannot be read.
-     *
-     * Null rather than a throw: an account whose implementation keeps no tally answers
-     * with a revert or with no data, and the caller carries on without the figure either
-     * way. Not retried, since that answer does not change on a second ask.
+     * Whether an entry is still live. A pinned order's entries are judged as of the pin,
+     * so what was live when its bid loop began stays live until the loop ends, and
+     * what had already expired stays expired.
      */
-    limitOrderSpent(chain: string, budgetId: HexString): Promise<bigint | null>;
-    getSolverEntryPointBalance(chain: string): Promise<bigint>;
+    private isCacheValid;
     /**
-     * Deposits native tokens to the ERC-4337 EntryPoint on behalf of the solver account.
-     * @returns The transaction hash of the deposit.
+     * When an entry written now for the order expires: `CACHE_EXPIRY_MS` from now, plus the
+     * time the order's source confirmations take while it waits for them.
      */
-    depositToEntryPoint(chain: string, amount: bigint): Promise<HexString>;
+    private expiresAt;
     /**
-     * Withdraws the solver's full EntryPoint deposit back to the solver EOA on a single chain.
-     * @returns The transaction hash, or null if there was nothing to withdraw.
+     * Lets what is cached for the order outlive `CACHE_EXPIRY_MS` by `waitMs`, the time its
+     * source confirmations take, and returns the release.
+     *
+     * An order is evaluated while it waits for its confirmations, and its bids are signed after
+     * them from what the evaluation cached, so that has to outlast the wait. Each entry takes
+     * its expiry when it is written: the release does not shorten what is already cached, it
+     * only stops later entries from getting the extra time.
      */
-    withdrawFromEntryPoint(chain: string): Promise<HexString | null>;
+    extendForConfirmations(orderId: string, waitMs: number): () => void;
     /**
-     * Withdraws EntryPoint deposits on all configured chains that have a positive balance.
+     * Keeps the order's evaluation alive while its bids go out, and returns the release.
+     *
+     * The bids on one order are sent in turn, each priced by the evaluation that planned
+     * them, and every one reads the shared gas estimate back out of here. Submitting a
+     * bid can take longer than `CACHE_EXPIRY_MS` on its own, and the order is not
+     * evaluated again, so the estimate has to outlive the loop for the later bids to be
+     * sent at all. Estimating afresh instead would sign them at a gas cost their payouts
+     * were not priced against.
      */
-    withdrawAllEntryPointDeposits(): Promise<void>;
+    pinOrder(orderId: string): () => void;
+    private cleanupStaleData;
+    getGasEstimate(orderId: string): {
+        totalCostInSourceFeeToken: bigint;
+        relayerFeeInSourceFeeToken: bigint;
+        dispatchFee: bigint;
+        callGasLimit: bigint;
+        verificationGasLimit: bigint;
+        preVerificationGas: bigint;
+        maxFeePerGas: bigint;
+        maxPriorityFeePerGas: bigint;
+        totalGasCostWei: bigint;
+    } | null;
+    setGasEstimate(orderId: string, totalCostInSourceFeeToken: bigint, relayerFeeInSourceFeeToken: bigint, dispatchFee: bigint, callGasLimit: bigint, verificationGasLimit: bigint, preVerificationGas: bigint, maxFeePerGas: bigint, maxPriorityFeePerGas: bigint, totalGasCostWei: bigint): void;
+    getSwapOperations(orderId: string): {
+        calls: SwapCall[];
+        totalGasEstimate: bigint;
+    } | null;
+    setSwapOperations(orderId: string, calls: SwapCall[], totalGasEstimate: bigint): void;
+    getFillerOutputs(orderId: string): {
+        token: HexString;
+        amount: bigint;
+    }[] | null;
+    /** The takes cached with the order's filler outputs, or null when absent or stale. */
+    getFillerInputs(orderId: string): {
+        token: HexString;
+        amount: bigint;
+    }[] | null;
     /**
-     * Output already delivered against this order by any solver, per leg (the gateway keys fill
-     * progress by output index, so legs repeating a token are reported separately; a gateway not yet
-     * upgraded to per-leg escrow is read by token).
-     *
-     * A partially filled order has had its escrow drawn down, so the pro-rata
-     * release a later filler receives is computed against the *residual*, not
-     * against `order.inputs[i].amount`. A strategy that prices off the original
-     * inputs would overstate its take, which is why the partial-fill path refuses
-     * any order this reports as already touched.
+     * The budget of the limit order that priced the outputs cached for this order, or
+     * null when no limit order did.
      *
-     * Same-chain concept only — the cross-chain path has no partial-fill state.
+     * Kept on the same entry as the outputs, so the two are replaced and expire
+     * together: a bid can never sign one limit order's payout beside another's budget.
      */
-    partialFillsFor(order: Order, chain: string): Promise<bigint[]>;
+    getBidBudget(orderId: string): LimitOrderBudget | null;
+    setFillerOutputs(orderId: string, outputs: {
+        token: HexString;
+        amount: bigint;
+    }[], inputs?: {
+        token: HexString;
+        amount: bigint;
+    }[], budget?: LimitOrderBudget): void;
     /**
-     * Prepares a signed PackedUserOperation for bid submission to Hyperbridge
+     * The limit order this order was priced against, and the payout it allowed.
      *
-     * Uses cached gas estimates from prior profitability check (estimateGasFillPost)
-     * to avoid redundant RPC calls.
+     * Carried from `calculateProfitability` to the bid so the reservation lands on
+     * the same limit order the price came from. A fill later finds it through the
+     * bid row, not through here.
+     */
+    getMatchedLimitOrder(orderId: string): {
+        limitOrderId: string;
+        payout: bigint;
+    }[];
+    getBidPlans(orderId: string): BidPlan[];
+    setBidPlans(orderId: string, plans: BidPlan[]): void;
+    clearBidPlans(orderId: string): void;
+    setMatchedLimitOrder(orderId: string, holds: {
+        limitOrderId: string;
+        payout: bigint;
+    }[]): void;
+    getPairClassifications(orderId: string): CachedPairClassification[] | null;
+    setPairClassifications(orderId: string, pairs: CachedPairClassification[]): void;
+    getFundingPrepends(orderId: string): {
+        calls: ERC7821Call[];
+    } | null;
+    setFundingPrepends(orderId: string, calls: ERC7821Call[]): void;
+    clearFundingPrepends(orderId: string): void;
+    /**
+     * Whether the strategy's completed evaluation of this order chose a partial fill.
+     *
+     * Only ever written by an evaluation that went on to return a fillable answer,
+     * and cleared at the start of every evaluation — so a refusal can never leave a
+     * `true` behind for the caller to act on.
+     */
+    isPartialFill(orderId: string): boolean;
+    setPartialFill(orderId: string, partial: boolean): void;
+    clearPartialFill(orderId: string): void;
+    /**
+     * Whether the strategy's completed evaluation let a bid through without holding
+     * `order.fees` to the execution cost, because the order is at or above the
+     * operator's minimum size.
+     *
+     * Written and cleared the way {@link isPartialFill} is, for the same reason: the
+     * caller exempts such an order from its profit floor.
+     */
+    isFeeCheckWaived(orderId: string): boolean;
+    setFeeCheckWaived(orderId: string, waived: boolean): void;
+    clearFeeCheckWaived(orderId: string): void;
+    getFeeTokenWithDecimals(chain: string): {
+        address: HexString;
+        decimals: number;
+    } | null;
+    setFeeTokenWithDecimals(chain: string, address: HexString, decimals: number): void;
+    getTokenDecimals(chain: string, tokenAddress: HexString): number | null;
+    setTokenDecimals(chain: string, tokenAddress: HexString, decimals: number): void;
+    getSolverSelection(chain: string): boolean | null;
+    setSolverSelection(chain: string, active: boolean): void;
+}
+
+/** What a bid's batch needs to settle its limit order's budget. */
+interface BudgetSettlement {
+    budget: LimitOrderBudget;
+    /** The solver's account, which is the only caller `debitOrder` accepts. */
+    solverAccount: HexString;
+}
+declare class ContractInteractionService {
+    private clientManager;
+    private configService;
+    cacheService: CacheService;
+    private logger;
+    private sdkHelperCache;
+    private blockTimes;
+    private solverAccountAddress;
+    private signer;
+    constructor(clientManager: ChainClientManager, configService: FillerConfigService, signer: Signer, sharedCacheService?: CacheService);
+    /**
+     * The endpoint SDK helpers should use for `chain`: the first configured RPC,
+     * matching the one viem's `fallback` transport tries first.
+     */
+    private primaryRpcUrl;
+    /**
+     * Gets the SDK helper for a given source and destination chain.
+     * Instances are cached and reused to avoid redundant RPC calls.
+     */
+    getIntentGateway(source: string, destination: string): Promise<IntentGateway>;
+    /**
+     * Best-effort cache warm-up. Deliberately never rejects: this runs unawaited from the
+     * constructor, so a rejection would surface as an unhandled rejection and take the
+     * process down. A failed prewarm only means the value is fetched on first use, where
+     * `getTokenDecimals` is strict — which is the right place for strictness, because
+     * there it can skip a single order instead of killing the filler at boot.
+     */
+    initCache(): Promise<void>;
+    getCache(): CacheService;
+    /**
+     * Gets the decimals for a token
+     */
+    getTokenDecimals(tokenAddress: string, chain: string): Promise<number>;
+    /**
+     * Estimates gas for filling an order and caches the full estimate for bid preparation
+     */
+    estimateGasFillPost(order: Order): Promise<{
+        totalCostInSourceFeeToken: bigint;
+        relayerFeeInSourceFeeToken: bigint;
+        dispatchFee: bigint;
+        callGasLimit: bigint;
+    }>;
+    /**
+     * Logs a bundler gas estimate for `order` that failed transiently and is sent again
+     * (the SDK retries a network failure, a JSON-RPC internal error, or an HTTP 408, 429 or 5xx).
+     */
+    private logBundlerRetry;
+    /**
+     * The call gas a bid needs: the shared estimate plus room for the funding calls
+     * this bid prepends and for settling its limit order's budget.
+     *
+     * Funding calls are not simulated (the V4 PositionManager's flash accounting does
+     * not resolve in the bundler's estimation context), so each one adds a fixed
+     * allowance for its modifyLiquidities + take. They differ between the bids on one
+     * order, since each draws on its own limit order and so on its own funding, which
+     * is why this is worked out per bid rather than baked into the cached estimate.
+     * The estimate is of a lone fillOrder, so the budget call is not in it either, nor are
+     * the approvals: each token the batch approves adds `APPROVAL_GAS_PER_TOKEN`.
+     */
+    private callGasLimitFor;
+    /**
+     * What the batch approves to the gateway for `order`, per token, and the fee token's key
+     * when the fill dispatches. The fee token is read from the destination host.
+     */
+    private approvalsFor;
+    /**
+     * Gets the fee token address and decimals for a given chain.
+     *
+     * @param chain - The chain identifier to get fee token info for
+     * @returns An object containing the fee token address and its decimal places
+     */
+    getFeeTokenWithDecimals(chain: string): Promise<{
+        address: HexString;
+        decimals: number;
+    }>;
+    /**
+     * Tops up the solver's EntryPoint deposit so it covers at least
+     * `targetGasUnits` at the current gas price. Skips if the wallet
+     * balance cannot afford at least 1M gas units (not enough to send txs).
+     *
+     * @param chain - The chain identifier
+     * @param targetGasUnits - Gas units the deposit should cover (default 3M)
+     * @param thresholdGasUnits - Only top up if deposit is below this many gas units (defaults to targetGasUnits)
+     */
+    topUpEntryPointDeposit(chain: string, targetGasUnits?: bigint, thresholdGasUnits?: bigint): Promise<void>;
+    /**
+     * Calculates the total USD value of an order's inputs.
+     * Only stable (USDC/USDT) inputs contribute; non-stables contribute 0.
+     *
+     * @param order - The order to calculate input value for
+     * @returns The total USD value of inputs (sum of normalized stable amounts, or 0 if none)
+     */
+    getInputUsdValue(order: Order): Promise<Decimal>;
+    /**
+     * Checks if solver selection mode is active on the destination chain
+     * When active, fillers must submit bids to Hyperbridge instead of filling directly
+     *
+     * @param chain - The chain identifier to check
+     * @returns True if solver selection is active
+     */
+    isSolverSelectionActive(chain: string): Promise<boolean>;
+    /**
+     * Reads the solver account's deposit balance on the ERC-4337 EntryPoint.
+     */
+    /** What `holder` holds of an ERC-20 on `chain`, in the token's own units. */
+    getTokenBalance(chain: string, token: HexString, holder: HexString): Promise<bigint>;
+    /**
+     * What the solver's account has tallied against a limit order's budget on `chain`, in
+     * the paid token's own units, or null when it cannot be read.
+     *
+     * Null rather than a throw: an account whose implementation keeps no tally answers
+     * with a revert or with no data, and the caller carries on without the figure either
+     * way. Not retried, since that answer does not change on a second ask.
+     *
+     * Read at `blockNumber` when given, otherwise at the latest block. A load-balanced
+     * endpoint can lag the one that saw a fill, so a read at `latest` right after the
+     * fill can return the tally from before it. The tally only grows, so a read at the
+     * fill's own block already includes that fill. An endpoint that has not reached the
+     * block answers with an error, which is null here: no figure, rather than a stale one.
+     */
+    limitOrderSpent(chain: string, budgetId: HexString, blockNumber?: bigint): Promise<bigint | null>;
+    getSolverEntryPointBalance(chain: string): Promise<bigint>;
+    /**
+     * Deposits native tokens to the ERC-4337 EntryPoint on behalf of the solver account.
+     * @returns The transaction hash of the deposit.
+     */
+    depositToEntryPoint(chain: string, amount: bigint): Promise<HexString>;
+    /**
+     * Withdraws the solver's full EntryPoint deposit back to the solver EOA on a single chain.
+     * @returns The transaction hash, or null if there was nothing to withdraw.
+     */
+    withdrawFromEntryPoint(chain: string): Promise<HexString | null>;
+    /**
+     * Withdraws EntryPoint deposits on all configured chains that have a positive balance.
+     */
+    withdrawAllEntryPointDeposits(): Promise<void>;
+    /**
+     * Output already delivered against this order by any solver, per leg (the gateway keys fill
+     * progress by output index, so legs repeating a token are reported separately; a gateway not yet
+     * upgraded to per-leg escrow is read by token).
+     *
+     * A partially filled order has had its escrow drawn down, so the pro-rata
+     * release a later filler receives is computed against the *residual*, not
+     * against `order.inputs[i].amount`. A strategy that prices off the original
+     * inputs would overstate its take, which is why the partial-fill path refuses
+     * any order this reports as already touched.
+     *
+     * Same-chain concept only — the cross-chain path has no partial-fill state.
+     */
+    partialFillsFor(order: Order, chain: string): Promise<bigint[]>;
+    /**
+     * Prepares a signed PackedUserOperation for bid submission to Hyperbridge
+     *
+     * Uses cached gas estimates from prior profitability check (estimateGasFillPost)
+     * to avoid redundant RPC calls.
      *
      * @param order - The order to prepare a bid for
      * @param entryPointAddress - The ERC-4337 EntryPoint address on the destination chain
@@ -1239,6 +1634,16 @@ declare class ContractInteractionService {
         userOp: HexString;
         bid: HexString;
     }>;
+    /**
+     * Throws unless an op with no paymaster can pay its own prefund. The EntryPoint takes it from
+     * the account's deposit and asks the account for the rest out of its native balance, so
+     * between them they must cover `required`. Nothing funds a deposit on a chain with a
+     * paymaster configured, so when selection comes back empty there a solver holding little
+     * native would place a bid, pay Hyperbridge's bid fee for it, and fail validation (AA21)
+     * when it is selected. Reads that fail let the bid through, as the paymaster deposit gate
+     * does: a transient RPC error must not cost a bid, and the worst case is that failure.
+     */
+    private assertUnsponsoredBidFunded;
     /**
      * Last block on the destination chain at which a bid signed now may still execute.
      *
@@ -1264,12 +1669,16 @@ declare class ContractInteractionService {
      * speeds up (BSC makes a block every 0.45s against a declared 0.75s) and some chains
      * declare none. Converting at a slower block time than the chain's ends a bid early, so
      * the faster of the measured and the declared figure is used, and a stalled or idle
-     * stretch in the sample never shortens a bid.
+     * stretch in the sample never shortens a bid. A measurement below half the declared figure is
+     * discarded, which limits how far one RPC can stretch a bid to twice its window. A chain that
+     * declares none has no reference to judge a sample against, so it only gets the flat floor
+     * {@link MIN_PLAUSIBLE_BLOCK_TIME_SECONDS}; below that the measurement is discarded for
+     * {@link FALLBACK_BLOCK_TIME_SECONDS}.
      *
      * Blocks that cannot be read fall back to the declared figure, then to
      * {@link FALLBACK_BLOCK_TIME_SECONDS}. That answer is not kept.
      */
-    private blockTimeSeconds;
+    blockTimeSeconds(chain: string): Promise<number>;
     /** The average block time over the chain's last {@link BLOCK_TIME_SAMPLE_BLOCKS} blocks, in seconds. */
     private measureBlockTimeSeconds;
     /**
@@ -1307,6 +1716,13 @@ declare class ContractInteractionService {
      * Builds ERC-7821 batch calldata that approves exactly what this bid can pay
      * before the fillOrder call, all within a single UserOp payload.
      *
+     * The gateway is approved for exactly what this fill pays: the outputs in each
+     * ERC20, plus the dispatch fee (`dispatchFee`) in the fee token on a cross-chain
+     * fill. Nothing else goes in an approval: the fill's gas is paid through the
+     * paymaster's Permit2 pull. The batch ends by setting every allowance it set back
+     * to zero, so none stands once it completes. The gateway is an upgradeable proxy
+     * and a standing allowance is exposure to a future implementation.
+     *
      * The approvals are unconditional. One solver can hold several bids on one
      * order, at different levels of its book, and they execute one after another:
      * an approval skipped because the allowance covered this bid when it was signed
@@ -1322,9 +1738,11 @@ declare class ContractInteractionService {
      * A bid priced by a limit order ends with `debitOrder`, which takes the budget's id
      * as its `orderId`, works out what the fill paid from what is left of the allowance
      * and reverts the whole batch if the order's payouts would pass its size. It has to
-     * come last, after the gateway has drawn on the allowance.
+     * come after the gateway has drawn on the allowance, and the zero-resets after it,
+     * since it reads the allowance that is left. It clears the budget token's allowance
+     * itself, so the resets skip that token.
      */
-    buildApprovalAndFillCalldata(order: Order, fillerOutputs: TokenInfo[], fillOptions: FillOptions, requiredFeeTokenAmount: bigint, settlement?: BudgetSettlement): Promise<HexString>;
+    buildApprovalAndFillCalldata(order: Order, fillerOutputs: TokenInfo[], fillOptions: FillOptions, settlement?: BudgetSettlement): Promise<HexString>;
 }
 
 interface BinanceCexConfig {
@@ -1392,384 +1810,145 @@ declare class CctpRebalancer {
     /**
      * Estimates the cost of a CCTP transfer
      */
-    estimateCctp(options: RebalanceOptions): Promise<EstimateResult>;
-    /**
-     * Retries a failed CCTP transfer
-     */
-    retrySendCctp(failedResult: BridgeResult): Promise<BridgeResult>;
-}
-
-interface Usdt0TransferResult {
-    success: boolean;
-    txHash: HexString;
-    amountSent: bigint;
-    amountReceived: bigint;
-    nativeFee: bigint;
-}
-interface Usdt0EstimateResult {
-    amountSent: bigint;
-    amountReceived: bigint;
-    nativeFee: bigint;
-    minAmount: bigint;
-    maxAmount: bigint;
-}
-
-/**
- * Options for rebalancing transfers (CCTP, USDT0, or CEX).
- * - For CCTP/USDT0: coin is implicit (CCTP=USDC, USDT0=USDT), recipientAddress is optional
- * - For unified router/CEX: coin is required for routing, recipientAddress is ignored
- */
-interface RebalanceOptions {
-    /** Amount in human-readable format (e.g., "100.00") */
-    amount: string;
-    /** Source chain in state machine format (e.g., "EVM-137") */
-    source: string;
-    /** Destination chain in state machine format (e.g., "EVM-42161") */
-    destination: string;
-    /** Optional recipient address (defaults to sender's address) - only used for CCTP/USDT0, ignored for CEX */
-    recipientAddress?: HexString;
-}
-/**
- * UnifiedRebalanceOptions is kept for broader compatibility.
- */
-type UnifiedRebalanceOptions = RebalanceOptions & {
-    coin: "USDC" | "USDT";
-};
-
-/**
- * Represents a planned transfer from one chain to another for portfolio-level rebalancing.
- */
-interface PlannedTransfer {
-    sourceChain: string;
-    destChain: string;
-    coin: "USDC" | "USDT";
-    amount: string;
-}
-/**
- * Result of checking portfolio rebalancing triggers.
- */
-interface TriggerCheckResult {
-    triggered: boolean;
-    triggeredChains: Array<{
-        chain: string;
-        asset: "USDC" | "USDT";
-        deficit: number;
-    }>;
-}
-/**
- * Result of a portfolio rebalancing operation.
- */
-interface RebalancingResult {
-    success: boolean;
-    transfers: PlannedTransfer[];
-    executedTransfers: Array<{
-        transfer: PlannedTransfer;
-        result: unknown;
-    }>;
-    errors?: string[];
-}
-/**
- * RebalancingService - Facade over CCTP, USDT0, and Binance CEX rebalancers.
- * Provides both low-level methods (sendCctp, sendUsdt0, sendViaCex) and a high-level router (rebalance).
- */
-declare class RebalancingService {
-    private readonly chainClientManager;
-    private readonly configService;
-    private readonly walletAddress;
-    private readonly cctpRebalancer;
-    private readonly usdt0Rebalancer;
-    private readonly binanceRebalancer?;
-    private readonly logger;
-    constructor(chainClientManager: ChainClientManager, configService: FillerConfigService, binanceConfig?: BinanceCexConfig);
-    sendCctp(options: RebalanceOptions): Promise<_circle_fin_bridge_kit.BridgeResult>;
-    estimateCctp(options: RebalanceOptions): Promise<_circle_fin_bridge_kit.EstimateResult>;
-    retrySendCctp(failedResult: Awaited<ReturnType<CctpRebalancer["sendCctp"]>>): Promise<_circle_fin_bridge_kit.BridgeResult>;
-    sendUsdt0(options: RebalanceOptions): Promise<Usdt0TransferResult>;
-    estimateUsdt0(options: RebalanceOptions): Promise<Usdt0EstimateResult>;
-    sendViaCex(options: UnifiedRebalanceOptions): Promise<CexRebalanceResult>;
-    estimateCexRebalance(options: UnifiedRebalanceOptions): Promise<CexRebalanceEstimate>;
-    /**
-     * Execute a single cross-chain transfer, selecting the best route (CCTP / USDT0 / CEX).
-     * Requires coin to be specified for routing decisions.
-     */
-    rebalance(options: UnifiedRebalanceOptions): Promise<Awaited<ReturnType<CctpRebalancer["sendCctp"]>> | Usdt0TransferResult | CexRebalanceResult>;
-    /**
-     * Check if any chains/assets have triggered portfolio rebalancing thresholds.
-     */
-    checkRebalanceTriggers(): Promise<TriggerCheckResult>;
-    /**
-     * Plan portfolio-level rebalancing transfers for triggered chains using greedy matching.
-     */
-    planPortfolioRebalancing(triggeredChains: TriggerCheckResult["triggeredChains"]): Promise<PlannedTransfer[]>;
-    /**
-     * Plan transfers for a specific asset using greedy surplus–deficit matching.
-     */
-    private planTransfersForAsset;
-    /**
-     * Execute planned portfolio-level transfers via this service.
-     */
-    executePortfolioRebalancing(transfers: PlannedTransfer[]): Promise<RebalancingResult>;
-    /**
-     * High-level portfolio rebalance:
-     * 1) Check triggers
-     * 2) Plan transfers
-     * 3) Execute transfers
-     */
-    rebalancePortfolio(): Promise<RebalancingResult>;
-    /**
-     * Get current balance for a token on a chain.
-     * Returns balance in normalized USD value (treating token as $1).
-     */
-    private getCurrentBalance;
-    estimate(options: UnifiedRebalanceOptions): Promise<{
-        method: "cctp";
-        estimate: Awaited<ReturnType<CctpRebalancer["estimateCctp"]>>;
-    } | {
-        method: "usdt0";
-        estimate: Usdt0EstimateResult;
-    } | {
-        method: "cex";
-        estimate: CexRebalanceEstimate;
-    }>;
-}
-
-interface Book {
-    id: string;
-    base: string;
-    quote: string;
-}
-/** Live price levels. All prices and sizes are decimal integer strings at 1e18. */
-interface OrderbookLevel {
-    fillChain: string;
-    priceBucket: string;
-    price: string;
-    worstPrice: string;
-    baseSize: string;
-    quoteSize: string;
-    orderCount: number;
-    solverCount: number;
-}
-interface OrderbookSnapshot extends Book {
-    /** Best first: bids descending, asks ascending. */
-    bids: OrderbookLevel[];
-    asks: OrderbookLevel[];
-    /** True backing liquidity, in quote for bids and base for asks. */
-    bidLiquidity: string;
-    askLiquidity: string;
-    /** Price bucket width, quote per 1 base at 1e18; null when the orderbook does not report one. */
-    granularity: string | null;
-}
-/** One solver's order inside a price level. Prices and sizes are decimal integer strings at 1e18. */
-interface OrderbookLevelOrder {
-    solver: string;
-    commitment: string;
-    fillChain: string;
-    price: string;
-    /** What the order publishes as depth, in the token its side pays out: quote for bids, base for asks. */
-    advertisedSize: string;
-    /** The signed output before any balance cap, in the same token as `advertisedSize`. */
-    quotedAmount: string;
-    /** True when the solver's balance, not the quote, binds `advertisedSize`. */
-    resized: boolean;
-    expiresAt: string;
-    acceptedSources: string[];
-}
-interface OrderbookLevelQuery {
-    side: "BID" | "ASK";
-    fillChain: string;
-    priceBucket: string;
-    sourceChain?: string;
-}
-interface OrderbookFilters {
-    sourceChain?: string;
-    fillChain?: string;
-}
-interface TokenMinSize {
-    symbol: string;
-    size: string;
-}
-interface ServerInfo {
-    minOrderTtlSecs: number;
-    heartbeatIntervalSecs: number;
-    signatureSkewSecs: number;
-    maxBatchSize: number;
-    minOrderSizes: TokenMinSize[];
-    /**
-     * Every chain the orderbook serves, by state machine id: the chains orders
-     * fill on, and the source chains they may declare.
-     */
-    chains: string[];
-    eip712DomainName: string;
-    eip712DomainVersion: string;
-}
-/** One token on one chain, as the orderbook's own registry has it. */
-interface ChainToken {
-    symbol: string;
-    /** Its decimals there: USDC and USDT carry 18 on BNB Chain and 6 on the rest. */
-    decimals: number;
-}
-/** One chain the orderbook serves, with the tokens it registers on it. */
-interface ChainInfo {
-    /** State machine id, such as `EVM-8453`. */
-    id: string;
-    name: string;
-    tokens: ChainToken[];
-}
-/** `serverInfo`, `books` and `chains` together, which is how simplex reads them. */
-interface OrderbookLimits {
-    serverInfo: ServerInfo;
-    books: Book[];
-    chains: ChainInfo[];
-}
-interface PostedOrder {
-    commitment: HexString;
-    side: "BID" | "ASK";
-    status: "ACTIVE" | "SUSPENDED";
-    price: string;
-    quotedAmount: string;
-    advertisedSize: string;
-    expiresAt: string;
-    acceptedSources: string[];
-    /** The balance, not the quote, is what binds `advertisedSize`. */
-    resized?: boolean;
-    /**
-     * Whether the solver's balance covers the whole quote. Also false before any
-     * balance has been read, which is why {@link PostedOrder.validatedAt} decides
-     * whether a false here means anything.
-     */
-    backed?: boolean;
-    /**
-     * The last cycle that read this order's balance, absent until one has. An
-     * order surfaces at its quoted size meanwhile.
-     */
-    validatedAt?: string | null;
-}
-/**
- * Every code the orderbook's `RejectionCode` enum can send, listed rather than
- * written as a union so a test can hold it against the published schema.
- *
- * Why the orderbook refuses an order. `MIN_ORDER_SIZE`, `TTL_TOO_SHORT` and
- * `UNSUPPORTED_SOURCE_CHAIN` are prevented by validation before posting, the last
- * against the chains the server serves and the tokens its registry lists on each;
- * `REPLAYED` and `ORDER_EXISTS` are answered by bumping the nonce; the rest are
- * encoding bugs on our side.
- */
-declare const REJECTION_CODES: readonly ["MALFORMED_USER_OP", "NO_FILL_ORDER", "UNSUPPORTED_CHAIN", "UNSUPPORTED_SHAPE", "NOT_PHANTOM", "TTL_TOO_SHORT", "UNSUPPORTED_PAIR", "BAD_SIGNATURE", "BAD_NONCE_BINDING", "REPLAYED", "ORDER_EXISTS", "TOO_MANY_ORDERS", "MIN_ORDER_SIZE", "MISSING_DECLARATION", "EMPTY_DECLARATION", "UNSUPPORTED_SOURCE_CHAIN"];
-type RejectionCode = (typeof REJECTION_CODES)[number];
-/**
- * Why the orderbook could not decide an op at all. Ingest reads no chain, so it
- * is the database or the submission running out of time, and both are worth
- * another attempt.
- */
-declare const FAILURE_CODES: readonly ["DATABASE_UNAVAILABLE", "TIMEOUT"];
-type FailureCode = (typeof FAILURE_CODES)[number];
-type SubmitOrderResult = {
-    kind: "accepted";
-    order: PostedOrder;
-    surfaced: boolean;
-} | {
-    kind: "unchanged";
-    order: PostedOrder;
-} | {
-    kind: "rejected";
-    code: RejectionCode;
-    message: string;
-} | {
-    kind: "failed";
-    code: FailureCode | "REQUEST_FAILED";
-    message: string;
-    retryable: boolean;
-};
-/** Why a signed message was refused, shared by `cancelOrder` and `heartbeat`. */
-declare const MESSAGE_REJECTION_CODES: readonly ["BAD_SIGNATURE", "SOLVER_MISMATCH", "SIGNATURE_EXPIRED", "SIGNATURE_REUSED", "UNKNOWN_ORDER", "UNKNOWN_SOLVER"];
-type MessageRejectionCode = (typeof MESSAGE_REJECTION_CODES)[number];
-type SolverStatus = "ACTIVE" | "SUSPENDED";
-type HeartbeatResult = {
-    kind: "accepted";
-    status: SolverStatus;
-    reactivatedOrders: number;
-    heartbeatDueBy: string;
-} | {
-    kind: "rejected";
-    code: MessageRejectionCode;
-    message: string;
-};
-/** One page of the solver's own orders, as reconciliation walks them. */
-interface PostedOrderPage {
-    orders: PostedOrder[];
-    /** Cursor for the next page, absent on the last one. */
-    cursor?: string;
-    status: SolverStatus;
+    estimateCctp(options: RebalanceOptions): Promise<EstimateResult>;
+    /**
+     * Retries a failed CCTP transfer
+     */
+    retrySendCctp(failedResult: BridgeResult): Promise<BridgeResult>;
 }
-type CancelOrderResult = {
-    kind: "cancelled";
-    commitment: HexString;
-} | {
-    kind: "rejected";
-    code: MessageRejectionCode;
-    message: string;
+
+interface Usdt0TransferResult {
+    success: boolean;
+    txHash: HexString;
+    amountSent: bigint;
+    amountReceived: bigint;
+    nativeFee: bigint;
+}
+interface Usdt0EstimateResult {
+    amountSent: bigint;
+    amountReceived: bigint;
+    nativeFee: bigint;
+    minAmount: bigint;
+    maxAmount: bigint;
 }
+
 /**
- * The request never got an answer. Distinct from `UNKNOWN_ORDER`, which is the
- * orderbook saying the entry is already gone: here the entry may well still be
- * live, and a caller that treats the two alike orphans it.
+ * Options for rebalancing transfers (CCTP, USDT0, or CEX).
+ * - For CCTP/USDT0: coin is implicit (CCTP=USDC, USDT0=USDT), recipientAddress is optional
+ * - For unified router/CEX: coin is required for routing, recipientAddress is ignored
  */
- | {
-    kind: "failed";
-    message: string;
+interface RebalanceOptions {
+    /** Amount in human-readable format (e.g., "100.00") */
+    amount: string;
+    /** Source chain in state machine format (e.g., "EVM-137") */
+    source: string;
+    /** Destination chain in state machine format (e.g., "EVM-42161") */
+    destination: string;
+    /** Optional recipient address (defaults to sender's address) - only used for CCTP/USDT0, ignored for CEX */
+    recipientAddress?: HexString;
+}
+/**
+ * UnifiedRebalanceOptions is kept for broader compatibility.
+ */
+type UnifiedRebalanceOptions = RebalanceOptions & {
+    coin: "USDC" | "USDT";
 };
 
 /**
- * Talks to one HyperFX orderbook over GraphQL.
- *
- * Stateless apart from the endpoint and timeout. Every method either returns the
- * orderbook's own answer, including its refusals, or throws
- * {@link OrderbookRequestError} because it could not get one.
+ * Represents a planned transfer from one chain to another for portfolio-level rebalancing.
  */
-declare class OrderbookClient {
-    private readonly requestTimeoutMs;
-    private logger;
-    /** The configured endpoint, with `/graphql` if it was left off. */
-    private readonly url;
-    constructor(url: string, requestTimeoutMs: number, loggers?: LoggerContext);
-    /** The limits to validate against before posting, plus the books on offer. */
-    limits(): Promise<OrderbookLimits>;
-    /** The public book across all solvers, restricted to the selected route. */
-    snapshot(id: string, filters?: OrderbookFilters): Promise<OrderbookSnapshot | null>;
+interface PlannedTransfer {
+    sourceChain: string;
+    destChain: string;
+    coin: "USDC" | "USDT";
+    amount: string;
+}
+/**
+ * Result of checking portfolio rebalancing triggers.
+ */
+interface TriggerCheckResult {
+    triggered: boolean;
+    triggeredChains: Array<{
+        chain: string;
+        asset: "USDC" | "USDT";
+        deficit: number;
+    }>;
+}
+/**
+ * Result of a portfolio rebalancing operation.
+ */
+interface RebalancingResult {
+    success: boolean;
+    transfers: PlannedTransfer[];
+    executedTransfers: Array<{
+        transfer: PlannedTransfer;
+        result: unknown;
+    }>;
+    errors?: string[];
+}
+/**
+ * RebalancingService - Facade over CCTP, USDT0, and Binance CEX rebalancers.
+ * Provides both low-level methods (sendCctp, sendUsdt0, sendViaCex) and a high-level router (rebalance).
+ */
+declare class RebalancingService {
+    private readonly chainClientManager;
+    private readonly configService;
+    private readonly walletAddress;
+    private readonly cctpRebalancer;
+    private readonly usdt0Rebalancer;
+    private readonly binanceRebalancer?;
+    private readonly logger;
+    constructor(chainClientManager: ChainClientManager, configService: FillerConfigService, binanceConfig?: BinanceCexConfig);
+    sendCctp(options: RebalanceOptions): Promise<_circle_fin_bridge_kit.BridgeResult>;
+    estimateCctp(options: RebalanceOptions): Promise<_circle_fin_bridge_kit.EstimateResult>;
+    retrySendCctp(failedResult: Awaited<ReturnType<CctpRebalancer["sendCctp"]>>): Promise<_circle_fin_bridge_kit.BridgeResult>;
+    sendUsdt0(options: RebalanceOptions): Promise<Usdt0TransferResult>;
+    estimateUsdt0(options: RebalanceOptions): Promise<Usdt0EstimateResult>;
+    sendViaCex(options: UnifiedRebalanceOptions): Promise<CexRebalanceResult>;
+    estimateCexRebalance(options: UnifiedRebalanceOptions): Promise<CexRebalanceEstimate>;
     /**
-     * The orders behind one price level. The orderbook filters orders by side and route but not by
-     * price bucket, so this walks the side's orders on the level's fill chain and keeps the bucket.
-     * Null when the book does not exist.
+     * Execute a single cross-chain transfer, selecting the best route (CCTP / USDT0 / CEX).
+     * Requires coin to be specified for routing decisions.
      */
-    levelOrders(id: string, level: OrderbookLevelQuery): Promise<OrderbookLevelOrder[] | null>;
-    submitOrder(userOp: HexString): Promise<SubmitOrderResult>;
+    rebalance(options: UnifiedRebalanceOptions): Promise<Awaited<ReturnType<CctpRebalancer["sendCctp"]>> | Usdt0TransferResult | CexRebalanceResult>;
     /**
-     * The entry this solver holds at `commitment`, or null when it holds none.
-     *
-     * What tells `ORDER_EXISTS` from `REPLAYED`: the first means a live entry is
-     * already sitting there, and posting again on a new nonce would put a second
-     * one behind the same liability.
+     * Check if any chains/assets have triggered portfolio rebalancing thresholds.
      */
-    orderAt(solver: HexString, commitment: HexString): Promise<PostedOrder | null>;
-    cancelOrder(params: {
-        solver: HexString;
-        commitment: HexString;
-        timestamp: number;
-        signature: HexString;
-    }): Promise<CancelOrderResult>;
-    heartbeat(params: {
-        solver: HexString;
-        timestamp: number;
-        signature: HexString;
-    }): Promise<HeartbeatResult>;
+    checkRebalanceTriggers(): Promise<TriggerCheckResult>;
     /**
-     * One page of the solver's own orders as the orderbook holds them.
-     *
-     * A solver the orderbook has never accepted an order from is not an error:
-     * it answers with no solver at all, which reads here as an empty page.
+     * Plan portfolio-level rebalancing transfers for triggered chains using greedy matching.
      */
-    myOrders(solver: HexString, after?: string): Promise<PostedOrderPage>;
-    private request;
+    planPortfolioRebalancing(triggeredChains: TriggerCheckResult["triggeredChains"]): Promise<PlannedTransfer[]>;
+    /**
+     * Plan transfers for a specific asset using greedy surplus–deficit matching.
+     */
+    private planTransfersForAsset;
+    /**
+     * Execute planned portfolio-level transfers via this service.
+     */
+    executePortfolioRebalancing(transfers: PlannedTransfer[]): Promise<RebalancingResult>;
+    /**
+     * High-level portfolio rebalance:
+     * 1) Check triggers
+     * 2) Plan transfers
+     * 3) Execute transfers
+     */
+    rebalancePortfolio(): Promise<RebalancingResult>;
+    /**
+     * Get current balance for a token on a chain.
+     * Returns balance in normalized USD value (treating token as $1).
+     */
+    private getCurrentBalance;
+    estimate(options: UnifiedRebalanceOptions): Promise<{
+        method: "cctp";
+        estimate: Awaited<ReturnType<CctpRebalancer["estimateCctp"]>>;
+    } | {
+        method: "usdt0";
+        estimate: Usdt0EstimateResult;
+    } | {
+        method: "cex";
+        estimate: CexRebalanceEstimate;
+    }>;
 }
 
 /**
@@ -1809,8 +1988,9 @@ interface CreateLimitOrderRequest {
 }
 /**
  * What the service reports about an order nobody asked it about: a fill worked it
- * down, or took it under the dust floor. Operator-initiated changes are reported
- * by the controller that took the request.
+ * down, took it under the dust floor, it outlived its `expiresAt` and was
+ * retired, or the orderbook refused its posting. Operator-initiated changes are
+ * reported by the controller that took the request.
  */
 type LimitOrderEvent = {
     kind: "resized";
@@ -1819,6 +1999,12 @@ type LimitOrderEvent = {
 } | {
     kind: "filled";
     order: LimitOrder;
+} | {
+    kind: "expired";
+    order: LimitOrder;
+} | {
+    kind: "rejected";
+    order: LimitOrder;
 };
 /**
  * What came of an order being created: the orderbook's answer, or `unposted` for
@@ -1876,6 +2062,11 @@ declare class LimitOrderService {
     private readonly startingNonce;
     /** The configured ERC-4626 vaults, when the operator runs any. */
     private readonly vaultBalances?;
+    /**
+     * Whether the filler only watches a chain (`--watch-only`, or `watchOnly` in the config,
+     * globally or for that chain). Live: the operator can flip it while running.
+     */
+    private readonly isWatchOnly?;
     private logger;
     private cachedLimits?;
     private onEvent?;
@@ -1885,7 +2076,12 @@ declare class LimitOrderService {
     /** Where a new order's nonce starts; tests pin it, production draws it at random. */
     startingNonce?: () => bigint, 
     /** The configured ERC-4626 vaults, when the operator runs any. */
-    vaultBalances?: VaultHoldings | undefined);
+    vaultBalances?: VaultHoldings | undefined, 
+    /**
+     * Whether the filler only watches a chain (`--watch-only`, or `watchOnly` in the config,
+     * globally or for that chain). Live: the operator can flip it while running.
+     */
+    isWatchOnly?: ((chain: string) => boolean) | undefined);
     /**
      * Attaches the listener fill-driven changes are reported to. `Simplex` does
      * this after boot, the same way the filler is handed the service itself.
@@ -1970,7 +2166,7 @@ declare class LimitOrderService {
      * balance between them. Whichever order fills first draws the inventory down,
      * and the rest are cut to what is left. Netting them here would refuse the
      * second side of every book. Vault positions are counted the same way: the
-     * whole position, not what is left after reservations for fills in flight.
+     * whole position.
      */
     private assertWalletCanPay;
     /**
@@ -1981,28 +2177,19 @@ declare class LimitOrderService {
      * filler might have managed rather than accepting one it could not.
      */
     private vaultHoldings;
-    /**
-     * Works a limit order down by what a fill delivered, and puts the rest back on
-     * the orderbook.
-     *
-     * The order is moved to `resizing` and its new size written before the
-     * orderbook is touched, so a crash mid-way leaves a row that says what it was
-     * doing rather than one that silently advertises output it has already paid.
-     *
-     * The old entry is cancelled before the new one is posted. Two live entries
-     * for one liability would advertise the same output twice, and the gap between
-     * the two calls is at most one request.
-     */
-    settleFill(id: string, delivered: bigint): Promise<LimitOrder | null>;
     /**
      * Puts an order that has already been worked down back on the book, or closes
      * it when what is left is under the orderbook's dust floor for what it pays.
      *
-     * Separate from the draw-down because that is a store write that belongs in
-     * the same transaction as the hold it settles, while this is a round trip to
-     * the orderbook and must not be inside one.
+     * The order is moved to `resizing` before the orderbook is touched, so a crash
+     * mid-way leaves a row that says what it was doing rather than one that silently
+     * advertises output it has already paid. The old entry is cancelled before the
+     * new one is posted: two live entries for one liability would advertise the same
+     * output twice, and the gap between the two calls is at most one request.
      */
     resize(remaining: LimitOrder, delivered: bigint): Promise<LimitOrder | null>;
+    /** Takes an order that has been worked down past the dust floor off the book and closes the row. */
+    private closeFilled;
     /**
      * Cancels the current posting and puts the order back at its present size.
      *
@@ -2011,6 +2198,13 @@ declare class LimitOrderService {
      * thing: whatever the order has left, live on the book again.
      */
     repost(order: LimitOrder | null): Promise<LimitOrder | null>;
+    /**
+     * The order at the size the chain's tally allows, ready to post: lowered in the store
+     * when the tally leaves it less than it holds, and closed when what is left is under
+     * the dust floor (answering null). A tally that cannot be read leaves the size alone,
+     * and the periodic tally pass follows up.
+     */
+    private lowerBeforePosting;
     /** A listener that throws is the listener's problem, not the fill's. */
     private report;
     /**
@@ -2042,9 +2236,10 @@ declare class LimitOrderService {
      *
      * The row is read again and claimed out of `open` first: a fill can have worked
      * it down or started its own repost since reconciliation listed it, and that
-     * write is the one to follow. A fill that lands once the claim is taken waits
-     * in `resize` for this to finish. The EntryPoint is only written with a posting
-     * that landed, so a pass cut short anywhere leaves a row the next pass still
+     * write is the one to follow. A fill that lands once the claim is taken cannot
+     * sync the row, which is `resizing`; the repost lowers the order to the chain's
+     * tally before it posts, and `resize` waits for this to finish. The EntryPoint
+     * is only written with a posting that landed, so a pass cut short anywhere leaves a row the next pass still
      * reads as stale, or as having no entry, and finishes the job.
      */
     private resign;
@@ -2054,15 +2249,40 @@ declare class LimitOrderService {
      * pay for it, and puts the order back on the book at that size.
      *
      * The account tallies each order's payouts on the fill chain and refuses a fill
-     * that would take the tally past the order's size. A fill that never settled
-     * here, or a store restored from an older copy, leaves `remaining` above that
-     * room and the order posted at a size the account will refuse. A tally behind
-     * the store changes nothing: `remaining` is never raised.
+     * that would take the tally past the order's size. Settlement brings an order
+     * down to its tally after each fill; this pass catches what that missed: a sync
+     * that failed, a chain read that did not yet show the fill, a store restored
+     * from an older copy. A tally behind the store changes nothing: `remaining` is
+     * never raised.
      *
      * Answers how many orders were lowered.
      */
     reconcileTallies(): Promise<number>;
-    /** The order as the store now holds it when its tally lowered it, null when it was left alone. */
+    /**
+     * Brings one order's `remaining` down to its on-chain tally and puts it back on
+     * the book at that size, or closes it under the dust floor: what
+     * {@link reconcileTallies} does for every open order.
+     *
+     * The tally is read at `blockNumber` when given: a fill passes the block it landed
+     * in, so an endpoint lagging behind it cannot answer with the tally from before the
+     * fill. The periodic pass reads the latest block.
+     *
+     * The read falls back to the latest block when the pinned one fails.
+     *
+     * Answers whether the order was lowered. False when it is not `open` (also when a
+     * repost takes it between the check and the write), or when the tally leaves it where it is, including a chain that has not yet counted a
+     * fill and a tally that cannot be read (logged by the read). Throws when the chain
+     * cannot be read for the token's decimals, or the store or orderbook fail;
+     * settlement catches that and the periodic pass follows up.
+     */
+    syncToChain(id: string, blockNumber?: bigint): Promise<boolean>;
+    private lowerToTally;
+    /**
+     * The order as the store now holds it when its tally lowered it, null when it was left alone.
+     *
+     * `only` is the statuses the row may hold for the clamp to apply, so a row that moved to
+     * another between the caller's read and this write is not touched.
+     */
     private clampToTally;
     /**
      * Withdraws every order that has outlived the operator's own `expiresAt`.
@@ -2074,7 +2294,13 @@ declare class LimitOrderService {
      * reaches its TTL.
      */
     expireStale(now?: Date): Promise<number>;
-    /** Takes an expired order off the book and closes the row. */
+    /**
+     * Takes an expired order off the book and closes the row, and reports it so the bids
+     * it priced, which would otherwise still pay out at its price, are retracted.
+     *
+     * Guarded like every other posting write: an order the operator cancelled, or a fill
+     * closed, while the entry was coming down keeps that status and is not reported here.
+     */
     private retire;
     /** Every order that has a posting on the book, or should have one. */
     private live;
@@ -2137,20 +2363,55 @@ declare class IntentFiller {
      * built from this same store, so it cannot exist before the filler does.
      */
     private limitOrderService?;
+    /**
+     * Set after construction, like the service: the orderbook every bid is posted to, beside
+     * Hyperbridge. Absent only in tests that bid on Hyperbridge alone.
+     */
+    private orderbookClient?;
+    /**
+     * Whether the Hyperbridge account can pay for a bid, read once the connection is up. A bid
+     * the account cannot pay for goes to the orderbook alone.
+     */
+    private bridgeBalance?;
     private retractionQueue;
     /**
      * Fills are settled one at a time, in the order they were scanned. Several fills of
-     * one order can land in one scan, and each settlement names its bid from the holds
-     * the previous ones left: run side by side, two of them read the same holds and
-     * claim the same one.
+     * one order can land in one scan, and each settlement names its bid from the fills
+     * the previous ones recorded: run side by side, two of them would name the same bid.
      */
     private settlementQueue;
     private paused;
     private stopping;
     private pendingRetractions;
+    /**
+     * Orders seen completed on chain, by us or a rival, lower-cased. The bid loop reads it
+     * before each placement, because a bid placed on a completed order can only revert with
+     * `Filled()` and still pays the placement fee and locks a deposit. Capped at
+     * {@link MAX_COMPLETED_ORDERS}, oldest first.
+     */
+    private completedOrders;
     private rebalancingInterval?;
     private initialRebalanceTimer?;
     private activeRebalances;
+    /**
+     * Chains whose EIP-7702 delegation to the SolverAccount failed at boot.
+     *
+     * The bundler's estimate injects the SolverAccount code by state override, so an
+     * undelegated EOA's bid passes estimation and pays the Hyperbridge bid fees and
+     * deposit for a fill that can never execute. Orders for these chains are skipped
+     * at intake, and a later successful delegation (`enableFills`) clears the entry.
+     *
+     * A mark is a belief about the chain, not proof: a delegation transaction that
+     * mines after its receipt timeout, or a `getCode` that failed, leaves the wallet
+     * delegated on chain while the chain stays marked. The dashboard cannot clear it
+     * (its switch reads the chain and shows "Fills enabled"), so intake re-reads the
+     * chain at most once per `DELEGATION_RECHECK_MS` and drops a stale mark.
+     */
+    private undelegatedChains;
+    /** When each marked chain was last compared with the chain, by `Date.now()`. */
+    private delegationCheckedAt;
+    /** The re-check running now for a chain, so concurrent orders await its answer. */
+    private delegationRechecks;
     private retractionSweepInterval?;
     private hyperbridge;
     private hyperbridgeEndpoint?;
@@ -2176,6 +2437,11 @@ declare class IntentFiller {
      */
     /** Hands the filler the service that keeps the orderbook in step with a fill. */
     setLimitOrderService(service: LimitOrderService): void;
+    /**
+     * Hands the filler the orderbook its bids are posted to. Every bid goes there; it goes to
+     * Hyperbridge as well when the account holds BRIDGE for the deposit.
+     */
+    setOrderbook(client: OrderbookClient): void;
     /**
      * Brings the limit orders' `remaining` in line with their on-chain tallies.
      *
@@ -2198,6 +2464,24 @@ declare class IntentFiller {
     initialize(): Promise<void>;
     /** Chains that both fill and have solver selection active, as state machine ids. */
     private solverSelectionChains;
+    private delegation;
+    /**
+     * Whether a marked chain is in fact delegated, and clears the mark when it is.
+     *
+     * Read at most once per `DELEGATION_RECHECK_MS` per chain. Orders arriving while a
+     * read is in flight await its answer rather than being skipped on the old mark: the
+     * read can be the one that clears it. A read that fails counts as not delegated,
+     * the same as at boot.
+     */
+    private recheckDelegation;
+    /**
+     * Marks a chain undelegated when the wallet is not delegated there. For a chain
+     * that was watch-only at boot: boot skips those, so delegation was never tried or
+     * recorded, and turning watch-only off must not open a chain nothing can fill on.
+     * A chain without solver selection needs no delegation and is left alone. The mark
+     * clears through intake's re-check or `enableFills`.
+     */
+    guardDelegation(chainId: number): Promise<void>;
     /**
      * Delegates the filler EOA via EIP-7702 and tops up EntryPoint deposits.
      *
@@ -2268,12 +2552,34 @@ declare class IntentFiller {
      */
     private checkAndRebalance;
     private startRetractionSweep;
-    /** Enqueues retraction for every due bid; returns how many were queued. */
+    /** Enqueues retraction for every due bid, one pass per commitment; returns how many bids were due. */
     private sweepExpiredBids;
     stop(): Promise<void>;
+    /**
+     * Whether the source gateway still holds escrow for every leg of the order:
+     * `"held"`, `"missing"` for a read that came back empty, or `"unverifiable"` when
+     * the read itself failed. The two failures are kept apart because they mean
+     * different things to an operator: a confirmed zero is a phantom or reorged
+     * commitment, while an unreadable escrow is an RPC fault that says nothing about
+     * the order.
+     *
+     * With `quorum`, every leg is read in one `readWithQuorum` call so each
+     * endpoint's vote is the whole escrow vector — an endpoint that disagrees on any
+     * leg fails to join the agreeing group. That is the read used right before
+     * bidding, where one endpoint alone should not vouch for a commitment a source
+     * reorg may have rewritten; a quorum of the endpoints that answer must. Without
+     * it, the legs are read on the single source client, as the pre-bid check has
+     * always done.
+     */
     private verifyOrderOnSource;
     private handleNewOrder;
     private evaluateOrder;
+    /**
+     * How long `confirmations` take on `chain`, at the block time measured when simplex started.
+     * Zero when there is no block time to be had: the order then keeps the cache's own lifetime,
+     * and an evaluation that expires before its bids is redone.
+     */
+    private confirmationWaitMs;
     /**
      * The destination chain's latest block number, the clock `order.deadline` is read on.
      *
@@ -2298,12 +2604,17 @@ declare class IntentFiller {
      */
     private feeCheckWaived;
     private executeOrder;
+    /**
+     * The venues a bid goes to. The orderbook always; Hyperbridge when there is a connection and
+     * the account holds BRIDGE for the deposit, which the gate decides per bid.
+     */
+    private bidVenues;
     private handleOrderFilledOnChain;
     /**
      * A rival completed an order we bid on. `_filled[commitment]` is now set, so
      * every bid of ours on it can only revert with `Filled()`: retract them, which
-     * returns their Hyperbridge deposits and gives their holds back to the limit
-     * orders now rather than when the stale-bid sweep reaches them.
+     * returns their Hyperbridge deposits now rather than when the stale-bid sweep
+     * reaches them.
      *
      * Only a complete fill closes the order. After a rival's partial fill our bid
      * may still fill the rest, so it is left standing.
@@ -2313,68 +2624,138 @@ declare class IntentFiller {
      */
     private handleRivalCompletion;
     /**
-     * Turns the hold a filled bid was carrying into an actual draw-down.
+     * Settles a fill of ours against the limit orders that priced our bids on its order.
      *
-     * The hold and the delivery are two different numbers: the hold is what the
-     * bid promised, the delivery is what the gateway recorded going out. Giving
-     * the hold back and taking the delivery off `remaining` is what leaves the
-     * order describing the output it still has.
+     * The fill is attributed to one of those bids and recorded against that bid's
+     * limit order, for its history and profit. Then every limit order that priced one
+     * of our bids on the order is brought down to its on-chain tally, which is what
+     * counted the fill: `remaining` follows the chain, not arithmetic here. A partial
+     * fill and a completing one take the same path.
      *
-     * A fill with no amounts leaves the order alone. Sizing a draw-down from a
-     * guess would either advertise output already paid or quietly retire output
-     * still available, and both are worse than an order that looks unchanged
-     * until reconciliation notices.
+     * Nothing here throws for a sync that failed or a chain that does not show the fill
+     * yet; the periodic tally reconciliation lowers the order instead.
      */
+    private settleFilledLimitOrder;
     /**
-     * Takes a hold on every limit order the payout draws on, or none at all.
+     * Records the fill against the limit order of the bid it executed.
+     *
+     * A bid that failed outright cannot have executed, and a bid executes at most once,
+     * so one already recorded against this order is passed over. A retracted bid is not:
+     * retraction takes it out of discovery but does not stop a placer that already fetched
+     * it, which can execute it until its `validUntil`. A retracted bid placed longer before
+     * the fill than its validity window cannot have executed and is passed over; the window is
+     * counted back from when the fill happened, not from when it is settled, which can be long
+     * after behind the settlement queue (see `fillTimeMs`). The
+     * same fill delivered twice, which a scanner replaying from a cursor can do, is recorded
+     * once: a fill is named by its transaction hash and log index, since one transaction can
+     * carry several of our fills.
      *
-     * A bid that reserved only part of what it means to pay would promise output
-     * no order is holding for it, so a hold that cannot be taken gives back the
-     * ones already taken. Reserving in the matcher's order keeps two evaluations
-     * racing the same pair of orders from taking them in opposite sequences.
+     * Deduplication is weaker where those are missing. A fill with no transaction hash
+     * cannot be named, and a bid row with no `bid` identifier cannot be told from the
+     * others on its swap, so a replay of either may be recorded again. Only rows from
+     * before bids carried an identifier and logs that carried no hash are affected.
+     *
+     * A multi-leg swap can be priced by limit orders that pay different tokens, so
+     * the delivery is read per limit order and only bids whose order pays a token the
+     * fill delivered are candidates. The fill is attributed by the escrow it released
+     * (see `executedPricing`): a retracted bid at a better rate must not take the fill from a
+     * live bid whose take covers that escrow, so retracted bids are attributed only when no
+     * live bid could have been it. A live bid the escrow rules out does not hide a retracted
+     * one that covers it.
      */
-    private holdAll;
-    private releaseAll;
-    private settleFilledLimitOrder;
+    private recordExecutedFill;
+    /**
+     * Retracts the bids of a limit order the fill left closed (filled, cancelled or expired),
+     * which can no longer pay out at its price. While the order is live its other bids are
+     * left to the chain: `debitOrder` refuses a fill past its budget, and the gas of such a
+     * revert is the accepted cost of not holding anything locally. Never throws.
+     */
+    private retractBidsOfClosedLimitOrder;
+    /**
+     * How long after it is stored a retracted bid may still execute, in milliseconds:
+     * `bidValiditySeconds` plus `BID_DISCOVERY_PAD_SECONDS`, the window the bid is signed for,
+     * counted from the row (written after the head that window was counted from was read),
+     * plus `BID_PERMIT_SKEW_SECONDS`.
+     *
+     * The skew is the same execution tail the bid's Permit2 deadline allows: a bid can execute
+     * until its permit deadline, which is this window plus that skew. `validUntil` is block-based
+     * and the window is converted to blocks at the fastest block time seen, so a slower chain
+     * keeps a bid executable longer in wall-clock time, and the fill is seen only after its block
+     * is scanned.
+     */
+    private retractedBidWindowMs;
+    /**
+     * When a fill happened, in milliseconds: the timestamp of the block it landed in.
+     *
+     * The event's arrival time is only a stand-in. After downtime or a scanner catch-up a
+     * fill arrives long after it landed, and measuring a retracted bid's window from the
+     * arrival would put every such bid outside it. The arrival time is used when the block
+     * is unknown (`undefined`, or the `0n` a scanner substitutes) or cannot be read.
+     */
+    private fillTimeMs;
     /**
-     * Claims the holds of the one bid of ours a partial fill executed, and nothing
-     * else. It is found among our live bids on the order the same way a completing
-     * fill names it, then claimed by its bid identifier, so the other bids keep their
-     * holds and can still fill the rest. A fill that names none of what our limit
-     * orders pay claims nothing.
+     * Brings one limit order down to its on-chain tally after a fill, logging rather than throwing.
+     * The tally is read at the fill's block, so a lagging endpoint cannot return the tally from before it.
      */
-    private claimExecutedBid;
+    private syncLimitOrder;
     /**
      * What this fill delivered of the token the limit order pays, or null when the
      * fill names none of it.
      */
     private deliveredAgainst;
     /**
-     * Gives back whatever this bid still holds against its limit order.
+     * Whether a limit order can still stand behind a bid at its price: `open`, or `resizing`
+     * while a repost holds it. False once it is filled, cancelled, expired or rejected, or is
+     * gone. Undefined when the store cannot be read, which a caller placing a bid treats as
+     * unconfirmed and one retracting treats as nothing to do.
+     */
+    private limitOrderStands;
+    private markCompleted;
+    private hasCompleted;
+    /**
+     * Retracts the live bids a limit order priced, on every commitment they sit on.
+     *
+     * Called once the order can no longer stand behind them: the operator cancelled it, it
+     * expired, or a fill left it filled or closed. Each such bid would still pay out at a
+     * price the order no longer offers. Only the rows this order priced are retracted, so
+     * another limit order's bid on the same swap order keeps standing, and a bid a pass
+     * cannot close is flagged `dead` by row only.
+     *
+     * Retraction does not make the bids unexecutable: a placer that already fetched one can
+     * execute it until its `validUntil`. A bid that does is settled by provenance like any
+     * other fill, and the order's budget stays on chain. This only returns the deposit and
+     * takes the bid out of discovery.
      *
-     * Safe to call more than once and from either settlement route: the store
-     * hands the reservation out once, so a bid that already converted its hold on
-     * a fill releases nothing here.
+     * Never throws: it runs after a settlement, a cancel or an expiry that has already
+     * happened, and a bid it misses is still retracted by the stale-bid sweep.
      */
+    retractBidsForLimitOrder(limitOrderId: string): Promise<void>;
     /**
-     * Gives back what one bid held. Without a bid identifier it gives back every hold on
-     * the commitment, which is what a dead or filled order needs.
+     * Queues a retraction of this filler's live bids on a commitment: all of them, or only
+     * those named by bid identifier (`bids`) or by row (`rows`).
+     *
+     * A retraction takes the bid out of Hyperbridge's discovery and returns its deposit. It
+     * does not stop a placer that already fetched the bid, which can still execute it until
+     * its `validUntil` (`bidValiditySeconds` plus the pad), so it narrows the exposure and
+     * `bidValiditySeconds` remains the hard bound on it.
      */
-    private releaseReservation;
     private enqueueRetraction;
     /**
-     * Retracts every bid this filler placed on a commitment, by the identifiers recorded when each
-     * was placed.
+     * Retracts the given bid rows on a commitment, by the identifiers recorded when each was
+     * placed, and answers which rows each outcome closed.
      *
      * The identifiers come from the bid rows rather than from Hyperbridge's storage: a bid whose
      * `place_bid` is still in the pool is not in storage yet, and reading storage would find
      * nothing and abandon its deposit once it lands. Its retraction goes out after it from the same
      * account, so it lands after it and reclaims it.
      *
-     * The answer speaks for the commitment as a whole. A bid already gone (`BidNotFound`) is done
-     * with; one that is pending or failed stops the pass, and the sweep comes back for the rest.
-     * Nothing recorded to retract reads as `BidNotFound`, which the caller treats as nothing left
-     * to reclaim.
+     * A retraction that succeeded closes its rows with its hash. `BidNotFound` is terminal, not
+     * retryable: bids only leave the pallet by retraction, so "no bid" means there is nothing
+     * left to reclaim, and its rows close without one. A legacy row with no identifier closes the
+     * same way. A failure leaves its rows open for a retry, and so does a retraction still in
+     * Hyperbridge's pool: resubmitting can only bounce off it (1014), and if it lands the next
+     * attempt's `BidNotFound` closes the row. A pooled one also stops the pass, since the
+     * account's next extrinsic queues behind it; the bids after it stay open too.
      */
     private retractStoredBids;
 }
@@ -2384,8 +2765,6 @@ interface FillerRuntime {
     intentFiller: IntentFiller;
     balanceProvider: BalanceProvider;
     vaultVenue?: VaultFundingPlanner;
-    /** Self-halt visibility/reset for the trading engine (overfill protection). */
-    haltControls: HaltControl[];
     /** Live order-activity bridge; emits `event` per stored row. */
     activity: ActivityRecorder;
     /** The persistence backend this filler was started with. */
@@ -2509,9 +2888,14 @@ interface SimplexOptions {
 }
 /** Events a running filler emits. */
 interface SimplexEvents {
+    /**
+     * `blockHash` is the block the scanner read the placement from; a cross-chain
+     * order is only filled while a quorum still places its transaction there.
+     */
     "order:detected": {
         order: Order;
         transactionHash: string;
+        blockHash: string;
     };
     "order:skipped": {
         orderId: string;
@@ -2606,7 +2990,6 @@ interface ChainInput {
 }
 interface SimplexStatus {
     paused: boolean;
-    halted: boolean;
     /** The solver's EVM account — the same value as `simplex.address`. */
     address: HexString;
     startedAt: number;
@@ -2630,7 +3013,7 @@ declare class LimitOrderController {
     list(filter?: LimitOrderFilter): Promise<LimitOrder[]>;
     get(id: string): Promise<LimitOrder | null>;
     /**
-     * One limit order with its fills and the bids still drawing on it, newest first.
+     * One limit order with its fills and the bids it priced, newest first.
      *
      * What makes `remaining` explicable: a size that shrank is the sum of the fills
      * behind it, and the operator can see which ones. Fills are recorded when they
@@ -2729,7 +3112,17 @@ declare class ChainController {
      * lacks the gateway fee token or the native the paymaster's one-time setup needs.
      */
     enableFills(chainId: number): Promise<void>;
-    /** A global boolean is left alone — expanding it per chain changes how the config validates. */
+    /**
+     * Writes watch-only edits back into the config. A global boolean is left alone —
+     * expanding it per chain changes how the config validates.
+     *
+     * `changed` is the chain just added, removed or toggled, and its new value. It only
+     * matters under the `--watch-only` override: there the in-memory snapshot marks every
+     * chain, and writing it back would make one run permanent for every later run.
+     * Instead only the edited chain is applied — its key deleted when it stops being
+     * watch-only, kept as an explicit flag otherwise — so the override itself never lands
+     * in the file and a later override-free run sees what it would have anyway.
+     */
     private syncWatchOnlyToConfig;
 }
 /** ERC-4626 treasury vaults the filler sources fills from and sweeps into. */
@@ -2866,12 +3259,6 @@ declare class Simplex extends EventEmitter {
      * deposits still locked in the solver-selection pallet.
      */
     bidStats(): Promise<BidStats>;
-    /**
-     * Whether overfill protection has self-halted the engine. A halted filler
-     * refuses every order until {@link resetHalt}.
-     */
-    isHalted(): boolean;
-    resetHalt(): void;
     /** Restricts which order `user` addresses are processed. Omit to accept all. */
     setAllowlist(allowlist: AllowlistConfig | undefined): Promise<void>;
     setLogLevel(level: LogLevel): void;