@toon-protocol/rig 3.6.0 → 4.0.0

package/dist/standalone/index.d.ts

@@ -1,8 +1,178 @@
-import { ToonClientConfig, SignedBalanceProof, PublishEventResult } from '@toon-protocol/client';
-export { extractArweaveTxId } from '@toon-protocol/client';
-import { U as UnsignedEvent, P as Publisher, F as FeeRates, G as GitObjectUpload, a as UploadReceipt, B as BlobUpload, b as PublishReceipt } from '../publisher-BFcnZeJI.js';
+import { P as Publisher, F as FeeRates, G as GitObjectUpload, U as UploadReceipt, B as BlobUpload, S as StoreJobRequest, a as StoreJobResponse, b as UnsignedEvent, c as PublishReceipt } from '../publisher-CcL96ugq.js';
 import '@toon-protocol/core/nip34';
 
+/**
+ * The paid write path on `@toon-protocol/client` 2.x — a {@link Publisher}
+ * that pays a TOON connector per request.
+ *
+ * Everything a paid command needs comes from one connector URL: the client
+ * reads the node's own `GET /ilp` (addresses, prices, settlement chains,
+ * sealing key — connector ADR 0050), opens or adopts a payment channel, and
+ * pays each request with a signed claim. There is no relay to discover peers
+ * on (kind:10032 was removed by ADR 0046) and no topology to negotiate: a
+ * destination is a route the node prices, and `send()` pays what the route
+ * costs — including the per-kibibyte part of an ADR 0065 schedule, which the
+ * client works out from the sealed payload so this publisher never has to.
+ *
+ * Three request shapes, all ordinary paid POSTs:
+ *
+ *  1. `publishEvent` — a NIP-34 event signed with the OWNER's Nostr key,
+ *     sent as `{ event }` to the publish route; the relay answers
+ *     `{ eventId, storedAt, payment? }`.
+ *  2. `uploadGitObject` / `uploadBlob` — a kind:5094 store job carrying the
+ *     bytes base64 in an `i` tag; the store answers the Arweave tx id.
+ *  3. `submitStoreJob` — a kind:5095 / 5096 job with `param` tags; the
+ *     DVM's answer comes back as data, refusal included (ADR 0020: an answer
+ *     is an answer, and the payer was charged for it).
+ *
+ * The store route may terminate on a different node than the one addressed
+ * (the edge forwards it). Then the payload must be sealed to THAT node's
+ * identity — `sealTo` — and, when the store node holds its own channel, paid
+ * through its own client. Both are options here; the common single-node case
+ * needs neither.
+ */
+
+/** A paid request, as `ToonClient.send` takes it. */
+interface PaidRequest {
+    method?: string;
+    target?: string;
+    headers?: Record<string, string> | [string, string][];
+    body?: string | Uint8Array | object;
+}
+interface PaidSendOptions {
+    /** The terminating connector's `GET /ilp` URL or raw key, on a forwarded route. */
+    sealTo?: string | Uint8Array;
+    timeoutMs?: number;
+}
+interface PaidFulfilled {
+    fulfilled: true;
+    status: number;
+    body: Uint8Array;
+    /** What this request paid; absent on a route priced at zero. */
+    claim?: {
+        amount: bigint;
+    };
+}
+interface PaidRefused {
+    fulfilled: false;
+    code: string;
+    message: string;
+    refusedBy?: string;
+}
+type PaidSendResult = PaidFulfilled | PaidRefused;
+/** The route terms a connector publishes: a base price and an optional slope. */
+interface RouteTerms {
+    price: bigint;
+    pricePerKib?: bigint;
+}
+/** The slice of `ToonClient` (2.x) this publisher needs. */
+interface PaidClientLike {
+    send(destination: string, request: PaidRequest, options?: PaidSendOptions): Promise<PaidSendResult>;
+    /** The node's terms for a destination, or `null` when it prices no such route. */
+    routePrice(destination: string): Promise<RouteTerms | null>;
+}
+/** One leg of the write path: who pays, where to, and whom to seal to. */
+interface PaidLeg {
+    client: PaidClientLike;
+    destination: string;
+    sealTo?: string | Uint8Array;
+}
+interface ConnectorPublisherOptions {
+    /** Pays the publish route and signs nothing — the Nostr key below signs. */
+    publish: PaidLeg;
+    /** Pays the store route (often the same client as `publish`). */
+    store: PaidLeg;
+    /** The owner's Nostr secret key: signs every event this publisher sends. */
+    nostrSecretKey: Uint8Array;
+    /**
+     * A configured per-event fee. Informational floor only: the connector's
+     * published price for the publish route wins when it is higher, and the
+     * client pays that price whatever this says.
+     */
+    eventFee?: bigint;
+    /** Per-packet timeout for uploads (the store's Arweave round trip). */
+    uploadTimeoutMs?: number;
+    warn?(line: string): void;
+}
+declare class ConnectorPublishError extends Error {
+    constructor(message: string);
+}
+/**
+ * Read the Arweave tx id out of a store's kind:5094 answer.
+ *
+ * The store answers one of two ways — `{ txId }` as JSON, or the bare id
+ * base64 in `data` — and refuses with `{ accept: false, error }`. A non-2xx
+ * status is a refusal too; both are thrown, because an upload without an id
+ * is an upload that did not happen (even though the packet was paid for).
+ */
+declare function extractArweaveTxId(status: number, body: Uint8Array): string;
+declare class ConnectorPublisher implements Publisher {
+    private readonly publish;
+    private readonly store;
+    private readonly nostrSecretKey;
+    private readonly configuredEventFee;
+    private readonly uploadTimeoutMs;
+    private readonly warn;
+    private rates;
+    constructor(options: ConnectorPublisherOptions);
+    /** Where events go, and where objects go. */
+    get destinations(): {
+        publish: string;
+        store: string;
+    };
+    /**
+     * The two routes' published terms, read once per publisher. A route the
+     * node does not price is a configuration error and says which knob to fix.
+     */
+    getFeeRates(): Promise<FeeRates>;
+    private readFeeRates;
+    private sign;
+    /** One paid kind:5094 write; returns the tx id and what the claim spent. */
+    private storeWrite;
+    uploadGitObject(upload: GitObjectUpload): Promise<UploadReceipt>;
+    uploadBlob(upload: BlobUpload): Promise<UploadReceipt>;
+    /**
+     * One NIP-90 job to the store node's DVM, over the paid path. A refusal is
+     * returned, not thrown: `accept: false` and a non-2xx status are the
+     * answer's content, and the payer was charged for the answer (ADR 0020).
+     */
+    submitStoreJob(request: StoreJobRequest): Promise<StoreJobResponse>;
+    /**
+     * Sign the event with the owner's key and pay to publish it. `relayUrls`
+     * is the seam's plural surface: this publisher routes to one configured
+     * destination, so more than one relay is refused rather than half-done.
+     */
+    publishEvent(event: UnsignedEvent, relayUrls: string[]): Promise<PublishReceipt>;
+}
+
+/**
+ * The Nostr signing key rig derives from a BIP-39 phrase.
+ *
+ * `@toon-protocol/client` 2.x is a pure payer and carries no Nostr identity
+ * (its own words), so the derivation that lived in the 0.x client moves here,
+ * unchanged: `m/44'/1237'/0'/0/<accountIndex>`. Unchanged matters — this is
+ * the key every existing rig repo is owned by (`toon.owner`, the kind:30617
+ * author), and it is also the secp256k1 key the client reads a phrase's EVM
+ * account from under `keyDerivation: 'legacy'`, so one phrase still yields one
+ * author AND the wallet its channels were funded at.
+ */
+/** A BIP-32 non-hardened child index fits in 31 bits. */
+declare const MAX_ACCOUNT_INDEX = 2147483647;
+/** The path rig has always derived its Nostr key at. */
+declare function nostrDerivationPath(accountIndex?: number): string;
+interface NostrKey {
+    /** 32-byte secp256k1 secret. */
+    secretKey: Uint8Array;
+    /** 32-byte x-only public key, hex. */
+    pubkey: string;
+}
+/**
+ * Derive the Nostr key of a phrase at an account index.
+ *
+ * @throws when the index is out of range or the phrase yields no key.
+ */
+declare function deriveNostrKeyFromMnemonic(mnemonic: string, accountIndex?: number): NostrKey;
+
 /**
  * Peer→channel map for the STANDALONE embedded publisher (#262).
  *
@@ -32,6 +202,15 @@ import '@toon-protocol/core/nip34';
  * whole lifetime — the same guard that serializes the claim watermark also
  * serializes this file for one identity. `rig channel list` reads only.
  *
+ * COUNTERPARTY: the key names a ROUTE, not a node — an ILP name can change
+ * hands (the devnet apex `g.toon` was retired and another node took over
+ * `g.toon.relay`). A record therefore also carries the counterparty
+ * settlement address it was opened against (`context.recipient`), which is
+ * re-checked against the destination's announced address before every resume
+ * ({@link counterpartyMatch}); a rotated counterparty
+ * {@link ChannelMapStore.supersede}s the record instead of signing claims a
+ * connector with no record of that channel refuses (`F01`).
+ *
  * CORRUPTION: an unreadable/invalid map file is a hard
  * {@link ChannelMapCorruptError} — surfaced BEFORE any on-chain open — never
  * an empty fallback. Falling back to "no channels" would silently open (and
@@ -87,6 +266,15 @@ interface ChannelMapRecord {
     /** ISO timestamps. */
     openedAt: string;
     lastUsedAt: string;
+    /**
+     * ISO timestamp this record was RETIRED from the resume path because the
+     * destination now announces a different settlement address than the channel
+     * was opened against (see {@link counterpartyMatch} /
+     * {@link ChannelMapStore.supersede}). A superseded record is never resumed
+     * again, but stays in {@link ChannelMapStore.list} so `rig channel
+     * list/close/settle` can still reclaim whatever it holds on-chain.
+     */
+    supersededAt?: string;
 }
 /** The composite key a record is stored under. */
 interface ChannelMapKey {
@@ -114,6 +302,35 @@ declare class ChannelMapCorruptError extends Error {
     readonly path: string;
     constructor(path: string, detail: string);
 }
+/**
+ * Compare settlement addresses. EVM addresses travel in mixed checksum case
+ * (an announce may say `0xF29f…` where the record says `0xf29f…`) and are
+ * compared case-insensitively; anything else (base58 Solana, base58check
+ * Mina) is case-SIGNIFICANT and compared verbatim.
+ */
+declare function sameSettlementAddress(a: string, b: string): boolean;
+/**
+ * Does a recorded channel still belong to the counterparty the destination
+ * announces TODAY?
+ *
+ * The map key is `identity|destination|chain|tokenNetwork` — it carries no
+ * counterparty. When the node terminating an ILP name is REPLACED (the devnet
+ * apex `g.toon` was retired and another node took over `g.toon.relay`), all
+ * four key fields still match, so rig resumed a channel opened against the
+ * old node and signed claims against it. The new connector holds no record of
+ * that channel and refuses every packet: `F01 - claim rejected: names a
+ * channel this connector has no record of`. Every paid write failed until the
+ * cache entry was deleted by hand.
+ *
+ * - `'match'` — same counterparty, safe to resume.
+ * - `'mismatch'` — the counterparty rotated: the record must be superseded and
+ *   the channel re-resolved.
+ * - `'unrecorded'` — nothing to compare (a record written before this field
+ *   was validated, or a peer that announced no settlement address). Resume is
+ *   allowed and the caller should enrich the record with what the announce
+ *   says, so the NEXT run is verifiable.
+ */
+declare function counterpartyMatch(record: Pick<ChannelMapRecord, 'context'>, announced: string | undefined): 'match' | 'mismatch' | 'unrecorded';
 /** The key fields of a full record. */
 declare function recordKey(record: ChannelMapRecord): ChannelMapKey;
 interface ChannelMapStoreOptions {
@@ -135,7 +352,9 @@ declare class ChannelMapStore {
     list(): ChannelMapRecord[];
     /**
      * Recorded channels for one (identity, destination) pair — the resume
-     * candidates for a paid command. @throws {ChannelMapCorruptError}
+     * candidates for a paid command. Superseded records are EXCLUDED: they are
+     * retired from the resume path for good, and only `list()` (what `rig
+     * channel` enumerates) still shows them. @throws {ChannelMapCorruptError}
      */
     listFor(identity: string, destination: string): ChannelMapRecord[];
     /**
@@ -146,12 +365,27 @@ declare class ChannelMapStore {
      */
     record(record: Omit<ChannelMapRecord, 'openedAt' | 'lastUsedAt'> & Partial<Pick<ChannelMapRecord, 'openedAt' | 'lastUsedAt'>>): void;
     /**
-     * Bump a record's `lastUsedAt` (and optionally its known on-chain deposit)
-     * after resuming it. Unknown keys are a no-op.
+     * Bump a record's `lastUsedAt` (and optionally its known on-chain deposit,
+     * or the counterparty a pre-validation record was written without) after
+     * resuming it. Unknown keys are a no-op.
      */
     touch(key: ChannelMapKey, update?: {
         depositTotal?: string;
+        recipient?: string;
     }): void;
+    /**
+     * Retire a record from the resume path — the counterparty that terminates
+     * its destination has been REPLACED, so the channel it names is dead to the
+     * new node (`F01 - claim rejected`) even though every key field still
+     * matches (see {@link counterpartyMatch}).
+     *
+     * The record is MOVED to an archive key rather than deleted: it may still
+     * hold an on-chain deposit, and `rig channel list/close/settle` find
+     * channels by scanning `list()`, so deleting it would strand those funds
+     * behind hand-editing the JSON. Moving it also frees the live key for the
+     * re-resolved channel. Idempotent, and a no-op for an unknown record.
+     */
+    supersede(record: ChannelMapRecord): void;
     /**
      * Read one channel's nonce-watermark entry from the client's
      * `channels.json` (undefined when the file or entry is missing).
@@ -283,437 +517,6 @@ interface StandaloneMoneyOps {
     walletChainBalances(): Promise<WalletChainBalanceInfo[]>;
 }
 
-/**
- * StandalonePublisher — impl 2 of the {@link Publisher} seam (#228): an
- * EMBEDDED ToonClient constructed from the caller's config (mnemonic +
- * account index, the exact `packages/client/src/config.ts` shape) instead of
- * routing through a running toon-clientd. Made for CI jobs, servers, and
- * one-shot CLI runs where no daemon exists.
- *
- * Paid-write mechanics mirror the production daemon path
- * (`client-mcp/src/daemon/client-runner.ts`) and the proven seed pipeline
- * (`rig/tests/e2e/seed/lib/{publish,git-builder}.ts`):
- *
- *  - one signed balance-proof CLAIM per write (`signBalanceProof(channelId,
- *    fee)` — the ChannelManager accumulates the cumulative watermark),
- *  - publishes route to the relay write destination with a flat per-event
- *    fee (the daemon's `feePerEvent` convention),
- *  - git objects upload as kind:5094 store writes tagged
- *    Git-SHA/Git-Type/Repo, priced at bytes × per-byte rate (the seed
- *    pipeline's bid), routed to the store destination via `proxyPath:
- *    '/store'`, with the Arweave txId decoded from the FULFILL data.
- *
- * Because the embedded client signs claims on the SAME channels a daemon on
- * the same identity would, every paid operation is preceded by the nonce
- * guard (./nonce-guard.ts): refuse if a toon-clientd holds this identity,
- * and hold an exclusive per-pubkey lockfile against other standalone
- * processes for the lifetime of this publisher.
- *
- * Channel REUSE (#262): with a `channelMap` configured, start() resumes the
- * channel recorded for (identity, channel anchor) — `trackChannel` rehydrates
- * the cumulative-claim watermark from the client's channels.json — and
- * records any fresh lazy open, so sequential CLI invocations share ONE
- * on-chain channel instead of stranding a deposit per run (./channel-map.ts).
- */
-
-/** A fully-signed Nostr event (structural subset of nostr-tools' NostrEvent). */
-interface SignedNostrEvent extends UnsignedEvent {
-    id: string;
-    pubkey: string;
-    sig: string;
-}
-/**
- * The slice of `ToonClient` the publisher drives. Kept structural so tests
- * inject a mock and alternative client builds stay compatible.
- */
-interface ToonClientLike {
-    start(): Promise<unknown>;
-    stop(): Promise<void>;
-    isStarted?(): boolean;
-    getPublicKey(): string;
-    signEvent(template: UnsignedEvent): SignedNostrEvent;
-    openChannel(destination?: string): Promise<string>;
-    signBalanceProof(channelId: string, amount: bigint): Promise<SignedBalanceProof>;
-    publishEvent(event: SignedNostrEvent, options?: {
-        destination?: string;
-        claim?: SignedBalanceProof;
-        ilpAmount?: bigint;
-        proxyPath?: string;
-    }): Promise<PublishEventResult>;
-    /** On-chain deposit total for a tracked channel (channel-map bookkeeping). */
-    getChannelDepositTotal?(channelId: string): bigint;
-    /** Re-read a RESUMED channel's on-chain deposit (persisted state omits it). */
-    rehydrateChannelDeposit?(channelId: string, opts: {
-        chain: string;
-        tokenNetworkAddress: string;
-    }): Promise<bigint | undefined>;
-    /** Deposit extra collateral (base-unit delta) into an open channel. */
-    depositToChannel?(channelId: string, amount: string | bigint): Promise<{
-        channelId: string;
-        txHash?: string;
-        depositTotal: string;
-    }>;
-    /** Close a channel — starts the settlement challenge window (on-chain). */
-    closeChannel?(channelId: string): Promise<{
-        channelId: string;
-        txHash?: string;
-        /** Unix SECONDS, string-encoded. */
-        closedAt: string;
-        settleableAt: string;
-    }>;
-    /** Settle a closed channel after its window — releases funds (on-chain). */
-    settleChannel?(channelId: string): Promise<{
-        channelId: string;
-        txHash?: string;
-    }>;
-    /**
-     * Free FULL multi-chain wallet view (#299) — native coin + configured tokens
-     * per chain — works on an UNSTARTED client (Solana/Mina addresses are derived
-     * from the mnemonic on demand). `fallback` supplies Solana/Mina channel params
-     * to read WHEN the client config has none, without touching settlement config.
-     */
-    getWalletBalances?(fallback?: WalletViewFallback): Promise<WalletChainBalanceInfo[]>;
-}
-/**
- * Wallet-view-only Solana/Mina channel defaults (#299): RPC/GraphQL + token used
- * to READ the balance of a chain the identity has no configured channel for, so
- * `rig balance` shows all three chains (0 for a not-yet-on-chain account). These
- * NEVER enter the client's settlement config — they cannot influence chain
- * negotiation — so a preset default here is safe even for a chain the wallet
- * cannot yet settle on.
- */
-interface WalletViewFallback {
-    solanaChannel?: ToonClientConfig['solanaChannel'];
-    minaChannel?: ToonClientConfig['minaChannel'];
-}
-interface StandalonePublisherOptions {
-    /**
-     * ToonClient config (mnemonic + mnemonicAccountIndex + proxy/BTP uplink +
-     * settlement fields — see `packages/client/src/config.ts`). Exactly one of
-     * `clientConfig` | `client` is required.
-     */
-    clientConfig?: ToonClientConfig;
-    /** Pre-built client (tests / advanced callers). */
-    client?: ToonClientLike;
-    /**
-     * ILP route for event publishes (relay `/write`). Default: derived from the
-     * config's `destinationAddress` anchor (`<base>.relay.store` → `<base>.relay`,
-     * matching the daemon's route derivation), else the anchor itself.
-     */
-    publishDestination?: string;
-    /**
-     * ILP route for git-object uploads (store `/store` → Arweave). Default:
-     * derived like `publishDestination` (`<base>.relay.store` → `<base>.store`).
-     */
-    storeDestination?: string;
-    /**
-     * ILP destination the payment channel anchors to. Default: the client
-     * config's `destinationAddress`.
-     */
-    channelDestination?: string;
-    /**
-     * Client config for a SECOND uplink dedicated to store writes, when the
-     * store route terminates on a different node than publishes.
-     *
-     * A balance-proof claim is only verifiable by the connector holding that
-     * channel — one with no record of it refuses the packet (`F01 - claim
-     * rejected: names a channel this connector has no record of`). The store
-     * node has its own settlement address and its own channel, and on the
-     * two-box fleet the publish node has no route to it, so a store write
-     * cannot ride the publish session. Given this, store writes go out on
-     * their own client, against their own channel, recorded under their own
-     * anchor so `rig channel` still sees it.
-     *
-     * A separate CLIENT rather than a second destination on the existing one
-     * because `@toon-protocol/client` carries a single `btpUrl` per instance —
-     * there is no per-destination uplink to configure. Omitted (the
-     * single-node case) keeps the historical behaviour: one client, one
-     * channel, store writes on the publish session.
-     */
-    storeClientConfig?: ToonClientConfig;
-    /**
-     * Pre-built store-leg client (tests / advanced callers) — the store-side
-     * counterpart of `client`, and mutually exclusive with
-     * `storeClientConfig` in the same way.
-     */
-    storeClient?: ToonClientLike;
-    /** Flat fee per published event (daemon `feePerEvent` convention). Default 1n. */
-    eventFee?: bigint;
-    /**
-     * FLAT per-packet route prices for the publish/store destinations, as the
-     * payment peer announces them (kind:10032 `capabilities` — e.g.
-     * `{capability:'os.publish', address:'g.proxy.relay', price:'1000'}`) or as
-     * the terminating connector reports them from `GET /ilp/routes/price`.
-     *
-     * The connector gates every paid packet at the destination route's price: a
-     * balance-proof claim advancing the channel by less is rejected (F06). Since
-     * ADR 0020 (toon-client#452) a price is flat per handler, so `store` is the
-     * WHOLE upload fee rather than a floor under a per-byte computation — an
-     * upload of any size costs it. `publish` still floors {@link eventFee},
-     * which remains a caller-chosen flat figure.
-     *
-     * A destination without a known price prices its packets at 0 here and lets
-     * the connector be the one to refuse — this class never invents a rate.
-     */
-    routePrices?: {
-        publish?: bigint;
-        store?: bigint;
-    };
-    /** Daemon control API port probed by the nonce guard. */
-    daemonPort?: number;
-    /**
-     * Skip Guard 1 (the same-identity daemon refusal, {@link checkDaemonIdentity})
-     * — the force-standalone override ({@link standaloneForced} / RIG_STANDALONE
-     * / `rig --standalone`). Guard 2, the exclusive per-identity {@link NonceLock},
-     * ALWAYS runs regardless, so two standalone processes still can't race the
-     * channel watermark. Default false (daemon-aware).
-     */
-    skipDaemonCheck?: boolean;
-    /** Directory for the per-identity advisory lockfile. */
-    lockDir?: string;
-    /** Fetch impl for the daemon probe (tests). */
-    fetchImpl?: typeof fetch;
-    /**
-     * Peer→channel map store (#262): start() resumes the channel recorded for
-     * (identity, channel anchor) instead of opening a fresh one, and records
-     * any fresh lazy open for the next invocation. Absent (embedded callers
-     * managing their own channel lifecycle): the historical behaviour — open
-     * lazily every run, record nothing.
-     */
-    channelMap?: ChannelMapStore;
-    /**
-     * Per-chain settlement parameters to BACK-FILL into the client's peer
-     * negotiations after start (#264/#260): peers whose kind:10032 announce
-     * carries no `tokenNetworks`/`preferredTokens` negotiate with those fields
-     * empty, and the on-chain channel open then fails ("tokenNetwork address
-     * is required"). Values here never override what a peer DID announce —
-     * they only fill gaps, keyed by the negotiated chain id.
-     */
-    negotiationFallbacks?: {
-        tokenNetworks?: Record<string, string>;
-        preferredTokens?: Record<string, string>;
-    };
-    /** Sink for non-fatal channel-persistence warnings (default: stderr). */
-    warn?: (line: string) => void;
-}
-/** A relay/store rejected a paid write (fee NOT spent iff the claim failed too). */
-declare class StandalonePublishError extends Error {
-    constructor(message: string);
-}
-/**
- * Derive publish/store routes from the channel anchor. Behind the devnet
- * proxy the anchor is `<base>.relay.store` (e.g. `g.proxy.relay.store`):
- * publishes terminate at `<base>.relay`, uploads at `<base>.store`. Anchors
- * not matching the convention pass through unchanged.
- */
-declare function deriveRouteDestinations(anchor: string): {
-    publish: string;
-    store: string;
-};
-
-declare class StandalonePublisher implements Publisher {
-    private readonly client;
-    private readonly ownsClient;
-    private readonly publishDestination;
-    private readonly storeDestination;
-    private readonly channelDestination;
-    private readonly eventFee;
-    private readonly routePrices;
-    private readonly daemonPort;
-    private readonly skipDaemonCheck;
-    private readonly lockDir;
-    private readonly fetchImpl;
-    private readonly channelMap;
-    /** ILP anchor the channel is keyed by in the map (peer/apex destination). */
-    private readonly channelAnchor;
-    private readonly negotiationFallbacks;
-    private readonly warn;
-    private readonly storeClientConfig;
-    private readonly injectedStoreClient;
-    /** Lazily built on the first store write — see {@link storeLeg}. */
-    private storeClient;
-    private storeChannelId;
-    private storeLegPromise;
-    private lock;
-    private channelId;
-    private readyPromise;
-    /** Guard + client start only (no channel) — see {@link startClientOnly}. */
-    private clientReadyPromise;
-    /** True when the last start() RESUMED the recorded channel (#263). */
-    private lastOpenResumed;
-    constructor(options: StandalonePublisherOptions);
-    /** Hex Nostr pubkey of the embedded identity (available before start). */
-    getPublicKey(): string;
-    /**
-     * Run the nonce guard, start the embedded client, and open (or resume) the
-     * payment channel. Called lazily by the first paid operation; safe to call
-     * eagerly to fail fast. Idempotent.
-     */
-    start(): Promise<void>;
-    /**
-     * Run the nonce guard and start the embedded client WITHOUT touching the
-     * payment channel (#263): `channel close`/`settle` operate on a RECORDED
-     * channel and must never open a fresh one as a side effect of starting.
-     * Idempotent; `start()` layers the channel open/resume on top of this.
-     */
-    startClientOnly(): Promise<void>;
-    private doStartClient;
-    /**
-     * Back-fill negotiated peer metadata the announce did not carry
-     * (#264/#260 root cause 3): after the client's bootstrap negotiation, any
-     * peer negotiation missing `tokenNetwork`/`tokenAddress` gets the derived
-     * per-chain fallback for its negotiated chain, BEFORE the lazy channel
-     * open reads them. Announced values are never overridden.
-     */
-    private applyNegotiationFallbacks;
-    /**
-     * Open the payment channel — or, when the channel map has a record for
-     * (identity, anchor), RESUME the recorded on-chain channel (#262).
-     *
-     * Resume seeds the client's ChannelManager (`trackChannel` rehydrates the
-     * cumulative-claim watermark from channels.json; `peerChannels` makes the
-     * subsequent `openChannel` return the same id instead of opening on-chain).
-     * A fresh open is RECORDED so the next invocation resumes it. A corrupt map
-     * file throws BEFORE anything is opened — never a silent duplicate open.
-     */
-    private openOrResumeChannel;
-    /**
-     * {@link openOrResumeChannel} for an arbitrary client + destination, so
-     * the store leg gets the same resume-before-open guarantee (and the same
-     * corruption check) as the publish leg rather than a second, weaker path.
-     *
-     * `anchor` defaults to the destination: a leg other than the publish one
-     * is keyed in the channel map by the route it pays for.
-     * `trackResumeState` is publish-only — {@link lastOpenResumed} feeds the
-     * `resumed` field of this publisher's channel status, which describes the
-     * publish channel and would be wrong to overwrite from a store open.
-     */
-    private openOrResumeChannelOn;
-    /**
-     * Try to resume one recorded channel: the first candidate whose peer is
-     * still negotiated on the SAME chain + tokenNetwork and whose watermark
-     * does not show it closed/settled. Returns the resumed record, if any.
-     */
-    private resumeRecordedChannel;
-    /** Record a freshly opened channel (+ seed its claim watermark at 0/0). */
-    private recordOpenedChannel;
-    /** Release the identity lock and stop the embedded client (if we own it). */
-    stop(): Promise<void>;
-    /**
-     * Explicit `rig channel open`: the SAME resume-or-open path the lazy paid
-     * writes use (guard → start → resume the recorded channel or open + record
-     * a fresh one), surfaced with a receipt — plus an optional extra collateral
-     * deposit on top of the open/resume.
-     */
-    openChannelExplicit(opts?: {
-        /** Extra collateral to deposit AFTER the open/resume (base units). */
-        deposit?: bigint;
-    }): Promise<ChannelOpenOutcome>;
-    /**
-     * Adopt a RECORDED channel into the running client so on-chain close/
-     * settle/deposit can act on it: `trackChannel` rehydrates the claim
-     * watermark + withdraw timers from channels.json, `peerChannels` binds the
-     * peer, and the on-chain client's context cache is re-seeded (it only
-     * learns context at open time — a resumed channel would otherwise throw
-     * "No on-chain context").
-     */
-    private adoptRecordedChannel;
-    /**
-     * Close a recorded channel: starts the on-chain settlement challenge
-     * window. The client persists `closedAt`/`settleableAt` into the claim
-     * watermark store, which is exactly where `rig channel list`/`balance`
-     * derive the closing/settleable/settled status from. Guard + client start,
-     * but NEVER a channel open ({@link startClientOnly}).
-     */
-    closeRecordedChannel(record: ChannelMapRecord): Promise<ChannelCloseOutcome>;
-    /**
-     * Settle a recorded channel after its challenge window — releases the
-     * remaining collateral. The client enforces the `now >= settleableAt` time
-     * guard BEFORE spending gas (a too-early call throws its retryable
-     * SettleTooEarlyError) and persists `settledAt` into the watermark store.
-     */
-    settleRecordedChannel(record: ChannelMapRecord): Promise<ChannelSettleOutcome>;
-    /**
-     * The full multi-chain wallet view (#299) for the embedded identity — native
-     * coin + configured tokens (USDC) per chain — a FREE read on the UNSTARTED
-     * client (no nonce guard, no uplink, no channel). The client derives the
-     * Solana/Mina addresses from the mnemonic on demand, so ALL configured chains
-     * appear even before a start. Best-effort per chain (an unreachable RPC yields
-     * an `unreadable` chain, not a failure). `fallback` supplies Solana/Mina RPC
-     * defaults (e.g. the network preset) for chains the config has no channel for.
-     */
-    readWalletChainBalances(fallback?: WalletViewFallback): Promise<WalletChainBalanceInfo[]>;
-    /**
-     * Fee rates for `planPush` estimation, both flat per packet (ADR 0020),
-     * with the announced route prices folded in so the ESTIMATE always equals
-     * the CLAIMS: `eventFee` is returned pre-floored at the publish route price,
-     * and `uploadFee` IS the store route price.
-     */
-    getFeeRates(): Promise<FeeRates>;
-    /**
-     * The flat per-event claim: `eventFee`, floored at the publish route's
-     * announced price (the connector rejects a claim below it — F06).
-     */
-    private effectiveEventFee;
-    /**
-     * The per-upload claim: the store route's flat price, whatever the object's
-     * size. Byte-proportional pricing has no successor (ADR 0020) — the route
-     * table is the price list — and the connector charges this figure whether
-     * the body is 100 bytes or 100 KB.
-     */
-    private uploadFee;
-    /**
-     * Upload one git object as a kind:5094 store write (Git-SHA/Git-Type/Repo
-     * tagged — the proven seed-pipeline shape), signing one balance-proof claim
-     * for the store route's flat price
-     * ({@link StandalonePublisherOptions.routePrices}) — ADR 0020 prices a
-     * packet per handler, not per byte.
-     *
-     * #368: a blob's `Content-Type` is derived from its path extension (else
-     * octet-stream) and sent in the `output` tag, which the store forwards onto
-     * the Arweave upload's Content-Type — so a gateway serves `index.html` as
-     * `text/html`, not `application/octet-stream`. Non-blob objects (trees,
-     * commits, tags) are never served as files, so they stay octet-stream.
-     */
-    uploadGitObject(upload: GitObjectUpload): Promise<UploadReceipt>;
-    /**
-     * Upload one raw blob (no git envelope) with an explicit `Content-Type`
-     * (#368) — a kind:5094 store write carrying just the `i`/`bid`/`output`
-     * tags (and an optional `Repo` provenance tag), NOT the Git-SHA/Git-Type
-     * tags. Without those the store keeps the bytes verbatim instead of
-     * re-deriving a git envelope, which is exactly what the ar.io path manifest
-     * needs. One balance-proof claim for the store route's flat price.
-     */
-    uploadBlob(upload: BlobUpload): Promise<UploadReceipt>;
-    /**
-     * Sign the event with the embedded identity and pay-to-publish it through
-     * the relay write route, one claim for the flat per-event fee.
-     *
-     * `relayUrls` is the interface's plural forward-compat surface (parked
-     * #84): the standalone impl routes over ILP to its single configured
-     * publish destination, so more than one relay is refused rather than
-     * silently half-published.
-     */
-    publishEvent(event: UnsignedEvent, relayUrls: string[]): Promise<PublishReceipt>;
-    private requireChannel;
-    /**
-     * The client + channel a STORE write must be paid on.
-     *
-     * With no `storeClientConfig` this is the publish leg unchanged — the
-     * single-node case, where the store terminates on the connector that
-     * already holds the channel. With one, the store node is a different
-     * connector holding a different channel, and paying it from the publish
-     * channel is precisely the `F01 - claim rejected: names a channel this
-     * connector has no record of` failure this exists to prevent.
-     *
-     * Built on FIRST STORE WRITE, not in `start()`: `rig push` with nothing to
-     * upload, and every read-only command, should not open a second on-chain
-     * channel (gas) for a leg they never use. Memoised on the promise so
-     * concurrent uploads share one open rather than racing two.
-     */
-    private storeLeg;
-}
-
 /**
  * Nonce-ownership guard for the STANDALONE embedded Publisher (#228).
  *
@@ -825,4 +628,4 @@ declare class NonceLock {
     release(): void;
 }
 
-export { type AcquireLockOptions, type ChannelCloseOutcome, ChannelMapCorruptError, type ChannelMapKey, type ChannelMapRecord, ChannelMapStore, type ChannelMapStoreOptions, type ChannelOpenOutcome, type ChannelSettleOutcome, type CheckDaemonOptions, DEFAULT_DAEMON_PORT, DaemonIdentityConflictError, NonceLock, type PersistedChannelContext, RIG_CHANNEL_MAP_FILENAME, type SignedNostrEvent, StandaloneLockError, type StandaloneMoneyOps, StandalonePublishError, StandalonePublisher, type StandalonePublisherOptions, type ToonClientLike, type WalletChainBalanceInfo, type WalletTokenAmountInfo, type WatermarkEntry, channelStatus, checkDaemonIdentity, defaultDaemonPort, defaultLockDir, deriveRouteDestinations, recordKey, resolveChannelPaths };
+export { type AcquireLockOptions, type ChannelCloseOutcome, ChannelMapCorruptError, type ChannelMapKey, type ChannelMapRecord, ChannelMapStore, type ChannelMapStoreOptions, type ChannelOpenOutcome, type ChannelSettleOutcome, type CheckDaemonOptions, ConnectorPublishError, ConnectorPublisher, type ConnectorPublisherOptions, DEFAULT_DAEMON_PORT, DaemonIdentityConflictError, MAX_ACCOUNT_INDEX, NonceLock, type NostrKey, type PaidClientLike, type PaidFulfilled, type PaidLeg, type PaidRefused, type PaidRequest, type PaidSendOptions, type PaidSendResult, type PersistedChannelContext, RIG_CHANNEL_MAP_FILENAME, type RouteTerms, StandaloneLockError, type StandaloneMoneyOps, type WalletChainBalanceInfo, type WalletTokenAmountInfo, type WatermarkEntry, channelStatus, checkDaemonIdentity, counterpartyMatch, defaultDaemonPort, defaultLockDir, deriveNostrKeyFromMnemonic, extractArweaveTxId, nostrDerivationPath, recordKey, resolveChannelPaths, sameSettlementAddress };