Namespace NArk.Abstractions.Wallets

Classes

ArkWalletInfo

Wallet information record used at the abstraction/interface boundary.

DestinationDisabledEventArgs

Raised when a wallet's sweep destination is auto-disabled because an Arkade signer rotation made it stale.

Interfaces

IArkadeAddressProvider

Derives and tracks Arkade contracts for a wallet (receive addresses, boarding scripts, change outputs).

IArkadeWalletSigner

Wallet-side signer used during MuSig2 batch participation. The MuSig2 nonce flow is designed so the secret half never leaves the signer:

1. GenerateNonces(OutputDescriptor, MusigContext, string, CancellationToken) derives the secret nonce internally and returns only the public half.
2. The signer keeps the secret nonce indexed by the caller-supplied sessionId.
3. SignMusig(OutputDescriptor, MusigContext, string, CancellationToken) looks the secret nonce back up by the same sessionId, uses it, and consumes it.

The caller must pass a session-unique sessionId to both calls — typically a transaction identifier (e.g. a tree-node txid in batch participation), or any string the caller can correlate. AggregatePubKey on its own is not unique per signing operation: in a batch tree, multiple transactions can share the same cosigner set and taproot tweak, so their contexts have identical aggregate pubkeys but different sighashes. The sighash is buried inside MusigContext and cannot be observed by the signer, so disambiguation has to be caller-supplied.

IDescriptorSigningSource

A descriptor-scoped source of signing operations. The source owns signing material (locally or by reference) and exposes operations rooted in it — it never returns the raw key, which is what lets a remote-signing implementation honour the same contract.

A wallet's signer is a composition of one or more signing sources (see IArkadeWalletSigner implementations that compose sources). Each source answers CanProvideAsync(OutputDescriptor, CancellationToken) for the descriptors it covers; the composing signer dispatches each call to the first source that claims the descriptor.

The MuSig2 nonce lifecycle from IArkadeWalletSigner applies per-source: GenerateNoncesAsync(OutputDescriptor, MusigContext, string, CancellationToken) retains the secret half indexed by sessionId, and SignMusigAsync(OutputDescriptor, MusigContext, string, CancellationToken) consumes it on use. Different sources maintain independent nonce stores — there is no cross-source sharing.

IDestinationSafetyNotifier

Notifies consumers (e.g. a BTCPay plugin) that a wallet's sweep destination was disabled pending re-confirmation after an Arkade signer rotation. DI-aliased to the same singleton that performs detection.

IRemoteSignerTransport

Transport abstraction over a remote signer. Mirrors IArkadeWalletSigner but adds a walletId argument to every call so a single transport instance can serve multiple wallets (e.g. a multi-user server-side signing service, an HWI bridge, or a browser-extension wallet shared across tabs).

IWalletProvider

Resolves signers and address providers for wallets by ID.

IWalletStorage

Persistence for wallet records.

Enums

NextContractPurpose

Intended use of a freshly derived Arkade contract.

WalletType

The key-derivation flavour of an ArkWalletInfo. This is strictly about how scripts are derived — a single tweaked key vs. an xpub-derived child set — and stays orthogonal to whether the wallet can sign locally, remote-sign, or only watch.

Signing capability is answered by GetSignerAsync(string, CancellationToken): it returns a signer when one is available (local key in Secret, or a remote signer registered for this wallet) and null for watch-only.