The Stellar Side

      Reflector oracle        USDC (SAC)
             │                    │
             └────────┬───────────┘
                      │
   relayer  ──►  writz-lend  ──►  bitcoin-spv  ◄──  relayer
 (release PSBT)                                  (header submission)

// Deposit: rebuilds the Writz P2WSH from the protocol key, user_pubkey and timelock_height,
// verifies SPV, checks key_sig, consumes the txid and creates a position keyed by txid.
pub fn deposit(depositor: Address, /* SPV proof args */, p2wsh_script_pubkey: Bytes, timelock_height: u32, user_pubkey: BytesN<33>, key_sig: BytesN<65>) -> Result<BytesN<32>, WritzLendError>

// Supply / withdraw USDC to and from the pool (scaled balances that grow with interest).
pub fn supply_usdc(supplier: Address, amount: i128) -> Result<(), WritzLendError>
pub fn withdraw_supply(supplier: Address, amount: i128) -> Result<(), WritzLendError>

// Borrow: checks the 150% collateral ratio at the current oracle price, pool liquidity and the total borrow cap.
pub fn borrow(borrower: Address, txid: BytesN<32>, usdc_amount: i128) -> Result<(), WritzLendError>

// Repay: reduces outstanding debt. Emits `repay`, or `repay_full` and closes the position when the debt reaches zero.
pub fn repay(repayer: Address, txid: BytesN<32>, usdc_amount: i128) -> Result<(), WritzLendError>

// Liquidate: the designated keeper, or anyone once the keeper is stale (24h) - checks oracle undercollateralization (< 120%).
pub fn liquidate(keeper: Address, txid: BytesN<32>) -> Result<(), WritzLendError>

// Relayer only: store the co-signed Path A release PSBT for a repaid position; anyone can read it back.
pub fn publish_release_psbt(relayer: Address, txid: BytesN<32>, psbt: Bytes) -> Result<(), WritzLendError>
pub fn get_release_psbt(txid: BytesN<32>) -> Option<Bytes>

utilization = total_borrowed_usdc / total_supplied_usdc

if utilization ≤ Uoptimal (75%):
    borrow_rate = base_rate + (utilization / Uoptimal) × slope1
else:
    borrow_rate = base_rate + slope1 + ((utilization − Uoptimal) / (1 − Uoptimal)) × slope2

// writz-lend
pub fn refresh_position_ttl(env: Env, txid: BytesN<32>) -> bool
pub fn refresh_supply_balance_ttl(env: Env, lender: Address) -> bool
pub fn refresh_protocol_ttl(env: Env)
pub fn refresh_release_psbt_ttl(env: Env, txid: BytesN<32>) -> bool

// bitcoin-spv
pub fn refresh_ttl(env: Env)  // extends Config, Checkpoint, the best tip and its header

User (browser)
    │
    │  1. fetch the SPV proof bundle (relayer API or Esplora)
    │  2. sign the key-control message with the Bitcoin wallet (BIP-137)
    │
    ▼
writz-lend.deposit(spv_proof, p2wsh_script_pubkey, timelock_height, user_pubkey, key_sig)
    │
    ├── check: p2wsh_script_pubkey == P2WSH(protocol key, user_pubkey, timelock_height)
    ├──► bitcoin-spv.verify_transaction(block_hash, merkle_proof, tx_index, raw_tx, min_confirmations)
    │         returns: SpvVerificationResult { txid, block_hash, block_height, confirmations }
    ├── check: timelock_height within 1,008..=105,000 blocks above block_height
    ├── check: key_sig is user_pubkey's signature over (contract, depositor, txid)
    ├──► bitcoin-spv.consume_deposit(writz-lend, txid)   (shared registry: one position per output)
    ├── read: amount paid to the P2WSH output in raw_tx; require >= min_deposit_satoshis
    │
    ├── store: position[txid] = { depositor, btc_satoshis, user_pubkey, timelock_height, debt: 0 }
    └── emit: DepositEvent { txid, btc_satoshis, timelock_height }

On full repayment:
writz-lend.repay(...)  ──►  emit: RepayFullEvent { txid, repayer, p2wsh_script_pubkey }
relayer repay watcher  ──►  build + co-sign Path A PSBT  ──►  writz-lend.publish_release_psbt(txid, psbt)
User                   ──►  writz-lend.get_release_psbt(txid), sign with Bitcoin wallet, broadcast

pub fn verify_groth16(
    env: Env,
    circuit: CircuitType,
    proof: Groth16Proof,
    public_signals: Vec<Bytes32>,
) -> bool

// Deposit: verify SPV, the depositor's Writz script and the ZK proof; create commitment. Returns the new commitment.
pub fn deposit(depositor: Address, /* SPV proof args */, user_pubkey: BytesN<33>, timelock_height: u32, zk_proof: Proof, public_signals: Vec<BytesN<32>>, enc_note: Bytes) -> Result<BytesN<32>, CommitmentTreeError>

// Insert a pending commitment into the Merkle tree, with a proof that the new root is the
// old one plus this leaf in the next empty slot (#211). Admin/relayer. Emits `insert_leaf`.
pub fn insert_commitment(caller: Address, zk_proof: Proof, public_signals: Vec<BytesN<32>>) -> Result<(), CommitmentTreeError>

// Borrow: ZK proof + oracle price → USDC transferred to borrower.
pub fn borrow(borrower: Address, zk_proof: Proof, public_signals: Vec<BytesN<32>>, enc_note: Bytes) -> Result<(), CommitmentTreeError>

// Repay: ZK proof → outstanding debt reduced.
pub fn repay(repayer: Address, zk_proof: Proof, public_signals: Vec<BytesN<32>>, enc_note: Bytes) -> Result<(), CommitmentTreeError>

// Liquidate: ZK undercollateral proof → keeper collects proven debt amount.
pub fn liquidate(keeper: Address, zk_proof: Proof, public_signals: Vec<BytesN<32>>) -> Result<(), CommitmentTreeError>

// Supply USDC to the pool.
pub fn supply_usdc(supplier: Address, amount: i128) -> Result<(), CommitmentTreeError>

// Withdraw USDC supply.
pub fn withdraw_supply(supplier: Address, amount: i128) -> Result<(), CommitmentTreeError>