@dvmkit/sdk 0.0.0 → 0.1.0-rc.2

package/dist/server/index.d.ts

@@ -0,0 +1,4168 @@
+import { X as CashuMode, R as ResolvedCreditConfig, Y as FundingMethod, _ as CreditLedgerLike, $ as CreditSnapshot, g as CreditView, a0 as CreditInvoiceRecord, a1 as CreditDepositEnqueue, a2 as InvoiceSettlement, Z as ZodLike, a as DVMDescriptor, K as KVStore, o as JobStore, a3 as MppxServer, a4 as X402Config, p as PaymentMethod, a5 as ClientCompatibilityGate, a6 as Message, a7 as FundingReceipt, a8 as TopUpCapUnenforcedReason, a9 as JobReceipt, aa as AppendOutgoingOptions, S as SDKJobContext, ab as StepCache, v as ResponseContent, P as PaymentContent, ac as X402Receipt, ad as X402ExactVersionSupport, ae as X402SettlementIntent, af as X402FacilitatorAuth, ag as X402BatchSettlementConfig, ah as PostgresX402ChannelStorage, ai as PaymentRequirementsV2, aj as CreditLedgerQuerier, ak as X402SettlementCursor, al as X402SettlementStatus, am as X402SettlementWriteOff, an as X402RefundSettlementGate, ao as MppxCredential, J as JobRecord, ap as ReceiptCredit, aq as DrainReceiptEvent, ar as DrainReceipt, z as SignedRequestAudience, as as CreditDrawReleaseEnqueue, at as CreditDepositPayload, au as RevenueSkippedNoRailPayload, av as MessageType, aw as ClientCompatibility, ax as CreditDrainEnqueue, ay as DVMAuthScheme, B as SignedRequestDomain, az as DrawResult, aA as X402UnresolvedRefund, aB as GrownDrawResult, aC as DrawResolution, aD as FundingRecord, aE as BlockedInvoiceCursor, aF as InvoiceReconciliation, aG as InvoiceWriteOff, aH as DrawRecord, aI as StalePendingDrawCursor, aJ as TempoCreditLossEvidence, aK as TempoCreditLoss, aL as X402CreditLossEvidence, aM as X402CreditLoss, aN as DrainMethod, aO as DrainRequestResult, aP as BitcoinDepositLiability, aQ as FundingLot, aR as CreditDrainRecord, aS as ChannelDrainCursor, aT as DrainWriteOff, aU as DrainReleaseResult, aV as DrainFulfilment, aW as DrainTransitionResult, aX as StreamableJobStore, aY as ReceiptIssuingStore, aZ as RequestIdClaim, a_ as RequestIdClaimResult, a$ as OutgoingMessage, b0 as PaymentCreditDelta, b1 as VerifyAndCreditResult, b2 as JobCounters, G as SignedRequestReplayStore } from '../job-store-6gR4pZRP.js';
+export { b3 as CLIENT_COMPATIBILITY_HEADERS, d as CanonicalEnvelope, b4 as ClientCompatibilityEnv, b5 as ClientCompatibilityRequirement, b6 as ClientSemVer, e as CreateSignedRequestVerifierOpts, b7 as CreditFundingBasis, b8 as CreditInvoiceStatus, b9 as CreditLedger, ba as CreditLedgerError, bb as CreditLedgerErrorCode, bc as CreditLedgerErrorDetails, bd as CreditLedgerPool, be as CreditStatus, bf as DRAIN_DELIVERY_RESERVE_SATS, bg as DVM_PROTOCOL_VERSION, bh as DrainConflictReason, bi as DrawRailValue, bj as DrawStatus, n as JobStatus, bk as ReplayStoreBackend, bl as RevenueSkippedNoRailReason, x as SIGNED_REQUEST_AUTH_ID, y as SIGNED_REQUEST_STATEMENT_VERSION, bm as Secp256k1AuthOpts, E as SignedRequestError, F as SignedRequestFailure, H as SignedRequestSignOpts, M as SignedRequestStatementHeader, N as SignedRequestVerifier, bn as X402ChannelStorageOpts, bo as X402RelayLockHolder, bp as X402RelaySubmissionLock, bq as X402RelaySubmissionLockError, br as allocateDrawValue, bs as clientCompatibilityAttributes, bt as clientCompatibilityMiddleware, bu as clientUpgradeRequired, O as createSignedRequestVerifier, bv as isStreamableJobStore, bw as parseClientCapabilities, bx as parseClientCompatibility, by as parseDvmClient, bz as parseProtocolVersion, bA as requireClientCompatibility, bB as secp256k1Auth, bC as signedRequestInput, V as signedRequestStatementHeader } from '../job-store-6gR4pZRP.js';
+import { Pool } from 'pg';
+import { F as FxFetcher } from '../ssrf-DZi-xJyn.js';
+export { P as PinnedFetch, S as SSRFError, e as SSRFGuardOpts, f as SSRFReason, g as SSRFResolver, h as assertSafeUrl, j as createPinnedFetch } from '../ssrf-DZi-xJyn.js';
+import { Hono, Context } from 'hono';
+import { z } from 'zod';
+import { ProofLike } from '@cashu/cashu-ts';
+import { SupportedResponse, SettleResponse } from '@x402/core/types';
+import { Channel, AutoSettlementConfig } from '@x402/evm/batch-settlement/server';
+import 'mppx';
+import '@x402/core/server';
+
+/** The channel view the tracker sums claims over. */
+interface X402TrackedChannel {
+    channelId: string;
+    chargedCumulativeAmount: string;
+    totalClaimed: string;
+}
+/** A refund settlement wedged between chain and ledger (internal-review), for the wedge list. */
+interface X402WedgedRefund {
+    settlementId: string;
+    /** Epoch ms the settlement was first prepared. */
+    createdAt: number;
+    native?: number;
+}
+/** What the batch-settlement server hands the tracker once it knows its scope. */
+interface X402PayoutContext {
+    /** `${network}|${payTo}|${token}` — the scope the settle-pending marker is keyed on. */
+    scope: string;
+    payTo: string;
+    network: string;
+    storage: {
+        list(): Promise<X402TrackedChannel[]>;
+    };
+    /** The scheduler's settle cadence — what a wedge's `nextRetry` is derived from. */
+    settleIntervalMs: number;
+    listWedgedRefunds?: () => Promise<X402WedgedRefund[]>;
+}
+/** The two manager verbs the tracker wraps. */
+interface X402TrackedManager {
+    claim(...args: never[]): Promise<{
+        vouchers: number;
+        transaction: string;
+    }[]>;
+    settle(): Promise<{
+        transaction: string;
+    }>;
+}
+/**
+ * The batch-settlement server's view of the reporter: attach once with the
+ * scope, then route every claim and settle through the tracked manager so
+ * the open batch is kept and the settle emits the payout.
+ */
+interface X402PayoutObserver {
+    attach(ctx: X402PayoutContext): void;
+    trackManager<M extends X402TrackedManager>(manager: M): M;
+    /** A settle that landed outside the tracked manager — the manual claim-and-settle's own retry loop. */
+    recordSettle(transaction: string): Promise<void>;
+    /** A settle attempt that failed outside the tracked manager. One call per attempt a builder would count as one. */
+    recordSettleFailure(error: unknown): Promise<void>;
+}
+
+declare const lockPubkeyBrand: unique symbol;
+/**
+ * NUT-11 P2PK lock pubkey, lowercase-by-construction. Hex-encoded compressed
+ * secp256k1 pubkey (66 chars starting with `02` / `03`), normalised via
+ * `toLockPubkey`. The brand exists so any in-memory site that compares
+ * lock-pubkeys against each other — receive matching, monitor orphan/retired
+ * lookups, melt-pending keypair maps — gets a compile-time guarantee that
+ * both sides have been normalised. Raw strings off the wire or out of the DB
+ * must pass through `toLockPubkey` before they're treated as one.
+ */
+type LockPubkey = string & {
+    readonly [lockPubkeyBrand]: never;
+};
+
+/** Pool-shaped handle (`query` + `connect`). Required for the transactional insert path. */
+type AccumulatorPool = Pick<Pool, "query" | "connect">;
+
+/** Cashu accumulator opts resolved from environment variables. */
+interface ResolvedCashuOpts {
+    cashuMode: CashuMode | undefined;
+    lockPubkey: string | undefined;
+    lockPubkeyGraceSeconds: number;
+    db: Pool | undefined;
+    dvmId: string | undefined;
+    canonicalDvmId: string | undefined;
+}
+/**
+ * Resolves cashu accumulator opts from environment variables, initializing DB
+ * tables when all prerequisites are met. Extracted from serve() so DVMs that
+ * call createDVMServer directly (cast, scrape) can wire cashu without using
+ * the serve() wrapper (internal-review).
+ *
+ * @param pool - existing Postgres pool to reuse; pass undefined when no DB is available
+ * @param cashuModeHint - programmatic override for cashu mode (serve()'s opts.cashuMode)
+ */
+declare function resolveCashuOptsFromEnv(env: Record<string, string>, pool?: Pool, cashuModeHint?: CashuMode): Promise<ResolvedCashuOpts>;
+
+/**
+ * Tracks MPP challenge ids that have already been consumed by an upfront-flow
+ * request, scoped per-DVM realm. Entries auto-expire after a TTL and the store
+ * is bounded so a long-running DVM doesn't accumulate state without bound.
+ *
+ * Used by `verifyUpfrontPayment` to reject replay of an MPP credential whose
+ * `(realm, challenge.id)` was already accepted within the current TTL window
+ * (internal-review). Mid-job replay is handled separately via per-job
+ * `pendingMppChallengeIds` (internal-review).
+ */
+interface ConsumedCredentialStore {
+    /** True iff `(realm, challengeId)` was marked and the entry has not expired. */
+    has(realm: string, challengeId: string): Promise<boolean>;
+    /** Mark `(realm, challengeId)` as consumed for `ttlSeconds`. */
+    mark(realm: string, challengeId: string, ttlSeconds: number): Promise<void>;
+}
+/** Options for `MemoryConsumedCredentialStore`. */
+interface MemoryConsumedCredentialStoreOpts {
+    /** FIFO eviction kicks in when entry count would exceed this. Default: 10_000. */
+    maxEntries?: number;
+}
+/**
+ * In-memory `ConsumedCredentialStore`. Insertion-ordered Map provides FIFO
+ * eviction at the configured cap; TTL is enforced lazily on `has()` (same
+ * pattern as `MemoryKVStore`).
+ *
+ * Per-process and not multi-instance-safe — each replica tracks its own
+ * consumed set, so a credential redirected to a different replica still works
+ * once. Acceptable for first-party single-instance Fly DVMs (internal-review open
+ * question); swap to a shared backend before deploying multiple replicas.
+ */
+declare class MemoryConsumedCredentialStore implements ConsumedCredentialStore {
+    private readonly maxEntries;
+    private readonly data;
+    constructor(opts?: MemoryConsumedCredentialStoreOpts);
+    has(realm: string, challengeId: string): Promise<boolean>;
+    mark(realm: string, challengeId: string, ttlSeconds: number): Promise<void>;
+}
+
+/**
+ * Credit fields riding the signed request body (internal-review, spec §2).
+ *
+ * An explicit draw references the credit INSIDE the secp256k1/Schnorr-signed
+ * `body.data` — no new caller crypto. Wire field names (snake_case, matching
+ * the rest of the wire surface):
+ *
+ * - `credit_id` — the credit to draw against.
+ * - `draw_id`   — client-generated draw id; the ledger's idempotency key.
+ * - `fund`      — optional `{ amount_micro, commitment }` funding commitment:
+ *   present iff a funding artifact (X-Cashu / X-PAYMENT / mpp credential)
+ *   rides the same request. `commitment` is the SHA-256 hex over the raw
+ *   artifact bytes, binding the header-borne proof — which sits OUTSIDE the
+ *   signed body — to the credit its sender intended (spec §2 condition 3).
+ *
+ * These are envelope-level fields, not capability input: **the SDK** removes
+ * them before any builder-owned schema parses ({@link stripCreditEnvelope} in
+ * `JobManager.parseInput` and on the quote path; {@link
+ * creditEnvelopeIgnoreFields} feeding the auth verifier's own schema check), so
+ * handlers never see them and a top-level `.strict()` capability schema is
+ * fine (internal-review). Relying on Zod's default strip mode instead was the trap:
+ * `.strict()` rejects unknown keys, so an explicit draw 400'd at parse before
+ * the envelope was ever extracted.
+ *
+ * The strip never touches the canonical signing bytes. Every auth call site
+ * verifies the raw wire body (`signedRequestInput`, internal-review), so the credit
+ * fields are in the verified bytes because they were never taken out of them —
+ * the strip is only ever applied to what a schema is about to parse.
+ */
+interface CreditEnvelope {
+    creditId: string;
+    drawId: string;
+    fund?: CreditFundCommitment;
+}
+/** The signed funding commitment for a fund-and-draw request. */
+interface CreditFundCommitment {
+    /** Funding amount in 1e-6 units of the credit's currency. */
+    amountMicro: number;
+    /** SHA-256 hex over the raw funding artifact bytes. */
+    commitment: string;
+}
+/** Wire keys reserved for the credit envelope inside `body.data`. */
+declare const CREDIT_ENVELOPE_KEYS: readonly ["credit_id", "draw_id", "fund"];
+/**
+ * Thrown by {@link extractCreditEnvelope} on a structurally invalid credit
+ * envelope — half a pair, a `fund` block without credit fields, wrong types.
+ * Carries a caller-facing message; the route maps it to a 400.
+ */
+declare class CreditEnvelopeError extends Error {
+    constructor(message: string);
+}
+/**
+ * Extract the credit envelope from the raw wire `body.data`. Returns
+ * `undefined` when no credit field is present (the implicit / legacy shape).
+ * Throws {@link CreditEnvelopeError} on partial or malformed fields — a
+ * request that names half a draw is a caller bug, not an implicit payment.
+ */
+declare function extractCreditEnvelope(data: unknown): CreditEnvelope | undefined;
+/**
+ * The reserved keys `schema` does not itself declare — the ones the SDK is
+ * free to remove before handing it an input (internal-review).
+ *
+ * A capability schema declares none of them, so all three are removable. The
+ * one exception this exists for is `/v1/credit`'s own `CREDIT_REQUEST_SCHEMA`,
+ * where `credit_id` and `fund` are real fields on a different wire shape and
+ * removing them would empty the request. It is not an escape hatch for a
+ * capability: the three names stay reserved on `body.data`, and declaring one
+ * doesn't win a builder their own value — `app.ts` runs
+ * {@link extractCreditEnvelope} over the raw body on every submit, so a
+ * capability that declares `fund` answers `invalid_credit_fields` instead.
+ */
+declare function creditEnvelopeIgnoreFields(schema: unknown): readonly string[];
+/**
+ * Remove the reserved credit keys from `data` before `schema` parses it, so a
+ * strict schema doesn't reject the protocol's own envelope (internal-review). Keys
+ * `schema` declares are left alone — see {@link creditEnvelopeIgnoreFields}.
+ *
+ * Returns `data` unchanged when it isn't a plain object or carries none of the
+ * removable keys, so the ordinary no-credit request allocates nothing. Never
+ * use the result to derive canonical signing bytes: those cover the wire form,
+ * credit fields included (`signedRequestInput`).
+ */
+declare function stripCreditEnvelope(schema: unknown, data: unknown): unknown;
+
+/**
+ * The public prepaid-credit terms a DVM advertises before a caller identifies
+ * itself. Snake_case: this is the wire shape.
+ *
+ * This type deliberately excludes the per-caller echo. `/v1/info` is public
+ * and cacheable, so its type must make a caller credit ID or balance
+ * unrepresentable rather than relying on the current handler not to ask for
+ * one.
+ */
+interface CreditTerms {
+    /** Smallest funding accepted, in 1e-6 units of `currency`. */
+    min_micro: number;
+    /** Largest residual balance a caller may hold, in 1e-6 units of `currency`. */
+    max_micro: number;
+    /** Credit lifetime from the most recent funding, in ms. */
+    ttl_ms: number;
+    /** Currency the whole block and resulting credit are denominated in. */
+    currency: string;
+    /** Rails a top-up may be funded over. */
+    funding: FundingMethod[];
+    /** MPP instruments offered or temporarily withheld for credit funding. */
+    tempo?: {
+        methods: {
+            method: string;
+            intent: "charge" | "session";
+        }[];
+        withheld?: {
+            method: string;
+            intent: "charge" | "session";
+            reason: string;
+        }[];
+    };
+    /** x402 flavours accepted for credit funding. */
+    x402?: {
+        schemes: {
+            scheme: string;
+            network: string;
+        }[];
+    };
+    /** Smallest Lightning funding accepted, in 1e-6 units of `currency`. */
+    lightning_min_micro?: number;
+}
+/**
+ * The **funding menu** a DVM advertises on `/v1/quote` and in every 402
+ * (internal-review, credits spec §4/§6). Snake_case: this is the wire shape.
+ *
+ * `min_micro` / `max_micro` / `ttl_ms` are the DVM's sizing terms — `max_micro`
+ * binds the **residual balance**, not a funding amount, so a job priced above
+ * it still clears as fund-and-immediately-draw. `funding` is the rail list a
+ * top-up may arrive on — a {@link FundingMethod}, not a `PaymentMethod`, since
+ * `lightning` funds a credit without ever being an attached-proof wire method
+ * (internal-review). It degrades per spec §4: a rail whose backing wallet is
+ * unreachable drops out and the sale survives on the others.
+ *
+ * The `credit_id` / `balance_micro` / `remaining_micro` / `expiry_ms` echo
+ * appears only for an authenticated caller who already holds a live credit —
+ * so one round trip answers "what does this cost, and what do I have left?"
+ * (spec §7).
+ */
+interface CreditMenu extends CreditTerms {
+    /**
+     * MPP instruments accepted for this credit, reusable sessions first when
+     * available.
+     *
+     * `withheld` names an instrument this DVM is configured for and is not
+     * offering at this instant, with the reason (internal-review). Two audiences read
+     * it. An agent gets to relay *why* `tempo/session` vanished instead of
+     * inferring the DVM never had it. And the platform's deploy probe reads
+     * capability from `methods ∪ withheld`, so a deploy landing during an
+     * observer blip no longer stamps `tempo_session_advertised_at` NULL and
+     * drops the DVM out of the close observer's payee fallback permanently.
+     * `methods` stays the list a caller acts on — never widen it to include a
+     * withheld instrument.
+     */
+    /**
+     * Which x402 flavours a top-up may arrive on, and the chain each rides
+     * (internal-review). Present exactly when `funding` lists `x402`. Reusable
+     * `batch-settlement` is admitted by default; one-payment `exact` appears
+     * only when the builder explicitly accepts its manual refund obligation.
+     */
+    /**
+     * Smallest funding the `lightning` rail accepts, in 1e-6 units of
+     * `currency`. Present only when `funding` lists `lightning`. This is the
+     * deployment's sats-physical receive floor (internal-review) rendered into fiat
+     * with a ×{@link LIGHTNING_FLOOR_FX_MARGIN} margin absorbing rate drift
+     * between menu fetch and funding — issuance enforces the *raw* floor at
+     * request-time rates, so funding exactly this figure always clears. Rails
+     * without an entry (cashu) have no floor beyond `min_micro`.
+     */
+    /** The caller's credit this echo describes. Present only with the echo. */
+    credit_id?: string;
+    /** Funded balance, pending holds NOT subtracted. */
+    balance_micro?: number;
+    /** Spendable balance — what a draw is actually checked against. */
+    remaining_micro?: number;
+    /** Absolute expiry of the echoed credit, ms since epoch. */
+    expiry_ms?: number;
+}
+/** Everything {@link buildCreditMenu} needs, assembled per request. */
+interface BuildCreditMenuArgs {
+    /**
+     * Which runtime is answering. `"isolate"` is refused unconditionally — see
+     * the gate in {@link buildCreditMenu}.
+     */
+    runtime: "container" | "isolate";
+    /** The DVM's resolved `credit` block; `undefined` means it didn't opt in. */
+    config: ResolvedCreditConfig | undefined;
+    /**
+     * Currency the menu — and the credit it funds — denominates in: the DVM's
+     * declared `DVMConfig.currency`, which every call site reads off the single
+     * `DVMServer.creditCurrency()` (internal-review). Deliberately *not* the currency of
+     * the response this menu rides on: a quote priced elsewhere is refused before
+     * it reaches here, so the two agree, and sourcing it from the response is
+     * what left `POST /v1/credit` — which has no response to read — funding in
+     * hardwired USD at a DVM whose jobs draw in something else.
+     */
+    currency: string;
+    /** Rails this DVM settles over — the menu's funding options. */
+    funding: FundingMethod[];
+    /** Tempo methods wired for credit funding; builder policy filters the actionable menu. */
+    tempoMethods?: {
+        method: string;
+        intent: "charge" | "session";
+    }[];
+    /** Tempo methods this DVM is configured for but is not offering right now. */
+    tempoWithheld?: {
+        method: string;
+        intent: "charge" | "session";
+        reason: string;
+    }[];
+    /**
+     * x402 flavours this DVM can actually accept a top-up on (internal-review) — one
+     * server read, so what the sub-block advertises is what `/v1/credit` will
+     * answer a 402 with.
+     */
+    x402Schemes?: {
+        scheme: string;
+        network: string;
+    }[];
+    /**
+     * The deployment's Lightning receive floor in sats, when `lightning` is on
+     * the menu — rendered into `lightning_min_micro`. An fx failure during that
+     * rendering drops `lightning` from `funding` rather than suppressing the
+     * menu: a rail whose minimum we can't state honestly is a rail we must not
+     * advertise, but the other rails' sale survives.
+     */
+    lightningFundingMinSats?: number;
+    /**
+     * Whether this DVM has at least one accepted Cashu mint configured
+     * (internal-review). Without one, no Bitcoin funding rail may be advertised — see
+     * the filter in {@link buildCreditMenu}.
+     *
+     * Read off the **configured** mint list, never the health-filtered
+     * advertised one: a mint blip must not make a funding rail appear and
+     * disappear between quotes.
+     */
+    hasAcceptedMint?: boolean;
+    fxFetcher: FxFetcher;
+    /** True when the descriptor declares an auth scheme (see the gate). */
+    hasAuth: boolean;
+    ledger?: CreditLedgerLike;
+    /** devMode tolerates a non-durable ledger; production does not. */
+    devMode?: boolean;
+    /** Verified caller pubkey — required for the balance echo, never a fallback id. */
+    callerPubkey?: string;
+}
+/**
+ * Assemble the funding menu, or return `undefined` when this DVM must not
+ * advertise credit. **The refusal ladder is the feature**; each rung exists
+ * because advertising anyway would misadvertise:
+ *
+ * 1. **Isolate runtime** (credits spec §3) — checked first and unconditionally,
+ *    before config is even read. Isolate DVMs have no Postgres of their own;
+ *    their only DVM-side persistence is the last-write-wins callback KV, which
+ *    spec §2 condition 2 prohibits for credit state. Until [internal-review] resolves
+ *    the gate they run implicit N=1 only, and their quote simply never offers
+ *    credit so nothing is misadvertised.
+ * 2. **Not opted in** — no `credit` block on `configureDVM`.
+ * 3. **No descriptor auth** — a credit belongs to a verified secp256k1 pubkey.
+ *    Without auth the ledger's funder identity degrades to the requester id or
+ *    `"anonymous"` (see `resolveLedgerContext`), which would pool every
+ *    anonymous caller's money into one balance. Advertising a per-caller
+ *    balance on such a DVM would be a lie at best and a disclosure at worst.
+ * 4. **Non-durable ledger outside devMode** — a `MemoryCreditLedger` is
+ *    per-process, so a caller funding on machine A and drawing on machine B
+ *    gets `credit_not_found`. Advertise only what survives the fleet.
+ * 5. **Bounds not expressible in `currency`** — an fx outage, or a currency the
+ *    snapshot doesn't carry. Omit rather than quote a number we can't state.
+ *
+ * The balance echo is added only when a verified `callerPubkey` holds a live,
+ * same-currency credit.
+ *
+ * Rungs 1–4 live in {@link creditMenuConfigured}, which the capability refresh
+ * reads too.
+ */
+declare function buildCreditMenu(args: BuildCreditMenuArgs): Promise<CreditMenu | undefined>;
+/**
+ * The one credit a caller's quote echoes, from the several they may hold —
+ * every implicit N=1 payment mints its own `imp:<rail>:<paymentId>` credit, so
+ * this list grows with each paid job.
+ *
+ * Live, same-currency credits with something left in them; largest spendable
+ * balance wins, newest breaks a tie. That is the credit a caller would in fact
+ * draw against next. A failed job's released hold leaves a positive implicit
+ * balance, which is real caller money (spec §1, no debit on failure) and is
+ * echoed like any other.
+ *
+ * **Requires a verified pubkey.** Never call this with a requester id or
+ * `"anonymous"`: on an auth-less DVM the ledger pools every anonymous caller
+ * under one `caller_pubkey`, so echoing it would show one caller another's
+ * balance.
+ */
+declare function selectPrimaryCredit(args: {
+    ledger: CreditLedgerLike;
+    callerPubkey?: string;
+    currency: string;
+    nowMs?: number;
+}): Promise<CreditSnapshot | undefined>;
+/** Narrow a ledger snapshot to the read-only shape a quote handler receives. */
+declare function toCreditView(snapshot: CreditSnapshot): CreditView;
+/**
+ * Attach a menu to a response body when there is one. Keeps the "omit the key
+ * entirely rather than emit `credit: null`" rule in one place — every consumer
+ * checks presence, and the isolate tier depends on the key never appearing.
+ */
+declare function attachCreditMenu(body: Record<string, unknown>, menu: CreditMenu | undefined): Record<string, unknown>;
+
+/**
+ * Canonical deploy-time attestation payload (internal-review). One signature serves
+ * both auth-on-deploy and the `/v1/info#builder` attestation — the bytes the
+ * builder signs are the canonical JSON of this object. Making a field required
+ * also requires the coordinated fleet-before-caller release note in
+ * `public compatibility guide`.
+ */
+interface AttestationPayload {
+    /** Immutable platform or self-hosted DVM identifier this attestation applies to. */
+    dvm_id: string;
+    /** DVM slug the attestation applies to (must match the deploy request's slug). */
+    slug: string;
+    /** sha256(`canonicaliseForSigning(capabilities)`) hex. Binds the attestation
+     *  to the capability shape declared at deploy time. */
+    capabilities_hash: string;
+    /** Builder identity x-only secp256k1 pubkey, hex (32 bytes / 64 chars). */
+    builder_pubkey: string;
+    /**
+     * Per-DVM receipt-signing x-only pubkey, hex (internal-review). Binds the key the
+     * deployed DVM signs job receipts with to the cold builder identity: the
+     * builder signs this payload, so a receipt verifying under
+     * `receipt_pubkey` inherits the builder's authority.
+     *
+     * Optional: attestations signed before receipts shipped omit it and still
+     * verify byte-for-byte (canonical JSON drops absent keys), and deploy paths
+     * that can't provision the matching secret leave it unset rather than
+     * attesting a key the running process doesn't hold.
+     */
+    receipt_pubkey?: string;
+    /** Unix seconds at which the attestation was signed. */
+    deployed_at: number;
+}
+
+/** A Lightning invoice created by the backend. */
+interface CreatedInvoice {
+    /** BOLT11 payment request string. */
+    bolt11: string;
+    /** Payment hash (hex) — primary key for looking up settlement. */
+    paymentHash: string;
+    /** Amount in millisatoshis. */
+    amountMsats: number;
+    /** Unix milliseconds when the invoice expires. */
+    expiresAt: number;
+}
+/** Result of looking up an invoice's settlement status. */
+interface InvoiceStatus {
+    /** True once the invoice has been paid and preimage is known. */
+    settled: boolean;
+    /** Preimage (hex) — present only after settlement. */
+    preimage?: string;
+    /** Unix milliseconds when the invoice settled (if settled). */
+    settledAt?: number;
+    /** Unix milliseconds when the invoice expires. */
+    expiresAt?: number;
+}
+/** How a payment reached a settled state — see `payInvoiceReconciling`. */
+type LightningPayOutcome = "paid" | "reconciled" | "republished";
+/** Settled payment plus the audit trail of how it got there. */
+interface LightningPayment {
+    /** Payment preimage (hex) — proof the invoice was paid. */
+    preimage: string;
+    /** Routing fee reported by the wallet, in millisatoshis. Absent means unknown. */
+    feesPaidMsats?: number;
+    /** Whether the wallet answered directly, or the outcome had to be reconciled. */
+    outcome: LightningPayOutcome;
+}
+/** What a backend can tell us about the wallet behind it. */
+interface LightningWalletInfo {
+    /** Human-readable wallet name (e.g. "Alby Hub"). */
+    alias?: string;
+    /** Operations the wallet supports (e.g. `pay_invoice`, `lookup_invoice`). */
+    methods: string[];
+    /**
+     * Budget fields the wallet volunteered, if any.
+     *
+     * No rail behind this interface is required to expose a connection's
+     * spending cap, and NWC — today's only implementation — has no method that
+     * returns one. Present it when a wallet offers it, never infer it.
+     */
+    walletReportedBudget?: Record<string, unknown>;
+}
+/** Abstraction over Lightning wallet backends (NWC, future). */
+interface LightningBackend {
+    /**
+     * Pay a bolt11 invoice exactly once. Returns the preimage on success.
+     *
+     * Implementations must never re-send a payment on an unknown outcome without
+     * first reconciling against the wallet — the rails behind this interface have
+     * no idempotency key, so a blind retry is a second payment.
+     *
+     * `amountMsats` is passed when known (callers always have it from the
+     * provider's payment-request). Backends that don't need it may ignore the
+     * param.
+     */
+    payInvoice(bolt11: string, amountMsats?: number): Promise<LightningPayment>;
+    /** Get wallet balance in millisatoshis. */
+    getBalance(): Promise<number>;
+    /** Get wallet info (name, supported methods, any volunteered budget fields). */
+    getInfo(): Promise<LightningWalletInfo>;
+    /** Create a new incoming invoice for the given amount and description. */
+    createInvoice(params: {
+        amountMsats: number;
+        description?: string;
+        expirySeconds?: number;
+    }): Promise<CreatedInvoice>;
+    /** Look up an invoice's settlement status by payment hash. */
+    lookupInvoice(paymentHash: string): Promise<InvoiceStatus>;
+}
+
+/** Cached liveness signal for a platform-hosted DVM's Lightning receive rail. */
+interface LightningRailHealth {
+    /** Whether the receive rail may be advertised at this instant. */
+    available(): boolean;
+    /** Prime the cached signal at boot when the source supports it. */
+    refresh?(): Promise<void>;
+}
+
+/** Builder-facing wiring for the Lightning receive leg (internal-review). */
+interface LightningReceiveConfig {
+    /**
+     * Receive-only NWC connection URI (`DVMKIT_NWC_RECEIVE_URI`). Validated at
+     * boot: a connection that can *spend* is refused outright.
+     */
+    uri?: string;
+    /**
+     * Pre-built backend, bypassing URI parsing and the connect-time probe. Test
+     * seam only — production always goes through `uri` so the receive-only
+     * property is actually checked.
+     */
+    backend?: LightningBackend;
+    /** Invoice lifetime in seconds. Defaults to {@link DEFAULT_INVOICE_TTL_SECONDS}. */
+    invoiceTtlSeconds?: number;
+    /**
+     * Smallest funding this deployment can receive over Lightning, in sats
+     * (`DVMKIT_LIGHTNING_FUNDING_MIN_SATS`). The floor is a property of the
+     * receive wallet's channel policy (`htlc_minimum_msat` upstream), so it is
+     * per-deployment and sats-physical — the menu renders it into fiat with a
+     * margin, but everything that *enforces* it compares raw sats. Defaults to
+     * {@link DEFAULT_LIGHTNING_FUNDING_MIN_SATS}.
+     */
+    fundingMinSats?: number;
+    /**
+     * Optional platform-derived channel-liveness gate. Platform-hosted DVMs use
+     * it alongside their NWC reachability probe; self-hosted DVMs omit it.
+     */
+    railHealth?: LightningRailHealth;
+}
+/** Default bolt11 lifetime — long enough to pay by hand, short enough to retire. */
+declare const DEFAULT_INVOICE_TTL_SECONDS = 900;
+/**
+ * Floor on the invoice lifetime: twice the signed-request drift window, so the
+ * bolt11 always outlives the funding negotiation that produced it (the issue's
+ * "invoice expiry ≥ the funding-negotiation window"). A shorter one would
+ * expire inside the caller's own retry budget and strand them mid-top-up.
+ */
+declare const MIN_INVOICE_TTL_SECONDS = 600;
+/**
+ * The builder-side Lightning receive leg (internal-review, credits spec §4).
+ *
+ * Issues a bolt11 over a **receive-only** NWC connection while the DVM is
+ * awake serving the 402, and credits the ledger when a later request observes
+ * settlement. Two properties are load-bearing:
+ *
+ * - **It never holds a send credential.** `pay_invoice` on this connection is
+ *   refused at construction, so a compromised DVM can mint invoices and
+ *   nothing else. The drain/refund sender (internal-review) is a separate, budgeted
+ *   connection by rule.
+ * - **Crediting is pull-based — there is no settlement watcher.** The caller's
+ *   next request drives `lookup_invoice`, which is what makes this work on a
+ *   suspend-to-zero fleet: a machine that is asleep has nothing to miss.
+ *   Wallet downtime at that moment delays crediting; it never loses money,
+ *   because the invoice→credit binding is a durable row.
+ *
+ * Reachability is **cached**, never probed per request: the funding menu is
+ * assembled on every quote and every 402, so a live NIP-47 round trip there
+ * would put a nostr relay in the latency path of every priced call.
+ */
+declare class LightningReceive {
+    private readonly source;
+    readonly invoiceTtlSeconds: number;
+    readonly fundingMinSats: number;
+    private health;
+    private checkedAtMs;
+    private refreshing;
+    private permissionRefusal;
+    private constructor();
+    private readonly railHealth;
+    /**
+     * Validate the configured connection and build the receive leg, or return
+     * `undefined` when this DVM didn't configure one.
+     *
+     * **Throws on a credential that is wrong, degrades on one that is merely
+     * unreachable.** A wallet outage at boot must not stop a DVM whose other
+     * rails are fine — the menu simply omits `lightning` until a later probe
+     * succeeds. A connection that can spend, or one that can't state what it can
+     * do, is a different thing entirely: it is a standing money risk that no
+     * amount of retrying fixes, so it fails the boot loudly with the fix in the
+     * message.
+     */
+    static create(config: LightningReceiveConfig): Promise<LightningReceive | undefined>;
+    /**
+     * Whether `lightning` belongs on the funding menu right now.
+     *
+     * Reads the cached observation and never blocks; a stale one kicks off a
+     * background refresh and answers with what we last knew. Advertising a rail
+     * whose wallet is down would hand the caller an option that 402s on use —
+     * the §4 posture is to drop it and let the sale survive on the others.
+     */
+    available(): boolean;
+    /**
+     * Issue (or re-issue) the bolt11 funding `(creditId, fundId)`.
+     *
+     * The invoice is minted **for** the credit and amount named in the caller's
+     * signed body — that binding is the internal-review condition-3 commitment on this
+     * rail, and it is why no artifact hash rides the request: there is no
+     * caller-supplied artifact to hash. A re-poll returns the stored row rather
+     * than minting again; a second bolt11 for one `fund_id` would leave two
+     * payable invoices against a funding that can only be credited once.
+     */
+    issue(ledger: CreditLedgerLike, args: {
+        creditId: string;
+        fundId: string;
+        callerPubkey: string;
+        currency: string;
+        amountMicro: number;
+        amountMsats: number;
+        description?: string;
+    }): Promise<CreditInvoiceRecord>;
+    /**
+     * Ask the wallet whether one payment hash is paid, and when (internal-review).
+     *
+     * The operator's reconcile verb runs this before it credits anything. A
+     * `blocked` row implies payment — {@link applyOne} returns above the block
+     * classification when the lookup says unpaid — but that is *this fleet's
+     * belief, recorded possibly weeks ago*, and the verb it gates mints balance
+     * against it. One round trip turns the belief into a fact and recovers the
+     * true settlement instant for `settled_at`, which a blocked row never got to
+     * write.
+     *
+     * Unlike {@link settlePending} this **throws**: there is no request whose
+     * latency it protects, and crediting on an unverifiable wallet is exactly
+     * what it exists to prevent. `NOT_FOUND` is the one exception, and it is not
+     * an outage — it is the wallet saying it has never seen this hash, the same
+     * reading {@link applyOne} and the caller-side reconcile in `src/lib/nwc.ts`
+     * take. It comes back as `known: false` because the operator's repair for it
+     * ("you are pointed at a different wallet than the one that minted this")
+     * is not the repair for an unpaid invoice, and certainly not for a retry.
+     */
+    lookupSettlement(paymentHash: string): Promise<{
+        settled: boolean;
+        settledAt?: number;
+        known: boolean;
+    }>;
+    /**
+     * Consult the wallet about this caller's outstanding invoices and credit the
+     * ones that settled — the pull half of pull-based crediting.
+     *
+     * The pending rows are read locally first, so the common case (nothing
+     * outstanding) costs one indexed SELECT and no network at all. Bounded to
+     * {@link MAX_SETTLE_CHECKS} invoices on a short deadline, and **never throws
+     * into the request**: a wallet failure here means the caller's balance is
+     * merely not updated yet, which the ordinary `insufficient_credit` path
+     * already states honestly.
+     *
+     * **Each invoice gets its own failure boundary.** The sweep window is a few
+     * rows wide, so a row that fails on its own terms — a `fund_id` the caller
+     * reused on another rail, a credit someone else opened first — must not take
+     * the rest of the pass down with it: the next invoice in the window may be
+     * the paid one, and it would never be looked up. Only a transport failure
+     * ends the pass early, because there the wallet itself is gone and the
+     * remaining lookups would just spend the caller's latency confirming it.
+     */
+    settlePending(ledger: CreditLedgerLike, args: {
+        callerPubkey: string;
+        creditId?: string;
+        creditTtlMs: number;
+        dvmId?: string;
+        enqueueCreditDeposit?: CreditDepositEnqueue;
+        nowMs?: number;
+    }): Promise<InvoiceSettlement[]>;
+    /**
+     * One invoice's settlement check. Returns the applied settlement, or
+     * `undefined` when nothing changed (still unpaid, or retired unpaid).
+     *
+     * Throws whatever the wallet or the ledger threw — classifying that is
+     * {@link retireOrLog}'s job, so this stays one invoice's happy path.
+     */
+    private applyOne;
+    /**
+     * Decide what one invoice's failure means, and retire the invoice when the
+     * answer is "this can never succeed".
+     *
+     * The split that matters is permanent-versus-transient, because it decides
+     * whether the row keeps a slot in the sweep window. A transient failure — the
+     * database blinked, the wallet answered oddly — leaves it `pending` and the
+     * caller's next request retries it. A **permanent** one means the ledger will
+     * refuse this invoice identically forever, so leaving it pending costs a
+     * `lookup_invoice` on every subsequent request and, at
+     * {@link MAX_SETTLE_CHECKS} of them, fills the window so a genuinely payable
+     * invoice behind them is never even looked up. Those get `blocked`, which
+     * drops them out of the sweep and hands the operator the payment hash.
+     */
+    private retireOrLog;
+    /**
+     * The reason this invoice can never be credited, or `undefined` if the
+     * failure was transient.
+     *
+     * Every code here is decided by state a retry cannot move — a row the ledger
+     * has already committed (a `credit_fundings` entry at this
+     * `(credit_id, fund_id)`, or a `credits` row whose owner, denomination or
+     * rail disagrees with the invoice), or the basis this module rebuilds
+     * identically from the invoice row on every pass. None of them is a race.
+     *
+     * `funding_replayed` is the one that needs a second read to classify.
+     * Usually it *is* benign — a concurrent check won the race and the money is
+     * credited either way — but the key is `(credit_id, fund_id)` and `fund_id`
+     * is **caller-chosen**: reuse it on cashu or x402 after this bolt11 was
+     * minted and the row that collided is a different payment entirely, so the
+     * sats this invoice received have nowhere to land.
+     */
+    private blockingReason;
+    private withBackend;
+    /** Record activity without letting it promote an unvalidated connection. */
+    private noteOperationOk;
+    private notePermissionsOk;
+    private notePermissionRefused;
+    /**
+     * Only a *transport* failure from an ordinary invoice operation is a health
+     * signal. Permission-probe refusals are classified by {@link refresh}.
+     */
+    private noteFailure;
+    private refresh;
+}
+
+/** Tunables for `checkMintHealth`. */
+interface CheckMintHealthOptions {
+    /** Per-attempt timeout in ms. Default: 5000. */
+    timeoutMs?: number;
+    /** Total attempts including the first. Default: 3. */
+    retries?: number;
+    /** Inter-attempt backoff schedule in ms. Default: [200, 500, 1000]. */
+    backoffMs?: number[];
+    /** Injected `fetch` for tests. Default: global fetch. */
+    fetchImpl?: typeof fetch;
+}
+
+/**
+ * Per-DVM runtime mint-health tracker (internal-review). Alongside the platform's
+ * durable mint-health cron, probes every configured
+ * mint on a timer, tracks consecutive failures, and flips a mint to `sick`
+ * once the threshold is crossed. The SDK uses the resulting view to:
+ *
+ *   1. Filter `/v1/info`'s advertised `mints` to currently-healthy ones.
+ *   2. Reject new accumulator receives at sick mints before they touch the
+ *      DB (`cashu_mint_sick` 503 from `verifyAccumulatorReceipt`).
+ *
+ * Since internal-review this tracker is the sole owner of mint health: boot no longer
+ * runs a fail-fast check before binding the port. To preserve what boot used
+ * to guarantee it (a) treats a mint as healthy only when it's reachable AND
+ * NUT-compliant (reproducing `assertNutSupport` via `nutCompliant`), and (b)
+ * exposes `initialProbeComplete()` so the paid path holds calls at
+ * `mint_health_pending` until the first probe validates ≥1 mint.
+ *
+ * Existing accumulator entries are not touched — they're P2PK-locked to the
+ * original mint and stay put until `dvmctl melt-pending` drains them. The
+ * accumulator monitor's `wallet_accumulator_batch_expiring_soon` already
+ * pages the builder when a stuck batch nears `t_expire`.
+ *
+ * In-memory only — no DB persistence. The platform cron keeps the durable
+ * record + email path (internal-review); the SDK only needs fresh in-process state
+ * to make routing decisions.
+ */
+
+/** Per-mint runtime view exposed by `snapshot()`. */
+interface MintHealthSnapshot {
+    /** Last-observed wall-clock latency of the probe in ms. */
+    latencyMs?: number;
+    /** Consecutive failures up to the most recent tick. Reset on any success. */
+    consecutiveFailures: number;
+    /**
+     * True once the mint is considered unhealthy for routing: either
+     * `consecutiveFailures` crossed the threshold, or the last probe reached the
+     * mint but it fails the NUT gate (a deterministic, permanent config error
+     * that flips `sick` immediately — internal-review).
+     */
+    sick: boolean;
+    /**
+     * True when the last successful probe reached the mint but it fails the NUT
+     * capability gate ({@link assertNutSupport}'s required NUTs + bolt11/sat).
+     * Distinct from a plain outage: NUT-incompatibility is deterministic and
+     * never resolves without a config/mint change.
+     */
+    nutIncompatible?: boolean;
+    /** Mint version reported by the last successful probe. */
+    version?: string;
+    /** Error category from the most recent failed probe. */
+    errorCode?: string;
+}
+/** Tunables for {@link MintHealthTracker}. */
+interface MintHealthTrackerOptions {
+    /** Cashu mint URLs the DVM accepts. The tracker probes every entry. */
+    mints: string[];
+    /**
+     * Tick cadence in ms. Defaults to {@link DEFAULT_TICK_INTERVAL_MS} or the
+     * `DVMKIT_MINT_HEALTH_TICK_MS` env var when set.
+     */
+    tickIntervalMs?: number;
+    /**
+     * Consecutive failed probes before flipping a mint to `sick`. Defaults to
+     * {@link DEFAULT_FAILURES_TO_SICK} or `DVMKIT_MINT_FAILURES_TO_SICK` env.
+     */
+    consecutiveFailuresToSick?: number;
+    /** Injected `fetch` for tests. */
+    fetchImpl?: typeof fetch;
+    /** Injected `Date.now` for tests. */
+    now?: () => number;
+    /**
+     * Per-probe timeout / retry / backoff, forwarded to {@link checkMintHealth}.
+     * Defaults to that function's own defaults — 3 attempts with `[200, 500]`
+     * backoff, which is what a real tick should do.
+     *
+     * Tests that drive several failing ticks set `backoffMs: [0]`: a failing
+     * probe otherwise costs 700ms of real `setTimeout`, and four of them put a
+     * unit test within a loaded CI runner's reach of the 5s default timeout.
+     * `fetchImpl` is set on the tracker, not here.
+     */
+    probe?: Omit<CheckMintHealthOptions, "fetchImpl">;
+}
+/**
+ * Runtime mint-health tracker. Owns its own timer; `start()` runs an initial
+ * probe immediately so the first received call doesn't see a stale snapshot.
+ */
+declare class MintHealthTracker {
+    private readonly mints;
+    private readonly tickIntervalMs;
+    private readonly failuresToSick;
+    private readonly fetchImpl?;
+    private readonly probeOpts;
+    private readonly nowFn;
+    private readonly state;
+    private timer?;
+    private stopped;
+    private inFlight?;
+    private firstProbeComplete;
+    constructor(opts: MintHealthTrackerOptions);
+    /** Kick off the periodic probe. Runs one tick immediately. */
+    start(): void;
+    /** Stop the timer. Safe to call multiple times. */
+    stop(): void;
+    /**
+     * Probe every configured mint once. Sequential per mint to bound concurrent
+     * outbound load; the tick cadence makes parallelism unnecessary.
+     */
+    runOnce(): Promise<void>;
+    /**
+     * True once the first full probe tick has landed. Before this, paid calls
+     * are held at `503 mint_health_pending` rather than accepted against
+     * unvalidated mints (internal-review).
+     */
+    initialProbeComplete(): boolean;
+    /**
+     * True when the mint is either healthy or unknown to the tracker. Unknown
+     * mints (e.g. a value coming in via an externally-supplied tracker) get the
+     * benefit of the doubt — the receive path's mint-allowlist check is the
+     * authoritative gate on which mints the DVM accepts.
+     */
+    isHealthy(mintUrl: string): boolean;
+    /** Currently-healthy subset of the configured mints, preserving config order. */
+    healthyMints(): string[];
+    /**
+     * True when the last probe reached the mint but it failed the NUT capability
+     * gate — a deterministic, permanent config error, unlike a transient outage.
+     * Unknown mints return false. `advertisedMints()` uses this to keep a
+     * permanently-unsettleable mint off `/v1/info` even in the all-sick fallback,
+     * where a merely-flapping mint is still published (internal-review).
+     */
+    isNutIncompatible(mintUrl: string): boolean;
+    /** Plain-object snapshot keyed by mint URL — for tests + observability. */
+    snapshot(): Record<string, MintHealthSnapshot>;
+    private applyResult;
+    /**
+     * One-shot structured summary emitted after the first probe tick. Replaces
+     * the boot check's per-mint `cashu_mint_startup_health` lines and surfaces an
+     * all-mints-unhealthy warning — the operator alert that the Fly restart-loop
+     * used to be before boot stopped refusing to start (internal-review).
+     */
+    private logBootHealth;
+}
+
+/**
+ * Owner display identity surfaced on `/v1/info#owner` (internal-review). Personal orgs
+ * resolve to the owner builder's profile; shared orgs resolve to the org's own
+ * profile. Container DVMs read from env vars; isolate DVMs resolve from Postgres.
+ */
+interface OwnerDisplay {
+    handle: string;
+    displayName?: string | null;
+    avatarUrl?: string | null;
+    type: "builder" | "org";
+}
+/** Optional builder identity surfaced on `/v1/info` (forward-compatible stub). */
+interface BuilderIdentity {
+    id?: string;
+    name?: string;
+    url?: string;
+    /**
+     * Builder identity x-only secp256k1 pubkey (internal-review). When populated, the
+     * `/v1/info#builder` block also carries `attestation` + `signature` so
+     * consumers can verify the deploy was signed by the holder of this key.
+     * Populated at deploy time from `DVMKIT_BUILDER_PUBKEY` (Fly secret); the
+     * SDK never re-signs at runtime.
+     */
+    pubkey?: string;
+    /** Canonical deploy-time attestation payload (internal-review). Served verbatim. */
+    attestation?: AttestationPayload;
+    /** Schnorr signature over `canonicaliseForSigning(attestation)` (internal-review). */
+    signature?: string;
+}
+/** Platform reporter overrides — the host falls back to env when omitted. */
+interface PlatformReporterOpts {
+    /** Bearer token. Defaults to `DVMKIT_PLATFORM_TOKEN` env. */
+    token?: string;
+    /** Platform internal URL. Defaults to `DVMKIT_PLATFORM_URL` env. */
+    url?: string;
+}
+/** Options for {@link createDVMHost}. */
+interface DVMHostOpts {
+    /**
+     * Postgres connection string. Defaults to `DATABASE_URL` env.
+     * Required at runtime (internal-review). Boot fails when missing unless `jobStore`
+     * is explicitly supplied or `devMode` is true (test/dev escape hatches).
+     */
+    database?: string;
+    /** Listen port. Defaults to `PORT` env or 8080. */
+    port?: number;
+    /** Environment variables. Defaults to `process.env`. */
+    env?: Record<string, string>;
+    /** Builder identity for `/v1/info` (forward-compatible). */
+    builder?: BuilderIdentity;
+    /** Owner display identity for `/v1/info#owner` (internal-review). Falls back to env vars. */
+    owner?: OwnerDisplay;
+    /** Platform reporter overrides. Defaults to env-derived values. */
+    platformReporter?: PlatformReporterOpts;
+    /** Override the SDK's fx fetcher. Defaults to env-configured CoinGecko. */
+    fx?: FxFetcher;
+    /**
+     * Custom `/health` handler. When set, the SDK installs this instead of the
+     * default `{ status: "ok" }` responder — useful for runtime-specific health
+     * (pool depth, draining state, 503 while draining).
+     */
+    healthHandler?: (c: Context) => Response | Promise<Response>;
+    /** KV store override. Defaults to PostgresKVStore (or MemoryKVStore in dev). */
+    store?: KVStore;
+    /** JobStore override. Takes precedence over `database`. */
+    jobStore?: JobStore;
+    /**
+     * Existing Postgres pool to reuse instead of opening one from `database`
+     * (internal-review test seam). When set, the host builds its JobStore / KVStore /
+     * cashu accumulator on this pool and leaves it open at shutdown — the caller
+     * owns it. Lets the e2e harness run DVMs in `p2pk-accumulator` mode against
+     * its single shared pool rather than spawning a pool per DVM.
+     */
+    pool?: Pool;
+    /** Cashu mints accepted. Defaults to env `DVMKIT_CASHU_MINTS`. */
+    mints?: string[];
+    /** Cashu receive mode override. */
+    cashuMode?: CashuMode;
+    /** MPP handle override. Defaults to env-resolved via `createMppFromOpts`. */
+    mpp?: MppxServer;
+    /** x402 stablecoin payment configuration. Defaults to env-resolved. */
+    x402?: X402Config;
+    /** Payment methods override. Defaults to derived from configured rails. */
+    paymentMethods?: PaymentMethod[];
+    /**
+     * Lightning receive leg for credit funding (internal-review). Defaults to the
+     * env-resolved `DVMKIT_NWC_RECEIVE_URI` /
+     * `DVMKIT_NWC_RECEIVE_INVOICE_TTL_SECONDS`. Pass `backend` to inject a
+     * wallet directly — a test seam that skips the connect-time probe, so
+     * production must always come through the URI.
+     */
+    lightningReceive?: LightningReceiveConfig;
+    /** When true, payment is skipped if no mints are configured (dev/test). */
+    devMode?: boolean;
+    /** Consumed-credential store override (test seam). */
+    consumedCredentialStore?: ConsumedCredentialStore;
+    /** Mint-health tracker override (test seam). */
+    mintHealthTracker?: MintHealthTracker;
+    /**
+     * Wrap the SDK compatibility gate before it is exposed to descriptor custom
+     * routes. Platform hosts use this to enforce their independently released
+     * caller rollout policy; self-hosted SDK consumers receive the default gate.
+     */
+    wrapRouteClientCompatibility?: (sdkGate: ClientCompatibilityGate) => ClientCompatibilityGate;
+}
+/** Per-mount options. Currently only `prefix` is supported. */
+interface MountOpts {
+    /** Path prefix for this DVM's protocol routes (e.g. `/delete-feed`). */
+    prefix?: string;
+}
+/** Live DVM host. Single wiring locus for the SDK (internal-review). */
+interface DVMHost {
+    /**
+     * Underlying Hono app for custom non-protocol routes that belong to the
+     * host (cross-DVM `/admin`, cron callbacks, etc.). For DVM-scoped routes,
+     * declare `routes(app)` on the descriptor.
+     */
+    readonly app: Hono;
+    /**
+     * Resolved Postgres pool — undefined before `host.serve()` completes
+     * database resolution, set thereafter. Exposed so DVM-local Postgres
+     * consumers (e.g. scrape's `ScrapeDb` per-fetch event store, internal-review)
+     * can reuse the host's pool rather than constructing their own. Wire
+     * inside descriptor `onBoot` (fires after pool init, before listener opens).
+     */
+    readonly pool: Pool | undefined;
+    /**
+     * Money-safe credit ledger (internal-review) — undefined before `host.serve()`
+     * resolves stores, set thereafter. Postgres-backed when a pool exists;
+     * pool-less hosts get a shared in-memory ledger so the internal-review fund+draw
+     * semantics hold everywhere. Same wiring window as `pool` (descriptor
+     * `onBoot` fires after init, before the listener opens).
+     */
+    readonly creditLedger: CreditLedgerLike | undefined;
+    /**
+     * Add a DVM to this host. Multiple mounts compose at distinct prefixes;
+     * a single mount with no prefix attaches at root.
+     */
+    mount<S, I extends ZodLike | undefined>(descriptor: DVMDescriptor<S, I>, opts?: MountOpts): void;
+    /** Start listening. Returns the live server handle. */
+    serve(opts?: {
+        port?: number;
+    }): Promise<{
+        url: string;
+        close: () => Promise<void>;
+    }>;
+    /** Graceful shutdown. Runs descriptor `onShutdown` hooks in reverse mount order. */
+    shutdown(): Promise<void>;
+}
+/**
+ * Single wiring locus for SDK-side construction (internal-review). Replaces both the
+ * `serve()` wrapper and the `createDVMServer` direct path. Reads env once,
+ * resolves payment rails, owns the Postgres pool, and mounts each DVM
+ * descriptor as a Hono sub-app on `host.app`.
+ */
+declare function createDVMHost(opts?: DVMHostOpts): DVMHost;
+
+/** Promise resolver for a pending client prompt response. */
+interface PromptResolver {
+    resolve: (value: ResponseContent) => void;
+    reject: (reason: Error) => void;
+}
+/** Promise resolver for a pending client payment. */
+interface PaymentResolver {
+    resolve: (value: PaymentContent) => void;
+    reject: (reason: Error) => void;
+}
+/** In-memory representation of a running job. */
+interface ServerJob {
+    id: string;
+    tags: string[];
+    /**
+     * Capability name this job belongs to (internal-review). Set at submission from
+     * `POST /v1/job` body's `capability` field; routes the SDK runtime to the
+     * right `onJob` / `onResponse` / `onPayment` handler and the right input
+     * schema. Required — the wire layer rejects requests that omit it.
+     */
+    capability: string;
+    input: string;
+    params: Record<string, string>;
+    requesterId: string;
+    /**
+     * SHA-256 hex of the per-job opaque `job_token` minted at creation for
+     * anonymous callers (internal-review). Mirror of `JobRecord.requesterTokenHash`;
+     * see that field for the wire-level gating semantics.
+     */
+    requesterTokenHash?: string;
+    /**
+     * Submission provenance (internal-review) — mirrors `JobRecord.requesterToken` /
+     * `requestFingerprint` / `requesterPubkey`. Carried on the job purely so
+     * `toJobRecord` persists it; nothing in the runtime reads it. It's the
+     * replay gate: a retried paid submit that reproduces the fingerprint (and,
+     * on a signed DVM, the pubkey) is handed this token back.
+     */
+    requesterToken?: string;
+    requestFingerprint?: string;
+    requesterPubkey?: string;
+    requestId?: string;
+    /** HTTP path independently recorded when the caller proof was accepted. */
+    authRequestPath?: string;
+    status: "processing" | "completed" | "failed" | "awaiting-input" | "cancelled" | "working";
+    summary?: string;
+    messages: Message[];
+    seq: number;
+    paidMsats: number;
+    paymentMint?: string;
+    /** Rail of the most recent successful credit. Set on each credit branch in payment processing. */
+    paymentRail?: FundingMethod;
+    /**
+     * Settlement reference for the most-recent successful credit. Threaded
+     * into `onJobCompleted` so the platform revenue ledger can populate
+     * `revenue_events.tx_hash`. mpp/x402 carry the credential's `challenge.id`
+     * / EVM tx hash from the facilitator (internal-review); cashu accumulator carries
+     * the `X-Cashu-Request-Id` UUID (internal-review). Updated on every credit
+     * (upfront or mid-job via `processIncomingPayment`) — internal-review.
+     * Single-row-per-job accounting keeps the most recent credit's hash,
+     * mirroring `paymentRail`.
+     */
+    paymentTxHash?: string;
+    /** Chain transaction returned to callers recovering x402 or Tempo acceptance. */
+    paymentTransactionHash?: string;
+    /**
+     * Rail-native amount accumulated across all successful credits on this
+     * job (sats for mpp, USDC microunits for x402). The single
+     * `revenue_events` row written at completion uses this as `gross_native`,
+     * so multi-credit jobs sum the per-credit native amounts (internal-review).
+     * internal-review wired the upfront credit; mid-job credits accumulate same-rail
+     * and reset on a cross-rail switch (see `processIncomingPayment`).
+     */
+    nativeAmount?: number;
+    /** Native asset tag — paired with `nativeAmount`. internal-review. */
+    nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
+    /** Cashu flow discriminator written into `revenue_events.metadata.cashu_flow` (internal-review). */
+    cashuFlow?: "p2pk_accumulator";
+    /** Credit the upfront payment funded/drew (internal-review). See `JobRecord.creditId`. */
+    creditId?: string;
+    /** The draw placed for this job on `creditId` (internal-review). */
+    drawId?: string;
+    /** Original funding artifact returned by an explicit fund-and-draw. */
+    fundingReceipt?: FundingReceipt;
+    fundingCredit?: CreditSnapshot;
+    receivedProofs: ProofLike[];
+    pendingPaymentMsats?: number;
+    /**
+     * Per-job binding for MPP credentials. Contains the `challenge.id` of every
+     * mppx challenge issued in the most-recent `requestPayment` yield. mppx HMAC
+     * binds challenges to realm/method/amount/expiry, not to the dvmkit job-id;
+     * verifying the incoming credential's `challenge.id` is in this set blocks
+     * a credential lifted from a sibling job that requested the same fields.
+     * Cleared on successful credit (internal-review).
+     */
+    pendingMppChallengeIds?: string[];
+    /**
+     * Per-job binding for x402 mid-job credentials (internal-review). 32-byte 0x-hex
+     * nonce issued by `requestPayment` and stamped onto the outbound x402
+     * envelope; the caller signs `TransferWithAuthorization` against this exact
+     * `bytes32`. Verification rejects an incoming `x402_payment` whose decoded
+     * authorization nonce differs, blocking a cross-job replay before the
+     * facilitator settles. Cleared on successful credit.
+     */
+    pendingX402Nonce?: string;
+    /**
+     * Exact USDC microunit amount paired with `pendingX402Nonce`. Kept as a
+     * decimal string so the EIP-3009 uint256 value remains lossless.
+     */
+    pendingX402AmountUsdcMicro?: string;
+    /**
+     * Fiat micro-units the outstanding `requestPayment` ask is worth, pinned when
+     * the payment-request was emitted (internal-review). See `JobRecord`.
+     */
+    pendingPaymentFiatMicro?: number;
+    /** Currency of {@link pendingPaymentFiatMicro} (lowercase ISO-4217). */
+    pendingPaymentFiatCurrency?: string;
+    /**
+     * Cumulative fiat micro this job has asked for mid-job, the ceiling on its
+     * draw growth (internal-review). See `JobRecord.askedTopUpMicro` for the sentinel.
+     */
+    askedTopUpMicro?: number;
+    /**
+     * Currency of {@link askedTopUpMicro} — and this job's sticky ask
+     * denomination (internal-review). See `JobRecord.askedTopUpCurrency`.
+     */
+    askedTopUpCurrency?: string;
+    /**
+     * Why this job's draw growth is not capped, when it isn't (internal-review). Mirror
+     * of `JobRecord.topUpCapUnenforcedReason`.
+     */
+    topUpCapUnenforcedReason?: TopUpCapUnenforcedReason;
+    /** Price the job was charged at (msats). Used to detect overpayment for change/melt gating. */
+    requiredMsats?: number;
+    /**
+     * The signed receipt for this job's terminal outcome (internal-review). Mirror of
+     * `JobRecord.receipt`, set once the terminal funnel has signed and persisted
+     * it so the local read paths (which serve from `activeJobs` during the
+     * cleanup window) hand back the same bytes as a cross-machine re-read.
+     */
+    receipt?: JobReceipt;
+    /**
+     * The in-flight terminal chain — persist, then sign + store the receipt
+     * (internal-review). Assigned synchronously by `ctx.complete()` / `ctx.fail()` at
+     * the instant the job goes terminal, so the `POST /v1/job` fast path can
+     * await it (bounded) and put the receipt on the synchronous 200 rather than
+     * making the caller poll for it. Never rejects — the chain swallows its own
+     * failures.
+     */
+    terminalWork?: Promise<void>;
+    listeners: Set<(msg: Message) => void>;
+    /**
+     * Cancellation signal for the running handler (internal-review). Aborted whenever
+     * the job is cancelled on this process — caller cancel, idle timeout,
+     * stale-sweep teardown, supersession. Surfaced to builders as `ctx.signal`
+     * and auto-threaded into `ctx.fetch`, so an in-flight provider call
+     * (ElevenLabs, Scrapfly, …) is torn down instead of billing the caller for
+     * work they just cancelled. Per-process runtime state like `listeners` —
+     * never persisted, and re-created fresh on reactivation.
+     */
+    abort: AbortController;
+    /**
+     * Hook for cross-machine message persistence (Tx A, internal-review). Set by
+     * `JobManager` when the store is streamable. The appender runs the
+     * outgoing-message tx atomically with any payment-request counter bump so
+     * `(message, pending_payment_msats)` land together — never separately.
+     *
+     * Per-job serialised (internal-review): each call chains onto `messageAppenderTail`
+     * so two synchronous `providerMessage` calls (e.g. `artifact` followed by
+     * `complete`) can't race for the DB-side seq allocation.
+     */
+    messageAppender?: (msg: Message, opts?: AppendOutgoingOptions) => void;
+    /**
+     * Tail of the per-job appender chain (internal-review). `wireMessageAppender` updates
+     * this on every call so `persistJob` can await it before the terminal snapshot
+     * save runs `DELETE FROM job_messages`.
+     */
+    messageAppenderTail?: Promise<unknown>;
+    sdkCtx?: SDKJobContext<unknown, unknown>;
+    stepCache: StepCache;
+    state: unknown;
+    pendingPrompts: Map<string, PromptResolver>;
+    pendingPayment: PaymentResolver | null;
+    /** When not null, indicates replay mode — prompt/payment scan message history for cached responses. */
+    replayHighSeq: number | null;
+    /** Number of provider messages to suppress during replay. Cleared on handler error. */
+    replayProviderSkip: number;
+    /** Index of the next payment to match during replay (for multi-payment handlers). */
+    replayPaymentIndex: number;
+    /**
+     * Set once Tx C applies the current payment ask during this reactivation.
+     * Runtime-only: replayed prompts may mutate `status`, but never clear this
+     * marker before the matching payment is consumed.
+     */
+    reactivationPaymentApplied?: true;
+    /** Unix ms timestamp of job creation. */
+    createdAt: number;
+    /** Unix ms timestamp of last activity (message, yield, terminal). */
+    lastActivityAt: number;
+}
+
+/** Lifetime of a per-call implicit credit before the ledger refuses new draws. */
+declare const IMPLICIT_CREDIT_TTL_MS: number;
+
+/**
+ * Fiat denomination of the job price, pinned per request (internal-review).
+ *
+ * The credit ledger is fiat-micro denominated (internal-review baked decision:
+ * 1e-6 of the DVM's pricing currency, never msats). The conversion pins at
+ * quote time: the verify path already fixes both the fiat price and its msat
+ * equivalent, so the implicit N=1 fund credits the QUOTED fiat amount when
+ * the attached token satisfies the quoted msats — no fresh BTC/USD lookup in
+ * the rail verify hot path, and fund = draw = quoted price means zero
+ * rounding drift at N=1.
+ */
+interface PriceFiat {
+    /** Lowercase currency code, e.g. `"usd"`. */
+    currency: string;
+    /** Job price in 1e-6 currency units. */
+    amountMicro: number;
+}
+
+/**
+ * SHA-256 hex over the raw funding artifact — the value an explicit
+ * fund-and-draw request must sign as `fund.commitment` (spec §2 condition 3).
+ * The artifact is the exact header-borne string: the `X-Cashu` header value,
+ * the `X-PAYMENT` header value, or the extracted `Payment <…>` mpp scheme
+ * string. Hashing the verbatim wire string keeps the commitment computable by
+ * the client without any decode step.
+ */
+declare function fundingCommitment(artifact: string): string;
+/**
+ * Settlement reference stamped on the revenue event of an **explicit** draw
+ * (internal-review). One funding backs N draws, so the funding's own rail reference
+ * cannot key them: `revenue_events` carries a global `UNIQUE (rail, tx_hash)`
+ * that deliberately drops cross-job reuse of a settlement reference, and
+ * reusing it would silently discard every draw but the first.
+ *
+ * Hashed rather than concatenated because `draw_id` is caller-generated: the
+ * DVM id is mixed in so two DVMs whose callers both pick `draw_id: "1"` can't
+ * collide, and the hash keeps caller-controlled bytes out of a column ops
+ * reads. Deterministic, so a replayed report lands on the same row.
+ */
+declare function drawSettlementRef(dvmId: string, creditId: string, drawId: string): string;
+
+/**
+ * Durable marker for a rail payment that already funded the credit ledger
+ * (internal-review, spec §2 condition 3). The x402 and mpp rails have no dvmkit-side
+ * commit point of their own — the money moves at the facilitator / the payer's
+ * mpp server — so the marker row, inserted in the SAME transaction as
+ * `CreditLedger.fund` + `draw`, is what makes a crash-replayed credential
+ * unable to fund twice: the second attempt collides on the primary key and
+ * surfaces as {@link ProcessedPaymentReplayError}, which the verifier routes
+ * into the internal-review recovery gates instead of a second fund.
+ *
+ * The Cashu rail does not use this store — its accumulator insert is already
+ * the durable commit point, and its replay key (the `X-Cashu-Request-Id`
+ * regime) must stay exactly as-is (dual-idempotency rule, spec §2).
+ */
+interface ProcessedPaymentStore {
+    /**
+     * Record that `paymentId` on `rail` funded a credit. Throws
+     * {@link ProcessedPaymentReplayError} when the `(dvmId, rail, paymentId)`
+     * marker already exists. `tx` (Postgres implementation only) joins the
+     * caller-owned transaction so marker + fund + draw commit atomically.
+     */
+    record(args: {
+        dvmId: string;
+        rail: ProcessedPaymentRail;
+        paymentId: string;
+        creditId: string;
+        drawId: string;
+        jobId?: string;
+        tx?: ProcessedPaymentQuerier;
+        nowMs?: number;
+    }): Promise<void>;
+    /** Read one marker, `undefined` when absent. */
+    get(args: {
+        dvmId: string;
+        rail: ProcessedPaymentRail;
+        paymentId: string;
+    }): Promise<ProcessedPaymentRecord | undefined>;
+    /**
+     * Run `fn` inside one transaction (Postgres: BEGIN → fn → COMMIT, rollback
+     * on throw). The verifier funds and draws the ledger inside `fn`, passing
+     * the handle through to `record` / `CreditLedger.fund` / `draw` so all
+     * three commit atomically. The memory implementation invokes `fn` with no
+     * handle — its operations are synchronous-atomic in-process.
+     */
+    withTx<T>(fn: (tx?: ProcessedPaymentQuerier) => Promise<T>): Promise<T>;
+}
+/** Rails that commit through the marker (Cashu commits via the accumulator). */
+type ProcessedPaymentRail = "x402" | "tempo";
+/** One recorded funding marker. */
+interface ProcessedPaymentRecord {
+    dvmId: string;
+    rail: ProcessedPaymentRail;
+    paymentId: string;
+    creditId: string;
+    drawId: string;
+    jobId: string | null;
+    createdAt: number;
+}
+/** Subset of `pg.Pool` the store queries through; `PoolClient` satisfies it too. */
+interface ProcessedPaymentQuerier {
+    query: Pool["query"];
+}
+/** Thrown by `record` when the payment id was already processed on this rail. */
+declare class ProcessedPaymentReplayError extends Error {
+    readonly rail: ProcessedPaymentRail;
+    readonly paymentId: string;
+    constructor(rail: ProcessedPaymentRail, paymentId: string);
+}
+/** Postgres-backed {@link ProcessedPaymentStore} — the production implementation. */
+declare class PostgresProcessedPaymentStore implements ProcessedPaymentStore {
+    private readonly pool;
+    constructor(pool: Pick<Pool, "query" | "connect">);
+    withTx<T>(fn: (tx?: ProcessedPaymentQuerier) => Promise<T>): Promise<T>;
+    /** Create the `processed_payments` table if absent. Call once at SDK boot. */
+    init(): Promise<void>;
+    /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+    private createTables;
+    record(args: {
+        dvmId: string;
+        rail: ProcessedPaymentRail;
+        paymentId: string;
+        creditId: string;
+        drawId: string;
+        jobId?: string;
+        tx?: ProcessedPaymentQuerier;
+        nowMs?: number;
+    }): Promise<void>;
+    get(args: {
+        dvmId: string;
+        rail: ProcessedPaymentRail;
+        paymentId: string;
+    }): Promise<ProcessedPaymentRecord | undefined>;
+}
+/** In-memory {@link ProcessedPaymentStore} for pool-less setups. Per-process. */
+declare class MemoryProcessedPaymentStore implements ProcessedPaymentStore {
+    private readonly markers;
+    withTx<T>(fn: (tx?: ProcessedPaymentQuerier) => Promise<T>): Promise<T>;
+    record(args: {
+        dvmId: string;
+        rail: ProcessedPaymentRail;
+        paymentId: string;
+        creditId: string;
+        drawId: string;
+        jobId?: string;
+        tx?: ProcessedPaymentQuerier;
+        nowMs?: number;
+    }): Promise<void>;
+    get(args: {
+        dvmId: string;
+        rail: ProcessedPaymentRail;
+        paymentId: string;
+    }): Promise<ProcessedPaymentRecord | undefined>;
+}
+
+/** Durable state of one exact x402 authorization. */
+type X402ExactSettlementStatus = "prepared" | "submitting" | "settled" | "local_committed" | "ambiguous" | "rejected" | "complete";
+/** Serializable local economic effect that follows an exact settlement. */
+interface X402ExactSettlementEffect {
+    priceFiat: {
+        currency: string;
+        amountMicro: number;
+    };
+    requiredMsats: number;
+    callerId: string;
+    dvmId: string;
+    jobId?: string;
+    /** Upfront job request bound to this payment; omitted for credit-only and mid-job effects. */
+    jobAdmission?: {
+        requestFingerprint: string;
+        authFingerprint?: string;
+    };
+    creditEnvelope?: CreditEnvelope;
+    fundOnly?: {
+        creditId: string;
+        fundId: string;
+        commitment: string;
+        allowOneShotStablecoin?: boolean;
+    };
+    topUp?: {
+        creditId: string;
+        drawId: string;
+    };
+    topUpCapMicro?: number;
+    askSatisfied?: true;
+    midJob?: true;
+    drawBasis: boolean;
+    ttlMs: number;
+    paidMsats: number;
+    fundedMicro: number;
+    nativeAmount: number;
+}
+/** Canonical authorization facts retained without the bearer signature. */
+interface X402ExactAuthorizationFacts {
+    network: string;
+    asset: string;
+    from: string;
+    to: string;
+    value: string;
+    validAfter: string;
+    validBefore: string;
+    nonce: string;
+    fingerprint: string;
+}
+/** One durable exact-x402 settlement intent. */
+interface X402ExactSettlementIntent extends X402ExactAuthorizationFacts {
+    id: string;
+    dvmId: string;
+    resource: string;
+    status: X402ExactSettlementStatus;
+    effect?: X402ExactSettlementEffect;
+    submissionBlock?: string;
+    transaction?: string;
+    settleResponse?: Record<string, unknown>;
+    lastOutcome?: string;
+    createdAt: number;
+    updatedAt: number;
+    resolvedAt?: number;
+}
+/** Evidence recorded around one facilitator settlement call. */
+interface X402ExactSettlementAttempt {
+    id: string;
+    intentId: string;
+    outcome: "submitting" | "success" | "rejected" | "timeout" | "missing_reference";
+    detail?: string;
+    transaction?: string;
+    createdAt: number;
+}
+/** Persistence contract for exact x402 settlement recovery. */
+interface X402ExactSettlementStore {
+    prepare(intent: Omit<X402ExactSettlementIntent, "status" | "createdAt" | "updatedAt" | "resolvedAt">): Promise<X402ExactSettlementIntent>;
+    get(dvmId: string, intentId: string): Promise<X402ExactSettlementIntent | undefined>;
+    markSubmitting(args: {
+        dvmId: string;
+        intentId: string;
+        submissionBlock?: string;
+    }): Promise<boolean>;
+    recordOutcome(args: {
+        dvmId: string;
+        intentId: string;
+        status: Extract<X402ExactSettlementStatus, "settled" | "ambiguous" | "rejected">;
+        outcome: X402ExactSettlementAttempt["outcome"];
+        detail?: string;
+        transaction?: string;
+        settleResponse?: Record<string, unknown>;
+    }): Promise<X402ExactSettlementIntent>;
+    finalize<T>(dvmId: string, intentId: string, fn: (intent: X402ExactSettlementIntent, tx?: ProcessedPaymentQuerier) => Promise<T>): Promise<{
+        intent: X402ExactSettlementIntent;
+        value?: T;
+        replayed: boolean;
+    }>;
+    markAdmissionComplete(dvmId: string, intentId: string): Promise<X402ExactSettlementIntent>;
+    list(args: {
+        dvmId: string;
+        limit: number;
+        includeResolved?: boolean;
+    }): Promise<X402ExactSettlementIntent[]>;
+    attempts(dvmId: string, intentId: string): Promise<X402ExactSettlementAttempt[]>;
+}
+/** Postgres-backed exact settlement intent store. */
+declare class PostgresX402ExactSettlementStore implements X402ExactSettlementStore {
+    private readonly pool;
+    constructor(pool: Pick<Pool, "query" | "connect">);
+    /** Create the exact settlement tables. */
+    init(): Promise<void>;
+    prepare(intent: Omit<X402ExactSettlementIntent, "status" | "createdAt" | "updatedAt" | "resolvedAt">): Promise<X402ExactSettlementIntent>;
+    get(dvmId: string, intentId: string): Promise<X402ExactSettlementIntent | undefined>;
+    markSubmitting(args: {
+        dvmId: string;
+        intentId: string;
+        submissionBlock?: string;
+    }): Promise<boolean>;
+    recordOutcome(args: {
+        dvmId: string;
+        intentId: string;
+        status: Extract<X402ExactSettlementStatus, "settled" | "ambiguous" | "rejected">;
+        outcome: X402ExactSettlementAttempt["outcome"];
+        detail?: string;
+        transaction?: string;
+        settleResponse?: Record<string, unknown>;
+    }): Promise<X402ExactSettlementIntent>;
+    finalize<T>(dvmId: string, intentId: string, fn: (intent: X402ExactSettlementIntent, tx?: ProcessedPaymentQuerier) => Promise<T>): Promise<{
+        intent: X402ExactSettlementIntent;
+        value?: T;
+        replayed: boolean;
+    }>;
+    markAdmissionComplete(dvmId: string, intentId: string): Promise<X402ExactSettlementIntent>;
+    list(args: {
+        dvmId: string;
+        limit: number;
+        includeResolved?: boolean;
+    }): Promise<X402ExactSettlementIntent[]>;
+    attempts(dvmId: string, intentId: string): Promise<X402ExactSettlementAttempt[]>;
+    private insertAttempt;
+}
+/** In-memory exact settlement store used by dev and unit tests. */
+declare class MemoryX402ExactSettlementStore implements X402ExactSettlementStore {
+    private readonly intents;
+    private readonly evidence;
+    private readonly authBindings;
+    private readonly locks;
+    prepare(intent: Omit<X402ExactSettlementIntent, "status" | "createdAt" | "updatedAt" | "resolvedAt">): Promise<X402ExactSettlementIntent>;
+    get(dvmId: string, intentId: string): Promise<X402ExactSettlementIntent | undefined>;
+    markSubmitting(args: {
+        dvmId: string;
+        intentId: string;
+        submissionBlock?: string;
+    }): Promise<boolean>;
+    recordOutcome(args: {
+        dvmId: string;
+        intentId: string;
+        status: Extract<X402ExactSettlementStatus, "settled" | "ambiguous" | "rejected">;
+        outcome: X402ExactSettlementAttempt["outcome"];
+        detail?: string;
+        transaction?: string;
+        settleResponse?: Record<string, unknown>;
+    }): Promise<X402ExactSettlementIntent>;
+    finalize<T>(dvmId: string, intentId: string, fn: (intent: X402ExactSettlementIntent, tx?: ProcessedPaymentQuerier) => Promise<T>): Promise<{
+        intent: X402ExactSettlementIntent;
+        value?: T;
+        replayed: boolean;
+    }>;
+    markAdmissionComplete(dvmId: string, intentId: string): Promise<X402ExactSettlementIntent>;
+    list(args: {
+        dvmId: string;
+        limit: number;
+        includeResolved?: boolean;
+    }): Promise<X402ExactSettlementIntent[]>;
+    attempts(dvmId: string, intentId: string): Promise<X402ExactSettlementAttempt[]>;
+    private addAttempt;
+    private withLock;
+}
+/** Raised when the same on-chain authorization is presented for a different local effect. */
+declare class X402ExactIntentConflictError extends Error {
+    readonly intentId: string;
+    constructor(intentId: string);
+}
+/** Raised when local finalization is attempted before settlement is evidenced. */
+declare class X402ExactSettlementNotReadyError extends Error {
+    readonly intentId: string;
+    readonly status: X402ExactSettlementStatus;
+    constructor(intentId: string, status: X402ExactSettlementStatus);
+}
+
+/** Chain evidence recovered for one exact x402 authorization. */
+interface X402ExactSettlementChainEvidence {
+    transaction: string;
+    amount: string;
+}
+/** Chain boundary used by exact-settlement recovery. */
+interface X402ExactSettlementEvidenceReader {
+    getBlockNumber(): Promise<bigint>;
+    findExactPayment?(intent: X402ExactSettlementIntent): Promise<X402ExactSettlementChainEvidence | undefined>;
+}
+/** Result of accepting or recovering one exact x402 authorization. */
+type X402ExactAcceptance<T> = {
+    outcome: "accepted";
+    intentId: string;
+    receipt: X402Receipt;
+    committed?: T;
+    replayed: boolean;
+    admissionPending: boolean;
+    effect?: X402ExactSettlementEffect;
+} | {
+    outcome: "rejected";
+    intentId?: string;
+    reason: string;
+} | {
+    outcome: "ambiguous";
+    intentId: string;
+    reason: string;
+};
+/** Dependencies for the durable exact x402 settlement coordinator. */
+interface X402ExactSettlementServerOpts {
+    store: X402ExactSettlementStore;
+    evidence?: X402ExactSettlementEvidenceReader;
+    repair?: (effect: X402ExactSettlementEffect | undefined, receipt: X402Receipt, tx?: ProcessedPaymentQuerier) => Promise<unknown>;
+}
+/** Durable coordinator for irreversible exact x402 settlement. */
+declare class X402ExactSettlementServer {
+    private readonly opts;
+    private readonly activeSubmissions;
+    constructor(opts: X402ExactSettlementServerOpts);
+    /** Verify, settle, and atomically finalize one exact authorization. */
+    accept<T>(args: {
+        paymentHeader: string;
+        config: X402Config;
+        requiredUsdcMicro: bigint;
+        resource: string;
+        btcUsdRate: number;
+        exactVersions?: X402ExactVersionSupport;
+        dvmId: string;
+        effect?: X402ExactSettlementEffect;
+        commit: (receipt: X402Receipt, tx?: ProcessedPaymentQuerier, effect?: X402ExactSettlementEffect) => Promise<T>;
+    }): Promise<X402ExactAcceptance<T>>;
+    /** Read the operator queue. */
+    list(args: {
+        dvmId: string;
+        limit: number;
+        includeResolved?: boolean;
+    }): Promise<X402ExactSettlementIntent[]>;
+    /** Read durable attempt evidence for one intent. */
+    attempts(dvmId: string, intentId: string): Promise<X402ExactSettlementAttempt[]>;
+    /** Reconcile and finish one intent from chain evidence. */
+    reconcile(dvmId: string, intentId: string): Promise<{
+        intent: X402ExactSettlementIntent;
+        replayed: boolean;
+    }>;
+    /** Mark a locally committed upfront settlement complete after its job row lands. */
+    completeAdmission(dvmId: string, intentId: string): Promise<X402ExactSettlementIntent>;
+    private finalize;
+    private recoverEvidence;
+    private requiredIntent;
+}
+/** Raised when operator repair cannot prove the payment on chain. */
+declare class X402ExactSettlementEvidenceMissingError extends Error {
+    readonly intentId: string;
+    constructor(intentId: string);
+}
+
+/** Exact successful chain action recovered for one ambiguous settlement attempt. */
+interface X402SettlementChainEvidence {
+    transaction: string;
+    amount: string;
+}
+/** Chain boundary used to bookmark and reconcile irreversible x402 submissions. */
+interface X402SettlementEvidenceReader extends X402ExactSettlementEvidenceReader {
+    getBlockNumber(): Promise<bigint>;
+    findAppliedSettlement(intent: X402SettlementIntent): Promise<X402SettlementChainEvidence | undefined>;
+}
+
+/** Hosted-facilitator channel network retained for the existing testnet path. */
+declare const X402_BATCH_SETTLEMENT_NETWORK = "eip155:84532";
+/** Policy floor advertised to callers and enforced at boot. */
+declare const X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS = 86400;
+/** Default claim and transfer cadence; comfortably inside the 24-hour exit window. */
+declare const X402_BATCH_AUTO_SETTLEMENT: AutoSettlementConfig;
+/** Natural identity and incremental value carried by an accepted channel voucher. */
+interface X402BatchFunding {
+    channelId: string;
+    maxClaimableAmount: string;
+    paymentId: string;
+    amount: string;
+}
+/** Successful batch-settlement result plus the caller-owned ledger result. */
+interface X402BatchAcceptance<T> {
+    funding: X402BatchFunding;
+    settlement: SettleResponse;
+    committed: T;
+}
+/** Authoritative contract views needed to refresh one stored batch channel. */
+interface X402BatchChannelObservation {
+    balance: string;
+    totalClaimed: string;
+    withdrawRequestedAt: number;
+    refundNonce: number;
+}
+/**
+ * The chain submission behind an accepted voucher did not return success (internal-review).
+ *
+ * Typed and `retryable` because it is a service-availability fault, not a fault
+ * in the credential: the voucher verified, the ledger leg rolled back, and the
+ * same request first reconciles the durable submission bookmark before it can
+ * submit again. Without this, the branch threw a bare `Error`, which
+ * `mapLedgerCommitError` could not recognise
+ * and `verifyUpfrontPayment` answered as a 402 `payment_invalid` — copy that
+ * tells an agent its perfectly good payment can never be reused.
+ *
+ * It is deliberately *not* the relay submission lock's own error class. Upstream's
+ * `BatchSettlementEvmScheme` catches everything the signer throws and returns
+ * `{success: false, errorReason}`, so {@link X402RelaySubmissionLockError} never
+ * reaches this layer — it arrives as `settle_transaction_failed` with its message
+ * in `errorMessage`. Every sibling reason (RPC read, simulation, a reverted
+ * submission) is the same class of fault and had the same wrong copy, so the
+ * classification is made where upstream draws it rather than by re-deriving the
+ * one cause from a string.
+ *
+ * `errorReason` is upstream's enum and is safe to hand an unauthenticated caller.
+ * `errorMessage` — and therefore `.message` — is not: upstream builds it from
+ * whatever the signer threw, so it can carry a relay lock holder's backend pid
+ * and `client_addr`, or a viem error quoting the RPC URL. The self-relay path
+ * drops it before constructing this error; hosted facilitators retain their
+ * provider message for server logs. The wire gets the reason in either case.
+ */
+declare class X402SettlementSubmissionError extends Error {
+    readonly errorReason: string;
+    readonly errorMessage?: string | undefined;
+    readonly code = "x402_settlement_submission_failed";
+    readonly retryable = true;
+    constructor(errorReason: string, errorMessage?: string | undefined);
+}
+/** Structured refusal that can be turned back into a corrective 402. */
+interface X402BatchRefusal {
+    ok: false;
+    reason: string;
+    requirements: PaymentRequirementsV2[];
+    /**
+     * `false` when re-signing cannot fix this: the caller must be answered with a
+     * terminal error rather than a 402 carrying fresh requirements, because an
+     * agent reads a corrective 402 as "sign this and resubmit" and lands straight
+     * back on the same refusal (internal-review). Omitted means corrective.
+     */
+    corrective?: boolean;
+}
+/**
+ * What the chain says about one wedged settlement (internal-review).
+ *
+ * The four answers are kept apart because their repairs differ and because an
+ * operator re-pointing an RPC needs a definitive answer to read as definitive
+ * — the same split `LightningReceive.lookupSettlement` draws between
+ * `invoice_unknown_to_wallet` and `wallet_unreachable`. `findAppliedSettlement`
+ * collapses all of them (`undefined` for absent *and* unbookmarked, a throw for
+ * transport), so this is where they are separated.
+ */
+type X402SettlementEvidenceOutcome = 
+/** The chain carries this exact settlement, at this exact amount. */
+{
+    chain: "found";
+    transaction: string;
+    amount: string;
+}
+/** Scanned from the submission bookmark to head and found nothing. */
+ | {
+    chain: "absent";
+}
+/** The RPC could not be read — says nothing about whether the money moved. */
+ | {
+    chain: "unreachable";
+    error: string;
+}
+/** No submission bookmark, so there is no range to scan and no answer to give. */
+ | {
+    chain: "unbookmarked";
+};
+/** One row of the operator's repair queue: the durable intent plus what the chain says. */
+interface X402WedgedSettlement {
+    intent: X402SettlementIntent;
+    evidence?: X402SettlementEvidenceOutcome;
+}
+/** Why {@link X402SettlementRepair.reconcile} could not complete a settlement. */
+type X402SettlementRepairRefusal = {
+    refusal: "settlement_not_found";
+}
+/** `prepared` — nothing was ever submitted, so there is nothing to repair. */
+ | {
+    refusal: "settlement_not_wedged";
+    status: X402SettlementStatus;
+}
+/** A wedged deposit; the caller's own retry recovers it. See {@link X402SettlementRepair}. */
+ | {
+    refusal: "settlement_not_repairable";
+    operation: "fund";
+} | {
+    refusal: "settlement_unbookmarked";
+} | {
+    refusal: "settlement_not_on_chain";
+} | {
+    refusal: "chain_unreachable";
+    error: string;
+}
+/** A concurrent repair or a caller retry moved the row out from under this one. */
+ | {
+    refusal: "settlement_raced";
+    error: string;
+};
+/** One page of the repair queue, each row carrying what the chain says about it. */
+interface X402WedgedSettlementPage {
+    settlements: X402WedgedSettlement[];
+    /** Absent when this page was not full — there is nothing behind it. */
+    nextAfter?: X402SettlementCursor;
+}
+/** A settlement the repair completed — or found already complete. */
+interface X402SettlementRepaired<T> {
+    intent: X402SettlementIntent;
+    /** The chain figure the ledger leg was completed against; absent on a replay. */
+    evidence?: X402SettlementEvidenceOutcome & {
+        chain: "found";
+    };
+    committed?: T;
+    /** True when the settlement was already `complete` and nothing was booked again. */
+    replayed: boolean;
+}
+/**
+ * The operator's exit from a settlement stuck between "chain paid" and "ledger
+ * booked" (internal-review).
+ *
+ * `reconcile` is the ordinary recovery path with the chain's figure substituted
+ * for the facilitator's: the amount is re-derived from
+ * `x402-settlement-evidence.ts` and never supplied by the operator, which is
+ * what keeps this door from extinguishing a different figure than the chain
+ * actually paid. The ledger legs stay outside this module — they arrive as the
+ * same `commit`/`complete` callbacks {@link X402BatchSettlementServer.accept}
+ * takes, so the live path and the repair cannot drift about what completing a
+ * drain means.
+ *
+ * Both write verbs are `refund`-only. A wedged `fund` is recovered by the
+ * caller's own retry (that leg has no amount guard to wedge on), and its ledger
+ * effect is `payment.ts`'s fund-and-draw, which an admin route has no way to
+ * reconstruct.
+ */
+interface X402SettlementRepair {
+    /** One settlement by its own id, with no chain lookup — the repair's own read. */
+    get(settlementId: string): Promise<X402SettlementIntent | undefined>;
+    list(args: {
+        limit: number;
+        after?: X402SettlementCursor;
+        /** Staleness floor — a settlement younger than this is in flight, not wedged. */
+        updatedBeforeMs: number;
+        includeResolved?: boolean;
+        /** Skip the per-row chain lookups; the queue itself needs no RPC. */
+        evidence?: boolean;
+    }): Promise<X402WedgedSettlementPage>;
+    reconcile<T>(args: {
+        settlementId: string;
+        commit: (intent: X402SettlementIntent, tx: CreditLedgerQuerier) => Promise<T>;
+        complete: (evidence: {
+            transaction: string;
+            amount: string;
+        }, committed: T, tx: CreditLedgerQuerier) => Promise<T>;
+        nowMs?: number;
+    }): Promise<X402SettlementRepaired<T> | X402SettlementRepairRefusal>;
+    writeOff(args: {
+        settlementId: string;
+        note?: string;
+        nowMs?: number;
+    }): Promise<X402SettlementWriteOff | X402SettlementRepairRefusal>;
+}
+/** Runtime server handle used only by `/v1/credit`. */
+interface X402BatchSettlementServer {
+    buildRequirements(amount: string): Promise<PaymentRequirementsV2[]>;
+    accept<T>(args: {
+        paymentHeader: string;
+        amount: string;
+        effectId: string;
+        /**
+         * Required on `refund`: the credit's unspent balance in the channel token's
+         * own units. It is the ceiling the on-chain payout is sized to, so that a
+         * drain returns what the caller is owed and nothing the DVM has earned
+         * (internal-review). `commit` must re-assert it against the authoritative ledger
+         * figure, since this one is read before the channel lock is taken.
+         */
+        refundBoundNative?: number;
+        commit: (funding: X402BatchFunding, tx?: CreditLedgerQuerier) => Promise<T>;
+        complete?: (settlement: SettleResponse, committed: T, tx?: CreditLedgerQuerier) => Promise<T>;
+    } & ({
+        operation: "fund";
+        expectedChannelId?: undefined;
+    } | {
+        operation: "refund";
+        /**
+         * The channel the credit being drained is bound to. Required, and
+         * required in the *type*, because the payload the payer presents is
+         * what revokes, settles and pays: a refund voucher naming another
+         * channel would extinguish this credit's balance out of that channel's
+         * escrow (internal-review). The fund path binds in the ledger
+         * (`credit-ledger.ts`'s `rail_mismatch`) and the Tempo close binds in
+         * its credential verifier; this is x402's.
+         */
+        expectedChannelId: string;
+    })): Promise<{
+        ok: true;
+        value: X402BatchAcceptance<T>;
+    } | X402BatchRefusal>;
+    getChannel(channelId: string): Promise<Channel | undefined>;
+    /** Refresh one stored channel from the facilitator without settling or broadcasting anything. */
+    observeChannel(channelId: string): Promise<Channel | undefined>;
+    claimAndSettle(): Promise<void>;
+    /**
+     * Operator repair for a settlement wedged between chain and ledger
+     * (internal-review). Absent without durable storage: with no settlement rows there
+     * is no queue and nothing a repair could act on.
+     */
+    repair?: X402SettlementRepair;
+    /**
+     * The durable settlement read the credit ledger gates spending on
+     * (internal-review). Absent without durable storage, on the same reasoning as
+     * {@link repair}: with no settlement rows nothing can be wedged, so there is
+     * nothing to gate.
+     */
+    settlementGate?: X402RefundSettlementGate;
+    stop(): Promise<void>;
+}
+/** Options for constructing one DVM's batch-settlement server. */
+interface CreateX402BatchSettlementServerOpts {
+    network: string;
+    payTo: string;
+    facilitator?: string;
+    facilitatorAuth?: X402FacilitatorAuth;
+    config: X402BatchSettlementConfig;
+    /**
+     * Chain RPC endpoint for settlement reconciliation; defaults to viem's bundled public one.
+     *
+     * Takes precedence over {@link X402BatchSettlementConfig.rpcUrl}, which is
+     * where a builder configuring the rail declares it.
+     */
+    rpcUrl?: string;
+    db?: Pool;
+    /**
+     * Durable store to adopt instead of building one from {@link db} (internal-review).
+     *
+     * `createDVMServer` builds it at ledger construction, because the credit
+     * ledger's spend gate has to exist whether or not this server is ever
+     * constructed. Adopting it here keeps one `PostgresX402ChannelStorage` — and
+     * so one settlement pool — per mount, which is what the internal-review reasoning on
+     * {@link PostgresX402ChannelStorage} rests on. Ignored when the config
+     * supplies its own {@link X402BatchSettlementConfig.storage}.
+     */
+    channelStorage?: PostgresX402ChannelStorage;
+    allowInMemory?: boolean;
+    /**
+     * Rail-native value the credit a channel funded has earned, in the channel
+     * token's atomic units — `CreditLedgerLike.earnedNativeForX402Channel`.
+     * `undefined` means the channel's credit could not be resolved.
+     *
+     * Required, not optional: it is the ceiling every claim is capped at
+     * (internal-review), and a server that cannot derive one must claim nothing rather
+     * than fall back to the deposit.
+     */
+    earnedNative: (channelId: string) => Promise<number | undefined>;
+    /** Bounded host-probe result reused during resource initialization. */
+    supportedResponse?: SupportedResponse;
+    /** Exact-chain evidence override for deterministic tests and custom RPC infrastructure. */
+    settlementEvidenceReader?: X402SettlementEvidenceReader;
+    /** Authoritative channel-view override for deterministic tests. */
+    channelStateReader?: (channelId: string) => Promise<X402BatchChannelObservation>;
+    /**
+     * The payout tracker (internal-review). Attached with this server's settle scope
+     * and routed every claim and settle, so the batch that lands at `pay_to` is
+     * reported with the value claimed into it, and the pending snapshot can say
+     * what is still on the channels and whether the settle is wedged.
+     *
+     * @internal Wired by `createDVMServer` from the platform reporter; not a
+     * builder surface, and not part of the extractable SDK contract (internal-review).
+     */
+    payout?: X402PayoutObserver;
+}
+/**
+ * Initialize upstream's scheme and channel manager against dvmkit storage.
+ * `resource.initialize()` performs the facilitator capability check and is
+ * deliberately part of boot, so x402.org's missing authorizer refuses a
+ * misconfigured server before it advertises a channel callers could fund.
+ */
+declare function createX402BatchSettlementServer(opts: CreateX402BatchSettlementServerOpts): Promise<X402BatchSettlementServer>;
+
+/** Payment state from upfront token verification. */
+interface PaymentInfo {
+    /**
+     * Rail value this payment contributes to the job, in millisatoshis.
+     *
+     * For a credit-drawn job (internal-review) this is the **draw's** allocated share of
+     * the credit's rail value, not the amount the caller handed over on this
+     * request — under an explicit fund-and-draw the caller may have funded twenty
+     * jobs' worth. That makes it the revenue basis for this job: mid-job top-ups
+     * accumulate onto it, and the terminal books exactly what the job consumed.
+     */
+    paidMsats: number;
+    paymentMint?: string;
+    /**
+     * Rail that satisfied the upfront payment, if any. A {@link FundingMethod}
+     * rather than a `PaymentMethod`: a draw against a Lightning-funded credit
+     * reports `"lightning"` here (internal-review), which is what lets the revenue
+     * ledger book it instead of silently dropping the row.
+     */
+    paymentRail?: FundingMethod;
+    receivedProofs: ProofLike[];
+    /**
+     * Settlement reference for the credit. x402 carries the EVM tx hash from
+     * the facilitator (internal-review); mpp carries the credential's `challenge.id`,
+     * HMAC-bound to the realm so cross-DVM collisions are impossible (internal-review);
+     * cashu accumulator (internal-review) sets it to the `X-Cashu-Request-Id` UUID
+     * (internal-review). Required by the platform revenue ledger for `tempo`/`x402`
+     * rails; nullable for cashu's `tx_hash` column.
+     */
+    paymentTxHash?: string;
+    /** Chain transaction returned to a caller recovering this accepted request. */
+    paymentTransactionHash?: string;
+    /**
+     * Rail-native payment amount in atomic units (internal-review). Sats for mpp,
+     * USDC microunits for x402. Cashu leaves it unset — the existing
+     * `paidMsats / 1000` derivation in the platform callback covers it.
+     */
+    nativeAmount?: number;
+    /** Native asset tag matching `revenue_events.native_asset` (internal-review). */
+    nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
+    /**
+     * Discriminator written into `revenue_events.metadata.cashu_flow` so ops
+     * queries can split per-call cashu rows by source path (internal-review).
+     */
+    cashuFlow?: "p2pk_accumulator";
+    /**
+     * Base64-encoded x402 `SettleResponse` for the `X-PAYMENT-RESPONSE`
+     * response header (internal-review). Set on the upfront-flow x402 success path;
+     * `app.ts` attaches it to the 2xx response per x402 spec.
+     */
+    x402SettleResponseHeader?: string;
+    /** Exact-settlement admission retained until the matching upfront job row is durable. */
+    x402ExactAdmission?: {
+        intentId: string;
+        jobId: string;
+        replayed: boolean;
+    };
+    /**
+     * Credit-ledger linkage (internal-review). Set whenever the payment funded and/or
+     * drew the ledger — every paid job with a ledger wired. Persisted on the
+     * job so the terminal funnel can settle/release the draw and the receipt
+     * can countersign the `ReceiptCredit` block.
+     */
+    creditId?: string;
+    /** The draw placed for this job on `creditId` (internal-review). */
+    drawId?: string;
+    /** The draw's fiat amount, 1e-6 of {@link creditCurrency} (internal-review). */
+    drawAmountMicro?: number;
+    /** Currency the credit — and therefore the draw — is denominated in (internal-review). */
+    creditCurrency?: string;
+    /**
+     * The funding leg, when this request actually moved money onto a credit
+     * (internal-review). Reported to the platform as a **deposit**: a liability until
+     * drawn, never summed into revenue. Absent on a pure draw against an
+     * existing balance.
+     */
+    funding?: CreditFundingReport;
+    /** Signed proof and snapshot for an explicit fund-and-draw funding leg. */
+    fundingReceipt?: FundingReceipt;
+    fundingCredit?: CreditSnapshot;
+    /**
+     * Fiat micro of {@link creditCurrency} this payment funded that bought the
+     * job **nothing** (internal-review) — a second payment for an ask the job's draw
+     * already covers, or the overpaid tail of an oversized one. It is available
+     * balance on {@link creditId}, drainable at once, and the caller has to be
+     * told or they will re-send. Absent on every ordinary payment.
+     */
+    unappliedMicro?: number;
+}
+/**
+ * A funding event as the platform books it — one deposit row (internal-review, spec
+ * §10). Keyed on `(dvmId, creditId, fundingId)`, so a retried report is a
+ * no-op rather than a double-count.
+ */
+interface CreditFundingReport {
+    creditId: string;
+    /** The rail's own settlement reference — the deposit's idempotency key. */
+    fundingId: string;
+    rail: FundingMethod;
+    /** Rail value received, in millisatoshis. */
+    paidMsats: number;
+    /** Gross Cashu proof face before its receiver input fee; Cashu only. */
+    grossPaidMsats?: number;
+    /** Standalone NUT-02 fee reserved by the received Cashu proofs; Cashu only. */
+    cashuInputFeeMsats?: number;
+    /** Rail-native atomic units; omitted for cashu (the platform derives from msats). */
+    nativeAmount?: number;
+    nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
+    mint?: string;
+    /** Fiat micro credited to the ledger, and the currency it's denominated in. */
+    amountMicro: number;
+    currency: string;
+    fundedAt: number;
+    /** Current credit expiry after this funding committed (epoch ms). */
+    expiryMs: number;
+    /** TIP-1034 voucher identity, present only for session-funded credit. */
+    tempoSession?: {
+        channelId: string;
+        cumulativeAmount: string;
+    };
+    /** TIP-1034 chain binding, reported so the platform can route a close (internal-review). */
+    tempoChannel?: TempoChannelReport;
+}
+/**
+ * The chain identity of a TIP-1034 channel, as reported to the platform
+ * alongside its deposit (internal-review). Read from the DVM's own durable channel
+ * store, never from the caller's credential.
+ */
+interface TempoChannelReport {
+    chainId: number;
+    escrow: string;
+    payee?: string;
+}
+/** Options for verifying an upfront payment on job submission. */
+interface UpfrontPaymentOpts {
+    cashuToken?: string;
+    requiredMsats?: number;
+    mints?: string[];
+    /** Base64-encoded x402 `PaymentPayload` from the `X-PAYMENT` header. */
+    x402Payment?: string;
+    x402Config?: X402Config;
+    /** Durable exact-settlement coordinator. Production hosts wire this automatically. */
+    x402ExactSettlement?: X402ExactSettlementServer;
+    /** Exact generations the facilitator currently advertises. Defaults to both. */
+    x402ExactVersions?: X402ExactVersionSupport;
+    /** Reusable channel acceptor. Only consulted for fund-only `/v1/credit` requests. */
+    x402BatchSettlement?: X402BatchSettlementServer;
+    /**
+     * Resource URL the client retried against. Bound into the rebuilt
+     * `PaymentRequirements` when verifying x402, and surfaced on the 402 body
+     * `accepts` array for x402 dual-serve (internal-review).
+     */
+    x402Resource?: string;
+    /** Either the structured credential object or its serialized `Authorization: Payment <…>` value. */
+    mppCredential?: MppxCredential | string;
+    mpp?: MppxServer;
+    /**
+     * Request path of the resource being paid for (e.g. `/v1/job`). Bound into
+     * each issued mppx challenge's `meta.path` so a credential can't be replayed
+     * against a different paid endpoint of the same DVM (internal-review).
+     */
+    resourcePath?: string;
+    /**
+     * Whether `tempo/session` may be issued and newly accepted right now — the
+     * platform close-observer and hosted settlement-readiness gates (internal-review,
+     * internal-review), resolved per request by `DVMServer`. Absent means offered: a
+     * self-hosted DVM operates these responsibilities itself.
+     *
+     * `false` refuses a session credential that would open a channel the platform
+     * cannot safely protect or settle (internal-review, internal-review), and withholds session
+     * challenges from every 402 this call emits, *except* on a credit already
+     * bound to a TIP-1034 channel. That deposit is already exposed, so refusing
+     * its vouchers only strands it; and since a channel-bound credit can be funded
+     * no other way, withholding the challenge as well would have made the
+     * acceptance carve-out unreachable through ordinary discovery.
+     */
+    tempoSessionOffered?: boolean;
+    /** Machine-readable cause when {@link tempoSessionOffered} is false. */
+    tempoSessionUnavailableReason?: "observer_unhealthy" | "settlement_unhealthy";
+    /**
+     * Tracks consumed `(realm, challenge.id)` pairs so a credential that was
+     * already accepted on the upfront path can't be replayed within its
+     * `expires` window (internal-review). Optional: when absent, the upfront flow has
+     * no per-process replay protection beyond mppx's own expiry check.
+     */
+    consumedCredentialStore?: ConsumedCredentialStore;
+    /** Cashu receive mode (internal-review / internal-review). Routes the receive path. */
+    cashuMode?: CashuMode;
+    /** Per-DVM Postgres pool — required for the `p2pk-accumulator` path. */
+    accumulatorDb?: AccumulatorPool;
+    /** DVM identifier — required for the `p2pk-accumulator` path. */
+    dvmId?: string;
+    /**
+     * Active NUT-11 P2PK lock pubkeys — required for the `p2pk-accumulator`
+     * path. Includes the current pubkey followed by retired pubkeys still
+     * within the rotation grace window (internal-review). Caller resolves via
+     * `loadLockPubkeyState` per-request so rotations propagate without a
+     * server restart.
+     */
+    lockPubkeys?: LockPubkey[];
+    /** UUIDv4 from `X-Cashu-Request-Id` header. */
+    requestId?: string;
+    /**
+     * Runtime mint-health tracker (internal-review). Receive path short-circuits with
+     * `cashu_mint_sick` when the token's mint is currently flagged sick, so
+     * agents retry against a healthy alternative without waiting for the
+     * per-call mint timeout to fire inside `acceptAccumulatorPayment`.
+     */
+    mintHealthTracker?: MintHealthTracker;
+    /**
+     * Host fx fetcher used to price the non-sat rails (x402 USDC, mppx fiat)
+     * through the same BTC/USD source the quote path uses (internal-review). On a hosted
+     * DVM this is the platform-served snapshot; self-hosted defaults to
+     * CoinGecko-direct. Optional: a lazy default fetcher stands in when unset, so
+     * the payment path never reaches `fetchBtcUsdRate`.
+     */
+    fxFetcher?: FxFetcher;
+    /**
+     * Credit ledger every payment funds and draws through (internal-review, spec §1):
+     * an attached rail payment is an implicit N=1 funding — `fund` the paid
+     * amount + `draw` it, atomically with the rail commit. When absent (or
+     * when the price can't be fiat-denominated), the payment is accepted with
+     * legacy semantics and a structured warning — money is never refused
+     * because the ledger is unavailable.
+     */
+    creditLedger?: CreditLedgerLike;
+    /**
+     * Durable processed-payment markers for the x402/mpp rails (internal-review).
+     * Those rails commit money outside dvmkit, so the marker row — written in
+     * the same transaction as the ledger fund — is what makes a crash-replayed
+     * credential unable to fund twice.
+     */
+    processedPayments?: ProcessedPaymentStore;
+    /**
+     * Reporter-owned transactional outbox enqueue (internal-review). When present,
+     * every funding awaits this inside the rail's commit transaction, so money
+     * and its durable deposit report land together.
+     */
+    enqueueCreditDeposit?: CreditDepositEnqueue;
+    /**
+     * The job price's fiat denomination, pinned by the caller from the same
+     * quote surface that produced `requiredMsats` (internal-review). The ledger is
+     * fiat-micro denominated; fund = draw = this amount in the exact-payment
+     * case, so no fresh fx conversion happens on the verify hot path.
+     */
+    priceFiat?: PriceFiat;
+    /** Pre-allocated job id — recorded on the draw so replays can recover the job. */
+    jobId?: string;
+    /** Durable submit fingerprint paired with {@link jobId} for exact-x402 job admission. */
+    requestFingerprint?: string;
+    /** Fingerprint including the caller-auth envelope, reserved to this exact intent. */
+    requestAuthFingerprint?: string;
+    /** Verified caller pubkey from the signed-request envelope, when the DVM has auth. */
+    callerPubkey?: string;
+    /** Requester id — funder identity fallback for DVMs without descriptor auth. */
+    requesterId?: string;
+    /**
+     * Explicit credit fields extracted from the signed body (spec §2). Their
+     * signature coverage and structural validation happen in `app.ts` before
+     * payment verification; this layer enforces ownership, the funding
+     * commitment, and the draw itself.
+     */
+    creditEnvelope?: CreditEnvelope;
+    /**
+     * Turn this verification into a **fund-only top-up** (internal-review): the rails
+     * verify and commit exactly as they do for a job, but the ledger leg funds
+     * without drawing — there is no job to pay for. Set by `POST /v1/credit`;
+     * `requiredMsats` / `priceFiat` carry the requested top-up amount rather
+     * than a job price.
+     */
+    fundOnly?: FundOnlyRequest;
+    /**
+     * Credit lifetime to mint, in ms — the DVM's advertised `credit.ttl`.
+     * Defaults to {@link IMPLICIT_CREDIT_TTL_MS}. Threading it keeps the
+     * funding menu honest: a DVM advertising a 7-day TTL must not mint 30-day
+     * credits.
+     */
+    creditTtlMs?: number;
+}
+/** A fund-only top-up's identity: which credit, under which client-generated id. */
+interface FundOnlyRequest {
+    /**
+     * Target credit. `/v1/credit` always supplies one — either the caller's
+     * `credit_id` or the deterministic id derived from `(pubkey, fund_id)` — so
+     * a retry lands on the same credit and hits the `credit_fundings` key.
+     */
+    creditId?: string;
+    /**
+     * Builder opt-in for one-payment stablecoin credit. Absent fails closed;
+     * only `POST /v1/credit` supplies this policy input.
+     */
+    allowOneShotStablecoin?: boolean;
+    /** Client-generated idempotency key for this deposit (`credit_fundings` PK). */
+    fundId: string;
+    /**
+     * SHA-256 hex over the raw funding artifact, signed by the caller (spec §2
+     * condition 3). Checked before any rail work: it is what binds the artifact
+     * presented on the header to the deposit named in the signed body.
+     */
+    commitment: string;
+}
+
+/** Everything the issuer needs to sign for one DVM. */
+interface ReceiptIssuerOpts {
+    /** 32-byte hex receipt secret — `DVMKIT_RECEIPT_KEY`, or an ephemeral dev key. */
+    secret: string;
+    /** DVM slug written into every receipt's `dvm` field. */
+    dvm: string;
+    /** Immutable DVM identity written into every signed receipt. */
+    dvmId: string;
+}
+/**
+ * Signs job receipts for one DVM (internal-review).
+ *
+ * Constructed only when a receipt key is wired, so the presence of an issuer
+ * *is* the "this DVM emits receipts" signal that `/v1/info` advertises. Pure:
+ * it holds the key and the slug and turns a terminal `JobRecord` plus an
+ * allocated sequence number into signed bytes — sequence allocation and
+ * persistence belong to the store, which is what makes issuance idempotent
+ * across machines.
+ */
+declare class ReceiptIssuer {
+    /** x-only pubkey this issuer signs under; the attested `receipt_pubkey`. */
+    readonly pubkey: string;
+    private readonly secret;
+    private readonly dvm;
+    private readonly dvmId;
+    constructor(opts: ReceiptIssuerOpts);
+    /**
+     * Build and sign the receipt for a terminal job. `seq` comes from
+     * `JobStore.claimReceiptSeq`, `issuedAt` defaults to now (tests pin it).
+     *
+     * Free jobs get receipts too, with `paid.msats: 0` — they still consume a
+     * sequence number and still attest an outcome. Whether feedback is
+     * paid-only is the feedback layer's call, not this one's.
+     *
+     * `credit` is the resolved draw block (internal-review) — present on every job
+     * whose payment funded/drew the ledger, absent otherwise. Signature-
+     * compatible either way: `canonicalize` omits absent keys.
+     */
+    issue(record: JobRecord, seq: number, issuedAt?: number, credit?: ReceiptCredit): JobReceipt;
+    /**
+     * Countersign one reclaim event (internal-review). Unlike job receipts there is
+     * no store-allocated sequence — the drain's own `ledger_seq` (taken under
+     * the credit row lock, shared with draws) already orders it in the
+     * per-credit evidence chain.
+     */
+    issueDrain(args: {
+        creditId: string;
+        drainId: string;
+        event: DrainReceiptEvent;
+        method: string;
+        amountMicro: number;
+        balanceAfterMicro: number;
+        ledgerSeq: number;
+        callerPubkey: string;
+        issuedAt?: number;
+    }): DrainReceipt;
+    /** Countersign the immutable tuple captured when a credit funding committed. */
+    issueFunding(args: {
+        creditId: string;
+        fundId: string;
+        fundedMicro: number;
+        balanceAfterMicro: number;
+        ledgerSeq: number;
+        callerPubkey: string;
+        issuedAt?: number;
+    }): FundingReceipt;
+}
+
+/** Stable reason why the configured x402 exact rail cannot be advertised. */
+type X402FacilitatorUnavailableReason = "probe_failed" | "unsupported_exact";
+/** Versioned settlement capabilities advertised by one facilitator/network pair. */
+interface X402FacilitatorSupport {
+    /** True when at least one exact generation can settle. */
+    available: boolean;
+    exact: X402ExactVersionSupport;
+    batchSettlement: boolean;
+    facilitator: string;
+    network: string;
+    reason?: X402FacilitatorUnavailableReason;
+    error?: string;
+}
+/** Live, synchronous capability view consumed while payment responses are rendered. */
+interface X402FacilitatorHealthLike {
+    /** Prime or refresh the capability observation. */
+    refresh(): Promise<void>;
+    /** Return current support and begin a background refresh when its TTL has elapsed. */
+    support(): X402FacilitatorSupport;
+    /** Last successful raw response, reused by batch initialization without another request. */
+    supportedResponse?(): SupportedResponse | undefined;
+}
+
+/** Options for creating a JobManager. */
+interface JobManagerOpts {
+    /** Environment variables for ctx.env. */
+    env: Record<string, string>;
+    /** KV store for ctx.store. */
+    store: KVStore;
+    /** Cashu mints accepted for payment. */
+    mints?: string[];
+    /** Persistent backing store for job records. Default: in-memory. */
+    jobStore?: JobStore;
+    /** When true, payment messages auto-credit without verification. */
+    devMode?: boolean;
+    /** Payment methods this DVM accepts. Default: derived by the server from configured rails. */
+    paymentMethods?: PaymentMethod[];
+    /** x402 stablecoin payment configuration. */
+    x402?: X402Config;
+    /** Durable exact-settlement coordinator shared with upfront verification. */
+    x402ExactSettlement?: X402ExactSettlementServer;
+    /** Live facilitator capabilities for version-specific mid-job payment handling. */
+    x402FacilitatorHealth?: X402FacilitatorHealthLike;
+    /** MPP multi-rail payment handle (built via `createMppFromOpts`). */
+    mpp?: MppxServer;
+    /** Cashu receive mode (internal-review). */
+    cashuMode?: CashuMode;
+    /** Builder's NUT-11 P2PK lock pubkey (internal-review). Required for accumulator mode. */
+    lockPubkey?: string;
+    /** Postgres pool for wallet accumulator persistence. */
+    db?: Pool;
+    /**
+     * Agent-wallet (internal-review): per-DVM identifier used for the scheduler advisory
+     * lock and the `(dvm_id, request_id)` replay key. Defaults to `DVMKIT_DVM_ID`
+     * env at boot in `createDVMHost()`.
+     */
+    dvmId?: string;
+    /** Audience expected by persisted v2 caller statements. */
+    authAudience?: SignedRequestAudience;
+    /**
+     * Shared fx fetcher used to convert USD-string descriptor prices and
+     * fiat-form `requestPayment` calls into sats (internal-review). The SDK server owns
+     * one per process so concurrent quotes share the 60s cache window.
+     */
+    fxFetcher: FxFetcher;
+    /**
+     * Signs a receipt at every terminal transition (internal-review). Absent when the
+     * DVM has no receipt key wired — jobs then terminate exactly as before and
+     * `/v1/info` doesn't advertise `receipts`.
+     */
+    receiptIssuer?: ReceiptIssuer;
+    /**
+     * Credit ledger for the terminal funnel (internal-review): a job carrying a
+     * `creditId`/`drawId` settles its draw on success and releases it on
+     * failure/cancel — this is how "no debit on job failure" is mechanically
+     * real. The resolution runs before receipt issuance so the receipt's
+     * `credit` block countersigns the post-resolution balance.
+     */
+    creditLedger?: CreditLedgerLike;
+    /**
+     * Durable processed-payment markers (internal-review), threaded through to the
+     * mid-job top-up path (internal-review) so an x402/mpp payment's marker, `fund`, and
+     * `growDraw` commit together.
+     */
+    processedPayments?: ProcessedPaymentStore;
+    /**
+     * Reporter-owned transactional deposit enqueue threaded into mid-job rail
+     * commits (internal-review).
+     */
+    enqueueCreditDeposit?: CreditDepositEnqueue;
+    /** Reporter outbox inserted atomically with a terminal draw release (internal-review). */
+    enqueueCreditDrawRelease?: CreditDrawReleaseEnqueue;
+    /** Credit lifetime a top-up mints with, from the DVM's advertised `credit.ttl`. */
+    creditTtlMs?: number;
+    /**
+     * The DVM's declared pricing currency (internal-review), which is the currency of
+     * every credit it opens. Threaded into the job context so a mid-job ask on a
+     * job that holds no credit yet is still pinned in the denomination its first
+     * payment will open the credit in (internal-review). `DVMServer` passes its resolved
+     * `pricingCurrency`; a host building a `JobManager` directly falls back to the
+     * descriptor, and then to `"usd"`.
+     */
+    pricingCurrency?: string;
+    /**
+     * Callback fired when a mid-job top-up moves money onto a credit (internal-review).
+     * The platform books it as a **deposit** — a liability until drawn, never
+     * summed into revenue — so a top-up that skipped this would leave the
+     * outstanding-liability view short. Mirrors `DVMServer.reportCreditDeposit`,
+     * which handles the upfront and `/v1/credit` legs.
+     */
+    onCreditFunded?: (info: CreditDepositPayload) => void | Promise<void>;
+    /**
+     * Callback fired when a paid job completes (internal-review). Container-runtime DVMs
+     * use this to report revenue to the platform via `RevenueReporter`. Mirrors
+     * the isolate path's `IsolateJobManager.opts.onJobCompleted`.
+     */
+    onJobCompleted?: (info: {
+        dvmId: string;
+        jobId: string;
+        paidMsats: number;
+        paymentMint?: string;
+        rail: string;
+        paymentTxHash?: string;
+        nativeAmount?: number;
+        nativeAsset?: string;
+        cashuFlow?: string;
+        creditId?: string;
+        drawId?: string;
+        drawAmountMicro?: number;
+        creditCurrency?: string;
+        settledAt?: number;
+        fundingRef?: string;
+        kind?: string;
+    }) => void | Promise<void>;
+    /**
+     * Callback fired when the stale-job reaper force-fails a *paid* job — its
+     * pending credit draw is released rather than settled, because only a
+     * completed job settles a draw (internal-review). Container-runtime DVMs wire this
+     * to a paid-job-death report → operator `notice` (internal-review). Never fires for
+     * free jobs (`paidMsats === 0`). Fired fire-and-forget so a throw or a slow
+     * report can't wedge the sweep.
+     */
+    onPaidJobDeath?: (info: {
+        dvmId: string;
+        jobId: string;
+        capability: string;
+        paidMsats: number;
+        rail: string;
+        reason: "worker_died_mid_job" | "stale_no_terminal_status";
+        nativeAmount?: number;
+        nativeAsset?: string;
+        paymentMint?: string;
+    }) => void | Promise<void>;
+    /**
+     * Callback fired when a settled credit draw cannot book a revenue event
+     * because no usable payment rail is available (internal-review). Container-runtime
+     * DVMs auto-wire this to the platform's deduped operator notice. Fired
+     * fire-and-forget so alert delivery cannot block terminal handling or draw
+     * reconciliation.
+     */
+    onRevenueSkippedNoRail?: (info: RevenueSkippedNoRailPayload) => void | Promise<void>;
+    /**
+     * Stale-job sweep threshold in ms (internal-review). Jobs in a non-terminal status
+     * (`processing` / `working` / `awaiting-input`) whose `lastActivityAt` is
+     * older than this are force-cancelled with reason `stale_no_terminal_status`,
+     * so callers always reach a terminal status instead of polling forever after
+     * a worker crash, OOM, or silent `messageAppender` failure. Default:
+     * `2 × descriptor.idleTimeout + STALE_JOB_WATCHDOG_HEADROOM_MS`, matching
+     * the internal-review acceptance criterion against scrape's `JOB_TIMEOUT_MS`.
+     * Builders whose per-handler wall-clock bound exceeds 90s must override
+     * this — otherwise the watchdog fires on a legitimate in-flight handler.
+     * Set to `0` to disable (test seam).
+     */
+    staleJobTimeoutMs?: number;
+    /**
+     * Sweep interval for the stale-job watchdog. Default: `min(60s, max(15s,
+     * tightestActiveTimeout / 4))`. Tests override to fire deterministically.
+     */
+    staleJobSweepIntervalMs?: number;
+    /**
+     * Worker-liveness watchdog in ms (internal-review). Jobs in `processing`/`working`
+     * whose `lastActivityAt` is older than this are marked `failed` (dead
+     * worker), separately from the longer `awaiting-input` idle timeout above.
+     * Default: `descriptor.processingWatchdog * 1000` or
+     * `DEFAULT_PROCESSING_WATCHDOG_MS`. Set to `0` to disable (test seam).
+     */
+    processingWatchdogMs?: number;
+    /**
+     * Interval at which locally-active `processing`/`working` jobs have their
+     * `lastActivityAt` bumped so the processing watchdog only fires on a truly
+     * dead worker (internal-review). Default: `DEFAULT_HEARTBEAT_INTERVAL_MS`. Set to
+     * `0` to disable (test seam). Also floors how far the internal-review clock guard
+     * may compensate a backwards step on the processing arm — a cadence close to
+     * `processingWatchdogMs` leaves it no room and it compensates nothing.
+     */
+    heartbeatIntervalMs?: number;
+    /**
+     * Age in ms at which a `pending` credit draw whose `job_id` matches no row in
+     * the job store is released as orphaned (internal-review). The draw commits before
+     * the job row is persisted, so a crash or a fail-closed refusal in that
+     * window strands a hold no terminal path can ever reach. Must stay
+     * comfortably above the submit path's draw→persist latency. Set to `0` to
+     * disable the watchdog entirely — stranded holds then stay stranded, so
+     * treat it as a money knob, not a tuning one. Default:
+     * {@link DEFAULT_ORPHAN_DRAW_AGE_MS}.
+     */
+    orphanDrawAgeMs?: number;
+    /**
+     * Age in ms at which a `pending` credit draw whose job row **is** terminal is
+     * reconciled against that row's outcome (internal-review) — settled for a
+     * `completed` job, released for a `failed`/`cancelled` one. Covers the hole
+     * `orphanDrawAgeMs` cannot: `resolveCreditDraw` throwing on a ledger error
+     * leaves a terminal job whose hold no later path retries.
+     *
+     * Rides the same scan as the orphan arm, which has two consequences for the
+     * value you set here. Setting `orphanDrawAgeMs` to `0` disables this arm too.
+     * And the effective gate is `max(orphanDrawAgeMs, terminalDrawReconcileAgeMs)`
+     * — the scan never returns a row younger than its own cutoff, so anything
+     * below `orphanDrawAgeMs` is silently clamped up to it. That floor is
+     * deliberate rather than a wart: honouring a narrower value would mean
+     * widening the scan, which hands the orphan arm rows younger than
+     * `orphanDrawAgeMs` that it must not release. It can only ever delay a
+     * settle, never advance one, which is the safe direction for a debit.
+     *
+     * Set to `0` to disable this arm alone — a money knob, not a tuning one.
+     * Default: {@link DEFAULT_TERMINAL_DRAW_RECONCILE_AGE_MS}.
+     */
+    terminalDrawReconcileAgeMs?: number;
+    /**
+     * Sweep interval for the orphan-draw watchdog. Default:
+     * {@link DEFAULT_ORPHAN_DRAW_SWEEP_INTERVAL_MS}. Set to `0` to disable — the
+     * test seam, since suites drive `sweepOrphanDraws()` directly.
+     */
+    orphanDrawSweepIntervalMs?: number;
+    /**
+     * Grace window in ms a reactivating machine waits for a live original handler
+     * to win the single-execution claim before replaying an `awaiting-input` job
+     * itself (internal-review). Default: `DEFAULT_REACTIVATION_CLAIM_GRACE_MS`. Widen if
+     * cross-machine NOTIFY latency causes spurious double executions; lower in
+     * tests for speed.
+     */
+    reactivationClaimGraceMs?: number;
+}
+type ResolvedInput<I extends ZodLike | undefined> = I extends ZodLike<infer O> ? O : string;
+/**
+ * A deposit this payment funded that the job row did **not** take (internal-review).
+ *
+ * Reached when two mid-job top-ups race on a free-then-paid job: each opens its
+ * own implicit credit, and `verifyAndCredit`'s set-if-null bind keeps one. The
+ * loser's money is real, owned by the caller, and reclaimable — but nothing
+ * named it, so the caller would have to derive `imp:<rail>:<payment_id>` to
+ * reach their own balance. This rides the 201 so they don't have to.
+ *
+ * The response is the fast surface, not the only one: the credit is opened
+ * under the caller's verified pubkey, so `POST /v1/credit` op `balance` lists
+ * it and op `drain` reclaims it once the hold resolves.
+ */
+interface UnappliedCredit {
+    credit_id: string;
+    credited_micro: number;
+    credit_currency: string;
+    display: string;
+    hint: string;
+}
+/**
+ * What {@link JobManager.processPayment} tells the route. `error` is a refusal
+ * to serialise verbatim; otherwise the payment was accepted, optionally
+ * carrying an {@link UnappliedCredit} to fold into the 201.
+ */
+type ProcessPaymentOutcome = {
+    error: {
+        body: Record<string, unknown>;
+        status: number;
+    };
+    unappliedCredit?: undefined;
+} | {
+    error?: undefined;
+    unappliedCredit?: UnappliedCredit;
+};
+/**
+ * Transport-agnostic job lifecycle manager.
+ *
+ * Handles job creation, handler invocation, message dispatch, persistence,
+ * idle timeout, and durable replay. Shared by both the HTTP server and
+ * relay provider.
+ */
+declare class JobManager<State, InputSchema extends ZodLike | undefined> {
+    private readonly descriptor;
+    private readonly opts;
+    private readonly _activeJobs;
+    private readonly jobStore;
+    private readonly idleTimers;
+    private readonly cleanupTimers;
+    /** Per-job NOTIFY unsubscribe handles for the durable-status watch (internal-review). */
+    private readonly statusWatchers;
+    /** Job ids whose durable-status re-read is in flight — coalesces notify storms (internal-review). */
+    private readonly statusChecksInFlight;
+    /** Job ids that were notified mid-re-read and must be re-checked (internal-review). */
+    private readonly statusChecksQueued;
+    private readonly sessionId;
+    private nextJobId;
+    private accumulatorMonitor?;
+    private readonly staleJobTimeoutMs;
+    private readonly processingWatchdogMs;
+    private readonly reactivationClaimGraceMs;
+    /**
+     * Worker-heartbeat cadence (internal-review). Also floors the internal-review clock
+     * guard's compensation on the processing arm — see
+     * {@link staleSweepCompensationCapMs}.
+     */
+    private readonly heartbeatIntervalMs;
+    private readonly orphanDrawAgeMs;
+    private readonly terminalDrawReconcileAgeMs;
+    private staleSweepTimer?;
+    private heartbeatTimer?;
+    private orphanDrawSweepTimer?;
+    /** This manager holds {@link ORPHAN_SWEEP_CLAIMS} for its ledger. */
+    private orphanSweepClaimed;
+    /** Where a page-capped tick left off; cleared once a tick reaches the end. */
+    private orphanSweepResumeFrom?;
+    /**
+     * A `Date.now()` reading that cannot regress within this manager's lifetime
+     * (internal-review). Anchored at construction, so a manager already running when
+     * the clock stepped is covered. The stale-job sweep's two cutoffs, the
+     * orphan-draw age gate and the reactivation claim grace all read it; see
+     * {@link createMonotonicClock} for what it costs and where it is clamped.
+     */
+    private readonly monotonicNowMs;
+    private sweepInFlight;
+    private orphanSweepInFlight;
+    private heartbeatInFlight;
+    /**
+     * The denomination of every credit this DVM opens (internal-review). Resolved once,
+     * with the same boundary fallback `DVMServer` applies for direct JavaScript
+     * callers that force an incomplete value past the descriptor contract.
+     */
+    private readonly pricingCurrency;
+    constructor(descriptor: DVMDescriptor<State, InputSchema>, opts: JobManagerOpts);
+    /** Active in-memory jobs. */
+    get activeJobs(): Map<string, ServerJob>;
+    /** The backing job store. */
+    get store(): JobStore;
+    /**
+     * True when this DVM will actually issue receipts (internal-review) — a key *and*
+     * a store that can allocate sequence numbers and persist bytes write-once.
+     * `/v1/info#receipts` reads this rather than the key alone, so the flag can
+     * never promise something `issueReceipt` silently declines to do.
+     */
+    get receiptsEnabled(): boolean;
+    /** True when the named capability exists on this descriptor. */
+    hasCapability(name: string): boolean;
+    /** Names of every capability this descriptor exposes — used for error envelopes. */
+    capabilityNames(): string[];
+    /**
+     * Resolve a capability's static `price` to msats (internal-review).
+     *
+     * `"$X.XX"` is parsed as USD and converted via the SDK's shared fx fetcher.
+     * Returns `undefined` for dynamic-priced capabilities (those that declare
+     * `onQuote`) — the caller falls back to `computeDynamicPrice` in that path.
+     */
+    currentPriceMsats(capability: string): Promise<number | undefined>;
+    /**
+     * Translate a capability's static `price` into the fiat envelope used by
+     * the per-capability `pricing.max` advertised on `/v1/info` (internal-review).
+     * Returns `undefined` for dynamic-priced capabilities and for unknown
+     * names (the route handler validates the name before invoking this).
+     */
+    currentPricingMax(capability: string): {
+        amount: number;
+        currency: string;
+    } | undefined;
+    /**
+     * Parse a request body through a capability's input schema (internal-review).
+     *
+     * Resolution order when a capability declares an `input` schema:
+     * 1. `body.data` is preferred — agents pass structured fields directly
+     *    (CLI builds this from `--param k=v`).
+     * 2. Fallback: `JSON.parse(body.input)` for clients still on the legacy
+     *    JSON-string contract.
+     * 3. Neither usable → throw `MissingStructuredInputError` so the route can
+     *    return `invalid_input` with a hint pointing at `/v1/info`.
+     *
+     * When the capability has no `input` schema, returns `body.input` raw
+     * (primitive path).
+     *
+     * The internal-review credit envelope is removed before the schema runs, on both
+     * branches (internal-review) — it rides the signed body but is protocol-level, so a
+     * top-level `.strict()` capability schema would otherwise reject every
+     * explicit draw as an unknown key, before the envelope was even extracted.
+     * The persisted `record.input` the internal-review reactivation path re-reads is the
+     * pre-Zod wire form, so it comes through the second branch carrying them too.
+     */
+    parseInput(body: {
+        input?: string;
+        data?: unknown;
+    }, capability: string): unknown;
+    /**
+     * Look up the per-capability descriptor by name (internal-review). Throws when the
+     * name doesn't exist — the route layer validates body.capability first, so
+     * reaching this with an unknown name is a programmer error.
+     */
+    private requireCapability;
+    /**
+     * Soft capability lookup — `undefined` when the name isn't defined. The
+     * single place the `descriptor.capabilities` index cast lives; callers that
+     * tolerate a missing capability (the route layer pre-validates, or the cap
+     * was deleted from the descriptor after a job was persisted) route through
+     * here instead of re-casting inline.
+     */
+    private getCapability;
+    /**
+     * Allocate the id the next job will be created under (internal-review). The
+     * submit path calls this BEFORE payment verification so the ledger draw
+     * commits with its job linkage, then passes the id back through
+     * `createJob`'s provenance. Ids allocated for requests whose payment is
+     * refused are simply never used — the sequence has gaps, which nothing
+     * reads meaning into.
+     */
+    allocateJobId(): string;
+    /**
+     * Create a new job from a request body. `provenance` (internal-review) is what the
+     * idempotent-replay path on `POST /v1/job` reads back: the raw `job_token`
+     * to re-issue, and the fingerprint + caller pubkey a retry must reproduce
+     * to be given it.
+     */
+    createJob(body: {
+        input: string;
+        params?: Record<string, string>;
+    }, requesterId: string, payment: PaymentInfo, requiredMsats: number | undefined, capability: string, requesterTokenHash?: string, provenance?: {
+        requesterToken?: string;
+        requestFingerprint?: string;
+        requesterPubkey?: string;
+        requestId?: string;
+        authRequestPath?: string;
+        /**
+         * Pre-allocated id from {@link allocateJobId} (internal-review) — the submit
+         * path allocates before payment verification so the ledger draw can
+         * record the job it pays for.
+         */
+        jobId?: string;
+    }): ServerJob;
+    /** Build an SDKJobContext and attach it to the job. */
+    buildAndAttachContext(job: ServerJob, parsedInput: unknown): SDKJobContext<State, ResolvedInput<InputSchema>>;
+    /** Start the handler for a job. */
+    runHandler(job: ServerJob, sdkCtx: SDKJobContext<unknown, unknown>): void;
+    /** Dispatch a validated incoming message to the appropriate handler or pending resolver. */
+    dispatchMessage(job: ServerJob, type: MessageType, content: unknown): Promise<void>;
+    /**
+     * Persist a job to the backing store.
+     *
+     * Awaits the per-job appender tail (internal-review) so that:
+     *   1. The snapshot's `messages` is consistent with the `job_messages` table
+     *      — no row is still in flight at snapshot time.
+     *   2. For terminal saves, the `DELETE FROM job_messages` inside `save()`
+     *      can't race a still-pending `appendOutgoing` for the final yield
+     *      message (which would otherwise wipe the row before an in-flight SSE
+     *      subscriber's NOTIFY-driven fetch can see it).
+     */
+    persistJob(job: ServerJob): Promise<void>;
+    /**
+     * Cross-machine terminal guard (internal-review). `buildContext`'s guard reads the
+     * in-memory `job.status`, so on its own it only protects the machine running
+     * the handler. On a multi-machine DVM a `DELETE /v1/job/:id` routinely lands
+     * on a machine that isn't running the job — `app.ts` cancels it in the store
+     * and this process learns of it only through the durable row.
+     *
+     * Adopting the durable status blocks the rest of the handler's writes via the
+     * local guard, makes `handleJobTerminal` see a non-completed job so it skips
+     * the revenue report, rejects a suspended handler's prompt/payment yields, and
+     * fires `job.abort` so in-flight `ctx.fetch` calls tear down. Returns true when
+     * the durable state won and the caller must skip its save.
+     *
+     * Two triggers: `watchDurableStatus`'s NOTIFY subscription (internal-review) fires
+     * this within a round-trip of the remote cancel committing, which is what
+     * actually stops the provider spend; `persistJob` calls it again on every save
+     * as the backstop for the window where a cancel commits between a handler's
+     * read and its write (the check-then-write it can still lose is covered by the
+     * stores' terminal-sticky `save`, which keeps the row itself correct).
+     */
+    private adoptDurableTerminal;
+    /**
+     * Watch the durable status of a locally-active job (internal-review).
+     *
+     * `ctx.signal` is raised by `dispatchMessage`, which only runs on the machine
+     * holding the job in `activeJobs`. On a multi-machine DVM the `DELETE` usually
+     * lands somewhere else, and that machine's store-only cancel (`cancelJob`)
+     * commits the terminal status, appends the `cancel` message, and `pg_notify`s
+     * in one transaction. This subscription is how the handler's machine hears it:
+     * on each notify, re-read the durable status and adopt it if it went terminal.
+     * Without it, the handler only notices at its next store write, and the
+     * in-flight provider call — the spend the cancel was meant to stop — runs to
+     * completion.
+     *
+     * Every locally-emitted message notifies this machine too, so the re-read is
+     * coalesced: at most one `getCounters` in flight per job, and none once the
+     * job is locally terminal.
+     */
+    private watchDurableStatus;
+    /**
+     * Tear down a job's durable-status subscription (internal-review). Must be called
+     * wherever a job leaves `activeJobs` — a leaked subscriber outlives the job on
+     * the store's shared LISTEN connection. Idempotent.
+     */
+    unwatchDurableStatus(jobId: string): void;
+    /**
+     * NOTIFY-driven durable-status re-read, coalesced per job (internal-review).
+     *
+     * A notify that arrives while a re-read is in flight is queued rather than
+     * dropped: the in-flight read may have observed the row a moment *before* the
+     * cancel committed, and dropping its notify would put the abort back where
+     * this issue found it — waiting for the handler's next store write.
+     */
+    private checkDurableTerminal;
+    /**
+     * Wire the Tx A appender when the store supports streaming.
+     *
+     * Tx A (internal-review): outgoing message + `pending_payment_msats` bump land in
+     * the same transaction. The DB allocates the row's seq via
+     * `UPDATE jobs SET next_seq = next_seq + 1 RETURNING` so concurrent inbound
+     * traffic on different machines can never collide on the `(job_id, seq)` PK.
+     * In-memory `job.seq` keeps its own counter for same-machine SSE listeners.
+     *
+     * Per-job serialisation (internal-review): chained through `job.messageAppenderTail`
+     * so two synchronous `providerMessage` calls (e.g. `artifact` followed by
+     * `complete`) commit their `appendOutgoing` transactions in call order.
+     * Without this, the two transactions race for the `jobs` row lock and the
+     * DB-side seq can be allocated in the opposite order — which both renumbers
+     * the persisted messages and reorders the NOTIFY events feeding the
+     * cross-machine SSE subscriber. The subscriber closes the stream on the
+     * first yield message it sees, so a NOTIFY for `complete` arriving before
+     * `artifact`'s NOTIFY silently drops the artifact.
+     */
+    private wireMessageAppender;
+    /** Start (or restart) the idle timer for a job. */
+    startIdleTimer(job: ServerJob): void;
+    /** Clear the idle timer for a job. */
+    clearIdleTimer(id: string): void;
+    /** Cancel a job due to idle timeout. Exposed for the reactivation path's idle-expiry guard (internal-review). */
+    cancelJobIdle(job: ServerJob): Promise<void>;
+    /**
+     * Force-terminate stale non-terminal jobs. Two status-aware arms:
+     *   • `awaiting-input` past `staleJobTimeoutMs` → `cancelled`
+     *     (`stale_no_terminal_status`) — the caller never paid / responded.
+     *   • `processing`/`working` past `processingWatchdogMs` → `failed`
+     *     (`worker_died_mid_job`) — the worker died mid-job. The heartbeat keeps
+     *     live workers fresh, so a stale row here means a dead process.
+     *
+     * Fires on a timer (wired in the constructor) and also callable on demand
+     * (tests, ops). The CAS in `cancelStaleJob` makes this safe to run
+     * concurrently from multiple DVM machines. Scoped to capabilities this
+     * JobManager owns so multi-mount hosts don't steal stuck rows from sibling
+     * descriptors — the local activeJobs teardown only makes sense on the
+     * JobManager that actually hosted the zombie handler.
+     *
+     * **Both cutoffs float off the wall clock (internal-review).** Each is one
+     * `Date.now()` sample compared against `last_activity_at`, stamped from a
+     * different sample at a different moment, so a backwards step between the
+     * two makes every row look more recently active than it is: the query
+     * matches nothing and both arms go silent for the length of the skew. The
+     * dead worker's job keeps its `processing` status, its credit hold stays
+     * `pending`, and the internal-review paid-job-death alert — wired to this reaper —
+     * never fires. Same defect, same host class, as internal-review's orphan sweep.
+     *
+     * **The compensation is capped** — see {@link staleSweepCompensationCapMs}
+     * for where each arm's cap comes from — which internal-review did not need to do. Its eagerness costs at worst an early release
+     * of an unclaimed hold, refused outright for any live job row; ours
+     * force-*fails* a running job. `cancelStaleJob`'s CAS does not cover that:
+     * `expectedActivityBefore` is the same compensated threshold the query used,
+     * and a live worker's post-step heartbeat writes the low, post-step
+     * `Date.now()`, so `last_activity_at <= expectedActivityBefore` still holds.
+     * The CAS guards a job checking in *between* the find and the claim with a
+     * stamp above the cutoff — a race, not a clock.
+     *
+     * **Some blindness is inherent, and no cap choice removes it.** A backwards
+     * step of `S` inverts the stamp ordering: everything stamped after it reads
+     * `S` older than everything stamped before. A live worker heartbeating right
+     * now stamps `wall - S`; a job genuinely idle for `age` stamps `wall - age`.
+     * The stale row is the lower of the two — the one a cutoff reaches first —
+     * only once `age` exceeds `S`. Below that the reaper cannot tell them apart,
+     * so any cutoff that claimed the stale job would force-fail every live
+     * worker on the host with it. The cap picks where on that curve to sit: on
+     * the defaults a row must have been silent for `S + window / 2`, and a live
+     * worker keeps five missed heartbeats of margin. The
+     * alternative to a missed reap is mild and self-healing — the orphan sweep
+     * backstops the hold, and the arm recovers when the wall catches up. The
+     * alternative to a false reap is an irreversible force-fail of paid work.
+     *
+     * The stamps themselves stay wall-clock epoch-ms on purpose — they are
+     * written by whichever machine touched the job and read by every other one,
+     * so only the reading side can float.
+     */
+    sweepStaleJobs(): Promise<{
+        swept: number;
+    }>;
+    /**
+     * How far one watchdog arm may lean on {@link monotonicNowMs} past the wall
+     * clock to cover a backwards step (internal-review). The compensation is capped,
+     * not free: a claimed row must still have been silent for
+     * `windowMs - cap`, and unlike the orphan sweep, claiming eagerly here
+     * force-fails a job that may well be alive.
+     *
+     * **Half the window** is the floor that governs a wide window — five missed
+     * heartbeats on the processing defaults. On the `awaiting-input` arm it also
+     * preserves a real invariant: with the derived
+     * `2 x idleTimeout + headroom`, half is `idleTimeout + 45s`, so the sweeper
+     * still cannot fire before the in-process idle timer would have. (A builder
+     * who overrides `staleJobTimeoutMs` below `2 x idleTimeout` has already
+     * opted out of that, guard or no guard.)
+     *
+     * **Two heartbeat intervals** is the floor that governs a window configured
+     * close to the beat cadence — `processingWatchdog: 40` against the 30s
+     * default beat, where half the window is less than one beat and a worker
+     * heartbeating exactly on schedule would be reaped the moment the host's
+     * clock stepped. That pair is marginal already; the guard must not make it
+     * deterministic. The cap collapses to zero there, which is today's
+     * behaviour: late, never wrong. The `awaiting-input` arm takes no such term
+     * — nothing heartbeats it by design, and its refresh is an inbound caller
+     * message on no cadence at all.
+     *
+     * **Why a magnitude and not a predicate.** The tempting sharper rule is to
+     * compensate per row, fully, for any stamp that reads ahead of our wall —
+     * one our own post-step heartbeat could not have written. It is unsafe: a
+     * future-stamped row is equally what a live job heartbeated by a peer whose
+     * clock runs fast looks like, and from the stamp alone the two are
+     * indistinguishable. The same reasoning bounds the cap from the other side —
+     * while our clock is stepped, the guard force-fails the live jobs of any
+     * peer slower than `windowMs - cap`, which is 2.5 minutes of tolerated
+     * disagreement on the defaults, far outside anything NTP-managed hosts show.
+     */
+    private staleSweepCompensationCapMs;
+    /**
+     * Resolve `pending` credit draws the terminal funnel can no longer reach.
+     * Two arms over one scan, distinguished by whether the draw's job row exists.
+     *
+     * **No job row (internal-review) — release.** internal-review allocates the job id and
+     * commits the ledger draw, with its `job_id` linkage, before `recordReplay`
+     * and `persistJob` write the job row. A crash, a `draw_conflict` 409, or a
+     * fail-closed `replay_detected` 401 in that window leaves a committed hold
+     * that **no** terminal path can ever reach: `issueReceipt` →
+     * `resolveCreditDraw` keys off the `creditId`/`drawId` persisted on the job
+     * row, so with no row there is no release path at all and the caller's
+     * available balance stays reduced forever. Cosmetic for an implicit N=1
+     * credit, a silent balance shrink for an explicit N>1 one.
+     *
+     * **Terminal job row (internal-review) — reconcile to its outcome.** The funnel
+     * demonstrably fails: `resolveCreditDraw` throws on a ledger/DB error,
+     * `issueReceipt` catches it, logs `credit_resolve_failed` and returns
+     * nothing, and until now nothing retried. Same stranded hold, reached through
+     * a different door — and for a `completed` job it strands the platform's
+     * books too, since draws *are* the revenue events (internal-review): the caller is
+     * charged nothing, the balance never moves, and outstanding liability
+     * (`deposits − draw revenue`) overstates forever. So a late settle books, off
+     * the committed draw row, through the ordinary reporter path.
+     *
+     * **A non-terminal job row is still never touched** — the stale-job sweep
+     * above drives those to terminal first, and its `issueReceiptForStoredJob`
+     * resolves the draw on the way. Those skipped holds are why the scan
+     * keyset-paginates rather than re-reading one batch: they stay `pending`
+     * indefinitely (an `awaiting-input` job on a 30-minute idle timeout sits well
+     * past the orphan cutoff), so a fixed first page of them would starve every
+     * real orphan behind it, on every tick, forever. The cursor advances over
+     * every row examined; a tick that hits {@link ORPHAN_DRAW_SWEEP_MAX_PAGES}
+     * logs `orphan_draw_sweep_truncated` and the next one resumes where it
+     * stopped, so progress is bounded per tick but never blocked.
+     *
+     * Fires on a timer (wired in the constructor) and also callable on demand
+     * (tests, ops). Both `settle` and `release` are idempotent under the credit
+     * row's `FOR UPDATE`, so concurrent sweepers on several machines — and a
+     * sweeper racing the in-line funnel — resolve the hold exactly once; the
+     * losers see `replayed: true` and book nothing.
+     */
+    sweepOrphanDraws(): Promise<{
+        released: number;
+        reconciled: number;
+    }>;
+    /**
+     * The end-of-scan line for a tick that resolved nothing (internal-review, extended
+     * by internal-review). Two shapes are worth a warning, and neither is the ordinary
+     * one — the timer runs every 5 minutes per ledger in production.
+     *
+     * `examined > 0`: aged candidates were looked at and none moved. Usually
+     * legitimate (their jobs are still running, or terminal inside the reconcile
+     * grace period), but it is also what a silently skipped hold looks like.
+     *
+     * `examined === 0`: the query returned nothing. Ordinarily that means there
+     * is nothing to do — but it is equally what a blinded scan looks like, which
+     * is the case the internal-review gate could not reach. Probe for the oldest
+     * `pending` hold at any age and speak up when one exists the scan should
+     * have seen and didn't: already past the age gate outright, stamped ahead of
+     * our clock (some other process's clock is fast), or hidden while our own
+     * clock is held forward over a backwards step. A ledger holding nothing but
+     * young draws stays quiet.
+     *
+     * The probe is diagnostics, so it is wrapped: a tick that swept cleanly must
+     * never report failure because the extra read fell over. A probe that throws
+     * says so on the same line rather than replacing the tick's outcome.
+     */
+    private reportSweepOutcome;
+    /**
+     * Resolve one aged `pending` draw whose job row reached terminal (internal-review),
+     * mirroring what `resolveCreditDraw` would have done in line. Returns true
+     * when this call is the one that moved the draw — the caller counts it, and
+     * only it books.
+     *
+     * **The settle is gated on the job row naming _this_ draw.** The scan finds
+     * the draw by `credit_draws.job_id`, but the job's own `credit_id`/`draw_id`
+     * are written by a *later* transaction than the one that committed the draw
+     * (`verifyIncomingPayment` commits fund+draw; `verifyAndCredit` binds the
+     * row), and a free-then-paid job binds set-if-null. A store failure or a
+     * second concurrent top-up therefore leaves a hold tagged with the job whose
+     * row points somewhere else, or nowhere. Settling that would debit the caller
+     * a second time for one job — and invisibly, since `revenue_events`'
+     * `UNIQUE (dvm_id, job_id, rail)` would drop the booking. So an unbound hold
+     * is **released**, never settled: the job's payment was the draw it is bound
+     * to, and this one bought nothing.
+     *
+     * Concurrency needs no guard of its own. `settle`/`release` run under the
+     * credit row's `FOR UPDATE`, so exactly one caller — a sibling reconciler,
+     * or the in-line funnel arriving late — sees `replayed: false`, which makes
+     * the booking gate a true mutex rather than a hopeful one. The one race left
+     * open is another machine's `handleJobTerminal` stalled between resolving the
+     * draw and booking it, which would double-report; the platform's
+     * `(dvm_id, credit_id, draw_id)` and `(dvm_id, job_id, rail)` unique indexes
+     * absorb that.
+     *
+     * `invalid_draw_state` — the funnel having already resolved the draw to the
+     * other state — is the expected loss, logged and swallowed like the orphan
+     * arm's, so one contended hold can't strand the rest of the batch.
+     */
+    private reconcileTerminalDraw;
+    /**
+     * Refresh `lastActivityAt` for jobs this process is actively running
+     * (`processing`/`working`) so the processing watchdog only fires once the
+     * worker is genuinely dead (internal-review). `awaiting-input` jobs are
+     * deliberately excluded — their idle timeout must still elapse. Fires on the
+     * heartbeat timer; also callable on demand for tests.
+     */
+    heartbeatActiveJobs(): Promise<{
+        beat: number;
+    }>;
+    /**
+     * Single-execution claim for a reactivating machine (internal-review). Before
+     * replaying an `awaiting-input` job, wait a bounded grace window for a live
+     * original handler to win the `awaiting-input → processing` CAS via its
+     * NOTIFY wake. Resolves:
+     *   • `false` — the row left `awaiting-input` during the window (the original
+     *     handler claimed it / drove it terminal). Stand down; do not replay.
+     *   • `true`  — the window elapsed still `awaiting-input` (the original worker
+     *     is gone or has no live resolver) AND this machine won the claim CAS.
+     *     Replay for dead-worker recovery.
+     *
+     * Biasing the original handler to win kills the double execution (double
+     * substrate spend, clobbered artifact) without heartbeating `awaiting-input`
+     * (which would break the caller-input idle timeout). Non-streamable stores
+     * have no cross-machine race, so the claim is a no-op `true`.
+     */
+    claimAwaitingInputForReactivation(jobId: string): Promise<boolean>;
+    /**
+     * Record an inbound client message durably via Tx B (internal-review) and append
+     * it to the in-memory `job.messages` array. Returns the DB-allocated seq
+     * (`null` when the store isn't streamable — non-Postgres test fallback).
+     *
+     * Status starts as `pending-verification`; a follow-up Tx C call
+     * (`processPayment` for payments, `markInboundVerified` for everything
+     * else) transitions it to `verified` once the inbound is accepted.
+     */
+    recordInboundPending(job: ServerJob, msgType: MessageType, msgContent: Record<string, unknown>): Promise<number | null>;
+    /**
+     * Tx C complement for non-payment inbound messages — flip the row to
+     * `verified` so cross-machine readers see it via `subscribeMessages`.
+     */
+    markInboundVerified(jobId: string, inboundSeq: number | null): Promise<void>;
+    /**
+     * Reactivate a suspended/event-driven job from the store. Builds the
+     * in-memory `ServerJob`, wires the appender, builds the context, starts
+     * the idle timer. The caller has already recorded the inbound via Tx B
+     * and run Tx C (verify + credit); reactivation is now decoupled from
+     * credit (internal-review, internal-review). The caller decides whether to run the
+     * handler (Pattern A: status was `awaiting-input`) or to dispatch the
+     * message to a custom handler (Pattern B).
+     *
+     * For DVMs that declare descriptor-level auth, the persisted
+     * `record.input` carries the original signed envelope. We re-verify the
+     * signature here (internal-review) so a DB-layer tamper — compromised admin, SQL
+     * injection, malicious operator with DB access — can't silently feed an
+     * attacker-supplied pubkey/envelope into the handler. The drift window
+     * and replay store are deliberately skipped: the persisted timestamp is
+     * from the original signing instant (long past the 5-min drift bound for
+     * any long-running job), and the nonce was already committed at submission.
+     * On failure: throws `SignedRequestError` ({@link AuthSchemaError} when
+     * the capability has no input schema to verify against); the caller is
+     * expected to mark the row failed and surface a 401 / 500 to the inbound
+     * caller.
+     *
+     * What gets re-verified is the persisted row read back through
+     * {@link signedRequestInput} — `app.ts` stores the pre-Zod wire form, so
+     * those are the caller's own signed bytes, the same ones `/v1/quote` and the
+     * submit checked (internal-review). That makes the tamper check strictly stronger
+     * than the parsed form it replaced: an injected key the capability schema
+     * doesn't declare used to be stripped before the signature was checked, so
+     * it re-verified clean.
+     */
+    reactivateJob(record: JobRecord): {
+        job: ServerJob;
+        sdkCtx: SDKJobContext<unknown, unknown>;
+    };
+    /**
+     * Verify an inbound payment and apply the credit via Tx C (internal-review).
+     * The inbound message must have been recorded via Tx B already
+     * (`recordInboundPending` returned `inboundSeq`). For non-streamable
+     * stores (`inboundSeq === null`), falls back to in-memory mutation via
+     * `applyPaymentInfoToJob`.
+     *
+     * Dev-mode short-circuit: auto-credits the outstanding
+     * `pendingPaymentMsats` without external verification. Gated on
+     * `devModeSkipsPaymentVerification` — the same predicate the upfront path
+     * reads, so a dev server wired to a mint verifies mid-job payments for real
+     * (internal-review) — plus the explicit `dev_auto` opt-out the dev console uses,
+     * which is the one caller that has no wallet to pay from. `dev_auto` loses to
+     * any proof riding the same message: money on the wire always takes the rail,
+     * so the flag can never leave a real token unspent against a credited job.
+     *
+     * Tx C is not atomic with the rail commit (internal-review). `verifyIncomingPayment`
+     * commits the proofs *and* the ledger leg in one transaction and returns;
+     * only then does `verifyAndCredit` write the job row, on its own connection.
+     * Everything after that call therefore runs with the caller's money already
+     * moved, which is why the write is retried rather than left to throw, and why
+     * an exhausted retry answers with the credit it landed on instead of a bare
+     * 500. See `creditInbound`.
+     */
+    processPayment(job: ServerJob, body: {
+        type: MessageType;
+        content: Record<string, unknown>;
+    }, inboundSeq: number | null, extra?: {
+        lockPubkeys?: LockPubkey[];
+        mintHealthTracker?: MintHealthTracker;
+    }): Promise<ProcessPaymentOutcome>;
+    /**
+     * Tx C with a bounded retry (internal-review).
+     *
+     * By the time this runs on the verified path, the rail commit and the ledger
+     * leg have already committed in a transaction this call is not part of — so a
+     * throw here is money moved against a job row that records none of it, and
+     * letting it propagate was the bug. A transient store error is the ordinary
+     * cause and a second attempt clears it.
+     *
+     * The retry is safe by construction, not by convention: `verifyAndCredit`
+     * CASes on `job_messages.status = 'pending-verification'` inside its own
+     * transaction, so a call whose COMMIT actually landed before the ack was lost
+     * finds the row already `verified` and returns `alreadyVerified: true`
+     * carrying the counters and binding that first attempt committed. Re-applying
+     * the delta is impossible either way.
+     *
+     * That argument covers every attempt but the last, whose error nothing
+     * re-checks — and a connection-level fault is exactly the shape that loses
+     * the ack on *all* of them, idempotent replays included (the no-op path
+     * COMMITs too). So the exhausted path asks the row before reporting a
+     * failure: `getVerifiedInbound` reads, transaction-free, whether a Tx C for
+     * this seq committed. Without it a fully credited, fully bound job answers
+     * `payment_unapplied` and invites a retry, and a caller who takes it pays
+     * twice for one ask — the second payment growing the now-bound draw and
+     * settling as revenue.
+     *
+     * The read runs on the pool that just failed those COMMITs, so it is retried
+     * too, and a read that fails all the way through is reported as *unknown*
+     * rather than as nothing: `CreditInboundExhaustedError.readError` is what
+     * separates "checked the row, nothing landed" from "couldn't check", both on
+     * the operator's log line and in the copy the caller acts on.
+     */
+    private creditInbound;
+    /**
+     * Answer a payment whose rail and ledger legs committed but whose job row
+     * could not be written (internal-review) — every retry spent, the money real.
+     *
+     * The refusal names the credit the money landed on so the caller can act on
+     * it directly, mirroring the short mid-job pay's 402 (`payment.ts`). It is a
+     * 500 rather than a 402 on purpose: the payment was valid and was accepted,
+     * so telling the caller it was insufficient would be a lie, and this is a
+     * fault an operator should see in their 5xx rate. `retryable` is true because
+     * the ask is genuinely still outstanding.
+     *
+     * Nothing is released here. The hold is left to the internal-review reconciler,
+     * which makes the same decision — unbound draw ⇒ release, never settle — but
+     * under the credit row's `FOR UPDATE`, after the job is terminal, where it
+     * cannot race an in-flight COMMIT. Releasing from here would also be
+     * irreversible: a released draw can be neither re-grown nor re-opened, so one
+     * bad call would silently de-ledger every later top-up on the job.
+     *
+     * Whether the row was *read* is load-bearing on both surfaces. When the
+     * post-exhaustion read-back failed as well, `credit_job_row_unwritten` says so
+     * (`row_checked: false` plus the read's own error) instead of implying an
+     * operator can trust the row is clean, and the caller gets the `"unconfirmed"`
+     * copy rather than a flat "pay it again" it could be charged twice for.
+     *
+     * That copy overrides `display` as well as `hint`, on every branch including
+     * the ledger-less one. `display` is the sentence an agent relays to its human
+     * (repo convention: JSON carries the words, not just the facts), so a body
+     * whose `hint` says the outcome is unknown while its `display` still asserts
+     * the ask is outstanding is read as "pay again" by the audience that acts on
+     * it — and a payment that did land is charged on top.
+     */
+    private reportUnappliedPayment;
+    /**
+     * Describe a deposit the job row never took, in the shape both the 201 and
+     * the `payment_unapplied` 500 carry (internal-review). `undefined` when the payment
+     * ran ledger-less (no credit ledger wired, or the top-up preflight skipped) —
+     * there is no credit to name, so the 201 carries no `credit` block and the
+     * 500 takes its words from `unappliedCopy` directly.
+     */
+    private unappliedCredit;
+    /** Book a mid-job top-up's funding as a deposit (internal-review, spec §10). */
+    private reportCreditDeposit;
+    /**
+     * Internal: build the BuildContextOpts shared between `createJob` and
+     * `reactivateJob`. Centralised so persistence/terminal callbacks and the
+     * internal-review NOTIFY-driven cross-machine wake stay in one place.
+     */
+    private buildContextOpts;
+    /**
+     * Internal: what unit `ctx.requestPayment`'s auto-credit gate may measure this
+     * job's remaining pool in (internal-review).
+     *
+     * The regime is read off the DRAW, never off the job. Implicit N=1 is exactly
+     * `credit_id === imp:<rail>:<draw_id>`, because `fundAndDraw` derives both
+     * from the same rail payment id — a fact about a row that was written once
+     * and never moves. The tempting alternative, comparing `job.payment_tx_hash`
+     * against `drawSettlementRef` (what the mid-job preflight does to inherit
+     * `drawBasis`), silently rots: Tx C overwrites that column on every mid-job
+     * credit, and a payment whose ledger leg was skipped — a cross-rail top-up,
+     * an fx outage, a draw already resolved — leaves the rail's own reference
+     * there, so an explicit-draw job would read as implicit from then on.
+     *
+     * Never throws, and never answers `rail` on a guess. `rail` is claimed only
+     * where `withDrawBasis` demonstrably left `PaymentInfo.paidMsats` alone — no
+     * draw at all, or a draw carrying no rail value to overlay it with. A job that
+     * drew and whose pool this can't read or denominate answers `unpriced`, which
+     * the gate declines to auto-credit from: the msat figure it would otherwise
+     * fall back on is a slice of the credit's rail value at a ratio pinned
+     * whenever that credit was funded, which is the exact figure this issue exists
+     * to stop spending against.
+     */
+    private resolveDrawPool;
+    /** Internal: structured warn for the one path that can't price a drawn job's pool. */
+    private warnDrawPool;
+    /**
+     * Issue the signed receipt for a job that has reached a terminal status
+     * (internal-review). Idempotent and safe to call from every terminal path — the
+     * store owns both the sequence allocation and the write-once persist, so
+     * two machines racing on the same job converge on identical bytes and burn
+     * exactly one sequence number.
+     *
+     * Never throws. A receipt is evidence about a job, not part of delivering
+     * it: if signing or persistence fails we log structured and serve the
+     * response without one (same posture as the `cashu_refund_failed` branch in
+     * `context.ts`). The gap is visible to callers — the `seq` series skips a
+     * number — which is precisely the completeness signal receipts exist for.
+     */
+    issueReceipt(record: JobRecord): Promise<JobReceipt | undefined>;
+    /** Build the common settle/release args, adding the hosted release outbox when wired. */
+    private drawResolutionArgs;
+    /**
+     * Settle or release a terminal job's credit draw (internal-review): `completed`
+     * settles (the hold becomes a real debit); `failed`/`cancelled` releases
+     * (the hold evaporates — "no debit on job failure", mechanically
+     * superseding the internal-review/974 no-op refund for credit-paid jobs, including
+     * the `ctx.fail` path and the stale-sweeper reap). Idempotent — a replayed
+     * resolution returns the recorded state. Returns the `ReceiptCredit` block
+     * for the receipt: `balance_after` is the recorded draw trajectory for a
+     * settled draw, and the restored available balance for a released one.
+     */
+    private resolveCreditDraw;
+    /**
+     * The one place a terminal job's status becomes a ledger verb (internal-review):
+     * `completed` settles the hold into a real debit, `failed`/`cancelled`
+     * release it. Read by the in-line funnel (`resolveCreditDraw`) and by the
+     * late reconciler (`reconcileTerminalDraw`) — two paths that must never
+     * disagree about what an outcome means for the caller's money.
+     */
+    private settlesDraw;
+    /**
+     * Sign a locally-held terminal job's receipt and mirror it onto the
+     * in-memory job, so the read paths served out of `activeJobs` during the
+     * cleanup window hand back the same bytes as a cross-machine re-read.
+     */
+    private attachReceipt;
+    /**
+     * Read-path repair for a terminal job carrying no receipt (internal-review), for
+     * either an in-memory job or a store record. Free in the steady state — it
+     * returns on the `receipt` check without touching the store — so it costs
+     * only on the cases it exists for:
+     *
+     * - **A crash between the two store calls.** `claimReceiptSeq` commits the
+     *   sequence number to the job row before `saveReceipt` writes the bytes; a
+     *   process death in that window would otherwise strand that number
+     *   forever, and a permanent gap is indistinguishable from the deliberate
+     *   suppression `seq` exists to expose. Re-issuing here reuses the already
+     *   committed number (the claim is idempotent per job) rather than
+     *   allocating a second one.
+     * - **A transient store failure** at the terminal: `issueReceipt` logs
+     *   `receipt_issue_failed` and returns nothing rather than failing the job,
+     *   so the next read retries.
+     * - **Jobs that terminated before the DVM had a receipt key.** They pick one
+     *   up on first read, with `issued_at` reflecting when it was signed.
+     */
+    ensureReceipt(target: ServerJob | JobRecord): Promise<void>;
+    /**
+     * Close out a terminal job whose caller hasn't already persisted it: sign
+     * the receipt, then save the snapshot. The snapshot save never writes the
+     * receipt column, so ordering only affects how soon a reader sees the
+     * receipt — this way a caller polling immediately after the terminal
+     * already finds it.
+     */
+    private finalizeTerminal;
+    /**
+     * Issue a receipt for a job this process doesn't hold in `activeJobs` — a
+     * cross-machine cancel, or a row the stale sweeper just reaped. Re-reads the
+     * record so the receipt is built from the committed terminal row rather than
+     * from whatever the caller happened to have in hand.
+     */
+    issueReceiptForStoredJob(jobId: string): Promise<JobReceipt | undefined>;
+    /** Handle job reaching terminal state (completed, failed, cancelled). */
+    private handleJobTerminal;
+    /**
+     * Report a completed paid job's revenue (internal-review, re-keyed by internal-review).
+     * Fire-and-forget — the `RevenueReporter` owns persistence and retry.
+     *
+     * For a **credit-backed** job the revenue event is the *settled draw* (spec
+     * §10), and since internal-review the sats figure corrects the job's mirror of that
+     * draw against the draw itself: `withDrawBasis` stamps the job when the
+     * payment lands, but a Bitcoin credit's settle re-prices the draw against
+     * the funding lots it consumed. The correction is a delta, because a job's
+     * counter can carry legs no draw ever absorbed — except where the draw's
+     * forecast was zero and the counter therefore never held a component to
+     * correct. The event is dated at settlement rather than at report time. A
+     * released draw — the failed/cancelled path — is deliberately unreachable
+     * here, which is what makes "no debit on job failure" true in the books as
+     * well as the ledger.
+     *
+     * For everything else (free-then-paid jobs, isolate-shaped flows, a DVM
+     * whose price couldn't be fiat-denominated) nothing changes: the pre-credits
+     * payload is reported verbatim.
+     *
+     * Takes the fields rather than a `ServerJob` so the internal-review reconciler — a
+     * background sweep that holds no in-process job — books through this exact
+     * path off the row it read. `paymentTxHash` is passed **verbatim**, never
+     * recomputed as a `drawSettlementRef`: it is the same column the in-line
+     * funnel reads, so the two bookings are byte-identical by construction and
+     * the platform's `UNIQUE (rail, tx_hash)` dedupes them. Deriving it instead
+     * would diverge on an implicit N=1 job (whose row carries the rail's own
+     * reference) and on any job whose column a mid-job top-up overwrote — the
+     * same rot `resolveDrawPool` documents as the reason not to read regime off
+     * this column.
+     *
+     * Returns whether the report was handed to `onJobCompleted`, so a caller
+     * that logs the booking says what actually happened rather than what it
+     * assumed — the guards below still drop legitimate shapes (a free job, a
+     * DVM with no reporter). Every drop that costs a booking logs first.
+     *
+     * The rail check sits **below** the draw re-read, not in the entry guard
+     * (internal-review): a settled draw the terminal can't report under is a real debit
+     * with no revenue event, permanently overstating outstanding liability
+     * (`deposits − draw revenue`), and it used to return here in silence. Placed
+     * after the re-read, `revenue_skipped_no_rail` can name the draw and its
+     * amount, and can distinguish the four causes — see its `reason` below.
+     */
+    private bookRevenue;
+    /** Schedule job removal from activeJobs after a delay so clients can still poll final status. */
+    scheduleCleanup(job: ServerJob): void;
+    /** Clear all timers. Called on server shutdown to allow clean exit. */
+    shutdown(): void;
+}
+
+/** A configured Tempo operator fee-token balance reading. */
+interface TempoSettlementBalanceObservation {
+    address: `0x${string}`;
+    network: string;
+    token: `0x${string}`;
+    balanceMicro: bigint;
+    lowBalanceMicro: bigint;
+    checkedAt: number;
+    /** Whether balance and any fee-rejection latch both permit new sessions. */
+    ready: boolean;
+}
+/** A redacted operator-funded transaction rejection. */
+interface TempoSettlementFailureObservation {
+    address: `0x${string}`;
+    network: string;
+    token: `0x${string}`;
+    operation: "settle" | "close";
+    errorClass: "InsufficientFundsError";
+    checkedAt: number;
+    balanceMicro?: bigint;
+    channelId?: string;
+    creditId?: string;
+    drainId?: string;
+}
+/** Listener for platform reporting and builder-supplied observability. */
+interface TempoSettlementReadinessListener {
+    onBalance?(observation: TempoSettlementBalanceObservation): Promise<void> | undefined;
+    onFailure?(observation: TempoSettlementFailureObservation): Promise<void> | undefined;
+}
+/** Fleet-wide persisted state for one DVM/operator/token readiness epoch. */
+interface TempoSettlementFailureState {
+    latched: boolean;
+    version?: string;
+    balanceMicro?: bigint;
+}
+/** Durable latch operations shared by every Machine serving a hosted DVM. */
+interface TempoSettlementReadinessStateStore {
+    readFailure(): Promise<TempoSettlementFailureState>;
+    latchFailure(): Promise<TempoSettlementFailureState>;
+    captureFailureBalance(version: string, balanceMicro: bigint): Promise<boolean>;
+    clearFailureIfRefilled(version: string, balanceMicro: bigint, lowBalanceMicro: bigint): Promise<boolean>;
+    clearFailureAfterSuccessfulTransaction(version: string): Promise<boolean>;
+}
+/** Construction inputs for {@link TempoSettlementReadiness}. */
+interface TempoSettlementReadinessOptions {
+    address: `0x${string}`;
+    network: string;
+    token: `0x${string}`;
+    lowBalanceMicro?: bigint;
+    balanceCheckIntervalMs?: number;
+    readBalance(): Promise<bigint>;
+    stateStore?: TempoSettlementReadinessStateStore;
+    now?: () => number;
+}
+/**
+ * Readiness gate for the account that funds Tempo session settlement.
+ *
+ * The timer is deliberately unref'd: it reports only while the Fly Machine is
+ * awake and can never keep one awake or cause an external wake. An explicit
+ * fee rejection is stronger evidence than a balance reading, so hosted DVMs
+ * persist that latch in their shared database until a later successful operator
+ * transaction or an observed refill clears it for every Machine.
+ */
+declare class TempoSettlementReadiness {
+    private readonly opts;
+    private readonly lowBalanceMicro;
+    private readonly intervalMs;
+    private readonly now;
+    private readonly listeners;
+    private timer;
+    private inFlight;
+    private lastBalanceMicro;
+    private failureBalanceMicro;
+    private failureVersion;
+    private failureLatched;
+    private failureStateKnown;
+    private localFailureGeneration;
+    private pendingFailureGeneration;
+    private failurePersistence;
+    constructor(opts: TempoSettlementReadinessOptions);
+    /** Whether new Tempo session channels may be offered at this instant. */
+    available(): boolean;
+    /** Refresh shared failure state and hold the first balance read before gating. */
+    ensureFresh(): Promise<void>;
+    /** Add a reporting listener; the disposer removes only that listener. */
+    subscribe(listener: TempoSettlementReadinessListener): () => void;
+    /** Start the boot reading and in-process cadence. Idempotent. */
+    start(): void;
+    /** Stop the cadence without affecting any in-flight reading. */
+    stop(): void;
+    /** Read and report the configured fee-token balance now. */
+    checkBalance(opts?: {
+        successfulTransaction?: boolean;
+        recoveryVersion?: string;
+    }): Promise<TempoSettlementBalanceObservation>;
+    /** Latch fleet-wide and report every redacted fee-funding rejection. */
+    recordInsufficientFunds(failure: Omit<TempoSettlementFailureObservation, "address" | "network" | "token" | "errorClass" | "checkedAt" | "balanceMicro">): Promise<void>;
+    /** Snapshot the failure version an operator-funded transaction may recover. */
+    captureRecoveryVersion(): Promise<string | undefined>;
+    /** Re-check after a landed transaction and recover only its preflight version. */
+    recordSuccessfulTransaction(recoveryVersion?: string): Promise<void>;
+    /** Exposed for timer-lifecycle assertions without reaching into Node internals. */
+    timerHasRef(): boolean | undefined;
+    private checkBalanceOnce;
+    private captureFailureBalance;
+    private refreshFailureState;
+    private persistPendingFailure;
+    private applyFailureState;
+    private currentFailureState;
+    private reportBalance;
+    private notify;
+}
+
+/**
+ * Hono env for the SDK's DVM app. `unknownRoute` is set by
+ * {@link unknownRouteNotFound} so the `dvm.request` span can classify a 404 as
+ * scanner-probe noise vs a registered route's own 404 (internal-review).
+ *
+ * Exported as a type only, for route modules split out of this file
+ * (`credit-routes.ts`) — a type-only import erases at compile time, so it
+ * introduces no runtime cycle back into `app.ts`.
+ */
+interface AppEnv {
+    Variables: {
+        requesterId: string;
+        unknownRoute?: boolean;
+        clientCompatibility?: ClientCompatibility;
+    };
+}
+
+/**
+ * What a terminal drain transition needs in order to book its platform drain
+ * report (internal-review). Every field is optional because a DVM can legitimately
+ * run without platform reporting — a `dvmctl dev` server, a self-hosted
+ * builder, a test host — and a drain must still be fulfillable there.
+ */
+interface DrainReportWiring {
+    /** The SDK's own Postgres, which holds both the ledger and the reporter's outbox. */
+    db?: Pool;
+    /** Platform DVM record ID, bound into every report. */
+    dvmId?: string;
+    /** Reporter-owned outbox write, run inside the transition's transaction. */
+    enqueueCreditDrain?: CreditDrainEnqueue;
+}
+
+/**
+ * Signed body of a `POST /v1/credit` request (internal-review). The op discriminator
+ * lives **inside** the signed bytes, so a network attacker can't rewrite a
+ * `balance` read into a `drain`.
+ *
+ * Deliberately independent of `credit-envelope.ts`, which parses the credit
+ * fields riding a `/v1/job` body: that shape pairs `credit_id` with a
+ * mandatory `draw_id`, and a fund-only top-up has no draw. Two routes, two
+ * schemas — sharing one would force a top-up to invent a draw id.
+ */
+declare const CREDIT_REQUEST_SCHEMA: z.ZodObject<{
+    op: z.ZodEnum<{
+        drain: "drain";
+        balance: "balance";
+        fund: "fund";
+    }>;
+    credit_id: z.ZodOptional<z.ZodString>;
+    fund: z.ZodOptional<z.ZodObject<{
+        amount_micro: z.ZodNumber;
+        fund_id: z.ZodString;
+        commitment: z.ZodOptional<z.ZodString>;
+        method: z.ZodOptional<z.ZodEnum<{
+            tempo: "tempo";
+            lightning: "lightning";
+        }>>;
+        intent: z.ZodOptional<z.ZodEnum<{
+            charge: "charge";
+            session: "session";
+        }>>;
+    }, z.core.$strip>>;
+    drain: z.ZodOptional<z.ZodObject<{
+        drain_id: z.ZodString;
+        method: z.ZodOptional<z.ZodString>;
+        payout: z.ZodOptional<z.ZodObject<{
+            refund_pubkey: z.ZodOptional<z.ZodString>;
+            address: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    pubkey: z.ZodString;
+    signature: z.ZodString;
+    timestamp: z.ZodNumber;
+    nonce: z.ZodString;
+}, z.core.$strip>;
+/** Parsed `/v1/credit` body. */
+type CreditRequest = z.infer<typeof CREDIT_REQUEST_SCHEMA>;
+/** Everything the `/v1/credit` handler needs from the server that mounts it. */
+interface CreditRouteDeps {
+    /** Resolved credit sizing, or `undefined` when this DVM didn't opt in. */
+    menu: () => Promise<CreditMenu | undefined>;
+    /** Resolved builder policy; absent and older config fail closed. */
+    creditConfig: ResolvedCreditConfig | undefined;
+    auth: DVMAuthScheme | undefined;
+    /** Exact `/v1/credit` audience and operation expected by the auth gate. */
+    authDomain?: SignedRequestDomain;
+    ledger: CreditLedgerLike;
+    fxFetcher: FxFetcher;
+    /** Per-DVM + per-request rail wiring, shared with `/v1/job` (see `railVerifyOpts`). */
+    railOpts: (c: Context<AppEnv>) => Promise<UpfrontPaymentOpts>;
+    /**
+     * Book a committed top-up as a platform deposit (internal-review). A fund-only
+     * top-up moves real money onto a credit whose draws will each book revenue
+     * later, so skipping this would report the spending without the money that
+     * backed it — the DVM's outstanding liability would go negative.
+     */
+    onDeposit: (funding: NonNullable<PaymentInfo["funding"]>) => void;
+    /**
+     * Platform drain-report wiring (internal-review), used by the cashu pickup — the
+     * one terminal drain transition that lands on this caller-facing route.
+     * Empty on a DVM with no platform reporting, which changes nothing about
+     * the reclaim itself.
+     */
+    drainReport: DrainReportWiring;
+    /**
+     * Receipt signer, when this DVM has a receipt key (internal-review). Drain ops
+     * countersign every reclaim event with it (internal-review); absent, drains still
+     * work — the ledger stays authoritative, the caller just gets no portable
+     * evidence artifact.
+     */
+    receiptIssuer: ReceiptIssuer | undefined;
+    /**
+     * The Lightning receive leg, when this DVM configured one (internal-review).
+     * Absent ⇒ `method: "lightning"` is refused with `lightning_unavailable`
+     * and the funding menu never advertised it in the first place.
+     *
+     * Only the *issue* path reaches through this. Settling goes via
+     * {@link settleLightning}, which is where a settlement books its deposit.
+     */
+    lightning: {
+        receive: LightningReceive;
+    } | undefined;
+    /**
+     * Apply any Lightning invoice this caller has paid since the last check, and
+     * book the deposit for each one that credits (internal-review). A no-op when the
+     * rail isn't configured. Runs before the read ops so a balance reflects a
+     * top-up that settled out of band, and behind the fund poll so a sibling
+     * invoice on the same credit is swept with it.
+     */
+    settleLightning: (callerPubkey: string, creditId?: string) => Promise<void>;
+    /** Hosted operator fee-token gate; absent on self-hosted DVMs. */
+    tempoSettlementReadiness?: TempoSettlementReadiness;
+}
+/**
+ * `POST /v1/credit` — the caller-facing surface of the credits settlement
+ * layer (internal-review, spec §4/§7). Three ops on one signed, replay-protected
+ * envelope, mirroring `/v1/job`'s auth discipline exactly:
+ *
+ * - **fund** — a top-up with no job attached. The rail artifact rides the same
+ *   headers as `/v1/job` (`X-Cashu` + `X-Cashu-Request-Id`, `X-PAYMENT`,
+ *   `Authorization: Payment …`) and a missing or bad one comes back as the
+ *   same 402 envelope, which is what lets a caller's existing resumable-submit
+ *   machinery drive a top-up with no new client code.
+ * - **balance** — what do I hold here, including expired credits (their value
+ *   is still the caller's; spec §5), plus the funding menu, so the same read
+ *   also answers what may be added (internal-review).
+ * - **drain** — reclaim the unspent balance (internal-review, spec §5 tier 3). One
+ *   op is both the request and the poll/pickup: the first call debits the
+ *   available balance into a `pending` liability; re-polling the same
+ *   `drain_id` returns the current state, delivers the parked Cashu token
+ *   when the builder's batch job has parked it, and is idempotent throughout.
+ */
+declare function handleCreditRequest(c: Context<AppEnv>, deps: CreditRouteDeps): Promise<Response>;
+
+/**
+ * Pool-shaped handle the lock needs — `connect`, since the lock and the unlock
+ * must ride one pinned client, plus `pg`'s resolved config when it's there (a
+ * hand-rolled pool shape won't have it) so the size check below can run.
+ * Declared here rather than reusing `AccumulatorPool` so the stores can depend
+ * on this module without an import cycle; every SDK pool type (`Pool`,
+ * `AccumulatorPool`, `CreditLedgerPool`) structurally satisfies it.
+ */
+type InitLockPool = Pick<Pool, "connect"> & {
+    readonly options?: {
+        readonly max?: number;
+    };
+};
+/**
+ * The single session advisory-lock key serializing **all** SDK boot-time
+ * schema work against concurrent creators — two machines cold-booting one DVM
+ * against a fresh database, or parallel test files sharing one DB.
+ *
+ * Postgres' `IF NOT EXISTS` existence check is not atomic against a concurrent
+ * creator: two sessions running the same `CREATE TABLE IF NOT EXISTS` at once
+ * can raise `duplicate key value violates unique constraint
+ * "pg_type_typname_nsp_index"` (23505) in the loser, which at SDK boot is an
+ * unhandled throw that kills the machine (internal-review).
+ *
+ * Deliberately distinct from `PLATFORM_INIT_ADVISORY_LOCK` (17320917) — a
+ * DVM's own database is not the platform database — and from the first-party
+ * DVMs' own keys (cast 17320918, scrape 17320926, scribe 24700919). **A new
+ * SDK store reuses this key rather than inventing a second one**: one key means
+ * there is only ever one lock order, so the per-store lock-order inversion that
+ * deadlocked internal-review can't recur.
+ */
+declare const SDK_INIT_ADVISORY_LOCK = 17320927;
+/**
+ * Run `fn` holding {@link SDK_INIT_ADVISORY_LOCK} on `db`. Every SDK
+ * boot-path `CREATE TABLE IF NOT EXISTS` goes through here.
+ *
+ * Overlapping callers on the same pool share **one** acquisition: the first
+ * connects and locks, concurrent and nested callers join the held lock, and
+ * the last one out unlocks and releases the client. That keeps internal-review's
+ * deliberately-parallel store-init batch parallel — six `init()`s racing each
+ * other would otherwise queue behind one another — and keeps the uncontended
+ * cost at one extra round trip per boot phase rather than one per store.
+ * Sharing is safe for the DDL, which is what this lock is for: it excludes
+ * *other machines*, and within one process no two inits create the same table.
+ * It is not by itself a mutex between same-pool callers — two of them
+ * concurrently running one non-idempotent statement still race, so anything
+ * riding this lock that isn't `CREATE … IF NOT EXISTS` must carry its own
+ * conflict handling (`seedLockPubkeyState`'s `ON CONFLICT DO NOTHING`).
+ *
+ * Session-level (not `pg_advisory_xact_lock`) because the DDL runs in
+ * autocommit with no enclosing transaction, so the lock and the unlock ride a
+ * dedicated pinned client — advisory locks are session-scoped and the unlock
+ * must land on the backend that holds it. Released in `finally` on every path
+ * including throws: an SDK boot that died holding this lock would block every
+ * sibling until its connection closed.
+ *
+ * The guarded DDL runs on the pool's *other* connections, so the pool must
+ * allow at least two — `pg`'s default `max` is 10 and the host never narrows
+ * it, but a builder-supplied `Pool({ max: 1 })` would starve boot. That one
+ * deadlocks with no error and reads as a dead database, so it is refused up
+ * front instead.
+ */
+declare function withSdkInitLock<T>(db: InitLockPool, fn: () => Promise<T>): Promise<T>;
+
+/**
+ * In-memory {@link CreditLedgerLike} for pool-less setups — devMode, direct
+ * `createDVMServer` tests, and the in-process x402 money loop — mirroring the
+ * `MemoryJobStore` precedent. Same semantics as the Postgres `CreditLedger`
+ * (two-phase draws, replay-before-expiry, `draw_conflict`, gap-free
+ * `ledger_seq`), minus durability and cross-machine safety: per-process only,
+ * so production DVMs must use the Postgres ledger (spec §2 condition 2).
+ * Every mutating verb is synchronous between awaits, so operations are
+ * atomic in-process; the `tx` handles are accepted and ignored.
+ */
+declare class MemoryCreditLedger implements CreditLedgerLike {
+    /**
+     * Per-process and lost on restart, so a DVM backed by this ledger never
+     * advertises the funding menu outside devMode (internal-review) — funding on one
+     * machine and drawing on another would `credit_not_found`.
+     */
+    readonly durable = false;
+    private readonly credits;
+    private readonly fundings;
+    private readonly invoices;
+    private readonly tempoLosses;
+    private readonly x402Losses;
+    private x402Settlements?;
+    /** See {@link CreditLedger.useX402SettlementGate} — same contract (internal-review). */
+    useX402SettlementGate(gate: X402RefundSettlementGate): void;
+    fund(args: Parameters<CreditLedgerLike["fund"]>[0]): Promise<CreditSnapshot>;
+    draw(args: Parameters<CreditLedgerLike["draw"]>[0]): Promise<DrawResult>;
+    /** See {@link CreditLedger.blockingX402Refund} — same contract (internal-review). */
+    blockingX402Refund(channelId: string | null | undefined, statuses: X402SettlementStatus[]): Promise<X402UnresolvedRefund | undefined>;
+    /** The unresolved x402 refund that must stop an effect on `creditId` (internal-review). */
+    private blockingRefundForCredit;
+    growDraw(args: Parameters<CreditLedgerLike["growDraw"]>[0]): Promise<GrownDrawResult>;
+    settle(args: Parameters<CreditLedgerLike["settle"]>[0]): Promise<DrawResolution>;
+    release(args: Parameters<CreditLedgerLike["release"]>[0]): Promise<DrawResolution>;
+    recordFunding(args: Parameters<CreditLedgerLike["recordFunding"]>[0]): Promise<FundingRecord>;
+    getFunding(args: {
+        creditId: string;
+        fundId: string;
+    }): Promise<FundingRecord | undefined>;
+    completeFunding(args: Parameters<CreditLedgerLike["completeFunding"]>[0]): Promise<FundingRecord>;
+    saveFundingReceipt(args: Parameters<CreditLedgerLike["saveFundingReceipt"]>[0]): Promise<FundingReceipt>;
+    recordInvoice(args: Parameters<CreditLedgerLike["recordInvoice"]>[0]): Promise<CreditInvoiceRecord>;
+    getInvoice(args: {
+        creditId: string;
+        fundId: string;
+    }): Promise<CreditInvoiceRecord | undefined>;
+    listPendingInvoices(args: {
+        callerPubkey: string;
+        creditId?: string;
+        limit: number;
+    }): Promise<CreditInvoiceRecord[]>;
+    settleInvoice(args: Parameters<CreditLedgerLike["settleInvoice"]>[0]): Promise<InvoiceSettlement>;
+    markInvoiceExpired(args: {
+        creditId: string;
+        fundId: string;
+    }): Promise<CreditInvoiceRecord | undefined>;
+    markInvoiceBlocked(args: {
+        creditId: string;
+        fundId: string;
+        reason: string;
+    }): Promise<CreditInvoiceRecord | undefined>;
+    getInvoiceByPaymentHash(paymentHash: string): Promise<CreditInvoiceRecord | undefined>;
+    listBlockedInvoices(args: {
+        limit: number;
+        after?: BlockedInvoiceCursor;
+        includeResolved?: boolean;
+    }): Promise<CreditInvoiceRecord[]>;
+    reconcileBlockedInvoice(args: Parameters<CreditLedgerLike["reconcileBlockedInvoice"]>[0]): Promise<InvoiceReconciliation>;
+    writeOffBlockedInvoice(args: {
+        paymentHash: string;
+        note?: string;
+        nowMs?: number;
+    }): Promise<InvoiceWriteOff | undefined>;
+    private findByPaymentHash;
+    private fundSync;
+    private drawSync;
+    /** Mid-job top-up growth (internal-review) — see `CreditLedger.growDraw` for the semantics. */
+    private growDrawSync;
+    get(creditId: string, opts?: {
+        nowMs?: number;
+    }): Promise<CreditSnapshot | undefined>;
+    getForCaller(callerPubkey: string, opts?: {
+        nowMs?: number;
+    }): Promise<CreditSnapshot[]>;
+    getDraw(args: {
+        creditId: string;
+        drawId: string;
+    }): Promise<DrawRecord | undefined>;
+    getDrawByJobId(jobId: string): Promise<DrawRecord | undefined>;
+    listPendingDraws(creditId: string): Promise<DrawRecord[]>;
+    listStalePendingDraws(args: {
+        createdBeforeMs: number;
+        limit: number;
+        after?: StalePendingDrawCursor;
+    }): Promise<DrawRecord[]>;
+    /** Settled draws' native value for the credit an x402 channel funded (internal-review). */
+    earnedNativeForX402Channel(channelId: string): Promise<number | undefined>;
+    getCreditByX402Channel(channelId: string): Promise<CreditSnapshot | undefined>;
+    terminalizeTempoCredits(evidence: TempoCreditLossEvidence, _tx?: CreditLedgerQuerier): Promise<TempoCreditLoss[]>;
+    listTempoCreditLosses(args?: {
+        limit?: number;
+    }): Promise<TempoCreditLoss[]>;
+    terminalizeX402Credit(evidence: X402CreditLossEvidence, _tx?: CreditLedgerQuerier): Promise<X402CreditLoss[]>;
+    listX402CreditLosses(args?: {
+        limit?: number;
+    }): Promise<X402CreditLoss[]>;
+    requestDrain(args: {
+        creditId: string;
+        drainId: string;
+        callerPubkey: string;
+        method: DrainMethod;
+        payout: Record<string, string>;
+        requireNoPending?: boolean;
+        tx?: CreditLedgerQuerier;
+        nowMs?: number;
+    }): Promise<DrainRequestResult>;
+    bitcoinDepositLiability(): Promise<BitcoinDepositLiability>;
+    listFundingLots(creditId: string): Promise<FundingLot[]>;
+    getDrain(args: {
+        creditId: string;
+        drainId: string;
+    }): Promise<CreditDrainRecord | undefined>;
+    listPendingDrains(): Promise<CreditDrainRecord[]>;
+    listChannelDrains(args: {
+        limit: number;
+        after?: ChannelDrainCursor;
+        createdBeforeMs: number;
+        rail: "tempo";
+        includeResolved?: boolean;
+    }): Promise<CreditDrainRecord[]>;
+    writeOffDrain(args: {
+        creditId: string;
+        drainId: string;
+        note?: string;
+        nowMs?: number;
+    }): Promise<DrainWriteOff | undefined>;
+    clearDrainWriteOff(args: {
+        creditId: string;
+        drainId: string;
+    }): Promise<void>;
+    releaseDrain(args: {
+        creditId: string;
+        drainId: string;
+        tx?: CreditLedgerQuerier;
+        nowMs?: number;
+    }): Promise<DrainReleaseResult>;
+    parkDrain(args: {
+        creditId: string;
+        drainId: string;
+        token: string;
+        fulfilment?: DrainFulfilment;
+        tx?: CreditLedgerQuerier;
+        nowMs?: number;
+    }): Promise<CreditDrainRecord>;
+    markDrainPickedUp(args: {
+        creditId: string;
+        drainId: string;
+        tx?: CreditLedgerQuerier;
+        nowMs?: number;
+    }): Promise<DrainTransitionResult>;
+    markDrainSent(args: {
+        creditId: string;
+        drainId: string;
+        sentRef: Record<string, unknown>;
+        tx?: CreditLedgerQuerier;
+        nowMs?: number;
+    }): Promise<DrainTransitionResult>;
+    appendDrainReceipt(args: {
+        creditId: string;
+        drainId: string;
+        receipt: Record<string, unknown>;
+        tx?: CreditLedgerQuerier;
+    }): Promise<void>;
+    private requireDrain;
+    private transitionRefusal;
+    private resolve;
+    private requireCredit;
+    private snapshot;
+}
+
+/** Postgres-backed JobStore with cross-machine message streaming via LISTEN/NOTIFY. */
+declare class PostgresJobStore implements StreamableJobStore, ReceiptIssuingStore {
+    private pool;
+    private listenChannel;
+    private messageSubscribers;
+    private notifySubscribers;
+    private requestIdClaimLocks;
+    constructor(pool: Pool);
+    /** Run the CREATE TABLE migration. Call once at startup. */
+    init(): Promise<void>;
+    /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+    private createTables;
+    get(id: string): Promise<JobRecord | undefined>;
+    /**
+     * internal-review. Indexed by `idx_jobs_payment_tx_hash`. `paymentTxHash` is unique
+     * per settlement in practice — the accumulator's
+     * `UNIQUE(dvm_id, request_id, proof_secret)` is what makes a second job under
+     * the same request id impossible — but order by `created_at` so a
+     * hypothetical duplicate resolves to the job the caller actually paid for.
+     */
+    findJobByPaymentTxHash(txHash: string): Promise<JobRecord | undefined>;
+    findJobByRequestId(requestId: string, requesterPubkey: string): Promise<JobRecord | undefined>;
+    claimRequestId(claim: RequestIdClaim): Promise<RequestIdClaimResult | undefined>;
+    resumeRequestId(claim: RequestIdClaim): Promise<RequestIdClaimResult | undefined>;
+    private acquireRequestIdClaim;
+    releaseRequestIdClaim(claim: RequestIdClaim): Promise<void>;
+    save(record: JobRecord): Promise<void>;
+    delete(id: string): Promise<void>;
+    claimReceiptSeq(jobId: string): Promise<number>;
+    saveReceipt(jobId: string, receipt: JobReceipt): Promise<JobReceipt | undefined>;
+    appendOutgoing(jobId: string, message: OutgoingMessage, opts?: AppendOutgoingOptions): Promise<number>;
+    recordInbound(jobId: string, message: OutgoingMessage): Promise<number>;
+    verifyAndCredit(jobId: string, seq: number, credit: PaymentCreditDelta | null): Promise<VerifyAndCreditResult>;
+    getVerifiedInbound(jobId: string, seq: number): Promise<VerifyAndCreditResult | undefined>;
+    markInboundFailed(jobId: string, seq: number, _reason: string): Promise<void>;
+    findStaleJobs(processingThresholdMs: number, awaitingThresholdMs: number, limit: number, capabilities: string[] | null): Promise<JobRecord[]>;
+    heartbeatActiveJobs(jobIds: string[], now: number): Promise<void>;
+    cancelStaleJob(jobId: string, expectedActivityBefore: number, reason: string, terminalStatus: "failed" | "cancelled"): Promise<boolean>;
+    cancelJob(jobId: string, reason: string): Promise<boolean>;
+    getCounters(jobId: string): Promise<JobCounters | undefined>;
+    claimForProcessing(jobId: string): Promise<boolean>;
+    tryReactivationLock<T>(jobId: string, fn: () => Promise<T>): Promise<{
+        acquired: true;
+        result: T;
+    } | {
+        acquired: false;
+    }>;
+    subscribeMessages(jobId: string, afterSeq: number, onMessage: (msg: Message) => void): Promise<() => void>;
+    subscribeNotifications(jobId: string, onNotify: () => void): Promise<() => void>;
+    getMessages(jobId: string, afterSeq: number): Promise<Message[]>;
+    initStreaming(): Promise<void>;
+    shutdownStreaming(): Promise<void>;
+    private dispatch;
+    /**
+     * Drive a non-terminal job to `terminalStatus` and append its final `cancel`
+     * message in one transaction. Backs both `cancelStaleJob` (which passes an
+     * `expectedActivityBefore` cutoff, so the flip only lands while the row is
+     * still stale — a live worker that heartbeats in between keeps its job) and
+     * `cancelJob` (which passes `null`: an operator/caller cancel is
+     * unconditional, gated only on the row still being non-terminal).
+     *
+     * The `SELECT … FOR UPDATE` makes the whole thing a CAS: two machines racing
+     * to terminate the same job serialise on the row lock, and the loser's
+     * status filter no longer matches. `pg_notify` fires inside the tx so the
+     * machine running the handler wakes as soon as the terminal status is
+     * visible.
+     */
+    private terminateJob;
+    private fetchCountersTx;
+    /**
+     * The credit binding on the job row, read inside Tx C (internal-review). Used on the
+     * paths that don't get it from a `RETURNING` — the `alreadyVerified` skip and
+     * a non-payment inbound.
+     */
+    private fetchCreditBindingTx;
+}
+
+/**
+ * Postgres-backed KVStore. Requires the `pg` package as a peer dependency.
+ *
+ * Expired rows are filtered on read but never deleted. A periodic cleanup
+ * mechanism (e.g. `DELETE FROM kv_store WHERE expires_at IS NOT NULL AND
+ * expires_at < now()`) should be added before production use to prevent
+ * unbounded table growth.
+ */
+declare class PostgresKVStore implements KVStore {
+    private pool;
+    constructor(pool: Pool);
+    /** Run the CREATE TABLE migration. Call once at startup. */
+    init(): Promise<void>;
+    /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+    private createTables;
+    get<T = unknown>(key: string): Promise<T | undefined>;
+    set(key: string, value: unknown, opts?: {
+        ttl?: number;
+    }): Promise<void>;
+    delete(key: string): Promise<void>;
+    list(prefix?: string): Promise<string[]>;
+}
+
+/** Options for `PostgresReplayStore`. */
+interface PostgresReplayStoreOpts {
+    /** Table name. Defaults to `"signed_request_replays"`. Must match `/^[a-zA-Z_][a-zA-Z0-9_]*$/`. */
+    tableName?: string;
+    /**
+     * Retention window in seconds — rows older than `now - windowSeconds` are
+     * eligible for the sampled-in-line GC sweep. Defaults to 600 (10 minutes),
+     * matching the SDK's signed-request retention default.
+     */
+    windowSeconds?: number;
+    /**
+     * Probability (per `checkAndRecord` call) of firing a fire-and-forget GC
+     * sweep. Defaults to 0.01 — every ~100 writes runs one DELETE. Set to 0 to
+     * disable GC entirely (rely on an external sweeper).
+     */
+    gcSampleRate?: number;
+}
+/**
+ * Postgres-backed replay store implementing {@link SignedRequestReplayStore}.
+ *
+ * Cross-machine safe: relies on the PK on `(pubkey, timestamp, nonce)` with
+ * `INSERT ... ON CONFLICT DO NOTHING` to detect duplicates atomically across
+ * concurrent inserts from multiple machines. The consumer hands in a `Pool`
+ * (matching `PostgresJobStore` / `PostgresKVStore`) and manages its lifecycle.
+ *
+ * Multi-machine deploys of secp256k1-auth'd DVMs SHOULD use this store to
+ * close the per-process replay window — see {@link SignedRequestReplayStore}
+ * for the threat model.
+ */
+declare class PostgresReplayStore implements SignedRequestReplayStore {
+    private pool;
+    private tableName;
+    private windowSeconds;
+    private gcSampleRate;
+    constructor(pool: Pool, opts?: PostgresReplayStoreOpts);
+    /** Run the CREATE TABLE migration. Idempotent — safe to call repeatedly. */
+    init(): Promise<void>;
+    /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+    private createTables;
+    checkAndRecord(pubkey: string, timestamp: number, nonce: string, now: number): Promise<boolean>;
+    private gcSweep;
+}
+
+/** Protocol-owned request field carried inside a signed request body. */
+declare const REQUEST_ID_FIELD = "request_id";
+/** Auth-schema fields the protocol owns rather than the builder input schema. */
+declare function protocolEnvelopeIgnoreFields(schema: unknown): readonly string[];
+/** Remove protocol-owned credit and recovery fields before builder input parsing. */
+declare function stripProtocolEnvelope(schema: unknown, data: unknown): unknown;
+/** Read and validate the optional recovery id from a signed request body. */
+declare function requestIdFromEnvelope(data: unknown): string | undefined;
+/** True when the request body carries a request id field but its value is invalid. */
+declare function hasInvalidRequestId(data: unknown): boolean;
+
+/**
+ * Convenience one-liner over {@link createDVMHost} (internal-review). For
+ * single-DVM hosts, `serve(dvm, opts)` is equivalent to
+ * `createDVMHost(opts).mount(dvm).serve()`. Multi-DVM hosts go through
+ * `createDVMHost` directly so each mount can carry its own prefix.
+ *
+ * This is **shorthand-over-host**, not a parallel code path — every wiring
+ * step (Cashu/MPP/x402 envelope resolution, platform reporter, db, fx) flows
+ * through `createDVMHost`. First-party DVMs that use `serve(...)` are NOT
+ * exposed to the wiring-drift bug class fixed in internal-review/485/511, which was
+ * about bypassing the host entirely. There is no migration to do.
+ */
+declare function serve<State, InputSchema extends ZodLike | undefined = undefined>(descriptor: DVMDescriptor<State, InputSchema>, opts?: DVMHostOpts): Promise<{
+    url: string;
+    close: () => Promise<void>;
+}>;
+
+export { BlockedInvoiceCursor, type BuildCreditMenuArgs, type BuilderIdentity, CREDIT_ENVELOPE_KEYS, CREDIT_REQUEST_SCHEMA, ClientCompatibility, ClientCompatibilityGate, type ConsumedCredentialStore, type CreateX402BatchSettlementServerOpts, type CreditEnvelope, CreditEnvelopeError, type CreditFundCommitment, CreditInvoiceRecord, CreditLedgerLike, CreditLedgerQuerier, type CreditMenu, type CreditRequest, type CreditRouteDeps, CreditSnapshot, type CreditTerms, DEFAULT_INVOICE_TTL_SECONDS, DVMAuthScheme, type DVMHost, type DVMHostOpts, DrawRecord, DrawResolution, DrawResult, FundingRecord, GrownDrawResult, IMPLICIT_CREDIT_TTL_MS, type InitLockPool, InvoiceReconciliation, InvoiceSettlement, InvoiceWriteOff, JobManager, type JobManagerOpts, JobRecord, JobStore, LightningReceive, type LightningReceiveConfig, MIN_INVOICE_TTL_SECONDS, MemoryConsumedCredentialStore, type MemoryConsumedCredentialStoreOpts, MemoryCreditLedger, MemoryProcessedPaymentStore, MemoryX402ExactSettlementStore, type MountOpts, type OwnerDisplay, type PlatformReporterOpts, PostgresJobStore, PostgresKVStore, PostgresProcessedPaymentStore, PostgresReplayStore, type PostgresReplayStoreOpts, PostgresX402ChannelStorage, PostgresX402ExactSettlementStore, type PriceFiat, type ProcessedPaymentQuerier, type ProcessedPaymentRail, type ProcessedPaymentRecord, ProcessedPaymentReplayError, type ProcessedPaymentStore, REQUEST_ID_FIELD, type ResolvedCashuOpts, RevenueSkippedNoRailPayload, SDK_INIT_ADVISORY_LOCK, SignedRequestAudience, SignedRequestDomain, SignedRequestReplayStore, StalePendingDrawCursor, StreamableJobStore, type X402BatchAcceptance, type X402BatchFunding, type X402BatchRefusal, type X402BatchSettlementServer, type X402ExactAcceptance, X402ExactIntentConflictError, type X402ExactSettlementAttempt, type X402ExactSettlementChainEvidence, type X402ExactSettlementEffect, X402ExactSettlementEvidenceMissingError, type X402ExactSettlementEvidenceReader, type X402ExactSettlementIntent, X402ExactSettlementNotReadyError, X402ExactSettlementServer, type X402ExactSettlementServerOpts, type X402ExactSettlementStatus, type X402ExactSettlementStore, type X402SettlementChainEvidence, type X402SettlementEvidenceReader, X402SettlementSubmissionError, X402_BATCH_AUTO_SETTLEMENT, X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS, X402_BATCH_SETTLEMENT_NETWORK, attachCreditMenu, buildCreditMenu, createDVMHost, createX402BatchSettlementServer, creditEnvelopeIgnoreFields, drawSettlementRef, extractCreditEnvelope, fundingCommitment, handleCreditRequest, hasInvalidRequestId, protocolEnvelopeIgnoreFields, requestIdFromEnvelope, resolveCashuOptsFromEnv, selectPrimaryCredit, serve, stripCreditEnvelope, stripProtocolEnvelope, toCreditView, withSdkInitLock };