@dvmkit/sdk 0.1.0-rc.1 → 0.1.0-rc.2

package/dist/{chunk-RPXHKMYE.js → chunk-365P52XQ.js}

@@ -1001,6 +1001,7 @@ var CreditLedger = class {
    */
   durable = true;
   x402Settlements;
+  expiryReleaseOutbox;
   /**
    * Bind the durable x402 settlement state this ledger gates spending on
    * (internal-review).
@@ -1013,6 +1014,24 @@ var CreditLedger = class {
   useX402SettlementGate(gate) {
     this.x402Settlements = gate;
   }
+  /**
+   * Bind the durable outbox that reports credit-expiry releases and their
+   * revivals to the platform (internal-review).
+   *
+   * Held on the ledger rather than threaded through {@link fund} for the same
+   * reason as the gate above: the revival half fires from *every* funding path
+   * — Cashu commit, x402 exact and channel, Tempo, the Lightning invoice
+   * settle, the implicit N=1 per-call payment — and a seam each of those has to
+   * remember to pass is a seam one of them will eventually forget.
+   *
+   * Unbound (a `dvmctl dev` server, a self-hosted builder, a test host) the
+   * sweep and the reversal still run and still write the ledger's own rows;
+   * only the platform report is skipped. Reporting is bookkeeping and must
+   * never gate the ledger.
+   */
+  useCreditExpiryReleaseOutbox(outbox) {
+    this.expiryReleaseOutbox = outbox;
+  }
   /** Create the `credits` / `credit_draws` tables if absent. Call once at SDK boot. */
   async init() {
     await withSdkInitLock(this.pool, () => this.createTables());
@@ -1275,6 +1294,24 @@ var CreditLedger = class {
       `CREATE INDEX IF NOT EXISTS idx_credit_invoices_blocked
          ON credit_invoices(created_at, credit_id, fund_id) WHERE status = 'blocked';`
     );
+    await this.pool.query(`
+      CREATE TABLE IF NOT EXISTS credit_expiry_releases (
+        credit_id     TEXT NOT NULL,
+        release_id    TEXT NOT NULL,
+        caller_pubkey TEXT NOT NULL,
+        currency      TEXT NOT NULL,
+        rail          TEXT,
+        amount_micro  BIGINT NOT NULL,
+        expiry_ms     BIGINT NOT NULL,
+        released_at   BIGINT NOT NULL,
+        reversed_at   BIGINT,
+        PRIMARY KEY (credit_id, release_id)
+      );
+    `);
+    await this.pool.query(
+      `CREATE INDEX IF NOT EXISTS idx_credit_expiry_releases_open
+         ON credit_expiry_releases(credit_id) WHERE reversed_at IS NULL;`
+    );
   }
   /**
    * Give every open non-channel Bitcoin credit a funding lot (internal-review).
@@ -1341,9 +1378,15 @@ var CreditLedger = class {
    *
    * Pass `tx` (a client inside a caller-owned `BEGIN`) to commit the rail
    * receive and the ledger credit atomically (spec condition 3 — the internal-review
-   * verifier does this). The ledger issues **no** transaction control on `tx`;
-   * the upsert is a single statement, so without `tx` it is equally atomic on
-   * the pool.
+   * verifier does this). The ledger issues **no** transaction control on `tx`.
+   *
+   * Without `tx` it opens one of its own, because a funding is no longer a
+   * single statement: it upserts the credit, records its funding lot
+   * (internal-review), and reverses any standing expiry release (internal-review) — and that
+   * last leg restores balance and queues a report. A crash between the upsert
+   * and the reversal would leave a revived credit whose release still stands,
+   * which the sweep's own exclusion then makes permanent: `balance_micro > 0`
+   * but a standing release means it is neither drainable nor re-releasable.
    *
    * `basis` records the rail value behind the fiat (internal-review) so each draw can
    * be allocated its share of the rail-native amount actually received. A
@@ -1389,9 +1432,29 @@ var CreditLedger = class {
       );
     }
     const b = assertFundingBasis(args.basis);
-    const q = args.tx ?? this.pool;
     const nowMs = args.nowMs ?? Date.now();
     const creditId = args.creditId ?? randomUUID();
+    if (args.tx) return this.fundOn(args.tx, args, b, nowMs, creditId);
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const snapshot = await this.fundOn(client, args, b, nowMs, creditId);
+      await client.query("COMMIT");
+      return snapshot;
+    } catch (err) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw err;
+    } finally {
+      client.release();
+    }
+  }
+  /**
+   * The funding itself, on whichever handle {@link fund} chose. Every refusal
+   * it raises is the caller's to see unchanged; a self-opened transaction rolls
+   * back around it.
+   */
+  async fundOn(q, args, b, nowMs, creditId) {
     const wedged = await this.blockingX402Refund(
       b.x402Channel?.channelId,
       X402_SPEND_BLOCKING_SETTLEMENT_STATUSES
@@ -1524,7 +1587,196 @@ var CreditLedger = class {
       );
     }
     await this.recordFundingLot(q, creditId, args.amountMicro, b, nowMs);
-    return this.snapshotFromRow(rows[0], q, nowMs);
+    const revived = await this.reverseExpiryReleases(q, creditId, nowMs);
+    return this.snapshotFromRow(revived ?? rows[0], q, nowMs);
+  }
+  /**
+   * Undo any expiry release this credit still carries, because a funding just
+   * landed on it (internal-review — the revival rule), restoring the balance the
+   * release took.
+   *
+   * A release records the credit's **final** undrawn remainder and zeroes it
+   * (see {@link releaseExpiredCreditLocked}). Funding adds to the balance and
+   * overwrites `expiry_ms` (spec §5 carry-forward: the credit is a rolling
+   * buffer), so the moment money arrives the recorded remainder is no longer
+   * final: the release stops counting and its micro come back.
+   *
+   * Deliberately unconditional on the incoming expiry rather than gated on
+   * `expiryMs > nowMs`. A release exists only for a credit that had already
+   * lapsed, so any funding that reaches one is money the release did not
+   * account for — and a funding that arrives with an already-past expiry leaves
+   * a credit the very next sweep re-releases at its new, larger remainder. One
+   * rule, self-healing in both directions, and it never needs to read the
+   * pre-funding expiry the upsert has already overwritten.
+   *
+   * Runs on the funding's own handle — which {@link fund} now guarantees is a
+   * transaction — so the reversal, the restored balance and the report commit
+   * with the money or not at all. A reversal that committed without its report
+   * would be unrecoverable: `WHERE reversed_at IS NULL` means no later pass
+   * re-derives it.
+   *
+   * @returns the credit row as the restore left it, or undefined when there was
+   *   nothing to reverse. The caller reads its snapshot off this rather than off
+   *   the funding upsert's `RETURNING`, which predates the restore.
+   */
+  async reverseExpiryReleases(q, creditId, nowMs) {
+    const { rows } = await q.query(
+      `UPDATE credit_expiry_releases
+          SET reversed_at = $2
+        WHERE credit_id = $1 AND reversed_at IS NULL
+        RETURNING *`,
+      [creditId, nowMs]
+    );
+    if (rows.length === 0) return void 0;
+    const restoredMicro = rows.reduce((sum, row) => sum + toSafeInt(row.amount_micro), 0);
+    const { rows: restored } = await q.query(
+      `UPDATE credits SET balance_micro = balance_micro + $2 WHERE credit_id = $1 RETURNING *`,
+      [creditId, restoredMicro]
+    );
+    const outbox = this.expiryReleaseOutbox;
+    if (outbox) {
+      for (const row of rows) {
+        await outbox.enqueue(q, expiryReleaseReport(outbox.dvmId, row));
+      }
+    }
+    return restored[0];
+  }
+  /**
+   * Release the undrawn remainder of every credit whose TTL has run out
+   * (internal-review). Returns the releases this pass recorded.
+   *
+   * **What is released.** The credit's whole `balance_micro`. Expiry ends
+   * spending but never ownership of the record, so the balance stays readable;
+   * what ends is the caller's claim on it, and on the prepaid rails the value
+   * behind it is already in builder custody.
+   *
+   * **Tempo is excluded**, at both of its markers (`tempo_channel_id` and a
+   * `tempo` rail). A Tempo credit is channel-backed and its undrawn value
+   * returns to the *caller* at channel exit, so releasing it would book the
+   * builder money the chain is about to hand back.
+   *
+   * **A credit with a pending hold is skipped, not partially released.** A draw
+   * placed before expiry stays settleable afterwards (`draw`'s replay lookup
+   * runs above the expiry check, so a lost response is still recoverable), so
+   * the remainder is not final while a hold is outstanding. Skipping costs one
+   * sweep interval and keeps the released figure exactly "what nothing bought";
+   * holds do resolve — the orphan-draw watchdog (internal-review) is what guarantees
+   * a stranded one still reaches a terminal state.
+   *
+   * **Idempotent** two ways. `release_id` is derived from the expiry instant,
+   * so a re-sweep after a crash between the insert and its report collides on
+   * the same primary key instead of writing a second row; and the candidate
+   * scan excludes any credit that already has an un-reversed release.
+   *
+   * Each candidate is re-checked under the credit row lock every
+   * `credit_draws` write is taken under, so a draw racing the sweep either
+   * loses the race (its credit is already released and it would have been
+   * refused `credit_expired` anyway) or wins it and leaves a pending hold the
+   * locked re-check sees.
+   */
+  async sweepExpiredCredits(args) {
+    const nowMs = args?.nowMs ?? Date.now();
+    const limit = args?.limit ?? DEFAULT_EXPIRY_SWEEP_LIMIT;
+    const { rows: candidates } = await this.pool.query(
+      `SELECT c.credit_id
+         FROM credits c
+        WHERE c.expiry_ms <= $1
+          AND c.balance_micro > 0
+          AND c.status = 'active'
+          AND c.tempo_channel_id IS NULL
+          AND COALESCE(c.rail, '') <> 'tempo'
+          AND NOT EXISTS (
+            SELECT 1 FROM credit_expiry_releases r
+             WHERE r.credit_id = c.credit_id AND r.reversed_at IS NULL
+          )
+          AND NOT EXISTS (
+            SELECT 1 FROM credit_draws d
+             WHERE d.credit_id = c.credit_id AND d.status = 'pending'
+          )
+        ORDER BY c.expiry_ms
+        LIMIT $2`,
+      [nowMs, limit]
+    );
+    const released = [];
+    for (const candidate of candidates) {
+      const row = await this.withCreditLock(
+        candidate.credit_id,
+        (client, credit) => this.releaseExpiredCreditLocked(client, credit, nowMs)
+      );
+      if (row) released.push(expiryReleaseFromRow(row));
+    }
+    return { released };
+  }
+  /**
+   * Write one credit's expiry release under its row lock, zero the balance it
+   * released, and re-assert every condition the unlocked candidate scan tested.
+   * Returns undefined when the credit no longer qualifies — funded, drawn
+   * against, or already released between the scan and the lock.
+   *
+   * **Zeroing the balance is what makes the release real**, and it is the whole
+   * reason this runs under the lock rather than as a bare INSERT. The row alone
+   * records that the caller's claim ended; it does not *end* it. `requestDrain`
+   * has no expiry check by design (expiry gates new draws, not reclaims), so a
+   * credit whose remainder had been released and reported was still fully
+   * drainable: the DVM would pay out money the platform had already booked as
+   * the builder's, and `deposited - drawn - drained - released` would go
+   * negative on the same micro. With the balance at zero, `requestDrain`'s
+   * existing `availableMicro <= 0` guard refuses with `nothing_to_drain` and no
+   * new check is needed anywhere. {@link reverseExpiryReleases} puts the
+   * balance back when a funding revives the credit.
+   *
+   * `status` deliberately stays `active`: a released credit must remain
+   * fundable, or the revival rule has nothing to revive.
+   *
+   * The zeroed balance also takes the credit out of `BITCOIN_CREDIT_PREDICATE`
+   * (`balance_micro > 0`), so the in-kind sweep floor stops counting sats the
+   * builder no longer owes back — and counts them again after a revival, with
+   * the credit's funding lots untouched throughout.
+   */
+  async releaseExpiredCreditLocked(client, credit, nowMs) {
+    const expiryMs = toSafeInt(credit.expiry_ms);
+    const balanceMicro = toSafeInt(credit.balance_micro);
+    if (expiryMs > nowMs || balanceMicro <= 0 || credit.status !== "active") return void 0;
+    if (credit.tempo_channel_id !== null || credit.rail === "tempo") return void 0;
+    const pending = await this.pendingSums(client, credit.credit_id);
+    if (pending.micro > 0) return void 0;
+    const { rows: open } = await client.query(
+      `SELECT 1 AS one FROM credit_expiry_releases
+        WHERE credit_id = $1 AND reversed_at IS NULL`,
+      [credit.credit_id]
+    );
+    if (open.length > 0) return void 0;
+    const { rows: episodes } = await client.query(
+      `SELECT COUNT(*)::text AS n FROM credit_expiry_releases WHERE credit_id = $1`,
+      [credit.credit_id]
+    );
+    const seq = toSafeInt(episodes[0].n) + 1;
+    const { rows } = await client.query(
+      `INSERT INTO credit_expiry_releases
+         (credit_id, release_id, caller_pubkey, currency, rail, amount_micro, expiry_ms, released_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+       ON CONFLICT (credit_id, release_id) DO NOTHING
+       RETURNING *`,
+      [
+        credit.credit_id,
+        expiryReleaseId(expiryMs, seq),
+        credit.caller_pubkey,
+        credit.currency,
+        credit.rail,
+        balanceMicro,
+        expiryMs,
+        nowMs
+      ]
+    );
+    if (rows.length === 0) return void 0;
+    const row = rows[0];
+    await client.query(
+      `UPDATE credits SET balance_micro = balance_micro - $2 WHERE credit_id = $1`,
+      [credit.credit_id, balanceMicro]
+    );
+    const outbox = this.expiryReleaseOutbox;
+    if (outbox) await outbox.enqueue(client, expiryReleaseReport(outbox.dvmId, row));
+    return row;
   }
   /**
    * Record this funding's in-kind basis as a lot (internal-review).
@@ -2654,7 +2906,15 @@ var CreditLedger = class {
   async listTempoCreditLosses(args) {
     return this.readTempoCreditLosses(this.pool, { limit: args?.limit ?? 50 });
   }
-  /** Retire the active credit bound to a chain-proven empty x402 channel. */
+  /**
+   * Reconcile the credit bound to a chain-proven empty x402 channel.
+   *
+   * A channel with no unclaimed backing makes every remaining customer
+   * liability unsafe, so those credits become terminal. A fully settled credit
+   * has neither a balance nor an unfinished drain and is safe to retain for a
+   * later deposit. This also repairs a zero-liability row an older build
+   * terminalized from the same observation.
+   */
   async terminalizeX402Credit(evidence, tx) {
     const channelId = evidence.channelId.toLowerCase();
     const observedAt = evidence.observedAt ?? Date.now();
@@ -2682,36 +2942,57 @@ var CreditLedger = class {
       `SELECT * FROM credits WHERE x402_channel_id = $1 FOR UPDATE`,
       [channelId]
     );
-    if (credits.length > 0 && credits[0].status !== "unbacked") {
+    if (credits.length > 0) {
       const credit = credits[0];
-      if (credit.status !== "active") throw terminalCreditError(credit.credit_id, credit.status);
-      const { rows: consumed } = await q.query(
-        `SELECT COALESCE(SUM(amount_micro), 0)::text AS amount
-           FROM credit_draws
-          WHERE credit_id = $1 AND status = 'settled'`,
+      if (credit.status !== "active" && credit.status !== "unbacked") {
+        throw terminalCreditError(credit.credit_id, credit.status);
+      }
+      const { rows: drains } = await q.query(
+        `SELECT EXISTS(
+           SELECT 1 FROM credit_drains
+            WHERE credit_id = $1 AND status IN ('pending', 'parked')
+         ) AS outstanding`,
         [credit.credit_id]
       );
-      await q.query(
-        `INSERT INTO x402_credit_losses
-           (credit_id, channel_id, caller_pubkey, currency, former_balance_micro,
-            channel_balance_native, total_claimed_native, consumed_service_micro, observed_at)
-         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
-         ON CONFLICT (credit_id) DO NOTHING`,
-        [
-          credit.credit_id,
-          channelId,
-          credit.caller_pubkey,
-          credit.currency,
-          credit.balance_micro,
-          evidence.channelBalanceNative.toString(),
-          evidence.totalClaimedNative.toString(),
-          consumed[0]?.amount ?? "0",
-          observedAt
-        ]
-      );
-      await q.query(`UPDATE credits SET status = 'unbacked' WHERE credit_id = $1`, [
-        credit.credit_id
-      ]);
+      const hasLiability = toSafeInt(credit.balance_micro) > 0 || drains[0]?.outstanding;
+      if (!hasLiability) {
+        if (credit.status === "unbacked") {
+          await q.query(`UPDATE credits SET status = 'active' WHERE credit_id = $1`, [
+            credit.credit_id
+          ]);
+          await q.query(`DELETE FROM x402_credit_losses WHERE credit_id = $1`, [credit.credit_id]);
+        }
+        return this.readX402CreditLosses(q, { channelId });
+      }
+      if (credit.status !== "unbacked") {
+        const { rows: consumed } = await q.query(
+          `SELECT COALESCE(SUM(amount_micro), 0)::text AS amount
+             FROM credit_draws
+            WHERE credit_id = $1 AND status = 'settled'`,
+          [credit.credit_id]
+        );
+        await q.query(
+          `INSERT INTO x402_credit_losses
+             (credit_id, channel_id, caller_pubkey, currency, former_balance_micro,
+              channel_balance_native, total_claimed_native, consumed_service_micro, observed_at)
+           VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
+           ON CONFLICT (credit_id) DO NOTHING`,
+          [
+            credit.credit_id,
+            channelId,
+            credit.caller_pubkey,
+            credit.currency,
+            credit.balance_micro,
+            evidence.channelBalanceNative.toString(),
+            evidence.totalClaimedNative.toString(),
+            consumed[0]?.amount ?? "0",
+            observedAt
+          ]
+        );
+        await q.query(`UPDATE credits SET status = 'unbacked' WHERE credit_id = $1`, [
+          credit.credit_id
+        ]);
+      }
     }
     return this.readX402CreditLosses(q, { channelId });
   }
@@ -3778,6 +4059,38 @@ function invoiceRecordFromRow(row) {
     settledAt: row.settled_at === null ? null : toSafeInt(row.settled_at)
   };
 }
+var DEFAULT_EXPIRY_SWEEP_LIMIT = 200;
+function expiryReleaseId(expiryMs, seq) {
+  return `xrel:${expiryMs}:${seq}`;
+}
+function expiryReleaseFromRow(row) {
+  return {
+    creditId: row.credit_id,
+    releaseId: row.release_id,
+    callerPubkey: row.caller_pubkey,
+    currency: row.currency,
+    rail: row.rail,
+    amountMicro: toSafeInt(row.amount_micro),
+    expiryMs: toSafeInt(row.expiry_ms),
+    releasedAt: toSafeInt(row.released_at),
+    reversedAt: row.reversed_at === null ? null : toSafeInt(row.reversed_at)
+  };
+}
+function expiryReleaseReport(dvmId, row) {
+  const release = expiryReleaseFromRow(row);
+  return {
+    dvmId,
+    creditId: release.creditId,
+    releaseId: release.releaseId,
+    callerPubkey: release.callerPubkey,
+    rail: release.rail,
+    amountMicro: release.amountMicro,
+    creditCurrency: release.currency,
+    expiryMs: release.expiryMs,
+    releasedAt: release.releasedAt,
+    reversedAt: release.reversedAt
+  };
+}
 
 export {
   isNonChannelBitcoinRail,

package/dist/{chunk-NTK5DJ6R.js → chunk-OJ5WFIB2.js}

@@ -15,7 +15,7 @@ import {
   lotOwedSats,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-RPXHKMYE.js";
+} from "./chunk-365P52XQ.js";
 
 // src/sdk/server/memory-credit-ledger.ts
 import { randomUUID } from "crypto";
@@ -702,6 +702,16 @@ var MemoryCreditLedger = class {
       const observedAt = evidence.observedAt ?? Date.now();
       for (const credit of this.credits.values()) {
         if (credit.x402ChannelId !== channelId) continue;
+        const hasLiability = credit.balanceMicro > 0 || [...credit.drains.values()].some(
+          (drain) => drain.status === "pending" || drain.status === "parked"
+        );
+        if (!hasLiability) {
+          if (credit.status === "unbacked") {
+            credit.status = "active";
+            this.x402Losses.delete(credit.creditId);
+          }
+          continue;
+        }
         if (credit.status === "unbacked") continue;
         const consumedServiceMicro = [...credit.draws.values()].filter((draw) => draw.status === "settled").reduce((sum, draw) => sum + draw.amountMicro, 0);
         this.x402Losses.set(credit.creditId, {

package/dist/{credit-ledger-EDMEZSA2.js → credit-ledger-RO4FGSHG.js}

@@ -10,7 +10,7 @@ import {
   isDrainMethod,
   isFundingRail,
   x402SettlementPending
-} from "./chunk-RPXHKMYE.js";
+} from "./chunk-365P52XQ.js";
 import "./chunk-H25M54MI.js";
 import "./chunk-S3XAHZQY.js";
 export {

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { C as Currency, Z as ZodLike, D as DVMConfig, a as DVMDescriptor } from './job-store-C5n6bhap.js';
-export { A as ApprovalContent, b as ArtifactContent, c as CancelContent, d as CanonicalEnvelope, e as CreateSignedRequestVerifierOpts, f as CreditConfig, g as CreditView, h as DEFAULT_CREDIT_MAX, i as DEFAULT_CREDIT_MIN, j as DEFAULT_CREDIT_TTL_SECONDS, k as DVMRouteContext, I as IncomingMessage, l as InputType, m as InvalidCurrencyError, J as JobRecord, n as JobStatus, o as JobStore, K as KVStore, L as Logger, P as PaymentContent, p as PaymentMethod, q as PriceValue, r as ProgressContent, s as PromptOpts, Q as QuoteConfig, t as QuoteContext, u as QuoteResult, R as ResolvedCreditConfig, v as ResponseContent, S as SDKJobContext, w as SDKPaymentRequestOpts, x as SIGNED_REQUEST_AUTH_ID, y as SIGNED_REQUEST_STATEMENT_VERSION, z as SignedRequestAudience, B as SignedRequestDomain, E as SignedRequestError, F as SignedRequestFailure, G as SignedRequestReplayStore, H as SignedRequestSignOpts, M as SignedRequestStatementHeader, N as SignedRequestVerifier, U as UnsupportedCurrencyError, O as createSignedRequestVerifier, T as isZodSchema, V as signedRequestStatementHeader, W as validateCurrency } from './job-store-C5n6bhap.js';
-export { C as CreateFxFetcherOpts, D as DEFAULT_FX_CURRENCIES, a as DEFAULT_FX_RATE_SOURCE, F as FxFetcher, b as FxRateSnapshot, c as FxRateUnavailableError, P as PinnedFetch, d as PlatformFxSource, S as SSRFError, e as SSRFGuardOpts, f as SSRFReason, g as SSRFResolver, h as assertSafeUrl, i as createFxFetcher, j as createPinnedFetch, k as fxRateFor, r as resolveFxSourceFromEnv } from './ssrf-BdHsrrIb.js';
+import { C as Currency, Z as ZodLike, D as DVMConfig, a as DVMDescriptor } from './job-store-6gR4pZRP.js';
+export { A as ApprovalContent, b as ArtifactContent, c as CancelContent, d as CanonicalEnvelope, e as CreateSignedRequestVerifierOpts, f as CreditConfig, g as CreditView, h as DEFAULT_CREDIT_MAX, i as DEFAULT_CREDIT_MIN, j as DEFAULT_CREDIT_TTL_SECONDS, k as DVMRouteContext, I as IncomingMessage, l as InputType, m as InvalidCurrencyError, J as JobRecord, n as JobStatus, o as JobStore, K as KVStore, L as Logger, P as PaymentContent, p as PaymentMethod, q as PriceValue, r as ProgressContent, s as PromptOpts, Q as QuoteConfig, t as QuoteContext, u as QuoteResult, R as ResolvedCreditConfig, v as ResponseContent, S as SDKJobContext, w as SDKPaymentRequestOpts, x as SIGNED_REQUEST_AUTH_ID, y as SIGNED_REQUEST_STATEMENT_VERSION, z as SignedRequestAudience, B as SignedRequestDomain, E as SignedRequestError, F as SignedRequestFailure, G as SignedRequestReplayStore, H as SignedRequestSignOpts, M as SignedRequestStatementHeader, N as SignedRequestVerifier, U as UnsupportedCurrencyError, O as createSignedRequestVerifier, T as isZodSchema, V as signedRequestStatementHeader, W as validateCurrency } from './job-store-6gR4pZRP.js';
+export { C as CreateFxFetcherOpts, D as DEFAULT_FX_CURRENCIES, a as DEFAULT_FX_RATE_SOURCE, F as FxFetcher, b as FxRateSnapshot, c as FxRateUnavailableError, P as PinnedFetch, d as PlatformFxSource, S as SSRFError, e as SSRFGuardOpts, f as SSRFReason, g as SSRFResolver, h as assertSafeUrl, i as createFxFetcher, j as createPinnedFetch, k as fxRateFor, r as resolveFxSourceFromEnv } from './ssrf-DZi-xJyn.js';
 export { z } from 'zod';
 import '@cashu/cashu-ts';
 import 'mppx';