@dvmkit/sdk 0.1.0-rc.1 → 0.1.0-rc.3

package/dist/{job-store-C5n6bhap.d.ts → job-store-m2pYmvbr.d.ts}

@@ -1,10 +1,11 @@
 import { ProofLike } from '@cashu/cashu-ts';
-import { Challenge, Credential, Method, Receipt } from 'mppx';
-import { MiddlewareHandler, Context, Hono } from 'hono';
-import { FacilitatorClient } from '@x402/core/server';
+import { Challenge, Credential, Store, Method, Receipt } from 'mppx';
+import { FacilitatorClient, FacilitatorConfig } from '@x402/core/server';
 import { AuthorizerSigner, ChannelStorage, AutoSettlementConfig, Channel, ChannelUpdateResult } from '@x402/evm/batch-settlement/server';
+import { MiddlewareHandler, Context, Hono } from 'hono';
+import { Account, Client, Hex } from 'viem';
 import { Pool, PoolClient } from 'pg';
-import { PaymentPayload, PaymentRequirements, SettleResponse } from '@x402/core/types';
+import { PaymentPayload as PaymentPayload$1, PaymentRequirements as PaymentRequirements$1, SettleResponse as SettleResponse$1 } from '@x402/core/types';
 import { z } from 'zod';
 
 /**
@@ -78,6 +79,8 @@ interface X402SelfRelayConfig {
     /** Advanced RPC-health hook; platform-hosted DVMs receive an automatic reporter. */
     onRpcHealth?: (observation: X402SelfRelayRpcHealthObservation) => void | Promise<void>;
 }
+/** Caller-visible reasons an ambiguous x402 settlement could not be reconciled. */
+type X402SettlementReconciliationReason = "settlement_not_on_chain" | "chain_unreachable" | "settlement_unbookmarked" | "facilitator_channel_state_unavailable";
 /** Builder-facing configuration for reusable x402 batch-settlement channels. */
 interface X402BatchSettlementConfig {
     /** Receiver-authorizer signer used when the facilitator advertises none. */
@@ -142,6 +145,13 @@ interface X402ExactVersionSupport {
     v1: boolean;
     v2: boolean;
 }
+/** Client-side x402 wallet — EVM key pair for signing payments. */
+interface X402Wallet {
+    privateKey: string;
+    address: string;
+    /** CAIP-2 chain id this wallet pays on. */
+    network: string;
+}
 /** Server-side receipt from verifying an x402 payment. */
 interface X402Receipt {
     verified: boolean;
@@ -181,6 +191,50 @@ interface X402Receipt {
 
 /** Current x402 protocol version preferred by dvmkit clients and servers. */
 declare const X402_VERSION = 2;
+/** Legacy x402 protocol version retained during the dual-serve window. */
+declare const X402_V1_VERSION = 1;
+/** x402 protocol versions supported by dvmkit's hand-rolled exact codec. */
+type X402Version = typeof X402_V1_VERSION | typeof X402_VERSION;
+/**
+ * Chain a caller's x402 wallet reads when it was connected without an explicit
+ * `--network`. Single source of truth for the default: the wallet loader, the
+ * connect output and the asset resolver all read it from here (internal-review).
+ */
+declare const X402_DEFAULT_NETWORK = "eip155:8453";
+/**
+ * Scheme name of the per-call rail — one signed authorization settling one
+ * resource. Shared with the credit funding menu's `x402.schemes` block, which
+ * has to name the same string the requirement carries (internal-review).
+ */
+declare const X402_EXACT_SCHEME = "exact";
+/**
+ * Scheme name of the reusable v2 channel rail. Single source of truth: the
+ * facilitator probe, the requirement the server builds, the header dispatch,
+ * the caller's requirement selection, and the credit menu's `x402.schemes`
+ * block all read it from here — the menu advertises exactly what the challenge
+ * will carry, so a rename cannot leave one of them advertising a flavour the
+ * others no longer speak (internal-review).
+ */
+declare const X402_BATCH_SETTLEMENT_SCHEME = "batch-settlement";
+
+/**
+ * x402-spec PaymentRequirements — the shape advertised on a 402 response's
+ * `accepts` array, mirrored from the facilitator's `PaymentRequirementsSchema`
+ * (see `x402/types/index.d.ts` in the published `x402` package).
+ */
+interface PaymentRequirementsV1 {
+    scheme: string;
+    network: string;
+    maxAmountRequired: string;
+    resource: string;
+    description: string;
+    mimeType: string;
+    payTo: string;
+    asset: string;
+    maxTimeoutSeconds: number;
+    outputSchema?: Record<string, unknown>;
+    extra?: Record<string, unknown>;
+}
 /** x402 v2 resource metadata echoed by a paying client. */
 interface ResourceInfo {
     url: string;
@@ -204,6 +258,73 @@ interface PaymentRequirementsV2 {
      */
     extra?: Record<string, unknown> | null;
 }
+/** Legacy alias retained for server internals that carry the v1 body requirements. */
+type PaymentRequirements = PaymentRequirementsV1;
+/**
+ * EIP-3009 `TransferWithAuthorization` parameters that the client signs and
+ * the facilitator submits on settlement.
+ */
+interface ExactEvmPayloadAuthorization {
+    from: string;
+    to: string;
+    value: string;
+    validAfter: string;
+    validBefore: string;
+    nonce: string;
+}
+/** Signed EIP-3009 transfer authorization (the `payload` of a PaymentPayload). */
+interface ExactEvmPayload {
+    signature: string;
+    authorization: ExactEvmPayloadAuthorization;
+}
+/**
+ * x402-spec PaymentPayload — the JSON shape carried inside the `X-PAYMENT`
+ * header (base64-encoded). `payload` is scheme-specific; alpha only supports
+ * `scheme: "exact"` against an EVM network.
+ */
+interface PaymentPayloadV1 {
+    x402Version: typeof X402_V1_VERSION;
+    scheme: "exact";
+    network: string;
+    payload: ExactEvmPayload;
+}
+/** x402 v2 payment payload carried in `PAYMENT-SIGNATURE`. */
+interface PaymentPayloadV2 {
+    x402Version: typeof X402_VERSION;
+    resource?: ResourceInfo;
+    accepted: PaymentRequirementsV2;
+    payload: ExactEvmPayload;
+    extensions?: Record<string, unknown>;
+}
+/** Exact EVM payment payload accepted by the dual-version codec. */
+type PaymentPayload = PaymentPayloadV1 | PaymentPayloadV2;
+/** Facilitator `/verify` response. */
+interface VerifyResponse {
+    isValid: boolean;
+    invalidReason?: string;
+    payer?: string;
+}
+/** Facilitator `/settle` response — what we base64 into `X-PAYMENT-RESPONSE`. */
+interface SettleResponse {
+    success: boolean;
+    errorReason?: string;
+    payer?: string;
+    transaction?: string;
+    network?: string;
+    amount?: string;
+    extensions?: Record<string, unknown>;
+}
+/**
+ * Body envelope used to carry x402 PaymentRequirements on a 402 response.
+ * The x402 spec puts requirements in the JSON body under `accepts`; the
+ * `WWW-Authenticate: Payment` header carries the MPP method advertisements
+ * separately, so the two protocols don't fight for the same header slot.
+ */
+interface X402ResponseBody {
+    x402Version: typeof X402_V1_VERSION;
+    accepts: PaymentRequirementsV1[];
+    error?: string;
+}
 /** x402 v2 payment-required declaration encoded into `PAYMENT-REQUIRED`. */
 interface PaymentRequiredV2 {
     x402Version: typeof X402_VERSION;
@@ -212,6 +333,101 @@ interface PaymentRequiredV2 {
     accepts: PaymentRequirementsV2[];
     extensions?: Record<string, unknown>;
 }
+/** Either challenge shape understood by dvmkit callers. */
+type PaymentRequired = X402ResponseBody | PaymentRequiredV2;
+/** Inputs for `buildPaymentRequirements`. */
+interface BuildPaymentRequirementsOpts {
+    x402Config: X402Config;
+    requiredUsdcMicro: bigint;
+    resource: string;
+    description?: string;
+    mimeType?: string;
+    version?: X402Version;
+}
+/**
+ * Build a single x402 `PaymentRequirements` entry from the DVM's `X402Config`,
+ * the resolved per-call USDC amount, and the live request's resource URL.
+ * The resource string is bound into the EIP-3009 `extra` field on signing in
+ * the reference clients, so it must match exactly between the 402 response
+ * and the retry payload — pass the request URL the client will retry against.
+ */
+declare function buildPaymentRequirements(opts: BuildPaymentRequirementsOpts & {
+    version: typeof X402_V1_VERSION;
+}): PaymentRequirementsV1;
+declare function buildPaymentRequirements(opts: (BuildPaymentRequirementsOpts & {
+    version: typeof X402_VERSION;
+}) | (BuildPaymentRequirementsOpts & {
+    version?: undefined;
+})): PaymentRequirementsV2;
+/** Build the canonical x402 v2 declaration for a `PAYMENT-REQUIRED` header. */
+declare function buildPaymentRequiredV2(opts: Omit<BuildPaymentRequirementsOpts, "version"> & {
+    error?: string;
+}): PaymentRequiredV2;
+/** Convert the server's legacy body requirements into the parallel v2 declaration. */
+declare function paymentRequiredV2FromV1(requirements: PaymentRequirementsV1[], error?: string): PaymentRequiredV2;
+/**
+ * Translate a CAIP-2 chain id (`eip155:8453`) to the x402-spec network slug
+ * (`base`). Operators configure DVMs in CAIP-2 because it's the lingua-franca
+ * across our other rails; the x402 facilitator API only accepts named slugs.
+ * Unknown CAIP-2 ids fall through to the original string so non-EVM rails
+ * (Solana mainnet, etc.) can also be plumbed once supported.
+ */
+declare function caip2ToX402Network(network: string): string;
+/** Translate a legacy x402 network slug back to its CAIP-2 chain id. */
+declare function x402NetworkToCaip2(network: string): string;
+/** EIP-712 chain id derived from a CAIP-2 chain id. */
+declare function chainIdFromCaip2(network: string): number;
+/** USDC contract address for a network slug (post-translation). */
+declare function usdcContractFor(networkSlug: string): `0x${string}` | undefined;
+/**
+ * USDC contract address for a CAIP-2 chain id (e.g. `eip155:8453`). Resolves
+ * via {@link caip2ToX402Network} so the one network table is the source of
+ * truth — keeps callers that hold the CAIP-2 form (CLI wallet) in lockstep
+ * with the SDK 402-builder which already speaks x402 slugs.
+ */
+declare function usdcContractByCaip2(caip2: string): `0x${string}` | undefined;
+/** USDC EIP-712 domain `name` for a network slug. */
+declare function usdcDomainNameFor(networkSlug: string): string | undefined;
+/** USDC EIP-712 domain `version` for a network slug. */
+declare function usdcDomainVersionFor(networkSlug: string): string | undefined;
+/**
+ * Decode a base64-encoded `X-PAYMENT` header into a structured `PaymentPayload`.
+ * Throws on malformed input rather than silently returning a partial — the
+ * server treats decode failures as `payment_invalid` per the spec.
+ */
+declare function decodePayment(header: string): PaymentPayload;
+/**
+ * Encode a `PaymentPayload` for transport in the `X-PAYMENT` header. JSON
+ * serialization uses string-typed integer fields (the spec encodes uint256
+ * values as decimal strings, so `bigint` must already be stringified by the
+ * caller).
+ */
+declare function encodePayment(payload: PaymentPayload): string;
+/** Encode a v2 `PaymentRequired` declaration for the HTTP response header. */
+declare function encodePaymentRequiredHeader(required: PaymentRequiredV2): string;
+/** Decode and structurally validate a v2 `PAYMENT-REQUIRED` header. */
+declare function decodePaymentRequiredHeader(header: string): PaymentRequiredV2;
+/** Read the exact EIP-3009 authorization carried by either protocol version. */
+declare function exactEvmAuthorization(payload: PaymentPayload): ExactEvmPayloadAuthorization;
+/**
+ * Encode a `SettleResponse` for the `X-PAYMENT-RESPONSE` header that the
+ * server emits on a 2xx after a successful settlement (internal-review, per the
+ * x402 spec).
+ */
+declare function encodeSettleResponseHeader(response: SettleResponse): string;
+/**
+ * POST a verify request to the facilitator. Returns the parsed `VerifyResponse`
+ * or a structured-failure shape when the facilitator rejects the call (network
+ * error, non-2xx, or `isValid: false`).
+ */
+declare function verifyWithFacilitator(payload: PaymentPayload, requirements: PaymentRequirementsV1 | PaymentRequirementsV2, config?: Pick<X402Config, "facilitator" | "facilitatorAuth">, createAuthHeaders?: FacilitatorConfig["createAuthHeaders"] | undefined): Promise<VerifyResponse>;
+/**
+ * POST a settle request to the facilitator. The facilitator broadcasts the
+ * EIP-3009 `transferWithAuthorization` and returns the on-chain tx hash on
+ * success; the dvmkit DVM mirrors that into `X-PAYMENT-RESPONSE` for the
+ * client and into `revenue_events.tx_hash` for the platform ledger.
+ */
+declare function settleWithFacilitator(payload: PaymentPayload, requirements: PaymentRequirementsV1 | PaymentRequirementsV2, config?: Pick<X402Config, "facilitator" | "facilitatorAuth">, createAuthHeaders?: FacilitatorConfig["createAuthHeaders"] | undefined): Promise<SettleResponse>;
 
 /** Identifies which side of the conversation sent a message. */
 type MessageFrom = "requester" | "provider";
@@ -419,6 +635,16 @@ type Message = (MessageBase & {
     type: "progress";
     content: ProgressContent;
 });
+/** Type guard: message contains an artifact. */
+declare function isArtifactMessage(msg: Message): msg is MessageBase & {
+    type: "artifact";
+    content: ArtifactContent;
+};
+/** Type guard: message is a payment request. */
+declare function isPaymentRequestMessage(msg: Message): msg is MessageBase & {
+    type: "payment-request";
+    content: PaymentRequestContent;
+};
 
 /** Auth identifier advertised by DVMs using audience-bound caller proofs. */
 declare const SIGNED_REQUEST_AUTH_ID: "secp256k1-schnorr-v2";
@@ -514,6 +740,42 @@ declare const requireClientCompatibility: ClientCompatibilityGate;
 /** Render the normal structured HTTP 426 compatibility error. */
 declare function clientUpgradeRequired(c: Context, compatibility: ClientCompatibility, requirement: ClientCompatibilityRequirement): Response;
 
+/**
+ * Canonical JSON serialisation used for secp256k1+BIP-340 Schnorr request
+ * signing in cast (internal-review).
+ *
+ * Single source of truth for both the cast DVM's verifier (internal-review) and the
+ * client signing helper (internal-review). The same function on both sides guarantees
+ * that what the client signs is byte-identical to what the server hashes.
+ *
+ * Algorithm: recursively sort object keys lexicographically (UTF-16 code-unit
+ * order — JavaScript's default), then JSON.stringify with no whitespace.
+ * Arrays preserve order. Numbers, strings, booleans, null pass through as
+ * `JSON.stringify` formats them. Values of `undefined` or functions are
+ * forbidden (we throw rather than silently drop, since both sides must agree).
+ */
+/** Any JSON-serialisable value accepted by `canonicalize`. */
+type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/**
+ * Serialise `value` to its canonical JSON form (sorted keys, no whitespace).
+ *
+ * `undefined` properties on objects are silently omitted (mirroring
+ * `JSON.stringify`), so callers don't need to explicitly delete optional fields
+ * that weren't set. Throws `TypeError` for unsupported scalar types (functions,
+ * symbols, non-finite numbers). The caller is responsible for stripping fields
+ * that shouldn't appear in the signed payload (e.g. `signature` itself).
+ */
+declare function canonicalize(value: JsonValue): string;
+/**
+ * Canonicalise `value` and return the UTF-8 bytes the signer should produce a
+ * signature over. Both the cast client signer (`signAddEpisode`) and the
+ * server verifier (`verifyCanonicalSignedRequest`) call this — sharing the function
+ * guarantees byte-identical input on both sides.
+ */
+declare function canonicaliseForSigning(value: JsonValue): Uint8Array;
+
 /** Terminal outcome a receipt attests. Mirrors the SDK's terminal job statuses. */
 type ReceiptOutcome = "completed" | "failed" | "cancelled";
 /** What the caller paid for the job, as persisted on the job record. */
@@ -611,6 +873,8 @@ interface JobReceipt {
      */
     credit?: ReceiptCredit;
 }
+/** A receipt before signing — every field but the signature itself. */
+type UnsignedJobReceipt = Omit<JobReceipt, "signature">;
 /** Reclaim lifecycle event a {@link DrainReceipt} attests (internal-review, spec §5). */
 type DrainReceiptEvent = "requested" | "parked" | "picked_up" | "sent" | "released";
 /**
@@ -665,6 +929,8 @@ interface DrainReceipt {
     /** BIP-340 Schnorr signature over the canonical receipt minus `signature`. */
     signature: string;
 }
+/** A drain receipt before signing — every field but the signature itself. */
+type UnsignedDrainReceipt = Omit<DrainReceipt, "signature">;
 /**
  * A DVM-signed proof that one payment funded a prepaid credit (internal-review).
  * The balance and sequence are the values fixed when the funding committed;
@@ -698,6 +964,94 @@ interface FundingReceipt {
     /** BIP-340 Schnorr signature over the canonical receipt minus `signature`. */
     signature: string;
 }
+/** A funding receipt before signing. */
+type UnsignedFundingReceipt = Omit<FundingReceipt, "signature">;
+/**
+ * Hash the delivered result so a receipt binds to *what* was returned, not
+ * just that something was.
+ *
+ * `sha256(canonicalize({ summary, artifact_hashes }))`, where each artifact
+ * hash is `sha256(canonicalize(artifactContent))` in emission order (`[]`
+ * when the job emitted none). Hashing the artifact *content object* rather
+ * than trusting `content.sha256` — which is optional and which `ctx.artifact`
+ * never fills in — keeps the hash recomputable by any consumer from exactly
+ * the messages it received.
+ *
+ * **Pass `summary` only for a `completed` job.** On `failed`/`cancelled` the
+ * SDK's durable terminal writes the terminal *reason* into the job's summary
+ * column, so a verifier recomputing a non-completed receipt must pass
+ * `undefined` here and read the reason off `receipt.reason` instead. The
+ * issuer does the same (`resultHashFor` in `sdk/server/receipt-issuer.ts`).
+ */
+declare function computeResultHash(summary: string | undefined, artifactContents: JsonValue[]): string;
+/**
+ * Sign an unsigned receipt with the DVM's receipt secret, returning the
+ * complete receipt. Signs `canonicaliseForSigning(receipt)` — the same
+ * sorted-key canonical JSON the caller-auth envelope and the builder
+ * attestation use, so {@link verifyReceipt} is symmetric with
+ * `verifyCanonicalSignedRequest`. There is no second canonicalisation.
+ */
+declare function signReceipt(unsigned: UnsignedJobReceipt, secretHex: string): JobReceipt;
+/**
+ * Verify a receipt's self-consistency: the BIP-340 signature over the
+ * canonical payload (minus `signature`) under the receipt's own
+ * `receipt_pubkey`. Returns `false` rather than throwing on malformed input.
+ *
+ * This is only the inner link. A consumer that wants provenance must also
+ * check `receipt_pubkey` against `/v1/info#builder`'s attested
+ * `receipt_pubkey` and verify that attestation under the builder pubkey
+ * (`verifyAttestation` in `builder-identity.ts`).
+ */
+declare function verifyReceipt(receipt: JobReceipt): boolean;
+/**
+ * Structural guard on a receipt that arrived from outside this process — off a
+ * `/v1/job` response, or back out of the hand-editable `~/.dvm/receipts.jsonl`.
+ *
+ * Checks only that the load-bearing fields are the right *kind* of thing; it
+ * deliberately does not judge the receipt. A well-formed receipt whose
+ * signature doesn't hold is `invalid` and the caller must see it said so. A
+ * body missing one of these fields is a different animal: consumers dereference
+ * them unconditionally (`receiptDisplay`'s `paid.msats`, the attestation link's
+ * `receipt_pubkey`), so an unguarded one throws `TypeError` and surfaces as an
+ * `internal` exit — and it could never have verified anyway, since the
+ * signature covers the whole canonical body. Refusing it costs no proof.
+ *
+ * One guard for both directions on purpose: what can't come in over the wire
+ * must not be able to come back out of the file.
+ *
+ * Release coupling: adding or requiring a field here changes both the SDK's
+ * emitted wire shape and the caller CLI's accepted shape. Name the first-party
+ * fleet redeploy as a prerequisite in the release note before publishing the
+ * stricter caller; see `public compatibility guide`.
+ */
+declare function isSignedJobReceipt(value: unknown): value is JobReceipt;
+/** Sign an unsigned drain receipt — same canonicalisation as {@link signReceipt}. */
+declare function signDrainReceipt(unsigned: UnsignedDrainReceipt, secretHex: string): DrainReceipt;
+/** Sign an unsigned funding receipt using the common receipt canonicalisation. */
+declare function signFundingReceipt(unsigned: UnsignedFundingReceipt, secretHex: string): FundingReceipt;
+/** Structural guard for a funding receipt received over the wire or from disk. */
+declare function isFundingReceipt(value: unknown): value is FundingReceipt;
+/** Verify a funding receipt's inner BIP-340 signature. */
+declare function verifyFundingReceipt(receipt: FundingReceipt): boolean;
+/**
+ * Structural guard on a drain receipt from outside this process — off a
+ * `/v1/credit` drain response, or back out of `~/.dvm/credits.json`.
+ *
+ * Same contract and same reasoning as {@link isSignedJobReceipt}: both homes
+ * type these `unknown[]` because neither the wire nor a hand-editable file is
+ * evidence of shape, and the chain walk dereferences `receipt_pubkey`
+ * unconditionally. A body missing one of these fields could never have carried
+ * a valid signature anyway, so refusing it costs no proof.
+ * Required-field changes follow the fleet-before-caller release note linked
+ * from {@link isSignedJobReceipt}.
+ */
+declare function isDrainReceipt(value: unknown): value is DrainReceipt;
+/**
+ * Verify a drain receipt's self-consistency, mirroring {@link verifyReceipt}
+ * — the same provenance caveat applies: check `receipt_pubkey` against the
+ * DVM's attested `receipt_pubkey` for the outer link.
+ */
+declare function verifyDrainReceipt(receipt: DrainReceipt): boolean;
 
 /**
  * Funding lots: the in-kind basis of a non-channel Bitcoin credit (internal-review).
@@ -734,12 +1088,19 @@ interface FundingReceipt {
 declare const NON_CHANNEL_BITCOIN_RAILS: readonly ["cashu", "lightning"];
 /** A rail whose unused credit is a sats deposit the provider owes back. */
 type NonChannelBitcoinRail = (typeof NON_CHANNEL_BITCOIN_RAILS)[number];
+/** True when `rail` funds a credit with sats the provider holds and owes back. */
+declare function isNonChannelBitcoinRail(rail: string | null | undefined): rail is NonChannelBitcoinRail;
 /**
  * One funding event's deposit: the sats that arrived and the credit micro they
  * bought, with however much of that micro is still unspent.
  *
  * `remainingMicro` is depleted FIFO by settled draws and by reclaims, so the
- * sum of a credit's lots tracks `credits.balance_micro` exactly.
+ * sum of a credit's lots tracks `credits.balance_micro` exactly — with one
+ * deliberate exception: an expiry release (internal-review) zeroes the balance and
+ * leaves the lots standing, because a revival restores that balance and its
+ * in-kind basis has to still be there. A released credit is excluded from the
+ * sweep floor by `BITCOIN_CREDIT_PREDICATE`'s own `balance_micro > 0`, so the
+ * over-coverage is never counted as sats the builder owes back.
  */
 interface FundingLot {
     lotId: string;
@@ -755,6 +1116,71 @@ interface FundingLot {
     fundingRef: string | null;
     createdAt: number;
 }
+/** One lot's share of a depletion, and what that share is worth in kind. */
+interface LotDebit {
+    lotId: string;
+    /** Credit micro taken out of this lot. */
+    micro: number;
+    /** Sats that micro is worth at this lot's own funding rate, floored. */
+    sats: number;
+}
+/** What a FIFO depletion took, and what it could not cover. */
+interface LotDepletion {
+    debits: LotDebit[];
+    /** In-kind value of everything taken — the reclaim obligation. */
+    satsOwed: number;
+    /** Micro the lots could not cover. Non-zero means the credit's lots are short. */
+    uncoveredMicro: number;
+    /** Of the micro taken, how much came out of a lot carrying a real sats basis. */
+    backedMicro: number;
+}
+/**
+ * Take `amountMicro` out of `lots`, oldest first, and price what was taken at
+ * each lot's own rate.
+ *
+ * FIFO rather than pro rata across the pool, so a top-up taken at a different
+ * rate is reclaimed at *that* rate once the earlier deposit is spent. A
+ * fraction of a satoshi cannot be handed back, so the conversion floors and
+ * the dust stays with the provider rather than being rounded into a payout the
+ * deposit does not cover.
+ *
+ * A slice is priced as the **decrement in the lot's own obligation** —
+ * `lotSats(before) - lotSats(after)` — rather than by flooring the slice on
+ * its own. The two agree whenever a lot is taken whole, which is every
+ * ordinary reclaim; they diverge once a lot is drawn down in pieces, and there
+ * the independent floor loses up to a satoshi *per piece*, permanently. That
+ * matters since internal-review, where each settling draw is priced through here: the
+ * slices have to telescope, or a lot spent over many jobs pays out less than
+ * it took in and the residue is exactly the unattributable one this was meant
+ * to remove. It also makes {@link lotOwedSats} exact rather than conservative
+ * — the remaining obligation is precisely what future depletions will pay.
+ *
+ * `lots` must already be in FIFO order ({@link fifoOrder}).
+ */
+declare function depleteLots(lots: FundingLot[], amountMicro: number): LotDepletion;
+/**
+ * What a settling draw's fiat debit was worth in kind, in millisatoshis
+ * (internal-review) — `null` where the lots cannot price it.
+ *
+ * This is the single sats authority for a non-channel Bitcoin credit. The
+ * settle already depletes the lots the draw consumed, so the figure costs no
+ * extra read: it is `depletion.satsOwed` in the ledger's own msat unit, and
+ * stamping it on `credit_draws.draw_msats` is what makes
+ * `Σ settled draw sats + reclaim sats == Σ sats funded` close per credit.
+ *
+ * `null` follows {@link isInKindDepletion} exactly, so a settle and a reclaim
+ * fall back together: lots short of the balance, or covering lots with no sats
+ * basis, keep the pooled pro-rata figure rather than blending a lot rate with
+ * a blended one. Mixed coverage counts as unpriceable for the same reason it
+ * does on the reclaim.
+ */
+declare function inKindDrawMsats(depletion: LotDepletion, amountMicro: number): number | null;
+/**
+ * What these lots owe in kind if every remaining micro were reclaimed now —
+ * the deposit-liability figure, and the floor the hub must never be swept
+ * below.
+ */
+declare function lotOwedSats(lots: FundingLot[]): number;
 /**
  * Sats held back from every non-channel Bitcoin reclaim to pay for handing it
  * over (internal-review).
@@ -777,7 +1203,502 @@ interface FundingLot {
  * rule the per-lot flooring already follows.
  */
 declare const DRAIN_DELIVERY_RESERVE_SATS = 8;
+/**
+ * The figure a reclaim publishes: its in-kind gross less
+ * {@link DRAIN_DELIVERY_RESERVE_SATS}, floored at zero.
+ *
+ * Zero is a refusal rather than a payout — a balance worth no more than what
+ * it costs to send is `drain_below_dust`, since parking a zero-value token
+ * would hold the servicer's queue open forever.
+ */
+declare function netOwedSats(grossSats: number): number;
+/**
+ * The order lots deplete in: oldest first, `lotId` breaking a tie.
+ *
+ * A tiebreak is not decoration — lot ids are surrogates rather than a
+ * per-credit sequence (`fund` takes no credit lock, so two concurrent
+ * fundings cannot cooperate on a counter), and two fundings can land on the
+ * same millisecond. Without it the FIFO order is whatever the planner
+ * returned, and a reclaim's figure would depend on it.
+ */
+declare function fifoOrder(left: FundingLot, right: FundingLot): number;
+/**
+ * Whether a depletion may be settled in kind, or has to fall back to pricing
+ * the fiat balance at a live rate.
+ *
+ * Both failure modes are real and neither is the caller's fault: a credit's
+ * lots can be short (a coverage hole the boot backfill is meant to close), and
+ * a credit funded before internal-review recorded a rail basis at all has lots whose
+ * `satsFunded` is 0 — pricing *that* in kind would answer "we owe you nothing"
+ * for a deposit we plainly hold. Mixed coverage is treated as unbacked too:
+ * blending a lot rate with a live rate produces a figure neither basis
+ * supports.
+ */
+declare function isInKindDepletion(depletion: LotDepletion, amountMicro: number): boolean;
+
+/** The rails a payout lands on. Lightning never pays out: credits fund straight into the receive wallet. */
+type PayoutRail = "cashu" | "x402" | "tempo";
+/**
+ * What gathered the payments into one transfer: a cashu accumulator melt, an
+ * x402 batch settle to `pay_to`, a Tempo channel's cooperative close, or a
+ * Tempo channel's scheduled / manual settlement to the recipient.
+ */
+type PayoutKind = "melt" | "batch" | "close" | "settle";
+/** Which repair verb completed a stuck movement. Only `tempo_close_reconciled` is produced here today. */
+type PayoutRepairKind = "x402_settlement_reconciled" | "lightning_invoice_reconciled" | "tempo_close_reconciled";
+/**
+ * JSON wire shape POSTed to the platform's `/_internal/payout` endpoint —
+ * one landed movement into the builder's custody. Idempotent platform-side
+ * on `(dvmId, payoutId)`, so the durable retry loop can redeliver freely; a
+ * `repaired` redelivery of an id that already landed upgrades that row rather
+ * than adding a second.
+ */
+interface PayoutReportPayload {
+    /** Required. Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
+    dvmId: string;
+    /** Required. The DVM's own id for the movement — `cashu:melt:<quote>`, `x402:batch:<uuid>`, `tempo:<tx>`. */
+    payoutId: string;
+    rail: PayoutRail;
+    kind: PayoutKind;
+    /** Required. Rail-native atomic units: sats, or USDC micro. Always > 0. */
+    nativeAmount: number;
+    /** Required. `sats` for cashu, `usdc` for the stablecoin rails. */
+    nativeAsset: "sats" | "usdc";
+    /** Where it landed; `null` for a melt, whose Lightning destination the platform never records. */
+    recipient: string | null;
+    /** Mechanism references — mint, melt quote, tx hash, batch id, voucher count, channel id. Description material, never arithmetic. */
+    refs: Record<string, unknown>;
+    /** Required. When the money landed (epoch ms). */
+    landedAt: number;
+    /** Set when a repair verb completed this movement. */
+    repaired?: boolean;
+    /** Required iff `repaired`. */
+    repairKind?: PayoutRepairKind;
+}
+/** A stuck movement inside a pending snapshot. */
+interface PayoutWedge {
+    id: string;
+    /**
+     * `settle`: an x402 batch whose transfer keeps failing (auto-retried).
+     * `refund`: an x402 cooperative refund wedged between chain and ledger —
+     * caller money, not in the pool. `close`: a Tempo close wedged the same way.
+     * `melt`: cashu rows whose builder-side melt failed.
+     */
+    kind: "settle" | "refund" | "close" | "melt";
+    /** Epoch ms the wedge was first observed. */
+    since: number;
+    /** Retry count where the retry is automatic, else null. */
+    attempts: number | null;
+    /** Epoch ms of the next automatic retry, else null. */
+    nextRetry: number | null;
+    lastError: string | null;
+    /** Rail-native amount held up, when known. */
+    native?: number;
+}
+/** One pool inside a rail's pending figure — a mint, a batch, a channel. */
+interface PayoutPool {
+    id: string;
+    native: number;
+    label?: string;
+}
+/**
+ * JSON wire shape POSTed to the platform's `/_internal/payout-pending`
+ * endpoint — one rail's snapshot of money still moving toward the builder,
+ * replaced on each report. Best-effort: a lost one is superseded by the next
+ * tick, so it rides no durable queue.
+ */
+interface PayoutPendingPayload {
+    dvmId: string;
+    rail: PayoutRail;
+    /** Everything on this rail still moving toward the builder, in atomic units. */
+    poolNative: number;
+    nativeAsset: "sats" | "usdc";
+    /** How many pools the figure is made of. */
+    items: number;
+    pools: PayoutPool[];
+    wedged: PayoutWedge[];
+    /** This DVM's clock when the snapshot was taken (epoch ms). */
+    snapshotAt: number;
+}
+/** The delivery seam — implemented by `RevenueReporter`, stubbed in tests. */
+interface PayoutTransport {
+    /**
+     * Queue a payout through the caller's open transaction, so the row and the
+     * fact it reports commit or roll back together; without `tx` it is queued on
+     * its own. Durable once committed — the retry loop delivers it, or
+     * {@link PayoutTransport.drainPending} when a caller wants it now.
+     */
+    enqueuePayout(payload: PayoutReportPayload, tx?: RevenueReporterQuerier): Promise<void>;
+    /** Queue a payout on its own and try to deliver it at once. */
+    reportPayout(payload: PayoutReportPayload): Promise<void>;
+    /** Best-effort: one POST, replaced by the next snapshot. */
+    reportPayoutPending(payload: PayoutPendingPayload): Promise<void>;
+    /** Deliver what is queued now rather than on the next retry tick. */
+    drainPending?(): Promise<void>;
+}
+/**
+ * A money-path hook whose report must commit with the fact it describes.
+ * `enqueue` runs inside the caller's transaction, and a throw rolls the fact
+ * back with it — the drain report's own discipline (internal-review): a call the
+ * caller has to repeat costs a round trip, where a landed movement with no
+ * row understates paid-out forever. `committed` runs once that transaction
+ * has committed, for the delivery and the snapshot that must not read
+ * uncommitted state.
+ */
+interface TransactionalPayoutHook<E> {
+    enqueue(event: E, tx: RevenueReporterQuerier): Promise<void>;
+    committed(): void;
+}
+/** What `/admin/cashu/mark-melted` knows once the rows are marked. */
+interface CashuMeltCompleted {
+    rows: {
+        id: string;
+        mintUrl: string;
+        proofAmount: number;
+    }[];
+    meltQuoteId: string;
+    paymentPreimage: string;
+}
+/** What mppx reports after a Tempo channel settlement or close confirmed on chain. */
+interface TempoSessionSettled {
+    txHash: string;
+    channelId: string;
+    trigger: "settle" | "close" | "scheduled";
+    /** Cumulative amount settled to the payee on this channel, atomic units. */
+    amount: bigint;
+    /** Newly settled to the payee by this transaction, atomic units. */
+    delta: bigint;
+}
+/** What `reconcile-tempo-drain` re-read from the close receipt it booked against. */
+interface TempoCloseReconciled {
+    channelId: string;
+    txHash: string;
+    /** Captured by the payee — this DVM — per the receipt, atomic units as a decimal string. */
+    settledToPayee: string;
+}
+/** The channel view the tracker sums claims over. */
+interface X402TrackedChannel {
+    channelId: string;
+    chargedCumulativeAmount: string;
+    totalClaimed: string;
+}
+/** A refund settlement wedged between chain and ledger (internal-review), for the wedge list. */
+interface X402WedgedRefund {
+    settlementId: string;
+    /** Epoch ms the settlement was first prepared. */
+    createdAt: number;
+    native?: number;
+}
+/** What the batch-settlement server hands the tracker once it knows its scope. */
+interface X402PayoutContext {
+    /** `${network}|${payTo}|${token}` — the scope the settle-pending marker is keyed on. */
+    scope: string;
+    payTo: string;
+    network: string;
+    storage: {
+        list(): Promise<X402TrackedChannel[]>;
+    };
+    /** The scheduler's settle cadence — what a wedge's `nextRetry` is derived from. */
+    settleIntervalMs: number;
+    listWedgedRefunds?: () => Promise<X402WedgedRefund[]>;
+}
+/** The two manager verbs the tracker wraps. */
+interface X402TrackedManager {
+    claim(...args: never[]): Promise<{
+        vouchers: number;
+        transaction: string;
+    }[]>;
+    settle(): Promise<{
+        transaction: string;
+    }>;
+}
+/**
+ * The batch-settlement server's view of the reporter: attach once with the
+ * scope, then route every claim and settle through the tracked manager so
+ * the open batch is kept and the settle emits the payout.
+ */
+interface X402PayoutObserver {
+    attach(ctx: X402PayoutContext): void;
+    trackManager<M extends X402TrackedManager>(manager: M): M;
+    /** A settle that landed outside the tracked manager — the manual claim-and-settle's own retry loop. */
+    recordSettle(transaction: string): Promise<void>;
+    /** A settle attempt that failed outside the tracked manager. One call per attempt a builder would count as one. */
+    recordSettleFailure(error: unknown): Promise<void>;
+}
+/** The Tempo readers the host attaches after mounting. */
+interface TempoPayoutReader {
+    /** The recipient address every Tempo payout names. */
+    recipient?: string;
+    /** CAIP-2 network for the refs, when known. */
+    network?: string;
+    listActive?: (limit: number, cursor?: {
+        updatedAt: number;
+        key: string;
+    }) => Promise<{
+        key: string;
+        state: Record<string, unknown>;
+        updatedAt: number;
+    }[]>;
+    listChannelDrains?: (args: {
+        limit: number;
+        after?: ChannelDrainCursor;
+        createdBeforeMs: number;
+        rail: "tempo";
+    }) => Promise<CreditDrainRecord[]>;
+}
+/**
+ * The claims gathered since the last settle — the batch the next settle pays
+ * out. Durable across machines because claims run under the fleet lock on
+ * whichever machine won the tick, and the settle that finally moves the money
+ * may run on another: an in-process figure would report a partial amount
+ * after any restart in between.
+ */
+interface X402OpenBatch {
+    scope: string;
+    batchId: string;
+    claimedNative: bigint;
+    voucherCount: number;
+    claims: number;
+    openedAt: number;
+    attempts: number;
+    firstFailedAt: number | null;
+    lastError: string | null;
+    nextRetryAt: number | null;
+}
+/** Where the open batch lives — Postgres beside the settlement rows, or memory in dev. */
+interface X402BatchStore {
+    get(scope: string): Promise<X402OpenBatch | undefined>;
+    put(batch: X402OpenBatch): Promise<void>;
+    delete(scope: string): Promise<void>;
+    /**
+     * Close the open batch and run `enqueue` in the same transaction, so the
+     * payout row is queued exactly when the batch is gone and never otherwise:
+     * a settle can never lose its payout, because a failed enqueue leaves the
+     * batch open for the next settle to report in full. `false` when the batch
+     * under `scope` is no longer `batchId` — a sibling settled it first — in
+     * which case nothing is queued.
+     */
+    settle(scope: string, batchId: string, enqueue: (tx?: RevenueReporterQuerier) => Promise<void>): Promise<boolean>;
+}
+/** Construction options for {@link PayoutReporter}. */
+interface PayoutReporterOpts {
+    /** Platform DVM record ID, bound into every report. */
+    dvmId: string;
+    transport: PayoutTransport;
+    /**
+     * The SDK's Postgres. Reads the cashu accumulator for the pending pool and
+     * holds the open x402 batch; without it the batch lives in memory (dev) and
+     * no cashu snapshot is taken.
+     */
+    db?: Pool;
+    /**
+     * Whether this DVM runs the cashu accumulator. The cashu snapshot reads
+     * `wallet_accumulator`, which only that mode creates — on any other DVM the
+     * read would fail every tick and warn about a rail it does not carry.
+     */
+    cashu?: boolean;
+    /** Override the batch store (tests); defaults to Postgres on `db`, memory without. */
+    batchStore?: X402BatchStore;
+    /** Snapshot cadence, ms. Default 5 minutes. */
+    snapshotIntervalMs?: number;
+    /** Override for the current time (tests). */
+    now?: () => number;
+}
+/**
+ * Builds the payout and pending reports from the SDK's money paths and hands
+ * them to the transport.
+ *
+ * Two entry points are transactional: `cashuMelted` and `tempoCloseReconciled`
+ * queue their row inside the caller's transaction and throw when they cannot,
+ * so the melt or the reconciled close rolls back with its missing report rather
+ * than landing without one. The x402 settle and the pending snapshots are
+ * fail-safe instead: a report that cannot be built or queued there is logged and
+ * picked up on the next tick, never thrown into the settle that produced it.
+ */
+declare class PayoutReporter implements PayoutTransport {
+    private readonly dvmId;
+    private readonly transport;
+    private readonly db?;
+    private readonly cashu;
+    private readonly batches;
+    private readonly ownsBatchStore;
+    private readonly intervalMs;
+    private readonly now;
+    private x402?;
+    private tempo?;
+    private timer;
+    private warmup;
+    constructor(opts: PayoutReporterOpts);
+    /** Boot DDL for the durable batch store, when this reporter owns one. */
+    init(): Promise<void>;
+    /**
+     * Start the snapshot loop. Unref'd, so it never keeps a scale-to-zero
+     * machine awake; a first snapshot runs shortly after boot so a fresh process
+     * reports without waiting a whole interval.
+     */
+    start(): void;
+    stop(): void;
+    enqueuePayout(payload: PayoutReportPayload, tx?: RevenueReporterQuerier): Promise<void>;
+    reportPayout(payload: PayoutReportPayload): Promise<void>;
+    reportPayoutPending(payload: PayoutPendingPayload): Promise<void>;
+    /** Deliver what is queued now; a transport without the seam waits for its retry loop. */
+    flush(): Promise<void>;
+    /** The hook `mark-melted` runs inside its transaction: the mark and its payout commit together. */
+    meltHook(): TransactionalPayoutHook<CashuMeltCompleted>;
+    /**
+     * A melt completed: the accumulator rows are SPENT at the mint and the
+     * Lightning payment reached the builder's destination. One payout per mint
+     * in the call — a `mark-melted` normally names one, since a melt quote
+     * belongs to one mint. The amount is the face value melted; the mint's fee
+     * and the Lightning amount received are builder-machine facts this DVM does
+     * not see.
+     *
+     * Queued through `tx` when the caller is inside the transaction that marks
+     * the rows, and a failure is thrown rather than swallowed so that mark rolls
+     * back with it — see {@link TransactionalPayoutHook}. Without `tx` the rows
+     * are queued on their own and delivered at once.
+     */
+    cashuMelted(event: CashuMeltCompleted, tx?: RevenueReporterQuerier): Promise<void>;
+    /** The host attaches the session store and ledger readers once they exist. */
+    attachTempo(reader: TempoPayoutReader): void;
+    /**
+     * A Tempo channel settled or closed on chain. `delta` is what this
+     * transaction newly paid the recipient; a transaction that paid nothing new
+     * (a close of a fully settled channel) is no payout.
+     */
+    tempoSettled(event: TempoSessionSettled): Promise<void>;
+    /** The hook `reconcile-tempo-drain` runs inside its transaction: the booking and its payout commit together. */
+    tempoRepairHook(): TransactionalPayoutHook<TempoCloseReconciled>;
+    /**
+     * The operator repaired a wedged cooperative close (internal-review). The close's
+     * payee side landed on chain when the close did; if the live hook reported
+     * it, this upgrades that row to `repair`, otherwise it is the row. The
+     * figure is the receipt's payee total for the channel.
+     *
+     * Queued through `tx` when the caller is inside the transaction that books
+     * the drain, and thrown rather than swallowed so that booking rolls back
+     * with it — see {@link TransactionalPayoutHook}.
+     */
+    tempoCloseReconciled(event: TempoCloseReconciled, tx?: RevenueReporterQuerier): Promise<void>;
+    /** The observer the batch-settlement server attaches to and routes its manager through. */
+    x402Observer(): X402PayoutObserver;
+    /**
+     * Wrap the upstream channel manager so every claim grows the open batch and
+     * every settle closes it. The claim delta is read off storage rather than
+     * off upstream's result, which carries only a voucher count; under the
+     * fleet lock the before/after read is consistent. A channel the claim
+     * removed on its way through — a refund's claim-then-delete (internal-review) —
+     * moved whatever it still owed before it went, and that value reaches
+     * `pay_to` in this batch too, so it counts at its pre-claim figure.
+     */
+    private trackX402Manager;
+    private recordX402Claim;
+    private recordX402Settle;
+    private recordX402SettleFailure;
+    /** Every rail this reporter can read, each on its own failure boundary. */
+    snapshot(): Promise<void>;
+    /**
+     * Cashu: every unmelted proof in the accumulator, per mint. Rows whose
+     * builder-side melt failed are still in the pool (they are still at the
+     * mint) and listed as wedged until `restart-failed` clears them.
+     */
+    snapshotCashu(): Promise<void>;
+    /**
+     * x402: the open batch (claimed, not yet transferred) plus every channel's
+     * unclaimed voucher value; wedged when the settle keeps failing, and the
+     * refund settlements stuck between chain and ledger beside it.
+     */
+    snapshotX402(): Promise<void>;
+    /**
+     * Tempo: each active channel's spent-but-unsettled balance — earned, not
+     * yet paid to the recipient — and the cooperative closes wedged between
+     * chain and ledger (internal-review), aged past the same floor the repair queue
+     * uses so an in-flight close is not reported as stuck.
+     */
+    snapshotTempo(): Promise<void>;
+}
 
+/**
+ * JSON wire shape POSTed to the platform's `/_internal/job-revenue` endpoint
+ * and stored in `pending_revenue_reports.payload` for durable retry.
+ *
+ * The platform-side consumer is `OnJobCompleted`, implemented by
+ * `createRevenueCallback`. Keep the two shapes in sync: the SDK and platform
+ * deploy in lockstep, and any
+ * backwards-incompatible field change requires a coordinated release. No `version`
+ * field is included pre-launch because there are no external container-runtime
+ * consumers yet; add one once the first third-party builder ships a container-runtime
+ * DVM (trigger condition: external builder onboarded via `dvmctl deploy --container`).
+ */
+interface RevenueReportPayload {
+    /** Required. Platform DVM record ID (`dvms.id`). Identifies which DVM earned the revenue. */
+    dvmId: string;
+    /** Required. Job identifier used by the platform to de-duplicate revenue rows and link to the job record. */
+    jobId: string;
+    /** Required. Total amount paid by the caller in millisatoshis, across all credits that satisfied the job. */
+    paidMsats: number;
+    /** Optional. Cashu mint URL from which the payment tokens were issued. Set only for the `cashu` rail; omitted for all other rails. */
+    paymentMint?: string;
+    /**
+     * Required. Payment rail identifier (`"cashu"`, `"tempo"`, `"x402"`, `"stripe"`).
+     * Mirrors `PaymentMethod` on the platform; carried as a plain string over the wire
+     * so the SDK has no platform-type dependency.
+     */
+    rail: string;
+    /**
+     * Optional. Settlement reference for the credit: EVM tx hash for `x402`, credential
+     * challenge ID for `tempo`, `X-Cashu-Request-Id` UUID for `cashu`. Required by the
+     * platform revenue ledger for `tempo`/`x402` rails (recordJobRevenue throws without it);
+     * nullable for `cashu`.
+     */
+    paymentTxHash?: string;
+    /**
+     * Optional. Rail-native payment amount in atomic units: satoshis for `tempo`, USDC
+     * microunits for `x402`, USD cents for `stripe`. Omitted for `cashu` (platform derives
+     * `paidMsats / 1000`). Must be set together with `nativeAsset`.
+     */
+    nativeAmount?: number;
+    /**
+     * Optional. Asset tag paired with `nativeAmount`: `"sats"`, `"usdc"`, `"usdc.e"`, or
+     * `"usd-cents"`. Both fields must be present for the platform to write a non-cashu
+     * revenue row.
+     */
+    nativeAsset?: string;
+    /**
+     * Optional. Cashu flow discriminator. Set to `"p2pk_accumulator"` when the cashu
+     * accumulator path (internal-review) satisfied the job; omitted for legacy cashu. Written into
+     * `revenue_events.metadata.cashu_flow` by the platform so ops can split per-call cashu
+     * rows by source.
+     */
+    cashuFlow?: string;
+    /**
+     * Optional. Credit this job's payment drew against (internal-review). Present on
+     * every job a ledger-backed payment satisfied; its presence is what tells
+     * the platform the row is a **draw-keyed** revenue event rather than a
+     * pre-credits per-call one.
+     */
+    creditId?: string;
+    /** Optional. The draw this job settled — one draw, one revenue row. */
+    drawId?: string;
+    /** Optional. The draw's fiat amount, 1e-6 of `creditCurrency`. The exact liability offset. */
+    drawAmountMicro?: number;
+    /** Optional. Currency the credit is denominated in (lowercase ISO, e.g. `usd`). */
+    creditCurrency?: string;
+    /**
+     * Optional. Settlement instant (epoch ms) — draws are revenue *when they
+     * settle*, so this dates the row. Omitted for pre-credits rows, which the
+     * platform dates at record time as before.
+     */
+    settledAt?: number;
+    /** Optional. The funding's own rail reference, for reconciling a draw back to its deposit. */
+    fundingRef?: string;
+    /**
+     * Optional. Revenue class when this row is not ordinary service revenue.
+     * `short_pay_forfeit` marks money kept from an underpayment that bought no
+     * job (internal-review operator ruling) so analytics can exclude it.
+     */
+    kind?: string;
+}
 /**
  * JSON wire shape POSTed to the platform's `/_internal/credit-deposit`
  * endpoint (internal-review). A funding event is a **deposit** — a liability until
@@ -855,6 +1776,14 @@ interface CreditDepositPayload {
         /** 32-byte channel id, `0x`-prefixed and lowercased. */
         channelId: string;
     };
+    /**
+     * Set by the blocked-invoice repair (internal-review): this deposit is a paid
+     * Lightning invoice the builder's agent reconciled onto a credit. The money
+     * landed in the receive wallet at payment time and this deposit is the one
+     * row it gets, so the settlements table types it `repair` off this flag
+     * rather than off a second row.
+     */
+    repaired?: boolean;
 }
 /**
  * JSON wire shape POSTed to the platform's `/_internal/credit-draw-release`
@@ -944,6 +1873,94 @@ type CreditDrawReleaseEnqueue = (tx: RevenueReporterQuerier, payload: CreditDraw
  * it before committing the status CAS that moved the money.
  */
 type CreditDrainEnqueue = (tx: RevenueReporterQuerier, payload: CreditDrainPayload) => Promise<void>;
+/**
+ * JSON wire shape POSTed to the platform's `/_internal/credit-expiry-release`
+ * endpoint (internal-review). A prepaid credit that reaches its TTL with an undrawn
+ * remainder RELEASES that remainder to the builder: on cashu, Lightning and
+ * x402 the funding value reached builder custody at funding time or on the
+ * settlement cycle, so expiry extinguishes the caller's remaining claim.
+ * Reported so committed value nets to
+ * `deposited − drawn − drained − released`; without it an expired credit is
+ * owed forever on paper, exactly like an unreported drain.
+ *
+ * Never sent for a Tempo credit. Tempo balances are channel-backed and undrawn
+ * channel value returns to the *caller* at exit, so no release exists on that
+ * rail — the sweep skips them and the platform refuses one outright.
+ *
+ * Two reports share this shape, distinguished only by `reversedAt`:
+ *
+ * - **The release**, written by the expiry sweep with `reversedAt` absent.
+ * - **The reversal**, written when a later funding revives the credit
+ *   (`CreditLedger.fund` overwrites `expiry_ms`, so the recorded remainder is
+ *   no longer final). It repeats the whole payload rather than sending a
+ *   reference, because the retry loop can deliver the two out of order and the
+ *   platform's upsert must be able to land either one first.
+ *
+ * Idempotent on `(dvmId, creditId, releaseId)`, so the shared retry loop can
+ * redeliver freely.
+ */
+interface CreditExpiryReleasePayload {
+    /** Required. Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
+    dvmId: string;
+    /** Required. Credit whose remainder expired. */
+    creditId: string;
+    /** Required. Per-expiry-episode key; the platform idempotency key with DVM and credit. */
+    releaseId: string;
+    /** Required. Caller whose claim on the remainder ended. */
+    callerPubkey: string;
+    /** Funding rail. `null` on a credit funded before the basis became mandatory. */
+    rail: string | null;
+    /** Required. Fiat micro released — the liability this expiry extinguishes. */
+    amountMicro: number;
+    /** Required. Currency `amountMicro` is 1e-6 of. */
+    creditCurrency: string;
+    /** Required. When the credit's TTL ran out (epoch ms) — when the liability ended. */
+    expiryMs: number;
+    /** Required. When the sweep observed the expiry (epoch ms). */
+    releasedAt: number;
+    /** Set only on the reversal report: when the revival funding landed (epoch ms). */
+    reversedAt?: number | null;
+}
+/**
+ * Transactional expiry-release outbox seam, threaded through the sweep's insert
+ * and through the funding that reverses a release (internal-review).
+ *
+ * Implemented by {@link RevenueReporter.enqueueCreditExpiryRelease}; callers
+ * must await it before committing the write that made the release (or its
+ * reversal) true, for the same reason the drain seam does — a report lost
+ * between the two overstates or understates committed value forever.
+ */
+type CreditExpiryReleaseEnqueue = (tx: RevenueReporterQuerier, payload: CreditExpiryReleasePayload) => Promise<void>;
+/**
+ * JSON wire shape POSTed to the platform's `/_internal/paid-job-death` endpoint
+ * (internal-review) when the stale-job reaper force-fails a *paid* job — its pending
+ * credit draw is released rather than settled, so the caller's payment is back
+ * on their credit balance and reclaimable by drain. The platform resolves fiat
+ * + owner and sends an ambient notice via the shared alert sink. Unlike
+ * {@link RevenueReportPayload} this carries no durable-retry semantics: the
+ * reaper's `stale_job_failed` structured log is the durable backstop, so a lost
+ * report degrades to log-only rather than blocking the sweep.
+ */
+interface PaidJobDeathPayload {
+    /** Required. Platform DVM record ID (`dvms.id`). Bound to the authenticating token. */
+    dvmId: string;
+    /** Required. Job identifier the reaper force-failed. */
+    jobId: string;
+    /** Required. Capability the job dispatched to (e.g. `"add-episode"`). */
+    capability: string;
+    /** Required. Amount of the released credit draw in millisatoshis. */
+    paidMsats: number;
+    /** Required. Payment rail of the credit draw (`"cashu"` / `"tempo"` / `"x402"`). */
+    rail: string;
+    /** Required. Terminal reason the reaper set: dead worker vs never-terminal idle. */
+    reason: string;
+    /** Optional. Rail-native released amount, paired with `nativeAsset`. */
+    nativeAmount?: number;
+    /** Optional. Asset tag for `nativeAmount` (`"sats"` / `"usdc"` / …). */
+    nativeAsset?: string;
+    /** Optional. Cashu mint URL the credit draw's tokens were issued from. */
+    paymentMint?: string;
+}
 /** Distinct causes for a settled credit draw that could not book revenue. */
 type RevenueSkippedNoRailReason = "credit_rail_null" | "credit_rail_unrecognized" | "job_rail_missing" | "ledger_not_configured";
 /**
@@ -973,6 +1990,210 @@ interface RevenueSkippedNoRailPayload {
     /** Required classification of why the revenue rail was unavailable. */
     reason: RevenueSkippedNoRailReason;
 }
+/** Gas-balance observation POSTed by a platform-hosted x402 self-relay. */
+interface X402SelfRelayGasBalancePayload {
+    /** Platform DVM record ID, bound to the authenticating platform token. */
+    dvmId: string;
+    /** Dedicated relay EOA whose Base ETH balance was read. */
+    address: `0x${string}`;
+    /** CAIP-2 Base network identifier. */
+    network: string;
+    /** Current native balance as a decimal wei string. */
+    balanceWei: string;
+    /** Configured paging floor as a decimal wei string. */
+    lowBalanceWei: string;
+    /** Millisecond timestamp at which the DVM read the balance. */
+    checkedAt: number;
+}
+/** RPC-health transition POSTed by a platform-hosted x402 self-relay. */
+type X402SelfRelayRpcHealthPayload = {
+    /** Platform DVM record ID, bound to the authenticating platform token. */
+    dvmId: string;
+    /** Dedicated relay EOA identifying the affected self-relay. */
+    address: `0x${string}`;
+    /** CAIP-2 Base network identifier. */
+    network: string;
+    /** Healthy transition clears an open RPC page. */
+    status: "healthy";
+    /** Millisecond timestamp at which the DVM observed the transition. */
+    checkedAt: number;
+} | {
+    /** Platform DVM record ID, bound to the authenticating platform token. */
+    dvmId: string;
+    /** Dedicated relay EOA identifying the affected self-relay. */
+    address: `0x${string}`;
+    /** CAIP-2 Base network identifier. */
+    network: string;
+    /** Failed transition opens or refreshes an RPC page. */
+    status: "failed";
+    /** Redacted failure class; never the provider error or endpoint URL. */
+    reason: X402SelfRelayRpcFailureReason;
+    /** Millisecond timestamp at which the DVM observed the transition. */
+    checkedAt: number;
+};
+/** Configured Tempo operator fee-token balance POSTed by a hosted DVM. */
+interface TempoSettlementBalancePayload {
+    dvmId: string;
+    address: `0x${string}`;
+    network: string;
+    token: `0x${string}`;
+    balanceMicro: string;
+    lowBalanceMicro: string;
+    checkedAt: number;
+    ready: boolean;
+}
+/** Redacted Tempo operator fee-funding rejection POSTed by a hosted DVM. */
+interface TempoSettlementFailurePayload {
+    dvmId: string;
+    address: `0x${string}`;
+    network: string;
+    token: `0x${string}`;
+    operation: "settle" | "close";
+    errorClass: "InsufficientFundsError";
+    checkedAt: number;
+    balanceMicro?: string;
+    channelId?: string;
+    creditId?: string;
+    drainId?: string;
+}
+/**
+ * Durable revenue reporter for container-runtime DVMs (internal-review).
+ *
+ * On job completion the SDK calls `report()`, which persists the payload to
+ * a local Postgres table and attempts an immediate POST to the platform.
+ * A background retry loop picks up un-acked rows with exponential backoff.
+ */
+declare class RevenueReporter {
+    private readonly db;
+    private readonly platformUrl;
+    private readonly platformToken;
+    private retryTimer;
+    private static readonly RETRY_INTERVAL_MS;
+    private static readonly MAX_BACKOFF_MS;
+    private static readonly ABANDON_AFTER_MS;
+    constructor(db: Pool, platformUrl: string, platformToken: string);
+    /** Create the pending-reports table (idempotent). */
+    init(): Promise<void>;
+    /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+    private createTables;
+    /** Persist a revenue report and attempt immediate delivery. */
+    report(payload: RevenueReportPayload): Promise<void>;
+    /**
+     * Join a credit deposit to the caller-owned rail transaction.
+     *
+     * This method performs no network I/O: it only writes the reporter-owned
+     * durable queue row through `tx`. The retry drain delivers the row after the
+     * rail transaction commits, including after a process restart.
+     */
+    enqueueDeposit(tx: RevenueReporterQuerier, payload: CreditDepositPayload): Promise<void>;
+    /** Join a released draw to the transaction that made the hold terminal. */
+    enqueueCreditDrawRelease(tx: RevenueReporterQuerier, payload: CreditDrawReleasePayload): Promise<void>;
+    /**
+     * Join a credit drain to the transaction that made it terminal (internal-review).
+     *
+     * Same discipline as {@link enqueueDeposit} and the same reason: no network
+     * I/O here, only the durable queue row, written through `tx` so the report
+     * and the status CAS commit or roll back together. A drain whose row was
+     * lost between the two would overstate outstanding liability forever —
+     * the mirror image of a lost deposit.
+     *
+     * Named for the payload rather than the verb because `drain` already means
+     * "flush the queue" in this class (see {@link drainPending}).
+     */
+    enqueueCreditDrain(tx: RevenueReporterQuerier, payload: CreditDrainPayload): Promise<void>;
+    /**
+     * Join a payout to the transaction that commits the movement it reports
+     * (internal-review) — the batch close, the accumulator mark, the drain booking.
+     * No network I/O, only the durable queue row through `tx`, the discipline
+     * {@link enqueueCreditDrain} set and for the same reason: the money has
+     * already moved on a rail this ledger does not own, so the platform row is
+     * the only record the builder's dashboard has of it, and a row lost between
+     * the fact and the queue would understate "paid out" forever. Without `tx`
+     * the row is queued on the pool, for callers with no fact of their own to
+     * commit. Idempotent on `(dvmId, payoutId)` platform-side, so the retry
+     * loop redelivers freely.
+     */
+    enqueuePayout(payload: PayoutReportPayload, tx?: RevenueReporterQuerier): Promise<void>;
+    /**
+     * Report one landed payout on its own and try to deliver it at once — the
+     * live Tempo settlement, which has no dvmkit transaction to join. Durable
+     * like {@link report}.
+     */
+    reportPayout(payload: PayoutReportPayload): Promise<void>;
+    /**
+     * Report one rail's pending-pool snapshot (internal-review). Best-effort and
+     * fire-and-forget, deliberately unlike {@link reportPayout}: a snapshot is
+     * replaced by the next tick, so queueing a stale one behind an outage would
+     * only deliver figures the platform already has newer ones for.
+     */
+    reportPayoutPending(payload: PayoutPendingPayload): Promise<void>;
+    /**
+     * Join a credit-expiry release — or the revival that reverses one — to the
+     * transaction that made it true (internal-review).
+     *
+     * Same discipline as {@link enqueueCreditDrain}: no network I/O, only the
+     * durable queue row written through `tx`. A release whose row was lost after
+     * the sweep committed would understate committed value forever; a lost
+     * reversal would overstate it, which is the worse direction — the builder
+     * would see money as theirs that a revived credit can still buy work with.
+     */
+    enqueueCreditExpiryRelease(tx: RevenueReporterQuerier, payload: CreditExpiryReleasePayload): Promise<void>;
+    /**
+     * Report a reaper-force-failed paid job to the platform (internal-review) so the
+     * operator receives an ambient notice that a DVM died or wedged mid-job.
+     * Best-effort and fire-and-forget: unlike {@link report} there is no local
+     * durable queue — a non-2xx or transport failure is structured-logged
+     * (`paid_job_death_report_failed`) and dropped, since the reaper's own
+     * `stale_job_failed` log is the durable record and a failed *alert* must never
+     * wedge the sweep.
+     */
+    reportPaidJobDeath(payload: PaidJobDeathPayload): Promise<void>;
+    /**
+     * Report a settled draw whose revenue event was skipped (internal-review).
+     * Best-effort and fire-and-forget: the SDK's structured
+     * `revenue_skipped_no_rail` log is the durable backstop, so a failed notice
+     * must never wedge terminal handling or the orphan-draw reconciler.
+     */
+    reportRevenueSkippedNoRail(payload: RevenueSkippedNoRailPayload): Promise<void>;
+    /** Report the self-relay's Base gas gauge for platform-side paging and recovery. */
+    reportX402SelfRelayGasBalance(payload: X402SelfRelayGasBalancePayload): Promise<void>;
+    /** Report redacted self-relay RPC health for platform-side paging and recovery. */
+    reportX402SelfRelayRpcHealth(payload: X402SelfRelayRpcHealthPayload): Promise<void>;
+    /** Report the Tempo operator's fee-token gauge for paging and recovery. */
+    reportTempoSettlementBalance(payload: TempoSettlementBalancePayload): Promise<void>;
+    /** Report a redacted operator fee rejection immediately. */
+    reportTempoSettlementFailure(payload: TempoSettlementFailurePayload): Promise<void>;
+    private postTempoSettlementReadiness;
+    /** Start the background retry loop. */
+    startRetryLoop(): void;
+    /** Stop the background retry loop. */
+    stop(): void;
+    /**
+     * Operator-facing queue snapshot: distinguishes the live retry queue from
+     * terminal (stale) rows and breaks the latter down by classification reason
+     * (`token_rotated`, `client_error:<status>`, `abandoned`). Lets monitoring tell
+     * transient backlog apart from permanently-failed rows.
+     */
+    getQueueStats(): Promise<{
+        liveRetry: number;
+        stale: number;
+        byReason: Record<string, number>;
+    }>;
+    /**
+     * Deliver one bounded batch from the durable queue.
+     *
+     * Public so startup/recovery tests and operator tooling can drive the same
+     * drain the background timer uses without reaching into private state.
+     */
+    drainPending(): Promise<void>;
+    /** Durably queue one report of either kind, then try it once immediately. */
+    private enqueue;
+    /** Insert one pending report through either the pool or an open transaction. */
+    private insertPending;
+    private attemptDelivery;
+    /** Mark a pending row terminal (stale) with a classification reason. */
+    private markStale;
+}
 
 /** Query surface shared by the pool and an open Postgres transaction. */
 type X402ChannelQuerier = Pick<Pool, "query">;
@@ -992,8 +2213,8 @@ interface X402SettlementIntent {
     operation: "fund" | "refund";
     effectId: string;
     paymentId: string;
-    payload: PaymentPayload;
-    requirements: PaymentRequirements;
+    payload: PaymentPayload$1;
+    requirements: PaymentRequirements$1;
     channelBefore: Channel;
     /**
      * The channel as it stood when the settlement was handed to the facilitator —
@@ -1012,7 +2233,7 @@ interface X402SettlementIntent {
     submissionBlock?: string;
     pendingId?: string;
     status: X402SettlementStatus;
-    response?: SettleResponse;
+    response?: SettleResponse$1;
     /** Epoch ms the row was first prepared. */
     createdAt: number;
     /** Epoch ms of the last status write — what the repair queue ages against. */
@@ -1279,7 +2500,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      * reversed. On the live path the columns are already `NULL` and this is a
      * no-op.
      */
-    recordSettlementResponse(settlementId: string, response: SettleResponse): Promise<void>;
+    recordSettlementResponse(settlementId: string, response: SettleResponse$1): Promise<void>;
     /**
      * Mark the external settlement and ledger effect complete in the active transaction.
      *
@@ -1366,15 +2587,15 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
 
 /** Durable channel seam used to compose a settled draw with consumed Tempo value. */
 interface TempoSessionSettlementStore {
-    withDrawPlacement<value>(channelId: string, operation: (tx: CreditLedgerQuerier, lifecycle: TempoSessionLifecycle) => Promise<value>, tx?: CreditLedgerQuerier): Promise<value>;
-    withTerminalConsumption<value>(channelId: string, operation: (tx: CreditLedgerQuerier, lifecycle: TempoSessionLifecycle) => Promise<{
+    withDrawPlacement<value>(channelId: string, operation: (tx: CreditLedgerQuerier, lifecycle: TempoSessionLifecycle$1) => Promise<value>, tx?: CreditLedgerQuerier): Promise<value>;
+    withTerminalConsumption<value>(channelId: string, operation: (tx: CreditLedgerQuerier, lifecycle: TempoSessionLifecycle$1) => Promise<{
         value: value;
         amount: bigint;
         consume: boolean;
     }>): Promise<value>;
 }
 /** Tempo channel state read while holding its durable row lock. */
-interface TempoSessionLifecycle {
+interface TempoSessionLifecycle$1 {
     finalized: boolean;
     closeRequestedAt: bigint;
     spent: bigint;
@@ -1451,6 +2672,7 @@ declare class CreditLedger {
      */
     readonly durable = true;
     private x402Settlements?;
+    private expiryReleaseOutbox?;
     constructor(pool: CreditLedgerPool, tempoSessionStore?: TempoSessionSettlementStore | undefined);
     /**
      * Bind the durable x402 settlement state this ledger gates spending on
@@ -1462,6 +2684,22 @@ declare class CreditLedger {
      * channel storage, where no settlement row can exist to wedge.
      */
     useX402SettlementGate(gate: X402RefundSettlementGate): void;
+    /**
+     * Bind the durable outbox that reports credit-expiry releases and their
+     * revivals to the platform (internal-review).
+     *
+     * Held on the ledger rather than threaded through {@link fund} for the same
+     * reason as the gate above: the revival half fires from *every* funding path
+     * — Cashu commit, x402 exact and channel, Tempo, the Lightning invoice
+     * settle, the implicit N=1 per-call payment — and a seam each of those has to
+     * remember to pass is a seam one of them will eventually forget.
+     *
+     * Unbound (a `dvmctl dev` server, a self-hosted builder, a test host) the
+     * sweep and the reversal still run and still write the ledger's own rows;
+     * only the platform report is skipped. Reporting is bookkeeping and must
+     * never gate the ledger.
+     */
+    useCreditExpiryReleaseOutbox(outbox: CreditExpiryReleaseOutbox): void;
     /** Create the `credits` / `credit_draws` tables if absent. Call once at SDK boot. */
     init(): Promise<void>;
     /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
@@ -1499,9 +2737,15 @@ declare class CreditLedger {
      *
      * Pass `tx` (a client inside a caller-owned `BEGIN`) to commit the rail
      * receive and the ledger credit atomically (spec condition 3 — the internal-review
-     * verifier does this). The ledger issues **no** transaction control on `tx`;
-     * the upsert is a single statement, so without `tx` it is equally atomic on
-     * the pool.
+     * verifier does this). The ledger issues **no** transaction control on `tx`.
+     *
+     * Without `tx` it opens one of its own, because a funding is no longer a
+     * single statement: it upserts the credit, records its funding lot
+     * (internal-review), and reverses any standing expiry release (internal-review) — and that
+     * last leg restores balance and queues a report. A crash between the upsert
+     * and the reversal would leave a revived credit whose release still stands,
+     * which the sweep's own exclusion then makes permanent: `balance_micro > 0`
+     * but a standing release means it is neither drainable nor re-releasable.
      *
      * `basis` records the rail value behind the fiat (internal-review) so each draw can
      * be allocated its share of the rail-native amount actually received. A
@@ -1538,21 +2782,110 @@ declare class CreditLedger {
      * below. This method is the authority on that rule, as it is on the binding
      * rules above; every door preflights it where a refusal is still free.
      */
-    fund(args: {
-        /** Omit to mint a fresh credit id; provide to top up (or idempotently create). */
-        creditId?: string;
-        callerPubkey: string;
-        /** The DVM's pricing currency; `amountMicro` is 1e-6 of it. */
-        currency: string;
-        amountMicro: number;
-        /** Absolute expiry, ms since epoch. Overwrites the previous value on top-up. */
-        expiryMs: number;
-        /** Rail-value basis this funding contributes (internal-review, required by internal-review). */
-        basis: CreditFundingBasis;
-        /** External transaction handle — caller owns BEGIN/COMMIT (spec condition 3). */
-        tx?: CreditLedgerQuerier;
+    fund(args: CreditFundArgs): Promise<CreditSnapshot>;
+    /**
+     * The funding itself, on whichever handle {@link fund} chose. Every refusal
+     * it raises is the caller's to see unchanged; a self-opened transaction rolls
+     * back around it.
+     */
+    private fundOn;
+    /**
+     * Undo any expiry release this credit still carries, because a funding just
+     * landed on it (internal-review — the revival rule), restoring the balance the
+     * release took.
+     *
+     * A release records the credit's **final** undrawn remainder and zeroes it
+     * (see {@link releaseExpiredCreditLocked}). Funding adds to the balance and
+     * overwrites `expiry_ms` (spec §5 carry-forward: the credit is a rolling
+     * buffer), so the moment money arrives the recorded remainder is no longer
+     * final: the release stops counting and its micro come back.
+     *
+     * Deliberately unconditional on the incoming expiry rather than gated on
+     * `expiryMs > nowMs`. A release exists only for a credit that had already
+     * lapsed, so any funding that reaches one is money the release did not
+     * account for — and a funding that arrives with an already-past expiry leaves
+     * a credit the very next sweep re-releases at its new, larger remainder. One
+     * rule, self-healing in both directions, and it never needs to read the
+     * pre-funding expiry the upsert has already overwritten.
+     *
+     * Runs on the funding's own handle — which {@link fund} now guarantees is a
+     * transaction — so the reversal, the restored balance and the report commit
+     * with the money or not at all. A reversal that committed without its report
+     * would be unrecoverable: `WHERE reversed_at IS NULL` means no later pass
+     * re-derives it.
+     *
+     * @returns the credit row as the restore left it, or undefined when there was
+     *   nothing to reverse. The caller reads its snapshot off this rather than off
+     *   the funding upsert's `RETURNING`, which predates the restore.
+     */
+    private reverseExpiryReleases;
+    /**
+     * Release the undrawn remainder of every credit whose TTL has run out
+     * (internal-review). Returns the releases this pass recorded.
+     *
+     * **What is released.** The credit's whole `balance_micro`. Expiry ends
+     * spending but never ownership of the record, so the balance stays readable;
+     * what ends is the caller's claim on it, and on the prepaid rails the value
+     * behind it is already in builder custody.
+     *
+     * **Tempo is excluded**, at both of its markers (`tempo_channel_id` and a
+     * `tempo` rail). A Tempo credit is channel-backed and its undrawn value
+     * returns to the *caller* at channel exit, so releasing it would book the
+     * builder money the chain is about to hand back.
+     *
+     * **A credit with a pending hold is skipped, not partially released.** A draw
+     * placed before expiry stays settleable afterwards (`draw`'s replay lookup
+     * runs above the expiry check, so a lost response is still recoverable), so
+     * the remainder is not final while a hold is outstanding. Skipping costs one
+     * sweep interval and keeps the released figure exactly "what nothing bought";
+     * holds do resolve — the orphan-draw watchdog (internal-review) is what guarantees
+     * a stranded one still reaches a terminal state.
+     *
+     * **Idempotent** two ways. `release_id` is derived from the expiry instant,
+     * so a re-sweep after a crash between the insert and its report collides on
+     * the same primary key instead of writing a second row; and the candidate
+     * scan excludes any credit that already has an un-reversed release.
+     *
+     * Each candidate is re-checked under the credit row lock every
+     * `credit_draws` write is taken under, so a draw racing the sweep either
+     * loses the race (its credit is already released and it would have been
+     * refused `credit_expired` anyway) or wins it and leaves a pending hold the
+     * locked re-check sees.
+     */
+    sweepExpiredCredits(args?: {
         nowMs?: number;
-    }): Promise<CreditSnapshot>;
+        /** Credits released per pass. Bounds the work a long-idle DVM does at boot. */
+        limit?: number;
+    }): Promise<{
+        released: CreditExpiryRelease[];
+    }>;
+    /**
+     * Write one credit's expiry release under its row lock, zero the balance it
+     * released, and re-assert every condition the unlocked candidate scan tested.
+     * Returns undefined when the credit no longer qualifies — funded, drawn
+     * against, or already released between the scan and the lock.
+     *
+     * **Zeroing the balance is what makes the release real**, and it is the whole
+     * reason this runs under the lock rather than as a bare INSERT. The row alone
+     * records that the caller's claim ended; it does not *end* it. `requestDrain`
+     * has no expiry check by design (expiry gates new draws, not reclaims), so a
+     * credit whose remainder had been released and reported was still fully
+     * drainable: the DVM would pay out money the platform had already booked as
+     * the builder's, and `deposited - drawn - drained - released` would go
+     * negative on the same micro. With the balance at zero, `requestDrain`'s
+     * existing `availableMicro <= 0` guard refuses with `nothing_to_drain` and no
+     * new check is needed anywhere. {@link reverseExpiryReleases} puts the
+     * balance back when a funding revives the credit.
+     *
+     * `status` deliberately stays `active`: a released credit must remain
+     * fundable, or the revival rule has nothing to revive.
+     *
+     * The zeroed balance also takes the credit out of `BITCOIN_CREDIT_PREDICATE`
+     * (`balance_micro > 0`), so the in-kind sweep floor stops counting sats the
+     * builder no longer owes back — and counts them again after a revival, with
+     * the credit's funding lots untouched throughout.
+     */
+    private releaseExpiredCreditLocked;
     /**
      * Record this funding's in-kind basis as a lot (internal-review).
      *
@@ -2054,7 +3387,15 @@ declare class CreditLedger {
     listTempoCreditLosses(args?: {
         limit?: number;
     }): Promise<TempoCreditLoss[]>;
-    /** Retire the active credit bound to a chain-proven empty x402 channel. */
+    /**
+     * Reconcile the credit bound to a chain-proven empty x402 channel.
+     *
+     * A channel with no unclaimed backing makes every remaining customer
+     * liability unsafe, so those credits become terminal. A fully settled credit
+     * has neither a balance nor an unfinished drain and is safe to retain for a
+     * later deposit. This also repairs a zero-liability row an older build
+     * terminalized from the same observation.
+     */
     terminalizeX402Credit(evidence: X402CreditLossEvidence, tx?: CreditLedgerQuerier): Promise<X402CreditLoss[]>;
     private terminalizeX402CreditLocked;
     /** List terminal x402 credit losses, newest observation first. */
@@ -2386,6 +3727,27 @@ interface CreditLedgerLike {
      * {@link CreditLedger.useX402SettlementGate}.
      */
     useX402SettlementGate?(gate: X402RefundSettlementGate): void;
+    /**
+     * Bind the outbox that reports credit-expiry releases and their revivals
+     * (internal-review).
+     *
+     * Optional, and absent on `MemoryCreditLedger`: an expiry release is a
+     * durable liability fact, and a ledger whose balances do not survive a
+     * restart has none to report. A host on a non-durable ledger simply never
+     * sweeps. See {@link CreditLedger.useCreditExpiryReleaseOutbox}.
+     */
+    useCreditExpiryReleaseOutbox?(outbox: CreditExpiryReleaseOutbox): void;
+    /**
+     * Release the undrawn remainder of every credit past its TTL (internal-review).
+     * Optional on the same terms as the binder above. See
+     * {@link CreditLedger.sweepExpiredCredits}.
+     */
+    sweepExpiredCredits?(args?: {
+        nowMs?: number;
+        limit?: number;
+    }): Promise<{
+        released: CreditExpiryRelease[];
+    }>;
     /**
      * Ask that gate directly, so a route can refuse a wedged channel **before**
      * the rail moves anything (internal-review). Optional on the same terms as the
@@ -2641,6 +4003,38 @@ interface CreditDrawReleaseOutbox {
     /** Reporter-owned insert executed through the ledger transaction. */
     enqueue: CreditDrawReleaseEnqueue;
 }
+/** Reporter seam for credit-expiry releases and the revivals that reverse them (internal-review). */
+interface CreditExpiryReleaseOutbox {
+    /** Platform DVM record ID bound into the report. */
+    dvmId: string;
+    /** Reporter-owned insert executed through the ledger transaction. */
+    enqueue: CreditExpiryReleaseEnqueue;
+}
+/**
+ * One recorded expiry episode: a credit's undrawn remainder passing to the
+ * builder when its TTL ran out (internal-review).
+ *
+ * `reversedAt` is set when a later funding revived the credit, at which point
+ * the release stops counting against committed value — the row stays as the
+ * record that it once did.
+ */
+interface CreditExpiryRelease {
+    creditId: string;
+    /** Per-expiry-episode key, derived from {@link CreditExpiryRelease.expiryMs}. */
+    releaseId: string;
+    callerPubkey: string;
+    currency: string;
+    /** Funding rail, or `null` on a credit funded before the basis was mandatory. */
+    rail: string | null;
+    /** Fiat micro released, 1e-6 of `currency`. */
+    amountMicro: number;
+    /** When the credit's TTL ran out — when the liability ended. */
+    expiryMs: number;
+    /** When the sweep observed the expiry. */
+    releasedAt: number;
+    /** When a funding revived the credit and undid this release. */
+    reversedAt: number | null;
+}
 /** Pool-shaped handle (`query` + `connect`). Required for the locked write paths. */
 type CreditLedgerPool = Pick<Pool, "query" | "connect">;
 /**
@@ -3059,6 +4453,22 @@ interface CreditFundingBasis {
         maxClaimableAmount: string;
     };
 }
+/** What {@link CreditLedger.fund} takes. Named so the private body can share the shape. */
+interface CreditFundArgs {
+    /** Omit to mint a fresh credit id; provide to top up (or idempotently create). */
+    creditId?: string;
+    callerPubkey: string;
+    /** The DVM's pricing currency; `amountMicro` is 1e-6 of it. */
+    currency: string;
+    amountMicro: number;
+    /** Absolute expiry, ms since epoch. Overwrites the previous value on top-up. */
+    expiryMs: number;
+    /** Rail-value basis this funding contributes (internal-review, required by internal-review). */
+    basis: CreditFundingBasis;
+    /** External transaction handle — caller owns BEGIN/COMMIT (spec condition 3). */
+    tx?: CreditLedgerQuerier;
+    nowMs?: number;
+}
 /**
  * Allocate a draw's share of a credit's unspent rail value (internal-review). Pure —
  * shared by the Postgres and in-memory ledgers so the two can't drift.
@@ -3244,6 +4654,17 @@ declare class CreditLedgerError extends Error {
     constructor(code: CreditLedgerErrorCode, message: string, details?: CreditLedgerErrorDetails, opts?: ErrorOptions);
 }
 
+/** One durable Tempo session-channel row exposed to reconciliation workers. */
+interface TempoSessionRow {
+    key: string;
+    state: Record<string, unknown>;
+    updatedAt: number;
+}
+/** Cursor for stable pagination over active Tempo session channels. */
+interface TempoSessionCursor {
+    updatedAt: number;
+    key: string;
+}
 /** Durable state joining a credit drain to its cooperative channel close. */
 interface TempoSessionCloseRecord {
     channelId: string;
@@ -3261,7 +4682,212 @@ type TempoSessionCloseForecastResolution<value> = {
 } | {
     outcome: "missing";
 };
+/** The voucher increment observed while holding the channel row lock. */
+interface TempoVoucherDelta {
+    key: string;
+    cumulativeAmount: bigint;
+    priorCumulativeAmount: bigint;
+    delta: bigint;
+}
+/** Result of a ledger resolution composed with terminal channel consumption. */
+interface TempoSessionConsumption<value> {
+    value: value;
+    amount: bigint;
+    consume: boolean;
+}
+/** Channel lifecycle fields exposed while its row lock is held. */
+interface TempoSessionLifecycle {
+    finalized: boolean;
+    closeRequestedAt: bigint;
+    spent: bigint;
+    settledOnChain: bigint;
+    highestVoucherAmount: bigint;
+}
+/**
+ * Postgres implementation of mppx's atomic channel store.
+ *
+ * Every mutation takes an advisory transaction lock keyed by the channel
+ * before locking its row with `FOR UPDATE`, applies mppx's synchronous
+ * transition exactly once, and commits before returning. The advisory lock
+ * covers a channel's first write, when there is no row for `FOR UPDATE` to
+ * lock. Together these are the cross-machine linearization point for voucher,
+ * top-up, spend, and close state; mppx's process-local fallback is
+ * intentionally never used in a durable SDK host.
+ *
+ * Lock order remains channel before credit: mutation paths take the advisory
+ * lock and then the row lock, while terminal consumption requires an existing
+ * row and starts there. Both own the channel lock before the ledger takes its
+ * parent-credit lock through the same client.
+ *
+ * {@link withVoucherAcceptance} acquires its pooled client **lazily**, on the
+ * first store mutation rather than up front (internal-review). Its `operation` is
+ * mppx's credential verification, which does the chain work before it touches
+ * the store: an `open` submits the escrow transaction and awaits its receipt,
+ * a `voucher` reads channel state over public RPC. Holding a connection across
+ * that starves everything else on the shared host pool — `/v1/job`, the job
+ * store, KV, the credit ledger, the replay store — and exposes the open
+ * transaction to `idle_in_transaction_session_timeout`. This is the same shape
+ * internal-review removed from the x402 settlement path. Laziness costs nothing in
+ * atomicity: the `FOR UPDATE` row lock was always taken at the first mutation,
+ * never at `BEGIN`, so the critical section is unchanged — only the
+ * connection-holding window shrinks to the database work it actually covers.
+ */
+declare class PostgresTempoSessionStore implements Store.AtomicStore {
+    private readonly pool;
+    private readonly acceptance;
+    constructor(pool: Pool);
+    /** Create the channel table under the SDK-wide migration lock. */
+    init(): Promise<void>;
+    /** Read one channel snapshot. */
+    get(key: string): Promise<unknown>;
+    /** Replace one channel snapshot. Used by mppx only for non-RMW maintenance. */
+    put(key: string, value: unknown): Promise<void>;
+    /** Delete one channel snapshot. */
+    delete(key: string): Promise<void>;
+    /** Atomic read-modify-write using a row lock shared by every SDK replica. */
+    update<result>(key: string, fn: (current: unknown) => Store.Change<unknown, result>): Promise<result>;
+    /** Compose voucher acceptance and its ledger mutation under the channel-row lock. */
+    withVoucherAcceptance<value, result>(voucher: {
+        channelId: string;
+        cumulativeAmount: bigint;
+    }, commit: (tx: PoolClient, voucher: TempoVoucherDelta) => Promise<result>, operation: () => Promise<value>): Promise<{
+        value: value;
+        result: result | undefined;
+    }>;
+    /**
+     * Check out the acceptance transaction's client, opening it on first demand.
+     *
+     * An operation that never mutates the store therefore never takes a
+     * connection and never opens an empty transaction — the caller sees the same
+     * `result: undefined` it saw before, because nothing committed either way.
+     *
+     * The in-flight checkout is memoized, not just its result: mppx awaits each
+     * store call today, but two concurrent first mutations would otherwise open
+     * two transactions and leak the one nobody keeps a handle to.
+     */
+    private acceptanceClient;
+    /** Serialize a credit draw with the channel lifecycle that authorizes it. */
+    withDrawPlacement<value>(channelId: string, operation: (tx: CreditLedgerQuerier, lifecycle: TempoSessionLifecycle) => Promise<value>, tx?: CreditLedgerQuerier): Promise<value>;
+    private withLockedLifecycle;
+    /**
+     * Compose a terminal ledger resolution with the channel's consumed value.
+     *
+     * Voucher acceptance records spending authority; only a successful job
+     * consumes it. Holding the channel row while the callback locks and settles
+     * the credit keeps that distinction atomic across machines and preserves the
+     * shared channel -> credit lock order.
+     */
+    withTerminalConsumption<value>(channelId: string, operation: (tx: PoolClient, lifecycle: TempoSessionLifecycle) => Promise<TempoSessionConsumption<value>>): Promise<value>;
+    /** Retire lost backing while holding the channel row ahead of every credit lock. */
+    withFinalizedCreditLoss<value>(channelId: string, operation: (tx: PoolClient, lifecycle: TempoSessionLifecycle) => Promise<value>): Promise<value>;
+    /** Page active channel snapshots for the close/settlement watcher. */
+    listActive(limit?: number, cursor?: TempoSessionCursor): Promise<TempoSessionRow[]>;
+    /** Persist a drain's close intent before its credential is broadcast. */
+    beginClose(channelId: string, drainId: string): Promise<TempoSessionCloseRecord>;
+    /** Reserve a close intent and run its ledger debit in the same transaction. */
+    withCloseIntent<value>(channelId: string, drainId: string, operation: (tx: PoolClient) => Promise<value>): Promise<value>;
+    /**
+     * Resolve a reserved close's forecast under the intent row lock.
+     *
+     * `proceed` opens the broadcast gate. `release` deletes the intent and runs
+     * the ledger restore in the same transaction, but only while the gate is
+     * still pending. A concurrent proceed wins by returning `proceed` to the
+     * releaser, which must not restore value that may already be broadcasting.
+     */
+    resolveCloseForecast<value>(channelId: string, drainId: string, decision: TempoSessionCloseForecastDecision, operation?: (tx: PoolClient) => Promise<value>): Promise<TempoSessionCloseForecastResolution<value>>;
+    /** Delete a matching close intent and release its ledger debit atomically. */
+    releaseCloseIntent<value>(channelId: string, drainId: string, operation: (tx: PoolClient) => Promise<value>): Promise<value>;
+    /** Read a persisted cooperative-close intent or confirmed result. */
+    getClose(channelId: string): Promise<TempoSessionCloseRecord | null>;
+    /** Persist proof that a cooperative close reached terminal chain state. */
+    confirmClose(channelId: string, drainId: string, reference: string): Promise<TempoSessionCloseRecord>;
+    private runCloseIntentTransaction;
+    private transaction;
+    private writeCloseIntent;
+    private updateInTransaction;
+}
 
+/**
+ * Options for assembling an Mppx server handle from explicit recipient strings
+ * and the surrounding environment. The SDK boundary owns env reads so DVM
+ * authors only think in terms of "set DVMKIT_TEMPO_RECIPIENT /
+ * DVMKIT_TEMPO_SECRET_KEY in your DVM env" — same pattern as the existing
+ * payment-rail inputs.
+ */
+interface MppOpts {
+    /**
+     * Tempo recipient (0x-prefixed 40-char hex address). When set, registers
+     * `tempo/charge`. Currency defaults to USDC on Tempo mainnet; override via
+     * the `DVMKIT_TEMPO_CURRENCY` env var for testnet/devnet deployments.
+     */
+    tempoRecipient?: string;
+    /**
+     * Server realm for advertising on `/v1/info`. Default resolution lives in
+     * mppx (env vars `MPP_REALM`, `FLY_APP_NAME`, `VERCEL_URL`, request URL,
+     * `"MPP Payment"`).
+     */
+    realm?: string;
+    /**
+     * When set, only register MPP methods whose name appears in this list, even
+     * if the per-rail env var (`DVMKIT_TEMPO_RECIPIENT`) is configured
+     * (internal-review). Lets operators temporarily disable a rail without unsetting
+     * other knobs. Empty/undefined falls back to "register everything that has
+     * a configured recipient".
+     */
+    methodsAllowlist?: string[];
+    /**
+     * Durable replay protection for the one-shot `tempo/charge` method
+     * (internal-review). Omit and mppx falls back to `Store.memory()`, whose consumed
+     * transaction hashes are per-process — invisible to sibling machines and lost
+     * on restart. Pass a cross-machine store (`PostgresTempoChargeStore`) on any
+     * multi-instance deploy.
+     *
+     * The same store also backs mppx's fee-sponsor budget and, because mppx
+     * enables proof-credential replay protection only when a store is supplied,
+     * turns that guard on as a side effect.
+     */
+    tempoCharge?: {
+        store: Store.AtomicStore;
+    };
+    /**
+     * Durable TIP-1034 session support. Omit to keep the existing one-shot
+     * `tempo/charge` method only. The account must be able to submit settlement
+     * transactions as the channel payee/operator; an address-only client is not
+     * sufficient.
+     */
+    tempoSession?: {
+        store: Store.AtomicStore;
+        account: Account;
+        getClient?: (parameters: {
+            chainId?: number;
+        }) => Client | Promise<Client>;
+        chainId?: number;
+        settlementSchedule?: {
+            units?: number;
+            amount?: string | bigint;
+            intervalMs?: number;
+            /**
+             * How long a settlement holds its in-flight lease (internal-review). Defaults to
+             * {@link TEMPO_SETTLEMENT_LEASE_MS}, which documents the receipt-timeout
+             * floor an override has to stay above.
+             */
+            leaseMs?: number;
+        };
+        beforeSessionSettlement?: () => string | undefined | Promise<string | undefined>;
+        onSessionSettlement?: (context: {
+            txHash: `0x${string}`;
+            channelId: `0x${string}`;
+            trigger: "settle" | "close" | "scheduled";
+            amount: bigint;
+            delta: bigint;
+            recoveryVersion?: string;
+        }) => void | Promise<void>;
+        onInsufficientFunds?: (context: {
+            operation: "settle";
+            channelId: string;
+        }) => void | Promise<void>;
+    };
+}
 /**
  * Loose runtime view of an `Mppx.create(...)` handle. mppx's full generic
  * typing is precise but propagates badly through layers — the SDK boundary
@@ -3464,6 +5090,36 @@ interface TempoSessionDrainState {
     deposit: bigint;
     finalized: boolean;
 }
+/**
+ * Attach the typed `issueChallenge` dispatcher to a freshly-created mppx
+ * handle. Production builds via `createMppFromOpts`; tests build via
+ * `Mppx.create(...)` directly and use `wrapMppx` to satisfy the SDK boundary.
+ *
+ * Accepts `unknown` because mppx's `Mppx<methods, transport>` generic doesn't
+ * collapse cleanly through `ReturnType<typeof Mppx.create>` — the default
+ * pins `methods: readonly []` and rejects any concrete method tuple. We cast
+ * inside the wrapper instead of leaking the generic onto every caller.
+ */
+declare function wrapMppx(mppx: unknown): MppxServer;
+interface TempoSessionChainOps {
+    getChannelStatesBatch(client: Client, channelIds: readonly Hex[], escrowContract: `0x${string}`): Promise<{
+        settled: bigint;
+        deposit: bigint;
+        closeRequestedAt: number;
+    }[]>;
+    settle(store: Store.AtomicStore, client: Client, channelId: Hex, options: {
+        account: Account;
+        escrowContract: `0x${string}`;
+        feeToken: `0x${string}`;
+        onSessionSettlement?: NonNullable<MppOpts["tempoSession"]>["onSessionSettlement"];
+    }): Promise<Hex>;
+    readChannelClose(client: Client, channelId: Hex, txHash: Hex): Promise<TempoChannelCloseAmounts>;
+}
+declare function attachTempoSessionRuntime(mppx: MppxServer, config: MppOpts["tempoSession"], chainOpOverrides?: Partial<TempoSessionChainOps>): MppxServer;
+/** Test-only seams for deterministic watcher coverage without a live Tempo RPC. */
+declare const _testing: {
+    attachTempoSessionRuntime: typeof attachTempoSessionRuntime;
+};
 
 /** Envelope fields the verifier validates around the signed payload. */
 interface CanonicalEnvelope {
@@ -3575,6 +5231,28 @@ interface SignedRequestVerifier<T> {
 }
 /** Failure mode taxonomy returned from `verify()`. */
 type SignedRequestFailure = "schema_invalid" | "timestamp_drift" | "signature_invalid" | "replay_detected";
+/**
+ * The four fields every signed-request envelope carries around the payload,
+ * with the runtime type each must have once the schema has parsed.
+ *
+ * The single definition of "which part of a schema failure is the envelope's":
+ * the post-parse shape check in `parse()` iterates it, and `authErrorBody`'s
+ * internal-review classifier reads its keys to decide whether a `schema_invalid` throw
+ * is the caller's *input* being wrong (disclosable: the schema is public on
+ * `/v1/info`) or their *signing* being wrong (folded into `signature_invalid`,
+ * one answer for every key and signature failure). `satisfies` pins it to
+ * {@link CanonicalEnvelope}, so a fifth envelope field can't be added to the
+ * type without both readers picking it up.
+ */
+declare const SIGNED_ENVELOPE_TYPES: {
+    readonly pubkey: "string";
+    readonly signature: "string";
+    readonly timestamp: "number";
+    readonly nonce: "string";
+    readonly auth_statement: "object";
+};
+/** The envelope field names — {@link SIGNED_ENVELOPE_TYPES}' keys. */
+declare const SIGNED_ENVELOPE_FIELDS: readonly (keyof CanonicalEnvelope)[];
 /** Structured error from `verify()` — `sub_reason` is the failure kind. */
 declare class SignedRequestError extends Error {
     readonly sub_reason: SignedRequestFailure;
@@ -3640,6 +5318,23 @@ declare function signedRequestInput(body: {
     input?: string;
     data?: unknown;
 }): unknown;
+/**
+ * Build the bounded in-memory FIFO replay store used as the default when no
+ * cross-machine `SignedRequestReplayStore` is supplied. 10-minute retention
+ * window, 100k entry cap, per-process. Exported so `secp256k1Auth(...)` can
+ * pre-build one and share it across every per-schema verifier plus its own
+ * `recordReplay` path (internal-review).
+ *
+ * When the cap is hit after the time-expired sweep, fresh inserts are
+ * **rejected** (return `true` — treated as replay at the wire) rather than
+ * silently evicting an in-window entry. Silent eviction would flush a
+ * still-valid nonce back to "unseen" and let an attacker who can drive cap
+ * pressure replay it (internal-review). A rate-limited structured warning fires so
+ * operators see saturation in `fly logs`; reaching cap means in-memory has
+ * been pushed past where it's safe and the deploy should move to
+ * `PostgresReplayStore`.
+ */
+declare function createDefaultReplayStore(): SignedRequestReplayStore;
 
 /**
  * A DVM-level auth scheme, declared on `DVMDescriptor.auth`. Authentication
@@ -4123,6 +5818,35 @@ type PaymentMethod = "cashu" | "x402" | "tempo";
  * stops that dead rail from reappearing every time the funding menu grows.
  */
 type FundingMethod = PaymentMethod | "lightning";
+/**
+ * Whether a failed job on a given rail can return the caller's funds (internal-review).
+ *
+ * **No rail refunds on `ctx.fail`, and no code behind the idea any more.** Under
+ * the P2PK-accumulator Cashu path — the only Cashu path post-internal-review/internal-review —
+ * `verifyAccumulatorReceipt` commits the caller's proofs straight into
+ * `wallet_accumulator` and leaves `job.receivedProofs` empty; every producer in
+ * `payment.ts` returns `[]`. The `ctx.fail(err, { refund: true })` branch that
+ * used to send proofs back gated on those held proofs, so it had been an
+ * unreachable no-op for as long as the accumulator has been the commit boundary,
+ * and internal-review deleted it. This fail-closed posture was locked by internal-review
+ * (Decision C) and pinned by internal-review. mpp (Tempo) and x402 credentials are
+ * single-use, final-settlement — no SDK-managed reversal path either.
+ *
+ * **This is a rail-level question, and since internal-review it is no longer the whole
+ * story.** A failed job never debits: the draw is a hold the terminal funnel
+ * releases (`JobManager.resolveCreditDraw`), so the value stays on the caller's
+ * credit. What this flag reports is narrower and still true — no rail hands
+ * value backwards — and reclaiming a released balance runs through the
+ * internal-review `drain` op, which exists only on a DVM that advertises credit.
+ *
+ * `{ refund: true }` survives as a **caller-fault annotation only** — first-party
+ * handlers tag which errors were the caller's doing, and `sdk/testing`'s
+ * `createTestContext` exposes it — and it is not a hook waiting to be re-wired.
+ * internal-review, the accumulator-debit rewrite that would have flipped `cashu` back to
+ * `true`, was cancelled as superseded: the ledger is where reclaim lives now.
+ * x402 refund parity remains a deferred internal-review exploration.
+ */
+declare const RAIL_REFUNDABLE: Record<PaymentMethod, boolean>;
 /**
  * Cashu receive mode for builder DVMs (internal-review).
  *
@@ -5086,5 +6810,22 @@ interface OutgoingMessage {
  * that calls the member it's missing.
  */
 declare function isStreamableJobStore(store: JobStore): store is StreamableJobStore;
+/**
+ * The stale-job reaper surface (internal-review) — the two methods a sweeper needs to
+ * find and atomically reap worker-stranded jobs. A strict subset of
+ * `StreamableJobStore`: `MemoryJobStore` and `PostgresJobStore` satisfy it via
+ * the full streamable interface, and the platform's `IsolateJobStore` (a plain
+ * single-machine `JobStore`, not streamable) implements just these two so the
+ * `IsolateJobManager` reaper can sweep the `isolate_jobs` table without taking
+ * on the streaming/LISTEN machinery it doesn't need.
+ */
+interface StaleJobReapable {
+    /** See {@link StreamableJobStore.findStaleJobs}. */
+    findStaleJobs(processingThresholdMs: number, awaitingThresholdMs: number, limit: number, capabilities: string[] | null): Promise<JobRecord[]>;
+    /** See {@link StreamableJobStore.cancelStaleJob}. */
+    cancelStaleJob(jobId: string, expectedActivityBefore: number, reason: string, terminalStatus: "failed" | "cancelled"): Promise<boolean>;
+}
+/** Runtime type guard for StaleJobReapable. */
+declare function isStaleJobReapable(store: JobStore): store is JobStore & StaleJobReapable;
 
-export { type CreditSnapshot as $, type ApprovalContent as A, type SignedRequestDomain as B, type Currency as C, type DVMConfig as D, SignedRequestError as E, type SignedRequestFailure as F, type SignedRequestReplayStore as G, type SignedRequestSignOpts as H, type IncomingMessage as I, type JobRecord as J, type KVStore as K, type Logger as L, type SignedRequestStatementHeader as M, type SignedRequestVerifier as N, createSignedRequestVerifier as O, type PaymentContent as P, type QuoteConfig as Q, type ResolvedCreditConfig as R, type SDKJobContext as S, isZodSchema as T, UnsupportedCurrencyError as U, signedRequestStatementHeader as V, validateCurrency as W, type CashuMode as X, type FundingMethod as Y, type ZodLike as Z, type CreditLedgerLike as _, type DVMDescriptor as a, type OutgoingMessage as a$, type CreditInvoiceRecord as a0, type CreditDepositEnqueue as a1, type InvoiceSettlement as a2, type MppxServer as a3, type X402Config as a4, type ClientCompatibilityGate as a5, type Message as a6, type FundingReceipt as a7, type TopUpCapUnenforcedReason as a8, type JobReceipt as a9, type X402UnresolvedRefund as aA, type GrownDrawResult as aB, type DrawResolution as aC, type FundingRecord as aD, type BlockedInvoiceCursor as aE, type InvoiceReconciliation as aF, type InvoiceWriteOff as aG, type DrawRecord as aH, type StalePendingDrawCursor as aI, type TempoCreditLossEvidence as aJ, type TempoCreditLoss as aK, type X402CreditLossEvidence as aL, type X402CreditLoss as aM, type DrainMethod as aN, type DrainRequestResult as aO, type BitcoinDepositLiability as aP, type FundingLot as aQ, type CreditDrainRecord as aR, type ChannelDrainCursor as aS, type DrainWriteOff as aT, type DrainReleaseResult as aU, type DrainFulfilment as aV, type DrainTransitionResult as aW, type StreamableJobStore as aX, type ReceiptIssuingStore as aY, type RequestIdClaim as aZ, type RequestIdClaimResult as a_, type AppendOutgoingOptions as aa, StepCache as ab, type X402Receipt as ac, type X402ExactVersionSupport as ad, type X402SettlementIntent as ae, type X402FacilitatorAuth as af, type X402BatchSettlementConfig as ag, PostgresX402ChannelStorage as ah, type PaymentRequirementsV2 as ai, type CreditLedgerQuerier as aj, type X402SettlementCursor as ak, type X402SettlementStatus as al, type X402SettlementWriteOff as am, type X402RefundSettlementGate as an, type MppxCredential as ao, type ReceiptCredit as ap, type DrainReceiptEvent as aq, type DrainReceipt as ar, type CreditDrawReleaseEnqueue as as, type CreditDepositPayload as at, type RevenueSkippedNoRailPayload as au, type MessageType as av, type ClientCompatibility as aw, type CreditDrainEnqueue as ax, type DVMAuthScheme as ay, type DrawResult as az, type ArtifactContent as b, type PaymentCreditDelta as b0, type VerifyAndCreditResult as b1, type JobCounters as b2, CLIENT_COMPATIBILITY_HEADERS as b3, type ClientCompatibilityEnv as b4, type ClientCompatibilityRequirement as b5, type ClientSemVer as b6, type CreditFundingBasis as b7, type CreditInvoiceStatus as b8, CreditLedger as b9, requireClientCompatibility as bA, secp256k1Auth as bB, signedRequestInput as bC, CreditLedgerError as ba, type CreditLedgerErrorCode as bb, type CreditLedgerErrorDetails as bc, type CreditLedgerPool as bd, type CreditStatus as be, DRAIN_DELIVERY_RESERVE_SATS as bf, DVM_PROTOCOL_VERSION as bg, type DrainConflictReason as bh, type DrawRailValue as bi, type DrawStatus as bj, type ReplayStoreBackend as bk, type RevenueSkippedNoRailReason as bl, type Secp256k1AuthOpts as bm, type X402ChannelStorageOpts as bn, type X402RelayLockHolder as bo, type X402RelaySubmissionLock as bp, X402RelaySubmissionLockError as bq, allocateDrawValue as br, clientCompatibilityAttributes as bs, clientCompatibilityMiddleware as bt, clientUpgradeRequired as bu, isStreamableJobStore as bv, parseClientCapabilities as bw, parseClientCompatibility as bx, parseDvmClient as by, parseProtocolVersion as bz, type CancelContent as c, type CanonicalEnvelope as d, type CreateSignedRequestVerifierOpts as e, type CreditConfig as f, type CreditView as g, DEFAULT_CREDIT_MAX as h, DEFAULT_CREDIT_MIN as i, DEFAULT_CREDIT_TTL_SECONDS as j, type DVMRouteContext as k, type InputType as l, InvalidCurrencyError as m, type JobStatus as n, type JobStore as o, type PaymentMethod as p, type PriceValue as q, type ProgressContent as r, type PromptOpts as s, type QuoteContext as t, type QuoteResult as u, type ResponseContent as v, type SDKPaymentRequestOpts as w, SIGNED_REQUEST_AUTH_ID as x, SIGNED_REQUEST_STATEMENT_VERSION as y, type SignedRequestAudience as z };
+export { type PaymentRequired as $, type ApprovalContent as A, type SignedRequestDomain as B, type Currency as C, type DVMConfig as D, SignedRequestError as E, type SignedRequestFailure as F, type SignedRequestReplayStore as G, type SignedRequestSignOpts as H, type IncomingMessage as I, type JobRecord as J, type KVStore as K, type Logger as L, type SignedRequestStatementHeader as M, type SignedRequestVerifier as N, createSignedRequestVerifier as O, type PaymentContent as P, type QuoteConfig as Q, type ResolvedCreditConfig as R, type SDKJobContext as S, isZodSchema as T, UnsupportedCurrencyError as U, signedRequestStatementHeader as V, validateCurrency as W, type JsonValue as X, type FundingReceipt as Y, type ZodLike as Z, type JobReceipt as _, type DVMDescriptor as a, caip2ToX402Network as a$, type X402Version as a0, type MppxCredential as a1, type Message as a2, type MessageType as a3, type MppxChallenge as a4, X402_BATCH_SETTLEMENT_SCHEME as a5, X402_EXACT_SCHEME as a6, type X402Wallet as a7, type X402Config as a8, type X402ExactVersionSupport as a9, PayoutReporter as aA, PostgresTempoSessionStore as aB, RAIL_REFUNDABLE as aC, type ReceiptCredit as aD, type ReceiptOutcome as aE, type ReceiptPayment as aF, type ResourceInfo as aG, RevenueReporter as aH, SIGNED_ENVELOPE_FIELDS as aI, SIGNED_ENVELOPE_TYPES as aJ, type SettleResponse as aK, type StaleJobReapable as aL, StepCache as aM, type StepRecord as aN, type UnsignedDrainReceipt as aO, type UnsignedFundingReceipt as aP, type UnsignedJobReceipt as aQ, type VerifyResponse as aR, type X402ResponseBody as aS, type X402SelfRelayRpcFailureReason as aT, type X402TrackedChannel as aU, X402_DEFAULT_NETWORK as aV, X402_V1_VERSION as aW, X402_VERSION as aX, _testing as aY, buildPaymentRequiredV2 as aZ, buildPaymentRequirements as a_, type X402Receipt as aa, type TransactionalPayoutHook as ab, type CashuMeltCompleted as ac, type BuildPaymentRequirementsOpts as ad, type CapabilityDescriptor as ae, type CashuMode as af, type CreditDepositPayload as ag, type DrainReceipt as ah, type DrainReceiptEvent as ai, type ExactEvmPayload as aj, type ExactEvmPayloadAuthorization as ak, type FundingLot as al, type FundingMethod as am, type LotDebit as an, type LotDepletion as ao, type MppxServer as ap, NON_CHANNEL_BITCOIN_RAILS as aq, type NonChannelBitcoinRail as ar, type OutgoingMessage as as, type PaymentPayload as at, type PaymentPayloadV1 as au, type PaymentPayloadV2 as av, type PaymentRequiredV2 as aw, type PaymentRequirements as ax, type PaymentRequirementsV1 as ay, type PaymentRequirementsV2 as az, type ArtifactContent as b, type DrainRequestResult as b$, canonicaliseForSigning as b0, canonicalize as b1, chainIdFromCaip2 as b2, computeResultHash as b3, createDefaultReplayStore as b4, decodePayment as b5, decodePaymentRequiredHeader as b6, depleteLots as b7, encodePayment as b8, encodePaymentRequiredHeader as b9, verifyWithFacilitator as bA, wrapMppx as bB, x402NetworkToCaip2 as bC, type CreditDrainEnqueue as bD, type DVMAuthScheme as bE, type CreditLedgerLike as bF, type X402RefundSettlementGate as bG, type CreditSnapshot as bH, type DrawResult as bI, type X402SettlementStatus as bJ, type X402UnresolvedRefund as bK, type GrownDrawResult as bL, type DrawResolution as bM, type FundingRecord as bN, type CreditInvoiceRecord as bO, type InvoiceSettlement as bP, type BlockedInvoiceCursor as bQ, type InvoiceReconciliation as bR, type InvoiceWriteOff as bS, type DrawRecord as bT, type StalePendingDrawCursor as bU, type TempoCreditLossEvidence as bV, type CreditLedgerQuerier as bW, type TempoCreditLoss as bX, type X402CreditLossEvidence as bY, type X402CreditLoss as bZ, type DrainMethod as b_, encodeSettleResponseHeader as ba, exactEvmAuthorization as bb, fifoOrder as bc, inKindDrawMsats as bd, isArtifactMessage as be, isDrainReceipt as bf, isFundingReceipt as bg, isInKindDepletion as bh, isNonChannelBitcoinRail as bi, isPaymentRequestMessage as bj, isSignedJobReceipt as bk, isStaleJobReapable as bl, lotOwedSats as bm, netOwedSats as bn, paymentRequiredV2FromV1 as bo, settleWithFacilitator as bp, signDrainReceipt as bq, signFundingReceipt as br, signReceipt as bs, usdcContractByCaip2 as bt, usdcContractFor as bu, usdcDomainNameFor as bv, usdcDomainVersionFor as bw, verifyDrainReceipt as bx, verifyFundingReceipt as by, verifyReceipt as bz, type CancelContent as c, type X402SettlementReconciliationReason as c$, type BitcoinDepositLiability as c0, type CreditDrainRecord as c1, type ChannelDrainCursor as c2, type DrainWriteOff as c3, type DrainReleaseResult as c4, type DrainFulfilment as c5, type DrainTransitionResult as c6, type StreamableJobStore as c7, type ReceiptIssuingStore as c8, type RequestIdClaim as c9, type RevenueSkippedNoRailPayload as cA, type RevenueSkippedNoRailReason as cB, type Secp256k1AuthOpts as cC, type X402ChannelStorageOpts as cD, type X402RelayLockHolder as cE, type X402RelaySubmissionLock as cF, X402RelaySubmissionLockError as cG, allocateDrawValue as cH, clientCompatibilityAttributes as cI, clientCompatibilityMiddleware as cJ, clientUpgradeRequired as cK, isStreamableJobStore as cL, parseClientCapabilities as cM, parseClientCompatibility as cN, parseDvmClient as cO, parseProtocolVersion as cP, requireClientCompatibility as cQ, secp256k1Auth as cR, signedRequestInput as cS, type CreditDepositEnqueue as cT, type TopUpCapUnenforcedReason as cU, type X402SettlementIntent as cV, type X402SettlementCursor as cW, type X402SettlementWriteOff as cX, type X402FacilitatorAuth as cY, type X402BatchSettlementConfig as cZ, type X402PayoutObserver as c_, type RequestIdClaimResult as ca, type AppendOutgoingOptions as cb, type PaymentCreditDelta as cc, type VerifyAndCreditResult as cd, type JobCounters as ce, CLIENT_COMPATIBILITY_HEADERS as cf, type ClientCompatibility as cg, type ClientCompatibilityEnv as ch, type ClientCompatibilityGate as ci, type ClientCompatibilityRequirement as cj, type ClientSemVer as ck, type CreditFundingBasis as cl, type CreditInvoiceStatus as cm, CreditLedger as cn, CreditLedgerError as co, type CreditLedgerErrorCode as cp, type CreditLedgerErrorDetails as cq, type CreditLedgerPool as cr, type CreditStatus as cs, DRAIN_DELIVERY_RESERVE_SATS as ct, DVM_PROTOCOL_VERSION as cu, type DrainConflictReason as cv, type DrawRailValue as cw, type DrawStatus as cx, PostgresX402ChannelStorage as cy, type ReplayStoreBackend as cz, type CanonicalEnvelope as d, type CreditDrawReleaseEnqueue as d0, type CreateSignedRequestVerifierOpts as e, type CreditConfig as f, type CreditView as g, DEFAULT_CREDIT_MAX as h, DEFAULT_CREDIT_MIN as i, DEFAULT_CREDIT_TTL_SECONDS as j, type DVMRouteContext as k, type InputType as l, InvalidCurrencyError as m, type JobStatus as n, type JobStore as o, type PaymentMethod as p, type PriceValue as q, type ProgressContent as r, type PromptOpts as s, type QuoteContext as t, type QuoteResult as u, type ResponseContent as v, type SDKPaymentRequestOpts as w, SIGNED_REQUEST_AUTH_ID as x, SIGNED_REQUEST_STATEMENT_VERSION as y, type SignedRequestAudience as z };