@dvmkit/sdk 0.1.0-rc.1 → 0.1.0-rc.3

package/dist/chunk-FT7IM66W.js

@@ -0,0 +1,1557 @@
+import {
+  CONFIG_AUDIT_FILE,
+  CONFIG_BACKUP_FILE,
+  CONFIG_FILE,
+  CONFIG_PINNED_FILE,
+  CREDITS_FILE,
+  DvmError,
+  ensureConfigDir
+} from "./chunk-5SO7ZVOH.js";
+
+// src/lib/payment-rails/types.ts
+var ADVERTISED_AMOUNT_TOLERANCE_BPS = 1000n;
+function maxAdvertisedMicro(localMicro) {
+  return localMicro * (10000n + ADVERTISED_AMOUNT_TOLERANCE_BPS) / 10000n;
+}
+function withinAdvertisedTolerance(advertisedMicro, localMicro) {
+  return advertisedMicro * 10000n <= localMicro * (10000n + ADVERTISED_AMOUNT_TOLERANCE_BPS);
+}
+
+// src/lib/transport/types.ts
+var SUPPORTED_PROTOCOL_VERSION = 1;
+function parseCreditTerms(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const credit = raw;
+  if (typeof credit.min_micro !== "number" || typeof credit.max_micro !== "number" || typeof credit.ttl_ms !== "number" || typeof credit.currency !== "string" || !Array.isArray(credit.funding) || !credit.funding.every((method) => typeof method === "string") || credit.lightning_min_micro !== void 0 && typeof credit.lightning_min_micro !== "number")
+    return void 0;
+  const tempo = credit.tempo === void 0 ? void 0 : parseCreditTempoTerms(credit.tempo);
+  if (credit.tempo !== void 0 && !tempo) return void 0;
+  const x402 = credit.x402 === void 0 ? void 0 : parseCreditX402Terms(credit.x402);
+  if (credit.x402 !== void 0 && !x402) return void 0;
+  return {
+    min_micro: credit.min_micro,
+    max_micro: credit.max_micro,
+    ttl_ms: credit.ttl_ms,
+    currency: credit.currency,
+    funding: [...credit.funding],
+    ...tempo && { tempo },
+    ...x402 && { x402 },
+    ...typeof credit.lightning_min_micro === "number" && {
+      lightning_min_micro: credit.lightning_min_micro
+    }
+  };
+}
+function parseCreditMenu(raw) {
+  const terms = parseCreditTerms(raw);
+  if (!terms) return void 0;
+  const credit = raw;
+  return {
+    ...terms,
+    ...typeof credit.credit_id === "string" && { credit_id: credit.credit_id },
+    ...typeof credit.balance_micro === "number" && { balance_micro: credit.balance_micro },
+    ...typeof credit.remaining_micro === "number" && {
+      remaining_micro: credit.remaining_micro
+    },
+    ...typeof credit.expiry_ms === "number" && { expiry_ms: credit.expiry_ms }
+  };
+}
+function parseCreditTempoTerms(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const block = raw;
+  if (!Array.isArray(block.methods) || !block.methods.every(isCreditTempoMethod)) return void 0;
+  if (block.withheld !== void 0 && (!Array.isArray(block.withheld) || !block.withheld.every(isCreditTempoWithheldMethod)))
+    return void 0;
+  return {
+    methods: block.methods.map((method) => ({
+      method: method.method,
+      intent: method.intent
+    })),
+    ...Array.isArray(block.withheld) && {
+      withheld: block.withheld.map((method) => ({
+        method: method.method,
+        intent: method.intent,
+        reason: method.reason
+      }))
+    }
+  };
+}
+function isCreditTempoMethod(raw) {
+  return !!raw && typeof raw === "object" && typeof raw.method === "string" && (raw.intent === "charge" || raw.intent === "session");
+}
+function isCreditTempoWithheldMethod(raw) {
+  return isCreditTempoMethod(raw) && typeof raw.reason === "string";
+}
+function parseCreditX402Terms(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const schemes = raw.schemes;
+  if (!Array.isArray(schemes) || !schemes.every(
+    (entry) => !!entry && typeof entry === "object" && typeof entry.scheme === "string" && typeof entry.network === "string"
+  ))
+    return void 0;
+  return {
+    schemes: schemes.map((entry) => ({
+      scheme: entry.scheme,
+      network: entry.network
+    }))
+  };
+}
+
+// src/lib/output.ts
+import { writeSync } from "fs";
+function info(msg) {
+  writeAllSync(2, msg + "\n");
+}
+function progress(event) {
+  writeAllSync(2, JSON.stringify(event) + "\n");
+}
+function writeAllSync(fd, text) {
+  const buf = Buffer.from(text, "utf8");
+  let offset = 0;
+  while (offset < buf.length) {
+    try {
+      offset += writeSync(fd, buf, offset, buf.length - offset);
+    } catch (err) {
+      const code = err.code;
+      if (code === "EAGAIN" || code === "EINTR") continue;
+      throw err;
+    }
+  }
+}
+
+// src/lib/evm-private-key.ts
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { hexToBytes } from "@noble/hashes/utils.js";
+var EVM_PRIVATE_KEY_RE = /^0x[0-9a-fA-F]{64}$/;
+function isValidEvmPrivateKey(value) {
+  return EVM_PRIVATE_KEY_RE.test(value) && secp256k1.utils.isValidSecretKey(hexToBytes(value.slice(2)));
+}
+
+// src/lib/config-mutation.ts
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync,
+  readFileSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+var PROTECTED_CONFIG_FIELDS = ["nwcUri", "defaultIdentity", "tempo", "x402"];
+var ProtectedFieldAuthorization = class {
+  /** Targets this authorization covers. A field also covers its own leaves. */
+  targets;
+  /** Prefer {@link authorizeProtectedRemoval}; this exists for it to call. */
+  constructor(targets) {
+    this.targets = [...targets];
+  }
+  /**
+   * True when `target` is one this authorization names. Naming a field covers
+   * the leaves under it; naming a leaf covers only that leaf, so a command
+   * entitled to clear `tempo.apiKey` still cannot take the whole `tempo` block.
+   */
+  covers(target) {
+    if (this.targets.includes(target)) return true;
+    const field = target.split(".")[0];
+    return target !== field && this.targets.includes(field);
+  }
+};
+function authorizeProtectedRemoval(...targets) {
+  return new ProtectedFieldAuthorization(targets);
+}
+function applyConfigPatch(base, patch) {
+  if (!isPlainObject(patch))
+    throw patchShapeError("A change must be an object with `set` and/or `unset`.");
+  if (patch.set !== void 0 && !isPlainObject(patch.set)) {
+    throw patchShapeError("A change's `set` must be an object of fields to write.");
+  }
+  if (patch.unset !== void 0 && !Array.isArray(patch.unset)) {
+    throw patchShapeError("A change's `unset` must be an array of field names.");
+  }
+  const set = patch.set ?? {};
+  const unset = patch.unset ?? [];
+  for (const [field, value] of Object.entries(set)) {
+    if (value !== void 0) continue;
+    throw new DvmError(
+      "config_patch_invalid",
+      `Config field '${field}' was declared with no value.`,
+      "Give the field a value, or name it in the change's `unset` list to remove it. An undefined value is how a field gets dropped without anyone deciding to drop it."
+    );
+  }
+  for (const field of unset) {
+    if (typeof field !== "string" || field.length === 0) {
+      throw patchShapeError("Every entry in a change's `unset` must be a field name.");
+    }
+    if (!Object.hasOwn(set, field)) continue;
+    throw new DvmError(
+      "config_patch_invalid",
+      `Config field '${field}' is both written and removed by the same change.`,
+      "Declare each field once: in `set` with its new value, or in `unset` to remove it."
+    );
+  }
+  const merged = { ...base, ...set };
+  const removing = new Set(unset);
+  return Object.fromEntries(
+    Object.entries(merged).filter(([field]) => !removing.has(field))
+  );
+}
+function deepFreezeConfig(config) {
+  freezeDeep(config);
+  return config;
+}
+function protectedRemovals(before, after) {
+  const previous = before;
+  const next = after;
+  const removed = [];
+  for (const field of PROTECTED_CONFIG_FIELDS) {
+    const held = previous[field];
+    if (!isPresentValue(held)) continue;
+    const kept = next[field];
+    if (!isPresentValue(kept)) {
+      removed.push(field);
+      continue;
+    }
+    const spec = PROTECTED_FIELDS[field];
+    if (spec.credentialLeaves.length === 0) continue;
+    if (!isPlainObject(held)) continue;
+    if (!isPlainObject(kept)) {
+      removed.push(field);
+      continue;
+    }
+    for (const leaf of spec.credentialLeaves) {
+      if (!isPresentValue(held[leaf]) || isPresentValue(kept[leaf])) continue;
+      removed.push(`${field}.${leaf}`);
+    }
+  }
+  return removed;
+}
+function supersededProtectedSecrets(before, after) {
+  const previous = before;
+  const next = after;
+  const superseded = [];
+  for (const field of PROTECTED_CONFIG_FIELDS) {
+    const spec = PROTECTED_FIELDS[field];
+    if (!spec.secret) continue;
+    const held = previous[field];
+    const kept = next[field];
+    if (spec.credentialLeaves.length === 0) {
+      if (isPresentValue(held) && isPresentValue(kept) && held !== kept) superseded.push(field);
+      continue;
+    }
+    if (!isPlainObject(held) || !isPlainObject(kept)) continue;
+    for (const leaf of spec.credentialLeaves) {
+      const was = held[leaf];
+      const now = kept[leaf];
+      if (!isPresentValue(was) || !isPresentValue(now) || was === now) continue;
+      superseded.push(`${field}.${leaf}`);
+    }
+  }
+  return superseded;
+}
+function changedConfigPaths(before, after) {
+  const found = /* @__PURE__ */ new Set();
+  collectChangedPaths(
+    before,
+    after,
+    CONFIG_PATH_SHAPE,
+    "",
+    found
+  );
+  return [...found].sort();
+}
+function assertValidConfig(config, fields) {
+  if (!isPlainObject(config)) {
+    throw new DvmError(
+      "config_invalid",
+      "The caller configuration is not a JSON object.",
+      `Expected an object at ${CONFIG_FILE}.${rollbackSuffix()}`
+    );
+  }
+  const record = config;
+  const scope = fields ? new Set(fields) : null;
+  for (const [field, kind] of Object.entries(CONFIG_FIELD_TYPES)) {
+    if (scope && !scope.has(field)) continue;
+    const value = record[field];
+    if (value === void 0) continue;
+    if (!matchesKind(value, kind)) throw invalidFieldError(field, kind);
+  }
+  for (const [path, kind] of Object.entries(CONFIG_LEAF_TYPES)) {
+    const [field, leaf] = path.split(".");
+    if (scope && !scope.has(field)) continue;
+    const owner = record[field];
+    if (!isPlainObject(owner)) continue;
+    const value = owner[leaf];
+    if (value === void 0 || !matchesKind(value, kind)) throw invalidFieldError(path, kind);
+  }
+}
+function readRawConfig() {
+  if (!existsSync(CONFIG_FILE)) return null;
+  try {
+    return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
+  } catch {
+    throw new DvmError(
+      "config_corrupt",
+      "Config file is corrupt.",
+      // Not "delete it": those bytes are the only copy on this machine of the
+      // NWC connection string and both private keys, however badly they parse.
+      `Run 'dvm config rollback' to restore a stored copy, or move ${CONFIG_FILE} aside yourself and run 'dvm init'.${rollbackSuffix()}`
+    );
+  }
+}
+function writeConfigFile(config) {
+  writeJsonAtomic(CONFIG_FILE, config);
+}
+var CONFIG_SNAPSHOT_SLOTS = ["backup", "pinned"];
+function configSnapshotPath(slot) {
+  return slot === "pinned" ? CONFIG_PINNED_FILE : CONFIG_BACKUP_FILE;
+}
+function describeConfigBackup(slot = "backup") {
+  const path = configSnapshotPath(slot);
+  try {
+    if (!existsSync(path)) return null;
+    const stat = statSync(path);
+    const posix = process.platform !== "win32";
+    const mode = stat.mode & 511;
+    return {
+      path,
+      slot,
+      bytes: stat.size,
+      modifiedAt: stat.mtime.toISOString(),
+      modeOctal: posix ? toOctal(mode) : null,
+      ownerOnly: !posix || (mode & 63) === 0
+    };
+  } catch {
+    return null;
+  }
+}
+function readConfigBackup(slot = "backup") {
+  const path = configSnapshotPath(slot);
+  if (!existsSync(path)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    return isPlainObject(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function retainConfigBackup(slot = "backup") {
+  if (!existsSync(CONFIG_FILE)) return false;
+  ensureConfigDir();
+  const path = configSnapshotPath(slot);
+  const tmp = `${path}.tmp`;
+  writeFileSync(tmp, readFileSync(CONFIG_FILE), { mode: 384 });
+  chmodSync(tmp, 384);
+  commitTmp(tmp, path);
+  return true;
+}
+function writeConfigBackup(config, slot = "backup") {
+  writeJsonAtomic(configSnapshotPath(slot), config);
+}
+function removeConfigBackup(slot = "backup") {
+  const path = configSnapshotPath(slot);
+  if (!existsSync(path)) return false;
+  unlinkSync(path);
+  return true;
+}
+function protectedTargetValue(config, target) {
+  const [field, named] = target.split(".");
+  const held = config[field];
+  const leaves = PROTECTED_FIELDS[field].credentialLeaves;
+  const leaf = named ?? (leaves.length > 0 ? leaves[0] : void 0);
+  if (leaf === void 0) return held;
+  return isPlainObject(held) ? held[leaf] : void 0;
+}
+function protectedValuesMatch(target, left, right) {
+  const normalized = comparableProtectedValue(target, left);
+  return normalized !== void 0 && normalized === comparableProtectedValue(target, right);
+}
+function isSecretProtectedTarget(target) {
+  return PROTECTED_FIELDS[target.split(".")[0]].secret;
+}
+function withoutProtectedTargets(config, targets) {
+  const dropping = /* @__PURE__ */ new Set();
+  for (const target of targets) {
+    const field = target.split(".")[0];
+    dropping.add(field);
+    for (const alias of PROTECTED_FIELDS[field].aliases) dropping.add(alias);
+  }
+  return Object.fromEntries(
+    Object.entries(config).filter(([field]) => !dropping.has(field))
+  );
+}
+function appendConfigAudit(record) {
+  try {
+    ensureConfigDir();
+    appendFileSync(CONFIG_AUDIT_FILE, JSON.stringify(record) + "\n", { mode: 384 });
+    chmodSync(CONFIG_AUDIT_FILE, 384);
+  } catch {
+  }
+}
+function protectedRemovalError(targets, reason) {
+  const named = targets.join(", ");
+  const one = targets.length === 1;
+  return new DvmError(
+    "config_protected_field",
+    `The '${reason}' change would remove ${named} from the local configuration.`,
+    `Nothing was written. ${named} ${one ? "is a credential or identity pointer" : "are credentials or identity pointers"} nothing else on this machine records, so only a command that names ${one ? "it" : "them"} explicitly may remove ${one ? "it" : "them"} \u2014 'dvm wallet disconnect', 'dvm wallet tempo-disconnect' and 'dvm wallet x402-disconnect' are those commands.`,
+    { fields: targets }
+  );
+}
+var PROTECTED_FIELDS = {
+  nwcUri: { aliases: [], credentialLeaves: [], secret: true, hexCredential: false },
+  // A pointer at a key, not a key: worth protecting from removal, and never
+  // worth stripping out of a stored copy — that is recovery lost for nothing.
+  defaultIdentity: { aliases: [], credentialLeaves: [], secret: false, hexCredential: false },
+  // `mpp` is the pre-internal-review name; a caller who has not run a mutating command
+  // since the rename still has their private key under it.
+  tempo: { aliases: ["mpp"], credentialLeaves: ["apiKey"], secret: true, hexCredential: true },
+  x402: { aliases: [], credentialLeaves: ["privateKey"], secret: true, hexCredential: true }
+};
+var CONFIG_PATH_SHAPE = {
+  float: { statedBudget: {}, connectedAt: {}, alias: {}, methods: {} },
+  x402: { privateKey: {}, network: {} },
+  tempo: { method: {}, accountId: {}, apiKey: {} },
+  credit: {
+    targetJobs: {},
+    posture: {},
+    tier0Cap: {},
+    tier1Cap: {},
+    pocketTarget: {},
+    fundingRail: {},
+    perDvm: { "*": { targetJobs: {}, posture: {}, fundingRail: {}, dvmId: {}, builderPubkey: {} } },
+    trustOverrides: { "*": {} }
+  },
+  feedback: { posture: {} }
+};
+var CONFIG_FIELD_TYPES = {
+  nwcUri: "string",
+  float: "object",
+  defaultBudget: "string",
+  autoPayThreshold: "string",
+  defaultMaxPayments: "number",
+  cashuMints: "string[]",
+  x402: "object",
+  tempo: "object",
+  defaultRail: "string",
+  defaultIdentity: "string",
+  credit: "object",
+  feedback: "object"
+};
+var CONFIG_LEAF_TYPES = {
+  "float.connectedAt": "string",
+  "x402.privateKey": "string",
+  "tempo.method": "string"
+};
+function collectChangedPaths(before, after, shape, prefix, found) {
+  for (const key of /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])) {
+    const held = before[key];
+    const kept = after[key];
+    if (deepEqual(held, kept)) continue;
+    const known = shape !== void 0 && Object.hasOwn(shape, key);
+    const wildcard = !known && shape !== void 0 && Object.hasOwn(shape, "*");
+    const child = known ? shape[key] : wildcard ? shape["*"] : void 0;
+    const path = prefix ? `${prefix}.${wildcard ? "*" : key}` : key;
+    const descendable = child !== void 0 && Object.keys(child).length > 0 && (held === void 0 || isPlainObject(held)) && (kept === void 0 || isPlainObject(kept));
+    if (descendable) {
+      collectChangedPaths(
+        isPlainObject(held) ? held : {},
+        isPlainObject(kept) ? kept : {},
+        child,
+        path,
+        found
+      );
+    } else {
+      found.add(path);
+    }
+  }
+}
+function invalidFieldError(path, kind) {
+  return new DvmError(
+    "config_invalid",
+    `Config field '${path}' must be ${describeKind(kind)}.`,
+    `Nothing was written. Correct the field in ${CONFIG_FILE}, or run 'dvm doctor' for the full picture.${rollbackSuffix()}`
+  );
+}
+function describeKind(kind) {
+  switch (kind) {
+    case "string":
+      return "a string";
+    case "number":
+      return "a number";
+    case "object":
+      return "an object";
+    case "string[]":
+      return "an array of strings";
+  }
+}
+function matchesKind(value, kind) {
+  switch (kind) {
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number" && Number.isFinite(value);
+    case "object":
+      return isPlainObject(value);
+    case "string[]":
+      return Array.isArray(value) && value.every((item) => typeof item === "string");
+  }
+}
+function rollbackSuffix() {
+  const stored = describeConfigBackup() ?? describeConfigBackup("pinned");
+  return stored === null ? "" : ` A stored copy of the previous configuration is at ${stored.path}.`;
+}
+function writeJsonAtomic(path, value) {
+  ensureConfigDir();
+  const tmp = `${path}.tmp`;
+  writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", { mode: 384 });
+  chmodSync(tmp, 384);
+  commitTmp(tmp, path);
+}
+function commitTmp(tmp, path) {
+  try {
+    renameSync(tmp, path);
+  } catch (err) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (Array.isArray(a) || Array.isArray(b)) {
+    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+    return a.every((item, index) => deepEqual(item, b[index]));
+  }
+  if (!isPlainObject(a) || !isPlainObject(b)) return false;
+  for (const key of /* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)])) {
+    if (!deepEqual(a[key], b[key])) return false;
+  }
+  return true;
+}
+function isPresentValue(value) {
+  if (value === void 0 || value === null) return false;
+  return typeof value !== "string" || value.trim().length > 0;
+}
+function comparableProtectedValue(target, value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  if (trimmed.length === 0) return void 0;
+  const field = target.split(".")[0];
+  return PROTECTED_FIELDS[field].hexCredential ? trimmed.toLowerCase() : trimmed;
+}
+function patchShapeError(message) {
+  return new DvmError(
+    "config_patch_invalid",
+    message,
+    "A change declares `set` (fields to write) and `unset` (field names to remove). Anything else cannot be applied, and nothing was written."
+  );
+}
+function freezeDeep(value) {
+  if (typeof value !== "object" || value === null || Object.isFrozen(value)) return;
+  Object.freeze(value);
+  for (const nested of Object.values(value)) freezeDeep(nested);
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toOctal(mode) {
+  return "0" + mode.toString(8).padStart(3, "0");
+}
+
+// src/lib/identity.ts
+import lockfile from "proper-lockfile";
+var CREDIT_POSTURES = ["suggest", "auto", "off"];
+function isCreditPosture(value) {
+  return typeof value === "string" && CREDIT_POSTURES.includes(value);
+}
+function migrateCreditConfig(config) {
+  const credit = config.credit;
+  if (!credit) return config;
+  const migrateLayer = (layer) => {
+    const railed = migrateFundingRail(layer);
+    if (!("disabled" in railed)) return railed;
+    const { disabled, ...rest } = railed;
+    const migrated = { ...rest };
+    if (migrated.posture === void 0 && disabled === true) migrated.posture = "off";
+    return migrated;
+  };
+  const perDvm = credit.perDvm;
+  return {
+    ...config,
+    credit: {
+      ...migrateLayer(credit),
+      ...perDvm ? {
+        perDvm: Object.fromEntries(
+          Object.entries(perDvm).map(([endpoint, per]) => [endpoint, migrateLayer(per)])
+        )
+      } : {}
+    }
+  };
+}
+function migrateFundingRail(layer) {
+  const loose = layer;
+  if (loose.fundingRail !== "mpp") return layer;
+  return { ...layer, fundingRail: "tempo" };
+}
+function migrateTempoWalletKey(config) {
+  const loose = config;
+  if (!loose.mpp || loose.tempo) return config;
+  const { mpp, ...rest } = loose;
+  return { ...rest, tempo: mpp };
+}
+function migrateConfig(config) {
+  return migrateCreditConfig(migrateTempoWalletKey(config));
+}
+function loadConfig() {
+  const raw = readRawConfig();
+  return raw === null ? null : migrateConfig(raw);
+}
+async function updateConfig(update) {
+  return withConfigLock(async () => {
+    const raw = readRawConfig();
+    const snapshot = raw === null ? {} : structuredClone(raw);
+    const base = raw === null ? null : migrateConfig(structuredClone(raw));
+    const handed = raw === null ? null : deepFreezeConfig(migrateConfig(structuredClone(raw)));
+    const next = applyConfigPatch(base ?? {}, await runPatch(update, handed));
+    const changed = changedConfigPaths(snapshot, next);
+    if (changed.length === 0) {
+      return {
+        config: base ?? {},
+        previous: base,
+        changed: [],
+        written: false,
+        backup: describeConfigBackup()
+      };
+    }
+    const removals = protectedRemovals(base ?? {}, next);
+    const unauthorized = removals.filter((target) => update.authorize?.covers(target) !== true);
+    if (unauthorized.length > 0) throw protectedRemovalError(unauthorized, update.reason);
+    assertValidConfig(
+      next,
+      changed.map((path) => path.split(".")[0])
+    );
+    const superseded = supersededProtectedSecrets(base ?? {}, next);
+    const stripped = [
+      .../* @__PURE__ */ new Set([...removals, ...superseded, ...update.sanitizeBackup ?? []])
+    ].filter(isSecretProtectedTarget);
+    const sweeping = update.sweepSlots ?? CONFIG_SNAPSHOT_SLOTS;
+    const swept = [];
+    if (raw !== null) {
+      if (stripped.length > 0) {
+        writeConfigBackup(withoutProtectedTargets(raw, stripped));
+        swept.push("backup");
+      } else {
+        retainConfigBackup();
+      }
+    }
+    if (stripped.length > 0 && sweeping.includes("pinned")) {
+      if (sweepPinnedSnapshot(stripped, base ?? {}, update.reason)) swept.push("pinned");
+    }
+    const backup = describeConfigBackup();
+    writeConfigFile(next);
+    appendConfigAudit({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      event: "update",
+      reason: update.reason,
+      fields: changed,
+      ...removals.length > 0 ? { removed: removals } : {},
+      ...superseded.length > 0 ? { superseded } : {},
+      ...swept.length > 0 ? { sweptSlots: swept } : {},
+      backup: backup !== null,
+      pid: process.pid
+    });
+    return { config: next, previous: base, changed, written: true, backup };
+  });
+}
+async function withConfigLock(fn) {
+  ensureConfigDir();
+  let release;
+  try {
+    release = await lockfile.lock(CONFIG_FILE, {
+      lockfilePath: `${CONFIG_FILE}.lock`,
+      realpath: false,
+      stale: 3e4,
+      retries: { retries: 10, factor: 1, minTimeout: 100, maxTimeout: 100 }
+    });
+  } catch {
+    throw new DvmError(
+      "config_locked",
+      "Another dvm process is updating the local configuration.",
+      "Wait a moment and retry."
+    );
+  }
+  try {
+    return await fn();
+  } finally {
+    await release().catch(() => void 0);
+  }
+}
+async function runPatch(update, current) {
+  try {
+    return await update.patch(current);
+  } catch (err) {
+    if (err instanceof TypeError && /read only|not extensible|frozen|cannot delete property|cannot add property/i.test(
+      err.message
+    )) {
+      throw new DvmError(
+        "config_patch_invalid",
+        `The '${update.reason}' change tried to modify the configuration it was handed.`,
+        "Nothing was written. A change declares what it wants through its `set` and `unset` lists; editing the current config in place bypasses the protected-field gate, so the object is frozen."
+      );
+    }
+    throw err;
+  }
+}
+function sweepPinnedSnapshot(targets, departing, reason) {
+  if (describeConfigBackup("pinned") === null) return false;
+  const pinned = readConfigBackup("pinned");
+  if (pinned === null) {
+    return retireSlot(`${reason}:unreadable_pin`, "pinned");
+  }
+  const migrated = migrateConfig(structuredClone(pinned));
+  const matching = targets.filter(
+    (target) => protectedValuesMatch(
+      target,
+      protectedTargetValue(departing, target),
+      protectedTargetValue(migrated, target)
+    )
+  );
+  if (matching.length === 0) return false;
+  const sanitized = withoutProtectedTargets(pinned, matching);
+  const changed = changedConfigPaths(pinned, sanitized);
+  if (changed.length === 0) return false;
+  writeConfigBackup(sanitized, "pinned");
+  appendConfigAudit({
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    event: "backup_sanitized",
+    reason,
+    fields: changed,
+    removed: matching,
+    slot: "pinned",
+    backup: describeConfigBackup() !== null,
+    pid: process.pid
+  });
+  return true;
+}
+function retireSlot(reason, slot) {
+  if (!removeConfigBackup(slot)) return false;
+  appendConfigAudit({
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    event: "backup_retired",
+    reason,
+    fields: [],
+    slot,
+    backup: describeConfigBackup() !== null,
+    pid: process.pid
+  });
+  return true;
+}
+
+// src/lib/credit-store.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname } from "path";
+import lockfile2 from "proper-lockfile";
+function withCreditLock(fn, opts = {}) {
+  if (lockDepth > 0) {
+    lockDepth += 1;
+    try {
+      return rejectAsyncBody(fn());
+    } finally {
+      lockDepth -= 1;
+    }
+  }
+  const release = acquireCreditLock(opts);
+  lockDepth = 1;
+  try {
+    return rejectAsyncBody(fn());
+  } finally {
+    lockDepth = 0;
+    try {
+      release();
+    } catch {
+    }
+  }
+}
+function normalizeCreditEndpoint(endpoint) {
+  try {
+    return new URL(endpoint).origin;
+  } catch {
+    return endpoint.replace(/\/+$/, "");
+  }
+}
+function dvmLocationIdentity(record) {
+  if (typeof record.dvmId !== "string" || record.dvmId.length === 0) return void 0;
+  const pubkey = typeof record.attestedBuilderPubkey === "string" ? record.attestedBuilderPubkey.trim().toLowerCase() : "";
+  if (!/^[0-9a-f]{64}$/.test(pubkey)) return void 0;
+  return { dvmId: record.dvmId, builderPubkey: pubkey };
+}
+function findDvmLocated(records, args) {
+  const where = args.where ?? (() => true);
+  const identity = args.identity;
+  if (identity) {
+    const attested = records.find(
+      (record) => where(record) && matchesDvmIdentity(record, identity)
+    );
+    if (attested) return attested;
+  }
+  return records.find(
+    (record) => where(record) && matchesDvmOrigin(record, args.endpoint, identity)
+  );
+}
+function attachDvmLocation(record, endpoint, identity) {
+  let changed = false;
+  if (identity) {
+    if (record.dvmId !== identity.dvmId) {
+      record.dvmId = identity.dvmId;
+      changed = true;
+    }
+    if (record.attestedBuilderPubkey !== identity.builderPubkey) {
+      record.attestedBuilderPubkey = identity.builderPubkey;
+      changed = true;
+    }
+  }
+  if (endpoint !== record.endpoint && !dvmLocationOrigins(record).includes(endpoint)) {
+    record.endpointAliases = [...record.endpointAliases ?? [], endpoint];
+    changed = true;
+  }
+  return changed;
+}
+function dvmLocationOrigins(record) {
+  const aliases = Array.isArray(record.endpointAliases) ? record.endpointAliases.filter((endpoint) => typeof endpoint === "string") : [];
+  const primary = typeof record.endpoint === "string" ? [record.endpoint] : [];
+  return [...primary, ...aliases].map(normalizeCreditEndpoint);
+}
+function fundingReachableAt(funding, endpoint, credits) {
+  const at = normalizeCreditEndpoint(funding.endpoint);
+  const named = normalizeCreditEndpoint(endpoint);
+  if (at === named) return true;
+  const record = credits.find(
+    (c) => c.callerPubkey === funding.callerPubkey && c.creditId === funding.creditId
+  );
+  if (!record) return false;
+  const origins = dvmLocationOrigins(record);
+  return origins.includes(at) && origins.includes(named);
+}
+function loadCredit(endpoint, callerPubkey, identity) {
+  return withCreditLock(() => {
+    const key = normalizeCreditEndpoint(endpoint);
+    const store = loadStore();
+    const record = findDvmLocated(store.credits, {
+      endpoint: key,
+      ...identity ? { identity } : {},
+      where: (c) => c.callerPubkey === callerPubkey
+    });
+    if (record && attachDvmLocation(record, key, identity)) saveStore(store);
+    return record;
+  });
+}
+function listCredits() {
+  return withCreditLock(() => [...loadStore().credits].sort((a, b) => b.updatedAt - a.updatedAt));
+}
+function listPendingFundings(args = {}) {
+  const endpoint = args.endpoint ? normalizeCreditEndpoint(args.endpoint) : void 0;
+  return withCreditLock(() => {
+    const store = loadStore();
+    return store.pendingFundings.filter(
+      (funding) => (!endpoint || fundingReachableAt(funding, endpoint, store.credits)) && (!args.callerPubkey || funding.callerPubkey === args.callerPubkey) && (!args.creditId || funding.creditId === args.creditId)
+    ).sort((a, b) => a.requestedAt - b.requestedAt);
+  });
+}
+function loadPendingFunding(endpoint, callerPubkey, creditId) {
+  return listPendingFundings({ endpoint, callerPubkey, ...creditId ? { creditId } : {} })[0];
+}
+function recordPendingFunding(funding) {
+  withCreditLock(() => {
+    const store = loadStore();
+    const normalized = { ...funding, endpoint: normalizeCreditEndpoint(funding.endpoint) };
+    const index = store.pendingFundings.findIndex(
+      (entry) => entry.callerPubkey === normalized.callerPubkey && entry.creditId === normalized.creditId && entry.fundId === normalized.fundId && fundingReachableAt(entry, normalized.endpoint, store.credits)
+    );
+    if (index === -1) store.pendingFundings.push(normalized);
+    else
+      store.pendingFundings[index] = {
+        ...normalized,
+        endpoint: store.pendingFundings[index].endpoint
+      };
+    saveStore(store);
+  });
+}
+function clearPendingFunding(endpoint, callerPubkey, creditId, fundId) {
+  withCreditLock(() => {
+    const store = loadStore();
+    const normalized = normalizeCreditEndpoint(endpoint);
+    const remaining = store.pendingFundings.filter(
+      (entry) => !(entry.callerPubkey === callerPubkey && entry.creditId === creditId && entry.fundId === fundId && fundingReachableAt(entry, normalized, store.credits))
+    );
+    if (remaining.length === store.pendingFundings.length) return;
+    saveStore({ ...store, pendingFundings: remaining });
+  });
+}
+function recordFundResponse(args) {
+  const now = args.now ?? Date.now();
+  return withCreditLock(() => {
+    const store = loadStore();
+    const key = normalizeCreditEndpoint(args.endpoint);
+    let record = findDvmLocated(store.credits, {
+      endpoint: key,
+      ...args.identity ? { identity: args.identity } : {},
+      where: (c) => c.callerPubkey === args.callerPubkey
+    });
+    if (!record) {
+      record = {
+        endpoint: key,
+        ...identityFields(args.identity),
+        callerPubkey: args.callerPubkey,
+        creditId: args.credit.credit_id,
+        currency: args.credit.currency,
+        balanceMicro: 0,
+        remainingMicro: 0,
+        ledgerSeq: 0,
+        expiryMs: 0,
+        targetMicro: args.targetMicro,
+        status: "active",
+        openedAt: now,
+        updatedAt: now
+      };
+      store.credits.push(record);
+    }
+    attachDvmLocation(record, key, args.identity);
+    adoptCreditId(record, args.credit.credit_id);
+    record.currency = args.credit.currency;
+    record.balanceMicro = args.credit.balance_micro;
+    record.remainingMicro = args.credit.remaining_micro;
+    record.ledgerSeq = Math.max(record.ledgerSeq, args.credit.ledger_seq);
+    record.expiryMs = args.credit.expiry_ms;
+    record.targetMicro = args.targetMicro;
+    record.status = args.credit.status === "unbacked" ? "unbacked" : args.credit.expired ? "expired" : "active";
+    record.reconciliationPending = args.credit.reconciliation_pending;
+    record.updatedAt = now;
+    delete record.provisional;
+    if (args.sequenced === false) record.unsequencedBalance = true;
+    else delete record.unsequencedBalance;
+    if (args.menu) record.menu = args.menu;
+    if (args.rail) {
+      record.rail = args.rail;
+      delete record.refillUnavailableRail;
+    }
+    if (args.x402Instrument) record.x402Instrument = args.x402Instrument;
+    if (args.x402ChannelNetwork) record.x402ChannelNetwork = args.x402ChannelNetwork;
+    if (args.builderPubkey) record.builderPubkey = args.builderPubkey;
+    if (args.select) delete record.selectionCleared;
+    delete record.discrepancy;
+    saveStore(store);
+    return record;
+  });
+}
+function loadCreditX402Binding(endpoint, callerPubkey, creditId, identity) {
+  const record = loadCredit(endpoint, callerPubkey, identity);
+  if (record?.creditId !== creditId) return {};
+  if (record.status !== "active" && record.status !== "expired") return {};
+  return {
+    ...record.x402Instrument ? { instrument: record.x402Instrument } : {},
+    ...record.x402ChannelNetwork ? { channelNetwork: record.x402ChannelNetwork } : {}
+  };
+}
+function recordCreditX402Instrument(endpoint, callerPubkey, creditId, instrument, identity, channelNetwork) {
+  mutateCredit(mutationAt(endpoint, callerPubkey, identity), (record) => {
+    if (record.creditId !== creditId) return "skip";
+    const instrumentChanged = record.x402Instrument !== instrument;
+    const channelNetworkChanged = instrument === "x402_channel" && channelNetwork !== void 0 && record.x402ChannelNetwork !== channelNetwork;
+    if (!instrumentChanged && !channelNetworkChanged) return "skip";
+    if (instrumentChanged) {
+      record.x402Instrument = instrument;
+      delete record.x402ChannelNetwork;
+    }
+    if (instrument === "x402_channel" && channelNetwork !== void 0) {
+      record.x402ChannelNetwork = channelNetwork;
+    }
+    return void 0;
+  });
+}
+function identityFields(identity) {
+  if (!identity) return {};
+  return { dvmId: identity.dvmId, attestedBuilderPubkey: identity.builderPubkey };
+}
+function mutationAt(endpoint, callerPubkey, identity) {
+  return { endpoint, callerPubkey, ...identity ? { identity } : {} };
+}
+function matchesDvmIdentity(record, identity) {
+  const stored = dvmLocationIdentity(record);
+  return stored?.dvmId === identity.dvmId && stored.builderPubkey === identity.builderPubkey;
+}
+function matchesDvmOrigin(record, endpoint, identity) {
+  if (identity) {
+    if (dvmLocationIdentity(record) !== void 0) return false;
+    if (record.dvmId !== void 0 && record.dvmId !== identity.dvmId) return false;
+  }
+  return dvmLocationOrigins(record).includes(endpoint);
+}
+function adoptCreditId(record, creditId) {
+  if (record.creditId === creditId) return;
+  if (record.status === "active" || record.status === "expired" || record.status === "unbacked") {
+    const prior = {
+      creditId: record.creditId,
+      status: record.status === "unbacked" ? "unbacked" : "active",
+      currency: record.currency,
+      balanceMicro: record.balanceMicro,
+      remainingMicro: record.remainingMicro,
+      ledgerSeq: record.ledgerSeq,
+      expiryMs: record.expiryMs,
+      expired: record.status === "expired",
+      drainable: record.status !== "unbacked" && record.balanceMicro > 0,
+      ...record.reconciliationPending ? { reconciliationPending: true } : {},
+      observedAt: record.updatedAt
+    };
+    record.siblingCredits = [
+      ...(record.siblingCredits ?? []).filter(
+        (sibling) => sibling.creditId !== prior.creditId && sibling.creditId !== creditId
+      ),
+      prior
+    ];
+  } else if (record.siblingCredits) {
+    record.siblingCredits = record.siblingCredits.filter(
+      (sibling) => sibling.creditId !== creditId
+    );
+  }
+  record.creditId = creditId;
+  record.ledgerSeq = 0;
+  record.balanceMicro = 0;
+  record.remainingMicro = 0;
+  record.expiryMs = 0;
+  delete record.unsequencedBalance;
+  delete record.rail;
+  delete record.x402Instrument;
+  delete record.x402ChannelNetwork;
+  delete record.refillUnavailableRail;
+  delete record.refillDrainNoticed;
+  delete record.discrepancy;
+  delete record.lastReceiptJobId;
+}
+var MAX_LOST_IMPLICIT_CREDITS = 8;
+var MAX_DATE_MS = 864e13;
+function loadStore() {
+  if (!existsSync2(CREDITS_FILE)) {
+    return { credits: [], implicitCredits: [], pendingFundings: [], fundingMenuSnapshots: [] };
+  }
+  let raw;
+  try {
+    raw = readFileSync2(CREDITS_FILE, "utf-8");
+  } catch (cause) {
+    throw unreadableStore(cause);
+  }
+  let data;
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("the file parsed as JSON but is not a credit-store object");
+    }
+    data = parsed;
+  } catch (cause) {
+    throw quarantineCorruptStore(cause);
+  }
+  const merged = mergeDuplicateCredits(
+    Array.isArray(data.credits) ? data.credits.filter((record) => isObjectRecord(record)).map(
+      (record) => normalizeRailKey(normalizeEvidence(normalizeDrains(normalizeSiblingCredits(record))))
+    ) : []
+  );
+  const snapshots = mergeDuplicateSnapshots(
+    Array.isArray(data.fundingMenuSnapshots) ? data.fundingMenuSnapshots.filter(isFundingMenuSnapshot) : [],
+    merged.credits
+  );
+  const fundings = dedupePendingFundings(
+    Array.isArray(data.pendingFundings) ? data.pendingFundings.filter((funding) => isObjectRecord(funding)).map(normalizeRailKey) : []
+  );
+  const implicit = dedupeImplicitCredits(
+    Array.isArray(data.implicitCredits) ? data.implicitCredits.filter(isStoredImplicitCredit) : []
+  );
+  const store = {
+    credits: merged.credits,
+    implicitCredits: implicit.credits,
+    pendingFundings: fundings.fundings,
+    fundingMenuSnapshots: snapshots.snapshots
+  };
+  if (merged.changed || snapshots.changed || fundings.changed || implicit.changed) saveStore(store);
+  return store;
+}
+function isStoredImplicitCredit(value) {
+  if (!isObjectRecord(value)) return false;
+  return typeof value.endpoint === "string" && typeof value.callerPubkey === "string" && typeof value.creditId === "string" && value.creditId.startsWith("imp:") && typeof value.currency === "string" && typeof value.remainingMicro === "number" && Number.isFinite(value.remainingMicro) && typeof value.ledgerSeq === "number" && Number.isInteger(value.ledgerSeq) && typeof value.expiryMs === "number" && Number.isFinite(value.expiryMs) && (value.status === "active" || value.status === "lost") && typeof value.releasedByJobId === "string" && typeof value.releasedAt === "number" && Number.isFinite(value.releasedAt) && typeof value.updatedAt === "number" && Number.isFinite(value.updatedAt);
+}
+function dedupeImplicitCredits(credits) {
+  const merged = [];
+  let changed = false;
+  for (const candidate of credits) {
+    candidate.endpoint = normalizeCreditEndpoint(candidate.endpoint);
+    const identity = dvmLocationIdentity(candidate);
+    const existing = findDvmLocated(merged, {
+      endpoint: candidate.endpoint,
+      ...identity ? { identity } : {},
+      where: (record) => record.callerPubkey === candidate.callerPubkey && record.creditId === candidate.creditId
+    });
+    if (!existing) {
+      merged.push(candidate);
+      continue;
+    }
+    changed = true;
+    for (const origin of dvmLocationOrigins(candidate)) {
+      attachDvmLocation(existing, origin, identity);
+    }
+    if (candidate.ledgerSeq > existing.ledgerSeq || candidate.ledgerSeq === existing.ledgerSeq && candidate.updatedAt > existing.updatedAt) {
+      existing.currency = candidate.currency;
+      existing.remainingMicro = candidate.remainingMicro;
+      existing.ledgerSeq = candidate.ledgerSeq;
+      existing.status = candidate.status;
+      if (candidate.lossReason) existing.lossReason = candidate.lossReason;
+      else delete existing.lossReason;
+      existing.updatedAt = candidate.updatedAt;
+      existing.lastReceiptJobId = candidate.lastReceiptJobId;
+      existing.discrepancy = candidate.discrepancy;
+    }
+    existing.expiryMs = Math.min(existing.expiryMs, candidate.expiryMs);
+    if (candidate.releasedAt < existing.releasedAt) {
+      existing.releasedAt = candidate.releasedAt;
+      existing.releasedByJobId = candidate.releasedByJobId;
+    }
+  }
+  const capped = capLostImplicitCredits(merged);
+  return { credits: capped.credits, changed: changed || capped.changed };
+}
+function capLostImplicitCredits(credits) {
+  const lostByOwner = /* @__PURE__ */ new Map();
+  for (const credit of credits) {
+    if (credit.status !== "lost") continue;
+    const identity = dvmLocationIdentity(credit);
+    const dvmKey = identity ? `${identity.dvmId}\0${identity.builderPubkey}` : normalizeCreditEndpoint(credit.endpoint);
+    const key = `${credit.callerPubkey}\0${dvmKey}`;
+    const group = lostByOwner.get(key) ?? [];
+    group.push(credit);
+    lostByOwner.set(key, group);
+  }
+  const dropped = /* @__PURE__ */ new Set();
+  for (const group of lostByOwner.values()) {
+    group.sort((a, b) => b.updatedAt - a.updatedAt);
+    for (const credit of group.slice(MAX_LOST_IMPLICIT_CREDITS)) dropped.add(credit);
+  }
+  return dropped.size === 0 ? { credits, changed: false } : { credits: credits.filter((credit) => !dropped.has(credit)), changed: true };
+}
+function mergeDuplicateSnapshots(snapshots, credits) {
+  const identities = originIdentityMap(credits);
+  const merged = [];
+  const byIdentity = /* @__PURE__ */ new Map();
+  let changed = false;
+  for (const snapshot of snapshots) {
+    const stamped = identities.get(`${snapshot.callerPubkey}\0${snapshot.endpoint}`);
+    if (stamped !== void 0 && snapshot.dvmId === void 0) {
+      snapshot.dvmId = stamped.dvmId;
+      if (stamped.attestedBuilderPubkey !== void 0) {
+        snapshot.attestedBuilderPubkey = stamped.attestedBuilderPubkey;
+      }
+      changed = true;
+    }
+    if (snapshot.dvmId === void 0) {
+      merged.push(snapshot);
+      continue;
+    }
+    const key = `${snapshot.callerPubkey}\0${snapshot.dvmId}\0${snapshot.attestedBuilderPubkey ?? ""}`;
+    const index = byIdentity.get(key);
+    if (index === void 0) {
+      byIdentity.set(key, merged.length);
+      merged.push(snapshot);
+      continue;
+    }
+    merged[index] = mergeSnapshots(merged[index], snapshot);
+    changed = true;
+  }
+  return { snapshots: merged, changed };
+}
+function mergeSnapshots(left, right) {
+  const leftSeen = Number.isFinite(left.observedAt) ? left.observedAt : 0;
+  const rightSeen = Number.isFinite(right.observedAt) ? right.observedAt : 0;
+  const [newer, older] = rightSeen >= leftSeen ? [right, left] : [left, right];
+  const snapshot = { ...newer };
+  if (snapshot.builderPubkey === void 0 && older.builderPubkey !== void 0) {
+    snapshot.builderPubkey = older.builderPubkey;
+  }
+  const origins = dvmLocationOrigins(newer).concat(dvmLocationOrigins(older));
+  const aliases = [...new Set(origins)].filter((origin) => origin !== snapshot.endpoint);
+  if (aliases.length > 0) snapshot.endpointAliases = aliases;
+  else delete snapshot.endpointAliases;
+  return snapshot;
+}
+function originIdentityMap(credits) {
+  const identities = /* @__PURE__ */ new Map();
+  const ambiguous = /* @__PURE__ */ new Set();
+  for (const record of credits) {
+    if (typeof record.dvmId !== "string" || typeof record.callerPubkey !== "string") continue;
+    const identity = {
+      dvmId: record.dvmId,
+      ...record.attestedBuilderPubkey !== void 0 ? { attestedBuilderPubkey: record.attestedBuilderPubkey } : {}
+    };
+    for (const origin of dvmLocationOrigins(record)) {
+      const key = `${record.callerPubkey}\0${origin}`;
+      const seen = identities.get(key);
+      if (seen !== void 0 && (seen.dvmId !== identity.dvmId || seen.attestedBuilderPubkey !== identity.attestedBuilderPubkey)) {
+        ambiguous.add(key);
+        continue;
+      }
+      identities.set(key, identity);
+    }
+  }
+  for (const key of ambiguous) identities.delete(key);
+  return identities;
+}
+function dedupePendingFundings(fundings) {
+  const kept = [];
+  const byIntent = /* @__PURE__ */ new Map();
+  let changed = false;
+  for (const funding of fundings) {
+    if (typeof funding.callerPubkey !== "string" || typeof funding.creditId !== "string" || typeof funding.fundId !== "string") {
+      kept.push(funding);
+      continue;
+    }
+    const key = `${funding.callerPubkey}\0${funding.creditId}\0${funding.fundId}`;
+    const index = byIntent.get(key);
+    if (index === void 0) {
+      byIntent.set(key, kept.length);
+      kept.push(funding);
+      continue;
+    }
+    const seen = kept[index];
+    const seenAt = Number.isFinite(seen.requestedAt) ? seen.requestedAt : 0;
+    const at = Number.isFinite(funding.requestedAt) ? funding.requestedAt : 0;
+    if (at > seenAt) kept[index] = funding;
+    changed = true;
+  }
+  return { fundings: kept, changed };
+}
+function isObjectRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function mergeDuplicateCredits(credits) {
+  const merged = [];
+  const byCredit = /* @__PURE__ */ new Map();
+  let changed = false;
+  for (const record of credits) {
+    if (typeof record.creditId !== "string" || typeof record.callerPubkey !== "string") {
+      merged.push(record);
+      continue;
+    }
+    const key = `${record.callerPubkey}\0${record.creditId}`;
+    const index = byCredit.get(key);
+    if (index === void 0) {
+      byCredit.set(key, merged.length);
+      merged.push(record);
+      continue;
+    }
+    merged[index] = mergeCreditRecords(merged[index], record);
+    changed = true;
+  }
+  return { credits: merged, changed };
+}
+function mergeCreditRecords(left, right) {
+  const leftUpdated = Number.isFinite(left.updatedAt) ? left.updatedAt : 0;
+  const rightUpdated = Number.isFinite(right.updatedAt) ? right.updatedAt : 0;
+  const [newer, older] = rightUpdated >= leftUpdated ? [right, left] : [left, right];
+  const record = { ...newer };
+  if (record.dvmId === void 0 && older.dvmId !== void 0) record.dvmId = older.dvmId;
+  if (record.attestedBuilderPubkey === void 0 && older.attestedBuilderPubkey !== void 0 && record.dvmId === older.dvmId) {
+    record.attestedBuilderPubkey = older.attestedBuilderPubkey;
+  }
+  if (record.rail === void 0 && older.rail !== void 0) record.rail = older.rail;
+  if (record.x402Instrument === void 0 && older.x402Instrument !== void 0) {
+    record.x402Instrument = older.x402Instrument;
+  }
+  if (record.x402ChannelNetwork === void 0 && older.x402ChannelNetwork !== void 0) {
+    record.x402ChannelNetwork = older.x402ChannelNetwork;
+  }
+  if (record.menu === void 0 && older.menu !== void 0) record.menu = older.menu;
+  if (record.builderPubkey === void 0 && older.builderPubkey !== void 0) {
+    record.builderPubkey = older.builderPubkey;
+  }
+  const endpoints = dvmLocationOrigins(newer).concat(dvmLocationOrigins(older));
+  const aliases = [...new Set(endpoints)].filter((endpoint) => endpoint !== record.endpoint);
+  if (aliases.length > 0) record.endpointAliases = aliases;
+  else delete record.endpointAliases;
+  const pendingDrains = unionPendingDrains(newer.pendingDrains, older.pendingDrains);
+  if (pendingDrains.length > 0) record.pendingDrains = pendingDrains;
+  else delete record.pendingDrains;
+  const drainEvidence = unionDrainEvidence(newer.drainEvidence, older.drainEvidence);
+  if (drainEvidence.length > 0) record.drainEvidence = drainEvidence;
+  else delete record.drainEvidence;
+  const siblings = Array.isArray(newer.siblingCredits) ? newer.siblingCredits : older.siblingCredits;
+  if (siblings) {
+    record.siblingCredits = siblings.filter((sibling) => sibling.creditId !== record.creditId);
+  } else {
+    delete record.siblingCredits;
+  }
+  return record;
+}
+function unionPendingDrains(preferred, fallback) {
+  const byDrain = /* @__PURE__ */ new Map();
+  for (const drain of [...fallback ?? [], ...preferred ?? []]) {
+    const key = `${drain.drainId}\0${drain.creditId ?? ""}`;
+    byDrain.set(key, { ...byDrain.get(key) ?? {}, ...drain });
+  }
+  return [...byDrain.values()];
+}
+function unionDrainEvidence(preferred, fallback) {
+  const byDrain = /* @__PURE__ */ new Map();
+  for (const evidence of [...fallback ?? [], ...preferred ?? []]) {
+    const key = `${evidence.drainId}\0${evidence.creditId}`;
+    const existing = byDrain.get(key);
+    if (!existing) {
+      byDrain.set(key, evidence);
+      continue;
+    }
+    const [newer, older] = evidence.collectedAt >= existing.collectedAt ? [evidence, existing] : [existing, evidence];
+    const receipts = unionUnknown(newer.receipts, older.receipts);
+    byDrain.set(key, {
+      ...older,
+      ...newer,
+      receipts,
+      collectedAt: Math.max(existing.collectedAt, evidence.collectedAt),
+      ...existing.settledAt !== void 0 || evidence.settledAt !== void 0 ? { settledAt: Math.max(existing.settledAt ?? 0, evidence.settledAt ?? 0) } : {}
+    });
+  }
+  return [...byDrain.values()];
+}
+function unionUnknown(preferred, fallback) {
+  const seen = /* @__PURE__ */ new Set();
+  const values = [];
+  for (const value of [...preferred, ...fallback]) {
+    let key;
+    try {
+      const serialized = JSON.stringify(value);
+      key = typeof serialized === "string" ? serialized : String(value);
+    } catch {
+      key = String(value);
+    }
+    if (seen.has(key)) continue;
+    seen.add(key);
+    values.push(value);
+  }
+  return values;
+}
+function isFundingMenuSnapshot(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const snapshot = value;
+  return typeof snapshot.endpoint === "string" && typeof snapshot.callerPubkey === "string" && typeof snapshot.observedAt === "number" && Number.isFinite(snapshot.observedAt) && Math.abs(snapshot.observedAt) <= MAX_DATE_MS && parseCreditMenu(snapshot.menu) !== void 0 && (snapshot.builderPubkey === void 0 || typeof snapshot.builderPubkey === "string");
+}
+function normalizeRailKey(record) {
+  const loose = record;
+  if (loose.rail === LEGACY_TEMPO_RAIL_KEY) loose.rail = "tempo";
+  if (loose.refillUnavailableRail === LEGACY_TEMPO_RAIL_KEY) loose.refillUnavailableRail = "tempo";
+  if (Array.isArray(loose.pendingDrains)) {
+    for (const drain of loose.pendingDrains) {
+      if (drain?.method === LEGACY_TEMPO_RAIL_KEY) drain.method = "tempo";
+    }
+  }
+  return record;
+}
+var LEGACY_TEMPO_RAIL_KEY = "mpp";
+function normalizeSiblingCredits(record) {
+  if (!Array.isArray(record.siblingCredits)) {
+    delete record.siblingCredits;
+    return record;
+  }
+  record.siblingCredits = record.siblingCredits.filter(
+    (sibling) => isSiblingCredit(sibling) && sibling.creditId !== record.creditId
+  );
+  return record;
+}
+function isSiblingCredit(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const sibling = value;
+  const status = value.status;
+  return typeof sibling.creditId === "string" && typeof sibling.currency === "string" && Number.isSafeInteger(sibling.balanceMicro) && Number.isSafeInteger(sibling.remainingMicro) && Number.isSafeInteger(sibling.ledgerSeq) && Number.isFinite(sibling.expiryMs) && Math.abs(sibling.expiryMs) <= MAX_DATE_MS && typeof sibling.expired === "boolean" && typeof sibling.drainable === "boolean" && (status === void 0 || status === "active" || status === "unbacked") && (sibling.reconciliationPending === void 0 || typeof sibling.reconciliationPending === "boolean") && Number.isFinite(sibling.observedAt) && Math.abs(sibling.observedAt) <= MAX_DATE_MS;
+}
+function normalizeDrains(record) {
+  const legacy = record;
+  const drains = (Array.isArray(record.pendingDrains) ? record.pendingDrains : []).filter(
+    isDrainish
+  );
+  if (isDrainish(legacy.pendingDrain)) drains.unshift(legacy.pendingDrain);
+  delete legacy.pendingDrain;
+  if (drains.length === 0) delete record.pendingDrains;
+  else record.pendingDrains = drains;
+  return record;
+}
+function normalizeEvidence(record) {
+  if (!Array.isArray(record.drainEvidence)) {
+    delete record.drainEvidence;
+    return record;
+  }
+  const evidence = record.drainEvidence.filter(isEvidenceish).map((e) => {
+    const bundle = {
+      ...e,
+      creditId: typeof e.creditId === "string" ? e.creditId : "",
+      collectedAt: Number.isFinite(e.collectedAt) ? e.collectedAt : 0
+    };
+    if (!Number.isFinite(bundle.settledAt)) delete bundle.settledAt;
+    return bundle;
+  });
+  if (evidence.length === 0) delete record.drainEvidence;
+  else record.drainEvidence = evidence;
+  return record;
+}
+function isEvidenceish(value) {
+  return typeof value === "object" && value !== null && typeof value.drainId === "string" && Array.isArray(value.receipts);
+}
+function isDrainish(value) {
+  return typeof value === "object" && value !== null && typeof value.drainId === "string";
+}
+function saveStore(store) {
+  ensureConfigDir();
+  const tmp = `${CREDITS_FILE}.${String(process.pid)}.tmp`;
+  writeFileSync2(tmp, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
+  try {
+    renameSync2(tmp, CREDITS_FILE);
+  } catch (err) {
+    try {
+      unlinkSync2(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function unreadableStore(cause) {
+  const detail = cause instanceof Error ? cause.message : String(cause);
+  return new DvmError(
+    "credit_store_unreadable",
+    `The prepaid-credit record at ${CREDITS_FILE} exists but could not be opened: ${detail}`,
+    `The file was left untouched. Check that you own it and can read it ('ls -l ${CREDITS_FILE}'), then retry \u2014 'chmod 600 ${CREDITS_FILE}' fixes the common case. Do not delete it: it may hold DVM-signed drain receipts for a refund that is still owed.`,
+    { credits_file: CREDITS_FILE, cause: detail },
+    `Your local record of prepaid credits could not be opened \u2014 this looks like a file-permissions problem on this machine, not damage to the record. Nothing was changed or deleted, so any signed proof of a refund you are owed is still there.`
+  );
+}
+function quarantineCorruptStore(cause) {
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const quarantined = `${CREDITS_FILE}.corrupt-${stamp}-${String(process.pid)}`;
+  let moved = false;
+  try {
+    renameSync2(CREDITS_FILE, quarantined);
+    moved = true;
+  } catch {
+  }
+  const kept = moved ? quarantined : CREDITS_FILE;
+  return new DvmError(
+    "credit_store_corrupt",
+    moved ? `The prepaid-credit record at ${CREDITS_FILE} is damaged and could not be parsed; it was moved aside to ${quarantined}.` : `The prepaid-credit record at ${CREDITS_FILE} is damaged and could not be parsed, and could not be moved aside.`,
+    `Do not delete ${kept} \u2014 it may hold DVM-signed drain receipts for a refund that is still owed. Balances themselves live on the DVM, so 'dvm credit balance <dvm>' re-reads them.`,
+    {
+      credits_file: CREDITS_FILE,
+      ...moved ? { quarantined_path: quarantined } : {},
+      cause: cause instanceof Error ? cause.message : String(cause)
+    },
+    `The local record of your prepaid credits is damaged. It was set aside at ${kept} rather than overwritten, so any signed proof of a refund you are owed is still in that file. Your credits are held by each DVM, not by this file, so re-reading a balance will restore what the CLI shows.`
+  );
+}
+function mutateCredit(location, mutate) {
+  withCreditLock(() => {
+    const store = loadStore();
+    const key = normalizeCreditEndpoint(location.endpoint);
+    const record = findDvmLocated(store.credits, {
+      endpoint: key,
+      ...location.identity ? { identity: location.identity } : {},
+      where: (c) => c.callerPubkey === location.callerPubkey
+    });
+    if (!record) return;
+    const locationChanged = attachDvmLocation(record, key, location.identity);
+    if (mutate(record) === "skip") {
+      if (locationChanged) saveStore(store);
+      return;
+    }
+    record.updatedAt = Date.now();
+    saveStore(store);
+  });
+}
+var DEFAULT_LOCK_STALE_MS = 1e4;
+var DEFAULT_LOCK_RETRIES = 600;
+var DEFAULT_LOCK_RETRY_INTERVAL_MS = 25;
+var lockDepth = 0;
+function acquireCreditLock(opts) {
+  ensureConfigDir();
+  const lockPath = `${CREDITS_FILE}.lock`;
+  const stale = opts.stale ?? DEFAULT_LOCK_STALE_MS;
+  const retries = opts.retries ?? DEFAULT_LOCK_RETRIES;
+  const interval = opts.retryIntervalMs ?? DEFAULT_LOCK_RETRY_INTERVAL_MS;
+  let lastError;
+  for (let attempt = 0; attempt <= retries; attempt += 1) {
+    try {
+      return lockfile2.lockSync(CREDITS_FILE, {
+        lockfilePath: lockPath,
+        stale,
+        realpath: false
+      });
+    } catch (err) {
+      lastError = err;
+      if (err.code !== "ELOCKED") {
+        const detail = err instanceof Error ? err.message : String(err);
+        const configDir = dirname(lockPath);
+        throw new DvmError(
+          "credit_store_lock_failed",
+          `Could not create the prepaid-credit lock at ${lockPath}: ${detail}`,
+          `This is not contention \u2014 nothing is holding the lock. Check that ${configDir} exists and is writable by you ('ls -ld ${configDir}'), then retry.`,
+          {
+            lock_file: lockPath,
+            config_dir: configDir,
+            underlying: detail,
+            errno_code: err.code
+          },
+          `The dvm CLI could not create the small lock file it uses to keep two commands from writing your credit record at once. Its folder looks unwritable \u2014 nothing about your credits is wrong, and nothing was changed.`
+        );
+      }
+      if (attempt === retries) break;
+      sleepSync(interval);
+    }
+  }
+  throw new DvmError(
+    "credit_store_locked",
+    `Could not acquire the prepaid-credit lock at ${lockPath} within the retry budget.`,
+    `Another dvm CLI may be writing to ${CREDITS_FILE}. Wait a moment and retry. If no other dvm CLI is running, remove ${lockPath} and try again.`,
+    {
+      lock_file: lockPath,
+      underlying: lastError instanceof Error ? lastError.message : String(lastError)
+    }
+  );
+}
+function rejectAsyncBody(result) {
+  if (typeof result?.then !== "function") {
+    return result;
+  }
+  throw new DvmError(
+    "credit_store_lock_misuse",
+    "withCreditLock was called with an asynchronous body. The lock is released when the body returns, so a promise's writes would run unprotected.",
+    "Make the locked body synchronous \u2014 the credit store's whole surface is sync \u2014 and do any awaiting outside the lock."
+  );
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+export {
+  info,
+  progress,
+  maxAdvertisedMicro,
+  withinAdvertisedTolerance,
+  isValidEvmPrivateKey,
+  authorizeProtectedRemoval,
+  isCreditPosture,
+  loadConfig,
+  updateConfig,
+  SUPPORTED_PROTOCOL_VERSION,
+  parseCreditTerms,
+  parseCreditMenu,
+  normalizeCreditEndpoint,
+  fundingReachableAt,
+  listCredits,
+  listPendingFundings,
+  loadPendingFunding,
+  recordPendingFunding,
+  clearPendingFunding,
+  recordFundResponse,
+  loadCreditX402Binding,
+  recordCreditX402Instrument
+};