@dvmkit/sdk 0.1.0-rc.3 → 0.1.0-rc.5

package/dist/{chunk-FT7IM66W.js → chunk-4KB3LTOS.js}

@@ -6,7 +6,7 @@ import {
   CREDITS_FILE,
   DvmError,
   ensureConfigDir
-} from "./chunk-5SO7ZVOH.js";
+} from "./chunk-F2L6KIMD.js";
 
 // src/lib/payment-rails/types.ts
 var ADVERTISED_AMOUNT_TOLERANCE_BPS = 1000n;
@@ -96,6 +96,11 @@ function parseCreditX402Terms(raw) {
   };
 }
 
+// src/lib/credit-store.ts
+import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "fs";
+import { dirname } from "path";
+import lockfile from "proper-lockfile";
+
 // src/lib/output.ts
 import { writeSync } from "fs";
 function info(msg) {
@@ -118,1417 +123,1492 @@ function writeAllSync(fd, text) {
   }
 }
 
-// src/lib/evm-private-key.ts
-import { secp256k1 } from "@noble/curves/secp256k1.js";
-import { hexToBytes } from "@noble/hashes/utils.js";
-var EVM_PRIVATE_KEY_RE = /^0x[0-9a-fA-F]{64}$/;
-function isValidEvmPrivateKey(value) {
-  return EVM_PRIVATE_KEY_RE.test(value) && secp256k1.utils.isValidSecretKey(hexToBytes(value.slice(2)));
-}
-
-// src/lib/config-mutation.ts
-import {
-  appendFileSync,
-  chmodSync,
-  existsSync,
-  readFileSync,
-  renameSync,
-  statSync,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-var PROTECTED_CONFIG_FIELDS = ["nwcUri", "defaultIdentity", "tempo", "x402"];
-var ProtectedFieldAuthorization = class {
-  /** Targets this authorization covers. A field also covers its own leaves. */
-  targets;
-  /** Prefer {@link authorizeProtectedRemoval}; this exists for it to call. */
-  constructor(targets) {
-    this.targets = [...targets];
+// src/lib/credit-store.ts
+function withCreditLock(fn, opts = {}) {
+  if (lockDepth > 0) {
+    lockDepth += 1;
+    try {
+      return rejectAsyncBody(fn());
+    } finally {
+      lockDepth -= 1;
+    }
   }
-  /**
-   * True when `target` is one this authorization names. Naming a field covers
-   * the leaves under it; naming a leaf covers only that leaf, so a command
-   * entitled to clear `tempo.apiKey` still cannot take the whole `tempo` block.
-   */
-  covers(target) {
-    if (this.targets.includes(target)) return true;
-    const field = target.split(".")[0];
-    return target !== field && this.targets.includes(field);
+  const release = acquireCreditLock(opts);
+  lockDepth = 1;
+  try {
+    return rejectAsyncBody(fn());
+  } finally {
+    lockDepth = 0;
+    try {
+      release();
+    } catch {
+    }
   }
-};
-function authorizeProtectedRemoval(...targets) {
-  return new ProtectedFieldAuthorization(targets);
 }
-function applyConfigPatch(base, patch) {
-  if (!isPlainObject(patch))
-    throw patchShapeError("A change must be an object with `set` and/or `unset`.");
-  if (patch.set !== void 0 && !isPlainObject(patch.set)) {
-    throw patchShapeError("A change's `set` must be an object of fields to write.");
-  }
-  if (patch.unset !== void 0 && !Array.isArray(patch.unset)) {
-    throw patchShapeError("A change's `unset` must be an array of field names.");
-  }
-  const set = patch.set ?? {};
-  const unset = patch.unset ?? [];
-  for (const [field, value] of Object.entries(set)) {
-    if (value !== void 0) continue;
-    throw new DvmError(
-      "config_patch_invalid",
-      `Config field '${field}' was declared with no value.`,
-      "Give the field a value, or name it in the change's `unset` list to remove it. An undefined value is how a field gets dropped without anyone deciding to drop it."
-    );
+function normalizeCreditEndpoint(endpoint) {
+  try {
+    return new URL(endpoint).origin;
+  } catch {
+    return endpoint.replace(/\/+$/, "");
   }
-  for (const field of unset) {
-    if (typeof field !== "string" || field.length === 0) {
-      throw patchShapeError("Every entry in a change's `unset` must be a field name.");
-    }
-    if (!Object.hasOwn(set, field)) continue;
-    throw new DvmError(
-      "config_patch_invalid",
-      `Config field '${field}' is both written and removed by the same change.`,
-      "Declare each field once: in `set` with its new value, or in `unset` to remove it."
+}
+function dvmLocationIdentity(record) {
+  if (typeof record.dvmId !== "string" || record.dvmId.length === 0) return void 0;
+  const pubkey = typeof record.attestedBuilderPubkey === "string" ? record.attestedBuilderPubkey.trim().toLowerCase() : "";
+  if (!/^[0-9a-f]{64}$/.test(pubkey)) return void 0;
+  return { dvmId: record.dvmId, builderPubkey: pubkey };
+}
+function findDvmLocated(records, args) {
+  const where = args.where ?? (() => true);
+  const identity = args.identity;
+  if (identity) {
+    const attested = records.find(
+      (record) => where(record) && matchesDvmIdentity(record, identity)
     );
+    if (attested) return attested;
   }
-  const merged = { ...base, ...set };
-  const removing = new Set(unset);
-  return Object.fromEntries(
-    Object.entries(merged).filter(([field]) => !removing.has(field))
+  return records.find(
+    (record) => where(record) && matchesDvmOrigin(record, args.endpoint, identity)
   );
 }
-function deepFreezeConfig(config) {
-  freezeDeep(config);
-  return config;
-}
-function protectedRemovals(before, after) {
-  const previous = before;
-  const next = after;
-  const removed = [];
-  for (const field of PROTECTED_CONFIG_FIELDS) {
-    const held = previous[field];
-    if (!isPresentValue(held)) continue;
-    const kept = next[field];
-    if (!isPresentValue(kept)) {
-      removed.push(field);
-      continue;
-    }
-    const spec = PROTECTED_FIELDS[field];
-    if (spec.credentialLeaves.length === 0) continue;
-    if (!isPlainObject(held)) continue;
-    if (!isPlainObject(kept)) {
-      removed.push(field);
-      continue;
+function attachDvmLocation(record, endpoint, identity) {
+  let changed = false;
+  if (identity) {
+    if (record.dvmId !== identity.dvmId) {
+      record.dvmId = identity.dvmId;
+      changed = true;
     }
-    for (const leaf of spec.credentialLeaves) {
-      if (!isPresentValue(held[leaf]) || isPresentValue(kept[leaf])) continue;
-      removed.push(`${field}.${leaf}`);
+    if (record.attestedBuilderPubkey !== identity.builderPubkey) {
+      record.attestedBuilderPubkey = identity.builderPubkey;
+      changed = true;
     }
   }
-  return removed;
-}
-function supersededProtectedSecrets(before, after) {
-  const previous = before;
-  const next = after;
-  const superseded = [];
-  for (const field of PROTECTED_CONFIG_FIELDS) {
-    const spec = PROTECTED_FIELDS[field];
-    if (!spec.secret) continue;
-    const held = previous[field];
-    const kept = next[field];
-    if (spec.credentialLeaves.length === 0) {
-      if (isPresentValue(held) && isPresentValue(kept) && held !== kept) superseded.push(field);
-      continue;
-    }
-    if (!isPlainObject(held) || !isPlainObject(kept)) continue;
-    for (const leaf of spec.credentialLeaves) {
-      const was = held[leaf];
-      const now = kept[leaf];
-      if (!isPresentValue(was) || !isPresentValue(now) || was === now) continue;
-      superseded.push(`${field}.${leaf}`);
-    }
+  if (endpoint !== record.endpoint && !dvmLocationOrigins(record).includes(endpoint)) {
+    record.endpointAliases = [...record.endpointAliases ?? [], endpoint];
+    changed = true;
   }
-  return superseded;
+  return changed;
 }
-function changedConfigPaths(before, after) {
-  const found = /* @__PURE__ */ new Set();
-  collectChangedPaths(
-    before,
-    after,
-    CONFIG_PATH_SHAPE,
-    "",
-    found
+function dvmLocationOrigins(record) {
+  const aliases = Array.isArray(record.endpointAliases) ? record.endpointAliases.filter((endpoint) => typeof endpoint === "string") : [];
+  const primary = typeof record.endpoint === "string" ? [record.endpoint] : [];
+  return [...primary, ...aliases].map(normalizeCreditEndpoint);
+}
+function fundingReachableAt(funding, endpoint, credits) {
+  const at = normalizeCreditEndpoint(funding.endpoint);
+  const named = normalizeCreditEndpoint(endpoint);
+  if (at === named) return true;
+  const record = credits.find(
+    (c) => c.callerPubkey === funding.callerPubkey && c.creditId === funding.creditId
   );
-  return [...found].sort();
+  if (!record) return false;
+  const origins = dvmLocationOrigins(record);
+  return origins.includes(at) && origins.includes(named);
 }
-function assertValidConfig(config, fields) {
-  if (!isPlainObject(config)) {
-    throw new DvmError(
-      "config_invalid",
-      "The caller configuration is not a JSON object.",
-      `Expected an object at ${CONFIG_FILE}.${rollbackSuffix()}`
-    );
-  }
-  const record = config;
-  const scope = fields ? new Set(fields) : null;
-  for (const [field, kind] of Object.entries(CONFIG_FIELD_TYPES)) {
-    if (scope && !scope.has(field)) continue;
-    const value = record[field];
-    if (value === void 0) continue;
-    if (!matchesKind(value, kind)) throw invalidFieldError(field, kind);
-  }
-  for (const [path, kind] of Object.entries(CONFIG_LEAF_TYPES)) {
-    const [field, leaf] = path.split(".");
-    if (scope && !scope.has(field)) continue;
-    const owner = record[field];
-    if (!isPlainObject(owner)) continue;
-    const value = owner[leaf];
-    if (value === void 0 || !matchesKind(value, kind)) throw invalidFieldError(path, kind);
-  }
+function pendingDrainFor(record, creditId) {
+  return record?.pendingDrains?.find((d) => d.creditId === creditId);
 }
-function readRawConfig() {
-  if (!existsSync(CONFIG_FILE)) return null;
-  try {
-    return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
-  } catch {
-    throw new DvmError(
-      "config_corrupt",
-      "Config file is corrupt.",
-      // Not "delete it": those bytes are the only copy on this machine of the
-      // NWC connection string and both private keys, however badly they parse.
-      `Run 'dvm config rollback' to restore a stored copy, or move ${CONFIG_FILE} aside yourself and run 'dvm init'.${rollbackSuffix()}`
-    );
-  }
+function loadCredit(endpoint, callerPubkey, identity) {
+  return withCreditLock(() => {
+    const key = normalizeCreditEndpoint(endpoint);
+    const store = loadStore();
+    const record = findDvmLocated(store.credits, {
+      endpoint: key,
+      ...identity ? { identity } : {},
+      where: (c) => c.callerPubkey === callerPubkey
+    });
+    if (record && attachDvmLocation(record, key, identity)) saveStore(store);
+    return record;
+  });
 }
-function writeConfigFile(config) {
-  writeJsonAtomic(CONFIG_FILE, config);
+function listCredits() {
+  return withCreditLock(() => [...loadStore().credits].sort((a, b) => b.updatedAt - a.updatedAt));
 }
-var CONFIG_SNAPSHOT_SLOTS = ["backup", "pinned"];
-function configSnapshotPath(slot) {
-  return slot === "pinned" ? CONFIG_PINNED_FILE : CONFIG_BACKUP_FILE;
+function listPendingFundings(args = {}) {
+  const endpoint = args.endpoint ? normalizeCreditEndpoint(args.endpoint) : void 0;
+  return withCreditLock(() => {
+    const store = loadStore();
+    return store.pendingFundings.filter(
+      (funding) => (!endpoint || fundingReachableAt(funding, endpoint, store.credits)) && (!args.callerPubkey || funding.callerPubkey === args.callerPubkey) && (!args.creditId || funding.creditId === args.creditId)
+    ).sort((a, b) => a.requestedAt - b.requestedAt);
+  });
 }
-function describeConfigBackup(slot = "backup") {
-  const path = configSnapshotPath(slot);
-  try {
-    if (!existsSync(path)) return null;
-    const stat = statSync(path);
-    const posix = process.platform !== "win32";
-    const mode = stat.mode & 511;
-    return {
-      path,
-      slot,
-      bytes: stat.size,
-      modifiedAt: stat.mtime.toISOString(),
-      modeOctal: posix ? toOctal(mode) : null,
-      ownerOnly: !posix || (mode & 63) === 0
-    };
-  } catch {
-    return null;
-  }
+function loadPendingFunding(endpoint, callerPubkey, creditId) {
+  return listPendingFundings({ endpoint, callerPubkey, ...creditId ? { creditId } : {} })[0];
 }
-function readConfigBackup(slot = "backup") {
-  const path = configSnapshotPath(slot);
-  if (!existsSync(path)) return null;
-  try {
-    const parsed = JSON.parse(readFileSync(path, "utf-8"));
-    return isPlainObject(parsed) ? parsed : null;
-  } catch {
-    return null;
-  }
+function recordPendingFunding(funding) {
+  withCreditLock(() => {
+    const store = loadStore();
+    const normalized = { ...funding, endpoint: normalizeCreditEndpoint(funding.endpoint) };
+    const index = store.pendingFundings.findIndex(
+      (entry) => entry.callerPubkey === normalized.callerPubkey && entry.creditId === normalized.creditId && entry.fundId === normalized.fundId && fundingReachableAt(entry, normalized.endpoint, store.credits)
+    );
+    if (index === -1) store.pendingFundings.push(normalized);
+    else
+      store.pendingFundings[index] = {
+        ...normalized,
+        endpoint: store.pendingFundings[index].endpoint
+      };
+    saveStore(store);
+  });
 }
-function retainConfigBackup(slot = "backup") {
-  if (!existsSync(CONFIG_FILE)) return false;
-  ensureConfigDir();
-  const path = configSnapshotPath(slot);
-  const tmp = `${path}.tmp`;
-  writeFileSync(tmp, readFileSync(CONFIG_FILE), { mode: 384 });
-  chmodSync(tmp, 384);
-  commitTmp(tmp, path);
-  return true;
+function clearPendingFunding(endpoint, callerPubkey, creditId, fundId) {
+  withCreditLock(() => {
+    const store = loadStore();
+    const normalized = normalizeCreditEndpoint(endpoint);
+    const remaining = store.pendingFundings.filter(
+      (entry) => !(entry.callerPubkey === callerPubkey && entry.creditId === creditId && entry.fundId === fundId && fundingReachableAt(entry, normalized, store.credits))
+    );
+    if (remaining.length === store.pendingFundings.length) return;
+    saveStore({ ...store, pendingFundings: remaining });
+  });
 }
-function writeConfigBackup(config, slot = "backup") {
-  writeJsonAtomic(configSnapshotPath(slot), config);
+function recordFundResponse(args) {
+  const now = args.now ?? Date.now();
+  return withCreditLock(() => {
+    const store = loadStore();
+    const key = normalizeCreditEndpoint(args.endpoint);
+    let record = findDvmLocated(store.credits, {
+      endpoint: key,
+      ...args.identity ? { identity: args.identity } : {},
+      where: (c) => c.callerPubkey === args.callerPubkey
+    });
+    if (!record) {
+      record = {
+        endpoint: key,
+        ...identityFields(args.identity),
+        callerPubkey: args.callerPubkey,
+        creditId: args.credit.credit_id,
+        currency: args.credit.currency,
+        balanceMicro: 0,
+        remainingMicro: 0,
+        ledgerSeq: 0,
+        expiryMs: 0,
+        targetMicro: args.targetMicro,
+        status: "active",
+        openedAt: now,
+        updatedAt: now
+      };
+      store.credits.push(record);
+    }
+    attachDvmLocation(record, key, args.identity);
+    adoptCreditId(record, args.credit.credit_id);
+    record.currency = args.credit.currency;
+    record.balanceMicro = args.credit.balance_micro;
+    record.remainingMicro = args.credit.remaining_micro;
+    record.ledgerSeq = Math.max(record.ledgerSeq, args.credit.ledger_seq);
+    record.expiryMs = args.credit.expiry_ms;
+    record.targetMicro = args.targetMicro;
+    record.status = args.credit.status === "unbacked" ? "unbacked" : args.credit.expired ? "expired" : "active";
+    record.reconciliationPending = args.credit.reconciliation_pending;
+    record.updatedAt = now;
+    delete record.provisional;
+    if (args.sequenced === false) record.unsequencedBalance = true;
+    else delete record.unsequencedBalance;
+    if (args.menu) record.menu = args.menu;
+    if (args.rail) {
+      record.rail = args.rail;
+      delete record.refillUnavailableRail;
+    }
+    if (args.x402Instrument) record.x402Instrument = args.x402Instrument;
+    if (args.x402ChannelNetwork) record.x402ChannelNetwork = args.x402ChannelNetwork;
+    if (args.builderPubkey) record.builderPubkey = args.builderPubkey;
+    if (args.select) delete record.selectionCleared;
+    delete record.discrepancy;
+    saveStore(store);
+    return record;
+  });
 }
-function removeConfigBackup(slot = "backup") {
-  const path = configSnapshotPath(slot);
-  if (!existsSync(path)) return false;
-  unlinkSync(path);
-  return true;
+function ensureProvisionalCredit(args) {
+  const now = args.now ?? Date.now();
+  withCreditLock(() => {
+    const store = loadStore();
+    const key = normalizeCreditEndpoint(args.endpoint);
+    let record = findDvmLocated(store.credits, {
+      endpoint: key,
+      ...args.identity ? { identity: args.identity } : {},
+      where: (c) => c.callerPubkey === args.callerPubkey
+    });
+    if (!record) {
+      record = {
+        endpoint: key,
+        ...identityFields(args.identity),
+        callerPubkey: args.callerPubkey,
+        creditId: args.creditId,
+        currency: args.currency,
+        balanceMicro: 0,
+        remainingMicro: 0,
+        ledgerSeq: 0,
+        expiryMs: 0,
+        targetMicro: args.targetMicro,
+        status: "active",
+        openedAt: now,
+        updatedAt: now
+      };
+      store.credits.push(record);
+    }
+    attachDvmLocation(record, key, args.identity);
+    adoptCreditId(record, args.creditId);
+    record.currency = args.currency;
+    record.targetMicro = args.targetMicro;
+    record.status = "active";
+    record.provisional = true;
+    record.updatedAt = now;
+    if (args.menu) record.menu = args.menu;
+    saveStore(store);
+  });
 }
-function protectedTargetValue(config, target) {
-  const [field, named] = target.split(".");
-  const held = config[field];
-  const leaves = PROTECTED_FIELDS[field].credentialLeaves;
-  const leaf = named ?? (leaves.length > 0 ? leaves[0] : void 0);
-  if (leaf === void 0) return held;
-  return isPlainObject(held) ? held[leaf] : void 0;
+function loadCreditX402Binding(endpoint, callerPubkey, creditId, identity) {
+  const record = loadCredit(endpoint, callerPubkey, identity);
+  if (record?.creditId !== creditId) return {};
+  if (record.status !== "active" && record.status !== "expired") return {};
+  return {
+    ...record.x402Instrument ? { instrument: record.x402Instrument } : {},
+    ...record.x402ChannelNetwork ? { channelNetwork: record.x402ChannelNetwork } : {}
+  };
 }
-function protectedValuesMatch(target, left, right) {
-  const normalized = comparableProtectedValue(target, left);
-  return normalized !== void 0 && normalized === comparableProtectedValue(target, right);
+function recordCreditX402Instrument(endpoint, callerPubkey, creditId, instrument, identity, channelNetwork) {
+  mutateCredit(mutationAt(endpoint, callerPubkey, identity), (record) => {
+    if (record.creditId !== creditId) return "skip";
+    const instrumentChanged = record.x402Instrument !== instrument;
+    const channelNetworkChanged = instrument === "x402_channel" && channelNetwork !== void 0 && record.x402ChannelNetwork !== channelNetwork;
+    if (!instrumentChanged && !channelNetworkChanged) return "skip";
+    if (instrumentChanged) {
+      record.x402Instrument = instrument;
+      delete record.x402ChannelNetwork;
+    }
+    if (instrument === "x402_channel" && channelNetwork !== void 0) {
+      record.x402ChannelNetwork = channelNetwork;
+    }
+    return void 0;
+  });
 }
-function isSecretProtectedTarget(target) {
-  return PROTECTED_FIELDS[target.split(".")[0]].secret;
+function recordPendingDrain(endpoint, callerPubkey, drain, identity) {
+  mutateCredit(mutationAt(endpoint, callerPubkey, identity), (record) => {
+    const drains = record.pendingDrains ?? [];
+    const index = drains.findIndex(
+      (d) => d.drainId === drain.drainId && d.creditId === drain.creditId
+    );
+    if (index === -1) drains.push(drain);
+    else drains[index] = drain;
+    record.pendingDrains = capPendingDrains(drains, record.creditId);
+    return void 0;
+  });
 }
-function withoutProtectedTargets(config, targets) {
-  const dropping = /* @__PURE__ */ new Set();
-  for (const target of targets) {
-    const field = target.split(".")[0];
-    dropping.add(field);
-    for (const alias of PROTECTED_FIELDS[field].aliases) dropping.add(alias);
-  }
-  return Object.fromEntries(
-    Object.entries(config).filter(([field]) => !dropping.has(field))
-  );
+function clearPendingDrain(endpoint, callerPubkey, drain, identity) {
+  mutateCredit(mutationAt(endpoint, callerPubkey, identity), (record) => {
+    const before = record.pendingDrains ?? [];
+    const remaining = before.filter(
+      (d) => !(d.drainId === drain.drainId && d.creditId === drain.creditId)
+    );
+    if (remaining.length === before.length) return "skip";
+    if (remaining.length === 0) delete record.pendingDrains;
+    else record.pendingDrains = remaining;
+    return void 0;
+  });
 }
-function appendConfigAudit(record) {
-  try {
-    ensureConfigDir();
-    appendFileSync(CONFIG_AUDIT_FILE, JSON.stringify(record) + "\n", { mode: 384 });
-    chmodSync(CONFIG_AUDIT_FILE, 384);
-  } catch {
-  }
+function identityFields(identity) {
+  if (!identity) return {};
+  return { dvmId: identity.dvmId, attestedBuilderPubkey: identity.builderPubkey };
 }
-function protectedRemovalError(targets, reason) {
-  const named = targets.join(", ");
-  const one = targets.length === 1;
-  return new DvmError(
-    "config_protected_field",
-    `The '${reason}' change would remove ${named} from the local configuration.`,
-    `Nothing was written. ${named} ${one ? "is a credential or identity pointer" : "are credentials or identity pointers"} nothing else on this machine records, so only a command that names ${one ? "it" : "them"} explicitly may remove ${one ? "it" : "them"} \u2014 'dvm wallet disconnect', 'dvm wallet tempo-disconnect' and 'dvm wallet x402-disconnect' are those commands.`,
-    { fields: targets }
-  );
+function mutationAt(endpoint, callerPubkey, identity) {
+  return { endpoint, callerPubkey, ...identity ? { identity } : {} };
 }
-var PROTECTED_FIELDS = {
-  nwcUri: { aliases: [], credentialLeaves: [], secret: true, hexCredential: false },
-  // A pointer at a key, not a key: worth protecting from removal, and never
-  // worth stripping out of a stored copy — that is recovery lost for nothing.
-  defaultIdentity: { aliases: [], credentialLeaves: [], secret: false, hexCredential: false },
-  // `mpp` is the pre-internal-review name; a caller who has not run a mutating command
-  // since the rename still has their private key under it.
-  tempo: { aliases: ["mpp"], credentialLeaves: ["apiKey"], secret: true, hexCredential: true },
-  x402: { aliases: [], credentialLeaves: ["privateKey"], secret: true, hexCredential: true }
-};
-var CONFIG_PATH_SHAPE = {
-  float: { statedBudget: {}, connectedAt: {}, alias: {}, methods: {} },
-  x402: { privateKey: {}, network: {} },
-  tempo: { method: {}, accountId: {}, apiKey: {} },
-  credit: {
-    targetJobs: {},
-    posture: {},
-    tier0Cap: {},
-    tier1Cap: {},
-    pocketTarget: {},
-    fundingRail: {},
-    perDvm: { "*": { targetJobs: {}, posture: {}, fundingRail: {}, dvmId: {}, builderPubkey: {} } },
-    trustOverrides: { "*": {} }
-  },
-  feedback: { posture: {} }
-};
-var CONFIG_FIELD_TYPES = {
-  nwcUri: "string",
-  float: "object",
-  defaultBudget: "string",
-  autoPayThreshold: "string",
-  defaultMaxPayments: "number",
-  cashuMints: "string[]",
-  x402: "object",
-  tempo: "object",
-  defaultRail: "string",
-  defaultIdentity: "string",
-  credit: "object",
-  feedback: "object"
-};
-var CONFIG_LEAF_TYPES = {
-  "float.connectedAt": "string",
-  "x402.privateKey": "string",
-  "tempo.method": "string"
-};
-function collectChangedPaths(before, after, shape, prefix, found) {
-  for (const key of /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])) {
-    const held = before[key];
-    const kept = after[key];
-    if (deepEqual(held, kept)) continue;
-    const known = shape !== void 0 && Object.hasOwn(shape, key);
-    const wildcard = !known && shape !== void 0 && Object.hasOwn(shape, "*");
-    const child = known ? shape[key] : wildcard ? shape["*"] : void 0;
-    const path = prefix ? `${prefix}.${wildcard ? "*" : key}` : key;
-    const descendable = child !== void 0 && Object.keys(child).length > 0 && (held === void 0 || isPlainObject(held)) && (kept === void 0 || isPlainObject(kept));
-    if (descendable) {
-      collectChangedPaths(
-        isPlainObject(held) ? held : {},
-        isPlainObject(kept) ? kept : {},
-        child,
-        path,
-        found
-      );
-    } else {
-      found.add(path);
-    }
-  }
-}
-function invalidFieldError(path, kind) {
-  return new DvmError(
-    "config_invalid",
-    `Config field '${path}' must be ${describeKind(kind)}.`,
-    `Nothing was written. Correct the field in ${CONFIG_FILE}, or run 'dvm doctor' for the full picture.${rollbackSuffix()}`
-  );
+function matchesDvmIdentity(record, identity) {
+  const stored = dvmLocationIdentity(record);
+  return stored?.dvmId === identity.dvmId && stored.builderPubkey === identity.builderPubkey;
 }
-function describeKind(kind) {
-  switch (kind) {
-    case "string":
-      return "a string";
-    case "number":
-      return "a number";
-    case "object":
-      return "an object";
-    case "string[]":
-      return "an array of strings";
+function matchesDvmOrigin(record, endpoint, identity) {
+  if (identity) {
+    if (dvmLocationIdentity(record) !== void 0) return false;
+    if (record.dvmId !== void 0 && record.dvmId !== identity.dvmId) return false;
   }
+  return dvmLocationOrigins(record).includes(endpoint);
 }
-function matchesKind(value, kind) {
-  switch (kind) {
-    case "string":
-      return typeof value === "string";
-    case "number":
-      return typeof value === "number" && Number.isFinite(value);
-    case "object":
-      return isPlainObject(value);
-    case "string[]":
-      return Array.isArray(value) && value.every((item) => typeof item === "string");
+function adoptCreditId(record, creditId) {
+  if (record.creditId === creditId) return;
+  if (record.status === "active" || record.status === "expired" || record.status === "unbacked") {
+    const prior = {
+      creditId: record.creditId,
+      status: record.status === "unbacked" ? "unbacked" : "active",
+      currency: record.currency,
+      balanceMicro: record.balanceMicro,
+      remainingMicro: record.remainingMicro,
+      ledgerSeq: record.ledgerSeq,
+      expiryMs: record.expiryMs,
+      expired: record.status === "expired",
+      drainable: record.status !== "unbacked" && record.balanceMicro > 0,
+      ...record.reconciliationPending ? { reconciliationPending: true } : {},
+      observedAt: record.updatedAt
+    };
+    record.siblingCredits = [
+      ...(record.siblingCredits ?? []).filter(
+        (sibling) => sibling.creditId !== prior.creditId && sibling.creditId !== creditId
+      ),
+      prior
+    ];
+  } else if (record.siblingCredits) {
+    record.siblingCredits = record.siblingCredits.filter(
+      (sibling) => sibling.creditId !== creditId
+    );
   }
+  record.creditId = creditId;
+  record.ledgerSeq = 0;
+  record.balanceMicro = 0;
+  record.remainingMicro = 0;
+  record.expiryMs = 0;
+  delete record.unsequencedBalance;
+  delete record.rail;
+  delete record.x402Instrument;
+  delete record.x402ChannelNetwork;
+  delete record.refillUnavailableRail;
+  delete record.refillDrainNoticed;
+  delete record.discrepancy;
+  delete record.lastReceiptJobId;
 }
-function rollbackSuffix() {
-  const stored = describeConfigBackup() ?? describeConfigBackup("pinned");
-  return stored === null ? "" : ` A stored copy of the previous configuration is at ${stored.path}.`;
-}
-function writeJsonAtomic(path, value) {
-  ensureConfigDir();
-  const tmp = `${path}.tmp`;
-  writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", { mode: 384 });
-  chmodSync(tmp, 384);
-  commitTmp(tmp, path);
-}
-function commitTmp(tmp, path) {
-  try {
-    renameSync(tmp, path);
-  } catch (err) {
-    try {
-      unlinkSync(tmp);
-    } catch {
-    }
-    throw err;
+var MAX_PENDING_DRAINS = 8;
+var MAX_LOST_IMPLICIT_CREDITS = 8;
+var MAX_DATE_MS = 864e13;
+function loadStore() {
+  if (!existsSync(CREDITS_FILE)) {
+    return { credits: [], implicitCredits: [], pendingFundings: [], fundingMenuSnapshots: [] };
   }
-}
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (Array.isArray(a) || Array.isArray(b)) {
-    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-    return a.every((item, index) => deepEqual(item, b[index]));
+  let raw;
+  try {
+    raw = readFileSync(CREDITS_FILE, "utf-8");
+  } catch (cause) {
+    throw unreadableStore(cause);
   }
-  if (!isPlainObject(a) || !isPlainObject(b)) return false;
-  for (const key of /* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)])) {
-    if (!deepEqual(a[key], b[key])) return false;
+  let data;
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("the file parsed as JSON but is not a credit-store object");
+    }
+    data = parsed;
+  } catch (cause) {
+    throw quarantineCorruptStore(cause);
   }
-  return true;
-}
-function isPresentValue(value) {
-  if (value === void 0 || value === null) return false;
-  return typeof value !== "string" || value.trim().length > 0;
-}
-function comparableProtectedValue(target, value) {
-  if (typeof value !== "string") return void 0;
-  const trimmed = value.trim();
-  if (trimmed.length === 0) return void 0;
-  const field = target.split(".")[0];
-  return PROTECTED_FIELDS[field].hexCredential ? trimmed.toLowerCase() : trimmed;
-}
-function patchShapeError(message) {
-  return new DvmError(
-    "config_patch_invalid",
-    message,
-    "A change declares `set` (fields to write) and `unset` (field names to remove). Anything else cannot be applied, and nothing was written."
+  const merged = mergeDuplicateCredits(
+    Array.isArray(data.credits) ? data.credits.filter((record) => isObjectRecord(record)).map(
+      (record) => normalizeRailKey(normalizeEvidence(normalizeDrains(normalizeSiblingCredits(record))))
+    ) : []
+  );
+  const snapshots = mergeDuplicateSnapshots(
+    Array.isArray(data.fundingMenuSnapshots) ? data.fundingMenuSnapshots.filter(isFundingMenuSnapshot) : [],
+    merged.credits
   );
+  const fundings = dedupePendingFundings(
+    Array.isArray(data.pendingFundings) ? data.pendingFundings.filter((funding) => isObjectRecord(funding)).map(normalizeRailKey) : []
+  );
+  const implicit = dedupeImplicitCredits(
+    Array.isArray(data.implicitCredits) ? data.implicitCredits.filter(isStoredImplicitCredit) : []
+  );
+  const store = {
+    credits: merged.credits,
+    implicitCredits: implicit.credits,
+    pendingFundings: fundings.fundings,
+    fundingMenuSnapshots: snapshots.snapshots
+  };
+  if (merged.changed || snapshots.changed || fundings.changed || implicit.changed) saveStore(store);
+  return store;
 }
-function freezeDeep(value) {
-  if (typeof value !== "object" || value === null || Object.isFrozen(value)) return;
-  Object.freeze(value);
-  for (const nested of Object.values(value)) freezeDeep(nested);
+function isStoredImplicitCredit(value) {
+  if (!isObjectRecord(value)) return false;
+  return typeof value.endpoint === "string" && typeof value.callerPubkey === "string" && typeof value.creditId === "string" && value.creditId.startsWith("imp:") && typeof value.currency === "string" && typeof value.remainingMicro === "number" && Number.isFinite(value.remainingMicro) && typeof value.ledgerSeq === "number" && Number.isInteger(value.ledgerSeq) && typeof value.expiryMs === "number" && Number.isFinite(value.expiryMs) && (value.status === "active" || value.status === "lost") && typeof value.releasedByJobId === "string" && typeof value.releasedAt === "number" && Number.isFinite(value.releasedAt) && typeof value.updatedAt === "number" && Number.isFinite(value.updatedAt);
 }
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+function dedupeImplicitCredits(credits) {
+  const merged = [];
+  let changed = false;
+  for (const candidate of credits) {
+    candidate.endpoint = normalizeCreditEndpoint(candidate.endpoint);
+    const identity = dvmLocationIdentity(candidate);
+    const existing = findDvmLocated(merged, {
+      endpoint: candidate.endpoint,
+      ...identity ? { identity } : {},
+      where: (record) => record.callerPubkey === candidate.callerPubkey && record.creditId === candidate.creditId
+    });
+    if (!existing) {
+      merged.push(candidate);
+      continue;
+    }
+    changed = true;
+    for (const origin of dvmLocationOrigins(candidate)) {
+      attachDvmLocation(existing, origin, identity);
+    }
+    if (candidate.ledgerSeq > existing.ledgerSeq || candidate.ledgerSeq === existing.ledgerSeq && candidate.updatedAt > existing.updatedAt) {
+      existing.currency = candidate.currency;
+      existing.remainingMicro = candidate.remainingMicro;
+      existing.ledgerSeq = candidate.ledgerSeq;
+      existing.status = candidate.status;
+      if (candidate.lossReason) existing.lossReason = candidate.lossReason;
+      else delete existing.lossReason;
+      existing.updatedAt = candidate.updatedAt;
+      existing.lastReceiptJobId = candidate.lastReceiptJobId;
+      existing.discrepancy = candidate.discrepancy;
+    }
+    existing.expiryMs = Math.min(existing.expiryMs, candidate.expiryMs);
+    if (candidate.releasedAt < existing.releasedAt) {
+      existing.releasedAt = candidate.releasedAt;
+      existing.releasedByJobId = candidate.releasedByJobId;
+    }
+  }
+  const capped = capLostImplicitCredits(merged);
+  return { credits: capped.credits, changed: changed || capped.changed };
 }
-function toOctal(mode) {
-  return "0" + mode.toString(8).padStart(3, "0");
+function capLostImplicitCredits(credits) {
+  const lostByOwner = /* @__PURE__ */ new Map();
+  for (const credit of credits) {
+    if (credit.status !== "lost") continue;
+    const identity = dvmLocationIdentity(credit);
+    const dvmKey = identity ? `${identity.dvmId}\0${identity.builderPubkey}` : normalizeCreditEndpoint(credit.endpoint);
+    const key = `${credit.callerPubkey}\0${dvmKey}`;
+    const group = lostByOwner.get(key) ?? [];
+    group.push(credit);
+    lostByOwner.set(key, group);
+  }
+  const dropped = /* @__PURE__ */ new Set();
+  for (const group of lostByOwner.values()) {
+    group.sort((a, b) => b.updatedAt - a.updatedAt);
+    for (const credit of group.slice(MAX_LOST_IMPLICIT_CREDITS)) dropped.add(credit);
+  }
+  return dropped.size === 0 ? { credits, changed: false } : { credits: credits.filter((credit) => !dropped.has(credit)), changed: true };
 }
-
-// src/lib/identity.ts
-import lockfile from "proper-lockfile";
-var CREDIT_POSTURES = ["suggest", "auto", "off"];
-function isCreditPosture(value) {
-  return typeof value === "string" && CREDIT_POSTURES.includes(value);
-}
-function migrateCreditConfig(config) {
-  const credit = config.credit;
-  if (!credit) return config;
-  const migrateLayer = (layer) => {
-    const railed = migrateFundingRail(layer);
-    if (!("disabled" in railed)) return railed;
-    const { disabled, ...rest } = railed;
-    const migrated = { ...rest };
-    if (migrated.posture === void 0 && disabled === true) migrated.posture = "off";
-    return migrated;
-  };
-  const perDvm = credit.perDvm;
-  return {
-    ...config,
-    credit: {
-      ...migrateLayer(credit),
-      ...perDvm ? {
-        perDvm: Object.fromEntries(
-          Object.entries(perDvm).map(([endpoint, per]) => [endpoint, migrateLayer(per)])
-        )
-      } : {}
+function mergeDuplicateSnapshots(snapshots, credits) {
+  const identities = originIdentityMap(credits);
+  const merged = [];
+  const byIdentity = /* @__PURE__ */ new Map();
+  let changed = false;
+  for (const snapshot of snapshots) {
+    const stamped = identities.get(`${snapshot.callerPubkey}\0${snapshot.endpoint}`);
+    if (stamped !== void 0 && snapshot.dvmId === void 0) {
+      snapshot.dvmId = stamped.dvmId;
+      if (stamped.attestedBuilderPubkey !== void 0) {
+        snapshot.attestedBuilderPubkey = stamped.attestedBuilderPubkey;
+      }
+      changed = true;
     }
-  };
-}
-function migrateFundingRail(layer) {
-  const loose = layer;
-  if (loose.fundingRail !== "mpp") return layer;
-  return { ...layer, fundingRail: "tempo" };
-}
-function migrateTempoWalletKey(config) {
-  const loose = config;
-  if (!loose.mpp || loose.tempo) return config;
-  const { mpp, ...rest } = loose;
-  return { ...rest, tempo: mpp };
-}
-function migrateConfig(config) {
-  return migrateCreditConfig(migrateTempoWalletKey(config));
+    if (snapshot.dvmId === void 0) {
+      merged.push(snapshot);
+      continue;
+    }
+    const key = `${snapshot.callerPubkey}\0${snapshot.dvmId}\0${snapshot.attestedBuilderPubkey ?? ""}`;
+    const index = byIdentity.get(key);
+    if (index === void 0) {
+      byIdentity.set(key, merged.length);
+      merged.push(snapshot);
+      continue;
+    }
+    merged[index] = mergeSnapshots(merged[index], snapshot);
+    changed = true;
+  }
+  return { snapshots: merged, changed };
 }
-function loadConfig() {
-  const raw = readRawConfig();
-  return raw === null ? null : migrateConfig(raw);
+function mergeSnapshots(left, right) {
+  const leftSeen = Number.isFinite(left.observedAt) ? left.observedAt : 0;
+  const rightSeen = Number.isFinite(right.observedAt) ? right.observedAt : 0;
+  const [newer, older] = rightSeen >= leftSeen ? [right, left] : [left, right];
+  const snapshot = { ...newer };
+  if (snapshot.builderPubkey === void 0 && older.builderPubkey !== void 0) {
+    snapshot.builderPubkey = older.builderPubkey;
+  }
+  const origins = dvmLocationOrigins(newer).concat(dvmLocationOrigins(older));
+  const aliases = [...new Set(origins)].filter((origin) => origin !== snapshot.endpoint);
+  if (aliases.length > 0) snapshot.endpointAliases = aliases;
+  else delete snapshot.endpointAliases;
+  return snapshot;
 }
-async function updateConfig(update) {
-  return withConfigLock(async () => {
-    const raw = readRawConfig();
-    const snapshot = raw === null ? {} : structuredClone(raw);
-    const base = raw === null ? null : migrateConfig(structuredClone(raw));
-    const handed = raw === null ? null : deepFreezeConfig(migrateConfig(structuredClone(raw)));
-    const next = applyConfigPatch(base ?? {}, await runPatch(update, handed));
-    const changed = changedConfigPaths(snapshot, next);
-    if (changed.length === 0) {
-      return {
-        config: base ?? {},
-        previous: base,
-        changed: [],
-        written: false,
-        backup: describeConfigBackup()
-      };
-    }
-    const removals = protectedRemovals(base ?? {}, next);
-    const unauthorized = removals.filter((target) => update.authorize?.covers(target) !== true);
-    if (unauthorized.length > 0) throw protectedRemovalError(unauthorized, update.reason);
-    assertValidConfig(
-      next,
-      changed.map((path) => path.split(".")[0])
-    );
-    const superseded = supersededProtectedSecrets(base ?? {}, next);
-    const stripped = [
-      .../* @__PURE__ */ new Set([...removals, ...superseded, ...update.sanitizeBackup ?? []])
-    ].filter(isSecretProtectedTarget);
-    const sweeping = update.sweepSlots ?? CONFIG_SNAPSHOT_SLOTS;
-    const swept = [];
-    if (raw !== null) {
-      if (stripped.length > 0) {
-        writeConfigBackup(withoutProtectedTargets(raw, stripped));
-        swept.push("backup");
-      } else {
-        retainConfigBackup();
+function originIdentityMap(credits) {
+  const identities = /* @__PURE__ */ new Map();
+  const ambiguous = /* @__PURE__ */ new Set();
+  for (const record of credits) {
+    if (typeof record.dvmId !== "string" || typeof record.callerPubkey !== "string") continue;
+    const identity = {
+      dvmId: record.dvmId,
+      ...record.attestedBuilderPubkey !== void 0 ? { attestedBuilderPubkey: record.attestedBuilderPubkey } : {}
+    };
+    for (const origin of dvmLocationOrigins(record)) {
+      const key = `${record.callerPubkey}\0${origin}`;
+      const seen = identities.get(key);
+      if (seen !== void 0 && (seen.dvmId !== identity.dvmId || seen.attestedBuilderPubkey !== identity.attestedBuilderPubkey)) {
+        ambiguous.add(key);
+        continue;
       }
+      identities.set(key, identity);
     }
-    if (stripped.length > 0 && sweeping.includes("pinned")) {
-      if (sweepPinnedSnapshot(stripped, base ?? {}, update.reason)) swept.push("pinned");
-    }
-    const backup = describeConfigBackup();
-    writeConfigFile(next);
-    appendConfigAudit({
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      event: "update",
-      reason: update.reason,
-      fields: changed,
-      ...removals.length > 0 ? { removed: removals } : {},
-      ...superseded.length > 0 ? { superseded } : {},
-      ...swept.length > 0 ? { sweptSlots: swept } : {},
-      backup: backup !== null,
-      pid: process.pid
-    });
-    return { config: next, previous: base, changed, written: true, backup };
-  });
-}
-async function withConfigLock(fn) {
-  ensureConfigDir();
-  let release;
-  try {
-    release = await lockfile.lock(CONFIG_FILE, {
-      lockfilePath: `${CONFIG_FILE}.lock`,
-      realpath: false,
-      stale: 3e4,
-      retries: { retries: 10, factor: 1, minTimeout: 100, maxTimeout: 100 }
-    });
-  } catch {
-    throw new DvmError(
-      "config_locked",
-      "Another dvm process is updating the local configuration.",
-      "Wait a moment and retry."
-    );
   }
-  try {
-    return await fn();
-  } finally {
-    await release().catch(() => void 0);
+  for (const key of ambiguous) identities.delete(key);
+  return identities;
+}
+function dedupePendingFundings(fundings) {
+  const kept = [];
+  const byIntent = /* @__PURE__ */ new Map();
+  let changed = false;
+  for (const funding of fundings) {
+    if (typeof funding.callerPubkey !== "string" || typeof funding.creditId !== "string" || typeof funding.fundId !== "string") {
+      kept.push(funding);
+      continue;
+    }
+    const key = `${funding.callerPubkey}\0${funding.creditId}\0${funding.fundId}`;
+    const index = byIntent.get(key);
+    if (index === void 0) {
+      byIntent.set(key, kept.length);
+      kept.push(funding);
+      continue;
+    }
+    const seen = kept[index];
+    const seenAt = Number.isFinite(seen.requestedAt) ? seen.requestedAt : 0;
+    const at = Number.isFinite(funding.requestedAt) ? funding.requestedAt : 0;
+    if (at > seenAt) kept[index] = funding;
+    changed = true;
   }
+  return { fundings: kept, changed };
 }
-async function runPatch(update, current) {
-  try {
-    return await update.patch(current);
-  } catch (err) {
-    if (err instanceof TypeError && /read only|not extensible|frozen|cannot delete property|cannot add property/i.test(
-      err.message
-    )) {
-      throw new DvmError(
-        "config_patch_invalid",
-        `The '${update.reason}' change tried to modify the configuration it was handed.`,
-        "Nothing was written. A change declares what it wants through its `set` and `unset` lists; editing the current config in place bypasses the protected-field gate, so the object is frozen."
-      );
+function isObjectRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function mergeDuplicateCredits(credits) {
+  const merged = [];
+  const byCredit = /* @__PURE__ */ new Map();
+  let changed = false;
+  for (const record of credits) {
+    if (typeof record.creditId !== "string" || typeof record.callerPubkey !== "string") {
+      merged.push(record);
+      continue;
     }
-    throw err;
+    const key = `${record.callerPubkey}\0${record.creditId}`;
+    const index = byCredit.get(key);
+    if (index === void 0) {
+      byCredit.set(key, merged.length);
+      merged.push(record);
+      continue;
+    }
+    merged[index] = mergeCreditRecords(merged[index], record);
+    changed = true;
   }
+  return { credits: merged, changed };
 }
-function sweepPinnedSnapshot(targets, departing, reason) {
-  if (describeConfigBackup("pinned") === null) return false;
-  const pinned = readConfigBackup("pinned");
-  if (pinned === null) {
-    return retireSlot(`${reason}:unreadable_pin`, "pinned");
+function mergeCreditRecords(left, right) {
+  const leftUpdated = Number.isFinite(left.updatedAt) ? left.updatedAt : 0;
+  const rightUpdated = Number.isFinite(right.updatedAt) ? right.updatedAt : 0;
+  const [newer, older] = rightUpdated >= leftUpdated ? [right, left] : [left, right];
+  const record = { ...newer };
+  if (record.dvmId === void 0 && older.dvmId !== void 0) record.dvmId = older.dvmId;
+  if (record.attestedBuilderPubkey === void 0 && older.attestedBuilderPubkey !== void 0 && record.dvmId === older.dvmId) {
+    record.attestedBuilderPubkey = older.attestedBuilderPubkey;
   }
-  const migrated = migrateConfig(structuredClone(pinned));
-  const matching = targets.filter(
-    (target) => protectedValuesMatch(
-      target,
-      protectedTargetValue(departing, target),
-      protectedTargetValue(migrated, target)
-    )
-  );
-  if (matching.length === 0) return false;
-  const sanitized = withoutProtectedTargets(pinned, matching);
-  const changed = changedConfigPaths(pinned, sanitized);
-  if (changed.length === 0) return false;
-  writeConfigBackup(sanitized, "pinned");
-  appendConfigAudit({
-    ts: (/* @__PURE__ */ new Date()).toISOString(),
-    event: "backup_sanitized",
-    reason,
-    fields: changed,
-    removed: matching,
-    slot: "pinned",
-    backup: describeConfigBackup() !== null,
-    pid: process.pid
-  });
-  return true;
+  if (record.rail === void 0 && older.rail !== void 0) record.rail = older.rail;
+  if (record.x402Instrument === void 0 && older.x402Instrument !== void 0) {
+    record.x402Instrument = older.x402Instrument;
+  }
+  if (record.x402ChannelNetwork === void 0 && older.x402ChannelNetwork !== void 0) {
+    record.x402ChannelNetwork = older.x402ChannelNetwork;
+  }
+  if (record.menu === void 0 && older.menu !== void 0) record.menu = older.menu;
+  if (record.builderPubkey === void 0 && older.builderPubkey !== void 0) {
+    record.builderPubkey = older.builderPubkey;
+  }
+  const endpoints = dvmLocationOrigins(newer).concat(dvmLocationOrigins(older));
+  const aliases = [...new Set(endpoints)].filter((endpoint) => endpoint !== record.endpoint);
+  if (aliases.length > 0) record.endpointAliases = aliases;
+  else delete record.endpointAliases;
+  const pendingDrains = unionPendingDrains(newer.pendingDrains, older.pendingDrains);
+  if (pendingDrains.length > 0) record.pendingDrains = pendingDrains;
+  else delete record.pendingDrains;
+  const drainEvidence = unionDrainEvidence(newer.drainEvidence, older.drainEvidence);
+  if (drainEvidence.length > 0) record.drainEvidence = drainEvidence;
+  else delete record.drainEvidence;
+  const siblings = Array.isArray(newer.siblingCredits) ? newer.siblingCredits : older.siblingCredits;
+  if (siblings) {
+    record.siblingCredits = siblings.filter((sibling) => sibling.creditId !== record.creditId);
+  } else {
+    delete record.siblingCredits;
+  }
+  return record;
 }
-function retireSlot(reason, slot) {
-  if (!removeConfigBackup(slot)) return false;
-  appendConfigAudit({
-    ts: (/* @__PURE__ */ new Date()).toISOString(),
-    event: "backup_retired",
-    reason,
-    fields: [],
-    slot,
-    backup: describeConfigBackup() !== null,
-    pid: process.pid
-  });
-  return true;
+function unionPendingDrains(preferred, fallback) {
+  const byDrain = /* @__PURE__ */ new Map();
+  for (const drain of [...fallback ?? [], ...preferred ?? []]) {
+    const key = `${drain.drainId}\0${drain.creditId ?? ""}`;
+    byDrain.set(key, { ...byDrain.get(key) ?? {}, ...drain });
+  }
+  return [...byDrain.values()];
 }
-
-// src/lib/credit-store.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname } from "path";
-import lockfile2 from "proper-lockfile";
-function withCreditLock(fn, opts = {}) {
-  if (lockDepth > 0) {
-    lockDepth += 1;
-    try {
-      return rejectAsyncBody(fn());
-    } finally {
-      lockDepth -= 1;
+function unionDrainEvidence(preferred, fallback) {
+  const byDrain = /* @__PURE__ */ new Map();
+  for (const evidence of [...fallback ?? [], ...preferred ?? []]) {
+    const key = `${evidence.drainId}\0${evidence.creditId}`;
+    const existing = byDrain.get(key);
+    if (!existing) {
+      byDrain.set(key, evidence);
+      continue;
     }
+    const [newer, older] = evidence.collectedAt >= existing.collectedAt ? [evidence, existing] : [existing, evidence];
+    const receipts = unionUnknown(newer.receipts, older.receipts);
+    byDrain.set(key, {
+      ...older,
+      ...newer,
+      receipts,
+      collectedAt: Math.max(existing.collectedAt, evidence.collectedAt),
+      ...existing.settledAt !== void 0 || evidence.settledAt !== void 0 ? { settledAt: Math.max(existing.settledAt ?? 0, evidence.settledAt ?? 0) } : {}
+    });
   }
-  const release = acquireCreditLock(opts);
-  lockDepth = 1;
-  try {
-    return rejectAsyncBody(fn());
-  } finally {
-    lockDepth = 0;
+  return [...byDrain.values()];
+}
+function unionUnknown(preferred, fallback) {
+  const seen = /* @__PURE__ */ new Set();
+  const values = [];
+  for (const value of [...preferred, ...fallback]) {
+    let key;
     try {
-      release();
+      const serialized = JSON.stringify(value);
+      key = typeof serialized === "string" ? serialized : String(value);
     } catch {
+      key = String(value);
     }
+    if (seen.has(key)) continue;
+    seen.add(key);
+    values.push(value);
   }
+  return values;
 }
-function normalizeCreditEndpoint(endpoint) {
-  try {
-    return new URL(endpoint).origin;
-  } catch {
-    return endpoint.replace(/\/+$/, "");
-  }
-}
-function dvmLocationIdentity(record) {
-  if (typeof record.dvmId !== "string" || record.dvmId.length === 0) return void 0;
-  const pubkey = typeof record.attestedBuilderPubkey === "string" ? record.attestedBuilderPubkey.trim().toLowerCase() : "";
-  if (!/^[0-9a-f]{64}$/.test(pubkey)) return void 0;
-  return { dvmId: record.dvmId, builderPubkey: pubkey };
-}
-function findDvmLocated(records, args) {
-  const where = args.where ?? (() => true);
-  const identity = args.identity;
-  if (identity) {
-    const attested = records.find(
-      (record) => where(record) && matchesDvmIdentity(record, identity)
-    );
-    if (attested) return attested;
-  }
-  return records.find(
-    (record) => where(record) && matchesDvmOrigin(record, args.endpoint, identity)
-  );
+function isFundingMenuSnapshot(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const snapshot = value;
+  return typeof snapshot.endpoint === "string" && typeof snapshot.callerPubkey === "string" && typeof snapshot.observedAt === "number" && Number.isFinite(snapshot.observedAt) && Math.abs(snapshot.observedAt) <= MAX_DATE_MS && parseCreditMenu(snapshot.menu) !== void 0 && (snapshot.builderPubkey === void 0 || typeof snapshot.builderPubkey === "string");
 }
-function attachDvmLocation(record, endpoint, identity) {
-  let changed = false;
-  if (identity) {
-    if (record.dvmId !== identity.dvmId) {
-      record.dvmId = identity.dvmId;
-      changed = true;
-    }
-    if (record.attestedBuilderPubkey !== identity.builderPubkey) {
-      record.attestedBuilderPubkey = identity.builderPubkey;
-      changed = true;
+function normalizeRailKey(record) {
+  const loose = record;
+  if (loose.rail === LEGACY_TEMPO_RAIL_KEY) loose.rail = "tempo";
+  if (loose.refillUnavailableRail === LEGACY_TEMPO_RAIL_KEY) loose.refillUnavailableRail = "tempo";
+  if (Array.isArray(loose.pendingDrains)) {
+    for (const drain of loose.pendingDrains) {
+      if (drain?.method === LEGACY_TEMPO_RAIL_KEY) drain.method = "tempo";
     }
   }
-  if (endpoint !== record.endpoint && !dvmLocationOrigins(record).includes(endpoint)) {
-    record.endpointAliases = [...record.endpointAliases ?? [], endpoint];
-    changed = true;
+  return record;
+}
+var LEGACY_TEMPO_RAIL_KEY = "mpp";
+function normalizeSiblingCredits(record) {
+  if (!Array.isArray(record.siblingCredits)) {
+    delete record.siblingCredits;
+    return record;
   }
-  return changed;
+  record.siblingCredits = record.siblingCredits.filter(
+    (sibling) => isSiblingCredit(sibling) && sibling.creditId !== record.creditId
+  );
+  return record;
 }
-function dvmLocationOrigins(record) {
-  const aliases = Array.isArray(record.endpointAliases) ? record.endpointAliases.filter((endpoint) => typeof endpoint === "string") : [];
-  const primary = typeof record.endpoint === "string" ? [record.endpoint] : [];
-  return [...primary, ...aliases].map(normalizeCreditEndpoint);
+function isSiblingCredit(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const sibling = value;
+  const status = value.status;
+  return typeof sibling.creditId === "string" && typeof sibling.currency === "string" && Number.isSafeInteger(sibling.balanceMicro) && Number.isSafeInteger(sibling.remainingMicro) && Number.isSafeInteger(sibling.ledgerSeq) && Number.isFinite(sibling.expiryMs) && Math.abs(sibling.expiryMs) <= MAX_DATE_MS && typeof sibling.expired === "boolean" && typeof sibling.drainable === "boolean" && (status === void 0 || status === "active" || status === "unbacked") && (sibling.reconciliationPending === void 0 || typeof sibling.reconciliationPending === "boolean") && Number.isFinite(sibling.observedAt) && Math.abs(sibling.observedAt) <= MAX_DATE_MS;
 }
-function fundingReachableAt(funding, endpoint, credits) {
-  const at = normalizeCreditEndpoint(funding.endpoint);
-  const named = normalizeCreditEndpoint(endpoint);
-  if (at === named) return true;
-  const record = credits.find(
-    (c) => c.callerPubkey === funding.callerPubkey && c.creditId === funding.creditId
+function normalizeDrains(record) {
+  const legacy = record;
+  const drains = (Array.isArray(record.pendingDrains) ? record.pendingDrains : []).filter(
+    isDrainish
   );
-  if (!record) return false;
-  const origins = dvmLocationOrigins(record);
-  return origins.includes(at) && origins.includes(named);
+  if (isDrainish(legacy.pendingDrain)) drains.unshift(legacy.pendingDrain);
+  delete legacy.pendingDrain;
+  if (drains.length === 0) delete record.pendingDrains;
+  else record.pendingDrains = drains;
+  return record;
 }
-function loadCredit(endpoint, callerPubkey, identity) {
-  return withCreditLock(() => {
-    const key = normalizeCreditEndpoint(endpoint);
-    const store = loadStore();
-    const record = findDvmLocated(store.credits, {
-      endpoint: key,
-      ...identity ? { identity } : {},
-      where: (c) => c.callerPubkey === callerPubkey
-    });
-    if (record && attachDvmLocation(record, key, identity)) saveStore(store);
+function normalizeEvidence(record) {
+  if (!Array.isArray(record.drainEvidence)) {
+    delete record.drainEvidence;
     return record;
+  }
+  const evidence = record.drainEvidence.filter(isEvidenceish).map((e) => {
+    const bundle = {
+      ...e,
+      creditId: typeof e.creditId === "string" ? e.creditId : "",
+      collectedAt: Number.isFinite(e.collectedAt) ? e.collectedAt : 0
+    };
+    if (!Number.isFinite(bundle.settledAt)) delete bundle.settledAt;
+    return bundle;
   });
+  if (evidence.length === 0) delete record.drainEvidence;
+  else record.drainEvidence = evidence;
+  return record;
 }
-function listCredits() {
-  return withCreditLock(() => [...loadStore().credits].sort((a, b) => b.updatedAt - a.updatedAt));
-}
-function listPendingFundings(args = {}) {
-  const endpoint = args.endpoint ? normalizeCreditEndpoint(args.endpoint) : void 0;
-  return withCreditLock(() => {
-    const store = loadStore();
-    return store.pendingFundings.filter(
-      (funding) => (!endpoint || fundingReachableAt(funding, endpoint, store.credits)) && (!args.callerPubkey || funding.callerPubkey === args.callerPubkey) && (!args.creditId || funding.creditId === args.creditId)
-    ).sort((a, b) => a.requestedAt - b.requestedAt);
-  });
+function isEvidenceish(value) {
+  return typeof value === "object" && value !== null && typeof value.drainId === "string" && Array.isArray(value.receipts);
 }
-function loadPendingFunding(endpoint, callerPubkey, creditId) {
-  return listPendingFundings({ endpoint, callerPubkey, ...creditId ? { creditId } : {} })[0];
+function isDrainish(value) {
+  return typeof value === "object" && value !== null && typeof value.drainId === "string";
 }
-function recordPendingFunding(funding) {
-  withCreditLock(() => {
-    const store = loadStore();
-    const normalized = { ...funding, endpoint: normalizeCreditEndpoint(funding.endpoint) };
-    const index = store.pendingFundings.findIndex(
-      (entry) => entry.callerPubkey === normalized.callerPubkey && entry.creditId === normalized.creditId && entry.fundId === normalized.fundId && fundingReachableAt(entry, normalized.endpoint, store.credits)
+function capPendingDrains(drains, creditId) {
+  if (drains.length <= MAX_PENDING_DRAINS) return drains;
+  const evictable = drains.filter((d) => d.creditId !== creditId).sort((a, b) => a.requestedAt - b.requestedAt);
+  const dropped = new Set(evictable.slice(0, drains.length - MAX_PENDING_DRAINS));
+  for (const d of dropped) {
+    info(
+      `Dropping the oldest unclaimed drain record (${d.drainId}${d.creditId ? ` on credit ${d.creditId}` : ""}) \u2014 ${String(MAX_PENDING_DRAINS)} is the most this DVM's record keeps.`
     );
-    if (index === -1) store.pendingFundings.push(normalized);
-    else
-      store.pendingFundings[index] = {
-        ...normalized,
-        endpoint: store.pendingFundings[index].endpoint
-      };
-    saveStore(store);
-  });
+  }
+  return drains.filter((d) => !dropped.has(d));
 }
-function clearPendingFunding(endpoint, callerPubkey, creditId, fundId) {
-  withCreditLock(() => {
-    const store = loadStore();
-    const normalized = normalizeCreditEndpoint(endpoint);
-    const remaining = store.pendingFundings.filter(
-      (entry) => !(entry.callerPubkey === callerPubkey && entry.creditId === creditId && entry.fundId === fundId && fundingReachableAt(entry, normalized, store.credits))
-    );
-    if (remaining.length === store.pendingFundings.length) return;
-    saveStore({ ...store, pendingFundings: remaining });
-  });
+function saveStore(store) {
+  ensureConfigDir();
+  const tmp = `${CREDITS_FILE}.${String(process.pid)}.tmp`;
+  writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
+  try {
+    renameSync(tmp, CREDITS_FILE);
+  } catch (err) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
 }
-function recordFundResponse(args) {
-  const now = args.now ?? Date.now();
-  return withCreditLock(() => {
+function unreadableStore(cause) {
+  const detail = cause instanceof Error ? cause.message : String(cause);
+  return new DvmError(
+    "credit_store_unreadable",
+    `The prepaid-credit record at ${CREDITS_FILE} exists but could not be opened: ${detail}`,
+    `The file was left untouched. Check that you own it and can read it ('ls -l ${CREDITS_FILE}'), then retry \u2014 'chmod 600 ${CREDITS_FILE}' fixes the common case. Do not delete it: it may hold DVM-signed drain receipts for a refund that is still owed.`,
+    { credits_file: CREDITS_FILE, cause: detail },
+    `Your local record of prepaid credits could not be opened \u2014 this looks like a file-permissions problem on this machine, not damage to the record. Nothing was changed or deleted, so any signed proof of a refund you are owed is still there.`
+  );
+}
+function quarantineCorruptStore(cause) {
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const quarantined = `${CREDITS_FILE}.corrupt-${stamp}-${String(process.pid)}`;
+  let moved = false;
+  try {
+    renameSync(CREDITS_FILE, quarantined);
+    moved = true;
+  } catch {
+  }
+  const kept = moved ? quarantined : CREDITS_FILE;
+  return new DvmError(
+    "credit_store_corrupt",
+    moved ? `The prepaid-credit record at ${CREDITS_FILE} is damaged and could not be parsed; it was moved aside to ${quarantined}.` : `The prepaid-credit record at ${CREDITS_FILE} is damaged and could not be parsed, and could not be moved aside.`,
+    `Do not delete ${kept} \u2014 it may hold DVM-signed drain receipts for a refund that is still owed. Balances themselves live on the DVM, so 'dvm credit balance <dvm>' re-reads them.`,
+    {
+      credits_file: CREDITS_FILE,
+      ...moved ? { quarantined_path: quarantined } : {},
+      cause: cause instanceof Error ? cause.message : String(cause)
+    },
+    `The local record of your prepaid credits is damaged. It was set aside at ${kept} rather than overwritten, so any signed proof of a refund you are owed is still in that file. Your credits are held by each DVM, not by this file, so re-reading a balance will restore what the CLI shows.`
+  );
+}
+function mutateCredit(location, mutate) {
+  withCreditLock(() => {
     const store = loadStore();
-    const key = normalizeCreditEndpoint(args.endpoint);
-    let record = findDvmLocated(store.credits, {
+    const key = normalizeCreditEndpoint(location.endpoint);
+    const record = findDvmLocated(store.credits, {
       endpoint: key,
-      ...args.identity ? { identity: args.identity } : {},
-      where: (c) => c.callerPubkey === args.callerPubkey
+      ...location.identity ? { identity: location.identity } : {},
+      where: (c) => c.callerPubkey === location.callerPubkey
     });
-    if (!record) {
-      record = {
-        endpoint: key,
-        ...identityFields(args.identity),
-        callerPubkey: args.callerPubkey,
-        creditId: args.credit.credit_id,
-        currency: args.credit.currency,
-        balanceMicro: 0,
-        remainingMicro: 0,
-        ledgerSeq: 0,
-        expiryMs: 0,
-        targetMicro: args.targetMicro,
-        status: "active",
-        openedAt: now,
-        updatedAt: now
-      };
-      store.credits.push(record);
-    }
-    attachDvmLocation(record, key, args.identity);
-    adoptCreditId(record, args.credit.credit_id);
-    record.currency = args.credit.currency;
-    record.balanceMicro = args.credit.balance_micro;
-    record.remainingMicro = args.credit.remaining_micro;
-    record.ledgerSeq = Math.max(record.ledgerSeq, args.credit.ledger_seq);
-    record.expiryMs = args.credit.expiry_ms;
-    record.targetMicro = args.targetMicro;
-    record.status = args.credit.status === "unbacked" ? "unbacked" : args.credit.expired ? "expired" : "active";
-    record.reconciliationPending = args.credit.reconciliation_pending;
-    record.updatedAt = now;
-    delete record.provisional;
-    if (args.sequenced === false) record.unsequencedBalance = true;
-    else delete record.unsequencedBalance;
-    if (args.menu) record.menu = args.menu;
-    if (args.rail) {
-      record.rail = args.rail;
-      delete record.refillUnavailableRail;
+    if (!record) return;
+    const locationChanged = attachDvmLocation(record, key, location.identity);
+    if (mutate(record) === "skip") {
+      if (locationChanged) saveStore(store);
+      return;
     }
-    if (args.x402Instrument) record.x402Instrument = args.x402Instrument;
-    if (args.x402ChannelNetwork) record.x402ChannelNetwork = args.x402ChannelNetwork;
-    if (args.builderPubkey) record.builderPubkey = args.builderPubkey;
-    if (args.select) delete record.selectionCleared;
-    delete record.discrepancy;
+    record.updatedAt = Date.now();
     saveStore(store);
-    return record;
   });
 }
-function loadCreditX402Binding(endpoint, callerPubkey, creditId, identity) {
-  const record = loadCredit(endpoint, callerPubkey, identity);
-  if (record?.creditId !== creditId) return {};
-  if (record.status !== "active" && record.status !== "expired") return {};
-  return {
-    ...record.x402Instrument ? { instrument: record.x402Instrument } : {},
-    ...record.x402ChannelNetwork ? { channelNetwork: record.x402ChannelNetwork } : {}
-  };
-}
-function recordCreditX402Instrument(endpoint, callerPubkey, creditId, instrument, identity, channelNetwork) {
-  mutateCredit(mutationAt(endpoint, callerPubkey, identity), (record) => {
-    if (record.creditId !== creditId) return "skip";
-    const instrumentChanged = record.x402Instrument !== instrument;
-    const channelNetworkChanged = instrument === "x402_channel" && channelNetwork !== void 0 && record.x402ChannelNetwork !== channelNetwork;
-    if (!instrumentChanged && !channelNetworkChanged) return "skip";
-    if (instrumentChanged) {
-      record.x402Instrument = instrument;
-      delete record.x402ChannelNetwork;
+var DEFAULT_LOCK_STALE_MS = 1e4;
+var DEFAULT_LOCK_RETRIES = 600;
+var DEFAULT_LOCK_RETRY_INTERVAL_MS = 25;
+var lockDepth = 0;
+function acquireCreditLock(opts) {
+  ensureConfigDir();
+  const lockPath = `${CREDITS_FILE}.lock`;
+  const stale = opts.stale ?? DEFAULT_LOCK_STALE_MS;
+  const retries = opts.retries ?? DEFAULT_LOCK_RETRIES;
+  const interval = opts.retryIntervalMs ?? DEFAULT_LOCK_RETRY_INTERVAL_MS;
+  let lastError;
+  for (let attempt = 0; attempt <= retries; attempt += 1) {
+    try {
+      return lockfile.lockSync(CREDITS_FILE, {
+        lockfilePath: lockPath,
+        stale,
+        realpath: false
+      });
+    } catch (err) {
+      lastError = err;
+      if (err.code !== "ELOCKED") {
+        const detail = err instanceof Error ? err.message : String(err);
+        const configDir = dirname(lockPath);
+        throw new DvmError(
+          "credit_store_lock_failed",
+          `Could not create the prepaid-credit lock at ${lockPath}: ${detail}`,
+          `This is not contention \u2014 nothing is holding the lock. Check that ${configDir} exists and is writable by you ('ls -ld ${configDir}'), then retry.`,
+          {
+            lock_file: lockPath,
+            config_dir: configDir,
+            underlying: detail,
+            errno_code: err.code
+          },
+          `The dvm CLI could not create the small lock file it uses to keep two commands from writing your credit record at once. Its folder looks unwritable \u2014 nothing about your credits is wrong, and nothing was changed.`
+        );
+      }
+      if (attempt === retries) break;
+      sleepSync(interval);
     }
-    if (instrument === "x402_channel" && channelNetwork !== void 0) {
-      record.x402ChannelNetwork = channelNetwork;
+  }
+  throw new DvmError(
+    "credit_store_locked",
+    `Could not acquire the prepaid-credit lock at ${lockPath} within the retry budget.`,
+    `Another dvm CLI may be writing to ${CREDITS_FILE}. Wait a moment and retry. If no other dvm CLI is running, remove ${lockPath} and try again.`,
+    {
+      lock_file: lockPath,
+      underlying: lastError instanceof Error ? lastError.message : String(lastError)
     }
-    return void 0;
-  });
+  );
 }
-function identityFields(identity) {
-  if (!identity) return {};
-  return { dvmId: identity.dvmId, attestedBuilderPubkey: identity.builderPubkey };
+function rejectAsyncBody(result) {
+  if (typeof result?.then !== "function") {
+    return result;
+  }
+  throw new DvmError(
+    "credit_store_lock_misuse",
+    "withCreditLock was called with an asynchronous body. The lock is released when the body returns, so a promise's writes would run unprotected.",
+    "Make the locked body synchronous \u2014 the credit store's whole surface is sync \u2014 and do any awaiting outside the lock."
+  );
 }
-function mutationAt(endpoint, callerPubkey, identity) {
-  return { endpoint, callerPubkey, ...identity ? { identity } : {} };
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
-function matchesDvmIdentity(record, identity) {
-  const stored = dvmLocationIdentity(record);
-  return stored?.dvmId === identity.dvmId && stored.builderPubkey === identity.builderPubkey;
+
+// src/lib/evm-private-key.ts
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { hexToBytes } from "@noble/hashes/utils.js";
+var EVM_PRIVATE_KEY_RE = /^0x[0-9a-fA-F]{64}$/;
+function isValidEvmPrivateKey(value) {
+  return EVM_PRIVATE_KEY_RE.test(value) && secp256k1.utils.isValidSecretKey(hexToBytes(value.slice(2)));
 }
-function matchesDvmOrigin(record, endpoint, identity) {
-  if (identity) {
-    if (dvmLocationIdentity(record) !== void 0) return false;
-    if (record.dvmId !== void 0 && record.dvmId !== identity.dvmId) return false;
+
+// src/lib/config-mutation.ts
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync as existsSync2,
+  readFileSync as readFileSync2,
+  renameSync as renameSync2,
+  statSync,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+var PROTECTED_CONFIG_FIELDS = ["nwcUri", "defaultIdentity", "tempo", "x402"];
+var ProtectedFieldAuthorization = class {
+  /** Targets this authorization covers. A field also covers its own leaves. */
+  targets;
+  /** Prefer {@link authorizeProtectedRemoval}; this exists for it to call. */
+  constructor(targets) {
+    this.targets = [...targets];
   }
-  return dvmLocationOrigins(record).includes(endpoint);
+  /**
+   * True when `target` is one this authorization names. Naming a field covers
+   * the leaves under it; naming a leaf covers only that leaf, so a command
+   * entitled to clear `tempo.apiKey` still cannot take the whole `tempo` block.
+   */
+  covers(target) {
+    if (this.targets.includes(target)) return true;
+    const field = target.split(".")[0];
+    return target !== field && this.targets.includes(field);
+  }
+};
+function authorizeProtectedRemoval(...targets) {
+  return new ProtectedFieldAuthorization(targets);
 }
-function adoptCreditId(record, creditId) {
-  if (record.creditId === creditId) return;
-  if (record.status === "active" || record.status === "expired" || record.status === "unbacked") {
-    const prior = {
-      creditId: record.creditId,
-      status: record.status === "unbacked" ? "unbacked" : "active",
-      currency: record.currency,
-      balanceMicro: record.balanceMicro,
-      remainingMicro: record.remainingMicro,
-      ledgerSeq: record.ledgerSeq,
-      expiryMs: record.expiryMs,
-      expired: record.status === "expired",
-      drainable: record.status !== "unbacked" && record.balanceMicro > 0,
-      ...record.reconciliationPending ? { reconciliationPending: true } : {},
-      observedAt: record.updatedAt
-    };
-    record.siblingCredits = [
-      ...(record.siblingCredits ?? []).filter(
-        (sibling) => sibling.creditId !== prior.creditId && sibling.creditId !== creditId
-      ),
-      prior
-    ];
-  } else if (record.siblingCredits) {
-    record.siblingCredits = record.siblingCredits.filter(
-      (sibling) => sibling.creditId !== creditId
-    );
+function applyConfigPatch(base, patch) {
+  if (!isPlainObject(patch))
+    throw patchShapeError("A change must be an object with `set` and/or `unset`.");
+  if (patch.set !== void 0 && !isPlainObject(patch.set)) {
+    throw patchShapeError("A change's `set` must be an object of fields to write.");
   }
-  record.creditId = creditId;
-  record.ledgerSeq = 0;
-  record.balanceMicro = 0;
-  record.remainingMicro = 0;
-  record.expiryMs = 0;
-  delete record.unsequencedBalance;
-  delete record.rail;
-  delete record.x402Instrument;
-  delete record.x402ChannelNetwork;
-  delete record.refillUnavailableRail;
-  delete record.refillDrainNoticed;
-  delete record.discrepancy;
-  delete record.lastReceiptJobId;
-}
-var MAX_LOST_IMPLICIT_CREDITS = 8;
-var MAX_DATE_MS = 864e13;
-function loadStore() {
-  if (!existsSync2(CREDITS_FILE)) {
-    return { credits: [], implicitCredits: [], pendingFundings: [], fundingMenuSnapshots: [] };
+  if (patch.unset !== void 0 && !Array.isArray(patch.unset)) {
+    throw patchShapeError("A change's `unset` must be an array of field names.");
   }
-  let raw;
-  try {
-    raw = readFileSync2(CREDITS_FILE, "utf-8");
-  } catch (cause) {
-    throw unreadableStore(cause);
+  const set = patch.set ?? {};
+  const unset = patch.unset ?? [];
+  for (const [field, value] of Object.entries(set)) {
+    if (value !== void 0) continue;
+    throw new DvmError(
+      "config_patch_invalid",
+      `Config field '${field}' was declared with no value.`,
+      "Give the field a value, or name it in the change's `unset` list to remove it. An undefined value is how a field gets dropped without anyone deciding to drop it."
+    );
   }
-  let data;
-  try {
-    const parsed = JSON.parse(raw);
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error("the file parsed as JSON but is not a credit-store object");
+  for (const field of unset) {
+    if (typeof field !== "string" || field.length === 0) {
+      throw patchShapeError("Every entry in a change's `unset` must be a field name.");
     }
-    data = parsed;
-  } catch (cause) {
-    throw quarantineCorruptStore(cause);
+    if (!Object.hasOwn(set, field)) continue;
+    throw new DvmError(
+      "config_patch_invalid",
+      `Config field '${field}' is both written and removed by the same change.`,
+      "Declare each field once: in `set` with its new value, or in `unset` to remove it."
+    );
   }
-  const merged = mergeDuplicateCredits(
-    Array.isArray(data.credits) ? data.credits.filter((record) => isObjectRecord(record)).map(
-      (record) => normalizeRailKey(normalizeEvidence(normalizeDrains(normalizeSiblingCredits(record))))
-    ) : []
-  );
-  const snapshots = mergeDuplicateSnapshots(
-    Array.isArray(data.fundingMenuSnapshots) ? data.fundingMenuSnapshots.filter(isFundingMenuSnapshot) : [],
-    merged.credits
-  );
-  const fundings = dedupePendingFundings(
-    Array.isArray(data.pendingFundings) ? data.pendingFundings.filter((funding) => isObjectRecord(funding)).map(normalizeRailKey) : []
-  );
-  const implicit = dedupeImplicitCredits(
-    Array.isArray(data.implicitCredits) ? data.implicitCredits.filter(isStoredImplicitCredit) : []
+  const merged = { ...base, ...set };
+  const removing = new Set(unset);
+  return Object.fromEntries(
+    Object.entries(merged).filter(([field]) => !removing.has(field))
   );
-  const store = {
-    credits: merged.credits,
-    implicitCredits: implicit.credits,
-    pendingFundings: fundings.fundings,
-    fundingMenuSnapshots: snapshots.snapshots
-  };
-  if (merged.changed || snapshots.changed || fundings.changed || implicit.changed) saveStore(store);
-  return store;
 }
-function isStoredImplicitCredit(value) {
-  if (!isObjectRecord(value)) return false;
-  return typeof value.endpoint === "string" && typeof value.callerPubkey === "string" && typeof value.creditId === "string" && value.creditId.startsWith("imp:") && typeof value.currency === "string" && typeof value.remainingMicro === "number" && Number.isFinite(value.remainingMicro) && typeof value.ledgerSeq === "number" && Number.isInteger(value.ledgerSeq) && typeof value.expiryMs === "number" && Number.isFinite(value.expiryMs) && (value.status === "active" || value.status === "lost") && typeof value.releasedByJobId === "string" && typeof value.releasedAt === "number" && Number.isFinite(value.releasedAt) && typeof value.updatedAt === "number" && Number.isFinite(value.updatedAt);
+function deepFreezeConfig(config) {
+  freezeDeep(config);
+  return config;
 }
-function dedupeImplicitCredits(credits) {
-  const merged = [];
-  let changed = false;
-  for (const candidate of credits) {
-    candidate.endpoint = normalizeCreditEndpoint(candidate.endpoint);
-    const identity = dvmLocationIdentity(candidate);
-    const existing = findDvmLocated(merged, {
-      endpoint: candidate.endpoint,
-      ...identity ? { identity } : {},
-      where: (record) => record.callerPubkey === candidate.callerPubkey && record.creditId === candidate.creditId
-    });
-    if (!existing) {
-      merged.push(candidate);
+function protectedRemovals(before, after) {
+  const previous = before;
+  const next = after;
+  const removed = [];
+  for (const field of PROTECTED_CONFIG_FIELDS) {
+    const held = previous[field];
+    if (!isPresentValue(held)) continue;
+    const kept = next[field];
+    if (!isPresentValue(kept)) {
+      removed.push(field);
       continue;
     }
-    changed = true;
-    for (const origin of dvmLocationOrigins(candidate)) {
-      attachDvmLocation(existing, origin, identity);
-    }
-    if (candidate.ledgerSeq > existing.ledgerSeq || candidate.ledgerSeq === existing.ledgerSeq && candidate.updatedAt > existing.updatedAt) {
-      existing.currency = candidate.currency;
-      existing.remainingMicro = candidate.remainingMicro;
-      existing.ledgerSeq = candidate.ledgerSeq;
-      existing.status = candidate.status;
-      if (candidate.lossReason) existing.lossReason = candidate.lossReason;
-      else delete existing.lossReason;
-      existing.updatedAt = candidate.updatedAt;
-      existing.lastReceiptJobId = candidate.lastReceiptJobId;
-      existing.discrepancy = candidate.discrepancy;
+    const spec = PROTECTED_FIELDS[field];
+    if (spec.credentialLeaves.length === 0) continue;
+    if (!isPlainObject(held)) continue;
+    if (!isPlainObject(kept)) {
+      removed.push(field);
+      continue;
     }
-    existing.expiryMs = Math.min(existing.expiryMs, candidate.expiryMs);
-    if (candidate.releasedAt < existing.releasedAt) {
-      existing.releasedAt = candidate.releasedAt;
-      existing.releasedByJobId = candidate.releasedByJobId;
+    for (const leaf of spec.credentialLeaves) {
+      if (!isPresentValue(held[leaf]) || isPresentValue(kept[leaf])) continue;
+      removed.push(`${field}.${leaf}`);
     }
   }
-  const capped = capLostImplicitCredits(merged);
-  return { credits: capped.credits, changed: changed || capped.changed };
-}
-function capLostImplicitCredits(credits) {
-  const lostByOwner = /* @__PURE__ */ new Map();
-  for (const credit of credits) {
-    if (credit.status !== "lost") continue;
-    const identity = dvmLocationIdentity(credit);
-    const dvmKey = identity ? `${identity.dvmId}\0${identity.builderPubkey}` : normalizeCreditEndpoint(credit.endpoint);
-    const key = `${credit.callerPubkey}\0${dvmKey}`;
-    const group = lostByOwner.get(key) ?? [];
-    group.push(credit);
-    lostByOwner.set(key, group);
-  }
-  const dropped = /* @__PURE__ */ new Set();
-  for (const group of lostByOwner.values()) {
-    group.sort((a, b) => b.updatedAt - a.updatedAt);
-    for (const credit of group.slice(MAX_LOST_IMPLICIT_CREDITS)) dropped.add(credit);
-  }
-  return dropped.size === 0 ? { credits, changed: false } : { credits: credits.filter((credit) => !dropped.has(credit)), changed: true };
+  return removed;
 }
-function mergeDuplicateSnapshots(snapshots, credits) {
-  const identities = originIdentityMap(credits);
-  const merged = [];
-  const byIdentity = /* @__PURE__ */ new Map();
-  let changed = false;
-  for (const snapshot of snapshots) {
-    const stamped = identities.get(`${snapshot.callerPubkey}\0${snapshot.endpoint}`);
-    if (stamped !== void 0 && snapshot.dvmId === void 0) {
-      snapshot.dvmId = stamped.dvmId;
-      if (stamped.attestedBuilderPubkey !== void 0) {
-        snapshot.attestedBuilderPubkey = stamped.attestedBuilderPubkey;
-      }
-      changed = true;
-    }
-    if (snapshot.dvmId === void 0) {
-      merged.push(snapshot);
+function supersededProtectedSecrets(before, after) {
+  const previous = before;
+  const next = after;
+  const superseded = [];
+  for (const field of PROTECTED_CONFIG_FIELDS) {
+    const spec = PROTECTED_FIELDS[field];
+    if (!spec.secret) continue;
+    const held = previous[field];
+    const kept = next[field];
+    if (spec.credentialLeaves.length === 0) {
+      if (isPresentValue(held) && isPresentValue(kept) && held !== kept) superseded.push(field);
       continue;
     }
-    const key = `${snapshot.callerPubkey}\0${snapshot.dvmId}\0${snapshot.attestedBuilderPubkey ?? ""}`;
-    const index = byIdentity.get(key);
-    if (index === void 0) {
-      byIdentity.set(key, merged.length);
-      merged.push(snapshot);
-      continue;
+    if (!isPlainObject(held) || !isPlainObject(kept)) continue;
+    for (const leaf of spec.credentialLeaves) {
+      const was = held[leaf];
+      const now = kept[leaf];
+      if (!isPresentValue(was) || !isPresentValue(now) || was === now) continue;
+      superseded.push(`${field}.${leaf}`);
     }
-    merged[index] = mergeSnapshots(merged[index], snapshot);
-    changed = true;
   }
-  return { snapshots: merged, changed };
+  return superseded;
 }
-function mergeSnapshots(left, right) {
-  const leftSeen = Number.isFinite(left.observedAt) ? left.observedAt : 0;
-  const rightSeen = Number.isFinite(right.observedAt) ? right.observedAt : 0;
-  const [newer, older] = rightSeen >= leftSeen ? [right, left] : [left, right];
-  const snapshot = { ...newer };
-  if (snapshot.builderPubkey === void 0 && older.builderPubkey !== void 0) {
-    snapshot.builderPubkey = older.builderPubkey;
+function changedConfigPaths(before, after) {
+  const found = /* @__PURE__ */ new Set();
+  collectChangedPaths(
+    before,
+    after,
+    CONFIG_PATH_SHAPE,
+    "",
+    found
+  );
+  return [...found].sort();
+}
+function assertValidConfig(config, fields) {
+  if (!isPlainObject(config)) {
+    throw new DvmError(
+      "config_invalid",
+      "The caller configuration is not a JSON object.",
+      `Expected an object at ${CONFIG_FILE}.${rollbackSuffix()}`
+    );
+  }
+  const record = config;
+  const scope = fields ? new Set(fields) : null;
+  for (const [field, kind] of Object.entries(CONFIG_FIELD_TYPES)) {
+    if (scope && !scope.has(field)) continue;
+    const value = record[field];
+    if (value === void 0) continue;
+    if (!matchesKind(value, kind)) throw invalidFieldError(field, kind);
+  }
+  for (const [path, kind] of Object.entries(CONFIG_LEAF_TYPES)) {
+    const [field, leaf] = path.split(".");
+    if (scope && !scope.has(field)) continue;
+    const owner = record[field];
+    if (!isPlainObject(owner)) continue;
+    const value = owner[leaf];
+    if (value === void 0 || !matchesKind(value, kind)) throw invalidFieldError(path, kind);
   }
-  const origins = dvmLocationOrigins(newer).concat(dvmLocationOrigins(older));
-  const aliases = [...new Set(origins)].filter((origin) => origin !== snapshot.endpoint);
-  if (aliases.length > 0) snapshot.endpointAliases = aliases;
-  else delete snapshot.endpointAliases;
-  return snapshot;
 }
-function originIdentityMap(credits) {
-  const identities = /* @__PURE__ */ new Map();
-  const ambiguous = /* @__PURE__ */ new Set();
-  for (const record of credits) {
-    if (typeof record.dvmId !== "string" || typeof record.callerPubkey !== "string") continue;
-    const identity = {
-      dvmId: record.dvmId,
-      ...record.attestedBuilderPubkey !== void 0 ? { attestedBuilderPubkey: record.attestedBuilderPubkey } : {}
+function readRawConfig() {
+  if (!existsSync2(CONFIG_FILE)) return null;
+  try {
+    return JSON.parse(readFileSync2(CONFIG_FILE, "utf-8"));
+  } catch {
+    throw new DvmError(
+      "config_corrupt",
+      "Config file is corrupt.",
+      // Not "delete it": those bytes are the only copy on this machine of the
+      // NWC connection string and both private keys, however badly they parse.
+      `Run 'dvm config rollback' to restore a stored copy, or move ${CONFIG_FILE} aside yourself and run 'dvm init'.${rollbackSuffix()}`
+    );
+  }
+}
+function writeConfigFile(config) {
+  writeJsonAtomic(CONFIG_FILE, config);
+}
+var CONFIG_SNAPSHOT_SLOTS = ["backup", "pinned"];
+function configSnapshotPath(slot) {
+  return slot === "pinned" ? CONFIG_PINNED_FILE : CONFIG_BACKUP_FILE;
+}
+function describeConfigBackup(slot = "backup") {
+  const path = configSnapshotPath(slot);
+  try {
+    if (!existsSync2(path)) return null;
+    const stat = statSync(path);
+    const posix = process.platform !== "win32";
+    const mode = stat.mode & 511;
+    return {
+      path,
+      slot,
+      bytes: stat.size,
+      modifiedAt: stat.mtime.toISOString(),
+      modeOctal: posix ? toOctal(mode) : null,
+      ownerOnly: !posix || (mode & 63) === 0
     };
-    for (const origin of dvmLocationOrigins(record)) {
-      const key = `${record.callerPubkey}\0${origin}`;
-      const seen = identities.get(key);
-      if (seen !== void 0 && (seen.dvmId !== identity.dvmId || seen.attestedBuilderPubkey !== identity.attestedBuilderPubkey)) {
-        ambiguous.add(key);
-        continue;
-      }
-      identities.set(key, identity);
-    }
+  } catch {
+    return null;
   }
-  for (const key of ambiguous) identities.delete(key);
-  return identities;
 }
-function dedupePendingFundings(fundings) {
-  const kept = [];
-  const byIntent = /* @__PURE__ */ new Map();
-  let changed = false;
-  for (const funding of fundings) {
-    if (typeof funding.callerPubkey !== "string" || typeof funding.creditId !== "string" || typeof funding.fundId !== "string") {
-      kept.push(funding);
-      continue;
-    }
-    const key = `${funding.callerPubkey}\0${funding.creditId}\0${funding.fundId}`;
-    const index = byIntent.get(key);
-    if (index === void 0) {
-      byIntent.set(key, kept.length);
-      kept.push(funding);
-      continue;
-    }
-    const seen = kept[index];
-    const seenAt = Number.isFinite(seen.requestedAt) ? seen.requestedAt : 0;
-    const at = Number.isFinite(funding.requestedAt) ? funding.requestedAt : 0;
-    if (at > seenAt) kept[index] = funding;
-    changed = true;
+function readConfigBackup(slot = "backup") {
+  const path = configSnapshotPath(slot);
+  if (!existsSync2(path)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf-8"));
+    return isPlainObject(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function retainConfigBackup(slot = "backup") {
+  if (!existsSync2(CONFIG_FILE)) return false;
+  ensureConfigDir();
+  const path = configSnapshotPath(slot);
+  const tmp = `${path}.tmp`;
+  writeFileSync2(tmp, readFileSync2(CONFIG_FILE), { mode: 384 });
+  chmodSync(tmp, 384);
+  commitTmp(tmp, path);
+  return true;
+}
+function writeConfigBackup(config, slot = "backup") {
+  writeJsonAtomic(configSnapshotPath(slot), config);
+}
+function removeConfigBackup(slot = "backup") {
+  const path = configSnapshotPath(slot);
+  if (!existsSync2(path)) return false;
+  unlinkSync2(path);
+  return true;
+}
+function protectedTargetValue(config, target) {
+  const [field, named] = target.split(".");
+  const held = config[field];
+  const leaves = PROTECTED_FIELDS[field].credentialLeaves;
+  const leaf = named ?? (leaves.length > 0 ? leaves[0] : void 0);
+  if (leaf === void 0) return held;
+  return isPlainObject(held) ? held[leaf] : void 0;
+}
+function protectedValuesMatch(target, left, right) {
+  const normalized = comparableProtectedValue(target, left);
+  return normalized !== void 0 && normalized === comparableProtectedValue(target, right);
+}
+function isSecretProtectedTarget(target) {
+  return PROTECTED_FIELDS[target.split(".")[0]].secret;
+}
+function withoutProtectedTargets(config, targets) {
+  const dropping = /* @__PURE__ */ new Set();
+  for (const target of targets) {
+    const field = target.split(".")[0];
+    dropping.add(field);
+    for (const alias of PROTECTED_FIELDS[field].aliases) dropping.add(alias);
+  }
+  return Object.fromEntries(
+    Object.entries(config).filter(([field]) => !dropping.has(field))
+  );
+}
+function appendConfigAudit(record) {
+  try {
+    ensureConfigDir();
+    appendFileSync(CONFIG_AUDIT_FILE, JSON.stringify(record) + "\n", { mode: 384 });
+    chmodSync(CONFIG_AUDIT_FILE, 384);
+  } catch {
+  }
+}
+function protectedRemovalError(targets, reason) {
+  const named = targets.join(", ");
+  const one = targets.length === 1;
+  return new DvmError(
+    "config_protected_field",
+    `The '${reason}' change would remove ${named} from the local configuration.`,
+    `Nothing was written. ${named} ${one ? "is a credential or identity pointer" : "are credentials or identity pointers"} nothing else on this machine records, so only a command that names ${one ? "it" : "them"} explicitly may remove ${one ? "it" : "them"} \u2014 'dvm wallet disconnect', 'dvm wallet tempo-disconnect' and 'dvm wallet x402-disconnect' are those commands.`,
+    { fields: targets }
+  );
+}
+var PROTECTED_FIELDS = {
+  nwcUri: { aliases: [], credentialLeaves: [], secret: true, hexCredential: false },
+  // A pointer at a key, not a key: worth protecting from removal, and never
+  // worth stripping out of a stored copy — that is recovery lost for nothing.
+  defaultIdentity: { aliases: [], credentialLeaves: [], secret: false, hexCredential: false },
+  // `mpp` is the pre-internal-review name; a caller who has not run a mutating command
+  // since the rename still has their private key under it.
+  tempo: { aliases: ["mpp"], credentialLeaves: ["apiKey"], secret: true, hexCredential: true },
+  x402: { aliases: [], credentialLeaves: ["privateKey"], secret: true, hexCredential: true }
+};
+var CONFIG_PATH_SHAPE = {
+  float: { statedBudget: {}, connectedAt: {}, alias: {}, methods: {} },
+  x402: { privateKey: {}, network: {} },
+  tempo: { method: {}, accountId: {}, apiKey: {} },
+  credit: {
+    targetJobs: {},
+    posture: {},
+    tier0Cap: {},
+    tier1Cap: {},
+    pocketTarget: {},
+    fundingRail: {},
+    perDvm: { "*": { targetJobs: {}, posture: {}, fundingRail: {}, dvmId: {}, builderPubkey: {} } },
+    trustOverrides: { "*": {} }
+  },
+  feedback: { posture: {} }
+};
+var CONFIG_FIELD_TYPES = {
+  nwcUri: "string",
+  float: "object",
+  defaultBudget: "string",
+  autoPayThreshold: "string",
+  defaultMaxPayments: "number",
+  cashuMints: "string[]",
+  x402: "object",
+  tempo: "object",
+  defaultRail: "string",
+  defaultIdentity: "string",
+  credit: "object",
+  feedback: "object"
+};
+var CONFIG_LEAF_TYPES = {
+  "float.connectedAt": "string",
+  "x402.privateKey": "string",
+  "tempo.method": "string"
+};
+function collectChangedPaths(before, after, shape, prefix, found) {
+  for (const key of /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])) {
+    const held = before[key];
+    const kept = after[key];
+    if (deepEqual(held, kept)) continue;
+    const known = shape !== void 0 && Object.hasOwn(shape, key);
+    const wildcard = !known && shape !== void 0 && Object.hasOwn(shape, "*");
+    const child = known ? shape[key] : wildcard ? shape["*"] : void 0;
+    const path = prefix ? `${prefix}.${wildcard ? "*" : key}` : key;
+    const descendable = child !== void 0 && Object.keys(child).length > 0 && (held === void 0 || isPlainObject(held)) && (kept === void 0 || isPlainObject(kept));
+    if (descendable) {
+      collectChangedPaths(
+        isPlainObject(held) ? held : {},
+        isPlainObject(kept) ? kept : {},
+        child,
+        path,
+        found
+      );
+    } else {
+      found.add(path);
+    }
   }
-  return { fundings: kept, changed };
 }
-function isObjectRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
+function invalidFieldError(path, kind) {
+  return new DvmError(
+    "config_invalid",
+    `Config field '${path}' must be ${describeKind(kind)}.`,
+    `Nothing was written. Correct the field in ${CONFIG_FILE}, or run 'dvm doctor' for the full picture.${rollbackSuffix()}`
+  );
 }
-function mergeDuplicateCredits(credits) {
-  const merged = [];
-  const byCredit = /* @__PURE__ */ new Map();
-  let changed = false;
-  for (const record of credits) {
-    if (typeof record.creditId !== "string" || typeof record.callerPubkey !== "string") {
-      merged.push(record);
-      continue;
-    }
-    const key = `${record.callerPubkey}\0${record.creditId}`;
-    const index = byCredit.get(key);
-    if (index === void 0) {
-      byCredit.set(key, merged.length);
-      merged.push(record);
-      continue;
-    }
-    merged[index] = mergeCreditRecords(merged[index], record);
-    changed = true;
+function describeKind(kind) {
+  switch (kind) {
+    case "string":
+      return "a string";
+    case "number":
+      return "a number";
+    case "object":
+      return "an object";
+    case "string[]":
+      return "an array of strings";
   }
-  return { credits: merged, changed };
 }
-function mergeCreditRecords(left, right) {
-  const leftUpdated = Number.isFinite(left.updatedAt) ? left.updatedAt : 0;
-  const rightUpdated = Number.isFinite(right.updatedAt) ? right.updatedAt : 0;
-  const [newer, older] = rightUpdated >= leftUpdated ? [right, left] : [left, right];
-  const record = { ...newer };
-  if (record.dvmId === void 0 && older.dvmId !== void 0) record.dvmId = older.dvmId;
-  if (record.attestedBuilderPubkey === void 0 && older.attestedBuilderPubkey !== void 0 && record.dvmId === older.dvmId) {
-    record.attestedBuilderPubkey = older.attestedBuilderPubkey;
-  }
-  if (record.rail === void 0 && older.rail !== void 0) record.rail = older.rail;
-  if (record.x402Instrument === void 0 && older.x402Instrument !== void 0) {
-    record.x402Instrument = older.x402Instrument;
-  }
-  if (record.x402ChannelNetwork === void 0 && older.x402ChannelNetwork !== void 0) {
-    record.x402ChannelNetwork = older.x402ChannelNetwork;
-  }
-  if (record.menu === void 0 && older.menu !== void 0) record.menu = older.menu;
-  if (record.builderPubkey === void 0 && older.builderPubkey !== void 0) {
-    record.builderPubkey = older.builderPubkey;
-  }
-  const endpoints = dvmLocationOrigins(newer).concat(dvmLocationOrigins(older));
-  const aliases = [...new Set(endpoints)].filter((endpoint) => endpoint !== record.endpoint);
-  if (aliases.length > 0) record.endpointAliases = aliases;
-  else delete record.endpointAliases;
-  const pendingDrains = unionPendingDrains(newer.pendingDrains, older.pendingDrains);
-  if (pendingDrains.length > 0) record.pendingDrains = pendingDrains;
-  else delete record.pendingDrains;
-  const drainEvidence = unionDrainEvidence(newer.drainEvidence, older.drainEvidence);
-  if (drainEvidence.length > 0) record.drainEvidence = drainEvidence;
-  else delete record.drainEvidence;
-  const siblings = Array.isArray(newer.siblingCredits) ? newer.siblingCredits : older.siblingCredits;
-  if (siblings) {
-    record.siblingCredits = siblings.filter((sibling) => sibling.creditId !== record.creditId);
-  } else {
-    delete record.siblingCredits;
+function matchesKind(value, kind) {
+  switch (kind) {
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number" && Number.isFinite(value);
+    case "object":
+      return isPlainObject(value);
+    case "string[]":
+      return Array.isArray(value) && value.every((item) => typeof item === "string");
   }
-  return record;
 }
-function unionPendingDrains(preferred, fallback) {
-  const byDrain = /* @__PURE__ */ new Map();
-  for (const drain of [...fallback ?? [], ...preferred ?? []]) {
-    const key = `${drain.drainId}\0${drain.creditId ?? ""}`;
-    byDrain.set(key, { ...byDrain.get(key) ?? {}, ...drain });
-  }
-  return [...byDrain.values()];
+function rollbackSuffix() {
+  const stored = describeConfigBackup() ?? describeConfigBackup("pinned");
+  return stored === null ? "" : ` A stored copy of the previous configuration is at ${stored.path}.`;
 }
-function unionDrainEvidence(preferred, fallback) {
-  const byDrain = /* @__PURE__ */ new Map();
-  for (const evidence of [...fallback ?? [], ...preferred ?? []]) {
-    const key = `${evidence.drainId}\0${evidence.creditId}`;
-    const existing = byDrain.get(key);
-    if (!existing) {
-      byDrain.set(key, evidence);
-      continue;
-    }
-    const [newer, older] = evidence.collectedAt >= existing.collectedAt ? [evidence, existing] : [existing, evidence];
-    const receipts = unionUnknown(newer.receipts, older.receipts);
-    byDrain.set(key, {
-      ...older,
-      ...newer,
-      receipts,
-      collectedAt: Math.max(existing.collectedAt, evidence.collectedAt),
-      ...existing.settledAt !== void 0 || evidence.settledAt !== void 0 ? { settledAt: Math.max(existing.settledAt ?? 0, evidence.settledAt ?? 0) } : {}
-    });
-  }
-  return [...byDrain.values()];
+function writeJsonAtomic(path, value) {
+  ensureConfigDir();
+  const tmp = `${path}.tmp`;
+  writeFileSync2(tmp, JSON.stringify(value, null, 2) + "\n", { mode: 384 });
+  chmodSync(tmp, 384);
+  commitTmp(tmp, path);
 }
-function unionUnknown(preferred, fallback) {
-  const seen = /* @__PURE__ */ new Set();
-  const values = [];
-  for (const value of [...preferred, ...fallback]) {
-    let key;
+function commitTmp(tmp, path) {
+  try {
+    renameSync2(tmp, path);
+  } catch (err) {
     try {
-      const serialized = JSON.stringify(value);
-      key = typeof serialized === "string" ? serialized : String(value);
+      unlinkSync2(tmp);
     } catch {
-      key = String(value);
     }
-    if (seen.has(key)) continue;
-    seen.add(key);
-    values.push(value);
+    throw err;
   }
-  return values;
-}
-function isFundingMenuSnapshot(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const snapshot = value;
-  return typeof snapshot.endpoint === "string" && typeof snapshot.callerPubkey === "string" && typeof snapshot.observedAt === "number" && Number.isFinite(snapshot.observedAt) && Math.abs(snapshot.observedAt) <= MAX_DATE_MS && parseCreditMenu(snapshot.menu) !== void 0 && (snapshot.builderPubkey === void 0 || typeof snapshot.builderPubkey === "string");
 }
-function normalizeRailKey(record) {
-  const loose = record;
-  if (loose.rail === LEGACY_TEMPO_RAIL_KEY) loose.rail = "tempo";
-  if (loose.refillUnavailableRail === LEGACY_TEMPO_RAIL_KEY) loose.refillUnavailableRail = "tempo";
-  if (Array.isArray(loose.pendingDrains)) {
-    for (const drain of loose.pendingDrains) {
-      if (drain?.method === LEGACY_TEMPO_RAIL_KEY) drain.method = "tempo";
-    }
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (Array.isArray(a) || Array.isArray(b)) {
+    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+    return a.every((item, index) => deepEqual(item, b[index]));
   }
-  return record;
-}
-var LEGACY_TEMPO_RAIL_KEY = "mpp";
-function normalizeSiblingCredits(record) {
-  if (!Array.isArray(record.siblingCredits)) {
-    delete record.siblingCredits;
-    return record;
+  if (!isPlainObject(a) || !isPlainObject(b)) return false;
+  for (const key of /* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)])) {
+    if (!deepEqual(a[key], b[key])) return false;
   }
-  record.siblingCredits = record.siblingCredits.filter(
-    (sibling) => isSiblingCredit(sibling) && sibling.creditId !== record.creditId
-  );
-  return record;
+  return true;
 }
-function isSiblingCredit(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const sibling = value;
-  const status = value.status;
-  return typeof sibling.creditId === "string" && typeof sibling.currency === "string" && Number.isSafeInteger(sibling.balanceMicro) && Number.isSafeInteger(sibling.remainingMicro) && Number.isSafeInteger(sibling.ledgerSeq) && Number.isFinite(sibling.expiryMs) && Math.abs(sibling.expiryMs) <= MAX_DATE_MS && typeof sibling.expired === "boolean" && typeof sibling.drainable === "boolean" && (status === void 0 || status === "active" || status === "unbacked") && (sibling.reconciliationPending === void 0 || typeof sibling.reconciliationPending === "boolean") && Number.isFinite(sibling.observedAt) && Math.abs(sibling.observedAt) <= MAX_DATE_MS;
+function isPresentValue(value) {
+  if (value === void 0 || value === null) return false;
+  return typeof value !== "string" || value.trim().length > 0;
 }
-function normalizeDrains(record) {
-  const legacy = record;
-  const drains = (Array.isArray(record.pendingDrains) ? record.pendingDrains : []).filter(
-    isDrainish
+function comparableProtectedValue(target, value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  if (trimmed.length === 0) return void 0;
+  const field = target.split(".")[0];
+  return PROTECTED_FIELDS[field].hexCredential ? trimmed.toLowerCase() : trimmed;
+}
+function patchShapeError(message) {
+  return new DvmError(
+    "config_patch_invalid",
+    message,
+    "A change declares `set` (fields to write) and `unset` (field names to remove). Anything else cannot be applied, and nothing was written."
   );
-  if (isDrainish(legacy.pendingDrain)) drains.unshift(legacy.pendingDrain);
-  delete legacy.pendingDrain;
-  if (drains.length === 0) delete record.pendingDrains;
-  else record.pendingDrains = drains;
-  return record;
 }
-function normalizeEvidence(record) {
-  if (!Array.isArray(record.drainEvidence)) {
-    delete record.drainEvidence;
-    return record;
-  }
-  const evidence = record.drainEvidence.filter(isEvidenceish).map((e) => {
-    const bundle = {
-      ...e,
-      creditId: typeof e.creditId === "string" ? e.creditId : "",
-      collectedAt: Number.isFinite(e.collectedAt) ? e.collectedAt : 0
-    };
-    if (!Number.isFinite(bundle.settledAt)) delete bundle.settledAt;
-    return bundle;
-  });
-  if (evidence.length === 0) delete record.drainEvidence;
-  else record.drainEvidence = evidence;
-  return record;
+function freezeDeep(value) {
+  if (typeof value !== "object" || value === null || Object.isFrozen(value)) return;
+  Object.freeze(value);
+  for (const nested of Object.values(value)) freezeDeep(nested);
 }
-function isEvidenceish(value) {
-  return typeof value === "object" && value !== null && typeof value.drainId === "string" && Array.isArray(value.receipts);
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toOctal(mode) {
+  return "0" + mode.toString(8).padStart(3, "0");
+}
+
+// src/lib/identity.ts
+import lockfile2 from "proper-lockfile";
+var CREDIT_POSTURES = ["suggest", "auto", "off"];
+function isCreditPosture(value) {
+  return typeof value === "string" && CREDIT_POSTURES.includes(value);
+}
+function migrateCreditConfig(config) {
+  const credit = config.credit;
+  if (!credit) return config;
+  const migrateLayer = (layer) => {
+    const railed = migrateFundingRail(layer);
+    if (!("disabled" in railed)) return railed;
+    const { disabled, ...rest } = railed;
+    const migrated = { ...rest };
+    if (migrated.posture === void 0 && disabled === true) migrated.posture = "off";
+    return migrated;
+  };
+  const perDvm = credit.perDvm;
+  return {
+    ...config,
+    credit: {
+      ...migrateLayer(credit),
+      ...perDvm ? {
+        perDvm: Object.fromEntries(
+          Object.entries(perDvm).map(([endpoint, per]) => [endpoint, migrateLayer(per)])
+        )
+      } : {}
+    }
+  };
 }
-function isDrainish(value) {
-  return typeof value === "object" && value !== null && typeof value.drainId === "string";
+function migrateFundingRail(layer) {
+  const loose = layer;
+  if (loose.fundingRail !== "mpp") return layer;
+  return { ...layer, fundingRail: "tempo" };
 }
-function saveStore(store) {
-  ensureConfigDir();
-  const tmp = `${CREDITS_FILE}.${String(process.pid)}.tmp`;
-  writeFileSync2(tmp, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
-  try {
-    renameSync2(tmp, CREDITS_FILE);
-  } catch (err) {
-    try {
-      unlinkSync2(tmp);
-    } catch {
-    }
-    throw err;
-  }
+function migrateTempoWalletKey(config) {
+  const loose = config;
+  if (!loose.mpp || loose.tempo) return config;
+  const { mpp, ...rest } = loose;
+  return { ...rest, tempo: mpp };
 }
-function unreadableStore(cause) {
-  const detail = cause instanceof Error ? cause.message : String(cause);
-  return new DvmError(
-    "credit_store_unreadable",
-    `The prepaid-credit record at ${CREDITS_FILE} exists but could not be opened: ${detail}`,
-    `The file was left untouched. Check that you own it and can read it ('ls -l ${CREDITS_FILE}'), then retry \u2014 'chmod 600 ${CREDITS_FILE}' fixes the common case. Do not delete it: it may hold DVM-signed drain receipts for a refund that is still owed.`,
-    { credits_file: CREDITS_FILE, cause: detail },
-    `Your local record of prepaid credits could not be opened \u2014 this looks like a file-permissions problem on this machine, not damage to the record. Nothing was changed or deleted, so any signed proof of a refund you are owed is still there.`
-  );
+function migrateConfig(config) {
+  return migrateCreditConfig(migrateTempoWalletKey(config));
 }
-function quarantineCorruptStore(cause) {
-  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const quarantined = `${CREDITS_FILE}.corrupt-${stamp}-${String(process.pid)}`;
-  let moved = false;
-  try {
-    renameSync2(CREDITS_FILE, quarantined);
-    moved = true;
-  } catch {
-  }
-  const kept = moved ? quarantined : CREDITS_FILE;
-  return new DvmError(
-    "credit_store_corrupt",
-    moved ? `The prepaid-credit record at ${CREDITS_FILE} is damaged and could not be parsed; it was moved aside to ${quarantined}.` : `The prepaid-credit record at ${CREDITS_FILE} is damaged and could not be parsed, and could not be moved aside.`,
-    `Do not delete ${kept} \u2014 it may hold DVM-signed drain receipts for a refund that is still owed. Balances themselves live on the DVM, so 'dvm credit balance <dvm>' re-reads them.`,
-    {
-      credits_file: CREDITS_FILE,
-      ...moved ? { quarantined_path: quarantined } : {},
-      cause: cause instanceof Error ? cause.message : String(cause)
-    },
-    `The local record of your prepaid credits is damaged. It was set aside at ${kept} rather than overwritten, so any signed proof of a refund you are owed is still in that file. Your credits are held by each DVM, not by this file, so re-reading a balance will restore what the CLI shows.`
-  );
+function loadConfig() {
+  const raw = readRawConfig();
+  return raw === null ? null : migrateConfig(raw);
 }
-function mutateCredit(location, mutate) {
-  withCreditLock(() => {
-    const store = loadStore();
-    const key = normalizeCreditEndpoint(location.endpoint);
-    const record = findDvmLocated(store.credits, {
-      endpoint: key,
-      ...location.identity ? { identity: location.identity } : {},
-      where: (c) => c.callerPubkey === location.callerPubkey
-    });
-    if (!record) return;
-    const locationChanged = attachDvmLocation(record, key, location.identity);
-    if (mutate(record) === "skip") {
-      if (locationChanged) saveStore(store);
-      return;
+async function updateConfig(update) {
+  return withConfigLock(async () => {
+    const raw = readRawConfig();
+    const snapshot = raw === null ? {} : structuredClone(raw);
+    const base = raw === null ? null : migrateConfig(structuredClone(raw));
+    const handed = raw === null ? null : deepFreezeConfig(migrateConfig(structuredClone(raw)));
+    const next = applyConfigPatch(base ?? {}, await runPatch(update, handed));
+    const changed = changedConfigPaths(snapshot, next);
+    if (changed.length === 0) {
+      return {
+        config: base ?? {},
+        previous: base,
+        changed: [],
+        written: false,
+        backup: describeConfigBackup()
+      };
     }
-    record.updatedAt = Date.now();
-    saveStore(store);
+    const removals = protectedRemovals(base ?? {}, next);
+    const unauthorized = removals.filter((target) => update.authorize?.covers(target) !== true);
+    if (unauthorized.length > 0) throw protectedRemovalError(unauthorized, update.reason);
+    assertValidConfig(
+      next,
+      changed.map((path) => path.split(".")[0])
+    );
+    const superseded = supersededProtectedSecrets(base ?? {}, next);
+    const stripped = [
+      .../* @__PURE__ */ new Set([...removals, ...superseded, ...update.sanitizeBackup ?? []])
+    ].filter(isSecretProtectedTarget);
+    const sweeping = update.sweepSlots ?? CONFIG_SNAPSHOT_SLOTS;
+    const swept = [];
+    if (raw !== null) {
+      if (stripped.length > 0) {
+        writeConfigBackup(withoutProtectedTargets(raw, stripped));
+        swept.push("backup");
+      } else {
+        retainConfigBackup();
+      }
+    }
+    if (stripped.length > 0 && sweeping.includes("pinned")) {
+      if (sweepPinnedSnapshot(stripped, base ?? {}, update.reason)) swept.push("pinned");
+    }
+    const backup = describeConfigBackup();
+    writeConfigFile(next);
+    appendConfigAudit({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      event: "update",
+      reason: update.reason,
+      fields: changed,
+      ...removals.length > 0 ? { removed: removals } : {},
+      ...superseded.length > 0 ? { superseded } : {},
+      ...swept.length > 0 ? { sweptSlots: swept } : {},
+      backup: backup !== null,
+      pid: process.pid
+    });
+    return { config: next, previous: base, changed, written: true, backup };
   });
 }
-var DEFAULT_LOCK_STALE_MS = 1e4;
-var DEFAULT_LOCK_RETRIES = 600;
-var DEFAULT_LOCK_RETRY_INTERVAL_MS = 25;
-var lockDepth = 0;
-function acquireCreditLock(opts) {
+async function withConfigLock(fn) {
   ensureConfigDir();
-  const lockPath = `${CREDITS_FILE}.lock`;
-  const stale = opts.stale ?? DEFAULT_LOCK_STALE_MS;
-  const retries = opts.retries ?? DEFAULT_LOCK_RETRIES;
-  const interval = opts.retryIntervalMs ?? DEFAULT_LOCK_RETRY_INTERVAL_MS;
-  let lastError;
-  for (let attempt = 0; attempt <= retries; attempt += 1) {
-    try {
-      return lockfile2.lockSync(CREDITS_FILE, {
-        lockfilePath: lockPath,
-        stale,
-        realpath: false
-      });
-    } catch (err) {
-      lastError = err;
-      if (err.code !== "ELOCKED") {
-        const detail = err instanceof Error ? err.message : String(err);
-        const configDir = dirname(lockPath);
-        throw new DvmError(
-          "credit_store_lock_failed",
-          `Could not create the prepaid-credit lock at ${lockPath}: ${detail}`,
-          `This is not contention \u2014 nothing is holding the lock. Check that ${configDir} exists and is writable by you ('ls -ld ${configDir}'), then retry.`,
-          {
-            lock_file: lockPath,
-            config_dir: configDir,
-            underlying: detail,
-            errno_code: err.code
-          },
-          `The dvm CLI could not create the small lock file it uses to keep two commands from writing your credit record at once. Its folder looks unwritable \u2014 nothing about your credits is wrong, and nothing was changed.`
-        );
-      }
-      if (attempt === retries) break;
-      sleepSync(interval);
-    }
+  let release;
+  try {
+    release = await lockfile2.lock(CONFIG_FILE, {
+      lockfilePath: `${CONFIG_FILE}.lock`,
+      realpath: false,
+      stale: 3e4,
+      retries: { retries: 10, factor: 1, minTimeout: 100, maxTimeout: 100 }
+    });
+  } catch {
+    throw new DvmError(
+      "config_locked",
+      "Another dvm process is updating the local configuration.",
+      "Wait a moment and retry."
+    );
   }
-  throw new DvmError(
-    "credit_store_locked",
-    `Could not acquire the prepaid-credit lock at ${lockPath} within the retry budget.`,
-    `Another dvm CLI may be writing to ${CREDITS_FILE}. Wait a moment and retry. If no other dvm CLI is running, remove ${lockPath} and try again.`,
-    {
-      lock_file: lockPath,
-      underlying: lastError instanceof Error ? lastError.message : String(lastError)
+  try {
+    return await fn();
+  } finally {
+    await release().catch(() => void 0);
+  }
+}
+async function runPatch(update, current) {
+  try {
+    return await update.patch(current);
+  } catch (err) {
+    if (err instanceof TypeError && /read only|not extensible|frozen|cannot delete property|cannot add property/i.test(
+      err.message
+    )) {
+      throw new DvmError(
+        "config_patch_invalid",
+        `The '${update.reason}' change tried to modify the configuration it was handed.`,
+        "Nothing was written. A change declares what it wants through its `set` and `unset` lists; editing the current config in place bypasses the protected-field gate, so the object is frozen."
+      );
     }
-  );
+    throw err;
+  }
 }
-function rejectAsyncBody(result) {
-  if (typeof result?.then !== "function") {
-    return result;
+function sweepPinnedSnapshot(targets, departing, reason) {
+  if (describeConfigBackup("pinned") === null) return false;
+  const pinned = readConfigBackup("pinned");
+  if (pinned === null) {
+    return retireSlot(`${reason}:unreadable_pin`, "pinned");
   }
-  throw new DvmError(
-    "credit_store_lock_misuse",
-    "withCreditLock was called with an asynchronous body. The lock is released when the body returns, so a promise's writes would run unprotected.",
-    "Make the locked body synchronous \u2014 the credit store's whole surface is sync \u2014 and do any awaiting outside the lock."
+  const migrated = migrateConfig(structuredClone(pinned));
+  const matching = targets.filter(
+    (target) => protectedValuesMatch(
+      target,
+      protectedTargetValue(departing, target),
+      protectedTargetValue(migrated, target)
+    )
   );
+  if (matching.length === 0) return false;
+  const sanitized = withoutProtectedTargets(pinned, matching);
+  const changed = changedConfigPaths(pinned, sanitized);
+  if (changed.length === 0) return false;
+  writeConfigBackup(sanitized, "pinned");
+  appendConfigAudit({
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    event: "backup_sanitized",
+    reason,
+    fields: changed,
+    removed: matching,
+    slot: "pinned",
+    backup: describeConfigBackup() !== null,
+    pid: process.pid
+  });
+  return true;
 }
-function sleepSync(ms) {
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+function retireSlot(reason, slot) {
+  if (!removeConfigBackup(slot)) return false;
+  appendConfigAudit({
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    event: "backup_retired",
+    reason,
+    fields: [],
+    slot,
+    backup: describeConfigBackup() !== null,
+    pid: process.pid
+  });
+  return true;
 }
 
 export {
@@ -1546,12 +1626,17 @@ export {
   parseCreditMenu,
   normalizeCreditEndpoint,
   fundingReachableAt,
+  pendingDrainFor,
+  loadCredit,
   listCredits,
   listPendingFundings,
   loadPendingFunding,
   recordPendingFunding,
   clearPendingFunding,
   recordFundResponse,
+  ensureProvisionalCredit,
   loadCreditX402Binding,
-  recordCreditX402Instrument
+  recordCreditX402Instrument,
+  recordPendingDrain,
+  clearPendingDrain
 };